Communication method and device

Abstract

The invention provides a communication method and device, the method is applied to a first node, and the method comprises the steps: receiving a first SRv6 message, the first SRv6 message comprises a first segment list, the first segment list stores a plurality of virtual SIDs, and the plurality of virtual SIDs are used for indicating a first forwarding path for forwarding the first SRv6 message; obtaining a first virtual SID from the plurality of virtual SIDs, wherein the first virtual SID is the virtual SID of the next hop of the first node; if a first SID table item matched with the first virtual SID is obtained from a local SID mapping table, a first actual SID is obtained from the first SID table item, and the first actual SID is the actual SID of the next hop of the first node; and according to the first actual SID, carrying out forwarding processing on the first SRv6 message.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a communication method and device. Background Art

[0002] Segment Routing IPv6 (SRv6) based on the IPv6 forwarding plane is a new generation of IP bearer protocol. In the forwarding process, the Segment Routing Header (SRH) is inserted (or encapsulated) into the IPv6 message, and the Segment List (Segment List) representing the forwarding path is stored in the SRH to forward the SRv6 message through the forwarding path.

[0003] As can be seen from the above, the path information of the entire forwarding path is included in the segment list, and the security of its path information faces severe challenges. Attackers can obtain sensitive information such as network topology and business traffic trends by monitoring network traffic and analyzing segment lists. For example, in critical infrastructure networks (such as power networks and financial networks), if attackers have mastered the network topology, they can launch targeted distributed denial of service attacks (DDoS) or man-in-the-middle attacks, threatening the security and stability of the network.

[0004] Currently, the SRv6 over IPSec technology can ensure the security of SRv6 messages during transmission. For example, during the forwarding process, each node uses the SRv6 message as a payload, and then encapsulates and encrypts the entire SRv6 message through the IPSec protocol. In this way, SRv6 messages can be protected when passing through an insecure network to prevent attackers from intercepting them.

[0005] However, in the above forwarding process, although the use of IPSec protocol protects the path information to a certain extent, it also generally has the problem of great performance impact. For example, each node needs to consume a lot of computing resources during the encryption / decryption process, which leads to increased network delay and reduced throughput, affecting the overall performance of the network. Summary of the invention

[0006] In view of this, the present application provides a communication method and apparatus to solve the problem that the existing use of the IPSec protocol protects path information to a certain extent, but also generally has a significant impact on performance.

[0007] In a first aspect, the present application provides a communication method, which is applied to a first node, and the method includes:

[0008] receiving a first SRv6 message, wherein the first SRv6 message includes a first segment list, wherein the first segment list stores a plurality of virtual SIDs, and the plurality of virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message;

[0009] Acquire a first virtual SID from the multiple virtual SIDs, where the first virtual SID is a virtual SID of a next hop of the first node;

[0010] If a first SID table entry matching the first virtual SID is obtained from the local SID mapping table, a first actual SID is obtained from the first SID table entry, where the first actual SID is an actual SID of the next hop of the first node;

[0011] The first SRv6 message is forwarded according to the first actual SID.

[0012] In a second aspect, the present application provides a communication device, which is applied to a first node, and includes:

[0013] A receiving unit, configured to receive a first SRv6 message, wherein the first SRv6 message includes a first segment list, wherein the first segment list stores a plurality of virtual SIDs, and the plurality of virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message;

[0014] A first acquiring unit, configured to acquire a first virtual SID from the multiple virtual SIDs, where the first virtual SID is a virtual SID of a next hop of the first node;

[0015] a second acquiring unit, configured to acquire a first actual SID from the first SID table entry if a first SID table entry matching the first virtual SID is acquired from the local SID mapping table, where the first actual SID is an actual SID of a next hop of the first node;

[0016] A sending unit is used to forward the first SRv6 message according to the first actual SID.

[0017] In a third aspect, the present application provides a network device, including a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor, and the processor is prompted by the machine-executable instructions to execute the method provided in the first aspect of the present application.

[0018] Therefore, by applying the communication method and device provided by the present application, the first node receives a first SRv6 message, the first SRv6 message includes a first segment list, the first segment list stores multiple virtual SIDs, and the multiple virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message; the first node obtains a first virtual SID from the multiple virtual SIDs, and the first virtual SID is the virtual SID of the next hop of the first node; if a first SID table entry matching the first virtual SID is obtained from the local SID mapping table, the first node obtains a first actual SID from the first SID table entry, and the first actual SID is the actual SID of the next hop of the first node; according to the first actual SID, the first node forwards the first SRv6 message.

[0019] In this way, during the message forwarding process, the virtual SID is used to hide the actual SID, which effectively prevents the forwarding path information from being stolen, improves the security of the SRv6 network, and eliminates the need for complex encryption and decryption operations on the message, reducing the impact on network performance. At the same time, it also solves the problem that the existing use of the IPSec protocol protects the path information to a certain extent, but generally has a large impact on performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 A flow chart of a communication method provided in an embodiment of the present application;

[0021] Figure 2 Schematic diagram of SRv6 networking provided in an embodiment of the present application;

[0022] Figure 3 A structural diagram of a communication device provided in an embodiment of the present application;

[0023] Figure 4 The network device hardware structure provided in the embodiment of the present application. DETAILED DESCRIPTION

[0024] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0025] The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application and the appended claims are also intended to include plural forms unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in this article refers to and includes any or all possible combinations of one or more corresponding listed items.

