Message transmission method, chip, network system and electronic equipment

Abstract

The invention provides a message transmission method, a chip, a network system and electronic equipment, and relates to the technical field of communication. The method comprises the following steps: first network equipment receives an MACSec protocol sent by second network equipment through a first port, wherein the second network equipment is network equipment which establishes physical connection with the first network equipment; if it is determined that the first port is not configured with the MACSec protocol, the port state of the first port is configured to be a block state; in response to a request for sending a message through the first port, if it is determined that the message is an MACSec protocol message, the message is sent to the second network device through the first port, and the MACSec protocol message refers to a message conforming to an MACSec protocol but not containing an MACSec security label. According to the embodiment of the invention, the first port which is not configured with the MACSec protocol is configured to be in the block state, so that the forwarding of the service message can be effectively prevented under the condition that the MACSec protocol message can be effectively transmitted, and the loss of the service message can be improved.

Description

Technical Field

[0001] The present disclosure belongs to the field of communication technology, and specifically relates to a message transmission method, a chip, a network system and an electronic device. Background Art

[0002] In a message transmission network with high security requirements, by sending security configurations to each network device, each network device configures its local port to transmit messages according to the standards of the security protocol, thereby meeting the security transmission requirements for messages.

[0003] Taking the Media Access Control Security (MACSec) protocol as an example, in the stage of sending the MACSec protocol configuration to each network device, some network devices may fail to send it, which will cause one end of a transmission link to be configured with the MACSec protocol and send and receive messages according to the MACSec protocol standard, while the other end is not configured with the MACSec protocol. Among the messages sent by the port not configured with the MACSec protocol to the port configured with the MACSec protocol, the messages that do not meet the MACSec protocol standard will be discarded, resulting in a large number of message losses. Summary of the invention

[0004] The present disclosure provides a message transmission method, a chip, a network system and an electronic device, which can solve the problem of message loss when the MACSec protocol is configured on a single end of a transmission link.

[0005] A first aspect of the present disclosure provides a message transmission method, which is applied to a first network device. The method includes:

[0006] Receiving, through the first port, a media access control security MACSec protocol sent by a second network device, where the second network device is a network device that establishes a physical connection with the first network device;

[0007] If it is determined that the first port is not configured with the MACSec protocol, configuring the port state of the first port to a blocking state;

[0008] In response to a request to send a message through the first port, if it is determined that the message is a MACSec protocol message, the message is sent to the second network device through the first port, and the MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag.

[0009] In the embodiment of the present disclosure, it also includes:

[0010] If the message is a business message, the process of sending the message is terminated.

[0011] In the embodiment of the present disclosure, after receiving the MACSec protocol sent by the second network device through the first port, the method further includes:

[0012] Reading configuration information of the first port from a configuration information library;

[0013] If the configuration information does not include the MACSec enabling flag, or the configuration information includes the MACSec enabling flag but the state of the MACSec enabling flag is disabled, it is determined that the first port is not configured with the MACSec protocol.

[0014] In the embodiment of the present disclosure, before sending the message to the second network device through the first port, the method further includes:

[0015] Parsing the message to obtain a message type value of the message;

[0016] If the message type value is a MACSec value, determining that the message is a MACSec protocol message;

[0017] If the message type value is not a MACSec value, it is determined that the message is a service message.

[0018] In the embodiment of the present disclosure, it also includes:

[0019] Receiving a MACSec protocol message sent by the second network device through the first port;

[0020] Forward the MACSec protocol message sent by the second network device.

[0021] An embodiment of a second aspect of the present disclosure provides a message transmission method, which is applied to a second network device, and the method includes:

[0022] In response to receiving the MACSec protocol configuration instruction, configuring the second port to enable the MACSec protocol, wherein the first network device is a network device that establishes a physical connection with the second network device;

[0023] Sending the MACSec protocol to the first port of the first network device based on the second port, so that the first network device configures the port state of the first port to a blocking state when determining that the first port is not configured with the MACSec protocol;

[0024] In response to a request to send a message through the second port, a MACSec protocol message is sent to the first port through the second port, where the MACSec protocol message refers to a message that complies with the MACSec protocol but does not include a MACSec security tag.

