Message detection method, electronic equipment, system and computer readable storage medium

Abstract

The invention provides a message detection method, an electronic device, a system and a computer readable storage medium, and relates to the technical field of communication security. Detection mark information used for carrying out risk indication on a service message is set in the service message. And in the process of forwarding the service message in the forwarding path, the security device forwards the service message carrying the detection mark information, or updates the value of a field in the service message according to a detection result after performing security detection on the service message before forwarding. And the network equipment sends the flow security state information to the network management analysis equipment according to the detection mark information carried in the service message, so that a control layer can be assisted to identify a service flow forwarding path with risks.

Description

Technical Field

[0001] The present application relates to the field of communication security technology, and in particular to a message detection method, electronic equipment, system and computer-readable storage medium. Background Art

[0002] Firewall technology is a technology that helps a computer network build a relatively isolated protective barrier between its internal and external networks, thereby protecting user data and information security.

[0003] Currently, when a firewall finds that a computer network is under attack during operation, it will block some messages, such as discarding data packets (also known as "packet loss") to ensure the security of computer network operation. However, network operation and maintenance personnel cannot know the reason for traffic packet loss, nor can they know the threatening message forwarding path in the network, which affects business security. Summary of the invention

[0004] The embodiments of the present application provide a message detection method, electronic device, system and computer-readable storage medium, which help solve the problem that the network management analyzer cannot identify the risk message forwarding path in the business flow by setting detection mark information in the message to indicate the risk.

[0005] In order to achieve the above objectives, this application adopts the following technical solutions:

[0006] In a first aspect, a message detection method is provided, the method comprising: a security device receives a first service message from a previous-hop device on a service flow forwarding path, the message header of the first service message includes detection mark information, the detection mark information includes a first field, and the value of the first field is used to indicate whether there is a risk in the first service message; the security device sends a second service message to a next-hop device on the service flow forwarding path, wherein the second service message is the same as the first service message, or the second service message is obtained by updating the value of the first field in the first service message.

[0007] The solution provided in the first aspect above sets detection mark information in the business message and indicates risks for the business message based on the detection mark information. In this way, the network management analyzer can identify risky business flow forwarding paths based on the detection mark information in the business message, thereby ensuring the security of the business.

[0008] As a possible implementation method, if the value of the first field in the first service message is a second value, and the second value indicates that the first service message is at risk, the security device sends a second service message to the next-hop device on the service flow forwarding path, including: the security device sends the second service message to the next-hop device on the service flow forwarding path, and the first service message is the same as the second service message. In this way, when the value of the first field in the first service message indicates that the first service message is at risk, the second service message sent to the next-hop device is the same as the first service message, which enables the service message indicated as being at risk to maintain the risk mark during forwarding, thereby assisting the network management analyzer in identifying the risk path and ensuring service security.

[0009] Exemplarily, when the value of the first field in the first business message is the second value, if the security detection result of the security device on the first business message indicates that there is no risk to the first business message, the value of the first field in the detection mark information is not updated. In this way, the obtained second business message is the same as the first business message.

[0010] Exemplarily, when the value of the first field in the first business message is the second value, if the security detection result of the security device on the first business message indicates that there is a risk in the first business message, the value of the first field in the detection mark information is not updated. In this way, the obtained second business message is the same as the first business message. As a possible implementation method, if the value of the first field in the first service message is a first value, the first value indicates that the first service message does not have a risk, before the security device sends the second service message to the next hop device on the service flow forwarding path, the method also includes: the security device performs a security detection on the first service message; the security device sends the second service message to the next hop device on the service flow forwarding path, including: in response to the security device's security detection result on the first service message indicating that the first service message does not have a risk, the security device sends the second service message to the next hop device on the service flow forwarding path, and the first service message is the same as the second service message; in response to the security device's security detection result on the first service message indicating that the first service message has a risk, the security device sends the second service message to the next hop device on the service flow forwarding path, and the second service message is obtained by updating the value of the first field of the first service message to the second value, and the second value indicates that the second service message has a risk. In this way, by identifying risky service messages in the service flow through security detection, and indicating risky service messages based on detection tag information, it can assist the network management analyzer in identifying risky paths and ensure service security.

[0011] The security device performs security detection on the first service message, including: detecting whether the flow identification information of the first service message is the same as the flow identification information of the third service message with risk that has been detected by the security device, and whether the first service message includes malicious features.

[0012] For example, if the flow identification information in the first service message is the same as the flow identification information of the third service message that has been detected by the security device and is at risk, and / or the first service message includes malicious features, the security device's security detection result on the first service message indicates that the first service is at risk. If the flow identification information in the first service message is different from the flow identification information of the third service message that has been detected by the security device and is at risk, and the first service message does not include malicious features, the security device's security detection result on the first service message indicates that the first service is not at risk.

[0013] Exemplarily, in response to the security device's security detection result on the first business message indicating that the first business message is at risk, the security device sends a second business message to the next-hop device on the business flow forwarding path, including: if the flow identification information of the first business message is the same as the flow identification information of the third business message that the security device has detected to be at risk, but the first business message does not include malicious features, sending the second business message to the next-hop device on the business flow forwarding path.

[0014] As a possible implementation, the detection mark information in the first service message also includes a second field, the value of the second field is used to indicate whether the first service message has been security detected, and the security device performs security detection on the first service message, including: in response to the value of the second field in the detection mark information in the first service message being a third value, the third value indicating that the first service message has not been security detected, the security device performs security detection on the first service message, and before the security device sends the second service message to the next hop device on the service flow forwarding path, the method also includes: updating the value of the second field of the first service message to a fourth value, the fourth value indicating that the first service message has been security detected, thereby obtaining the second service message. In this way, it is convenient for the security device to perform targeted processing on the service message, for example, focusing on performing security detection on the message that has not been security detected, reducing the number of service messages that the security device needs to perform security detection on, and helping the security device to improve processing efficiency.

[0015] As a possible implementation, before the security device performs security detection on the first service message, the method further includes: in response to the value of the second field in the detection tag information in the first service message being a fourth value, the security device omits the step of performing security detection on the first service message. In this way, it is convenient for the security device to perform targeted processing on the service message, for example, omitting the re-execution of security detection on the message that has been security detected, reducing the number of service messages that the security device needs to perform security detection on, and improving processing efficiency.

[0016] As a possible implementation mode, the security device performs a security detection on the first business message, including: the security device determines whether the flow identification information of the first business message is the same as the flow identification information of the third business message that the security device has detected as having a risk; in response to the flow identification information of the first business message being the same as the flow identification information of the third business message that the security device has detected as having a risk, the security device determines that the security detection result of the first business message indicates that the first business message is at risk; in response to the flow identification information of the first business message being different from the flow identification information of the third business message that the security device has detected as having a risk, the security device determines that the first business message is at risk. Whether the service message includes malicious features in the malicious feature library; in response to the flow identification information of the first service message being different from the flow identification information of the third service message that has been detected by the security device and is at risk, and the first service message does not include malicious features in the malicious feature library, determine that the security detection result of the first service message indicates that the first service message does not have risks; in response to the flow identification information of the first service message being different from the flow identification information of the third service message that has been detected by the security device and is at risk, and the first service message includes malicious features in the malicious feature library, determine that the security detection result of the first service message indicates that the first service message has risks. In this way, by matching the flow identification information of the first service message with the flow identification information of the third service message that is at risk, and performing content security detection on the first service message, security detection of the first service message is implemented from multiple dimensions, which can improve the security of the network, and through security detection in multiple dimensions, risky service messages with potential threats can be identified, and then the network management analyzer can be assisted in identifying the attacked service flow forwarding path based on the service messages with potential threats.

[0017] Exemplarily, the flow identification information includes one or more of the following: address information of the source end, address information of the destination end, port number of the source end, port number of the destination end, and protocol type.

[0018] As a possible implementation, the detection mark information further includes a third field, and the value of the third field is used to indicate the risk type of the risk when the first service message has a risk. In this way, through the third field, more abundant risk information can be provided to the network management analyzer, which facilitates the network management analyzer to perform further analysis, association and other processing, and better ensure business security.

[0019] Exemplarily, the risk type includes one or more of the following: file-related risks, protocol-related risks, and website (world wide web, WEB)-related risks.

[0020] As a possible implementation, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. In this way, it is convenient for service messages to carry detection mark information and realize the identification of risky service flow forwarding paths.

[0021] As a possible implementation, the first service message includes an in-situ flow information telemetry (IFIT) message header, and the detection tag information is located in the IFIT message header. In this way, by carrying the detection tag information in the in-situ flow information telemetry message header, the network management analyzer can identify the delay and packet loss in the service flow while identifying the forwarding path of the risky service flow.

[0022] As a possible implementation, the first service message is a segment routing over IPv6 (SRv6) protocol message based on IPv6, and the IFIT message header is located in the extended header SRH (segment routing header) of the first service message; or, the first service message is a multiprotocol label switching (MPLS) protocol message, and the IFIT message header is located in the MPLS message header of the first service message. In this way, different types of service messages can carry detection tag information, thereby assisting the network management analyzer in identifying the forwarding path of risky service flows.

[0023] In a second aspect, a message detection method is provided, the method comprising: a first network device encapsulates business flow data to be transmitted to obtain a first business message, the message header of the first business message includes detection mark information, the detection mark information includes a first field, the value of the first field is set to a first numerical value, and the first numerical value is used to indicate that there is no risk in the first business message; the first network device sends the first business message to a next-hop device on the business flow forwarding path.

[0024] Among them, the first network device is a source node on the service flow forwarding path.

[0025] The solution provided in the second aspect above encapsulates the detection mark information in the business message through the source node, and indicates the risk of the business message based on the detection mark information, so that the network management analyzer can identify the risky business flow forwarding path according to the detection mark information in the business message, thereby ensuring the security of the business.

[0026] As a possible implementation, the detection mark information further includes a second field, the value of the second field is set to a third value, and the third value is used to indicate that the first service message has not been security detected. In this way, by indicating whether the first service message is security-checked through the second field, it is possible to facilitate the security device to perform targeted processing on the service message and improve processing efficiency.

[0027] As a possible implementation, the detection mark information further includes a third field, the value of the third field is set to a fifth value, and the fifth value is used to indicate that the risk type of the first service message is to be set. By setting the third field, it is easy for the network management analyzer to identify the risk type, thereby ensuring service security.

[0028] Exemplarily, the risk type includes one or more of the following: file-related risks, protocol-related risks, and website-related risks.

[0029] As a possible implementation, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. In this way, it is convenient for service messages to carry detection mark information and realize the identification of risky service flow forwarding paths.

[0030] As a possible implementation, the first service message includes an IFIT message header for in-flow detection, and the detection mark information is located in the IFIT message header. In this way, by carrying the detection mark information in the in-flow detection message header, the network management analyzer can identify the delay and packet loss in the service flow while identifying the forwarding path of the risky service flow.

[0031] As a possible implementation method, the first service message is an SRv6 protocol message, and the IFIT message header is located in the extended header SRH of the first service message; or, the first service message is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the first service message. In this way, different types of service messages can carry detection tag information, thereby assisting the network management analyzer in identifying the forwarding path of the risky service flow.

[0032] As a possible implementation, the method further includes: the first network device sends flow security status information to the network management analyzer, and the flow security status information is used to indicate whether the first service message is at risk. By sending the flow security status information to the network management analyzer, the network management analyzer can detect the forwarding path of the service flow message at risk based on the flow security status information.

[0033] As a possible implementation, the flow security status information includes the flow identification information and detection tag information of the first service message. Thus, by sending the flow security status information to the network management analyzer, the network management analyzer can detect whether there is a risk in the forwarding path of the first service message according to the flow identification information and detection tag information of the first service message.

[0034] According to a third aspect, a message detection method is provided, the method comprising: a second network device receives a second service message from a previous-hop device on a service flow forwarding path, the message header of the second service message includes detection mark information, the detection mark information includes a first field, and the value of the first field is used to indicate whether the second service message is at risk; the second network device sends flow security status information to a network management analyzer, and the flow security status information is used to indicate whether the second service message is at risk.

[0035] Optionally, the second network device is an intermediate node on the service flow forwarding path. Optionally, the second network device is a tail node on the service flow forwarding path.

[0036] The solution provided in the third aspect above, by setting detection mark information in the business message, indicating risks for the business message based on the detection mark information, and sending flow security status information to the network management analyzer, can enable the network management analyzer to identify risky business flow forwarding paths based on the detection mark information, thereby ensuring the security of the business.

[0037] As a possible implementation, the detection mark information further includes a second field, and the value of the second field is used to indicate whether the second service message has been security detected. In this way, by indicating whether the first service message has been security detected through the second field, it is possible to facilitate the security device to perform targeted processing on the service message and improve processing efficiency.

[0038] As a possible implementation, the detection mark information also includes a third field, and the value of the third field is used to indicate the risk type of the risk when the second business message has a risk. In this way, by setting the third field, it is easy to identify the risk type at the management and control analysis layer, thereby ensuring business security.

[0039] Exemplarily, the risk type includes one or more of the following: file-related risks, protocol-related risks, and website-related risks.

[0040] As a possible implementation, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. In this way, it is convenient for service messages to carry detection mark information and realize the identification of risky service flow forwarding paths.

[0041] As a possible implementation, the second service message includes an IFIT message header for in-flow detection, and the detection mark information is located in the IFIT message header. In this way, by carrying the detection mark information in the in-flow detection message header, the network management analyzer can identify the delay and packet loss in the service flow while identifying the forwarding path of the risky service flow.

[0042] As a possible implementation, the second service message is an SRv6 protocol message, and the IFIT message header is located in the extended header SRH of the second service message; or, the second service message is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the second service message. In this way, different types of service messages can carry detection tag information, thereby assisting the network management analyzer in identifying the forwarding path of the risky service flow.

[0043] As a possible implementation, the flow security status information includes the flow identification information and the detection mark information of the second service message. Thus, by sending the flow security status information to the network management analyzer, the network management analyzer can detect whether there is a risk in the forwarding path of the second service message according to the flow identification information and the detection mark information of the second service message.

[0044] As a possible implementation, the method further includes: in response to the second network device being an intermediate node on the service flow forwarding path, the second network device sends a second service message to a next-hop device on the service flow forwarding path, so that the second service message can be forwarded to the destination network node.

[0045] In a fourth aspect, a message detection method is provided, the method comprising: a network management analyzer receives flow security status information from a network device, the flow security status information comprises flow identification information of a service message and detection tag information, the detection tag information comprises a first field, the value of the first field is used to indicate whether the service message is at risk; when the value of the first field indicates that the service message is at risk, an alarm message is output, the alarm information comprises an identification of a service flow forwarding path at risk, or an identification of some nodes in the service flow forwarding path at risk, the identification of the service flow forwarding path at risk is determined based on the flow identification information.

[0046] The solution provided in the fourth aspect above sets detection mark information in the business message and indicates risks for the business message based on the detection mark information. In this way, after receiving the flow security status information, the network management analyzer can identify the risky business flow forwarding path based on the detection mark information in the flow security status information, thereby ensuring the security of the business.

[0047] In a fifth aspect, a security device is provided, which includes a receiving unit, a security detection unit and a sending unit; wherein the receiving unit is used to receive a first business message from a previous-hop device on a business flow forwarding path, and the message header of the first business message includes detection mark information, and the detection mark information includes a first field, and the first field is used to indicate whether there is a risk in the first business message; the sending unit is used to send a second business message to a next-hop device on the business flow forwarding path, wherein the second business message is the same as the first business message, or the second business message is obtained by updating the value of the first field in the first business message; the security detection unit is used to perform security detection on the first business message.