[0026] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0027] The communication method provided in the embodiment of the present application is described in detail below. Figure 1 , Figure 1 A flow chart of a communication method provided in an embodiment of the present application. The method is applied to a first node, the first node is in an SRv6 network, and the SRv6 network also includes other nodes, for example, a second node, a third node, etc. The communication method provided in an embodiment of the present application may include the following steps.

[0028] Step 110: Receive a first SRv6 message, where the first SRv6 message includes a first segment list, where a plurality of virtual SIDs are stored, and where the plurality of virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message;

[0029] Specifically, in an embodiment of the present application, the first node is an intermediate transmission node on the first forwarding path, and the first node is an Endpoint node. The Endpoint node specifically performs SRv6 related processing on the received SRv6 message. The first forwarding path also includes a source node and a destination node, the source node is the head node of the first forwarding path, and the destination node is the tail node on the first forwarding path. The first forwarding path also includes a transit node. The transit node specifically does not participate in SRv6 processing and only performs ordinary IPv6 message forwarding.

[0030] The first node receives a first SRv6 message sent by the previous hop node.

[0031] The first SRv6 message includes a first IPv6 basic header and a first SRH header. The first IPv6 basic header includes a first destination address (the first destination address should be the actual segment identifier (English: Segment ID, abbreviated as: SID) configured on the first node), and the first SRH header includes a first SL value and a first segment list. The first segment list stores multiple virtual SIDs (virtual SIDs, abbreviated as vSIDs), and the multiple virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message.

[0032] In the embodiment of the present application, the virtual SID is generated by each Endpoint node on the first forwarding path according to the configured actual (real) SID. In the subsequent embodiments, the generation process of the virtual SID will be described in detail and will not be repeated here.

[0033] It is understandable that if the Endpoint node is configured with multiple actual SIDs, a virtual SID is generated corresponding to each actual SID.

[0034] Step 120: Acquire a first virtual SID from the multiple virtual SIDs, where the first virtual SID is a virtual SID of a next hop of the first node;

[0035] Specifically, according to the description of step 110, after receiving the first SRv6 message, the first node first obtains the first SL value from the first SRH header. If the first SL value is greater than 1, the first node subtracts 1 from the first SL value to obtain a first difference.

[0036] The first node obtains the first segment list from the first SRH header. According to the first difference, the first node obtains the first virtual SID indicated by the first difference from the first segment list. The first virtual SID is the virtual SID of the next hop of the first node itself (that is, the virtual SID generated by the next hop Endpoint node).

[0037] In the embodiment of the present application, the virtual SID is generated by each Endpoint node according to the configured actual SID and the current timestamp. Therefore, the virtual SID also has different functions or types (Function, the Function field is in the actual SID, and the local operation instruction identified by it is essentially a node behavior that guides message forwarding and processing, or called SRv6 Endpoint Behavior). For example, it identifies a certain Endpoint node, identifies a certain link, and so on.

[0038] In an example, the first virtual SID may indicate a link between the first node and the next hop node, or may indicate a next hop node. It is understandable that the next hop nodes are all Endpoint nodes.

[0039] The format of the first segment list is: Segment List[0], Segment List[1], etc. For example, if the first SL value is 2, the first node subtracts 1 from the first SL value, that is, 2-1=1. The first node obtains the first virtual SID stored in Segment List[1] indicated by the first difference value 1 from the first segment list.

[0040] Step 130: If a first SID table entry matching the first virtual SID is obtained from the local SID mapping table, a first actual SID is obtained from the first SID table entry, where the first actual SID is the actual SID of the next hop of the first node;

[0041] Specifically, according to the description of step 120, after obtaining the first virtual SID, the first node searches the local SID mapping table according to the first virtual SID. The first node determines whether there is a first SID entry matching the first virtual SID in the local SID mapping table.

[0042] In one implementation, if there is a first SID entry matching the first virtual SID in the local SID mapping table, the first node obtains a first actual SID from the first SID entry. The first actual SID is the actual SID of the next hop of the first node (ie, the actual SID configured by the next hop Endpoint node).

[0043] In another implementation manner, if there is no first SID table entry matching the first virtual SID in the local SID mapping table, the first node discards the first SRv6 message.

[0044] Optionally, in the embodiment of the present application, the first node further generates and stores a local SID mapping table, wherein the local SID mapping table includes SID entries of each Endpoint node on the first forwarding path. Each SID entry includes a mapping relationship between an actual SID of the Endpoint node and a virtual SID.

[0045] Further, each SID list includes an actual SID field, a virtual SID field, a state information field, a time to live (TTL) field, and a timestamp field.

