Network message tracing method based on SRv6 and storage medium

Abstract

The invention relates to the technical field of communication, and discloses an SRv6-based network message tracing method and a storage medium, the method is applied to an SRv6 probe, and comprises the following steps: determining a source address of each message based on a mirroring data stream, the mirroring data stream being a data stream in a loop where the SRv6 probe is located, and the mirroring data stream being a data stream in the loop where the SRv6 probe is located; the destination label of each message is determined based on the composition type of each message, the destination label represents the address of the message reaching the data stream forwarding node of the last hop, each source address, each destination label and each inner layer message are associated and then transmitted to a software defined network SDN controller through a situation awareness system, and the SDN controller sends the message to the data stream forwarding node of the last hop. And the SDN controller determines the access node of the message with the abnormal flow according to the inner layer message, the source address and the destination label, so that additional configuration of an APN ID and the like and additional bandwidth overhead of a DOH selectable head and the like are omitted, and the scheme deployment is simple and convenient to maintain.

Description

Technical Field

[0001] The present application relates to the field of communication technology and provides a method and storage medium for tracing a network message based on SRv6. Background Art

[0002] Usually, in the process of network message processing, the access node is responsible for the encapsulation and decapsulation of the network message, and the intermediate node is responsible for the forwarding of the message. When the intermediate node processes the data packet, it cannot obtain the access node entry information of the message entering the network based on the forwarded message. In scenarios where attack source tracing is required, traffic sampling and other technologies are generally used for source tracing. However, a sampling ratio that is too low cannot meet the tracing requirements, and a sampling ratio that is too high will affect the performance of the device and require a large amount of sampling resources and equipment investment.

[0003] Based on the above problems, the wide area network APN6 traceability network security linkage solution is often used at present, that is, the APNID is configured at the access node. The above APN ID carries the device identifier, interface identifier and VPN identifier, and the APN ID and related identifiers are encoded into the APN Attribute field of the data forwarding plane. The APN Attribute is carried in the DOH (Destination Options Header) of IPv6, and then the APN6 probe is deployed at the intermediate node of the network forwarding. The APN6 probe transmits the collected data flow information and the APN ID to the situation awareness system, and the situation awareness system completes the big data intelligent correlation analysis. In addition, it is necessary to statically import the relationship between the APN ID and the device identifier, interface identifier and VPN identifier carried by the APN ID in the SDN controller to form a traceability table. If a threat occurs, the situation awareness system sends a blocking policy carrying the APN ID, and the SDN controller queries the traceability table according to the APN ID to obtain the threat location and sends a blocking policy to achieve the blocking of abnormal traffic.

[0004] However, in the above solution, the APN ID information needs to be uniformly deployed across the entire network, which makes the implementation of the solution difficult. The limited length of each field of the APN ID leads to a limited network scale supported by the solution. In addition, the above traceability table can only be maintained manually, which is difficult to use and prone to errors. When the network configuration changes, the traceability table needs to be manually synchronized, which has poor maintainability. In addition, the introduction of the DOH optional header increases the length of the network message, increases the length of the non-load message, and wastes bandwidth. Summary of the invention

[0005] The embodiments of the present application provide a method and storage medium for tracing the source of network messages based on SRv6, so as to simplify the deployment scheme and improve the maintainability of the scheme.

[0006] The specific technical solutions provided by this application are as follows:

[0007] In a first aspect, an embodiment of the present application provides a method for tracing the source of a network message based on SRv6, which is applied to an SRv6 probe, and the method includes:

[0008] Determine the source address of each message based on the mirrored data stream, where the mirrored data stream is the data stream in the loop where the SRv6 probe is located, the data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node, the loop is connected in parallel with the data stream forwarding node, and the message adopts SRv6 segment routing technology;

[0009] Determine the destination label of each message based on the composition type of each message, wherein the destination label represents the address of the data flow forwarding node where the message reaches the last hop;

[0010] After associating each source address, each destination label and each inner layer message, the message is transmitted to the software defined network SDN controller through the situation awareness system, so that the SDN controller determines the access node of the message with abnormal traffic according to the inner layer message, the source address and the destination label, wherein the inner layer message is obtained after the SRv6 probe unloads the SRv6 message header of the message.

[0011] Optionally, determining a destination label of each message based on a component type of each message includes:

[0012] If the composition type of each message indicates that the message does not include an SRv6 SRH message header, extracting a DA field from the IPv6 message header of the message, and determining the DA field as a destination label of the message; or

[0013] If the composition type of each message indicates that the message includes an SRv6 SRH message header, the destination label of the message is determined according to the storage format of the message and the SRv6 SRH message header.

[0014] Optionally, the destination label of the message is determined according to the storage format of the message and the SRv6 SRH message header, including:

[0015] If the storage format of the message is uncompressed, determining the first pointer value based on the SRv6 SRH message header, and determining the destination label of the message based on the first pointer value; or

[0016] If the storage format of the message is compressed, determine a first pointer value and a second pointer value based on the SRv6 SRH message header, and determine a destination label of the message based on the first pointer value and the second pointer value, wherein the message includes at least two compression label segments;

[0017] The first pointer value represents the data flow forwarding node that the message currently arrives at, and the second pointer value represents the compression label segment currently executed by the message.

