A data transmission method and router

Abstract

This application provides a data transmission method and a router. The method is applied to a router in a router group in a service chain. First, it receives a private key dictionary, a public key dictionary, multiple first local identifiers, and multiple traffic redirection policies sent by a management module. Based on the user traffic sent by the switch, it selects a target traffic redirection policy from the multiple traffic redirection policies and encrypts the second local identifier in the target traffic redirection policy based on the public key dictionary to generate a first identifier encryption set. Then, it generates a target packet based on the user traffic and the header. Finally, based on the private key dictionary, it decrypts the first element in the first identifier encryption set in the target packet, matches the decrypted local identifier with the multiple first local identifiers, selects a first target security network element, and sends the user traffic to it. Because the encrypted target traffic redirection policy is written into the user traffic and decrypted inside the router, the transmission path is kept confidential, thus improving the security of the service chain.

Description

Technical Field

[0001] This application relates to the field of cloud network security technology, and in particular to a data transmission method and a router. Background Technology

[0002] With the popularization of cloud computing networks, the requirements for Service Function Chain (SFC) technology are increasing. Service Function Chain technology is the security service chain technology in cloud networks, such as providing users with security functions such as firewalls, intrusion detection systems and intrusion prevention systems.

[0003] In existing technologies, SRV6 (Segment Routing IPv6) is a segmented routing protocol based on Internet Protocol version 6 (IPv6). SRV6's technological breakthroughs in network programmability simplify the node configuration and policy deployment of SFC. However, due to the transparency of the transmission and configuration process, the data transmission path may be subject to attacks such as eavesdropping and tampering. Furthermore, after attackers steal and tamper with the data, it will affect the management module's decision on service chain configuration, causing business paralysis. Summary of the Invention

[0004] This application provides a data transmission method and a router to solve the problem that service chains are vulnerable to attack in the prior art.

[0005] In a first aspect, embodiments of this application provide a data transmission method applied to routers in a router group within a service chain, the method comprising:

[0006] Based on the user traffic sent by the switch, a target traffic redirection strategy is selected from multiple traffic redirection strategies, and based on the public key in the public key dictionary, the second local identifier carried in the target traffic redirection strategy is encrypted to generate a first identifier encryption set.

[0007] Based on the user traffic and header, a target message is generated, wherein the header is obtained based on the first identifier encryption set;

[0008] Based on the private key dictionary, the first element in the first identifier encryption set in the header of the target message is decrypted, the decrypted local identifier is matched with the plurality of first local identifiers, the first target security network element is selected according to the matching result, and the user traffic is sent to the first target security network element;

[0009] The private key dictionary, the public key dictionary, the plurality of first local identifiers, and the plurality of traffic redirection strategies are sent by the management module. The private key dictionary includes the correspondence between the first local identifier and the first private key corresponding to the router, and the public key dictionary includes the correspondence between the first local identifier and the public key corresponding to the router group.

[0010] In one possible implementation, the step of encrypting the second local identifier carried in the target traffic redirection strategy based on the public key in the public key dictionary to generate a first identifier encryption set includes:

[0011] For each second local identifier, select the target public key corresponding to the second local identifier;

[0012] Based on the target public key, the second local identifier and the 5-tuple information are encrypted to obtain the encrypted local identifier, wherein the 5-tuple information is the 5-tuple information of the user traffic;

[0013] The obtained encrypted local identifier is used as the first identifier encryption set.

[0014] In one possible implementation, the step of matching the decrypted local identifier with the plurality of first local identifiers and selecting the first target security network element based on the matching result includes:

[0015] Traverse the plurality of first local identifiers to find a target first local identifier that is the same as the decrypted local identifier;

[0016] The security network element corresponding to the first local identifier of the target is taken as the first target security network element.

[0017] In one possible implementation, after finding the target first local identifier that is the same as the decrypted local identifier and before using the security network element corresponding to the target first local identifier as the first target security network element, the method further includes:

[0018] Compare the target quintuple information with the user traffic quintuple information;

[0019] The comparison results are confirmed to be the same;

[0020] The target quintuple information is obtained by decrypting the first identifier encryption set.

[0021] In one possible implementation, the method further includes:

[0022] If no target traffic redirection strategy is selected from the multiple traffic redirection strategies, the user traffic is sent to the switch so that the switch can send the user traffic to other routers in the router group.

[0023] In one possible implementation, the method further includes:

[0024] Based on the private key dictionary, the encrypted set of the first identifier in the header of the target packet is decrypted. If decryption fails, the target packet is sent to the switch, so that the switch sends the target packet to other routers in the router group. The other routers, based on their corresponding private key dictionaries, decrypt the encrypted set of the first identifier in the header of the target packet, match the decrypted local identifier with multiple first local identifiers corresponding to the other routers, select a first target security network element based on the matching result, and send the user traffic to the first target security network element.

[0025] In one possible implementation, after sending the user traffic to the first target security network element, the method further includes:

[0026] Receive processed user traffic sent by the first target security network element;

[0027] Based on the private key dictionary, the second element in the first identifier encryption set in the header of the target message is decrypted;

[0028] The decrypted local identifier is matched with the plurality of first local identifiers. Based on the matching result, a second target security network element is selected, and the processed user traffic is sent to the second target security network element until the last element in the first identifier encryption set is reached.

[0029] In one possible implementation, after selecting the first target security network element based on the matching result, the method further includes:

[0030] After determining that the first target security network element is faulty, determine the first local identifier corresponding to the third target security network element in the target security network element group;

[0031] Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element;

[0032] The user traffic is sent to the third target security network element corresponding to the modified first local identifier.

[0033] In one possible implementation, the method further includes:

[0034] Receive the first temporary public key sent by the management module;

[0035] Based on the first temporary public key, the plurality of first local identifiers are encrypted to obtain a second identifier encryption set. The second identifier encryption set is sent to the management module so that after receiving the second identifier encryption set, the management module decrypts the elements in the second identifier encryption set based on the first temporary private key corresponding to the first temporary public key to obtain a plurality of decrypted local identifiers. Based on the plurality of decrypted local identifiers, the router is confirmed to be a legitimate router.

[0036] In one possible implementation, the method further includes:

[0037] For each of the multiple first local identifiers corresponding to a security network element, a public key corresponding to the first local identifier is sent to the security network element so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier.

[0038] After receiving the encrypted identifier sent by the security network element, the encrypted identifier is decrypted based on the private key corresponding to the first local identifier. If the decryption is successful, the security network element is determined to be legitimate.

[0039] Secondly, embodiments of this application provide a router, including:

[0040] An encryption module is used to select a target traffic redirection strategy from multiple traffic redirection strategies based on user traffic sent by the switch, and encrypt the second local identifier carried in the target traffic redirection strategy based on the public key in the public key dictionary to generate a first identifier encryption set.