[0048] The beneficial effects of the security device provided in the fifth aspect can be found in the description of any implementation in the first aspect, and will not be repeated here. The security device has the function of implementing the behavior in the method example of any implementation in the first aspect above. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0049] In a sixth aspect, a network device is provided, comprising a processing unit and a sending unit; wherein the processing unit is used to encapsulate the business flow data to be transmitted, thereby obtaining a first business message, the message header of the first business message includes detection mark information, the detection mark information includes a first field, the value of the first field is set to a first numerical value, and the first numerical value is used to indicate that there is no risk in the first business message; the sending unit is used to send the first business message to the next-hop device on the business flow forwarding path.

[0050] The beneficial effects of the network device provided in the sixth aspect can be found in the description of any implementation in the second aspect, and will not be repeated here. The network device has the function of implementing the behavior in the method example of any implementation in the second aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0051] In the seventh aspect, a network device is provided, comprising a receiving unit and a sending unit, wherein the receiving unit is used to receive a second service message from a previous-hop device on a service flow forwarding path, the message header of the second service message comprising detection mark information, the detection mark information comprising a first field, and the value of the first field is used to indicate whether there is a risk in the second service message; the sending unit is used to send flow security status information to a network management analyzer, the flow security status information is used to indicate whether there is a risk in the second service message; the sending unit is used to send the second service message to a next-hop device on the service flow forwarding path when the network device is an intermediate node on the service flow forwarding path.

[0052] The beneficial effects of the network device provided in the seventh aspect can be found in the description of any implementation in the third aspect, and will not be repeated here. The first network device has the function of implementing the behavior in the method example of any implementation in the third aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0053] In an eighth aspect, a network management analyzer is provided, the network management analyzer includes a receiving unit and an alarm unit, wherein the receiving unit is used to receive flow security status information from a network device, the flow security status information includes flow identification information of a business message, and detection mark information, the detection mark information includes a first field, and the value of the first field is used to indicate whether the business message is at risk; the alarm unit is used to output alarm information when the value of the first field indicates that the business message is at risk, the alarm information includes an identification of a business flow forwarding path at risk, or an identification of some nodes in the business flow forwarding path at risk, the identification of the business flow forwarding path at risk is determined based on the flow identification information.

[0054] The beneficial effects of the network management analyzer provided in the eighth aspect can be found in the description of any implementation in the fourth aspect, and will not be repeated here. The first network device has the function of implementing the behavior in the method example of any implementation in the fourth aspect. The function can be implemented by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above functions.

[0055] In a ninth aspect, an electronic device is provided, comprising: a memory for storing computer program instructions; and a processor for executing computer program instructions to support the electronic device to implement a method as described in any possible implementation of the first aspect, or to implement a method as described in any possible implementation of the second aspect, or to implement a method as described in any possible implementation of the third aspect, or to implement a method as described in any possible implementation of the fourth aspect.

[0056] In the tenth aspect, a service flow transmission system is provided, comprising one or more security devices, one or more network devices and a network management analyzer; the security device is used to execute the method described in any possible implementation manner of the first aspect, the network device is used to execute the method described in any possible implementation manner of the second aspect or the method described in any possible implementation manner of the third aspect, and the network management analyzer is used to execute the method described in any possible implementation manner of the fourth aspect.

[0057] In the eleventh aspect, a computer-readable storage medium is provided, on which computer program instructions are stored. When the computer program instructions are executed by a processing circuit, the method described in any possible implementation manner in the first aspect is implemented, or the method described in any possible implementation manner in the second aspect is implemented, or the method described in any possible implementation manner in the third aspect is implemented, or the method described in any possible implementation manner in the fourth aspect is implemented.

[0058] In the twelfth aspect, a chip system is provided, the chip system includes a processing circuit and a storage medium, and the storage medium stores computer program instructions; when the computer program instructions are executed by the processing circuit, the method described in any possible implementation manner in the first aspect is implemented, or the method described in any possible implementation manner in the second aspect is implemented, or the method described in any possible implementation manner in the third aspect is implemented, or the method described in any possible implementation manner in the fourth aspect is implemented.

[0059] In the thirteenth aspect, a computer program product comprising instructions is provided. When the computer program product is run on a computer, the computer executes a method as described in any possible implementation of the first aspect, or a method as described in any possible implementation of the second aspect, or a method as described in any possible implementation of the third aspect, or a method as described in any possible implementation of the fourth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0060] Figure 1 An application scenario diagram of the message detection method provided in an embodiment of the present application;

[0061] Figure 2 A schematic diagram of a service chain provided in an embodiment of the present application;

[0062] Figure 3 A schematic diagram of the principle of out-of-band detection provided in an embodiment of the present application;

[0063] Figure 4 A schematic diagram of the principle of in-band detection provided in an embodiment of the present application;

[0064] Figure 5 A schematic diagram of the IFIT encapsulation format in an IPv6 network environment provided by an embodiment of the present application;

[0065] Figure 6 A schematic diagram of the encapsulation format of an SRv6 message in an SRv6 network environment provided in an embodiment of the present application;

[0066] Figure 7One of the schematic diagrams of the IFIT encapsulation format in an MPLS network environment provided by an embodiment of the present application;

[0067] Figure 8 The second schematic diagram of the IFIT encapsulation format in an MPLS network environment provided by an embodiment of the present application;

[0068] Fig. 9 The third schematic diagram of the IFIT encapsulation format in the MPLS network environment provided by the embodiment of the present application;

[0069] Fig.10 A schematic diagram of the principle of flow detection provided by an embodiment of the present application;

[0070] Fig.11 A system architecture diagram of a service flow transmission system applicable to the message detection method provided in the embodiment of the present application;

[0071] Fig.12 A schematic diagram of a service flow forwarding path provided in an embodiment of the present application;

[0072] Fig.13 A schematic diagram of the principle of safety detection of the safety device provided in the embodiment of the present application;

[0073] Fig.14 One of the flow diagrams of the message detection method provided in the embodiment of the present application;

[0074] Fig.15 One of the schematic diagrams of the packaging format of the detection mark information provided in the embodiment of the present application;

[0075] Fig.16 The second schematic diagram of the packaging format of the detection mark information provided in the embodiment of the present application;

[0076] Fig.17 The third schematic diagram of the packaging format of the detection mark information provided in the embodiment of the present application;

[0077] Fig.18 A second flow chart of the message detection method provided in the embodiment of the present application;

[0078] Fig.19 One of the safety detection process diagrams of the safety equipment provided in the embodiment of the present application;

[0079] Fig. 20 A second schematic diagram of a safety detection process for a safety device provided in an embodiment of the present application;

[0080] Fig.21 The third flowchart of the message detection method provided in the embodiment of the present application;

[0081] Fig. 22 A fourth flowchart of the message detection method provided in an embodiment of the present application;

[0082] Fig.23 A schematic diagram of an application of the message detection method provided in an embodiment of the present application;

[0083] Fig.24 A schematic diagram of the structure of a security device 100 provided in an embodiment of the present application;

[0084] Fig.25 A schematic diagram of the structure of a security device 200 provided in an embodiment of the present application;

[0085] Fig.26 A schematic diagram of the structure of a network device 300 provided in an embodiment of the present application;

[0086] Fig. 27 A schematic diagram of the structure of a network device 400 provided in an embodiment of the present application;

[0087] Fig.28 A schematic diagram of the structure of a network device 500 provided in an embodiment of the present application;

[0088] Fig.29 A schematic diagram of the structure of a network device 600 provided in an embodiment of the present application;

[0089] Fig.30 A schematic diagram of the structure of a network management analyzer 700 provided in an embodiment of the present application;

[0090] Fig.31 A structural diagram of a network management analyzer 800 provided in an embodiment of the present application. DETAILED DESCRIPTION

[0091] The technical solutions in the embodiments of the present application will be described below in conjunction with the drawings in the embodiments of the present application.

[0092] In the following, the terms "first", "second", etc. are used for descriptive purposes only and are not to be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Thus, a feature defined as "first", "second", etc. may explicitly or implicitly include one or more of the features.

[0093] In the embodiments of the present application, words such as "exemplary" or "for example" are used to indicate examples, illustrations or descriptions. Any embodiment or design described as "exemplary" or "for example" in the embodiments of the present application should not be interpreted as being more preferred or more advantageous than other embodiments or designs. Specifically, the use of words such as "exemplary" or "for example" is intended to present related concepts in a specific way.

[0094] In the description of the embodiments of the present application, unless otherwise specified, the meaning of "multiple" refers to two or more. The "and / or" in this article is only a description of the association relationship of the associated objects, indicating that there can be three relationships. For example, A and / or B can mean: A exists alone, A and B exist at the same time, and B exists alone.

[0095] Firewall technology is a technology that helps a computer network build a relatively isolated protective barrier between its internal and external networks, thereby protecting user data and information security.

[0096] The function of firewall technology is mainly to promptly discover and deal with security risks, data transmission and other problems that may exist during the operation of computer networks. The treatment measures include isolation and protection. At the same time, it can record and detect various operations in computer network security to ensure the security of computer network operation and the integrity of user data and information, providing users with a better and safer computer network experience.

[0097] Currently, when a firewall finds that a computer network is under attack during operation, it will block some messages, such as discarding data packets (also known as "packet loss") to ensure the security of computer network operation. However, network operation and maintenance personnel cannot know the reason for traffic packet loss, nor can they know the threatening message forwarding path in the network, which affects business security.

[0098] Based on the above research, an embodiment of the present application provides a message detection method, an electronic device and a computer-readable storage medium. By setting detection mark information in the message and indicating risks for the business message according to the detection mark information, it can assist in identifying risky business flow forwarding paths at the management and control analysis layer.

[0099] See also Figure 1 , Figure 1 An application scenario diagram of the message detection method provided in the embodiment of the present application, Figure 1 The deployment of each device is implemented based on business chain programming technology.

[0100] Among them, service function chaining (SFC) is a technology that provides orderly services to the application layer. The service chain is used to connect the services on each device at the logical level to form an orderly service combination. The service chain adds service chain path information to the original message to enable the message to pass through each device in sequence along the specified path.

[0101] Different devices can play different roles in the entire business chain system according to their different functions, such as Figure 2As shown, the roles of the service chain mainly include a classifier (service classifier, SC), a service node (service function, SF), a proxy server (proxy server), and a service chain forwarding node (service function forwarder, SFF).

[0102] The classifier is located at the boundary entrance of the SFC domain. After the message of application A enters the detection domain, it will first enter the classifier, through which the traffic is classified, and the service identifier and encapsulation service message header are set. Among them, the SFC domain refers to the area containing the SFC device, such as Figure 1 The area from R1 to R10 and FW1 to FW7.

[0103] Service nodes are devices that provide value-added service functions, including firewalls, load balancing devices, etc.

[0104] The proxy server is located between the service chain forwarding node and its associated SF, and deletes or adds network service header (NSH) encapsulation information for the SF.

[0105] The service chain forwarding node is used to forward the message received from the network to several SFs associated with the SFF. After the SF processes the message, it returns the message to the same SFF for forwarding.

[0106] When application messages are transmitted in the network, they often need to pass through various service nodes to ensure that the network can provide users with safe, fast and stable services according to the pre-planned plan. These service nodes include well-known firewalls, load balancers (LB), etc. Traffic needs to pass through these service nodes in the established order required by the business logic to achieve the required business.

[0107] Figure 1 Among them, FW1, FW2, FW3, FW4, FW5, FW6, and FW7 are security devices, such as firewalls. R1, R2, R3, R4, R5, R6, R7, R8, R9, and R10 are network devices. Figure 1 In the example, security devices FW3, FW4, FW5, and FW6 form a security resource pool. The security resource pool and security devices are managed and maintained by security operation and maintenance personnel, the network management analyzer is managed and maintained by network operation and maintenance personnel, and the network devices are uniformly managed by the network management analyzer. In addition, the network management analyzer can arrange the security devices and network devices in a unified path through the service chain, so that the service flow can be transmitted based on the arranged path.

[0108] like Figure 1 As shown, the business flow of application A can be forwarded from network device R1, via security device FW1, network device R3, network device R5, security device FW3, security device FW4, security device FW5, security device FW6, network device R7, network device R9, and security device FW7 to reach application B.

[0109] Figure 1 When the service flow is transmitted based on the arranged path, the network device can detect packet loss and delay of the service flow when passing through the network device.

[0110] like Figure 3 As shown, Figure 3 A schematic diagram of the principle of out-of-band detection provided by an embodiment of the present application. Network equipment can detect the delay, packet loss, etc. of the input service flow through out-of-band detection, such as two-way active measurement protocol (TWAMP), Internet packet explorer (Ping), trace router (Tracert), etc. One type of out-of-band detection is to construct a detection message and send an additional simulated flow to achieve detection, such as Figure 3 The input network device (ingress) in the process can send simulated streams to the output network device (egrss). However, in actual applications of out-of-band detection, the forwarding path of the simulated stream may be inconsistent with the forwarding path of the real business stream, resulting in low detection accuracy.

[0111] like Figure 4 As shown, Figure 4 A schematic diagram of the principle of in-band detection provided by the embodiment of the present application. Network equipment can also detect service flow delay, packet loss and other issues through in-band detection. For example, the Y.1731 protocol and the Y.1711 protocol use in-band detection. In-band detection can insert sampled detection messages into the input service flow, such as Figure 4 The input network device in the process can insert the sampled detection message into the input service flow and send the sampled detection message to the output network device to detect the delay and packet loss of the service flow. Since the in-band detection sends the sampled detection message at intervals, the detection accuracy is relatively low.

[0112] In order to improve the accuracy of detection, in the embodiment of the present application, in-situ flow information telemetry (IFIT) technology is used to detect the service flow for delay, packet loss, etc. When performing in-situ flow information telemetry, the head node will encapsulate the message with an IFIT message header.

[0113] It can be understood that in different network environments, the message types are different, and accordingly, the encapsulation of the IFIT message header is also different. For example, in the sixth version of the Internet Protocol (internet protocol version 6, IPv6) network environment, the message is an IPv6 message, and the IFIT message header is encapsulated in the IPv6 message header. For another example, in a segment routing over IPv6 (SRv6) network environment, the message is an SRv6 message, and the IFIT message header is encapsulated in the extended header (segment routing header, SRH) of the SRv6 message. For another example, in a multiprotocol label switching (MPLS) network environment, the message is an MPLS message, and the IFIT message header is encapsulated in the MPLS message header of the MPLS message.

[0114] The following takes the IPv6 network environment as an example to explain. In the IPv6 network environment, the IFIT encapsulation format of the IPv6 message is as follows Figure 5 shown. Figure 5 In the extended header of the IPv6 packet, the option type field, the option data length (Opt Data Len) field, the service flow ID (FlowMonID) field, the L field, the D field, and the reserved field. Among them, Opt Data Len is the length of the data in the option type, L is the packet loss detection coloring mark bit, and D is the delay detection coloring mark bit. As an example, the length of the option type field is 8 bits, the length of the Opt Data Len field is 8 bits, the length of the FlowMonID field is 20 bits, the length of the L field is 1 bit, and the length of the D field is 1 bit.