[0025] An embodiment of the third aspect of the present disclosure provides a chip, which is applied to a first network device. The chip includes a processor and an interface, the interface is coupled to the processor, the interface is used to communicate with the first port, and the processor is used to execute a computer program or instruction to implement the method described in the first aspect above.

[0026] An embodiment of the fourth aspect of the present disclosure provides a chip, which is applied to a second network device. The chip includes a processor and an interface, the interface is coupled to the processor, the interface is used to communicate with the second port, and the processor is used to execute a computer program or instruction to implement the method described in the second aspect above.

[0027] An embodiment of a fifth aspect of the present disclosure provides a network system, the network system comprising a first network device and a second network device, the first network device comprising a first port, the second network device comprising a second port, the first port being connected to the second port,

[0028] The second network device is used to configure the second port to enable the MACSec protocol after receiving the MACSec protocol configuration instruction, and is also used to send the MACSec protocol to the first port based on the second port;

[0029] The first network device is used to configure the port state of the first port to a blocking state when it is determined that the MACSec protocol is not configured on the first port; and is also used to respond to a request to send a message through the first port, and if it is determined that the message is a MACSec protocol message, send the message to the second network device through the first port, where the MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag.

[0030] The second network device is further configured to send a MACSec protocol message to the first port through the second port in response to a request to send a message through the second port.

[0031] An embodiment of a sixth aspect of the present disclosure provides a message transmission device, which is applied to a first network device, and the device includes:

[0032] A receiving module, configured to receive a media access control security MACSec protocol sent by a second network device through a first port, wherein the second network device is a network device that establishes a physical connection with the first network device;

[0033] A configuration module, configured to configure the port state of the first port to a blocking state if it is determined that the first port is not configured with the MACSec protocol;

[0034] A sending module is used to respond to a request to send a message through the first port. If it is determined that the message is a MACSec protocol message, the message is sent to the second network device through the first port. The MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag.

[0035] An embodiment of a seventh aspect of the present disclosure provides a message transmission device, which is applied to a second network device, and the device includes:

[0036] A configuration module, configured to configure the second port to enable the MACSec protocol in response to receiving a MACSec protocol configuration instruction, wherein the first network device is a network device that establishes a physical connection with the second network device;

[0037] A sending module, used to send the MACSec protocol to the first port of the first network device based on the second port, so that the first network device configures the port state of the first port to a blocking state when it is determined that the first port is not configured with the MACSec protocol; and is also used to respond to a request to send a message through the second port, send a MACSec protocol message to the first port through the second port, wherein the MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag.

[0038] An embodiment of an eighth aspect of the present disclosure provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method described in the first aspect or the second aspect above.

[0039] An embodiment of a ninth aspect of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, wherein the program is executed by a processor to implement the method described in the first aspect or the second aspect above.

[0040] The technical solution provided in the embodiments of the present disclosure has at least the following technical effects or advantages:

[0041] In the embodiment of the present disclosure, if the first port of the first network device is not configured with the MACSec protocol, and the second port of the second network device connected to the first port is configured with the MACSec protocol, then the first network device can receive the MACSec protocol from the second network device through the first port, and then configure the port state of the first port to a block state. Then, in response to a request to send a message through the first port, and the message is a MACSec protocol message, the first network device can send the MACSec protocol message to the second network device through the first port. In the embodiment of the present disclosure, the MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag. It can be seen that, by adopting the technical solution of the embodiment of the present disclosure, although the first port is not configured with the MACSec protocol, since in the block state, the port will not forward any service message, but can only forward the MACSec protocol message, then, by configuring the first port that is not configured with the MACSec protocol to a block state, it is possible to effectively prevent the forwarding of service messages while ensuring that the MACSec protocol message can be effectively transmitted, thereby helping to improve the situation of service message loss.

