Data transmission method and router

Abstract

The embodiment of the invention provides a data transmission method and routers. The method is applied to routers in a router group in a service chain. The method comprises the following steps: firstly, receiving a private key dictionary, a public key dictionary, a plurality of first local identifiers and a plurality of drainage strategies sent by a management module, selecting a target drainage strategy from the plurality of drainage strategies based on user traffic sent by a switch, encrypting a second local identifier in the target drainage strategy based on the public key dictionary, and sending the encrypted second local identifier to the management module; generating a first identifier encryption set; generating a target message based on the user traffic and the header; and finally, based on the private key dictionary, decrypting a first element in a first identifier encryption set in the target message, matching a decrypted local identifier with a plurality of first local identifiers, selecting a first target security network element, and sending the user traffic to the first target security network element. And decryption is carried out in the router, so that the transmission path is kept secret, and the security of the service chain is improved.

Description

Technical Field

[0001] The present application relates to the field of cloud network security technology, and in particular to a data transmission method and a router. Background Art

[0002] With the popularization of cloud computing networks, the demand for service chain (SFC) technology is increasing. Service chain technology is also the security service chain technology in cloud networks, such as providing users with security functions such as firewalls, intrusion detection systems, and intrusion prevention systems;

[0003] In the prior art, SRV6 (Segment Routing IPV6) is a segment routing protocol based on the sixth version of the Internet Protocol IPV6. SRV6's technological breakthrough in network programmability simplifies the node configuration and policy deployment of SFC. However, due to the transparency of the transmission and configuration process, the data transmission path may be attacked by attackers such as eavesdropping and tampering. After the attacker steals and tampers with the data, it will affect the management module's decision on the service chain configuration, causing business paralysis. Summary of the invention

[0004] The present application provides a data transmission method and a router, which are used to solve the problem that the service chain is vulnerable to attacks in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a data transmission method, which is applied to a router in a router group in a service chain, and the method includes:

[0006] Based on the user traffic sent by the switch, a target traffic diversion strategy is selected from multiple traffic diversion strategies, and based on the public key in the public key dictionary, a second local identifier carried in the target traffic diversion strategy is encrypted to generate a first identifier encryption set;

[0007] Generate a target message based on the user traffic and a header, wherein the header is obtained based on the encrypted set of the first identifier;

[0008] Decrypting, based on the private key dictionary, the first element in the first identifier encryption set in the header of the target message, matching the decrypted local identifier with the multiple first local identifiers, selecting a first target security network element according to the matching result, and sending the user traffic to the first target security network element;

[0009] Among them, the private key dictionary, the public key dictionary, the multiple first local identifiers and the multiple diversion strategies are sent by the management module, the private key dictionary includes the correspondence between the first local identifier corresponding to the router and the first private key, and the public key dictionary includes the correspondence between the first local identifier corresponding to the router group and the public key.

[0010] In a possible implementation, encrypting the second local identifier carried in the target traffic diversion strategy based on the public key in the public key dictionary to generate the first identifier encryption set includes:

[0011] For each second local identifier, selecting a target public key corresponding to the second local identifier;

[0012] Based on the target public key, encrypt the second local identifier and the five-tuple information to obtain an encrypted local identifier, wherein the five-tuple information is the five-tuple information of the user traffic;

[0013] The obtained encrypted local identifier is used as the first identifier encryption set.

[0014] In a possible implementation manner, matching the decrypted local identifier with the multiple first local identifiers and selecting the first target security network element according to the matching result includes:

[0015] Traversing the plurality of first local identifiers, searching for a target first local identifier that is identical to the decrypted local identifier;

[0016] The security network element corresponding to the target first local identifier is used as the first target security network element.

[0017] In a possible implementation manner, after searching for a target first local identifier that is identical to the decrypted local identifier and before using a security network element corresponding to the target first local identifier as the first target security network element, the method further includes:

[0018] Comparing the target five-tuple information with the five-tuple information of the user traffic;

[0019] Determine that the comparison result is the same;

[0020] The target five-tuple information is obtained by decrypting the first identifier encryption set.

[0021] In a possible implementation, the method further includes:

[0022] If the target traffic diversion strategy is not selected from the multiple traffic diversion strategies, the user traffic is sent to the switch, so that the switch sends the user traffic to other routers in the router group.

[0023] In a possible implementation, the method further includes:

[0024] Based on the private key dictionary, the first identifier encryption set in the header of the target message is decrypted. If the decryption fails, the target message is sent to the switch, so that the switch sends the target message to other routers in the router group. The other routers decrypt the first identifier encryption set in the header of the target message based on the private key dictionary corresponding to the other routers, match the decrypted local identifier with multiple first local identifiers corresponding to the other routers, select a first target security network element according to the matching result, and send the user traffic to the first target security network element.

[0025] In a possible implementation manner, after sending the user traffic to the first target security network element, the method further includes:

[0026] receiving processed user traffic sent by the first target security network element;

[0027] Decrypting, based on the private key dictionary, a second element in the first identifier encryption set in the header of the target message;

[0028] The decrypted local identifier is matched with the multiple first local identifiers, a second target security network element is selected according to the matching result, and the processed user traffic is sent to the second target security network element until the last element in the encrypted set of the first identifiers.

[0029] In a possible implementation manner, after selecting the first target security network element according to the matching result, the method further includes:

[0030] After determining that the first target safety network element is faulty, determining a first local identifier corresponding to a third target safety network element in the target safety network element group;

[0031] Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element;

[0032] The user traffic is sent to a third target security network element corresponding to the modified first local identifier.

[0033] In a possible implementation, the method further includes:

[0034] Receiving a first temporary public key sent by the management module;

[0035] The multiple first local identifiers are encrypted based on the first temporary public key to obtain a second identifier encryption set, and the second identifier encryption set is sent to the management module, so that after the management module receives the second identifier encryption set, the management module decrypts the elements in the second identifier encryption set based on the first temporary private key corresponding to the first temporary public key to obtain multiple decrypted local identifiers, and based on the multiple decrypted local identifiers, confirms that the router is a legitimate router.

[0036] In a possible implementation, the method further includes:

[0037] For the security network elements corresponding to the multiple first local identifiers, sending the public key corresponding to the first local identifier to the security network element, so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier;

[0038] After receiving the encrypted identifier sent by the security network element, the encrypted identifier is decrypted based on the private key corresponding to the first local identifier. If the decryption is successful, it is determined that the security network element is legal.