[0041] A generation module is configured to generate a target message based on the user traffic and the header, wherein the header is obtained based on the first identifier encryption set;

[0042] The decryption module is used to decrypt the first element in the first identifier encryption set in the header of the target message based on the private key dictionary, match the decrypted local identifier with the plurality of first local identifiers, select the first target security network element according to the matching result, and send the user traffic to the first target security network element.

[0043] The private key dictionary, the public key dictionary, the plurality of first local identifiers, and the plurality of traffic redirection strategies are sent by the management module. The private key dictionary includes the correspondence between the first local identifier and the first private key corresponding to the router, and the public key dictionary includes the correspondence between the first local identifier and the public key corresponding to the router group.

[0044] Thirdly, embodiments of this application provide a router, including: a processor, and a memory communicatively connected to the processor;

[0045] The memory stores computer-executed instructions;

[0046] The processor executes computer execution instructions stored in the memory to implement the method as described in any one of the first aspects.

[0047] This application provides a data transmission method and a router. The method is applied to a router in a router group within a service chain. First, it receives a private key dictionary, a public key dictionary, multiple first local identifiers, and multiple traffic redirection policies sent by a management module. Based on user traffic sent by the switch, a target traffic redirection policy is selected from the multiple policies. Then, based on the public key in the public key dictionary, a second local identifier in the target traffic redirection policy is encrypted to generate a first identifier encryption set. Next, a target packet is generated based on the user traffic and a header, where the header is obtained based on the first identifier encryption set. Finally, based on the private key dictionary, the first element in the first identifier encryption set in the header of the target packet is decrypted. The decrypted local identifier is matched with multiple first local identifiers. Based on the matching result, a first target security network element is selected, and user traffic is sent to the first target security network element. Because the encrypted target traffic redirection policy is written into the user traffic and decrypted internally by the router, the transmission path is kept confidential, improving the security of the service chain. Attached Figure Description

[0048] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0049] Figure 1 This is a diagram illustrating an applicable application scenario for the embodiments of this application;

[0050] Figure 2 A schematic diagram of the structure of a router and a security network element provided in an embodiment of this application;

[0051] Figure 3 A flowchart illustrating a data transmission method provided in an embodiment of this application;

[0052] Figure 4 This is a schematic diagram of another router and security network element provided in an embodiment of this application;

[0053] Figure 5 A schematic diagram of a service chain structure provided in an embodiment of this application;

[0054] Figure 6 A flowchart illustrating a data transmission method provided in an embodiment of this application;

[0055] Figure 7 A flowchart illustrating another data transmission method provided in an embodiment of this application;

[0056] Figure 8 This is a schematic diagram illustrating the interaction between a router and a management module for two-way authentication, provided as an embodiment of this application.

[0057] Figure 9 A schematic diagram illustrating the interaction between a security network element and a management module for two-way authentication, provided as an embodiment of this application;

[0058] Figure 10 This is a schematic diagram illustrating the interaction between a router and a security network element for two-way authentication, provided as an embodiment of this application.

[0059] Figure 11 This application provides a schematic diagram of the structure of a router according to an embodiment of the present application.

[0060] Figure 12 This is a schematic diagram of another router structure provided in an embodiment of this application;

[0061] Figure 13 This is a schematic diagram of another router structure provided in an embodiment of this application. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0063] like Figure 1 The diagram shown is an applicable application scenario provided by the embodiments of this application, namely a service chain structure diagram based on SRV6. The service chain 11 includes a switch 21, a router group 22, a security network element group 23, and a management module 24. The router group includes multiple routers 22n, and the security network element group includes multiple security network elements 23n.

[0064] During network initialization and user service activation, the management module 24 configures multiple first local identifiers (Localsid) and multiple traffic redirection policies for each router in the router group 22, as well as corresponding security network elements configured based on the multiple local first local identifiers;

[0065] For example, such as Figure 2 As shown, the management module 24 configures the first local identifier fc00:1::1, the first local identifier fc00:1::2 and the first local identifier end.dx to the router 221, configures traffic redirection policy 1 and traffic redirection policy 2, and configures security network element 231 based on the first local identifier fc00:1::1 and security network element 232 based on the first local identifier fc00:1::2.

[0066] Configure the first local identifier fc00:1::3 and the first local identifier end.dx on router 222, configure traffic redirection policy 3 and traffic redirection policy 4, and configure security network element 233 based on the first local identifier fc00:1::3;

[0067] Configure router 223 with first local identifier fc00:1::4, first local identifier fc00:1::5 and first local identifier end.dx, configure traffic redirection policy 5 and traffic redirection policy 6, configure security network element 234 based on first local identifier fc00:1::4, and configure security network element 235 based on first local identifier fc00:1::5.

[0068] It should be noted that the first local identifier end.dx indicates the end of data processing.

[0069] In the prior art, the switch 21 sends user traffic to the router 22n. The router 22n selects a target traffic redirection strategy based on the user traffic and then sends the user traffic to a security network element for processing based on the target traffic redirection strategy. However, the data transmission process and the matching process of the target traffic redirection strategy are transparent, which makes it easy for attackers to tamper with the target traffic redirection strategy. Furthermore, attackers can also forge and intrude into the management module 24 to steal user data.

[0070] To improve the security of data transmission, this application provides a data transmission method and a router. The data transmission method and router provided in this application will be described in detail below with reference to the accompanying drawings.

[0071] like Figure 3 The diagram shown is a flowchart illustrating a data transmission method provided in an embodiment of this application.

[0072] S301: Based on the user traffic sent by the switch, select the target traffic redirection strategy from multiple traffic redirection strategies, and based on the public key in the public key dictionary, encrypt the second local identifier carried in the target traffic redirection strategy to generate the first identifier encryption set;

[0073] S2302: Generate a target message based on user traffic and header, wherein the header is obtained by encrypting a set of first identifiers;

[0074] S303: Based on the private key dictionary, decrypt the first element in the encryption set of the first identifier in the header of the target message, match the decrypted local identifier with multiple first local identifiers, select the first target security network element according to the matching result, and send user traffic to the first target security network element;

[0075] This application provides a data transmission method and router, applied to a router in a router group within a service chain. The method receives a private key dictionary, a public key dictionary, multiple first local identifiers, and multiple traffic redirection policies sent by a management module. Based on user traffic sent by the switch, a target traffic redirection policy is selected from the multiple traffic redirection policies. Based on the public key in the public key dictionary, a second local identifier in the target traffic redirection policy is encrypted to generate a first identifier encryption set. A target packet is generated based on the user traffic and a header, wherein the header is obtained based on the first identifier encryption set. Based on the private key dictionary, the first element in the first identifier encryption set in the header of the target packet is decrypted. The decrypted local identifier is matched with multiple first local identifiers. Based on the matching result, a first target security network element is selected, and user traffic is sent to the first target security network element. Because the encrypted target traffic redirection policy is written into the user traffic and decrypted internally by the router, the transmission path is kept confidential, improving the security of the service chain.