[0018] Optionally, determining a first pointer value based on an SRv6 SRH message header, and determining a destination label of the message based on the first pointer value includes:

[0019] Extract the Segments Left value from the SRv6 SRH message header and determine the Segments Left value as the first pointer value;

[0020] If the first pointer value indicates that the data flow forwarding node currently arriving at the message is the data flow forwarding node of the last hop, the DA field extracted from the IPv6 message header is determined as the destination label of the message; or

[0021] If the first pointer value indicates that the data flow forwarding node currently arriving at the message is not the data flow forwarding node of the last hop, the first pointer value is assigned until the message reaches the data flow forwarding node of the last hop, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the message.

[0022] Optionally, determining a first pointer value and a second pointer value based on an SRv6 SRH message header, and determining a destination label of the message based on the first pointer value and the second pointer value includes:

[0023] Extract the Segments Left value and the SI value from the SRv6 SRH message header, determine the Segments Left value as the first pointer value, and determine the SI value as the second pointer value;

[0024] Determine whether the message has reached the data flow forwarding node of the last hop according to the first pointer value;

[0025] If so, the destination label of the message is determined according to the second pointer value; otherwise, the first pointer value is assigned a value until the message reaches the data flow forwarding node of the last hop.

[0026] Optionally, determining a destination label of the message according to the second pointer value includes:

[0027] If the second pointer value indicates that the compressed label segment currently executed by the message is the last compressed label segment, the DA field extracted from the IPv6 message header is determined as the destination label of the message; or

[0028] If the second pointer value indicates that the compression label segment currently executed by the message is not the last compression label segment, the second pointer value is assigned until the message executes the last compression label segment, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the message.

[0029] In a second aspect, an embodiment of the present application provides a method for tracing the source of a network message based on SRv6.

[0030] The method is applied to the SDN controller, including:

[0031] Parse each inner layer message received. If it is determined that the traffic of any inner layer message is abnormal, then search for the destination VPN instance associated with the received source address and destination label according to the preset correspondence between the source address, destination label and VPN instance. The source address, destination label and inner layer message are associated and transmitted to the SDN controller through the situation awareness system. The source address is determined by the SRv6 probe based on each message in the mirrored data stream. The destination label is determined by the SRv6 probe based on the composition type of each message. The inner layer message is obtained after the SRv6 probe unloads the SRv6 message header of the message. The mirrored data stream is the data stream in the loop where the SRv6 probe is located. The data flow value of the mirrored data stream is equal to the data flow value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node. The message adopts SRv6 segment routing technology. The destination label represents the address of the data stream forwarding node where the message arrives at the last hop.

[0032] An access node of the message with abnormal traffic is determined according to the destination VPN instance, and a blocking policy is issued to the access node according to the abnormal traffic N-tuple, wherein the abnormal traffic N-tuple is determined based on the message with abnormal traffic.

[0033] In a third aspect, an SRv6 probe includes:

[0034] A memory for storing executable instructions;

[0035] A processor is used to read and execute executable instructions stored in a memory to implement any method as described in the first aspect.

[0036] In a fourth aspect, an SDN controller includes:

[0037] A memory for storing executable instructions;

[0038] The processor is used to read and execute the executable instructions stored in the memory to implement the method of the second aspect.

[0039] In a fifth aspect, a computer-readable storage medium is provided. When instructions in the storage medium are executed by a processor, the processor is enabled to execute the method described in any one of the first and second aspects above.

[0040] The beneficial effects of this application are as follows:

[0041] In summary, in an embodiment of the present application, a method and storage medium for tracing the source of a network message based on SRv6 is provided. The method is applied to an SRv6 probe, including: determining the source address of each message based on a mirrored data stream, wherein the mirrored data stream is a data stream in a loop where the SRv6 probe is located, the data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node, the loop and the data stream forwarding node are connected in parallel, the message adopts SRv6 segment routing technology, and the destination label of each message is determined based on the composition type of each message, wherein the destination label represents the address of the data stream forwarding node where the message arrives at the last hop, and each source address, each destination label and each inner layer message are associated and transmitted to a software defined network SDN controller through a situation awareness system, so that the SDN controller determines the access node of the message with abnormal traffic according to the inner layer message, the source address and the destination label, wherein the inner layer message is obtained after the SRv6 probe unloads the SRv6 message header of the message, and the above-mentioned method of confirming the access node of the message with abnormal traffic using the native SRv6 message header eliminates the APN. The solution is simple to deploy and maintain, with additional configurations such as ID and additional bandwidth overhead for the optional header of DOH.