[0039] In a second aspect, an embodiment of the present application provides a router, including:

[0040] An encryption module, configured to select a target traffic diversion strategy from a plurality of traffic diversion strategies based on user traffic sent by the switch, and encrypt a second local identifier carried in the target traffic diversion strategy based on a public key in a public key dictionary to generate a first identifier encryption set;

[0041] A generating module, configured to generate a target message based on the user traffic and a header, wherein the header is obtained based on the encrypted set of the first identifier;

[0042] a decryption module, configured to decrypt the first element in the first identifier encryption set in the header of the target message based on a private key dictionary, match the decrypted local identifier with the multiple first local identifiers, select a first target security network element according to the matching result, and send the user traffic to the first target security network element;

[0043] Among them, the private key dictionary, the public key dictionary, the multiple first local identifiers and the multiple diversion strategies are sent by the management module, the private key dictionary includes the correspondence between the first local identifier corresponding to the router and the first private key, and the public key dictionary includes the correspondence between the first local identifier corresponding to the router group and the public key.

[0044] In a third aspect, an embodiment of the present application provides a router, comprising: a processor, and a memory communicatively connected to the processor;

[0045] The memory stores computer-executable instructions;

[0046] The processor executes the computer-executable instructions stored in the memory to implement the method as described in any one of the first aspects.

[0047] An embodiment of the present application provides a data transmission method and a router, which is applied to a router in a router group in a service chain. First, a private key dictionary, a public key dictionary, multiple first local identifiers, and multiple diversion strategies are received from a management module. Based on the user traffic sent by the switch, a target diversion strategy is selected from multiple diversion strategies, and based on the public key in the public key dictionary, the second local identifier in the target diversion strategy is encrypted to generate a first identifier encryption set; then, based on the user traffic and the header, a target message is generated, wherein the header is obtained based on the first identifier encryption set; finally, based on the private key dictionary, the first element in the first identifier encryption set in the header of the target message is decrypted, the decrypted local identifier is matched with the multiple first local identifiers, and the first target security network element is selected according to the matching result, and the user traffic is sent to the first target security network element. Since the encrypted target diversion strategy is written into the user traffic and decrypted inside the router, the transmission path is kept confidential, thereby improving the security of the service chain. BRIEF DESCRIPTION OF THE DRAWINGS

[0048] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative labor.

[0049] Figure 1 This is a diagram of applicable application scenarios of the embodiments of the present application;

[0050] Figure 2 A schematic diagram of the structure of a router and a security network element provided in an embodiment of the present application;

[0051] Figure 3 A flowchart of a data transmission method provided in an embodiment of the present application;

[0052] Figure 4 A schematic diagram of the structure of another router and security network element provided in an embodiment of the present application;

[0053] Figure 5 A schematic diagram of the structure of a service chain provided in an embodiment of the present application;

[0054] Figure 6 A flowchart of a data transmission method provided in an embodiment of the present application;

[0055] Figure 7 A flowchart of another data transmission method provided in an embodiment of the present application;

[0056] Figure 8 A schematic diagram of interaction between a router and a management module for two-way authentication provided in an embodiment of the present application;

[0057] Fig. 9 A schematic diagram of interaction between a security network element and a management module for two-way authentication provided in an embodiment of the present application;

[0058] Fig.10 A schematic diagram of interaction between a router and a security network element for two-way authentication provided in an embodiment of the present application;

[0059] Fig.11 A schematic diagram of the structure of a router provided in an embodiment of the present application;

[0060] Fig.12 A schematic diagram of the structure of another router provided in an embodiment of the present application;

[0061] Fig.13 A schematic diagram of the structure of another router provided in an embodiment of the present application. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the present invention clearer, the present invention will be further described in detail below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0063] like Figure 1 As shown, an applicable application scenario provided by an embodiment of the present application, that is, a structural diagram of a service chain based on SRV6, the service chain 11 includes a switch 21, a router group 22, a security network element group 23 and a management module 24, wherein the router group includes a plurality of routers 22n, and the security network element group includes a plurality of security network elements 23n;

[0064] When the network is initialized and user services are activated, the management module 24 configures multiple first local identifiers (Localsid) and multiple traffic diversion policies (Policy) to each router in the router group 22, as well as corresponding security network elements configured based on the multiple local first local identifiers;

[0065] For example, Figure 2 As shown, the management module 24 configures the first local identifier fc00:1::1, the first local identifier fc00:1::2 and the first local identifier end.dx to the router 221, configures the diversion strategy 1 and the diversion strategy 2, and configures the security network element 231 based on the first local identifier fc00:1::1, and configures the security network element 232 based on the first local identifier fc00:1::2;

[0066] Configure the first local identifier fc00:1::3 and the first local identifier end.dx to the router 222, configure the diversion strategy 3 and the diversion strategy 4, and configure the security network element 233 based on the first local identifier fc00:1::3;

[0067] The first local identifier fc00:1::4, the first local identifier fc00:1::5 and the first local identifier end.dx are configured to the router 223, the diversion strategy 5 and the diversion strategy 6 are configured, and the security network element 234 is configured based on the first local identifier fc00:1::4, and the security network element 235 is configured based on the first local identifier fc00:1::5.

[0068] It should be noted that the first local identifier end.dx represents the end of data processing.

[0069] In the prior art, the switch 21 sends user traffic to the router 22n, and the router 22n selects a target diversion strategy based on the user traffic, and then sends the user traffic to the security network element for processing based on the target diversion strategy. However, the data transmission process and the matching process of the target diversion strategy are transparent, which makes it easy for attackers to tamper with the target diversion strategy. Attackers can also forge and invade the management module 24 to steal user data.

[0070] In order to improve the security during data transmission, an embodiment of the present application provides a data transmission method and a router. The data transmission method and the router provided in the embodiment of the present application are described in detail below with reference to the accompanying drawings.

[0071] like Figure 3 FIG. 1 is a flow chart of a data transmission method provided in an embodiment of the present application.

[0072] S301: Based on the user traffic sent by the switch, a target traffic diversion strategy is selected from multiple traffic diversion strategies, and based on the public key in the public key dictionary, a second local identifier carried in the target traffic diversion strategy is encrypted to generate a first identifier encryption set;

[0073] S2302: Generate a target message based on user traffic and a header, wherein the header is obtained based on the first identifier encryption set;

[0074] S303: decrypting the first element in the first identifier encryption set in the header of the target message based on the private key dictionary, matching the decrypted local identifier with the multiple first local identifiers, selecting a first target security network element according to the matching result, and sending user traffic to the first target security network element;

[0075] The embodiment of the present application provides a data transmission method and a router, which are applied to a router in a router group in a service chain; a private key dictionary, a public key dictionary, multiple first local identifiers and multiple diversion strategies sent by a management module are received, a target diversion strategy is selected from multiple diversion strategies based on the user traffic sent by the switch, and a second local identifier in the target diversion strategy is encrypted based on the public key in the public key dictionary to generate a first identifier encryption set; a target message is generated based on the user traffic and the header, wherein the header is obtained based on the first identifier encryption set; based on the private key dictionary, the first element in the first identifier encryption set in the header of the target message is decrypted, the decrypted local identifier is matched with multiple first local identifiers, a first target security network element is selected according to the matching result, and the user traffic is sent to the first target security network element. Since the encrypted target diversion strategy is written into the user traffic and decrypted inside the router, the transmission path is kept confidential, thereby improving the security of the service chain.