[0042] Additional aspects and advantages of the present disclosure will be given in part in the following description and in part will become apparent from the following description or be learned through practice of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0043] By reading the detailed description of the preferred embodiment below, various other advantages and benefits will become clear to those of ordinary skill in the art. The accompanying drawings are only used for the purpose of illustrating the preferred embodiment and are not considered to be limitations of the present disclosure. In addition, the same reference symbols are used to represent the same components throughout the accompanying drawings.

[0044] In the attached picture:

[0045] Figure 1 A signaling interaction diagram of a typical message transmission method in a unilaterally configured MACSec protocol scenario is shown;

[0046] Figure 2 A schematic diagram showing the structure of a network system provided by an embodiment of the present disclosure is shown;

[0047] Figure 3A A schematic diagram of a method flow of a message transmission method provided by an embodiment of the present disclosure is shown;

[0048] Figure 3B A schematic diagram of a method flow of a message transmission method provided by another embodiment of the present disclosure is shown;

[0049] Figure 4A schematic diagram showing the structure of a chip provided by an embodiment of the present disclosure is shown;

[0050] Figure 5A A schematic diagram showing the structure of a message transmission device provided by an embodiment of the present disclosure is shown;

[0051] Figure 5B A schematic diagram showing the structure of a message transmission device provided by another embodiment of the present disclosure is shown;

[0052] Figure 6 A schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure is shown;

[0053] Figure 7 A schematic diagram of a storage medium provided by an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0054] The exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although the exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. On the contrary, these embodiments are provided in order to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0055] It should be noted that, unless otherwise specified, the technical terms or scientific terms used in the present disclosure should have the common meanings understood by those skilled in the art to which the present disclosure belongs.

[0056] The following is an introduction to the implementation scenarios and related technologies involved in the embodiments of the present disclosure.

[0057] The technical solution disclosed in the present invention relates to the IEEE 802.1AE secure communication standard. In business scenarios with high security requirements, such as business scenarios for transmitting user privacy data and financial business scenarios, configuration instructions can be issued to each network device in the corresponding message transmission network, so that each network device configures the MACSec protocol for the port, thereby enabling each network device to securely transmit messages based on the MACSec protocol.

[0058] MACSec defines a local area network data security communication method based on the IEEE 802.1AE standard. Between two ports configured with the MACSec protocol, before transmitting service messages, the corresponding network devices usually use the MACSec Key Agreement (MKA) protocol to negotiate and generate a key. Then, the sending network device generates a security tag based on the generated key, and encapsulates the security tag with the message as a MACSec header, and sends the encapsulated data frame to the opposite network device, so that after receiving the data frame, the opposite network device verifies the security and integrity of the message based on the security tag in the MACSec header and the negotiated key.

[0059] In some message transmission networks, the server sends configuration instructions to each network device in batches. However, due to many factors such as high bandwidth occupancy and high utilization of network device processors, the configuration instructions to some network devices may fail to be sent, resulting in a situation where the MACSec protocol is configured on one side of a transmission link. For example, refer to Figure 1 In the illustrated scenario, port 1 (port number 4 / 0 / 1) of network device A has been configured with MACSec protocol and can enable the MacSec function. Port 2 (port number 1 / 0 / 49) of network device B has not been configured with MACSec protocol and cannot enable the MacSec function. In order to support only the transmission of secure messages that comply with the MACSec protocol, the Line protocol of port 1 enters the inactive (DOWN) state, and the Line protocol of port 2 enters the active (UP) state. Network device B can forward service messages to port 1 of network device A through port 2, but the Line protocol of port 1 is in the DOWN state, so it does not process the received service messages but directly discards them, which results in the loss of a large number of service messages. In addition, facing the large number of network devices included in the message transmission network, it is also difficult to troubleshoot the situation where the MACSec protocol is configured on one side, which further increases the amount of service message loss.

[0060] In view of this, the technical solution proposed in the embodiment of the present disclosure configures the port state of the port that is not configured with the MACSec protocol to a block state by sending the MACSec protocol at the other end of the port that is configured with the MACSec protocol. Since in the block state, the port will not forward any service messages, but can only forward MACSec protocol messages, then, by configuring the port that is not configured with the MACSec protocol to a block state, it is possible to effectively prevent the forwarding of service messages while ensuring that the MACSec protocol messages can be effectively transmitted, thereby helping to improve the situation of service message loss.