[0042] Other features and advantages of the present application will be described in the subsequent description, and partly become apparent from the description, or be understood by practicing the present application. The purpose and other advantages of the present application can be realized and obtained by the structures specifically pointed out in the written description, claims, and drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0044] Figure 1 A schematic diagram of the system architecture for SRv6-based network message tracing in an embodiment of the present application;

[0045] Figure 2 A schematic diagram of a process of an SRv6 probe performing SRv6-based network message tracing in an embodiment of the present application;

[0046] Figure 3 A schematic diagram of a process for determining a destination tag of each message based on the composition type of each message in an embodiment of the present application;

[0047] Figure 4 A schematic diagram of a process for determining a destination label of a message based on an SRv6 SRH message header in an embodiment of the present application;

[0048] Figure 5A flow chart of a method for tracing a network message based on SRv6 performed by an SDN controller in an embodiment of the present application;

[0049] Figure 6 This is a schematic diagram of the physical architecture of the SRv6 probe in the embodiment of the present application;

[0050] Figure 7 Schematic diagram of the physical architecture of the SDN controller in the embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the technical solution of the present application, rather than all of the embodiments. Based on the embodiments recorded in the application documents, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the technical solution of the present application.

[0052] The terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented using sequences other than those illustrated or described herein.

[0053] The preferred implementation modes of the present application are described in detail below with reference to the accompanying drawings.

[0054] See also Figure 1 As shown, in the embodiment of the present application, the system includes at least one SRv6 probe, an SDN controller and a situation awareness system. Figure 1 In the figure, router 1, router 2 and router n are used to exemplify data flow access nodes and data flow forwarding nodes. In order to obtain the source address and destination label of the message, in the embodiment of the present application, an SRv6 probe is usually set at the aggregation node, that is, the data flow forwarding node with larger forwarding traffic. Usually, two aggregation nodes are selected in the network to set SRv6 probes respectively. When the data flows of different user terminals are connected to the network through different access nodes of the data flow, they will be further uploaded to the cloud after passing through the data flow forwarding node and the aggregation node. During the transmission process of uploading to the cloud, some user terminal data flows will have abnormal traffic due to threats. In the embodiment of the present application, the SRv6 probe will collect the source address and destination label of the data flow, and transmit the source address and destination label to the SDN controller via the situation awareness system, so that the SDN controller can determine the access node of the message with abnormal traffic.

[0055] In order to facilitate a detailed description of the solutions in the embodiments of the present application, the following technical terms are first introduced:

[0056] Segment Routing over IPv6 (SRv6) is a segment routing technology based on the IPv6 forwarding plane, which aims to achieve flexible path selection and processing by encoding packet headers in the network programming framework.

[0057] Segment Routing Ipv6 Traffic Engineering Policy (SRv6 TE Policy) is a segment routing technology based on the IPv6 forwarding plane. It aims to implement traffic engineering through source routing mechanism, thereby improving network quality and meeting end-to-end service requirements.

[0058] The extended version of segment routing G-SRv6 (Generalized Segment Routing over Ipv6) is an extended version of SRv6, which is designed to optimize the performance of SRv6 and promote its large-scale deployment. G-SRv6 significantly reduces the overhead of the segment list by introducing generalized segment identifiers (G-SIDs) and compressed segment identifiers (C-SIDs), thereby reducing the overhead of the SRv6 message header.

[0059] SDN (Software Defined Networking) is a network architecture that aims to achieve flexible management and automation of the network by separating the control plane and data plane of the network.

[0060] In the embodiment of the present application, the implementation of the SRv6-based network message tracing method is mainly divided into two aspects: the SRv6 probe side and the SDN controller side. The following first introduces the situation where the SRv6-based network message tracing method is executed by the SRv6 probe. Figure 2 As shown, in the embodiment of the present application, a specific process of tracing the source of a network message based on SRv6 is as follows:

[0061] Step 201: Determine the source address of each message based on the mirror data stream, wherein the mirror data stream is the data stream in the loop where the SRv6 probe is located, the data stream value of the mirror data stream is equal to the data stream value of the forwarding data stream of the data stream forwarding node, the loop is connected in parallel with the data stream forwarding node, and the message adopts SRv6 segment routing technology.

[0062] In order not to affect the transmission of the forwarded data stream between each data stream forwarding node, in an embodiment of the present application, the above-mentioned forwarded data stream will be copied to obtain a mirrored data stream, that is, the data stream will be mirrored to the SRv6 probe based on the port or fixed traffic characteristics at the data stream forwarding node, so that the data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node, and the above-mentioned mirrored data stream will be introduced into the loop where the SRv6 probe is located, so that the SRv6 probe can directly operate on the mirrored data stream, avoiding the impact on the forwarded data stream.

[0063] During the implementation process, a data flow forwarding node that plays a major forwarding role in the network is usually selected to set up an SRv6 probe. At the same time, in order to ensure the security of the network, the number of the above-mentioned SRv6 probes is at least two, that is, two data flow forwarding nodes that play a major forwarding role are selected in the network, and loops are established in parallel at both ends of each data flow forwarding node, and one of the above-mentioned SRv6 probes is set in each loop.