[0046] Among them, the actual SID field stores the actual SID of the Endpoint node (the SID actually used for message forwarding); the virtual SID field stores the virtual SID of the Endpoint node (a virtual SID used for transmission and identification, for example, an IPv6 address in a specific format or a custom number); the status information field stores status information, for example, valid or invalid, and the status information is used to indicate the current status of the mapping relationship between the virtual SID and the actual SID; the lifetime field stores the lifetime, and the lifetime is used to indicate the valid time of the SID table entry to prevent expired mapping relationships from being used incorrectly; the timestamp field stores the timestamp, and the timestamp is used to indicate the time when the SID table entry was last updated.

[0047] It should be noted that the generation of the local SID mapping table by the first node will be described in detail in subsequent embodiments, which will not be repeated here.

[0048] Step 140: Forward the first SRv6 message according to the first actual SID.

[0049] Specifically, according to the description of step 130, after obtaining the first actual SID, the first node forwards the first SRv6 message according to the first actual SID.

[0050] Furthermore, the first node will forward the first SRv6 message according to the provisions of the existing SRv6 protocol.

[0051] According to the first actual SID, the first node searches the local forwarding table, and obtains a first forwarding table entry matching the first actual SID from the local forwarding table, where the first forwarding table entry includes a next hop address and an outbound interface.

[0052] According to the foregoing, the first node calculates the first difference. The first node updates the first SL value to the first difference, and updates the destination address to the first actual SID. After the first node determines the next hop address and the outbound interface, it forwards the updated first SRv6 message to the node indicated by the next hop address (which may be a transit node or an Endpoint node) on the first forwarding path through the interface indicated by the outbound interface.

[0053] Therefore, by applying the communication method provided by the present application, the first node receives a first SRv6 message, the first SRv6 message includes a first segment list, the first segment list stores multiple virtual SIDs, and the multiple virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message; the first node obtains a first virtual SID from the multiple virtual SIDs, and the first virtual SID is the virtual SID of the next hop of the first node; if a first SID table entry matching the first virtual SID is obtained from the local SID mapping table, the first node obtains a first actual SID from the first SID table entry, and the first actual SID is the actual SID of the next hop of the first node; according to the first actual SID, the first node forwards the first SRv6 message.

[0054] In this way, during the message forwarding process, the virtual SID is used to hide the actual SID, which effectively prevents the forwarding path information from being stolen, improves the security of the SRv6 network, and eliminates the need for complex encryption and decryption operations on the message, reducing the impact on network performance. At the same time, it also solves the problem that the existing use of the IPSec protocol protects the path information to a certain extent, but generally has a large impact on performance.

[0055] Optionally, in the embodiment of the present application, before the first node receives the first SRv6 message, the process also includes a process in which the first node receives a keepalive message sent by other neighboring nodes and generates a local SID mapping table according to the keepalive message.

[0056] Specifically, in the SRv6 network, each Endpoint node establishes a neighbor relationship with each other, such as a BGP neighbor relationship, an OSPF neighbor relationship, an ISIS neighbor relationship, etc. After the neighbor relationship is established, each Endpoint node generates a virtual SID (e.g., a second virtual SID) corresponding to each actual SID (e.g., a second actual SID) according to the configured actual SID.

[0057] Each Endpoint node generates a first keepalive message, and carries the second actual SID and the second virtual SID in the first keepalive message. Each Endpoint node sends the first keepalive message to the Endpoint node with which the neighbor relationship is established.

[0058] In one example, the second node sends a first keepalive message to the first node. After receiving the first keepalive message, the first node first verifies the legitimacy of the first keepalive message (ie, checks whether the message format of the keepalive message is correct).

[0059] If the first keepalive message passes the validity verification, the first node obtains the second actual SID and the second virtual SID therefrom.

[0060] According to the second actual SID or the second virtual SID, the first node searches the local SID mapping table for a second SID entry that matches either the second actual SID or the second virtual SID.

[0061] If there is no second SID table entry matching either the second virtual SID or the second actual SID in the local SID mapping table, the first node determines that the mapping relationship between the second virtual SID and the second actual SID is a new mapping relationship. The first node generates a second SID table entry and stores the second virtual SID and the second actual SID in the second SID table entry.

[0062] If the local SID mapping table contains a second SID entry, the first node determines that it has previously learned the mapping relationship between the second virtual SID and the second actual SID. At this time, the first node can update the virtual SID or actual SID stored in the second SID entry according to the second virtual SID or the second actual SID.

[0063] Furthermore, the process of the aforementioned Endpoint node generating a virtual SID corresponding to each actual SID is specifically as follows: the second node is used as an example for explanation. The second node obtains the configured second actual SID; the second node concatenates the second actual SID with the current timestamp to obtain a concatenated SID; the second node performs hash calculation on the concatenated SID using a secure hash algorithm to obtain a second virtual SID.

[0064] In one example, the second actual SID is specifically an IPv6 address: 1000::1234:5678:9abc, and the current timestamp is 20241112143000. The concatenated SID obtained by the second node is 1000::1234:5678:9abc20241112143000. The second node inputs the concatenated SID into the SHA-256 hash function for hash calculation, and obtains a 256-bit (hexadecimal representation, a total of 64 characters) string, as shown below:

[0065] 78a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f89a

[0066] The second node uses the above character string as the second virtual SID.