[0115] Understandably, Figure 5 This is only a schematic diagram of the IFIT encapsulation format of IPv6. The order of the fields in the figure is adjusted according to actual needs. For example, the D field is located after the L field. For another example, the D field is located before the L field. There is no specific limitation.

[0116] For a detailed description of the above fields, please refer to the relevant instructions in the document "RFC9343 IPv6 Application of the Alternate-Marking Method". The above document is incorporated into this application by reference in its entirety and will not be repeated here.

[0117] The following takes the SRv6 network environment as an example. In the SRv6 network environment, the outer layer of the SRv6 message is IPv6, but the SRH information is added to the extended message header of the IPv6 message. Therefore, in the SRv6 network environment, the IFIT encapsulation format of the SRv6 message can refer to Figure 5 .

[0118] For ease of understanding, the following is a detailed description of the IFIT encapsulation format of the SRv6 message. Figure 6 , Figure 6 A schematic diagram of the encapsulation format of an SRv6 message in an SRv6 network environment provided in an embodiment of the present application, such as Figure 6 As shown, the SRv6 message includes an ETH field, an IPv6 Basic Header field, an SRH field, and a payload.

[0119] The ETH field is used to carry the Layer 2 Ethernet header, which can carry the source MAC address, destination MAC address, and protocol type.

[0120] IPv6 Basic Header is the IPv6 basic header.

[0121] The SRH field includes the SRH Basic Header field, the Segment List field, and related information of the flow detection. The SRH Basic Header is the basic extension header of the SRH. The Segment List field is used to carry a list of segments indicating the forwarding path of the service flow. The related information of the flow detection includes the flow instruction indicator (FII) field, the flow instruction header (FIH) field, and the flow instruction extension header (FIEH) field.

[0122] The FII field is mainly used to identify the beginning of the IFIT message header and define the overall length of the IFIT message header. The FII field includes a Type field, a Length field, and a Reserved field. Among them, the Type field is used to identify the IFIT detection header, and the Length field is used to identify the length of the FIH field and the FIEH field. As an example, the length of the Type field is 8 bits, and the length of the Length field is 8 bits.

[0123] The FIH field is mainly used to uniquely identify a service flow. Optionally, the FIH field includes a service flow ID (FlowID) field, an L field, a D field, an R field, an R / S field, and a NextHeader field. Among them, the Flow ID field is used to identify the ID information of the service flow, L is the packet loss detection coloring mark bit, D is the delay detection coloring mark bit, R is the reserved flag bit, which is reserved for future expansion, and the R / S field is used to indicate that when the guide label is at the bottom of the stack, R is reserved, which is set to 1 by default. If the guide label is not at the bottom of the stack, the S flag is reserved. The NextHeader field is used to indicate whether to carry an extended header. For example, if NextHeader is 0x00, it is reserved. If NextHeader is 0x01, it means that FIH is basic end-to-end detection information and does not carry an extended header. If NextHeader is 0x02, it means that FIH is basic hop-by-hop detection information and does not carry an extended header. If NextHeader is 0x03, it means that FIH is extended end-to-end detection information and carries an extended header, and FIEH is valid. If NextHeader is 0x04, it means that FIH is extended hop-by-hop detection information and carries an extended header, and FIEH is valid. As an example, the length of the Flow ID field is 20 bits, the length of the L field is 1 bit, the length of the D field is 1 bit, the length of the R field is 1 bit, the length of the R / S field is 1 bit, and the length of the NextHeader field is 8 bits.

[0124] The FIEH field is used to carry other IFIT detection related information. The FIEH field includes option data (OptionData). The specific content in the FIEH field can be set according to business requirements and is not specifically limited. The message detection method provided in the embodiment of the present application does not involve the FIEH field.

[0125] Understandably, Figure 6 This is only a schematic diagram of the IFIT encapsulation format in an SRv6 network environment. The order of the fields in the figure can be adjusted according to actual needs and is not specifically limited.

[0126] The following takes the MPLS network environment as an example to illustrate the IFIT encapsulation format of the MPLS message in the MPLS network environment. Figure 7As shown, the MPLS message includes a TC field, an S field, a time to live (TTL), a flow-ID Label Indicator field, a flow-ID Label field, an L field, a D field, and a T field. Among them, the Flow-ID Label Indicator is used to identify the IFIT detection header, the Flow-ID Label is used to identify the ID information of the service flow, the TC field refers to the traffic classification (Traffic Class) used to identify the corresponding communication flow category, or the priority level, S is used to indicate that when the guide label is at the bottom of the stack, R is retained, if the guide label is not at the bottom of the stack, the S mark is retained, L is the packet loss detection coloring mark bit, D is the delay detection coloring mark bit, and the T field is used to indicate the detection type. For example, when the T field is set to 1, it is an end-to-end detection, and when the T field is set to 0, it is a hop-by-hop detection. As an example, the length of the TC field is 3 bits, the length of the S field is 1 bit, the length of the TTL field is 8 bits, the length of the Flow-ID Label Indicator field is 20 bits, the length of the Flow-ID Label field is 20 bits, the length of the L field is 1 bit, the length of the D field is 1 bit, and the length of the T field is 1 bit.

[0127] For a detailed description of the above fields, please refer to the relevant description of the document "Encapsulation For MPLS Performance Measurement with Alternate Marking Method". The above document is incorporated into this application by reference in its entirety and will not be repeated here.

[0128] As an example, in an MPLS network environment, the encapsulation format of an MPLS message is as follows: Figure 8 shown. Figure 8 The MPLS message shown includes an ETH field, an SR Label field, a VPN Label field, an IFIT field, and a payload. The ETH field is used to carry a Layer 2 Ethernet header, and the ETH carries a source MAC address, a destination MAC address, and a protocol type. The SR Label field is used to carry a public network label. The VPN Label field is used to carry a private network label. The IFIT field includes a FII field, a FIH field, and a FIEH field.

[0129] The FII field includes a flow instruction indicator label (FII Label) field, an EXP field, an S field, and a time to live (TTL) field. The FII Label field is used to identify the IFIT detection header; the EXP field is a priority EXP flag, which is determined based on some relevant information in the outer MPLS label header; the S field is used to identify whether it is the bottom of the stack, for example, a value of 1 indicates the bottom of the stack, and a value of 0 indicates non-bottom of the stack; the TTL field is determined based on some relevant information in the outer MPLS label header. As an example, the length of the FII Label field is 20 bits, the length of the EXP field is 3 bits, the length of the S field is 1 bit, and the length of the TTL field is 8 bits.

[0130] The FIH field includes a Flow ID field, an L field, a D field, an R field, an R / S field, and a header type indicator (HTI) field. Among them, the Flow ID field, the L field, the D field, the R field, and the R / S field refer to the above description in the SRv6 network environment. HTI is used to identify the node range and the detection content range to which the IFIT detection results need to be sent. For example, different tag values ​​are used to distinguish whether the path nodes with IFIT capabilities are detected in addition to the detection of the two end nodes, and whether the FIEH field is valid. As an example, the length of the Flow ID field is 20 bits, the length of the L field, the D field, the R field, and the R field is 1 bit, and the length of the HTI field is 8 bits.

[0131] The FIEH field is used to carry other IFIT detection related information. The FIEH field includes option data (OptionData). The specific content in the FIEH field can be set according to business needs and is not specifically limited.

[0132] After the IFIT message header is expanded, the format of the IFIT message header is as follows: Fig. 9 As shown in (a), when HTI is 0x03 or 0x04, the FIEH field is valid and the encapsulation format is as follows Fig. 9 As shown in (b) in .

[0133] Understandably, Figure 7 , Figure 8 and Fig. 9 This is only a schematic diagram of the IFIT encapsulation format of MPLS. The order of the fields in the figure can be adjusted according to actual needs and is not specifically limited.

[0134] Through IFIT encapsulation, when performing delay and packet loss detection, the network device can color the packet loss detection coloring mark bit L and the delay detection coloring mark bit D, and realize the detection of packet loss and delay by counting the colored messages within a fixed period. Among them, coloring the message means to perform feature marking on the packet loss detection coloring mark bit L and the delay detection coloring mark bit D of the message.

[0135] As an example, the network device implements feature marking by setting the packet loss coloring bit L and the delay coloring bit D. For example, when the packet loss detection coloring bit L is set to 1, it indicates that the packet loss is collected, when the packet loss detection coloring bit L is set to 0, it indicates that the packet loss is not collected, when the delay detection coloring bit D is set to 1, it indicates that the timestamp is collected, and when the delay detection coloring bit D is set to 0, it indicates that the timestamp is not collected.

[0136] See also Fig.10 , Fig.10 The schematic diagram of the principle of the flow detection provided by the embodiment of the present application. Fig.10 As shown, when detecting packet loss of a service flow based on the IFIT flow detection technology, the head and tail nodes dye and count the packet loss detection dyeing mark bit L of the message according to a fixed period, and report the number of packets counted to the network management analyzer. The network management analyzer compares the number of packets in each period to detect whether packet loss occurs. For example, assuming that the head node sends 5 packets in the dyeing period T2, and the tail node receives 3 in the dyeing period T2, after the head node and the tail node report to the network management analyzer, the network management analyzer compares the number of packets reported by the head node and the tail node, and it can be obtained that 2 packets are lost in the dyeing period T2.

[0137] Accordingly, the delay of the service flow is detected based on the IFIT flow detection technology, such as Fig.10 As shown in the figure, the head node colors the delay detection coloring mark bit D, records the time when the colored message is sent by recording the timestamp, and the tail node also records the time when the colored message is received by recording the timestamp. Then the head and tail nodes report the time information to the network management analyzer. The network management analyzer calculates the time difference and obtains the one-way delay value of the message.

[0138] There are two main methods for flow detection technology: hop-by-hop detection and end-to-end detection. End-to-end detection only detects the colored packets at the head and tail nodes, and does not process them at the intermediate nodes. It can detect the packet loss and delay of the service end-to-end; hop-by-hop detection detects the colored packet information on each hop network device along the way, and can detect the packet loss and delay of the service hop by hop.

[0139] As an example, in the initial state, the network operation and maintenance personnel can send end-to-end IFIT packet loss detection for the service flow through the network management analyzer; when traffic packet loss is found, the IFIT flow packet loss detection is sent again to accurately determine the location of packet loss, and the IFIT detection results are reported to the control analyzer, which performs data analysis and collation.

[0140] The embodiment of the present application directly colors real business messages through the IFIT flow detection technology, which can actively perceive subtle changes in the network and truly reflect the packet loss and delay conditions of the network.

[0141] Figure 1 Due to the development of business chain programming technology, security devices in the network can be flexibly deployed in a pooled and centralized manner at any location in the network. When the business flow passes through the security device, the security device can perform security detection on the business flow as needed. When the security device detects a threat, it can block it or report an alarm.

[0142] In an embodiment of the present application, the security equipment and the security resource pool are the responsibility of the security operation and maintenance personnel, while the network equipment is managed by the network operation and maintenance personnel. The security equipment does not support the IFIT flow detection function, and the security equipment does not report the security detection results to the network management analyzer. Therefore, when the security equipment finds that the computer network is attacked during operation and blocks some messages, such as discarding data packets (also known as "packet loss") to ensure the security of the computer network operation, the network operation and maintenance personnel do not know the reason for the packet loss. Moreover, when the security equipment only issues an alarm for the attacked message and does not block the packet loss, the network operation and maintenance personnel cannot know the risky business flow forwarding path in the network, thereby affecting business security.

[0143] See also Fig.11 , Fig.11 A system architecture diagram of a service flow transmission system to which the message detection method provided in the embodiment of the present application is applicable. Fig.11 As shown, the service flow transmission system provided by the embodiment of the present application includes a management and control analysis layer and an infrastructure layer, wherein the management and control analysis layer includes a network management analyzer, and the infrastructure layer includes multiple network devices and security devices, and the multiple network devices and security devices are connected through communication links for transmitting service flows. In the embodiment of the present application, the network device is used to forward service messages of types such as MPLS / SRv6 and perform flow detection on the service messages, and report the flow detection data to the network management analyzer. Exemplarily, the network device is a routing switching device.

[0144] In the embodiment of the present application, the security device is used to forward service messages of types such as MPLS messages / SRv6, and to perform security detection on the service messages. Exemplarily, the security device is a firewall.

[0145] In the embodiment of the present application, the network management analyzer is used to manage network devices, present network topology, collect and integrate the flow security status information uploaded by each network device, and restore the attack path. Optionally, the network management analyzer is a device, or a collection of multiple devices.

[0146] As an example, multiple network devices and security devices can be deployed through a network management analyzer based on service chain technology such as Fig.12 In the service flow forwarding path shown, network device R1 is the source node, network device R2, security device FW1, security device FW2, and network device R3 are intermediate nodes, and network device R4 is the tail node.

[0147] The service flow data sent by the source device can reach the destination device along the service flow forwarding path, through the network device R1, the network device R2, the security device FW1, the security device FW2, the network device R3 and the network device R4.

[0148] The source device refers to the device that generates the service flow, such as Figure 2 The node device where application A or application B is located, the destination device refers to the node that receives the service flow, such as Figure 2 Node device where application A or application B is located. Exemplarily, when the node device where application A is located is a source device, the node device where application B is located is a destination device.

[0149] In an embodiment of the present application, in order to realize delay and packet loss detection of service flows, when the service flows are forwarded from network device R1 to network device R4, network operation and maintenance personnel can deploy hop-by-hop in-flow detection IFIT for the service flows through the network management analyzer, that is, when the service packets pass through each network device, the network device can perform in-flow detection IFIT and report it to the network management analyzer.

[0150] In the embodiment of the present application, in order to implement security detection of the business flow, the business flow is Fig.12 In the process of forwarding from the network device R1 to the network device R4 shown in the figure, when the service message passes through one or more security devices between the network device R1 and the network device R4, the security devices can perform security detection on the service message.

[0151] When performing security detection on business messages, the security device can filter and match the five-tuple of the business message according to the pre-set filtering rules to control the forwarding of the business message. The filtering rules can be set according to actual business needs and are not specifically limited here. Among them, the five-tuple of the business message refers to the source address, destination address, source port, destination port, and protocol type of the business message.

[0152] Considering that in actual applications, the five-tuple of malicious traffic that conducts content attacks often changes frequently, or the inner layer load (payload) carries threat information under the same five-tuple, it is impossible to detect risky messages in the service flow only through five-tuple detection. In order to improve the security of network operation, in the embodiment of the present application, the security detection of service messages also includes content security detection, by scanning the payload of the service message, combining the message features such as antivirus and content filtering with the five-tuple detection, to achieve the detection of the transport layer, session layer, presentation layer, and application layer (L4-L7 layer) of the service message.

[0153] like Fig.13 As shown, for the business flow, the security device can first match and filter the business message according to the traffic matching strategy, wherein the traffic matching strategy includes matching conditions such as user, source / destination security zone, source / destination address, source / destination region, VLANID, service, application, URL classification, time period, etc. The security device can match the business message in the business flow according to the matching conditions, obtain the matching result, and then execute the corresponding response action (allow or prohibit) according to the matching result. When executing the prohibition action, the security device can feedback whether the message is sent, and can deal with the business message, such as generating an alarm or discarding. When executing the permission action, the security device can further perform content security detection on the business message. Content security detection generally includes protocol filtering, file filtering and WEB website filtering. Among them, protocol filtering can include intrusion prevention system (IPS), application behavior control and auditing, mail filtering, etc. File filtering includes file filtering, anti virus (AV), content filtering, etc. WEB website filtering includes Uniform Resource Locator (URL) filtering, Domain Name System (DNS) filtering, etc. After the security device performs content security detection, it can feedback whether the service message is sent according to the security detection result. It can be understood that when sending the service message, the security device forwards the service message to the next hop device on the service flow forwarding path.