[0076] In a specific embodiment, router 22n in router group 21 first receives multiple first local identifiers and multiple traffic redirection policies allocated by the management module, as detailed below. Figure 2 The methods described herein will not be repeated here.

[0077] Secondly, router 22n receives the key dictionary sent by management module 24. The key dictionary includes a private key dictionary and a public key dictionary. The private key dictionary includes the correspondence between the first local identifier and the first private key corresponding to router 22n. The public key dictionary includes the correspondence between the first local identifier and the public key corresponding to router group 22.

[0078] For example, such as Figure 4 The diagram shows another router and security network element structure provided in this application embodiment. The management module 24 sends a private key dictionary 1 and a public key dictionary corresponding to router 221 based on multiple first local identifiers of router 221. Private key dictionary 1 includes the correspondence between the first local identifiers fc00:1::1, fc00:1::2, and end.dx and the first private keys 1, 2, and 6. The specific details of private key dictionary 1 are shown in Table 1.

[0079] fc00:1::1 First Private Key 1 fc00:1::2 First Private Key 2 end.dx First Private Key 6

[0080] Table 1

[0081] Based on multiple first local identifiers of router 222, the private key dictionary 2 and public key dictionary corresponding to router 222 are sent. Private key dictionary 2 includes the correspondence between the first local identifier fc00:1::3, the first local identifier end.dx and the first private key 3 and the first private key 6. The specific details of private key dictionary 2 are shown in Table 2.

[0082] fc00:1::3 First Private Key 3 end.dx First Private Key 6

[0083] Table 2

[0084] Based on multiple first local identifiers of router 223, the private key dictionary 3 and public key dictionary corresponding to router 223 are sent. Private key dictionary 3 includes the correspondence between the first local identifiers fc00:1::4, fc00:1::5, and end.dx and the first private keys 4, 5, and 6. The specific private key dictionary 3 is shown in Table 3.

[0085] fc00:1::4 First Private Key 4 fc00:1::5 First Private Key 5 end.dx First Private Key 6

[0086] Table 3

[0087] Router 221, Router 222, and Router 223 share the same public key dictionary. This public key dictionary includes the correspondence between the first local identifier fc00:1::1, fc00:1::2, fc00:1::3, fc00:1::4, fc00:1::5, and the first local identifier end.dx in router group 22 and the public keys 1, 2, 3, 4, 5, and 6. The specific details of the public key dictionary are shown in Table 4.

[0088]

[0089]

[0090] Table 4

[0091] In a specific embodiment, the management module 24 also sends a first private key to each security network element corresponding to the first local identifier. For example, the management module 24 sends the first private key corresponding to the first local identifier fc00:1::1 to the security network element 231, and finally... Figure 5 The diagram shown is a schematic representation of a service chain structure provided in an embodiment of this application.

[0092] It should be noted that the configuration of router 22n used in the following embodiments is the same as the configuration in the above embodiments.

[0093] In one embodiment, router 22n receives user traffic sent by switch, selects a target traffic redirection strategy from multiple traffic redirection strategies, and then rewrites the user traffic.

[0094] Specifically, router 22n receives user traffic sent by switch 21, selects a target redirection strategy from multiple redirection strategies in router 22n, and then determines whether the user traffic uses Internet Protocol version 4 (IPv4). If the user traffic uses IPv4, it adds an IPv6 header to the user traffic, resulting in rewritten user traffic.

[0095] If the user traffic does not use Internet Protocol version 4 (IPv4), add a Segment Routing Header (SRH) to the user traffic to obtain the rewritten user traffic.

[0096] It should be noted that the header of Internet Protocol version 6 (IPv6) includes the Routing Extension Header (SRH).

[0097] In another embodiment, after receiving user traffic sent by the switch, if the router 22n does not select a target traffic redirection policy from the multiple traffic redirection policies included in the router 22n, the router 22n sends user traffic to the switch 21 so that the switch sends user traffic from other routers in the router group 22 based on the routing table until a target traffic redirection policy is successfully matched.

[0098] In one embodiment, for each second local identifier, a target public key corresponding to the second local identifier is selected; based on the target public key, the second local identifier and the 5-tuple information are encrypted to obtain the encrypted local identifier; the obtained encrypted local identifier is used as the first identifier encryption set.

[0099] For example, when router 221 receives user traffic sent by switch 21, it selects traffic redirection policy1 as the target traffic redirection policy from multiple traffic redirection policies in router 221. Target traffic redirection policy1 includes the second local identifier fc000:1:1, the second local identifier fc00:1::2, and the second local identifier end.dx. It then searches the public key dictionary, referring to Table 4, and encrypts the second local identifier fc000:1:1 based on public key 1 and the 5-tuple information in the rewritten user traffic to generate the encrypted local identifier 1; encrypts the second local identifier fc000:1:2 based on public key 2 and the 5-tuple information in the rewritten user traffic to generate the encrypted local identifier 2; and encrypts the second local identifier end.dx based on public key 6 and the 5-tuple information in the rewritten user traffic to generate the encrypted local identifier 3.

[0100] The encrypted local identifier 1, encrypted local identifier 2, and encrypted local identifier 3 are used as the first identifier encryption set SL.

[0101] In this embodiment of the application, after obtaining the first identifier encryption set SL, a target message is generated based on the rewritten user traffic and header, wherein the header is obtained based on the first identifier encryption set.

[0102] Specifically, the first identifier encryption set SL is added to the routing extension header SRH in the rewritten user traffic to generate the target packet.

[0103] In one embodiment, based on the private key dictionary, the first element in the first identifier encryption set SL in the header of the target message is decrypted, the decrypted local identifier is matched with multiple first local identifiers, and the target quintuple information is compared with the quintuple information of the user traffic. Based on the matching result, the first target security network element is selected, and the user traffic is sent to the first target security network element.

[0104] Specifically, the private key dictionary is searched, and the first element (i.e. the first encrypted local identifier) ​​in the encryption set SL of the first identifier in the header SRH of the target packet is decrypted to obtain the decrypted second local identifier and the target 5-tuple information (i.e. the 5-tuple information of the rewritten user traffic). Then, multiple first local identifiers in router 22n are traversed to find the target first local identifier that is the same as the decrypted second local identifier.

[0105] In another embodiment, if multiple first local identifiers in router 22n are traversed and no target first local identifier that is the same as the decrypted second local identifier is found, router 22n sends the target packet to switch 21. Switch 21 searches for the router where the target first local identifier is located based on the routing table and sends the target packet to the router.