[0067] Furthermore, the second node may also carry the state information, lifetime, and timestamp included in the SID list in the first keepalive message, so that the first node generates or updates the second SID table entry.

[0068] In actual applications, the mapping relationship between the virtual SID and the actual SID will also change due to changes in the network topology of the SRv6 network, changes in the configuration of management personnel, etc. For example, when an Endpoint node fails or a new Endpoint node is added in the SRv6 network, the network topology changes, resulting in changes in the forwarding path, which affects the mapping relationship between the virtual SID and the actual SID; a new link is added to the SRv6 network, resulting in changes in the forwarding path, which also affects the mapping relationship between the virtual SID and the actual SID.

[0069] At this time, the Endpoint node will generate a new mapping relationship between the virtual SID and the actual SID, and synchronize it to the neighboring Endpoint node through the keepalive message.

[0070] In the embodiment of the present application, after the second node generates the first keepalive message, it may periodically (for example, every 10 seconds) send the first keepalive message. After the network topology changes, after the second node generates the first keepalive message, it will send the first keepalive message three times in a row.

[0071] It should be noted that the second node may also periodically (for example, every 10 seconds) update the virtual SID to ensure the security of the actual SID. After updating the virtual SID, the second node periodically (for example, every 10 seconds) generates and sends the first keepalive message.

[0072] Optionally, in an embodiment of the present application, before the first node receives the first SRv6 message, the process also includes the first node generating and synchronizing a second keepalive message to a neighboring Endpoint node, so that the neighboring Endpoint node generates a local SID mapping table according to the second keepalive message.

[0073] Specifically, in the aforementioned embodiment, the process of generating a virtual SID is described by taking the second node as an example. The process of generating a virtual SID by the first node is the same as the process of generating a virtual SID by the second node, and is only briefly described here.

[0074] The first node obtains the third actual SID; the first node concatenates the third actual SID with the current timestamp to obtain a concatenated SID; and the first node performs hash calculation on the concatenated SID using a secure hash algorithm to obtain a third virtual SID.

[0075] The first node generates a second keepalive message, and carries the third actual SID and the third virtual SID in the second keepalive message. The first node sends the second keepalive message to the neighboring Endpoint nodes respectively.

[0076] In one example, the first node sends a second keepalive message to the third node. The first node may also carry the state information, lifetime, and timestamp included in the SID list in the second keepalive message.

[0077] It can be understood that the processing process of the third node for the second keepalive message is the same as the processing process of the first node for the first keepalive message, which will not be repeated here.

[0078] The triggering and sending conditions and sending period of the first node for the second keepalive message are the same as the triggering and sending conditions and sending period of the second node for the first keepalive message, and are not repeated here.

[0079] Optionally, in an embodiment of the present application, the first node will also delete the SID table entry according to the keepalive message sent by the neighboring Endpoint node.

[0080] Specifically, if the mapping relationship between the virtual SID and the actual SID changes (for example, the mapping relationship becomes invalid, specifically due to link failure, Endpoint node failure, deletion by administrator, etc.), each Endpoint node generates and sends a third keepalive message to the neighboring Endpoint node, and the third keepalive message includes the virtual SID.

[0081] The second node is used as an example for description. If the mapping relationship between the second virtual SID and the second actual SID changes, the second node generates and sends a third keepalive message to the first node, where the third keepalive message includes the second virtual SID.

[0082] After receiving the third keepalive message, the first node first verifies the legitimacy of the third keepalive message (ie, checks whether the message format of the keepalive message is correct).

[0083] If the third keepalive message passes the validity verification, the first node obtains the second virtual SID therefrom.

[0084] According to the second virtual SID, the first node obtains a second SID table entry matching the second virtual SID from the local SID mapping table. The first node deletes the second SID table entry.

[0085] Optionally, in an embodiment of the present application, if the mapping relationship between the third virtual SID and the third actual SID changes (for example, the mapping relationship becomes invalid, specifically due to link failure, Endpoint node failure, deletion by an administrator, etc.), the first node will also generate and send a fourth keepalive message to the third node, and the fourth keepalive message includes the third virtual SID.

[0086] It can be understood that the processing process of the third node on the SID table entry matching the third virtual SID is the same as the processing process of the first node on the second SID table entry matching the second virtual SID, which will not be repeated here.

[0087] Optionally, in an embodiment of the present application, before each keepalive message is sent, each endpoint node encrypts the actual SID and virtual SID carried in the keepalive message, or the virtual SID is carried in the keepalive message. After receiving the keepalive message, the neighboring endpoint node needs to perform decryption processing and then obtain the actual SID and virtual SID, or the virtual SID, from the keepalive message.

[0088] Specifically, the second node uses a locally stored key (for example, an AES symmetric encryption algorithm has been configured and a key is generated by the AES symmetric encryption algorithm) or a public key (for example, an RSA asymmetric encryption algorithm has been configured and a public key corresponding to the RSA asymmetric encryption algorithm) to encrypt the second actual SID and the second virtual SID, and then carries the encrypted second actual SID and the second virtual SID in the first keepalive message.