[0154] In order to facilitate the operation and maintenance personnel to identify the service messages with threats in the service flow and the service flow forwarding path with threats through the network management analyzer, in the embodiment of the present application, the detection mark information for indicating the security detection information is added to the IFIT message header of the service message. The detection mark information is reported to the network management analyzer through the network device, so that the network management analyzer can obtain the service flow forwarding path with risks in the service flow according to the detection mark information.

[0155] Exemplarily, after the security device performs security detection on the service message, the security device can set the detection mark information according to the security detection result to indicate whether the service message is at risk. After receiving the service message, the network device reports the IFIT detection result and the detection mark information to the network management analyzer. The network management analyzer receives the detection mark information and identifies the service flow forwarding path with risks in the service flow according to the detection mark information. In this way, the operation and maintenance personnel can obtain the service flow forwarding path with risks in the service flow through the network management analyzer.

[0156] For ease of understanding, the message detection method provided by the embodiment of the present application will be described below in conjunction with the accompanying drawings. Fig.14 , Fig.14 A flow chart of a message detection method provided in an embodiment of the present application, Fig.14 The method shown can be applied to Fig.11 The service flow transmission system shown in FIG. 1 is executed by a first network device. The first network device refers to a source node on a service flow forwarding path, such as Fig.12 The network device R1 in Fig.14 As shown, the message detection method provided in the embodiment of the present application can include steps S101 to S103.

[0157] S101, a first network device encapsulates service flow data to be transmitted to obtain a first service message, wherein a message header of the first service message includes detection mark information, the detection mark information includes a first field, and a value of the first field is used to indicate whether the service message has a risk.

[0158] The service flow data is data to be transmitted, and is sent from the source device to the first network device.

[0159] Optionally, in order to detect packet loss and delay of the service flow, the first network device performs in-flow detection IFIT encapsulation on the service flow data to be transmitted when encapsulating the service flow data to be transmitted.

[0160] It can be understood that when the first network device performs IFIT encapsulation on the service flow data to be transmitted, it can perform the encapsulation based on the current network environment. In this way, different types of service messages can carry detection tag information, thereby assisting the network management analyzer to identify risky service flow forwarding paths. For example, if the current network environment is MPLS, the first network device encapsulates the service flow data based on the MPLS message encapsulation format, so that the first service message obtained is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the first service message. For another example, if the current network environment is SRv6, the first network device encapsulates the service flow data based on the SRv6 message encapsulation format, so that the first service message obtained is an SRv6 protocol message, and the IFIT message header is located in the extended header SRH of the first service message. For the encapsulation format of IFIT in different network environments, please refer to Figures 5 to 9 The description is not repeated here.

[0161] In an embodiment of the present application, in order to detect risky service messages and service flow forwarding paths in a service flow, the first network device encapsulates detection mark information in the IFIT message header when performing IFIT encapsulation on the service flow data to be transmitted.

[0162] In an embodiment of the present application, the detection mark information includes a first field, and the value of the first field is used to indicate whether the service message has a risk.

[0163] As an example, to facilitate security detection and risk analysis of business messages, in an embodiment of the present application, the detection mark information can also include a second field and / or a third field, wherein the value of the second field is used to indicate whether the business message has been security detected, and the value of the third field is used to indicate the risk type of the risk when there is a risk in the business message.

[0164] By setting the second field, the embodiment of the present application enables the security device to perform security detection on the service message based on the detection situation indicated by the second field, thereby facilitating the security device to perform targeted processing on the service message and improving processing efficiency.

[0165] The embodiment of the present application sets a third field to indicate the risk type of the service message, so that the network management analyzer can identify the risk type and ensure the security of the service. Considering that the IFIT encapsulation of the service message is different in different network environments, the encapsulation of the detection mark information is also different in different network environments.

[0166] As an example, in an MPLS network environment, that is, when the service message is an MPLS message, based on the following Figure 7In the IFIT encapsulation format of the MPLS message shown in FIG. , the detection tag information is set in the row where the Flow-ID Label is located. For example, Fig.15 As shown, the first field, the second field and the third field are set using the row where the Flow-ID Label is located, that is, the row where the Flow-IDLabel is located is used to mark whether it has been safely detected, whether there is a risk and the risk type.

[0167] As an example, in an SRv6 network environment, that is, when the service message is an SRv6 message, based on the following Figure 5 In the IFIT encapsulation format shown in FIG. 1 , the detection tag information is set in the row where FlowMonID is located. For example, Fig.16 As shown, the first field, the second field and the third field are set using the row where FlowMonID is located, that is, the row where FlowMonID is located is used to mark whether it has been safely detected, whether there is a risk and the risk type.

[0168] As an example, the first field occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. In this way, when setting the detection mark information in the service message, it can avoid that the detection mark information occupies too many bits, thereby increasing the amount of data carried by the service message. As an example, Fig.17 As shown in (a) of FIG. 1 , the first field, the second field, and the third field are added to the 5 bits 24 to 28 of the row where the Flow-IDLabel is located. As an example, Fig.17 As shown in (b), the first field, the second field and the third field are set in the 5 bits 24 to 28 of the row where FlowMonID is located. In this way, it is possible to avoid affecting other fields in the IFIT message header and improve the utilization rate of the bits.

[0169] It can be understood that since the first network device is the source node on the service flow forwarding path, the first service message encapsulated by the first network device has not undergone security detection on the service flow forwarding path. Therefore, in an embodiment of the present application, when the first network device encapsulates the message, the value of the first field is set to the first numerical value, and the first numerical value is used to indicate that there is no risk in the first service message.

[0170] Correspondingly, since the first service message encapsulated by the first network device has not undergone security detection on the service flow forwarding path, the value of the second field is also set to the third value, and the third value is used to indicate that the first service message has not been security detected. The value of the third field is also set to the fifth value, and the fifth value is used to indicate that the risk type of the first service message is to be set.

[0171] It can be understood that the first value, the third value, and the fifth value are only used to indicate the security detection information expressed by the first field, the second field, and the third field, and the first value, the third value, and the fifth value can be the same value. For example, the first value, the third value, and the fifth value can all be 0 to indicate that there is no risk in the first business message, the first business message has not been security detected, and the risk type of the first business message is to be set.

[0172] In some embodiments of the present application, the first value, the third value, and the fifth value may also be different values, which can be set specifically according to business requirements, and the present application does not impose any limitation thereto.

[0173] In the embodiment of the present application, the risk type includes one or more of the following: file risk, protocol risk, and website risk.

[0174] Please refer to Table 1, which shows an example of detection mark information. As shown in Table 1, when the value of the first field is 0, it indicates that there is no risk in the business message; when the value of the first field is 1, it indicates that there is a risk in the business message; when the value of the second field is 0, it indicates that the business message has not been securely detected; when the value of the second field is 1, it indicates that the business message has been securely detected; when the value of the third field is 0, it indicates that the risk type of the business message is to be set; when the value of the third field is 1, it indicates that the risk type of the business message is the risk type of file class filtering; when the value of the third field is 2, it indicates that the risk type of the business message is the risk type of protocol class filtering; when the value of the third field is 3, it indicates that the risk type of the business message is the risk type of WEB website class filtering; when the value of the third field is 4-7, it indicates that the risk type of the business message is reserved, which is set specifically according to business needs.

[0175] Table 1

[0176]

[0177] The embodiment of the present application encapsulates detection mark information in the business message and indicates the risk of the business message through the detection mark information, so that the network management analyzer can identify the risky business flow forwarding path based on the detection mark information in the business message, thereby ensuring the security of the business.

[0178] It can be understood that after the first network device encapsulates the first service message, it can forward the first service message to the destination device. At the same time, in order to facilitate the network management analyzer to identify the risk of the service flow during the transmission process, the first network device also sends the detection mark information of the first service message to the network management analyzer after encapsulating the first service message. Therefore, after obtaining the first service message, steps S102 and S103 are also included.

[0179] S102: The first network device sends a first service message to a next-hop device on a service flow forwarding path.

[0180] S103: The first network device sends flow security status information to the network management analyzer, where the flow security status information is used to indicate whether the first service message has a risk.

[0181] In an embodiment of the present application, the flow security status information includes flow identification information and detection mark information of the first business message, wherein the flow identification information refers to the identification information of the flow to which the first business message belongs, such as the Flow ID in the IFIT message header of the first business message.

[0182] It can be understood that the flow identification information of the service packets of the same flow is the same.

[0183] As an example, the flow identification information includes one or more of a source address, a source port, a destination address, and a destination port of the service message.

[0184] Since the first network device performs IFIT encapsulation on the service flow data, in order to obtain the delay and packet loss of the service flow, the flow security status information also includes the flow detection data. As an example, the flow detection data includes the timestamp of the first service message whose delay detection coloring mark bit D has been colored, the number of first service messages whose packet loss detection coloring mark bit L has been colored, the statistical cycle and other information. The embodiment of the present application uploads the flow detection data to the network management analyzer, so that the network management analyzer can obtain the delay information and packet loss information in the service flow according to the flow detection data.

[0185] The "source node / head node" and "tail node" in the embodiments of the present application refer to the service flow forwarding path, while the "source address" and "destination address" are concepts referring to the source device and destination device when the service message is transmitted in the entire network. The two are different in scope.

[0186] The embodiment of the present application uploads the flow identification information and the detection mark information to the network management analyzer, so that the network management analyzer can identify the risky business flow forwarding path in each business flow according to the flow identification information and the detection mark information.

[0187] In an embodiment of the present application, the first network device serves as a source node on a service flow forwarding path. After the first network device encapsulates a first service message, it sends the first service message to a next-hop device.

[0188] Optionally, the next hop device of the first network device is another network device, for example, Fig.12In the service flow forwarding path shown in , the next hop device of network device R1 is network device R2, and network device R2 is an intermediate node. Optionally, the next hop device of the first network device is also a security device, which is determined by the service flow forwarding path.

[0189] For ease of understanding, the following will describe the processing of security devices on the service flow forwarding path with reference to the accompanying drawings. Fig.18 , Fig.18 Another flow chart of the message detection method provided in the embodiment of the present application is as follows: Fig.18 The method shown can be applied to Fig.11 The service flow transmission system shown in FIG. 1 is executed by a security device. For example, it can be Fig.12 The safety device FW1 or safety device FW2 in the Fig.18 As shown, the message detection method provided in the embodiment of the present application also includes steps S201 to S202.

[0190] S201, a security device receives a first service message from a previous-hop device on a service flow forwarding path, a message header of the first service message includes detection mark information, the detection mark information includes a first field, and a value of the first field is used to indicate whether the first service message has a risk.

[0191] Optionally, for a security device, the previous hop device on the service flow forwarding path is one of the first network device, other network devices other than the first network device, and other security devices, without specific restrictions, based on the service flow forwarding path.

[0192] For example, when the safety device is Fig.12 When the security device FW1 in the example is used, the previous hop device on the service flow forwarding path is network device R2. Fig.12 The security device FW2 in the example, the previous hop device on the service flow forwarding path is the network device R3.

[0193] In an embodiment of the present application, the message header of the first service message received by the security device includes detection tag information. Exemplarily, the IFIT message header of the first service message received by the security device includes detection tag information, when the first service message is an MPLS protocol message, the IFIT message header is located in the MPLS message header of the first service message, and when the first service message is an SRv6 protocol message, the IFIT message header is located in the extended header SRH of the first service message.

[0194] In an embodiment of the present application, the detection mark information includes a first field, and a value of the first field is used to indicate whether the first service message has a risk.

[0195] It is understandable that when the first service message encapsulated by the first network device includes the second field and the third field, the first service message received by the security device also includes the second field and the third field. For the explanation of the second field and the third field, refer to the above description and will not be repeated here.

[0196] The first service message received by the security device may be different from the first service message encapsulated by the first network device. Exemplarily, when the previous hop device of the security device is another network device or another security device other than the first network device, the detection tag information of the first service message received by the security device may be different from the detection tag information of the first service message sent by the first network device.

[0197] S202: The security device sends a second service message to a next-hop device on the service flow forwarding path, wherein the second service message is the same as the first service message, or the second service message is obtained by updating the value of the first field in the first service message.

[0198] The first service message refers to the service message received by the security device from the previous hop device, and the second service message refers to the service message sent by the security device to the next hop device on the service flow forwarding path.

[0199] Optionally, the second service message is the same as the first service message, or is obtained by updating the detection mark information in the first service message, such as updating the value of the first field in the first service message.

[0200] Exemplarily, when the security device does not perform security detection on the received first service message and only forwards the first service message, the second service message is the same as the first service message.

[0201] Exemplarily, after the security device performs a security check on the received first business message, it can update the value of the first field in the first business message based on the security check result of whether the first business message poses a risk, thereby obtaining a second business message. At this time, the second business message is obtained by updating the value of the first field in the first business message.

[0202] In an embodiment of the present application, the security device may determine whether to perform security detection on the received first service message according to a preset detection strategy. Optionally, the preset detection strategy is to determine whether to perform security detection on the first service message according to detection tag information in the first service message.

[0203] Exemplarily, after receiving the first business message, the security device can parse the frame header of the first business message to obtain the detection mark information of the first business message, and then determine whether it is necessary to perform security detection on the first business message based on the detection mark information and a preset detection strategy.

[0204] As an example, an embodiment of the present application determines whether to perform security detection on the first business message based on the detection mark information in the first business message, including the following (1) to (5).

[0205] (1) In response to the value of the second field in the detection mark information in the first service message being a third value, the security device performs a security detection on the first service message.

[0206] Among them, the third value is used to indicate that the first service message has not been security detected. Therefore, when the value of the second field in the detection mark information in the first service message is the third value, it means that the first service message has not been security detected. In order to ensure the security of the network device, the security device performs security detection on the first service message. It can be understood that when the first service message has not been security detected, the value of the first field in the first service message is the second value, and the value of the third field is the fifth value.

[0207] (2) In response to the value of the second field in the detection flag information in the first service message being the fourth value, the security device does not perform security detection on the first service message.

[0208] Among them, the fourth value is used to indicate that the first business message has been security detected. Therefore, when the value of the second field in the detection mark information in the first business message is the fourth value, it means that the first business message has been security detected. In order to save resources and reduce workload, in an embodiment of the present application, the security device does not perform security detection on the first business message.

[0209] (3) In response to the value of the first field in the detection mark information in the first service message being a first value, the security device performs a security detection on the first service message.

[0210] Among them, the first value is used to indicate that there is no risk in the first business message. When the value of the first field in the detection mark information in the first business message is the first value, it indicates that there is no risk in the first business message. At this time, in order to further ensure security, regardless of whether the first business message has been security detected, that is, regardless of whether the value of the second field is the third value or the fourth value, the security device performs security detection on the first business message. It can be understood that when the value of the first field of the detection mark information in the first business message is the first value, the value of the third field is the fifth value, and the fifth value is used to indicate that the risk type of the first business message is to be set.

[0211] (4) In response to the value of the first field in the detection mark information in the first service message being the second value, the security device performs a security check on the first service message.

[0212] Among them, the second numerical value is used to indicate that there is a risk in the first business message. When the value of the first field in the detection mark information in the first business message is the second numerical value, it means that the first business message has been security detected and there is a risk. At this time, in order to further determine the risk situation, the security device performs a security check on the first business message.