[0061] The following describes a message transmission method, a network system, a chip, a device, an electronic device, and a storage medium according to an embodiment of the present disclosure. The technical solution of the present disclosure is described in detail with specific embodiments. The following specific embodiments can be combined with each other, and the same or similar concepts or processes may not be repeated in some embodiments. The embodiments of the present disclosure will be described below in conjunction with the accompanying drawings.

[0062] See also Figure 2 , Figure 2 The schematic diagram of the structure of a network system provided by an embodiment of the present disclosure is shown, and the network system may include a server 1000 and a device cluster 2000. The server 1000 is communicatively connected with each network device in the device cluster 2000. A communication link may be established between each network device in the device cluster 2000 through a physical port, and a message may be transmitted through the communication link. The communication link may be a physical link.

[0063] The server 1000 may be an independent physical server, or a server cluster, a distributed system or a cloud platform composed of multiple physical servers. The server 1000 may be configured to perform information processing, network management, resource configuration, etc. Information processing may include, for example, storing basic information, port information, configuration information, etc. of each network device in the device cluster 2000, and analyzing the port information and configuration information of each network device; the server 1000 may manage the network connection status of the device cluster 2000 and the network transmission protocol according to business needs, for example, providing Dynamic Host Configuration Protocol (DHCP) service, providing File Transfer Protocol (FTP) service, providing MACSec protocol service, etc. In some embodiments, the server 1000 may provide MACSec protocol service for the device cluster 2000. For example, configuration instructions may be sent to the device cluster 2000 in batches to configure local ports of each network device in the device cluster 2000 so that the local ports can enable the MACSec protocol.

[0064] Any network device in the device cluster 2000 can be a message forwarding device such as a switch, a router, a gateway, a network interface card (NIC), a firewall device, a virtual private network device, a modem, etc. Any network device can be set with at least one physical port, and any two network devices can establish a physical link through their respective physical ports, and forward messages through the physical link. Any network device can configure the state of the port by configuring the communication protocol, so that the local port in the corresponding state can process and transmit messages according to the standard of the corresponding communication protocol. For example, if the port of the network device enables the MACSec protocol (i.e., the MACSec protocol has been configured), then the port state of the port is a blocking state, and the line protocol is DOWN, so that the network device can only transmit messages that comply with the MACSec protocol through the port; for another example, if the port of the network device does not enable the MACSec protocol (i.e., the MACSec protocol is not configured), then the port state of the port is a forwarding state, and the line protocol is UP, so that the network device can transmit various types of messages through the port.

[0065] It should be noted that any network device may include a built-in chip, which is used to configure the status of the port, maintain the policy and conditions for the port to transmit messages in different states, and call the port to transmit messages that meet the corresponding conditions according to the policy. In some embodiments, the chip can also be used to configure the MACSec protocol for the local port and then send the MACSec protocol to the peer network device through the port. In other embodiments, the chip can also be used to monitor the dynamics of at least one local port. If it is monitored that any port receives the MACSec protocol, the chip can detect the port status of the corresponding port, and if the corresponding port is not configured with the MACSec protocol, the port status of the port can be configured to a block state.

[0066] The message transmission method of the embodiment of the present disclosure is described below using a network device as an example.

[0067] See also Figure 3A , Figure 3A An exemplary message transmission method provided by the present disclosure is shown, and the method is applied to a first network device, and the first network device can be any network device in the above-mentioned device cluster 2000. In this embodiment, the first network device is, for example, a network device that is not configured with the MACSec protocol. The method includes:

[0068] In step S11, a MACSec protocol sent by a second network device is received through a first port.

[0069] The first port is a physical port of the first network device, and the first port should be configured with the MACSec protocol. The second network device is a network device that establishes a physical connection with the first network device.