[0106] The target 5-tuple information is compared with the user traffic. If the target 5-tuple information is the same as the user traffic, the header of the rewritten user traffic is removed to obtain the restored user traffic (i.e., the user traffic sent by the switch). The restored user traffic is then sent to the first target security network element.

[0107] In one embodiment, processed user traffic sent by a first target security network element is received;

[0108] Based on the private key dictionary, the second element in the encryption set of the first identifier in the header of the target message is decrypted;

[0109] The decrypted local identifier is matched with multiple first local identifiers. Based on the matching results, a second target security network element is selected, and the processed user traffic is sent to the second target security network element until the last element in the first identifier encryption set is reached.

[0110] Specifically, such as Figure 6 The diagram shown is a flowchart illustrating a data transmission method provided in an embodiment of this application, including:

[0111] S601: Router receives user traffic;

[0112] S602: Determine the target traffic acquisition strategy;

[0113] S603: Determine whether user traffic uses IPv4; if yes, proceed to S605; if no, proceed to S604.

[0114] S604: Add SRH to user traffic to obtain rewritten user traffic;

[0115] S605: Add IPv6 to user traffic to obtain the rewritten user traffic;

[0116] S606: Generate the first identifier encryption set SL1, and add the first identifier encryption set SL1 to the SRH in the rewritten user traffic to generate the target packet;

[0117] S607: Decrypt the first element in the first identifier encryption set SL1 to obtain the decrypted second local identifier and target quintuple information;

[0118] S608: Determine the target first local identifier that is the same as the decrypted second local identifier;

[0119] S609: Determine whether the second local identifier is the last element of the encryption set SL1 of the first identifier; if yes, execute S613; if no, execute S610.

[0120] S610: Determine whether the target quintuple information is the same as the quintuple information in the user traffic; if yes, execute S611; if no, execute S613.

[0121] S611: Take the security network element corresponding to the first local identifier of the target as the first target security network element, and output the restored user traffic to the first target security network element;

[0122] S612: After receiving the user traffic processed by the first target security network element, execute S603;

[0123] S613: Output user traffic.

[0124] For example, router 221 receives user traffic 1 and uses traffic redirection policy 1 as the target traffic redirection policy, wherein the target traffic redirection policy includes the second local identifier fc000:1:1, the second local identifier fc00:1::2 and the second local identifier end.dx;

[0125] After confirming that the user traffic is not using IPv4, add an SRH to user traffic 1 to obtain the rewritten user traffic 1.

[0126] Router 221, based on a public key dictionary, encrypts the second local identifier in the target traffic redirection strategy and the five-tuple information in the rewritten user traffic 1, generating encrypted local identifier 1, encrypted local identifier 2, and encrypted local identifier 3, as well as generating a first identifier encryption set SL1. The first identifier encryption set SL1 is then added to the SRH in the rewritten user traffic 1 to generate target packet 1, wherein the first identifier encryption set SL1 includes encrypted local identifier 1, encrypted local identifier 2, and encrypted local identifier 3.

[0127] Router 221 searches the private key dictionary, decrypts the first element in the encryption set SL1 of the first identifier in the header SRH of target packet 1, and obtains the decrypted second local identifier fc000:1:1 and the target 5-tuple information. It then traverses multiple first local identifiers in router 221 (i.e., first local identifier fc000:1:1, first local identifier fc00:1::2 and first local identifier end.dx) to determine the target first local identifier fc000:1:1 that is the same as the decrypted second local identifier fc000:1:1.

[0128] Router 221 compares the decrypted target 5-tuple information with the 5-tuple information in user traffic 1 and confirms that the comparison result is the same, that is, confirms that the rewritten user traffic has not been tampered with by the attacker.

[0129] After router 221 takes the security network element 231 corresponding to the target first local identifier fc000:1:1 as the first target security network element, it removes the header of the rewritten user traffic and sends the restored user traffic (i.e., user traffic 1) to the first target security network element for processing.

[0130] Router 221 receives the processed user traffic 2 sent by the first target security network element, determines that user traffic 2 does not use IPv4, adds an SRH to user traffic 2, and adds the first identifier encryption set SL1 to the SRH.

[0131] Based on the private key dictionary, the second element (i.e., the encrypted local identifier 2) in the first identifier encryption set SL1 is decrypted to obtain the decrypted second local identifier fc000:1:2 and the target quintuple information 2.

[0132] The second local identifier fc000:1:2 is matched with multiple first local identifiers (i.e., first local identifier fc000:1:1, first local identifier fc00:1::2 and first local identifier end.dx), and the target quintuple information 2 is compared with the quintuple information in user traffic 2. Based on the matching and comparison results, the second target security network element (i.e., security network element 232 corresponding to the target first local identifier fc000:1:2) is selected, and user traffic 2 is sent to the second target security network element.

[0133] Router 221 receives the processed user traffic 3 sent by the second target security network element, determines that user traffic 3 does not use IPv4, adds an SRH to user traffic 3, and adds the first identifier encryption set SL1 to the SRH;

[0134] Based on the private key dictionary, the third element (i.e., the encrypted local identifier 3) in the first identifier encryption set SL1 is decrypted, and the decrypted third local identifier end.dx and target quintuple information are obtained.

[0135] When the router detects that the third local identifier is end.dx, it indicates the end of data processing and outputs user traffic 3.

[0136] It should be noted that after the target security network element receives the restored user traffic, it performs some business-related processing, including implementing security functions such as Network Address Translation (NAT), data compression, data inspection, data monitoring, filtering / access control, etc. This application does not impose any restrictions on this.

[0137] In another embodiment, after selecting the first target security network element based on the matching result, and after determining that the first target security network element is faulty, the first local identifier corresponding to the third target security network element in the target security network element group is determined; the decrypted local identifier is modified to the first local identifier corresponding to the third target security network element; and user traffic is sent to the third target security network element corresponding to the modified first local identifier.

[0138] For example, such as Figure 7 The diagram shown is a flowchart illustrating another data transmission method provided in an embodiment of this application, as detailed below:

[0139] S701: Router receives user traffic;

[0140] S702: Determine the target traffic acquisition strategy;

[0141] S703: Determine whether user traffic uses IPv4; if no, proceed to S704; if yes, proceed to S705.