[0064] Since, when the network is deployed, the SDN controller or other configuration device will send VPN configuration and SRv6 configuration to each access node and each data stream forwarding node in the network, in the embodiment of the present application, the SRv6 probe restores the source and destination key information of the message according to the mirror data stream, so as to prepare for message tracing. In the specific implementation process, the SRv6 probe will first obtain the Ipv6 message header of each message according to the mirror data stream, and further extract the SA field from the Ipv6 message header, and determine the above SA field as the source address of each message, that is, as the source Ipv6 router-id.

[0065] Step 202: Determine the destination label of each message based on the component type of each message, wherein the destination label represents the address of the data flow forwarding node where the message reaches the last hop.

[0066] Considering that the source address and destination label are one-to-one associated with the access node of the message, after determining the source address of the message, the destination label of the message must be further determined. It should be noted that the message will pass through multiple different data flow forwarding nodes in the process from the access node to the cloud, and the message will be forwarded between any two nodes according to the path information. The above-mentioned destination label represents the address of the data flow forwarding node where the message arrives at the last hop, that is, the destination label includes all the path information of the message from the access node through multiple data flow forwarding nodes and reaching the data flow forwarding node of the last hop.

[0067] In the embodiment of the present application, the destination tag of each message is determined based on the component type of each message, specifically including:

[0068] Case 1: If the composition type of each message indicates that the message does not include an SRv6 SRH message header, the DA field is extracted from the IPv6 message header of the message, and the DA field is determined as the destination label of the message; or

[0069] Taking into account the different composition types of each message, during the implementation process, the SRv6 probe will first detect whether there is an SRv6 SRH message header in the mirrored data stream. If the message does not include an SRv6 SRH message header, it will obtain the IPv6 message header from the message, extract the DA field from the IPv6 message header, and determine the obtained DA field as the destination label of the message.

[0070] The second case: if the composition type of each message indicates that the message includes an SRv6 SRH message header, the destination label of the message is determined according to the storage format of the message and the SRv6 SRH message header.

[0071] During the implementation process, the SRv6 probe detects the mirrored data flow and determines that the message includes an SRv6 SRH message header. It will further determine the destination label of the message based on the storage format of the message and the SRv6 SRH message header. It should be noted that the storage format of the above message includes uncompressed and compressed. The uncompressed storage format usually refers to the various fields of the data flow forwarding nodes corresponding to different hops being arranged in sequence in the message. The compressed storage format usually refers to the various fields of the data flow forwarding nodes corresponding to different hops being arranged in the message in the format of compressed label segments.

[0072] The above method determines the destination label of a message based on the storage format of the message and the SRv6 SRH message header, including:

[0073] Case 1: If the storage format of the message is uncompressed, the first pointer value is determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value. Or

[0074] The first thing to explain is that the first pointer value represents the data flow forwarding node where the message currently arrives, that is, the above-mentioned first pointer value corresponds one-to-one to the data flow forwarding node where the message is located during the forwarding process. As the message is forwarded between the data flow forwarding nodes in the network, the value of the above-mentioned first pointer value is also constantly changing.

[0075] The above determines the first pointer value based on the SRv6 SRH message header, and determines the destination label of the message based on the first pointer value, see Figure 3 As shown, including:

[0076] Step 2021: Extract the Segments Left value from the SRv6 SRH message header, and determine the Segments Left value as the first pointer value.

[0077] The Segments Left value is stored as a field in the SRv6 SRH message header. During the implementation process, after determining that the storage format of the message is uncompressed, the SRv6 probe extracts the SegmentsLeft value from the SRv6 SRH message header included in the message, and determines the extracted Segments Left value as the first pointer value.

[0078] Step 2022: If the first pointer value indicates that the data flow forwarding node currently arriving at the message is the data flow forwarding node of the last hop, the DA field extracted from the IPv6 message header is determined as the destination label of the message.

[0079] During the implementation process, after extracting the first pointer value, the above-mentioned first pointer value is further analyzed to determine whether the data flow forwarding node currently arriving at the message is the data flow forwarding node of the last hop. For example, the above-mentioned first pointer value can be used to check whether the address of the data flow forwarding node of the last hop is included. If it is included, it means that the data flow forwarding node currently arriving at the message is the data flow forwarding node of the last hop; if it is not included, it means that the data flow forwarding node currently arriving at the message is not the data flow forwarding node of the last hop.

[0080] After determining through the first pointer value that the data flow forwarding node currently reached by the message is the data flow forwarding node of the last hop, the DA field is directly extracted from the IPv6 message header, and the DA field is determined as the destination label of the message.

[0081] Step 2023: If the first pointer value indicates that the data flow forwarding node currently arriving at the message is not the data flow forwarding node of the last hop, the first pointer value is assigned until the message reaches the data flow forwarding node of the last hop, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the message.

[0082] After determining through the first pointer value that the data flow forwarding node that the message currently arrives at is not the data flow forwarding node of the last hop, an assignment operation is performed on the first pointer value, for example, a subtraction operation is performed on the first pointer value, so that the data flow forwarding node pointed to by the first pointer value changes, and the above assignment operation is stopped until the message corresponding to the first pointer value reaches the data flow forwarding node of the last hop.