[0213] (5) In response to the value of the first field in the detection flag information in the first service message being the second value, the security device does not perform security detection on the first service message.

[0214] When the value of the first field in the detection mark information in the first business message is the second value, it means that the first business message has been security detected and there is a risk. In order to ensure network security, the first business message can be directly blocked at this time without security detection.

[0215] It can be understood that when the value of the first field of the detection mark information in the first service message is the second value, the value of the second field is the fourth value, and the value of the third field is the value corresponding to the detected risk type.

[0216] It is understandable that the detection strategies listed above are only examples, and the detection strategies described in the embodiments of the present application can also include more methods. For example, to ensure the security of the network, in some embodiments, the security device performs security detection on each first service message received, which is set according to actual needs and is not specifically limited in the present application.

[0217] The embodiment of the present application sets a preset detection strategy and determines whether to perform security detection on the first business message according to the detection mark information in the first business message. It can dynamically and flexibly adjust the security detection method of the business message, which is conducive to refined network security operation and maintenance.

[0218] In order to improve the security of network transmission, in the embodiment of the present application, before step S202, that is, before the security device sends the second service message to the next hop device on the service flow forwarding path, the security device can also perform security detection on the first service message. Fig.19 , Fig.19 A schematic diagram of a process flow of security detection of a security device provided in an embodiment of the present application. Fig.19 As shown, in the embodiment of the present application, the step of the security device performing security detection on the first service message includes steps S301 to S305.

[0219] S301: The security device determines whether the flow identification information of the first service message is the same as the flow identification information of the third service message with risk that has been detected by the security device.

[0220] S302: In response to the flow identification information of the first service packet being the same as the flow identification information of the third service packet with risk that has been detected by the security device, the security device determines that the first service packet has risk.

[0221] S303: In response to the flow identification information of the first service message being different from the flow identification information of the third service message with risk detected by the security device, the security device determines whether the first service message includes a malicious feature in a malicious feature library.

[0222] S304, in response to the flow identification information of the first business message being different from the flow identification information of the third business message with risk that has been detected by the security device, and the first business message does not include malicious features in the malicious feature library, the security device determines that the first business message does not pose a risk.

[0223] S305: In response to the flow identification information of the first service message being different from the flow identification information of the third service message that has been detected by the security device as risky, and the first service message including a malicious feature in a malicious feature library, the security device determines that the first service message is risky.

[0224] In the embodiment of the present application, the message header of the first service message also includes flow identification information. After the security device parses the frame header of the first service message, it can obtain the flow identification information of the first service message.

[0225] In the embodiment of the present application, the third service message refers to a service message that has been previously security checked by the security device and has been detected to have risks, and the security device stores flow identification information of the third service message.

[0226] To further ensure the security of the network, in the embodiment of the present application, after receiving the first service message, the security device matches the flow identification information of the first service message with the flow identification information of the third service message with risk, and performs content security detection on the first service message. In this way, the security detection of the first service message from multiple dimensions can improve the security of the network, and can identify risky service messages with potential threats, so as to assist in identifying the attacked service flow forwarding path at the management and control analysis layer based on the service messages with potential threats.

[0227] Optionally, when performing content security detection on the first business message, the first business message is first scanned to obtain message features in the first business message, and then the message features are matched with malicious features in a malicious feature library to detect whether the first business message includes malicious features in the malicious feature library.

[0228] Optionally, the malicious features in the malicious database are pre-built and can be updated in real time or regularly. The malicious database includes malicious features of different risk types. For example, when the risk type is file filtering, the malicious features include virus features and malicious file features. When the risk type is protocol filtering, the malicious features include behavioral intrusion features, etc. It can be understood that the malicious features of different risk types can be built according to actual business needs, and no specific restrictions are made here.

[0229] It can be understood that when the first service message has a certain malicious feature, it is determined that the first service message has a risk, and the risk type is the risk type corresponding to the malicious feature.

[0230] As an example, the security device first matches the flow identification information of the first business message with the flow identification information of the third business message, and determines whether the flow identification information of the first business message is the same as the flow identification information of the third business message. If the flow identification information of the first business message is different from the flow identification information of the third business message, the first business message is scanned to detect whether the first business message includes malicious features in the malicious feature library.

[0231] As an example, the security device simultaneously matches the flow identification information of the first business message with the flow identification information of the third business message and scans the first business message, that is, it synchronously detects whether the first business message includes malicious features in the malicious feature library and whether the flow identification information of the first business message is the same as the flow identification information of the third business message.

[0232] As an example, the security device first scans the first business message to detect whether the first business message includes malicious features in the malicious feature library, and then matches the flow identification information of the first business message with the flow identification information of the third business message to determine whether the flow identification information of the first business message is the same as the flow identification information of the third business message.

[0233] In an embodiment of the present application, when the security device obtains that the flow identification information of the first business message is the same as the flow identification information of the third business message that has been detected to be at risk, it determines that the first business message belongs to a business message of a risky business flow, and then obtains the security detection result of the first business message, indicating that the first business message is at risk.

[0234] In an embodiment of the present application, when the flow identification information of the first business message obtained by the security device is different from the flow identification information of the third business message that has been detected to be at risk, and the security device detects that the first business message does not include malicious features in the malicious feature library, it is determined that the first business message is not a risky message and does not belong to a message of a risky business flow, and then the security detection result of the first business message indicates that there is no risk in the first business message.

[0235] In an embodiment of the present application, when the flow identification information of the first business message obtained by the security device is different from the flow identification information of the third business message that has been detected to be at risk, but the security device detects that the first business message includes malicious features in the malicious feature library, it is determined that the first business message is a risky message, and then the security detection result of the first business message indicates that the first business message is at risk.

[0236] Optionally, when the security device obtains that the first business message includes a malicious feature in a malicious feature library and determines that the first business message is a risky message, the first business message is updated to a third business message to update the stored flow identification information of the risky message to improve security.

[0237] As an example, in order to further strengthen security detection and determine risk information, when the security device obtains that the flow identification information of the first business message is the same as the flow identification information of the third business message that has been detected to be at risk, the security device detects whether the first business message includes malicious features in the malicious feature library.

[0238] In the embodiment of the present application, when the security detection result indicates that the flow identification information of the first service message is the same as the flow identification information of the third service message, but the first service message does not include malicious features, it indicates that the first service message belongs to a message of a risky service flow, and the first service message is risky, but is a potential threat and is not a risky message. When the security detection result indicates that the flow identification information of the first service message is the same as the flow identification of the third service message, and the first service message includes malicious features, it indicates that the first service message is a risky message and is threatening.

[0239] The embodiment of the present application achieves security detection of the first business message from multiple dimensions by matching the flow identification information of the first business message with the flow identification information of the third business message with risk, and performing content security detection on the first business message, thereby improving the security of the network. In addition, it can also identify risky business messages with potential threats, so as to assist in identifying the attacked business flow forwarding path at the management and control analysis layer based on the business messages with potential threats.

[0240] In the embodiment of the present application, after the security device performs a security check on the first service message, the security device updates the detection mark information in the first service message according to the security check result to obtain a second service message.

[0241] Exemplarily, the value of the second field in the detection mark information in the first business message is a third numerical value. After the security device performs a security check on the first business message, the value of the second field in the detection mark information in the first business message is set to a fourth numerical value. The fourth numerical value is used to indicate that the first business message has been security checked. At the same time, based on the result of the security check, the value of the first field and the value of the third field in the detection mark information are updated to obtain a second business message.

[0242] If the security detection result of the first service message indicates that the first service message has a risk, the value of the first field in the detection mark information is set to a second value, and the second value is used to indicate that the first service message has a risk. If the security detection result of the first service message indicates that the first service message does not have a risk, the value of the first field in the detection mark information is the first value.

[0243] Among them, when the security device detects that the first business message has a risk, the security device will set the value of the third field according to the detected risk type. For example, when the security device detects that the first business message has a risk type of file type filtering, the value of the third field can be set to the sixth value, and the sixth value is used to indicate that the first business message has a risk type of file type filtering. For another example, when the security device detects that the first business message has a risk type of protocol type filtering, the value of the third field is set to the seventh value, and the seventh value is used to indicate that the first business message has a risk type of protocol type filtering. For another example, when the security device detects that the first business message has a risk type of WEB website filtering, the value of the third field can be set to the eighth value, and the eighth value is used to indicate that the first business message has a risk type of WEB website filtering. As shown in Table 1, the sixth value is 1, the seventh value is 2, and the eighth value is 8.

[0244] Exemplarily, when the value of the second field in the detection mark information in the first business message is the fourth value and the value of the first field is the first value, after the security device performs a security check on the first business message, if the security check result of the first business message indicates that the first business message is at risk, the value of the first field in the detection mark information is set to the second value, and the value of the third field is set according to the detected risk type, thereby obtaining a second business message. If the security check result of the first business message indicates that the first business message is not at risk, the value of the first field is still the first value, and accordingly, the value of the third field is still the fifth value, and the second business message obtained at this time is the same as the first business message.

[0245] Exemplarily, when the value of the second field in the detection mark information in the first business message is the fourth value and the value of the first field is the second value, after the security device performs a security check on the first business message, if the security check result of the first business message indicates that the first business message has a risk, the value of the first field in the detection mark information is still the second value, and the value of the third field can be updated according to the detected risk type, thereby obtaining a second business message. It can be understood that when the security device does not detect a new risk type, the value of the third field remains unchanged, and the second business message obtained at this time is the same as the first business message.

[0246] When the value of the first field in the detection mark information in the first business message is the second value, after the security device performs a security check on the first business message, if the security check result of the first business message indicates that there is no risk to the first business message, then in order to ensure business security, the detection mark information is not updated, that is, the value of the first field in the detection mark information is still the second value, and the value of the third field remains unchanged. At this time, the second business message obtained is the same as the first business message.

[0247] The embodiment of the present application updates the detection mark information based on the security detection results, so that the detection mark information can accurately indicate the risk situation of the business message, so that the network management analyzer can identify the risky business flow forwarding path based on the detection mark information in the business message, thereby ensuring the security of the business.

[0248] After receiving the second service message, the security device sends the second service message to the next-hop device on the service flow forwarding path.

[0249] As an example, the security device sends the second service message to the next hop device on the service flow forwarding path according to the forwarding strategy. Exemplarily, it includes the following (1) to (3).

[0250] (1) In response to a security detection result of the security device on the first service message indicating that the first service message does not pose a risk, the security device sends a second service message to a next-hop device on a service flow forwarding path.

[0251] Among them, when the flow identification information in the first business message is different from the flow identification information of the third business message, and the first business message does not include malicious features, the first business message does not pose a risk. At this time, the second business message is sent to the next-hop device on the business flow forwarding path to ensure normal forwarding of the message.

[0252] (2) In response to the security detection result of the security device on the first service message indicating that the first service message has a risk, the security device sends a second service message to a next-hop device on the service flow forwarding path.

[0253] As an example, in order to ensure the security of the network, when the security detection result indicates that the first service message is at risk, the security device sends the second service message to the next-hop device on the service flow forwarding path, which means that the flow identification information in the first service message is detected to be the same as the flow identification information of the third service message, but the first service message does not include malicious features, and the second service message is sent to the next-hop device on the service flow forwarding path. That is, when the first service message belongs to a risky service flow and there is a potential threat, the second service message is sent to the next-hop device on the service flow forwarding path.

[0254] It can be understood that the value of the first field in the second service message sent at this time indicates that the second service message is at risk, and the risk type indicated by the value of the third field is the same as that of the third service message. At this time, the second service message is at risk means that the second service message belongs to a message of a risky service flow and has a potential threat.

[0255] As an example, during security detection, if it is detected that the flow identification information of the first business message is the same as the flow identification information of the third business message, and the first business message includes malicious features, that is, the first business message is a risky message, the obtained second business message is blocked.

[0256] As an example, during security detection, if it is detected that the flow identification information of the first business message is different from the flow identification information of the third business message, but the first business message includes malicious features, that is, the first business message is a risky message, the obtained second business message is blocked.

[0257] The embodiments of the present application can improve network security by blocking service messages with malicious characteristics and prevent risky messages with threats from affecting network security.

[0258] (3) In response to the value of the second field in the detection tag information in the first service message being the fourth value and the value of the first field being the first value, the security device sends the second service message to the next hop device on the service flow forwarding path.

[0259] If the value of the second field in the first service message is the fourth value and the value of the first field is the first value, it means that the first service message has been safely checked and there is no risk. In order to save resources and reduce workload, the security device can directly send the second service message to the next hop device on the service flow forwarding path without performing security checks. At this time, the second service message sent is the same as the first service message.

[0260] When the value of the second field in the detection mark information is the fourth value and the value of the first field is the first value, the security device in the embodiment of the present application directly sends the second service message to the next-hop device on the service flow forwarding path, which can save resources and reduce workload.

[0261] As an example, in order to facilitate the security device to perform security detection on the service message, the security device records the flow identification information of each service flow through the session table, and implements security detection on the service message based on the session table.

[0262] Exemplarily, for each service flow, when the security device receives the service message of the service flow for the first time, it establishes a session table based on the service message received for the first time, and then the service message of the service flow is security checked according to the session table, and the service message forwarding process is performed through the session table.

[0263] As an example, the session table includes the following content:

[0264] Current Total Sessions:1

[0265] icmp VPN:public-->public ID:a58f3a20d0900198275d3847c2

[0266] Zone:trust-->untrust TTL:00:00:20Left:00:00:04

[0267] Recv Interface: GigabitEthernet1 / 0 / 2

[0268] Interface:GigabitEthernet1 / 0 / 4NextHop:1.1.1.2MAC:707b-e8c8-0a76

[0269] <--packets:10bytes:600-->packets:10bytes:600

[0270] 2.2.2.2.1-->1.1.1.2:2048PolicyName:Allow Admin Ping

[0271] In the above example, Current Total Sessions is the total number of current session tables, icmp is the protocol name in the session table, the first public in VPN:public-->public indicates the source VPN, the second public indicates the destination VPN, ID is the ID of the current session, Zone indicates the security zone, trust in Zone:trust-->untrust indicates the source domain, and untrust indicates the destination domain, TTL is the lifetime of the session table, Left is the remaining time in the session table, Recv Interface is the inbound interface, Interface is the outbound interface, NextHop is the gateway address, MAC is the next hop MAC address, <--packets is the number of reverse packets, -->packets is the number of forward packets, 2.2.2.2.1-->1.1.1.2:2048 is the source IP / port and the destination IP address / port, and PolicyName is used to indicate the security policy that the packet matches.

[0272] As an example, for each service flow, when the security device detects a third service message that is risky in the service flow, it will mark the session table of the service flow as risky to indicate that the service flow is risky.

[0273] As an example, the security device matches the flow identification information of each received first service message with the flow identification information in the session table marked with a risk tag to detect the first service message with risk. The embodiment of the present application records the flow identification information and the security policy through the session table, which can facilitate the security device to perform security detection and improve the processing efficiency of the security device.

[0274] In some embodiments of the present application, a whitelist is provided for a specific service flow, and the whitelist includes the flow identification information of the specific service flow. When the flow identification information of the first service message is obtained, the security device matches the flow identification information of the first service message with the flow identification information in the whitelist. If the flow identification information of the first service message is the same as the flow identification information in the whitelist, the first service message is forwarded without security detection, thereby improving processing efficiency. If the flow identification information of the first service message is different from the flow identification information in the whitelist, a security detection is required for the first service message.