[0076] In a specific embodiment, the router 22n in the router group 21 first receives a plurality of first local identifiers and a plurality of traffic diversion strategies assigned by the management module. The specific implementation method is as follows: Figure 2 The described method will not be repeated here.

[0077] Secondly, the router 22n receives the key dictionary sent by the management module 24, the key dictionary includes a private key dictionary and a public key dictionary, the private key dictionary includes the correspondence between the first local identifier corresponding to the router 22n and the first private key, and the public key dictionary includes the correspondence between the first local identifier corresponding to the router group 22 and the public key;

[0078] For example, Figure 4 As shown, it is a structural schematic diagram of another router and security network element provided in an embodiment of the present application. The management module 24 sends the private key dictionary 1 and the public key dictionary corresponding to the router 221 based on multiple first local identifiers of the router 221. The private key dictionary 1 includes the correspondence between the first local identifier fc00:1::1, the first local identifier fc00:1::2, the first local identifier end.dx and the first private key 1, the first private key 2, and the first private key 6. The private key dictionary 1 is specifically shown in Table 1:

[0079] fc00:1::1 First private key 1 fc00:1::2 First private key 2 end.dx First private key 6

[0080] Table 1

[0081] Based on the multiple first local identifiers of the router 222, the private key dictionary 2 and the public key dictionary corresponding to the router 222 are sent. The private key dictionary 2 includes the correspondence between the first local identifier fc00:1::3, the first local identifier end.dx, the first private key 3, and the first private key 6. The private key dictionary 2 is specifically shown in Table 2:

[0082] fc00:1::3 First private key 3 end.dx First private key 6

[0083] Table 2

[0084] Based on the multiple first local identifiers of the router 223, the private key dictionary 3 and the public key dictionary corresponding to the router 223 are sent. The private key dictionary 3 includes the correspondence between the first local identifier fc00:1::4, the first local identifier fc00:1::5, the first local identifier end.dx and the first private key 4, the first private key 5, and the first private key 6. The private key dictionary 3 is specifically shown in Table 3:

[0085] fc00:1::4 First private key 4 fc00:1::5 First private key 5 end.dx First private key 6

[0086] Table 3

[0087] The public key dictionaries corresponding to routers 221, 222 and 223 are the same, and the public key dictionary includes the correspondence between the first local identifier fc00:1::1, the first local identifier fc00:1::2, the first local identifier fc00:1::3, the first local identifier fc00:1::4, the first local identifier fc00:1::5, the first local identifier end.dx in router group 22 and public keys 1, 2, 3, 4, 5 and 6. The public key dictionary is specifically shown in Table 4:

[0088]

[0089]

[0090] Table 4

[0091] In a specific embodiment, the management module 24 further sends the first private key to each security network element corresponding to the first local identifier. For example, the management module 24 sends the first private key corresponding to the first local identifier fc00:1::1 to the security network element 231. Figure 5 The figure shows a schematic diagram of the structure of a service chain provided in an embodiment of the present application.

[0092] It should be noted that the configurations corresponding to the router 22n used in the following embodiments are all the configurations in the above embodiments.

[0093] In one embodiment, the router 22n receives the user traffic sent by the switch, selects a target traffic diversion strategy from a plurality of traffic diversion strategies, and rewrites the user traffic;

[0094] Specifically, after the router 22n receives the user traffic sent by the switch 21 and selects a target traffic diversion strategy from a plurality of traffic diversion strategies in the router 22n, the router 22n determines whether the user traffic uses the Internet Protocol version 4 IPV4. If the user traffic uses the Internet Protocol version 4 IPV4, an Internet Protocol version 6 IPV6 header is added to the user traffic to obtain the rewritten user traffic, or

[0095] If the user traffic does not use the Internet Protocol version 4 (IPV4), a Segment Routing Header (SRH) is added to the user traffic to obtain the rewritten user traffic.

[0096] It should be noted that the header of the Internet Protocol version 6 (IPV6) includes a routing extension header (SRH).

[0097] In another embodiment, after router 22n receives the user traffic sent by the switch, if the target diversion strategy is not selected from the multiple diversion strategies included in router 22n, router 22n sends the user traffic to switch 21, so that the switch sends the user traffic from other routers in router group 22 based on the routing table until the target diversion strategy is successfully matched.

[0098] In one embodiment, for each second local identifier, a target public key corresponding to the second local identifier is selected; based on the target public key, the second local identifier and the five-tuple information are encrypted to obtain an encrypted local identifier; and the obtained encrypted local identifier is used as the first identifier encryption set.

[0099] For example, when the router 221 receives the user traffic sent by the switch 21, the traffic diversion policy 1 is selected as the target traffic diversion policy from the multiple traffic diversion policies in the router 221, wherein the target traffic diversion policy 1 includes the second local identifier fc000:1:1, the second local identifier fc00:1::2 and the second local identifier end.dx, the public key dictionary is searched, and with reference to Table 4, the encrypted local identifier 1 is obtained based on the public key 1 for the second local identifier fc000:1:1 and the five-tuple information in the rewritten user traffic; the encrypted local identifier 2 is obtained based on the public key 2 for the second local identifier fc000:1:2 and the five-tuple information in the rewritten user traffic; the encrypted local identifier 3 is obtained based on the public key 6 for the second local identifier end.dx and the five-tuple information in the rewritten user traffic;

[0100] The encrypted local identifier 1, the encrypted local identifier 2 and the encrypted local identifier 3 are taken as the first identifier encryption set SL.

[0101] In an embodiment of the present application, after obtaining the first identifier encryption set SL, a target message is generated based on the rewritten user traffic and header, wherein the header is obtained based on the first identifier encryption set.

[0102] Specifically, the first identifier encryption set SL is added to the routing extension header SRH in the rewritten user traffic to generate a target message.

[0103] In one embodiment, based on a private key dictionary, the first element in the first identifier encryption set SL in the header of the target message is decrypted, the decrypted local identifier is matched with multiple first local identifiers, and the target five-tuple information is compared with the five-tuple information of the user traffic. The first target security network element is selected according to the matching result, and the user traffic is sent to the first target security network element.