[0083] Furthermore, when the first pointer value after the assignment operation makes the message reach the data flow forwarding node of the last hop, the value of the DA field is updated using G-SID Container[SL], and the updated DA field is determined as the destination label of the message. The above SL is the abbreviation of Segment Left, and G-SID Container[SL] means the G-SID Container pointed to by SL. In the G-SRv6 scheme, a generalized SID (G-SID) is used to directly refer to a compressed SID, and the space carrying multiple compressed SIDs is called a G-SID Container.

[0084] Case 2: If the storage format of the message is compressed, the first pointer value and the second pointer value are determined based on the SRv6 SRH message header, and the destination label of the message is determined based on the first pointer value and the second pointer value, wherein the message includes at least two compression label segments.

[0085] It should be noted that the second pointer value represents the compression label segment currently executed by the message. Usually, the message includes at least two compression label segments, and one compression label segment includes a complete set of fields for the data flow forwarding node. Since the storage format of the message is compressed, the second pointer value can reflect the field corresponding to the data flow forwarding node currently reached by the message, but a corresponding decompression step is required to obtain it. In the specific implementation process, the first pointer value is used to determine the data flow forwarding node currently reached by the message, and the second pointer value is used to determine the compression label segment currently executed by the message, but a decompression step is required to obtain the destination label of the message.

[0086] The above-mentioned determination of the first pointer value and the second pointer value based on the SRv6 SRH message header, and the determination of the destination label of the message based on the first pointer value and the second pointer value, refer to Figure 4 As shown, specifically including:

[0087] Step 2021': Extract Segment from SRv6 SRH header S Left value and SI (SID Index, SI) value, and determine the Segments Left value as the first pointer value and the SI value as the second pointer value.

[0088] First of all, it should be noted that the message encapsulation format of SRv6 is: add a new IPv6 basic header and SRv6 message header (Segment Routing Header, SRH) in front of the original three-layer data message. SRH is a routing extension header with a routing type value of 4. The Next Header value in the IPv6 basic header is 43, indicating that the next message header is a routing extension header. The routing type field value of the routing extension header is 4, indicating that the routing extension header is SRH. SRH mainly includes the following parts: Next Header: 8 bits, used to identify the type of the next message header. Hdr Ext Len: 8 bits, indicating the length of the SRH header in units of 8 bytes, excluding the first 8 bytes. Routing Type: 8 bits, routing type field, value 4, indicating that it carries SRH. Segments Left: 8 bits, identifies the number of the next SID to be viewed, the initial value is n-1 (n represents the number of SIDs in the routing extension header), and it decreases by 1 for each node passed. Last Entry: 8 bits, the number of the first SID in the actual forwarding path of the message in the SRH header. Flags: 8 bits, flag information. Tag: 16 bits, used to mark a group of messages with the same characteristics. Segment List: SID list. Arranged in the order of nodes from far to near on the message forwarding path, that is, Segment List[0] represents the last SID of the path, Segment List[1] represents the second to last SID of the path, and so on.

[0089] In addition, from the composition of G-SID, it can be seen that the method of using G-SID to calculate the destination address is to concatenate the G-SID in the Segment List with the Common Prefix to form a new destination address. Among them: Common Prefix: Common prefix, manually configured by the administrator. G-SID: SID compressed according to 32 bits, obtained from SRH. SI value: used to locate the G-SID in a group of G-SIDs. SI is the lowest two bits of the destination address, with a value of 0 to 3. Every time a node that compresses the SID is passed, the SI value decreases by 1. If the SI value is 0, the SL value decreases by 1. In a group of G-SIDs in the Segment List, the G-SIDs are arranged from left to right in the order of SI from small to large, that is, the SI of the leftmost G-SID is 0, and the SI of the rightmost G-SID is 3. 0: If the sum of the bits of CommonPrefix, G-SID and SI is less than 128 bits, the middle bits are padded with 0.

[0090] Since the Segments Left value is stored as a field in the SRv6 SRH message header, during the implementation process, after determining that the storage format of the message is compressed, the message is first decompressed, and then the SRv6 probe extracts the Segments Left value from the SRv6 SRH message header included in the message, and determines the extracted Segments Left value as the first pointer value. In addition, the SRv6 probe extracts the SI value from the SRv6 SRH message header included in the message, and determines the extracted SI value as the second pointer value.

[0091] Step 2022': Determine whether the message has reached the data flow forwarding node of the last hop according to the first pointer value. If yes, execute step 2023'; otherwise, execute step 2024'.

[0092] During the implementation process, after extracting the first pointer value, it is determined whether the data flow forwarding node currently arriving at the message is the data flow forwarding node of the last hop based on the first pointer value. Similarly, it is possible to search in the above-mentioned first pointer value whether the address of the data flow forwarding node of the last hop is included. If it is included, it means that the data flow forwarding node currently arriving at the message is the data flow forwarding node of the last hop; if it is not included, it means that the data flow forwarding node currently arriving at the message is not the data flow forwarding node of the last hop.