[0089] After receiving the first keepalive message, the first node first obtains the encrypted second virtual SID and the second actual SID from the message. Using the locally stored key or private key, the first node decrypts the encrypted second virtual SID and the second actual SID to obtain the second virtual SID and the second actual SID;

[0090] or;

[0091] The second node uses a locally stored key (for example, an AES symmetric encryption algorithm has been configured and a key is generated by the AES symmetric encryption algorithm) or a public key (for example, an RSA asymmetric encryption algorithm has been configured and a public key corresponding to the RSA asymmetric encryption algorithm) to encrypt the second virtual SID, and then carries the encrypted second virtual SID in the third keepalive message.

[0092] After receiving the third keepalive message, the first node first obtains the encrypted second virtual SID from it and decrypts the encrypted second virtual SID using a locally stored key or private key (the private key corresponding to the public key) to obtain the second virtual SID.

[0093] It is understandable that when the keepalive message also carries the status information, lifetime and timestamp included in the SID list, all the carried contents may be uniformly encrypted and then carried in the keepalive message.

[0094] In the embodiment of the present application, the AES symmetric encryption algorithm or the RSA asymmetric encryption algorithm can be configured in the Endpoint node in advance, and in the SRv6 network, each Endpoint node is configured with the same encryption algorithm. Among them, the public key exists in the form of a file, and the public key file can be configured in each Endpoint node by the administrator or the controller in advance.

[0095] Optionally, in an embodiment of the present application, before sending a keepalive message, the first node will also perform an encryption process on the actual SID and the virtual SID, or the virtual SID, and carry the encrypted SID in the keepalive message.

[0096] Specifically, the first node uses a locally stored key (for example, an AES symmetric encryption algorithm has been configured, and a key is generated by the AES symmetric encryption algorithm) or a public key (for example, an RSA asymmetric encryption algorithm has been configured, and a public key corresponding to the RSA asymmetric encryption algorithm) to encrypt the third actual SID and the third virtual SID, and then carries the encrypted third actual SID and the third virtual SID in the second keepalive message;

[0097] or;

[0098] The first node uses a locally stored key (for example, an AES symmetric encryption algorithm has been configured and a key is generated by the AES symmetric encryption algorithm) or a public key (for example, an RSA asymmetric encryption algorithm has been configured and a public key corresponding to the RSA asymmetric encryption algorithm) to encrypt the third virtual SID, and then carries the encrypted third virtual SID in the fourth keepalive message.

[0099] It is understandable that when the keepalive message also carries the status information, lifetime and timestamp included in the SID list, all the carried contents may be uniformly encrypted and then carried in the keepalive message.

[0100] Optionally, in an embodiment of the present application, the first node may also serve as a source node to forward received user-side messages.

[0101] Specifically, the first node receives a first message (specifically an IPv6 message) sent by a user-side device. According to the message features (e.g., destination address, triplet, quintuple, etc.) included in the first message, the first node determines that the first message needs to be forwarded through an SRv6 path (e.g., a second forwarding path). At this time, the first node, as a source node, obtains multiple virtual SIDs constituting the second forwarding path from a local SID mapping table according to multiple actual SIDs constituting the second forwarding path.

[0102] The first node stores the acquired multiple virtual SIDs in the second segment list and generates a second SRH header, the second SRH header including the second segment list. It is understandable that according to the provisions of the existing SRv6 protocol, the first node will also set the second SL value included in the second SRH header.

[0103] The first node also generates a second IPv6 basic header, where the second IPv6 basic header includes a second destination address, where the second destination address is an actual SID corresponding to the virtual SID indicated by the second SL value.

[0104] According to the second destination address, the first node searches the local forwarding table and determines the next hop address and the outbound interface. The second SRv6 message is forwarded to the node (e.g., the fourth node) indicated by the next hop address on the second forwarding path through the interface indicated by the outbound interface.

[0105] After receiving the second SRv6 message, the fourth node forwards the second SRv6 message according to the description process of the aforementioned steps 110 to 140.

[0106] The communication method provided in the embodiment of the present application is described in detail below. Figure 2 , Figure 2This is a schematic diagram of the SRv6 network provided in the embodiment of the present application. Figure 2 In the figure, the SRv6 network includes nodes A, B, C, and D. Nodes A and D form a forwarding path, and node A is the source node of the forwarding path and is connected to user-side device 1, node D is the destination node of the forwarding path and is connected to user-side device 2, and nodes B and C are both endpoint nodes.

[0107] Each node establishes a neighbor relationship with each other. After the neighbor relationship is established, each node obtains its actual SID. Each node concatenates the actual SID with the current timestamp (20241112143000) to obtain the concatenated SID. The concatenated SID is hashed using the configured secure hash algorithm to generate a virtual SID corresponding to each actual SID.

[0108] At the same time, each node generates a corresponding SID table entry locally, which includes the actual SID, virtual SID, status information (valid), lifetime (30 minutes) and timestamp (20241112143000)

[0109] Take Node B as an example. Node B generates the corresponding virtual SID1 based on its local actual SID1. Node B has configured the AES symmetric encryption algorithm. Node B generates a key based on the AES symmetric encryption algorithm. Using the key, Node B encrypts the information to be synchronized (including actual SID1, virtual SID1, valid, 30 minutes, 20241112143000) and carries the encrypted information in keepalive message 1.