[0104] Specifically, the private key dictionary is searched, the first element (i.e., the first encrypted local identifier) ​​in the first identifier encryption set SL in the header SRH of the target message is decrypted, the decrypted second local identifier and the target five-tuple information (i.e., the rewritten five-tuple information of the user traffic) are obtained, and multiple first local identifiers in the router 22n are traversed to find the target first local identifier that is the same as the decrypted second local identifier;

[0105] In another embodiment, if multiple first local identifiers in router 22n are traversed and no target first local identifier that is the same as the decrypted second local identifier is found, router 22n sends the target message to switch 21. Switch 21 searches for the router where the target first local identifier is located based on the routing table and sends the target message to the router.

[0106] Determine and compare the target five-tuple information with the user traffic. If the target five-tuple information is the same as the user traffic, remove the header of the rewritten user traffic, obtain the restored user traffic (i.e. the user traffic sent by the switch), and send the restored user traffic to the first target security network element.

[0107] In one embodiment, receiving processed user traffic sent by a first target security network element;

[0108] Decrypting the second element in the first identifier encryption set in the header of the target message based on the private key dictionary;

[0109] The decrypted local identifier is matched with multiple first local identifiers, a second target security network element is selected according to the matching result, and the processed user traffic is sent to the second target security network element until the last element in the first identifier encryption set.

[0110] Specifically, Figure 6 FIG. 1 is a flow chart of a data transmission method provided in an embodiment of the present application, including:

[0111] S601: The router receives user traffic;

[0112] S602: Determine the target traffic diversion strategy;

[0113] S603: Determine whether the user traffic uses IPV4; if yes, execute S605; if no, execute S604;

[0114] S604: Add SRH to the user traffic to obtain the rewritten user traffic;

[0115] S605: Add IPv6 to the user traffic to obtain the rewritten user traffic;

[0116] S606: Generate a first encrypted set of identifiers SL1, and add the first encrypted set of identifiers SL1 to the SRH in the rewritten user traffic to generate a target message;

[0117] S607: Decrypt the first element in the first identifier encryption set SL1 to obtain the decrypted second local identifier and target five-tuple information;

[0118] S608: Determine a target first local identifier that is identical to the decrypted second local identifier;

[0119] S609: Determine whether the second local identifier is the last element of the first identifier encryption set SL1; if yes, execute S613; if no, execute S610;

[0120] S610: Determine whether the target five-tuple information is the same as the five-tuple information in the user traffic; if yes, execute S611; if no, execute S613;

[0121] S611: Take the security network element corresponding to the target first local identifier as the first target security network element, and output the restored user traffic to the first target security network element;

[0122] S612: After receiving the user traffic processed by the first target security network element, execute S603;

[0123] S613: Output user traffic.

[0124] For example, router 221 receives user traffic 1, and uses traffic diversion policy 1 as a target traffic diversion policy, wherein the target traffic diversion policy includes the second local identifier fc000:1:1, the second local identifier fc00:1::2, and the second local identifier end.dx;

[0125] Determine that the user traffic does not use IPV4, add SRH to user traffic 1, and obtain the rewritten user traffic 1;

[0126] Router 221 encrypts the second local identifier in the target diversion strategy and the five-tuple information in the rewritten user traffic 1 based on the public key dictionary, generates the encrypted local identifier 1, the encrypted local identifier 2 and the encrypted local identifier 3, generates the first identifier encryption set SL1, adds the first identifier encryption set SL1 to the SRH in the rewritten user traffic 1, and generates the target message 1, wherein the first identifier encryption set SL1 includes the encrypted local identifier 1, the encrypted local identifier 2 and the encrypted local identifier 3;

[0127] Router 221 searches the private key dictionary, decrypts the first element in the first identifier encryption set SL1 in the header SRH of target message 1, obtains the decrypted second local identifier fc000:1:1 and the target five-tuple information, and traverses multiple first local identifiers in router 221 (i.e., the first local identifier fc000:1:1, the first local identifier fc00:1::2, and the first local identifier end.dx), and determines the target first local identifier fc000:1:1 that is the same as the decrypted second local identifier fc000:1:1;

[0128] Router 221 compares the decrypted target five-tuple information with the five-tuple information in user traffic 1 and confirms that the comparison result is the same, that is, confirms that the rewritten user traffic has not been tampered with by the attacker.

[0129] After the router 221 uses the security network element 231 corresponding to the target first local identifier fc000:1:1 as the first target security network element, it removes the header of the rewritten user traffic and sends the restored user traffic (ie, user traffic 1) to the first target security network element for processing.

[0130] The router 221 receives the processed user traffic 2 sent by the first target security network element, determines that the user traffic 2 does not use IPV4, adds an SRH to the user traffic 2, and adds the first identifier encryption set SL1 to the SRH.

[0131] Based on the private key dictionary, the second element in the first identifier encryption set SL1 (that is, the encrypted local identifier 2) is decrypted to obtain the decrypted second local identifier fc000:1:2 and the target five-tuple information 2;

[0132] Match the second local identifier fc000:1:2 with multiple first local identifiers (i.e., the first local identifier fc000:1:1, the first local identifier fc00:1::2, and the first local identifier end.dx), and compare the target quintuple information 2 with the quintuple information in the user flow 2, select the second target security network element (i.e., the security network element 232 corresponding to the target first local identifier fc000:1:2) according to the matching result and the comparison result, and send the user flow 2 to the second target security network element;

[0133] The router 221 receives the processed user traffic 3 sent by the second target security network element, determines that the user traffic 3 does not use IPV4, adds an SRH to the user traffic 3, and adds the first identifier encryption set SL1 to the SRH;

[0134] Based on the private key dictionary, decrypt the third element in the first identifier encryption set SL1 (i.e. the encrypted local identifier 3), and the decrypted third local identifier end.dx and the target five-tuple information;

[0135] When the router detects that the third local identifier is end.dx, it indicates that data processing is ended and user traffic 3 is output.

[0136] It should be noted that after the target security network element receives the restored user traffic, it performs some business processing, including implementing security functions such as network address translation (NAT), data compression, data inspection, data monitoring, filtering / access, etc. This application does not restrict this.

[0137] In another embodiment, after selecting the first target security network element according to the matching result, after determining that the first target security network element has failed, determine the first local identifier corresponding to the third target security network element in the target security network element group; modify the decrypted local identifier to the first local identifier corresponding to the third target security network element; and send user traffic to the third target security network element corresponding to the modified first local identifier.