[0093] Step 2023': Determine the destination label of the message according to the second pointer value.

[0094] When it is determined according to the first pointer value that the message has arrived at the data flow forwarding node of the last hop, the destination label of the message is further determined according to the second pointer value. The above-mentioned determining the destination label of the message according to the second pointer value includes:

[0095] (1) If the second pointer value indicates that the compressed label segment currently executed by the message is the last compressed label segment, the DA field extracted from the IPv6 message header is determined as the destination label of the message; or

[0096] During the implementation process, the value of the second pointer value, that is, the value of the above-mentioned SI value, is used to determine whether the compression label segment currently executed by the message is the last compression label segment. For example, when the SI value is zero, it indicates that the second pointer value has pointed to the last compression label segment. In this case, the above-mentioned compression label segment is decompressed, and the IPv6 message header is obtained therefrom, and the DA field is further extracted from the IPv6 message header, and the extracted DA field is determined as the destination label of the message.

[0097] (2) If the second pointer value indicates that the compression label segment currently executed by the message is not the last compression label segment, the second pointer value is assigned a value until the message executes the last compression label segment, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the message.

[0098] During the implementation process, the value of the second pointer value, that is, the value of the above-mentioned SI value, is used to determine whether the compression label segment currently executed by the message is not the last compression label segment. For example, when the SI value is not equal to zero, it means that the second pointer value has not yet pointed to the last compression label segment. In this case, the second pointer value is assigned, that is, the SI value is reduced by one until the SI value is equal to zero. In this way, the second pointer value can point to the last compression label segment through the assignment operation, that is, the message is forced to execute to the last compression label segment.

[0099] In order to ensure the accuracy of the destination label, in this case, the DA field in the IPv6 packet header needs to be updated, for example, the value of the DA field is updated with Common Prefix G-SID Container[0].(G-SID[SI])SI Padding, where the Common Prefix len bit is the value of the Common Prefix len bit before the DA field before the update, and the G-SID len bit is the value of Container[0].G-SID[SI] after the SI value is reduced by one. In this way, the updated DA field is determined as the destination label of the packet.

[0100] It is necessary to add that in the G-SRv6 solution, the generalized SID (G-SID) is used to directly refer to the compressed SID, and the space carrying multiple compressed SIDs is called a G-SID Container. Under this naming system, a G-SID can be a compressed SID, a standard SRv6 SID or other SID, so it is called a generalized SID. A G-SID Container can carry a standard SRv6 SID or 1 to 4 32-bit compressed G-SIDs.

[0101] Step 2024': the first pointer value is assigned a value until the message reaches the data flow forwarding node of the last hop.

[0102] During the implementation process, when it is determined based on the first pointer value that the data flow forwarding node that the message currently arrives at is not the data flow forwarding node of the last hop, an assignment operation is performed on the first pointer value, for example, a subtraction operation is performed on the first pointer value, so that the data flow forwarding node pointed to by the first pointer value changes, and the above assignment operation is stopped until the message corresponding to the first pointer value reaches the data flow forwarding node of the last hop.

[0103] It should be additionally explained that, after the message reaches the data flow forwarding node of the last hop through the first pointer value after the assignment operation, the destination label of the message is determined in combination with the second pointer value.

[0104] Step 203: After associating each source address, each destination label and each inner layer message, the associated information is transmitted to a software defined network (SDN) controller via a situation awareness system, so that the SDN controller determines the access node of the message with abnormal traffic according to the inner layer message, the source address and the destination label, wherein the inner layer message is obtained after the SRv6 probe unloads the SRv6 message header of the message.

[0105] It should be noted that in addition to obtaining the source address and destination label of each message, the SRv6 probe will also unload the SRv6 message header of the message to obtain the inner message. Since the SDN controller sends the source address, destination label and inner message to the same access node at the same time when sending the VPN configuration and SRv6 configuration, the SRv6 probe will associate the source address, destination label and inner message of the same access node and send them to the situation awareness system, and the situation awareness system will send the associated source address, destination label and inner message to the SDN controller.

[0106] It should be noted that the above situation awareness system does not have the ability to trace the access node of the message with abnormal traffic, but the situation awareness system is the connection node between the SRv6 probe and the SDN controller. After the SDN controller determines the access node of the message with abnormal traffic, the situation awareness system can report the access node to the maintenance center.

[0107] Then, the SDN controller determines the access node of the message with abnormal traffic according to the inner layer message, source address and destination label. The following describes the method of network message tracing based on SRv6 performed by the SDN controller. Figure 5 As shown, in the embodiment of the present application, a specific process of tracing the source of a network message based on SRv6 is as follows:

[0108] Step 301: parse each received inner layer message. If it is determined that the traffic of any inner layer message is abnormal, search for the destination VPN instance associated with the received source address and destination label according to the preset correspondence between the source address, destination label and VPN instance. The source address, destination label and inner layer message are associated and transmitted to the SDN controller through the situation awareness system. The source address is determined by the SRv6 probe based on each message in the mirrored data stream. The destination label is determined by the SRv6 probe based on the composition type of each message. The inner layer message is obtained after the SRv6 probe unloads the SRv6 message header of the message. The mirrored data stream is the data stream in the loop where the SRv6 probe is located. The data flow value of the mirrored data stream is equal to the data flow value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node. The message adopts SRv6 segment routing technology. The destination label represents the address of the data stream forwarding node where the message arrives at the last hop.