[0142] S704: Add SRH to user traffic to obtain rewritten user traffic;

[0143] S705: Add IPv6 to user traffic to obtain rewritten user traffic;

[0144] S706: Generate the first identifier encryption set SL1, and add the first identifier encryption set SL1 to the SRH in the rewritten user traffic to generate the target packet;

[0145] S707: Decrypt the first element in the first identifier encryption set SL1 to obtain the decrypted second local identifier and target quintuple information;

[0146] S708: Determine the target first local identifier that is the same as the decrypted second local identifier;

[0147] S709: Determine if the second local identifier is the last element of the encryption set SL1 of the first identifier; if yes, execute S717; if no, execute S710;

[0148] S710: Determine whether the target 5-tuple information is the same as the 5-tuple information in the user traffic; if yes, proceed to S711; if no, proceed to S717.

[0149] S711: Use the security network element corresponding to the first local identifier of the target as the first target security network element;

[0150] S712: Determine that the first target security network element has failed, and determine that its corresponding first local identifier has set the activation bypass function;

[0151] S713: Determine the first local identifier corresponding to the third target security element in the target security element group;

[0152] S714: Modify the decrypted local identifier to the first local identifier corresponding to the third target security element;

[0153] S715: Send user traffic to the third target security element corresponding to the modified first local identifier;

[0154] S716: After receiving user traffic processed by the third target security network element, execute S703;

[0155] S717: Outputs user traffic.

[0156] For example, when router 223 receives user traffic 1, it uses traffic redirection policy 5 as the target traffic redirection policy, where the target traffic redirection policy includes the second local identifier fc000:1:4, the second local identifier fc00:1::5, and the second local identifier end.dx;

[0157] Since user traffic 1 does not use IPv4, add an SRH to user traffic 1 to obtain the rewritten user traffic 1.

[0158] Router 223, based on the public key dictionary, encrypts the second local identifier in the target traffic redirection strategy and the five-tuple information in the rewritten user traffic to generate encrypted local identifier 1, encrypted local identifier 2, and encrypted local identifier 3. It uses encrypted local identifier 1, encrypted local identifier 2, and encrypted local identifier 3 as the first identifier encryption set SL1, and adds the first identifier encryption set SL1 to the SRH in the rewritten user traffic to generate target packet 1.

[0159] Router 223 searches the private key dictionary, decrypts the first element (i.e., the encrypted local identifier 1) in the first identifier encryption set SL1 in the header SRH of target packet 1, and obtains the decrypted second local identifier fc000:1:4 and target 5-tuple information 1. Then, it traverses multiple first local identifiers in router 221 (i.e., first local identifier fc000:1:4, first local identifier fc00:1::5 and first local identifier end.dx) to determine the target first local identifier fc000:1:4 that is the same as the decrypted second local identifier fc000:1:4.

[0160] Router 223 compares the target 5-tuple information 1 with the 5-tuple information in user traffic 1 and confirms that the comparison result is the same, that is, user traffic 1 has not been tampered with by the attacker; and takes the security network element 234 corresponding to the target first local identifier fc000:1:4 as the first target security network element.

[0161] When router 223 determines that the first target security network element (i.e., security network element 234) has failed and determines that the first local identifier fc000:1:4 corresponding to the first target security network element has the bybass function enabled, router 221 queries the security network element group configuration. After confirming that security network element 232 and security network element 234 are in the same security network element group, it modifies the decrypted second local identifier fc000:1:4 to the first local identifier fc000:1:2 corresponding to security network element 232.

[0162] Based on the private key dictionary corresponding to Router 223, Router 223 encrypts the modified second local identifier fc000:1:2 and the target quintuple information 1 to generate an encrypted local identifier 4. The encrypted local identifier 2, encrypted local identifier 3 and encrypted local identifier 4 are used as the first identifier encryption set SL2, where the encrypted local identifier 4 is the first element in the first identifier encryption set SL2.

[0163] The first identifier encryption set SL2 is added to the SRH in the rewritten user traffic to generate target packet 2; router 223 forwards target packet 2 to the router (i.e. router 221) corresponding to security element 232 through switch 21.

[0164] After receiving the target packet 2, router 221 decrypts the first element (i.e., the encrypted local identifier 4) in the first identifier encryption set SL2 based on the public key dictionary to obtain the modified second local identifier fc000:1:2 and the target quintuple information. After confirming that the multiple first local identifiers in router 221 include the first local identifier fc000:1:2 which is equal to the modified second local identifier fc000:1:2, and confirming that the target quintuple information 1 is the same as the quintuple information in user traffic 1, router 221 sends the restored user traffic (i.e., user traffic 1) to the security network element 232 corresponding to the first local identifier fc000:1:2 for processing.

[0165] After receiving user traffic 2 processed by security network element 232, router 221 forwards user traffic 2 to router 223 through switch 21;

[0166] Router 223 receives user traffic 2, determines that user traffic 2 does not use IPv4, adds an SRH to user traffic 2, and adds the first identifier encryption set SL2 to the SRH;

[0167] Based on the private key dictionary, the second element in the first identifier encryption set SL2 is decrypted to obtain the decrypted second local identifier fc00:1::5 and the target quintuple information 2. After confirming that the target quintuple information 2 is the same as the quintuple information in user traffic 2, user traffic 2 is sent to the security network element corresponding to the first local identifier that is equal to the second local identifier fc00:1::5 for processing, until the last element in the first identifier encryption set SL2 is reached.

[0168] It should be noted that the processing procedure is the same as... Figure 5 The processing procedure described is the same, so it will not be repeated here.

[0169] In one embodiment, each router in router group 22 performs two-way authentication with management module 24, specifically including:

[0170] Router 22n receives the first temporary public key sent by management module 24;

[0171] Based on the first temporary public key, multiple first local identifiers are encrypted to obtain a second identifier encryption set. The second identifier encryption set is sent to the management module 24 so that after receiving the second identifier encryption set, the management module 24 decrypts the elements in the second identifier encryption set based on the first temporary private key corresponding to the first temporary public key to obtain multiple decrypted local identifiers. Based on the multiple decrypted local identifiers, the route 22n is confirmed as a legitimate router.

[0172] For example, such as Figure 8 The diagram shown is an interactive schematic of two-way authentication between a router and a management module provided in an embodiment of this application.

[0173] S801: Management module 24 generates a pair of temporary keys 1, including a first temporary public key Key1 and a first temporary private key key1, and sends the first temporary public key Key1 to router 221;

[0174] S802: Router 221 encrypts multiple first local identifiers corresponding to the first temporary public key Key1 to generate a second identifier encryption set, and sends the second identifier encryption set to management module 24.

[0175] The first temporary public key Key1 corresponds to several first local identifiers, including the first local identifier fc000:1:1, the first local identifier fc00:1::2, and the first local identifier end.dx.

[0176] S803: The management module 24 decrypts the encrypted set of the second identifier based on the first temporary private key key1 to obtain multiple decrypted local identifiers. After confirming that the multiple decrypted local identifiers are the same as the information stored in the management module 24, the management module 24 confirms that the router 221 is a legitimate router.