[0138] For example, Figure 7 FIG. 1 is a flow chart of another data transmission method provided in an embodiment of the present application, which is as follows:

[0139] S701: The router receives user traffic;

[0140] S702: Determine the target traffic diversion strategy;

[0141] S703: Determine whether the user traffic uses IPV4; if not, execute S704; if yes, execute S705;

[0142] S704: Add SRH to the user traffic to obtain the rewritten user traffic;

[0143] S705: Add IPv6 to the user traffic to obtain the rewritten user traffic;

[0144] S706: Generate a first encrypted set of identifiers SL1, and add the first encrypted set of identifiers SL1 to the SRH in the rewritten user traffic to generate a target message;

[0145] S707: Decrypt the first element in the first identifier encryption set SL1 to obtain the decrypted second local identifier and target five-tuple information;

[0146] S708: Determine a target first local identifier that is identical to the decrypted second local identifier;

[0147] S709: Determine whether the second local identifier is the last element of the first identifier encryption set SL1; if yes, execute S717; if no, execute S710;

[0148] S710: Determine whether the target five-tuple information is the same as the five-tuple information in the user traffic; if yes, execute S711; if no, execute S717;

[0149] S711: Use the security network element corresponding to the target first local identifier as the first target security network element;

[0150] S712: Determine that a first target security network element fails, and determine that a bypass function is activated for a first local identifier corresponding to the first target security network element;

[0151] S713: Determine a first local identifier corresponding to a third target security network element in the target security network element group;

[0152] S714: Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element;

[0153] S715: Sending user traffic to a third target security network element corresponding to the modified first local identifier;

[0154] S716: After receiving the user traffic processed by the third target security network element, execute S703;

[0155] S717: Output user traffic.

[0156] For example, router 223 receives user traffic 1, and uses traffic diversion policy 5 as a target traffic diversion policy, wherein the target traffic diversion policy includes the second local identifier fc000:1:4, the second local identifier fc00:1::5, and the second local identifier end.dx;

[0157] Determine that user flow 1 does not use IPV4, add SRH to user flow 1, and obtain the rewritten user flow 1;

[0158] Router 223 encrypts the second local identifier in the target diversion strategy and the five-tuple information in the rewritten user traffic based on the public key dictionary, generates encrypted local identifier 1, encrypted local identifier 2, and encrypted local identifier 3, uses the encrypted local identifier 1, encrypted local identifier 2, and encrypted local identifier 3 as the first identifier encryption set SL1, and adds the first identifier encryption set SL1 to the SRH in the rewritten user traffic to generate target message 1;

[0159] Router 223 searches the private key dictionary, decrypts the first element (i.e., the encrypted local identifier 1) in the first identifier encryption set SL1 in the header SRH of the target message 1, obtains the decrypted second local identifier fc000:1:4 and the target five-tuple information 1, and traverses multiple first local identifiers (i.e., the first local identifier fc000:1:4, the first local identifier fc00:1::5, and the first local identifier end.dx) in router 221, and determines the target first local identifier fc000:1:4 that is the same as the decrypted second local identifier fc000:1:4;

[0160] Router 223 compares the target quintuple information 1 with the quintuple information in user traffic 1, and confirms that the comparison results are the same, that is, user traffic 1 has not been tampered with by the attacker; and uses the security network element 234 corresponding to the target first local identifier fc000:1:4 as the first target security network element.

[0161] When router 223 determines that the first target security network element (i.e., security network element 234) fails and determines that the first local identifier fc000:1:4 corresponding to the first target security network element is set to activate the bypass function, router 221 queries the security network element group configuration, confirms that security network element 232 and security network element 234 are in the same security network element group, and then modifies the decrypted second local identifier fc000:1:4 to the first local identifier fc000:1:2 corresponding to security network element 232;

[0162] The router 223 encrypts the modified second local identifier fc000:1:2 and the target five-tuple information 1 based on the private key dictionary corresponding to the router 223 to generate an encrypted local identifier 4, and uses the encrypted local identifier 2, the encrypted local identifier 3 and the encrypted local identifier 4 as the first identifier encryption set SL2, wherein the encrypted local identifier 4 is used as the first element in the first identifier encryption set SL2;

[0163] The first identifier encryption set SL2 is added to the SRH in the rewritten user traffic to generate the target message 2; the router 223 forwards the target message 2 to the router corresponding to the security network element 232 (ie, the router 221) through the switch 21.

[0164] After receiving the target message 2, router 221 decrypts the first element (i.e., the encrypted local identifier 4) in the first identifier encryption set SL2 based on the public key dictionary, obtains the modified second local identifier fc000:1:2 and the target five-tuple information, confirms that the multiple first local identifiers in router 221 include the first local identifier fc000:1:2 that is equal to the modified second local identifier fc000:1:2, and determines that the target five-tuple information 1 is the same as the five-tuple information in user traffic 1, and then sends the restored user traffic (i.e., user traffic 1) to the security network element 232 corresponding to the first local identifier fc000:1:2 for processing.

[0165] After receiving the user traffic 2 processed by the security network element 232, the router 221 forwards the user traffic 2 to the router 223 through the switch 21;

[0166] The router 223 receives the user traffic 2, determines that the user traffic 2 does not use IPv4, adds an SRH to the user traffic 2, and adds the first identifier encryption set SL2 to the SRH;

[0167] Based on the private key dictionary, the second element in the first identifier encryption set SL2 is decrypted to obtain the decrypted second local identifier fc00:1::5 and the target five-tuple information 2; after determining that the target five-tuple information 2 is the same as the five-tuple information in the user traffic 2, the user traffic 2 is sent to the security network element corresponding to the first local identifier whose second local identifier fc00:1::5 is equal to that for processing until the last element in the first identifier encryption set SL2.

[0168] It should be noted that the processing process is Figure 5 The processing procedures described are the same and will not be repeated here.

[0169] In one embodiment, each router in the router group 22 performs a two-way authentication with the management module 24, specifically including:

[0170] The router 22n receives the first temporary public key sent by the management module 24;

[0171] Based on the first temporary public key, multiple first local identifiers are encrypted to obtain a second identifier encryption set, and the second identifier encryption set is sent to the management module 24, so that after the management module 24 receives the second identifier encryption set, it decrypts the elements in the second identifier encryption set based on the first temporary private key corresponding to the first temporary public key to obtain multiple decrypted local identifiers, and based on the multiple decrypted local identifiers, confirms that the router 22n is a legitimate router.

[0172] For example, Figure 8 , which is a schematic diagram of interaction between a router and a management module for two-way authentication provided in an embodiment of the present application;

[0173] S801: The management module 24 generates a pair of temporary keys 1, including a first temporary public key Key1 and a first temporary private key key1, and sends the first temporary public key Key1 to the router 221;

[0174] S802 : The router 221 encrypts the corresponding multiple first local identifiers based on the first temporary public key Key1 to generate a second identifier encryption set, and sends the second identifier encryption set to the management module 24 .

[0175] The first temporary public key Key1 corresponds to multiple first local identifiers including the first local identifier fc000:1:1, the first local identifier fc00:1::2 and the first local identifier end.dx.