[0109] During the implementation process, when the SDN controller receives the associated pair of source address, destination label and inner message, the SDN controller first parses each received inner message to determine which inner message has abnormal traffic. It should be noted that the cause of the above traffic abnormality may be caused by network attacks, viruses, etc.

[0110] Since, for an access node, the source address, destination label and VPN instance have a one-to-one correspondence with it, after determining the inner layer message with abnormal traffic, the SDN controller will search for the VPN instance associated with the received source address and destination label in the preset correspondence between the source address, destination label and VPN instance established when sending the configuration, and determine the found associated VPN instance as the destination VPN instance. In the embodiment of the present application, the destination VPN instance has a one-to-one correspondence with the access node with abnormal traffic.

[0111] It should also be noted that the source address, destination label and inner message are associated and then passed to the SDN controller through the situation awareness system. The source address is determined by the SRv6 probe based on each message in the mirrored data stream. The destination label is determined by the SRv6 probe based on the composition type of each message. The inner message is obtained after the SRv6 probe unloads the SRv6 message header of the message. The mirrored data stream is the data stream in the loop where the SRv6 probe is located. The data flow value of the mirrored data stream is equal to the data flow value of the forwarded data stream of the data stream forwarding node. The loop is connected in parallel with the data stream forwarding node. The message adopts SRv6 segment routing technology. The destination label represents the address of the data stream forwarding node where the message reaches the last hop. I will not go into details here.

[0112] Step 302: Determine the access node of the message with abnormal traffic according to the destination VPN instance, and issue a blocking policy to the access node according to the abnormal traffic N-tuple, wherein the abnormal traffic N-tuple is determined based on the message with abnormal traffic.

[0113] Since there is a one-to-one correspondence between VPN instances and access nodes, after determining the destination VPN instance, the SDN controller will further determine the corresponding access node based on the destination VPN instance, that is, determine the access node of the message with abnormal traffic. In order to prevent the message with abnormal traffic from continuing to threaten the network, during the implementation process, the SDN controller will also parse the abnormal traffic N-tuple from the message with abnormal traffic, and send a blocking strategy to the access node based on the abnormal traffic N-tuple, that is, prevent the message with abnormal traffic from continuing to transmit traffic to the network.

[0114] Based on the same inventive concept, refer to Figure 6 As shown, an embodiment of the present application provides an SRv6 probe, including: a memory 601, used to store executable instructions; a processor 602, used to read and execute the executable instructions stored in the memory, and execute any one of the methods of the first aspect above.

[0115] Based on the same inventive concept, refer to Figure 7 As shown, an embodiment of the present application provides an SDN controller, including: a memory 701, used to store executable instructions; a processor 702, used to read and execute the executable instructions stored in the memory, and execute the method of the second aspect above.

[0116] Based on the same inventive concept, an embodiment of the present application provides a computer-readable storage medium. When the instructions in the storage medium are executed by a processor, the processor is enabled to execute the method described in any one of the first and second aspects above.

[0117] In summary, in an embodiment of the present application, a method and storage medium for tracing the source of a network message based on SRv6 is provided. The method is applied to an SRv6 probe, including: determining the source address of each message based on a mirrored data stream, wherein the mirrored data stream is a data stream in a loop where the SRv6 probe is located, the data stream value of the mirrored data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node, the loop and the data stream forwarding node are connected in parallel, the message adopts SRv6 segment routing technology, and the destination label of each message is determined based on the composition type of each message, wherein the destination label represents the address of the data stream forwarding node where the message arrives at the last hop, and each source address, each destination label and each inner layer message are associated and transmitted to a software defined network SDN controller through a situation awareness system, so that the SDN controller determines the access node of the message with abnormal traffic according to the inner layer message, the source address and the destination label, wherein the inner layer message is obtained after the SRv6 probe unloads the SRv6 message header of the message, and the above-mentioned method of confirming the access node of the message with abnormal traffic using the native SRv6 message header eliminates the APN. The solution is simple to deploy and maintain, with additional configurations such as ID and additional bandwidth overhead for the optional header of DOH.