[0275] like Fig. 20 As shown, Fig. 20A detection process diagram of a security device. After receiving the first service message, the security device parses the frame header of the first service message, strips the frame header of the first service message, parses the IP message header, and obtains the detection tag information and flow identification information of the first service message. Based on the flow identification information, basic security detections such as whitelist detection and distributed denial of service (DDos) attack prevention detection are performed, and IP / MAC address binding is performed. After that, the session is matched according to the flow identification information to detect whether a session needs to be established. If the first service message is the first packet of the service flow and no matching session is found, the first packet session establishment process is executed, and security detection is performed based on the security policy. If the first service message is not the first packet of the service flow and a matching session is found, the subsequent packet processing process is executed, and security detection is performed based on the security policy in the session table. The security detection includes detecting whether the malicious features in the malicious database are included, and detecting whether the flow identification information is the same as the flow identification information of the third service message that has been detected to be at risk. After the detection is completed, the detection mark information in the first service message is updated according to the security detection result, and the message is encapsulated based on the updated detection mark information to obtain a second service message, and the second service message is sent to the next hop device on the service flow path.

[0276] Among them, the specific process of the security device parsing the frame header, stripping the frame header, whitelisting, IP / MAC address binding, first packet session establishment, and encapsulation refers to conventional technology and will not be repeated here.

[0277] The embodiment of the present application can improve network security by performing multiple tests such as whitelist detection, distributed denial of service, attack prevention detection, and security detection on the service message. And by updating the detection mark information through the security detection result, the detection mark information can accurately indicate the risk situation of the service message, so that the network management analyzer can identify the risky service flow forwarding path according to the detection mark information in the service message, thereby ensuring the security of the service.

[0278] Optionally, the next hop device of the security device is a network device. Optionally, the next hop device of the security device is another security device.

[0279] It is understandable that when the next hop device of the security device is other security devices, the processing process of other security devices refers to the above description and is not repeated here. When the next hop device of the security device is a network device, the network device is a network device belonging to an intermediate node on the service flow forwarding path.

[0280] For easier understanding, please refer to Fig.21 , Fig.21Another flow chart of the message detection method provided in the embodiment of the present application is as follows: Fig.21 The method shown can be applied to Fig.11 The service flow transmission system shown in the figure is executed by the second network device. The second network device is a network device belonging to an intermediate node on the service flow forwarding path, such as Fig.12 The network devices R2 and R3 in the example. Fig.21 As shown, the message detection method provided in the embodiment of the present application also includes steps S401 to S403.

[0281] S401, the second network device receives a second service message from a previous-hop device on a service flow forwarding path, the message header of the second service message includes detection mark information, the detection mark information includes a first field, and the value of the first field is used to indicate whether the second service message has a risk.

[0282] Optionally, for the second network device that is an intermediate node, the previous hop device on the service flow forwarding path is another network device or a security device.

[0283] Exemplarily, when the second network device is Fig.12 When the network device R2 in the previous hop is the network device R1, when the second network device is Fig.12 When the network device R3 is used, the previous hop device is the security device FW1.

[0284] It can be understood that when the previous hop device of the second network device is the first network device, the second service message received by the second network device is the first service message encapsulated by the first network device. When the previous hop device of the second network device is a security device or other network device except the first network device, the second service message is the service message obtained after forwarding and / or security detection of the first service message.

[0285] In an embodiment of the present application, the message header of the second service message received by the second network device includes detection tag information. Exemplarily, the IFIT message header of the second service message received by the second network device includes detection tag information, when the second service message is an MPLS protocol message, the IFIT message header is located in the MPLS message header of the second service message, and when the second service message is an SRv6 protocol message, the IFIT message header is located in the extended header SRH of the second service message.

[0286] In the embodiment of the present application, the detection mark signal includes a first field, and the value of the first field is used to indicate whether the second service message has a risk.

[0287] It is understandable that when the first service message encapsulated by the first network device includes the second field and the third field, the second service message received by the second network device also includes the second field and the third field. For the explanation of the second field and the third field, refer to the above explanation and will not be repeated here.

[0288] When the previous hop device of the second network device is the first network device, the values ​​of the first field, the second field, and the third field in the second service message received by the second network device are the same as the values ​​of the first field, the second field, and the third field in the first service message encapsulated by the first network device.

[0289] For example, if the value of the first field in the first service message encapsulated by the first network device is set to the first value, the value of the first field in the second service message received by the second network device is also the first value. If the value of the second field in the first service message encapsulated by the first network device is set to the third value, the value of the second field in the second service message received by the second network device is also the third value. If the value of the second field in the first service message encapsulated by the first network device is set to the fifth value, the value of the fifth field in the second service message received by the second network device is also the fifth value.

[0290] When the previous-hop device of the second network device is a security device or other network device other than the first network device, the values ​​of the first field, the second field, and the third field in the second service message received by the second network device may be different from the values ​​of the first field, the second field, and the third field in the first service message encapsulated by the first network device.

[0291] For example, if the second service message received by the second network device is a service message obtained by the previous hop security device after security detection, the value of the second field in the second service message received by the second network device will be set to a fourth value, and the fourth value is used to indicate that the second service message has been security detected. And if there is a risk in the security detection, the value of the first field will be set to a second value, and the second value is used to indicate that there is a risk in the second service message.

[0292] It can be understood that if the second service message received by the second network device is only obtained by forwarding the first service message encapsulated by the first network device through multiple consecutive hops of network devices, and the second service message has not been security checked, then the values ​​of the first field, the second field, and the third field in the second service message are the same as the values ​​of the first field, the second field, and the third field in the first service message encapsulated by the first network device.

[0293] S402: The second network device sends flow security status information to the network management analyzer, where the flow security status information is used to indicate whether the second service message has a risk.

[0294] In order to detect risky service messages and risky service flow forwarding paths in the service flow, after receiving the second service message, the second network device can send flow security status information of the second service message to the network management analyzer.

[0295] Correspondingly, the flow security status information of the second service message is used to indicate whether the second service message has a risk. The flow security status information of the second service message refers to the flow security status information of the first service message, which will not be described in detail here.

[0296] S403: The second network device sends a second service message to a next-hop device on the service flow forwarding path.

[0297] When the second network device is an intermediate node on the service flow forwarding path, the second network device also needs to send the second service message to the next-hop device so that the second service message is forwarded to the destination network node through the next-hop device.

[0298] Optionally, the next hop device of the second network device is other network devices, or a security device, which is specifically determined according to the service flow forwarding path.

[0299] When the second network device is the tail node on the service flow forwarding path, the second network device sends the second service message to the destination device.

[0300] In the embodiment of the present application, after receiving the service message, each network device will upload the flow security status information of the service message to the network management analyzer, so that the network management analyzer can identify the risky service flow message and the risky service flow forwarding path according to the flow security status information. Wherein, each network device includes a first network device and a second network device.

[0301] In order to obtain the risk status of the service flow in a timely manner, in some embodiments of the present application, each network device uses telemetry to report the flow security status information to the network management analyzer.

[0302] Among them, through telemetry technology, each network device periodically and actively reports the flow security status information of the service message to the network management analyzer through push mode. The collection cycle of telemetry technology can reach sub-second level. Therefore, each network device uploads the flow security status information to the network management analyzer through telemetry technology, which enables the network management analyzer to timely discover the risky service messages in the service flow and the risky service flow forwarding path.

[0303] Exemplarily, the network management analyzer and the network device pre-subscribe to the data information that needs to be collected, such as the flow security status information in the embodiment of the present application. Then, the network device adopts the flow security status information in the service message according to the subscription requirements, and then encodes the collected flow security status information and actively uploads it to the network management analyzer.

[0304] As an example, the network device uses the GPB (google protocol buffers) encoding format to encode the flow security status information, and then uploads the encoding result to the network management analyzer. The GPB encoding format is a binary encoding, and the GPB encoding can improve the data collection efficiency.

[0305] As an example, the network device uploads the encoded stream security status information to the network management analyzer based on the Google Remote Procedure Call (gRPC) method. As an example, the network device uploads the encoded stream security status information to the network management analyzer based on the User Datagram Protocol (UDP) method. In this way, for different business scenarios, a matching upload method can be used to achieve the collection of stream security status information.

[0306] In order to reduce the transmission volume and transmission load, in an embodiment of the present application, each network device uploads the flow security status information of the service message when the first field of the service message indicates that the service message is at risk. Exemplarily, after the network device receives the service message, it identifies the detection mark information of the service message, and if the first field in the detection mark information indicates that the service message is at risk, the flow security status information of the service message is uploaded to the network management analyzer. If the first field in the detection mark information indicates that the service message is not at risk, there is no need to upload the flow security status information of the service message to the network management analyzer.

[0307] In order to facilitate the network management analyzer to timely discover the risky business flow forwarding path, in some embodiments of the present application, the flow security status information also includes the identification of the network device. In this way, after each network device sends the flow security status information to the network management analyzer, the network management analyzer can identify the risky business flow forwarding path and the path segment in the risky business flow forwarding path based on the identification of the network device, the flow identification information and the detection mark information.

[0308] For easier understanding, please refer to Fig. 22 , Fig. 22 Another flow chart of the message detection method provided in the embodiment of the present application is as follows: Fig. 22 The method shown can be applied to Fig.11The service flow transmission system shown in FIG. 1 is executed by a network management analyzer, for example, by Fig.12 The network management analyzer in the Fig. 22 As shown, the message detection method provided in the embodiment of the present application also includes steps S501 to S502.

[0309] S501, a network management analyzer receives flow security status information from a network device, the flow security status information includes flow identification information and detection tag information of a service message, the detection tag information includes a first field, and the value of the first field is used to indicate whether the service message has a risk.

[0310] The network management analyzer receives the flow security status information sent by each network device, and the flow security status information includes the flow identification information and detection mark information of the service message.

[0311] The detection mark information includes a first field, the value of which is used to indicate whether the service message has a risk. The detection mark information also includes a second field and a third field, the second field is used to indicate whether the service message has been safely detected, and the third field is used to indicate the risk type of the risk when the service message has a risk.

[0312] In the embodiment of the present application, the flow security status information also includes an identifier of the network device, and each network device has a unique identifier.

[0313] S502, when the value of the first field indicates that the service message is at risk, the network management analyzer outputs an alarm message, the alarm message including an identifier of the service flow forwarding path at risk, or an identifier of some nodes in the service flow forwarding path at risk, the identifier of the service flow forwarding path at risk is determined based on the flow identifier information.

[0314] The alarm information includes an identifier of a risky business flow forwarding path, or an identifier of some nodes in the risky business flow forwarding path.

[0315] In an embodiment of the present application, the identification of the risky business flow forwarding path is determined based on the flow identification information. Exemplarily, a network topology relationship diagram is stored in the network management analyzer. For each business flow forwarding path in the network topology, the network management analyzer stores the flow identification information of the business flow transmitted by the business flow forwarding path, that is, the network management analyzer stores the mapping relationship between the identification of each business flow forwarding path and the flow identification information of the corresponding business flow. Therefore, when the network management analyzer receives the flow security status information, if the value of the first field in the detection mark information in the flow security status information indicates that the business message is at risk, the network management analyzer obtains the identification of the business flow forwarding path corresponding to the flow identification information in the flow security status information according to the mapping relationship. After obtaining the identification of the business flow forwarding path corresponding to the flow identification information in the flow security status information, it is determined that the business flow forwarding path corresponding to the flow identification information in the flow security status information is at risk, and an alarm prompt is issued, and the identification of the business flow forwarding path corresponding to the flow identification information in the flow security status information is output.

[0316] In some embodiments of the present application, the flow security status information uploaded by the network device to the network management analyzer includes the identification of the network device itself. Thus, after the network management analyzer receives the flow security status information of the network device, if the value of the first field in the detection tag information in the flow security status information indicates that the service message is at risk, the network management analyzer issues an alarm based on the identification of the network device and outputs the identification of the network device.

[0317] In some embodiments of the present application, the network management analyzer also stores the identifier of each node in the network topology diagram. After the network management analyzer receives the flow security status information of the network device, if the value of the first field in the detection tag information in the flow security status information indicates that the service message is at risk, the network management analyzer obtains the risky service flow forwarding path based on the mapping relationship and the flow identification information in the flow security status information, and then matches the identifier of the network device that uploaded the flow security status information with the identifier of the node on the service flow forwarding path to obtain the risky section on the service flow forwarding path. Then, an alarm is issued based on the risky section, and the identifier of the node of the risky section is output.

[0318] In some embodiments of the present application, the flow security status information uploaded by the network device to the network management analyzer also includes flow detection data. After receiving the flow detection data, the network management analyzer obtains the packet loss and delay of the service flow based on the flow detection data.

[0319] In some embodiments of the present application, when the value of the first field in the detection mark information in the flow security status information indicates that there is a risk in the service packet, the network management analyzer determines that the service packets discarded in the risk section are discarded due to the risk after determining the risk section, and then outputs a packet loss prompt, which includes a discard description of the discarded service packets.

[0320] The embodiment of the present application sets detection mark information in the business message and indicates the risk of the business message according to the detection mark information. In this way, after receiving the flow security status information, the network management analyzer can identify the risky business flow forwarding path according to the detection mark information in the flow security status information, thereby ensuring the security of the business.

[0321] Below Fig.12 Taking the service flow forwarding path shown in Table 1 as an example, the detection tag information includes the first field, the second field and the third field, and combining the detection tag information shown in Table 1, the message detection method provided in the embodiment of the present application is described. Fig.23 As shown, each network device is deployed to perform flow detection hop by hop.

[0322] First, the network device R1 encapsulates the service flow data to be transmitted to obtain a service message. At this time, the first field in the detection mark information in the service message is 0, the second field is 0, and the third field is 0. The detection mark information in the service message is expressed as 0-0-0 (the value of the second field, the value of the first field, and the value of the third field in sequence). The network device R1 sends the flow security status information to the network management analyzer and sends the service message to the network device R2. At this time, the detection mark information in the flow security status information received by the network management analyzer is 0-0-0, and the network management analyzer does not process it.

[0323] The network device R2 forwards the service message to the security device FW1 and sends the flow security status information to the network management analyzer. At this time, the detection tag information in the flow security status information received by the network management analyzer is still 0-0-0, and the network management analyzer does not process it. Correspondingly, the detection tag information in the service message forwarded to the security device FW1 is also 0-0-0.

[0324] After receiving the service message, the security device FW1 performs a security check on the service message. If no risk is detected, the second field in the detection mark information in the service message is set to 1. At this time, the detection mark information in the service message is 1-0-0. The security device FW1 sends the service message with the detection mark information of 1-0-0 to the network device R3.

[0325] After receiving the service message sent by the security device FW1, the network device R3 sends the flow security status information to the network management analyzer and forwards the received service message to the security device FW2. At this time, the detection tag information in the flow security status information received by the network management analyzer is 1-0-0, and the network management analyzer does not process it. Correspondingly, the detection tag information in the service message forwarded to the security device FW2 is also 1-0-0.

[0326] After security device FW2 receives the service message forwarded by network device R3, it performs a security check on the service message and detects that the service message is at risk of file filtering. Security device FW2 sets the first field of the detection mark information in the service message to 1 and the third field to 1. At this time, the detection mark information in the service message is 1-1-1.