[0176] S803: The management module 24 decrypts the second identifier encryption set based on the first temporary private key key1 to obtain multiple decrypted local identifiers, and after determining that the multiple decrypted local identifiers are the same as the information stored in the management module 24, confirms that the router 221 is a legitimate router.

[0177] In another embodiment, each security network element in the security network element group 23 performs bidirectional authentication with the management module 24, specifically including:

[0178] The security network element 23n receives the second temporary public key sent by the management module;

[0179] Based on the second temporary public key, the first local identifier corresponding to the security network element 23n is encrypted to obtain the encrypted first local identifier, and the encrypted first local identifier is sent to the management module 24, so that after the management module 24 receives the encrypted first local identifier, it decrypts the encrypted first local identifier based on the second temporary private key corresponding to the second temporary public key to obtain the decrypted first local identifier, and based on the decrypted first local identifier, confirms that the security network element 23n is a legitimate security network element.

[0180] For example, Fig. 9 As shown, it is a schematic diagram of interaction between a security network element and a management module for two-way authentication provided in an embodiment of the present application;

[0181] S901: The management module 24 generates a pair of temporary keys 2, including a second temporary public key Key2 and a second temporary private key key2, and sends the second temporary public key Key2 to the security network element 231;

[0182] S902: The security network element 231 encrypts the first local identifier (i.e., the first local identifier fc000:1:1) corresponding to it based on the second temporary private key key2 to generate an encrypted first local identifier, and sends the encrypted first local identifier to the management module 24;

[0183] S903: The management module 24 decrypts the encrypted first local identifier based on the second temporary private key key2 to obtain the decrypted first local identifier, and after determining that the decrypted first local identifier is the same as the information stored in the management module 24, confirms that the security network element 231 is a security network element.

[0184] In another embodiment, router 22n performs bidirectional authentication with security network element 23n;

[0185] For the security network elements corresponding to the multiple first local identifiers in the router 22n, the public key corresponding to the first local identifier is sent to the security network element, so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier;

[0186] After receiving the encrypted identifier sent by the security network element 23n, the router 22n decrypts the encrypted identifier based on the private key corresponding to the first local identifier. If the decryption is successful, it is determined that the security network element is legitimate.

[0187] For example, Fig.10 As shown, it is a schematic diagram of interaction between a router and a security network element for two-way authentication provided by an embodiment of the present application, wherein the security network element 231 corresponding to the first local identifier fc000:1:1 in the router 221, the specific steps are as follows:

[0188] S1001: The router 221 sends the public key 1 corresponding to the first local identifier fc000:1:1 to the security network element 231;

[0189] S1002: The security network element 231 encrypts the first local identifier fc000:1:1 corresponding to the public key 1 to obtain an encrypted identifier, and sends the encrypted identifier to the router 221;

[0190] S1003: The router 221 determines the private key 1 corresponding to the first local identifier fc000:1:1 based on the private key dictionary, and decrypts the encrypted identifier based on the private key 1. If the decryption is successful, it is determined that the security network element 231 is legitimate.

[0191] S1004: The router 221 encrypts the multiple first local identifiers based on the private key dictionary to obtain an encrypted identifier set, and sends the encrypted identifier set to the security network element 231;

[0192] The plurality of first local identifiers include a first local identifier fc000:1:1, a first local identifier fc00:1::2 and a first local identifier end.dx.

[0193] S1005: The security network element 231 decrypts the elements of the encrypted identifier set based on the private key 1 corresponding to its corresponding first local identifier fc000:1:1 to obtain the decrypted elements, and after determining that the decrypted elements are the same as its corresponding first local identifier fc000:1:1, determines that the router 221 is legitimate.

[0194] It should be noted that if it is determined that the router 22n is illegal, the security network element 23n generates an alarm and responds; if it is determined that the security network element 23n is illegal, the router 22n generates an alarm and responds.

[0195] Based on the same technical concept, a router is also provided in an embodiment of the present application. The principle of solving technical problems by the router is similar to the principle of solving technical problems by the above-mentioned data transmission method. The implementation of the router can refer to the implementation of the above-mentioned data transmission method, and the repeated parts will not be repeated.

[0196] like Fig.11 FIG. 1 is a schematic diagram of a structure of a router provided in an embodiment of the present application, wherein the router includes:

[0197] The encryption module 111 is used to select a target traffic diversion strategy from multiple traffic diversion strategies based on the user traffic sent by the switch, and encrypt the second local identifier carried in the target traffic diversion strategy based on the public key in the public key dictionary to generate a first identifier encryption set;

[0198] A generating module 112, configured to generate a target message based on the user traffic and a header, wherein the header is obtained based on the first identifier encryption set;

[0199] A decryption module 113, configured to decrypt the first element in the first identifier encryption set in the header of the target message based on a private key dictionary, match the decrypted local identifier with the multiple first local identifiers, select a first target security network element according to the matching result, and send the user traffic to the first target security network element;

[0200] Among them, the private key dictionary, the public key dictionary, the multiple first local identifiers and the multiple diversion strategies are sent by the management module, the private key dictionary includes the correspondence between the first local identifier corresponding to the router and the first private key, and the public key dictionary includes the correspondence between the first local identifier corresponding to the router group and the public key.

[0201] In one embodiment, the encryption module 111 is further configured to:

[0202] For each second local identifier, selecting a target public key corresponding to the second local identifier;

[0203] Based on the target public key, encrypt the second local identifier and the five-tuple information to obtain an encrypted local identifier, wherein the five-tuple information is the five-tuple information of the user traffic;

[0204] The obtained encrypted local identifier is used as the first identifier encryption set.

[0205] In one embodiment, the decryption module 113 is further configured to:

[0206] Traversing the plurality of first local identifiers, searching for a target first local identifier that is identical to the decrypted local identifier;

[0207] The security network element corresponding to the target first local identifier is used as the first target security network element.

[0208] In one embodiment, the router further includes a comparison module 114, such as Fig.12 As shown, it is a schematic diagram of a router structure provided in an embodiment of the present application, and the comparison module 114 is also used for:

[0209] Comparing the target five-tuple information with the five-tuple information of the user traffic;

[0210] Determine that the comparison result is the same;

[0211] The target five-tuple information is obtained by decrypting the first identifier encryption set.

[0212] In one embodiment, the encryption module 111 is further configured to:

[0213] If the target traffic diversion strategy is not selected from the multiple traffic diversion strategies, the user traffic is sent to the switch, so that the switch sends the user traffic to other routers in the router group.