[0118] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program product systems. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product system implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0119] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program product systems according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0120] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0121] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0122] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A method for tracing the source of network messages based on SRv6, characterized in that: Applied to SRv6 probes, the method comprises: Determine the source address of each message based on the mirror data stream, wherein the mirror data stream is the data stream in the loop where the SRv6 probe is located, the data stream value of the mirror data stream is equal to the data stream value of the forwarded data stream of the data stream forwarding node, the loop is connected in parallel with the data stream forwarding node, and the message adopts SRv6 segment routing technology; Determine a destination label of each message based on the composition type of each message, wherein the destination label represents the address of the data flow forwarding node where the message reaches the last hop; After associating each source address, each destination label and each inner layer message, the associated information is transmitted to a software defined network (SDN) controller via a situation awareness system, so that the SDN controller determines the access node of the message with abnormal traffic according to the inner layer message, the source address and the destination label, wherein the inner layer message is obtained after the SRv6 probe unloads the SRv6 message header of the message.

2. The method according to claim 1, characterized in that The determining of the destination label of each message based on the composition type of each message includes: If the composition type of each message indicates that the message does not include an SRv6 SRH message header, extracting a DA field from an IPv6 message header of the message, and determining the DA field as the destination label of the message; or If the composition type of each message indicates that the message includes an SRv6 SRH message header, the destination label of the message is determined according to the storage format of the message and the SRv6 SRH message header.

3. The method according to claim 2, characterized in that The determining the destination label of the message according to the storage format of the message and the SRv6SRH message header includes: If the storage format of the message is uncompressed, determining a first pointer value based on the SRv6 SRH message header, and determining the destination label of the message based on the first pointer value; or If the storage format of the message is compressed, determining a first pointer value and a second pointer value based on the SRv6 SRH message header, and determining the destination label of the message based on the first pointer value and the second pointer value, wherein the message includes at least two compression label segments; The first pointer value represents the data flow forwarding node that the message currently arrives at, and the second pointer value represents the compression label segment that the message currently executes.

4. The method according to claim 3, characterized in that The determining a first pointer value based on the SRv6 SRH message header, and determining the destination label of the message based on the first pointer value, includes: Extracting a Segments Left value from the SRv6 SRH message header, and determining the Segments Left value as the first pointer value; If the first pointer value indicates that the data flow forwarding node currently reached by the message is the data flow forwarding node of the last hop, the DA field extracted from the ipv6 message header is determined as the destination label of the message; or If the first pointer value indicates that the data flow forwarding node currently arriving at the message is not the data flow forwarding node of the last hop, the first pointer value is assigned until the message reaches the data flow forwarding node of the last hop, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the message.

5. The method according to claim 3, characterized in that The determining a first pointer value and a second pointer value based on the SRv6 SRH message header, and determining the destination label of the message based on the first pointer value and the second pointer value, includes: Extracting a Segments Left value and an SI value from the SRv6 SRH message header, and determining the Segments Left value as the first pointer value, and determining the SI value as the second pointer value; Determine whether the message reaches the data flow forwarding node of the last hop according to the first pointer value; If so, the destination label of the message is determined according to the second pointer value; otherwise, the first pointer value is assigned until the message reaches the data flow forwarding node of the last hop.

6. The method according to claim 5, characterized in that The determining the destination label of the message according to the second pointer value includes: If the second pointer value indicates that the compressed label segment currently executed by the message is the last compressed label segment, the DA field extracted from the IPv6 message header is determined as the destination label of the message; or If the second pointer value indicates that the compression label segment currently executed by the message is not the last compression label segment, the second pointer value is assigned until the message executes the last compression label segment, and the value of the DA field is updated, and the updated DA field is determined as the destination label of the message.

7. A method for tracing the source of network messages based on SRv6, characterized in that: The method is applied to an SDN controller, comprising: Parse each received inner layer message, if it is determined that the flow of any one of the inner layer messages is abnormal, then search for the destination VPN instance associated with the received source address and destination label according to the preset correspondence between the source address, the destination label and the VPN instance, wherein the source address, the destination label and the inner layer message are associated and transmitted to the SDN controller via the situation awareness system, the source address is determined by the SRv6 probe based on each message in the mirrored data stream, the destination label is determined by the SRv6 probe based on the composition type of each message, the inner layer message is obtained after the SRv6 probe unloads the SRv6 message header of the message, the mirrored data stream is the data stream in the loop where the SRv6 probe is located, the data flow value of the mirrored data stream is equal to the data flow value of the forwarded data stream of the data stream forwarding node, the loop is connected in parallel with the data stream forwarding node, the message adopts SRv6 segment routing technology, and the destination label represents the address of the data stream forwarding node where the message reaches the last hop; An access node of the message with abnormal traffic is determined according to the destination VPN instance, and a blocking policy is issued to the access node according to an abnormal traffic N-tuple, wherein the abnormal traffic N-tuple is determined based on the message with abnormal traffic.

8. An SRv6 probe, characterized in that: include: A memory for storing executable instructions; A processor, configured to read and execute the executable instructions stored in the memory to implement the method according to any one of claims 1 to 6.

9. An SDN controller, characterized in that: include: A memory for storing executable instructions; A processor, configured to read and execute the executable instructions stored in the memory to implement the method according to claim 7.

10. A computer-readable storage medium, characterized in that: When the instructions in the storage medium are executed by a processor, the processor is enabled to perform the method according to any one of claims 1 to 7.

Images