[0327] After the security device FW2 detects that the service message has the risk of file filtering, the security device FW2 blocks the service message and sets the first field of the detection mark information in the service message with the same flow identification information but no malicious features are detected to 1 and the third field to 1.

[0328] The security device FW2 sends a service message with detection tag information of 1-1-1 to the network device R4.

[0329] After receiving the service message sent by the security device FW2, the network device R4 sends the flow security status information to the network management analyzer. At this time, the detection mark information in the flow security status information received by the network management analyzer is 1-1-1. The network management analyzer marks the risk of the service flow forwarding path, or marks the risk of the path segment from the network device R3 to the network device R4, and outputs an alarm message to indicate that the security detection is abnormal. The alarm message includes the identifier of the service flow forwarding path, or the identifiers of the network devices R3 and R4.

[0330] The device detection method provided in the embodiment of the present application can assist in identifying risky messages and / or risky paths in the business flow at the management and control analysis layer by setting detection mark information in the message and indicating risks of the message through the detection mark information.

[0331] Based on the same inventive concept, the embodiment of the present application also provides a safety device, Fig.24 A schematic diagram of the structure of the security device 100 provided in the embodiment of the present application. Fig.24 The safety device 100 shown in FIG. 1 is, for example, the above-mentioned Fig.18 , Fig.19 , Fig. 20 The safety device in the corresponding embodiment, or Fig.12 Safety device FW1 and safety device FW2 in.

[0332] like Fig.24 As shown, the security device 100 includes a receiving unit 101 and a sending unit 102; wherein the receiving unit 101 is used to receive a first business message from a previous-hop device on a business flow forwarding path, and the message header of the first business message includes detection mark information, and the detection mark information includes a first field, and the first field is used to indicate whether the first business message has a risk; the sending unit 102 is used to send a second business message to a next-hop device on the business flow forwarding path, wherein the second business message is the same as the first business message, or the second business message is obtained by updating the value of the first field in the first business message.

[0333] Optionally, if the value of the first field in the first business message is a second value, the second value indicates that there is a risk in the first business message, and the sending unit 102 is used to: send a second business message to the next hop device on the business flow forwarding path, and the first business message is the same as the second business message.

[0334] Optionally, the security device 100 further includes a security detection unit 103; if the value of the first field in the first service message is a first value, the first value indicates that the first service message does not have a risk, before sending the second service message to the next hop device on the service flow forwarding path, the security detection unit 103 is used to: the security device performs a security detection on the first service message.

[0335] The sending unit 102 is used to: in response to the security detection result of the security device on the first business message indicating that the first business message does not have any risk, send a second business message to the next-hop device on the business flow forwarding path, the first business message is the same as the second business message; in response to the security detection result of the security device on the first business message indicating that the first business message does have any risk, send a second business message to the next-hop device on the business flow forwarding path, the second business message is obtained by updating the value of the first field of the first business message to a second numerical value, and the second numerical value indicates that the second business message does have any risk.

[0336] Optionally, the detection mark information in the first business message also includes a second field, and the value of the second field is used to indicate whether the first business message has been security detected; the security detection unit 103 is used to: in response to the value of the second field in the detection mark information in the first business message being a third numerical value, the third numerical value indicating that the first business message has not been security detected, the security device performs a security check on the first business message.

[0337] Before sending the second service message to the next-hop device on the service flow forwarding path, the security detection unit 103 is also used to: update the value of the second field of the first service message to a fourth value, the fourth value indicating that the first service message has been security detected, thereby obtaining the second service message.

[0338] Optionally, before performing security detection on the first service message, the security detection unit 103 is further configured to:

[0339] In response to the value of the second field in the detection mark information in the first service message being the fourth value, the security detection unit 103 omits the step of performing security detection on the first service message.

[0340] Optionally, the security detection unit 103 is used to: determine whether the flow identification information of the first business message is the same as the flow identification information of the third business message that has been detected to be at risk; in response to the flow identification information of the first business message being the same as the flow identification information of the third business message that has been detected to be at risk, determine that the security detection result of the first business message indicates that the first business message is at risk; in response to the flow identification information of the first business message being different from the flow identification information of the third business message that has been detected to be at risk, determine whether the first business message includes malicious features in a malicious feature library; in response to the flow identification information of the first business message being different from the flow identification information of the third business message that has been detected to be at risk by the security device, and the first business message does not include malicious features in the malicious feature library, determine that the security detection result of the first business message indicates that the first business message is not at risk; in response to the flow identification information of the first business message being different from the flow identification information of the third business message that has been detected to be at risk by the security device, and the first business message includes malicious features in the malicious feature library, determine that the security detection result of the first business message indicates that the first business message is at risk.

[0341] Optionally, the flow identification information includes one or more of the following: address information of the source end, address information of the destination end, port number of the source end, port number of the destination end, and protocol type.

[0342] Optionally, the detection mark information also includes a third field, and the value of the third field is used to indicate the risk type of the risk when there is a risk in the first service message.

[0343] Optionally, the risk type includes one or more of the following: file risk, protocol risk, and website risk.

[0344] Optionally, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

[0345] Optionally, the first service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

[0346] Optionally, the first service packet is an SRv6 protocol packet, and the IFIT packet header is located in an extended header SRH of the first service packet; or, the first service packet is an MPLS protocol packet, and the IFIT packet header is located in an MPLS packet header of the first service packet.

[0347] See also Fig.25 , Fig.25 A schematic diagram of the structure of a safety device provided in an embodiment of the present application. Fig.25 The safety device 100 shown in FIG. 1 is, for example, the above-mentioned Fig.18 , Fig.19 , Fig. 20 The safety device in the corresponding embodiment, or Fig.12 Safety device FW1 and safety device FW2 in.

[0348] like Fig.25 As shown, the security device 200 includes a processor 201, a memory 202, and a network interface 203. The processor 201, the memory 202, and the network interface 203 are connected via a double data rate (DDR) bus or other types of buses. The network interface 203 is used to communicate with other devices, for example, to receive service messages sent by a network device or other security devices through the network interface 203, or to send service messages to a network device or other security devices through the network interface.

[0349] The processor 201 may be a central processing unit (CPU) or other specific integrated circuits. The processor 201 may also be other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. In practical applications, the security device may also include multiple processors, and the processor may include one or more processor cores.

[0350] The memory 202 is usually used to store computer program executable program codes. The executable program codes include instructions, and the processor 201 executes various functional applications and data processing of the security device 200 by running the instructions stored in the memory. The memory 202 includes a program storage area and a data storage area. The program storage area can store an operating system, an application required for at least one function, etc., and the data storage area can store data created during the use of the security device 200, etc.

[0351] In addition, the memory 202 may include a high-speed random access memory and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, a universal flash storage (UFS), etc.

[0352] It is understandable that this application Fig.25 The structure shown does not constitute a specific limitation on the security device 200. In other embodiments of the present application, the security device 200 may include more or fewer components than shown in the figure, or combine some components, or separate some components, or arrange the components differently, and the components may be implemented in hardware, software, or a combination of software and hardware.

[0353] See also Fig.26 , Fig.26 A schematic diagram of the structure of a network device 300 provided in an embodiment of the present application. Fig.26 The network device 300 shown in FIG. 1 is, for example, the Fig.14 The first network device in the corresponding embodiment, or Fig.12 Network device R1 in.

[0354] like Fig.26 As shown, the network device 300 includes a processing unit 301 and a sending unit 302; wherein the processing unit 301 is used to encapsulate the service flow data to be transmitted, thereby obtaining a first service message, and the message header of the first service message includes detection mark information, the detection mark information includes a first field, the value of the first field is set to a first value, and the first value is used to indicate that there is no risk in the first service message; the sending unit 302 is used to send the first service message to the next hop device on the service flow forwarding path. Optionally, the detection mark information also includes a second field, the value of the second field is set to a third value, and the third value is used to indicate that the first service message has not been securely detected.

[0355] Optionally, the detection mark information also includes a third field, the value of the third field is set to a fifth numerical value, and the fifth numerical value is used to indicate that the risk type of the first service message is to be set.

[0356] Optionally, the risk type includes one or more of the following: file risk, protocol risk, and website risk.

[0357] Optionally, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

[0358] Optionally, the first service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

[0359] Optionally, the first service packet is an SRv6 protocol packet, and the IFIT packet header is located in an extended header SRH of the first service packet; or, the first service packet is an MPLS protocol packet, and the IFIT packet header is located in an MPLS packet header of the first service packet.

[0360] Optionally, the sending unit 302 is further used to: send flow security status information to the network management analyzer, where the flow security status information is used to indicate whether the first service message has a risk.

[0361] Optionally, the flow security status information includes flow identification information and detection mark information of the first service message.

[0362] See also Fig. 27 , Fig. 27 A schematic diagram of the structure of a network device 400 provided in an embodiment of the present application. Fig. 27 The network device 400 shown in FIG. 1 is, for example, the Fig.21 The second network device in the corresponding embodiment, or Fig.12 Network device R2, network device R3 or network device R4.

[0363] like Fig. 27 As shown, the network device 400 includes a receiving unit 401 and a sending unit 402, wherein the receiving unit 401 is used to receive a second service message from a previous-hop device on a service flow forwarding path, the message header of the second service message includes detection mark information, the detection mark information includes a first field, and the value of the first field is used to indicate whether the second service message is at risk; the sending unit 402 is used to send flow security status information to a network management analyzer, and the flow security status information is used to indicate whether the second service message is at risk.

[0364] Optionally, the detection mark information also includes a second field, and the value of the second field is used to indicate whether the second service message has been security detected.

[0365] Optionally, the detection mark information further includes a third field, and a value of the third field is used to indicate a risk type of the risk when the second service message has a risk.

[0366] Optionally, the risk type includes one or more of the following: file risk, protocol risk, and website risk.

[0367] Optionally, the first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits. In this way, it is convenient for service messages to carry detection mark information and realize the identification of risky service flow forwarding paths.

[0368] Optionally, the second service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

[0369] Optionally, the second service packet is an SRv6 protocol packet, and the IFIT packet header is located in an extended header SRH of the second service packet; or, the second service packet is an MPLS protocol packet, and the IFIT packet header is located in an MPLS packet header of the second service packet.

[0370] Optionally, the flow security status information includes flow identification information and detection mark information of the second service message.

[0371] Optionally, the sending unit 402 is further configured to: in response to the second network device being an intermediate node on the service flow forwarding path, send the second service message to a next-hop device on the service flow forwarding path.

[0372] See also Fig.28 , Fig.28 A schematic diagram of the structure of a network device 500 provided in an embodiment of the present application. Fig.28 The network device 500 shown can be used to execute the steps executed by any one of the first network device and the second network device described in the above embodiments. Fig.28 Although the network device 500 shown in the figure shows certain specific features, those skilled in the art will realize from the embodiments of the present application that for the sake of brevity, Fig.28 Various other features are not shown to avoid confusing more relevant aspects of the embodiments disclosed in the embodiments of the present application. To this end, as an example, in some implementations, the network device 500 includes one or more processors (e.g., CPU) 501, a network interface 502, a memory 503, and one or more communication buses 504 for interconnecting various components. In other implementations, the network device 500 can also omit or increase some functional components or units based on the above examples.

[0373] In some implementations, the network interface 502 is used for other network devices / security devices to connect. In some implementations, the communication bus 505 includes circuits for interconnecting and controlling the communication between system components. The memory 503 can include non-volatile memory and can also include volatile memory.

[0374] In some implementations, the non-transitory computer-readable storage medium of memory 503 stores the following programs, modules, and data structures, or a subset thereof, including, for example, a processing unit (not shown in the figure), a sending unit (not shown in the figure), and a receiving unit (not shown in the figure).

[0375] In a possible embodiment, the network device 500 has the above Fig.14 and Fig.21 Any function in the network device in the corresponding method embodiment.

[0376] It should be understood that in the present application, the data sending and receiving operation can be completed by the network interface 502 on the network device 500, or the processor 501 can call the program code in the memory and cooperate with the network interface 502 to implement the data sending and receiving operation when necessary.

[0377] Optional, this application Fig.28 The specific structure of the network device is as follows: Fig.29 shown.

[0378] Fig.29 A schematic diagram of the structure of a network device 600 provided in an embodiment of the present application. Fig.29 The network device 600 shown can be used to execute the steps executed by any one of the first network device and the second network device in the above embodiments. The network device 600 includes: a main control board 601 and an interface board 602 .

[0379] The main control board 601 is also called a main processing unit (MPU) or a route processor. The main control board 601 is used to control and manage various components in the network device 600, including routing calculation, device management, device maintenance, and protocol processing functions. The main control board 601 includes: a central processing unit 6011 and a memory 6012.

[0380] The interface board 602 is also called a line processing unit (LPU), a line card (line card) or a service board. The interface board 602 is used to provide various service interfaces and realize the forwarding of data packets. The service interfaces include but are not limited to Ethernet interfaces, POS (Packet over SONET / SDH) interfaces, etc. The interface board 602 includes: a central processing unit 6021, a network processor 6022, a physical interface card (physical interface card, PIC) 6023 and a forwarding table entry memory 6024.

[0381] The central processor 6021 on the interface board 602 is used to control and manage the interface board 602 and communicate with the central processor 6011 on the main control board 601 .

[0382] The network processor 6022 is used to implement message forwarding processing. The network processor 6022 can be in the form of a forwarding chip.

[0383] The physical interface card 6023 is used to implement the physical layer docking function, and the original traffic enters the interface board 602 from it, and the processed message is sent from the physical interface card 6023. The physical interface card 6023 includes at least one physical interface, which is also called a physical port. The physical interface can be a Flexible Ethernet (FlexE) physical interface. In some embodiments, the central processor 6021 of the interface board 602 can also perform the functions of the network processor 6022, such as implementing software forwarding based on a general-purpose CPU, so that the network processor 6022 is not required in the interface board 602.

[0384] Optionally, the network device 600 includes multiple interface boards. For example, the network device 600 also includes an interface board 603 . The interface board 603 includes: a central processor 6031 , a network processor 6032 , a physical interface card 6033 , and a forwarding table entry memory 6034 .

[0385] Optionally, the network device 600 further includes a switching fabric board 604. The switching fabric board 604 can also be referred to as a switch fabric unit (SFU). When the network device has multiple interface boards 602, the switching fabric board 604 is used for data exchange between the interface boards. For example, the interface board 602 and the interface board 603 can communicate through the switching fabric board 604.

[0386] The main control board 601 is coupled to the interface board. For example, the main control board 601, the interface board 602, the interface board 603, and the switching network board 604 are connected to each other through a system bus and / or a system backplane to achieve intercommunication. In a possible implementation, an inter-process communication (IPC) channel is established between the main control board 601 and the interface board 602, and the main control board 601 and the interface board 602 communicate through the IPC channel.

[0387] Logically, the network device 600 includes a control plane and a forwarding plane. The control plane includes a main control board 601 and a central processor 6021. The forwarding plane includes various components for performing forwarding, such as a forwarding table entry memory 6024, a physical interface card 6023, and a network processor 6022. The control plane performs functions such as publishing routes, generating forwarding tables, processing signaling and protocol messages, and configuring and maintaining the status of the device. The control plane sends the generated forwarding table to the forwarding plane. On the forwarding plane, the network processor 6022 forwards the message received by the physical interface card 6023 based on the forwarding table sent by the control plane. The forwarding table sent by the control plane can be stored in the forwarding table entry memory 6024. In some embodiments, the control plane and the forwarding plane can be completely separated and not on the same device.