[0110] Node B sends a keepalive message 1 to each node (node ​​A, node C, node D) with which a neighbor relationship has been established.

[0111] Take node C as an example. After receiving keepalive message 1, node C first verifies the legitimacy of keepalive message 1. If keepalive message 1 passes the legitimacy verification, node C obtains encryption information from it.

[0112] The AES symmetric encryption algorithm has also been configured in node C. According to the AES symmetric encryption algorithm, node C generates a key. Using the key, node C decrypts the encrypted information and obtains actual SID1, virtual SID1, valid, 30 minutes, and 14:40.

[0113] Node C generates a corresponding SID table entry locally and stores the SID table entry in a local SID mapping table. The SID table entry includes actual SID1, virtual SID1, valid, 30 minutes, and 20241112143000.

[0114] Similarly, node A, node C, and node D all send keepalive message 1 to each node with which they have established neighbor relationships. Each node that receives keepalive message 1 generates a corresponding SID entry locally and stores it in the local SID mapping table.

[0115] In one example, after node A receives message 1 sent by user-side device 1, it determines to forward message 1 through a forwarding path (node ​​A-node B-node C-node D) according to destination address 1 included in message 1.

[0116] Node A obtains the virtual SID1, virtual SID2, and virtual SID3 of nodes B, C, and D from the local SID mapping table based on the actual SID1, actual SID2, and actual SID3 of nodes B, C, and D that constitute the forwarding path. Since the forwarding path from node A to node D must pass through the three endpoint nodes of nodes B, C, and D, node A sets the SL value to 2. The SID list information encapsulated by node A is Segment List[0] = virtual SID3, Segment List[1] = virtual SID2, and Segment List[2] = virtual SID1.

[0117] Node A encapsulates the SRH header on the outer layer of message 1, and encapsulates the IPv6 basic header on the outer layer of the SRH header to obtain message 2. The source address included in the IPv6 basic header is the IPv6 address of node A, and the destination address is the actual SID1 corresponding to the virtual SID1 indicated by the SL value, that is, the actual SID1 corresponding to Segment List[2] corresponding to SL=2, and the actual SID1 of node B.

[0118] Node A sends message 2 to node B.

[0119] After receiving message 2, Node B checks the SL value included in the SRH header. If the SL value is greater than 0, Node B decrements the SL value by 1 and obtains the virtual SID 2 indicated by Segment List [1] from the SID list.

[0120] According to virtual SID 2, node B searches the local SID mapping table and determines whether there is a SID entry 1 matching virtual SID 2 in the local SID mapping table.

[0121] If there is a SID entry 1 matching the virtual SID 2 in the local SID mapping table, Node B obtains the actual SID 2 from the SID entry 1. Node B updates the destination address included in the IPv6 basic header to the actual SID 2, and updates the SL value included in the SRH header to 1, thereby obtaining message 3.

[0122] Node B continues to send message 3 to node C.

[0123] Similarly, node C processes message 3 in the same way as node B processes message 2, obtains message 4, and continues to send message 4 to node D.

[0124] After receiving message 4, node D checks the SL value included in the SRH header. If the SL value is equal to 0, node D decapsulates message 4, strips off the IPv6 basic header and SRH header, and obtains message 1. Node D continues to send message 1 to user-side device 2 according to the destination address 1 included in message 1.

[0125] Based on the same inventive concept, the present application embodiment also provides a communication device corresponding to the communication method. Figure 3 , Figure 3 A communication device provided in an embodiment of the present application is applied to a first node, and the device includes:

[0126] A receiving unit 310 is configured to receive a first SRv6 message, where the first SRv6 message includes a first segment list, where a plurality of virtual SIDs are stored in the first segment list, and where the plurality of virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message;

[0127] A first acquiring unit 320 is configured to acquire a first virtual SID from the multiple virtual SIDs, where the first virtual SID is a virtual SID of a next hop of the first node;

[0128] A second acquiring unit 330 is configured to acquire a first actual SID from the first SID table entry if a first SID table entry matching the first virtual SID is acquired from the local SID mapping table, where the first actual SID is an actual SID of the next hop of the first node;

[0129] The sending unit 340 is configured to forward the first SRv6 message according to the first actual SID.

[0130] Optionally, the receiving unit 310 is further configured to periodically receive a first keepalive message sent by the second node, where the first keepalive message includes a second virtual SID and a second actual SID;

[0131] The device further includes: a generating unit (not shown in the figure), configured to generate the second SID table entry if there is no second SID table entry matching either the second virtual SID or the second actual SID in the local SID mapping table, wherein the second SID table entry includes the second virtual SID and the second actual SID;

[0132] An updating unit (not shown in the figure) is configured to update the second SID entry according to either the second virtual SID or the second actual SID if the second SID entry exists in the local SID mapping table.