[0177] In another embodiment, each security element in security element group 23 performs two-way authentication with management module 24, specifically including:

[0178] Security element 23n receives the second temporary public key sent by the management module;

[0179] Based on the second temporary public key, the first local identifier corresponding to the security network element 23n is encrypted to obtain the encrypted first local identifier. The encrypted first local identifier is then sent to the management module 24 so that after receiving the encrypted first local identifier, the management module 24 decrypts the encrypted first local identifier based on the second temporary private key corresponding to the second temporary public key to obtain the decrypted first local identifier. Based on the decrypted first local identifier, the security network element 23n is confirmed as a legitimate security network element.

[0180] For example, such as Figure 9 The diagram shown is an interactive schematic of two-way authentication between a security network element and a management module, provided in an embodiment of this application.

[0181] S901: The management module 24 generates a pair of temporary keys 2, including a second temporary public key Key2 and a second temporary private key key2, and sends the second temporary public key Key2 to the security network element 231;

[0182] S902: The security element 231 encrypts the corresponding first local identifier (i.e., the first local identifier fc000:1:1) based on the second temporary private key key2, generates the encrypted first local identifier, and sends the encrypted first local identifier to the management module 24.

[0183] S903: The management module 24 decrypts the encrypted first local identifier based on the second temporary private key key2 to obtain the decrypted first local identifier. After confirming that the decrypted first local identifier is the same as the information stored in the management module 24, it confirms that the security element 231 is a security element.

[0184] In another embodiment, router 22n performs bidirectional authentication with security network element 23n;

[0185] For the security network elements corresponding to multiple first local identifiers in router 22n, send the public key corresponding to the first local identifier to the security network element so that the security network element can encrypt the first local identifier of the security network element based on the public key to obtain the encrypted identifier;

[0186] After receiving the encrypted identifier sent by the security network element 23n, the router 22n decrypts the encrypted identifier based on the private key corresponding to the first local identifier. If the decryption is successful, the security network element is determined to be legitimate.

[0187] For example, such as Figure 10 The diagram shown is an interactive schematic of two-way authentication between a router and a security network element provided in an embodiment of this application. The security network element 231 corresponding to the first local identifier fc000:1:1 in router 221 undergoes the following specific steps:

[0188] S1001: Router 221 sends public key 1, corresponding to the first local identifier fc000:1:1, to security element 231;

[0189] S1002: Security element 231 encrypts the first local identifier fc000:1:1 corresponding to 1 based on the public key to obtain the encrypted identifier, and sends the encrypted identifier to router 221.

[0190] S1003: Router 221 determines the private key 1 corresponding to the first local identifier fc000:1:1 based on the private key dictionary, and decrypts the encrypted identifier based on the private key 1. If the decryption is successful, the security element 231 is determined to be legitimate.

[0191] S1004: Router 221 sends the encrypted identifier set to the security network element 231 after encrypting multiple first local identifiers based on the private key dictionary.

[0192] The first local identifiers include the first local identifier fc000:1:1, the first local identifier fc00:1::2, and the first local identifier end.dx.

[0193] S1005: Security element 231 decrypts the elements of the encrypted identifier set based on its private key 1 corresponding to its first local identifier fc000:1:1, obtains the decrypted elements, and determines that the decrypted elements are the same as its corresponding first local identifier fc000:1:1, and then determines that router 221 is legitimate.

[0194] It should be noted that if router 22n is determined to be invalid, security element 23n will generate an alarm and respond; if security element 23n is determined to be invalid, router 22n will generate an alarm and respond.

[0195] Based on the same technical concept, this application also provides a router. The principle of this router in solving the technical problem is similar to that of the above-mentioned data transmission method in solving the technical problem. The implementation of the router can refer to the implementation of the above-mentioned data transmission method, and the repeated parts will not be described again.

[0196] like Figure 11 The diagram shown is a structural schematic of a router provided in an embodiment of this application. The router includes:

[0197] The encryption module 111 is used to select a target traffic redirection strategy from multiple traffic redirection strategies based on the user traffic sent by the switch, and encrypt the second local identifier carried in the target traffic redirection strategy based on the public key in the public key dictionary to generate a first identifier encryption set.

[0198] The generation module 112 is used to generate a target message based on the user traffic and the header, wherein the header is obtained based on the first identifier encryption set;

[0199] The decryption module 113 is used to decrypt the first element in the first identifier encryption set in the header of the target message based on the private key dictionary, match the decrypted local identifier with the plurality of first local identifiers, select the first target security network element according to the matching result, and send the user traffic to the first target security network element.

[0200] The private key dictionary, the public key dictionary, the plurality of first local identifiers, and the plurality of traffic redirection strategies are sent by the management module. The private key dictionary includes the correspondence between the first local identifier and the first private key corresponding to the router, and the public key dictionary includes the correspondence between the first local identifier and the public key corresponding to the router group.

[0201] In one embodiment, the encryption module 111 is further configured to:

[0202] For each second local identifier, select the target public key corresponding to the second local identifier;

[0203] Based on the target public key, the second local identifier and the 5-tuple information are encrypted to obtain the encrypted local identifier, wherein the 5-tuple information is the 5-tuple information of the user traffic;

[0204] The obtained encrypted local identifier is used as the first identifier encryption set.

[0205] In one embodiment, the decryption module 113 is further configured to:

[0206] Traverse the plurality of first local identifiers to find a target first local identifier that is the same as the decrypted local identifier;

[0207] The security network element corresponding to the first local identifier of the target is taken as the first target security network element.

[0208] In one embodiment, the router further includes a comparison module 114, such as... Figure 12 The diagram shown is a schematic representation of a router structure provided in an embodiment of this application. The comparison module 114 is further used for:

[0209] Compare the target quintuple information with the user traffic quintuple information;

[0210] The comparison results are confirmed to be the same;

[0211] The target quintuple information is obtained by decrypting the first identifier encryption set.

[0212] In one embodiment, the encryption module 111 is further configured to:

[0213] If no target traffic redirection strategy is selected from the multiple traffic redirection strategies, the user traffic is sent to the switch so that the switch can send the user traffic to other routers in the router group.

[0214] In one embodiment, the decryption module 113 is further used for

[0215] Based on the private key dictionary, the encrypted set of the first identifier in the header of the target packet is decrypted. If decryption fails, the target packet is sent to the switch, so that the switch sends the target packet to other routers in the router group. The other routers, based on their corresponding private key dictionaries, decrypt the encrypted set of the first identifier in the header of the target packet, match the decrypted local identifier with multiple first local identifiers corresponding to the other routers, select a first target security network element based on the matching result, and send the user traffic to the first target security network element.