[0214] In one embodiment, the decryption module 113 is also used to

[0215] Based on the private key dictionary, the first identifier encryption set in the header of the target message is decrypted. If the decryption fails, the target message is sent to the switch, so that the switch sends the target message to other routers in the router group. The other routers decrypt the first identifier encryption set in the header of the target message based on the private key dictionary corresponding to the other routers, match the decrypted local identifier with multiple first local identifiers corresponding to the other routers, select a first target security network element according to the matching result, and send the user traffic to the first target security network element.

[0216] In one embodiment, the decryption module 113 is further configured to:

[0217] receiving processed user traffic sent by the first target security network element;

[0218] Decrypting, based on the private key dictionary, a second element in the first identifier encryption set in the header of the target message;

[0219] The decrypted local identifier is matched with the multiple first local identifiers, a second target security network element is selected according to the matching result, and the processed user traffic is sent to the second target security network element until the last element in the encrypted set of the first identifiers.

[0220] In one embodiment, the decryption module 113 is further configured to:

[0221] After determining that the first target safety network element is faulty, determining a first local identifier corresponding to a third target safety network element in the target safety network element group;

[0222] Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element;

[0223] The user traffic is sent to a third target security network element corresponding to the modified first local identifier.

[0224] In one embodiment, the encryption module 111 is further configured to:

[0225] Receiving a first temporary public key sent by the management module;

[0226] The multiple first local identifiers are encrypted based on the first temporary public key to obtain a second identifier encryption set, and the second identifier encryption set is sent to the management module, so that after the management module receives the second identifier encryption set, the elements in the second identifier encryption set are decrypted based on the first temporary private key corresponding to the first temporary public key to obtain multiple decrypted local identifiers, and based on the multiple decrypted local identifiers, the router is confirmed to be a legitimate router and the elements in the encryption set are decrypted.

[0227] In one embodiment, the router is further configured to:

[0228] The generating module 112 sends a public key corresponding to the first local identifier to the security network element corresponding to the multiple first local identifiers, so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier;

[0229] After receiving the encrypted identifier sent by the security network element, the decryption module 113 decrypts the encrypted identifier based on the private key corresponding to the first local identifier. If the decryption is successful, it is determined that the security network element is legal.

[0230] Based on the same technical concept, a router is also provided in an embodiment of the present application. The principle of solving technical problems by the router is similar to the principle of solving technical problems by the above-mentioned data transmission method. The implementation of the router can refer to the implementation of the above-mentioned data transmission method, and the repeated parts will not be repeated.

[0231] like Fig.13 , which is a schematic diagram of the structure of a router provided in an embodiment of the present application, wherein the router includes a processor 132 and a memory 131 that is communicatively connected to the processor;

[0232] The memory 131 stores computer executable instructions;

[0233] The processor 132 executes the computer-executable instructions stored in the memory 131 to implement the following steps:

[0234] Based on the user traffic sent by the switch, a target traffic diversion strategy is selected from multiple traffic diversion strategies, and based on the public key in the public key dictionary, a second local identifier carried in the target traffic diversion strategy is encrypted to generate a first identifier encryption set;

[0235] Generate a target message based on the user traffic and a header, wherein the header is obtained based on the encrypted set of the first identifier;

[0236] Decrypting, based on the private key dictionary, the first element in the first identifier encryption set in the header of the target message, matching the decrypted local identifier with the multiple first local identifiers, selecting a first target security network element according to the matching result, and sending the user traffic to the first target security network element;

[0237] Among them, the private key dictionary, the public key dictionary, the multiple first local identifiers and the multiple diversion strategies are sent by the management module, the private key dictionary includes the correspondence between the first local identifier corresponding to the router and the first private key, and the public key dictionary includes the correspondence between the first local identifier corresponding to the router group and the public key.

[0238] In one embodiment, the processor 132 is specifically configured to:

[0239] For each second local identifier, selecting a target public key corresponding to the second local identifier;

[0240] Based on the target public key, encrypt the second local identifier and the five-tuple information to obtain an encrypted local identifier, wherein the five-tuple information is the five-tuple information of the user traffic;

[0241] The obtained encrypted local identifier is used as the first identifier encryption set.

[0242] In one embodiment, the processor 132 is further configured to:

[0243] Traversing the plurality of first local identifiers, searching for a target first local identifier that is identical to the decrypted local identifier;

[0244] The security network element corresponding to the target first local identifier is used as the first target security network element.

[0245] Comparing the target five-tuple information with the five-tuple information of the user traffic;

[0246] Determine that the comparison result is the same;

[0247] The target five-tuple information is obtained by decrypting the first identifier encryption set.

[0248] In one embodiment, the processor 132 is further configured to:

[0249] If the target traffic diversion strategy is not selected from the multiple traffic diversion strategies, the user traffic is sent to the switch, so that the switch sends the user traffic to other routers in the router group.

[0250] In one embodiment, the processor 132 is further configured to:

[0251] Based on the private key dictionary, the first identifier encryption set in the header of the target message is decrypted. If the decryption fails, the target message is sent to the switch, so that the switch sends the target message to other routers in the router group. The other routers decrypt the first identifier encryption set in the header of the target message based on the private key dictionary corresponding to the other routers, match the decrypted local identifier with multiple first local identifiers corresponding to the other routers, select a first target security network element according to the matching result, and send the user traffic to the first target security network element.

[0252] In one embodiment, the processor 132 is further configured to:

[0253] receiving processed user traffic sent by the first target security network element;

[0254] Decrypting, based on the private key dictionary, a second element in the first identifier encryption set in the header of the target message;

[0255] The decrypted local identifier is matched with the multiple first local identifiers, a second target security network element is selected according to the matching result, and the processed user traffic is sent to the second target security network element until the last element in the encrypted set of the first identifiers.

[0256] In one embodiment, the processor 132 is further configured to:

[0257] After determining that the first target safety network element is faulty, determining a first local identifier corresponding to a third target safety network element in the target safety network element group;

[0258] Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element;

[0259] The user traffic is sent to a third target security network element corresponding to the modified first local identifier.

[0260] In one embodiment, the processor 132 is further configured to:

[0261] Receiving a first temporary public key sent by the management module;

[0262] The multiple first local identifiers are encrypted based on the first temporary public key to obtain a second identifier encryption set, and the second identifier encryption set is sent to the management module, so that after the management module receives the second identifier encryption set, the elements in the second identifier encryption set are decrypted based on the first temporary private key corresponding to the first temporary public key to obtain multiple decrypted local identifiers, and based on the multiple decrypted local identifiers, the router is confirmed to be a legitimate router and the elements in the encryption set are decrypted.

[0263] In one embodiment, the processor 132 is further configured to:

[0264] For the security network elements corresponding to the multiple first local identifiers, sending the public key corresponding to the first local identifier to the security network element, so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier;

[0265] After receiving the encrypted identifier sent by the security network element, the encrypted identifier is decrypted based on the private key corresponding to the first local identifier. If the decryption is successful, it is determined that the security network element is legal.