[0133] Optionally, the device further includes: a third acquisition unit (not shown in the figure), configured to acquire a third actual SID;

[0134] A concatenation unit (not shown in the figure), configured to concatenate the third actual SID with the current timestamp to obtain a concatenated SID;

[0135] A calculation unit (not shown in the figure), configured to perform a hash calculation on the concatenated SID using a secure hash algorithm to obtain a third virtual SID;

[0136] The sending unit 340 is further configured to periodically send a second keepalive message to the third node, where the second keepalive message includes the third virtual SID and the third actual SID.

[0137] Optionally, the receiving unit 310 is further configured to receive a third keepalive message sent by the second node, where the third keepalive message includes the second virtual SID;

[0138] The device further includes: a deleting unit (not shown in the figure), configured to delete the second SID entry from the local SID mapping table according to the second virtual SID.

[0139] Optionally, the sending unit 340 is further configured to, when a mapping relationship between the third actual SID and the third virtual SID is invalid, send a fourth keepalive message to the third node, where the fourth keepalive message includes the third virtual SID.

[0140] Optionally, the device further includes: a fourth acquisition unit (not shown in the figure), configured to acquire the encrypted second virtual SID and the second actual SID from the first keepalive message;

[0141] a decryption unit (not shown in the figure), configured to decrypt the encrypted second virtual SID and the second actual SID using a locally stored key or a private key to obtain the second virtual SID and the second actual SID;

[0142] or;

[0143] The device further includes: a fourth acquisition unit (not shown in the figure), configured to acquire the encrypted second virtual SID from the third keepalive message;

[0144] The decryption unit (not shown in the figure) is used to decrypt the encrypted second virtual SID using a locally stored key or private key to obtain the second virtual SID.

[0145] Optionally, the device further includes: an encryption unit (not shown in the figure), configured to encrypt the third virtual SID and the third actual SID using a locally stored key or public key to obtain the encrypted third virtual SID and the third actual SID;

[0146] an adding unit (not shown in the figure), configured to add the encrypted third virtual SID and the third actual SID to the second keepalive message;

[0147] or;

[0148] The device further includes: an encryption unit (not shown in the figure), configured to encrypt the third virtual SID using a locally stored key or public key to obtain the encrypted third virtual SID;

[0149] An adding unit (not shown in the figure) is used to add the encrypted third virtual SID to the fourth keepalive message.

[0150] Optionally, the receiving unit 310 is further configured to receive a first message sent by a user side, where the first message includes a destination address;

[0151] The device further includes: a fifth acquisition unit (not shown in the figure), configured to acquire a plurality of virtual SIDs constituting the second forwarding path if it is determined according to the destination address that the first message is forwarded via the second forwarding path;

[0152] The sending unit 340 is further configured to send a second SRv6 message to the fourth node, where the second SRv6 message includes a second segment list, and the second segment list stores the multiple virtual SIDs.

[0153] Optionally, the SID entry also includes state information, lifetime, and timestamp;

[0154] The state information is used to indicate the current state of the mapping relationship between the virtual SID and the actual SID; the lifetime is used to indicate the valid time of the SID entry; and the timestamp is used to indicate the time when the SID entry was last updated.

[0155] Therefore, by applying the communication method provided by the present application, the first node receives a first SRv6 message, the first SRv6 message includes a first segment list, the first segment list stores multiple virtual SIDs, and the multiple virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message; the first node obtains a first virtual SID from the multiple virtual SIDs, and the first virtual SID is the virtual SID of the next hop of the first node; if a first SID table entry matching the first virtual SID is obtained from the local SID mapping table, the first node obtains a first actual SID from the first SID table entry, and the first actual SID is the actual SID of the next hop of the first node; according to the first actual SID, the first node forwards the first SRv6 message.

[0156] In this way, during the message forwarding process, the virtual SID is used to hide the actual SID, which effectively prevents the forwarding path information from being stolen, improves the security of the SRv6 network, and eliminates the need for complex encryption and decryption operations on the message, reducing the impact on network performance. At the same time, it also solves the problem that the existing use of the IPSec protocol protects the path information to a certain extent, but generally has a large impact on performance.

[0157] Based on the same inventive concept, the embodiment of the present application also provides a network device, such as Figure 4 As shown, it includes a processor 410, a transceiver 420 and a machine-readable storage medium 430, the machine-readable storage medium 430 stores machine-executable instructions that can be executed by the processor 410, and the processor 410 is prompted by the machine-executable instructions to execute the communication method provided in the embodiment of the present application. Figure 3 The communication device shown can be used as Figure 4 The network device hardware structure shown is implemented.

[0158] The computer-readable storage medium 430 may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk storage. Optionally, the computer-readable storage medium 430 may also be at least one storage device located away from the processor 410.

[0159] The processor 410 may be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it may also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gates or transistor logic devices, or discrete hardware components.

[0160] In the embodiment of the present application, the processor 410 reads the machine executable instructions stored in the machine readable storage medium 430, and the machine executable instructions enable the processor 410 itself and the transceiver 420 to execute the communication method described in the aforementioned embodiment of the present application.