[0388] It should be understood that the operation on the interface board 603 in the embodiment of the present application is consistent with the operation of the interface board 602, and for the sake of brevity, it will not be repeated. It should be understood that the network device 600 of this embodiment can correspond to the first network device in the above-mentioned various method embodiments, and the main control board 601, the interface board 602 and / or the interface board 603 in the network device 600 can implement the functions and / or various steps implemented by the first network device in the above-mentioned various method embodiments, and for the sake of brevity, it will not be repeated here.

[0389] It is worth noting that there may be one or more main control boards, and when there are multiple boards, they can include a main main control board and a standby main control board. There may be one or more interface boards. The stronger the data processing capability of the network device, the more interface boards are provided. There may also be one or more physical interface cards on the interface board. There may be no switching network board, or there may be one or more switching network boards. When there are multiple switching network boards, they can jointly realize load sharing and redundant backup. Under the centralized forwarding architecture, the network device may not need a switching network board, and the interface board bears the processing function of the service data of the entire system. Under the distributed forwarding architecture, the network device can have at least one switching network board, and the data exchange between multiple interface boards is realized through the switching network board, providing large-capacity data exchange and processing capabilities. Optionally, the form of the network device can also be only one board, that is, there is no switching network board, and the functions of the interface board and the main control board are integrated on the board. At this time, the central processor on the interface board and the central processor on the main control board can be merged into one central processor on the board to perform the functions of the two superimposed. Which architecture to adopt depends on the specific networking deployment scenario, and it is not limited here.

[0390] It should be understood that the network devices in the above-mentioned various product forms respectively have any functions of the first network device and the second network device in the above-mentioned method embodiment, which will not be repeated here.

[0391] See also Fig.30 , Fig.30 A schematic diagram of the structure of the network management analyzer 700 provided in the embodiment of the present application. Fig.30 The network management analyzer 700 shown in FIG. 1 is, for example, the Fig. 22 The first network device in the corresponding embodiment, or Fig.12 The network management analyzer in.

[0392] like Fig.30As shown, the network management analyzer 700 includes a receiving unit 701 and an alarm unit 702, wherein the receiving unit 701 is used to receive flow security status information from a network device, the flow security status information includes flow identification information of a service message, and detection tag information, the detection tag information includes a first field, the value of the first field is used to indicate whether the service message is at risk; the alarm unit 702 is used to output alarm information when the value of the first field indicates that the service message is at risk, the alarm information includes an identification of a service flow forwarding path at risk, or an identification of some nodes in the service flow forwarding path at risk. The identification of the service flow forwarding path at risk is determined based on the flow identification information. Please refer to Fig.31 , Fig.31 A schematic diagram of the structure of the network management analyzer 800 provided in the embodiment of the present application. Fig.31 The network management analyzer 800 shown in FIG. 8 is, for example, the Fig. 22 The first network device in the corresponding embodiment, or Fig.12 The network management analyzer in.

[0393] like Fig.31 As shown, the network management analyzer 800 includes a network interface 801 , a processor 802 , and a memory 803 .

[0394] The network interface 801 is used to communicate with other devices. For example, the network interface 801 can receive flow security status information uploaded by a network device.

[0395] The memory 803 is generally used to store computer program executable program codes. The executable program codes include instructions, and the processor 802 executes various functional applications and data processing of the network management analyzer 800 by running the instructions stored in the memory. The memory 803 can include a program storage area and a data storage area. The program storage area can store an operating system, an application required for at least one function, etc., and the data storage area can store data created during the use of the network management analyzer 800, etc.

[0396] It can be understood that the structures listed in the present application do not constitute a specific limitation on the network management analyzer 800. In other embodiments of the present application, the network management analyzer 800 may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently, and the components may be implemented in hardware, software, or a combination of software and hardware.

[0397] In addition, an embodiment of the present application further provides an electronic device. The electronic device includes a memory and a processor communicating with the memory. The memory includes computer-readable instructions; the processor is used to execute the computer-readable instructions, so that the electronic device executes the method executed by the security device, network device or network management analyzer side in the above embodiment.

[0398] In addition, an embodiment of the present application also provides a service flow transmission system, including one or more security devices, one or more network devices and a network management analyzer; the security device, network device, and network management analyzer are used to execute the methods in the above embodiments.

[0399] An embodiment of the present application also provides a computer-readable storage medium, on which computer program instructions are stored. When the computer program instructions are executed by a processing circuit, the functions or steps in the above-mentioned message detection method are implemented.

[0400] In addition, an embodiment of the present application may also provide a chip system, which includes a processing circuit and a storage medium, wherein the storage medium stores computer program instructions, and when the computer program instructions are executed by the processing circuit, the functions or steps in the above-mentioned message detection method are implemented.

[0401] In addition, an embodiment of the present application may also provide a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the functions or steps in the above-mentioned message detection method.

[0402] Through the description of the above implementation methods, technical personnel in the relevant field can clearly understand that, for the convenience and conciseness of description, the specific working processes of the chip system, electronic device, computer-readable storage medium, computer program product containing instructions, and business flow transmission system described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0403] It is understandable that the steps of the method or algorithm described in conjunction with the embodiments of the present application can be implemented in a hardware manner, or can be implemented by a processor executing a software instruction. The software instruction can be composed of corresponding software modules, and the software module can be stored in a random access memory, a flash memory, an erasable programmable read-only memory, an electrically erasable programmable read-only memory, a register, a hard disk, a mobile hard disk, a read-only optical disk, or any other form of storage medium. An exemplary storage medium is coupled to a processor so that the processor can read information from the storage medium and can write information to the storage medium. Of course, the storage medium can also be a component of the processor. The processor and the storage medium can be located in an application specific integrated circuit (Application Specific Integrated Circuit, ASIC). In addition, the ASIC can be located in an electronic device. Of course, the processor and the storage medium can also be present in an electronic device as discrete components.

[0404] In an optional manner, when software is used for implementation, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is implemented in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions may be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a digital video disk (DVD)), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0405] The above is only a specific implementation of the embodiment of the present application, but the protection scope of the embodiment of the present application is not limited thereto, and any changes or replacements within the technical scope disclosed in the embodiment of the present application should be included in the protection scope of the embodiment of the present application. Therefore, the protection scope of the embodiment of the present application should be based on the protection scope of the claims.

Claims

1. A message detection method, characterized in that: The method comprises: The security device receives a first service message from a previous-hop device on a service flow forwarding path, wherein a message header of the first service message includes detection mark information, and the detection mark information includes a first field, and a value of the first field is used to indicate whether the first service message has a risk; The security device sends a second service message to a next-hop device on the service flow forwarding path, wherein the second service message is the same as the first service message, or the second service message is obtained by updating the value of the first field in the first service message.

2. The message detection method according to claim 1, characterized in that: If the value of the first field in the first service message is a second value, and the second value indicates that the first service message is at risk, the security device sends the second service message to a next-hop device on the service flow forwarding path, including: The security device sends the second service message to a next-hop device on the service flow forwarding path, where the first service message is the same as the second service message.

3. The message detection method according to claim 1, characterized in that: If the value of the first field in the first service message is a first value, and the first value indicates that the first service message does not have a risk, before the security device sends the second service message to the next hop device on the service flow forwarding path, the method further includes: The security device performs security detection on the first service message; The security device sends a second service message to a next-hop device on the service flow forwarding path, including: In response to the security detection result of the security device on the first service message indicating that the first service message does not have a risk, the security device sends a second service message to a next-hop device on the service flow forwarding path, where the first service message is the same as the second service message; In response to the security detection result of the security device on the first business message indicating that the first business message is at risk, the security device sends a second business message to the next-hop device on the business flow forwarding path, where the second business message is obtained by updating the value of the first field of the first business message to a second value, and the second value indicates that the second business message is at risk.

4. The message detection method according to claim 3, characterized in that: The detection mark information in the first service message further includes a second field, and a value of the second field is used to indicate whether the first service message has been security detected; The security device performs security detection on the first service message, including: In response to the value of the second field in the detection mark information in the first service message being a third value, the third value indicating that the first service message has not been security detected, the security device performing the security detection on the first service message; Before the security device sends the second service message to the next-hop device on the service flow forwarding path, the method further includes: The value of the second field of the first service message is updated to a fourth value, where the fourth value indicates that the first service message has been security detected, thereby obtaining the second service message.

5. The message detection method according to claim 4, characterized in that: Before the security device performs security detection on the first service message, the method further includes: In response to the value of the second field in the detection mark information in the first service message being the fourth value, the security device omits the step of performing security detection on the first service message.

6. The message detection method according to any one of claims 2 to 5, characterized in that: The security device performs security detection on the first service message, including: The security device determines whether the flow identification information of the first service message is the same as the flow identification information of the third service message with risk that has been detected by the security device; In response to the flow identification information of the first service message being the same as the flow identification information of the third service message that has been detected by the security device as being at risk, the security device determines that the security detection result of the first service message indicates that the first service message is at risk; In response to the flow identification information of the first service message being different from the flow identification information of the third service message with risk that has been detected by the security device, the security device determines whether the first service message includes a malicious feature in a malicious feature library; In response to the flow identification information of the first business message being different from the flow identification information of the third business message that has been detected by the security device as being at risk, and the first business message not including the malicious features in the malicious feature library, the security detection result of determining the first business message indicates that the first business message is not at risk; In response to the fact that the flow identification information of the first business message is different from the flow identification information of the third business message that the security device has detected as risky, and the first business message includes malicious features in a malicious feature library, the security detection result of determining the first business message indicates that the first business message is risky.

7. The message detection method according to claim 6, characterized in that: The flow identification information includes one or more of the following: address information of the source end, address information of the destination end, port number of the source end, port number of the destination end, and protocol type.

8. The message detection method according to any one of claims 1 to 7, characterized in that: The detection mark information also includes a third field, and a value of the third field is used to indicate a risk type of the risk when the first service message has a risk.

9. The message detection method according to claim 8, characterized in that: The risk types include one or more of the following: file risks, protocol risks, and website risks.

10. The message detection method according to any one of claims 8 to 9, characterized in that: The first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

11. The message detection method according to any one of claims 1 to 10, characterized in that: The first service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

12. The message detection method according to claim 11, characterized in that: The first service message is an SRv6 protocol message, and the IFIT message header is located in an extended header SRH of the first service message; or, The first service message is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the first service message.

13. A message detection method, characterized in that: The method comprises: The first network device encapsulates the service flow data to be transmitted, thereby obtaining a first service message, wherein a message header of the first service message includes detection mark information, and the detection mark information includes a first field, and a value of the first field is set to a first value, and the first value is used to indicate that there is no risk in the first service message; The first network device sends the first service message to a next-hop device on a service flow forwarding path.

14. The message detection method according to claim 13, characterized in that: The detection mark information also includes a second field, the value of the second field is set to a third value, and the third value is used to indicate that the first service message has not been security detected.

15. The message detection method according to claim 13 or 14, characterized in that: The detection mark information also includes a third field, the value of the third field is set to a fifth value, and the fifth value is used to indicate that the risk type of the first service message is to be set.

16. The message detection method according to claim 15, characterized in that: The risk types include one or more of the following: file risks, protocol risks, and website risks.

17. The message detection method according to any one of claims 13 to 16, characterized in that: The first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

18. The message detection method according to any one of claims 13 to 17, characterized in that: The first service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

19. The message detection method according to claim 18, characterized in that: The first service message is an SRv6 protocol message, and the IFIT message header is located in an extended header SRH of the first service message; or, The first service message is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the first service message.

20. The message detection method according to any one of claims 13 to 19, characterized in that: The method further comprises: The first network device sends flow security status information to the network management analyzer, where the flow security status information is used to indicate whether the first service message has a risk.

21. The message detection method according to claim 20, characterized in that: The flow security status information includes flow identification information of the first service message and the detection mark information.

22. A message detection method, characterized in that: The method comprises: The second network device receives a second service message from a previous-hop device on a service flow forwarding path, wherein a message header of the second service message includes detection mark information, and the detection mark information includes a first field, and a value of the first field is used to indicate whether the second service message has a risk; The second network device sends flow security status information to the network management analyzer, where the flow security status information is used to indicate whether the second service message has a risk.

23. The message detection method according to claim 22, characterized in that: The detection mark information also includes a second field, and a value of the second field is used to indicate whether the second service message has been security detected.

24. The message detection method according to claim 22 or 23, characterized in that: The detection mark information also includes a third field, and a value of the third field is used to indicate a risk type of the risk when the second service message has a risk.

25. The message detection method according to claim 24, characterized in that: The risk types include one or more of the following: file risks, protocol risks, and website risks.

26. The message detection method according to any one of claims 22 to 25, characterized in that: The first field in the detection mark information occupies 1 bit, the second field occupies 1 bit, and the third field occupies 3 bits.

27. The message detection method according to any one of claims 22 to 26, characterized in that: The second service message includes an in-flow detection IFIT message header, and the detection mark information is located in the IFIT message header.

28. The message detection method according to claim 27, characterized in that: The second service message is an SRv6 protocol message, and the IFIT message header is located in an extended header SRH of the second service message; or, The second service message is an MPLS protocol message, and the IFIT message header is located in the MPLS message header of the second service message.

29. The message detection method according to any one of claims 22 to 28, characterized in that: The flow security status information includes flow identification information of the second service message and the detection mark information.

30. The message detection method according to any one of claims 22 to 29, characterized in that: The method further comprises: In response to the second network device being an intermediate node on the service flow forwarding path, the second network device sends the second service message to a next-hop device on the service flow forwarding path.

31. A message detection method, characterized in that: The method comprises: The network management analyzer receives flow security status information from the network device, wherein the flow security status information includes flow identification information of the service message and detection mark information, wherein the detection mark information includes a first field, and a value of the first field is used to indicate whether the service message has a risk; When the value of the first field indicates that the business message is at risk, an alarm message is output, wherein the alarm message includes an identifier of the business flow forwarding path at risk, or an identifier of some nodes in the business flow forwarding path at risk, wherein the identifier of the business flow forwarding path at risk is determined based on the flow identification information.

32. An electronic device, characterized in that: include: a memory for storing computer program instructions; A processor, used to execute the computer program instructions to support the electronic device to implement the method as described in any one of claims 1-12, or to implement the method as described in any one of claims 13-21, or to implement the method as described in any one of claims 22-30, or to implement the method as described in claim 31.

33. A service flow transmission system, characterized in that: It includes one or more security devices, one or more network devices and a network management analyzer; the security device is used to execute the method described in any one of claims 1-12, the network device is used to execute the method described in any one of claims 13-21 or the method described in any one of claims 22-30, and the network management analyzer is used to execute the method described in claim 31.

34. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer program instructions, which, when executed by a processing circuit, implement the method as described in any one of claims 1 to 12, or the method as described in any one of claims 13 to 21, or the method as described in any one of claims 22 to 30, or the method as described in claim 31.

35. A chip system, characterized in that: The chip system includes a processing circuit and a storage medium, wherein the storage medium stores computer program instructions; when the computer program instructions are executed by the processing circuit, they implement the method as described in any one of claims 1 to 12, or the method as described in any one of claims 13 to 21, or the method as described in any one of claims 22 to 30, or the method as described in claim 31.

36. A computer program product comprising instructions, characterized in that When the computer program product runs on a computer, the computer is enabled to execute the method according to any one of claims 1 to 12, or the method according to any one of claims 13 to 21, or the method according to any one of claims 22 to 30, or the method according to claim 31.

Images