[0266] An embodiment of the present application provides a data transmission method and a router, which is applied to a router in a router group in a service chain. First, a private key dictionary, a public key dictionary, multiple first local identifiers, and multiple diversion strategies are received from a management module. Based on the user traffic sent by the switch, a target diversion strategy is selected from multiple diversion strategies, and based on the public key in the public key dictionary, the second local identifier in the target diversion strategy is encrypted to generate a first identifier encryption set; then, based on the user traffic and the header, a target message is generated, wherein the header is obtained based on the first identifier encryption set; finally, based on the private key dictionary, the first element in the first identifier encryption set in the header of the target message is decrypted, the decrypted local identifier is matched with the multiple first local identifiers, and the first target security network element is selected according to the matching result, and the user traffic is sent to the first target security network element. Since the encrypted target diversion strategy is written into the user traffic and decrypted inside the router, the transmission path is kept confidential, thereby improving the security of the service chain.

[0267] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0268] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0269] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0270] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0271] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A data transmission method, characterized in that: Applied to a router in a router group in a service chain, the method comprises: Based on the user traffic sent by the switch, a target traffic diversion strategy is selected from multiple traffic diversion strategies, and based on the public key in the public key dictionary, a second local identifier carried in the target traffic diversion strategy is encrypted to generate a first identifier encryption set; Generate a target message based on the user traffic and a header, wherein the header is obtained based on the encrypted set of the first identifier; Decrypting, based on the private key dictionary, the first element in the first identifier encryption set in the header of the target message, matching the decrypted local identifier with the multiple first local identifiers, selecting a first target security network element according to the matching result, and sending the user traffic to the first target security network element; Among them, the private key dictionary, the public key dictionary, the multiple first local identifiers and the multiple diversion strategies are sent by the management module, the private key dictionary includes the correspondence between the first local identifier corresponding to the router and the first private key, and the public key dictionary includes the correspondence between the first local identifier corresponding to the router group and the public key.

2. The method according to claim 1, characterized in that The step of encrypting the second local identifier carried in the target traffic diversion strategy based on the public key in the public key dictionary to generate a first identifier encryption set includes: For each second local identifier, selecting a target public key corresponding to the second local identifier; Based on the target public key, encrypt the second local identifier and the five-tuple information to obtain an encrypted local identifier, wherein the five-tuple information is the five-tuple information of the user traffic; The obtained encrypted local identifier is used as the first identifier encryption set.

3. The method according to claim 2, characterized in that The step of matching the decrypted local identifier with the multiple first local identifiers and selecting a first target security network element according to the matching result includes: Traversing the plurality of first local identifiers, searching for a target first local identifier that is identical to the decrypted local identifier; The security network element corresponding to the target first local identifier is used as the first target security network element.

4. The method according to claim 3, characterized in that After searching for the target first local identifier that is identical to the decrypted local identifier and before using the security network element corresponding to the target first local identifier as the first target security network element, the method further includes: Comparing the target five-tuple information with the five-tuple information of the user traffic; Determine that the comparison result is the same; The target five-tuple information is obtained by decrypting the first identifier encryption set.

5. The method according to claim 1, characterized in that The method further includes: If the target traffic diversion strategy is not selected from the multiple traffic diversion strategies, the user traffic is sent to the switch, so that the switch sends the user traffic to other routers in the router group.

6. The method according to claim 1, characterized in that The method further includes: Based on the private key dictionary, the first identifier encryption set in the header of the target message is decrypted. If the decryption fails, the target message is sent to the switch, so that the switch sends the target message to other routers in the router group. The other routers decrypt the first identifier encryption set in the header of the target message based on the private key dictionary corresponding to the other routers, match the decrypted local identifier with multiple first local identifiers corresponding to the other routers, select a first target security network element according to the matching result, and send the user traffic to the first target security network element.

7. The method according to claim 1, characterized in that After sending the user traffic to the first target security network element, the method further includes: receiving processed user traffic sent by the first target security network element; Decrypting, based on the private key dictionary, a second element in the first identifier encryption set in the header of the target message; The decrypted local identifier is matched with the multiple first local identifiers, a second target security network element is selected according to the matching result, and the processed user traffic is sent to the second target security network element until the last element in the encrypted set of the first identifiers.

8. The method according to claim 1, characterized in that After selecting the first target security network element according to the matching result, the method further includes: After determining that the first target safety network element is faulty, determining a first local identifier corresponding to a third target safety network element in the target safety network element group; Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element; The user traffic is sent to a third target security network element corresponding to the modified first local identifier.

9. The method according to any one of claims 1 to 8, characterized in that: The method further comprises: Receiving a first temporary public key sent by the management module; The multiple first local identifiers are encrypted based on the first temporary public key to obtain a second identifier encryption set, and the second identifier encryption set is sent to the management module, so that after the management module receives the second identifier encryption set, the elements in the second identifier encryption set are decrypted based on the first temporary private key corresponding to the first temporary public key to obtain multiple decrypted local identifiers, and based on the multiple decrypted local identifiers, the router is confirmed to be a legitimate router and the elements in the encryption set are decrypted.

10. The method according to claim 9, characterized in that The method further comprises: For the security network elements corresponding to the multiple first local identifiers, sending the public key corresponding to the first local identifier to the security network element, so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier; After receiving the encrypted identifier sent by the security network element, the encrypted identifier is decrypted based on the private key corresponding to the first local identifier. If the decryption is successful, it is determined that the security network element is legal.

11. A router, characterized in that: The router comprises: An encryption module, configured to select a target traffic diversion strategy from a plurality of traffic diversion strategies based on user traffic sent by the switch, and encrypt a second local identifier carried in the target traffic diversion strategy based on a public key in a public key dictionary to generate a first identifier encryption set; A generating module, configured to generate a target message based on the user traffic and a header, wherein the header is obtained based on the encrypted set of the first identifier; a decryption module, configured to decrypt the first element in the first identifier encryption set in the header of the target message based on a private key dictionary, match the decrypted local identifier with the multiple first local identifiers, select a first target security network element according to the matching result, and send the user traffic to the first target security network element; Among them, the private key dictionary, the public key dictionary, the multiple first local identifiers and the multiple diversion strategies are sent by the management module, the private key dictionary includes the correspondence between the first local identifier corresponding to the router and the first private key, and the public key dictionary includes the correspondence between the first local identifier corresponding to the router group and the public key.

12. A router, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executable instructions; The processor executes the computer-executable instructions stored in the memory to implement the method according to any one of claims 1 to 10.

Images