[0161] In addition, an embodiment of the present application provides a machine-readable storage medium 430, which stores machine-executable instructions. When called and executed by the processor 410, the machine-executable instructions prompt the processor 410 itself and the calling transceiver 420 to execute the communication method described in the aforementioned embodiment of the present application.

[0162] The implementation process of the functions and effects of each unit in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0163] For the device embodiment, since it basically corresponds to the method embodiment, the relevant parts can refer to the partial description of the method embodiment. The device embodiment described above is only schematic, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the present application scheme. A person of ordinary skill in the art can understand and implement it without paying any creative work.

[0164] As for the communication device and machine-readable storage medium embodiments, since the method contents involved are basically similar to the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0165] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A communication method, characterized in that: The method is applied to a first node, and the method comprises: receiving a first SRv6 message, wherein the first SRv6 message includes a first segment list, wherein the first segment list stores a plurality of virtual SIDs, and the plurality of virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message; Acquire a first virtual SID from the multiple virtual SIDs, where the first virtual SID is a virtual SID of a next hop of the first node; If a first SID table entry matching the first virtual SID is obtained from the local SID mapping table, a first actual SID is obtained from the first SID table entry, where the first actual SID is an actual SID of the next hop of the first node; The first SRv6 message is forwarded according to the first actual SID.

2. The method according to claim 1, characterized in that: Before receiving the first SRv6 message, the method further includes: Periodically receiving a first keepalive message sent by the second node, where the first keepalive message includes a second virtual SID and a second actual SID; If there is no second SID table entry matching either the second virtual SID or the second actual SID in the local SID mapping table, generating the second SID table entry, where the second SID table entry includes the second virtual SID and the second actual SID; If the second SID table entry exists in the local SID mapping table, the second SID table entry is updated according to either the second virtual SID or the second actual SID.

3. The method according to claim 1, characterized in that Before receiving the first SRv6 message, the method further includes: Get the third actual SID; Concatenate the third actual SID with the current timestamp to obtain a concatenated SID; Using a secure hash algorithm, performing a hash calculation on the concatenated SID to obtain a third virtual SID; A second keepalive message is periodically sent to the third node, where the second keepalive message includes the third virtual SID and the third actual SID.

4. The method according to claim 2, characterized in that: The method further comprises: receiving a third keepalive message sent by the second node, where the third keepalive message includes the second virtual SID; The second SID table entry is deleted from the local SID mapping table according to the second virtual SID.

5. The method according to claim 3, characterized in that: The method further comprises: When the mapping relationship between the third actual SID and the third virtual SID is invalid, a fourth keepalive message is sent to the third node, where the fourth keepalive message includes the third virtual SID.

6. The method according to claim 4, characterized in that After receiving the keepalive message sent by the second node, the method further includes: Acquire the encrypted second virtual SID and the second actual SID from the first keepalive message; Decrypting the encrypted second virtual SID and the second actual SID by using a locally stored key or a private key to obtain the second virtual SID and the second actual SID; or; After receiving the keepalive message sent by the second node, the method further includes: Acquire the encrypted second virtual SID from the third keepalive message; The encrypted second virtual SID is decrypted using a locally stored key or a private key to obtain the second virtual SID.

7. The method according to claim 5, characterized in that Before sending the keepalive message to the node, the method further includes: Using a locally stored key or public key, encrypt the third virtual SID and the third actual SID to obtain the encrypted third virtual SID and the third actual SID; adding the encrypted third virtual SID and the third actual SID to the second keepalive message; or; Using a locally stored key or public key, encrypting the third virtual SID to obtain the encrypted third virtual SID; The encrypted third virtual SID is added to the fourth keepalive message.

8. The method according to claim 1, characterized in that The method further comprises: Receive a first message sent by a user side, where the first message includes a destination address; If it is determined according to the destination address that the first message is forwarded through a second forwarding path, obtaining a plurality of virtual SIDs constituting the second forwarding path; A second SRv6 message is sent to the fourth node, where the second SRv6 message includes a second segment list, and the second segment list stores the multiple virtual SIDs.

9. The method according to claim 1 or 2, characterized in that: The SID entry also includes status information, lifetime, and timestamp; The state information is used to indicate the current state of the mapping relationship between the virtual SID and the actual SID; the lifetime is used to indicate the valid time of the SID entry; and the timestamp is used to indicate the time when the SID entry was last updated.

10. A communication device, characterized in that: The device is applied to a first node, and includes: A receiving unit, configured to receive a first SRv6 message, wherein the first SRv6 message includes a first segment list, wherein the first segment list stores a plurality of virtual SIDs, and the plurality of virtual SIDs are used to indicate a first forwarding path for forwarding the first SRv6 message; A first acquiring unit, configured to acquire a first virtual SID from the multiple virtual SIDs, where the first virtual SID is a virtual SID of a next hop of the first node; a second acquiring unit, configured to acquire a first actual SID from the first SID table entry if a first SID table entry matching the first virtual SID is acquired from the local SID mapping table, where the first actual SID is an actual SID of a next hop of the first node; A sending unit is used to forward the first SRv6 message according to the first actual SID.

Images