[0216] In one embodiment, the decryption module 113 is further configured to:

[0217] Receive processed user traffic sent by the first target security network element;

[0218] Based on the private key dictionary, the second element in the first identifier encryption set in the header of the target message is decrypted;

[0219] The decrypted local identifier is matched with the plurality of first local identifiers. Based on the matching result, a second target security network element is selected, and the processed user traffic is sent to the second target security network element until the last element in the first identifier encryption set is reached.

[0220] In one embodiment, the decryption module 113 is further configured to:

[0221] After determining that the first target security network element is faulty, determine the first local identifier corresponding to the third target security network element in the target security network element group;

[0222] Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element;

[0223] The user traffic is sent to the third target security network element corresponding to the modified first local identifier.

[0224] In one embodiment, the encryption module 111 is further configured to:

[0225] Receive the first temporary public key sent by the management module;

[0226] Based on the first temporary public key, the plurality of first local identifiers are encrypted to obtain a second identifier encryption set. The second identifier encryption set is sent to the management module so that after receiving the second identifier encryption set, the management module decrypts the elements in the second identifier encryption set based on the first temporary private key corresponding to the first temporary public key to obtain a plurality of decrypted local identifiers. Based on the plurality of decrypted local identifiers, the router is confirmed to be a legitimate router. The elements in the encryption set are then decrypted.

[0227] In one embodiment, the router is further configured to:

[0228] The generation module 112 sends a public key corresponding to the first local identifier to the security network element corresponding to the plurality of first local identifiers, so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier;

[0229] After receiving the encrypted identifier sent by the security network element, the decryption module 113 decrypts the encrypted identifier based on the private key corresponding to the first local identifier. If the decryption is successful, the security network element is determined to be legitimate.

[0230] Based on the same technical concept, this application also provides a router. The principle of this router in solving the technical problem is similar to that of the above-mentioned data transmission method in solving the technical problem. The implementation of the router can refer to the implementation of the above-mentioned data transmission method, and the repeated parts will not be described again.

[0231] like Figure 13 The diagram shown is a schematic representation of a router provided in an embodiment of this application. The router includes a processor 132 and a memory 131 that is communicatively connected to the processor.

[0232] Memory 131 stores computer-executed instructions;

[0233] Processor 132 executes computer execution instructions stored in memory 131 to perform the following steps:

[0234] Based on the user traffic sent by the switch, a target traffic redirection strategy is selected from multiple traffic redirection strategies, and based on the public key in the public key dictionary, the second local identifier carried in the target traffic redirection strategy is encrypted to generate a first identifier encryption set.

[0235] Based on the user traffic and header, a target message is generated, wherein the header is obtained based on the first identifier encryption set;

[0236] Based on the private key dictionary, the first element in the first identifier encryption set in the header of the target message is decrypted, the decrypted local identifier is matched with the plurality of first local identifiers, the first target security network element is selected according to the matching result, and the user traffic is sent to the first target security network element;

[0237] The private key dictionary, the public key dictionary, the plurality of first local identifiers, and the plurality of traffic redirection strategies are sent by the management module. The private key dictionary includes the correspondence between the first local identifier and the first private key corresponding to the router, and the public key dictionary includes the correspondence between the first local identifier and the public key corresponding to the router group.

[0238] In one embodiment, processor 132 is specifically used for:

[0239] For each second local identifier, select the target public key corresponding to the second local identifier;

[0240] Based on the target public key, the second local identifier and the 5-tuple information are encrypted to obtain the encrypted local identifier, wherein the 5-tuple information is the 5-tuple information of the user traffic;

[0241] The obtained encrypted local identifier is used as the first identifier encryption set.

[0242] In one embodiment, the processor 132 is further configured to:

[0243] Traverse the plurality of first local identifiers to find a target first local identifier that is the same as the decrypted local identifier;

[0244] The security network element corresponding to the first local identifier of the target is taken as the first target security network element.

[0245] Compare the target quintuple information with the user traffic quintuple information;

[0246] The comparison results are confirmed to be the same;

[0247] The target quintuple information is obtained by decrypting the first identifier encryption set.

[0248] In one embodiment, the processor 132 is further configured to:

[0249] If no target traffic redirection strategy is selected from the multiple traffic redirection strategies, the user traffic is sent to the switch so that the switch can send the user traffic to other routers in the router group.

[0250] In one embodiment, the processor 132 is further configured to:

[0251] Based on the private key dictionary, the encrypted set of the first identifier in the header of the target packet is decrypted. If decryption fails, the target packet is sent to the switch, so that the switch sends the target packet to other routers in the router group. The other routers, based on their corresponding private key dictionaries, decrypt the encrypted set of the first identifier in the header of the target packet, match the decrypted local identifier with multiple first local identifiers corresponding to the other routers, select a first target security network element based on the matching result, and send the user traffic to the first target security network element.

[0252] In one embodiment, the processor 132 is further configured to:

[0253] Receive processed user traffic sent by the first target security network element;

[0254] Based on the private key dictionary, the second element in the first identifier encryption set in the header of the target message is decrypted;

[0255] The decrypted local identifier is matched with the plurality of first local identifiers. Based on the matching result, a second target security network element is selected, and the processed user traffic is sent to the second target security network element until the last element in the first identifier encryption set is reached.

[0256] In one embodiment, the processor 132 is further configured to:

[0257] After determining that the first target security network element is faulty, determine the first local identifier corresponding to the third target security network element in the target security network element group;

[0258] Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element;

[0259] The user traffic is sent to the third target security network element corresponding to the modified first local identifier.

[0260] In one embodiment, the processor 132 is further configured to:

[0261] Receive the first temporary public key sent by the management module;

[0262] Based on the first temporary public key, the plurality of first local identifiers are encrypted to obtain a second identifier encryption set. The second identifier encryption set is sent to the management module so that after receiving the second identifier encryption set, the management module decrypts the elements in the second identifier encryption set based on the first temporary private key corresponding to the first temporary public key to obtain a plurality of decrypted local identifiers. Based on the plurality of decrypted local identifiers, the router is confirmed to be a legitimate router. The elements in the encryption set are then decrypted.

[0263] In one embodiment, the processor 132 is further configured to:

[0264] For each of the multiple first local identifiers corresponding to a security network element, a public key corresponding to the first local identifier is sent to the security network element so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier.

[0265] After receiving the encrypted identifier sent by the security network element, the encrypted identifier is decrypted based on the private key corresponding to the first local identifier. If the decryption is successful, the security network element is determined to be legitimate.

[0266] This application provides a data transmission method and a router. The method is applied to a router in a router group within a service chain. First, it receives a private key dictionary, a public key dictionary, multiple first local identifiers, and multiple traffic redirection policies sent by a management module. Based on user traffic sent by the switch, a target traffic redirection policy is selected from the multiple policies. Then, based on the public key in the public key dictionary, a second local identifier in the target traffic redirection policy is encrypted to generate a first identifier encryption set. Next, a target packet is generated based on the user traffic and a header, where the header is obtained based on the first identifier encryption set. Finally, based on the private key dictionary, the first element in the first identifier encryption set in the header of the target packet is decrypted. The decrypted local identifier is matched with multiple first local identifiers. Based on the matching result, a first target security network element is selected, and user traffic is sent to the first target security network element. Because the encrypted target traffic redirection policy is written into the user traffic and decrypted internally by the router, the transmission path is kept confidential, improving the security of the service chain.

[0267] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, this application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0268] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to this application. It should be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0269] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0270] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0271] Obviously, those skilled in the art can make various modifications and variations to this application without departing from the spirit and scope of this application. Therefore, if such modifications and variations fall within the scope of the claims of this application and their equivalents, this application also intends to include such modifications and variations.

Claims

1. A data transmission method, characterized in that, The method, applied to routers in a router group within a service chain, includes: Based on the user traffic sent by the switch, a target traffic redirection strategy is selected from multiple traffic redirection strategies. For each second local identifier carried by the target traffic redirection strategy, a target public key corresponding to the second local identifier is selected based on the public key in the public key dictionary. Based on the target public key, the second local identifier and the 5-tuple information are encrypted to obtain the encrypted local identifier. The 5-tuple information is the 5-tuple information of the user traffic. The obtained encrypted local identifier is used as the first identifier encryption set. Based on the user traffic and header, a target message is generated, wherein the header is obtained based on the first identifier encryption set; Based on the private key dictionary, the first element in the encryption set of the first identifier in the header of the target message is decrypted, the decrypted local identifier is matched with multiple first local identifiers, the first target security network element is selected according to the matching result, and the user traffic is sent to the first target security network element. The private key dictionary, the public key dictionary, the plurality of first local identifiers, and the plurality of traffic redirection strategies are sent by the management module. The private key dictionary includes the correspondence between the first local identifier and the first private key corresponding to the router, and the public key dictionary includes the correspondence between the first local identifier and the public key corresponding to the router group.

2. The method as described in claim 1, characterized in that, The step of matching the decrypted local identifier with multiple first local identifiers and selecting the first target security network element based on the matching results includes: Traverse the plurality of first local identifiers to find a target first local identifier that is the same as the decrypted local identifier; The security network element corresponding to the first local identifier of the target is taken as the first target security network element.

3. The method as described in claim 2, characterized in that, After finding the target first local identifier that is the same as the decrypted local identifier, and before using the security network element corresponding to the target first local identifier as the first target security network element, the method further includes: Compare the target quintuple information with the user traffic quintuple information; The comparison results are confirmed to be the same; The target quintuple information is obtained by decrypting the first identifier encryption set.

4. The method as described in claim 1, characterized in that, The method also includes: If no target traffic redirection strategy is selected from the multiple traffic redirection strategies, the user traffic is sent to the switch so that the switch can send the user traffic to other routers in the router group.

5. The method as described in claim 1, characterized in that, The method also includes: Based on the private key dictionary, the encrypted set of the first identifier in the header of the target packet is decrypted. If decryption fails, the target packet is sent to the switch, so that the switch sends the target packet to other routers in the router group. The other routers, based on their corresponding private key dictionaries, decrypt the encrypted set of the first identifier in the header of the target packet, match the decrypted local identifier with multiple first local identifiers corresponding to the other routers, select a first target security network element based on the matching result, and send the user traffic to the first target security network element.

6. The method as described in claim 1, characterized in that, After sending the user traffic to the first target security network element, the method further includes: Receive processed user traffic sent by the first target security network element; Based on the private key dictionary, the second element in the first identifier encryption set in the header of the target message is decrypted; The decrypted local identifier is matched with the plurality of first local identifiers. Based on the matching result, a second target security network element is selected, and the processed user traffic is sent to the second target security network element until the last element in the first identifier encryption set is reached.

7. The method as described in claim 1, characterized in that, After selecting the first target security network element based on the matching result, the process further includes: After determining that the first target security network element is faulty, determine the first local identifier corresponding to the third target security network element in the target security network element group; Modify the decrypted local identifier to the first local identifier corresponding to the third target security network element; The user traffic is sent to the third target security network element corresponding to the modified first local identifier.

8. The method according to any one of claims 1 to 7, characterized in that, The method further includes: Receive the first temporary public key sent by the management module; Based on the first temporary public key, the plurality of first local identifiers are encrypted to obtain a second identifier encryption set. The second identifier encryption set is sent to the management module so that after receiving the second identifier encryption set, the management module decrypts the elements in the second identifier encryption set based on the first temporary private key corresponding to the first temporary public key to obtain a plurality of decrypted local identifiers. Based on the plurality of decrypted local identifiers, the router is confirmed to be a legitimate router. The elements in the encryption set are then decrypted.

9. The method as described in claim 8, characterized in that, The method further includes: For each of the multiple first local identifiers corresponding to a security network element, a public key corresponding to the first local identifier is sent to the security network element so that the security network element encrypts the first local identifier of the security network element based on the public key to obtain an encrypted identifier. After receiving the encrypted identifier sent by the security network element, the encrypted identifier is decrypted based on the private key corresponding to the first local identifier. If the decryption is successful, the security network element is determined to be legitimate.

10. A router, characterized in that, The router is used in a router group within a service chain, including: An encryption module is used to select a target traffic redirection strategy from multiple traffic redirection strategies based on user traffic sent by the switch, and for each second local identifier carried by the target traffic redirection strategy, select a target public key corresponding to the second local identifier based on the public key in the public key dictionary, and encrypt the second local identifier and the 5-tuple information based on the target public key to obtain an encrypted local identifier, wherein the 5-tuple information is the 5-tuple information of the user traffic, and use the obtained encrypted local identifier as the first identifier encryption set; A generation module is configured to generate a target message based on the user traffic and the header, wherein the header is obtained based on the first identifier encryption set; The decryption module is used to decrypt the first element in the encryption set of the first identifier in the header of the target message based on the private key dictionary, match the decrypted local identifier with multiple first local identifiers, select the first target security network element according to the matching result, and send the user traffic to the first target security network element. The private key dictionary, the public key dictionary, the plurality of first local identifiers, and the plurality of traffic redirection strategies are sent by the management module. The private key dictionary includes the correspondence between the first local identifier and the first private key corresponding to the router, and the public key dictionary includes the correspondence between the first local identifier and the public key corresponding to the router group.

11. A router, characterized in that, include: A processor, and a memory communicatively connected to the processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory to implement the method as described in any one of claims 1 to 9.

Images