[0070] The second network device is any network device other than the first network device in the device cluster 2000, and is physically connected to the first network device through the first port. The second network device is physically connected to the first port, for example, through a local second port. The MACSec protocol can be sent to the first port after the second network device enables the MACSec protocol on the second port.

[0071] In some embodiments, after the first network device starts running, the chip in the first network device can monitor the running status of each port of the first network device and the information sending and receiving of each port through a process. In the case of monitoring that the first port receives information, the chip can determine that the received information is a MACSec protocol. Further, when the chip calls the process to monitor each port, the monitoring of the first port can be skipped.

[0072] In step S12, if it is determined that the first port is not configured with the MACSec protocol, the port state of the first port is configured as a block state.

[0073] After receiving the MACSec protocol through the first port, the chip can detect whether the first port is configured with the MACSec protocol. If it is determined that the first port is not configured with the MACSec protocol, the port state of the first port is configured as a block state.

[0074] In some embodiments, the configuration information of each port may be stored in the configuration information library of the first network device, and the configuration information may include a flag indicating whether the MACSec protocol is enabled. After receiving the MACSec protocol through the first port, the chip may read the configuration information of the first port from the configuration information library. If the configuration information of the first port does not include a MACSec enable flag, or the configuration information of the first port includes the MACSec enable flag but the state of the MACSec enable flag is disabled, it can be determined that the first port is not configured with the MACSec protocol. Optionally, if the configuration information of the first port includes the MACSec enable flag and the state of the MACSec enable flag is enabled, it can be determined that the first port is configured with the MACSec protocol.

[0075] It should be understood that the above method of detecting whether the first port is configured with the MACSec protocol is only a schematic description and does not limit the embodiments of the present disclosure. In an actual implementation scenario, the chip can also determine whether the first port is configured with the MACSec protocol by detecting whether the first port is set with MACSec related keys and parameters, MKA parameters, etc. The embodiments of the present disclosure do not limit this.

[0076] It should be noted that, when the MACSec protocol is not enabled, the port state of the first port can be a forward state. In the forward state, the first port is configured to allow various types of messages such as service messages and protocol messages to pass through, that is, various types of messages can enter the first port and be forwarded from the first port. If it is determined that the first port is not configured with the MACSec protocol, the chip configures the port state of the first port from a forward state to a block state. Exemplarily, the chip can change the configuration information such as the port state and configuration parameters of the first port in the configuration information library to configure the port state of the first port to a block state.

[0077] It can be seen that, with this implementation, although the first network device cannot enable the MACSec protocol for the first port, by configuring the port state of the first port to be a block state, the forwarding of service messages can be effectively prevented, thereby helping to improve the situation of service message loss.

[0078] In step S13, in response to the request to send a message through the first port, if it is determined that the message is a MACSec protocol message, the message is sent to the second network device through the first port.

[0079] The MACSec protocol message refers to a message that complies with the MACSec protocol but does not include a MACSec security label.

[0080] It should be pointed out that the block state in the embodiment of the present disclosure can be a block in the MACSec mode, in which the first port can prevent the forwarding of messages that do not meet the MACSec security requirements, and only forward messages that meet the MACSec security requirements. Combined with the above description, the first network device only configures the port state of the first port to the block state, and does not configure the MACSec protocol. Based on this, the first port and the second network device cannot perform key negotiation, and further, cannot generate a MACSec security label. Accordingly, the first network device cannot forward a security message with a MACSec security label added through the first port. The security message may include, for example, an encrypted data frame, an Ethernet frame with a MACSec header, a MACSec encapsulated data packet, etc. However, the first network device can forward other messages that meet the MACSec protocol through the first port, such as MACSec control frames, MACSec activity detection messages, MACSec configuration messages, MACSec status messages, MACSec notification messages, and other MACSec protocol messages.

[0081] In some embodiments, in response to a request to send a message through the first port, before sending the message to the second network device through the first port, the chip in the first network device can detect the type of the message; if it is determined that the type of the message is a MACSec protocol message, the message is sent to the second network device through the first port; if the type of the message is a service message, the process of sending the message is terminated.

[0082] Exemplarily, the chip may parse the message to obtain a message type value of the message; if the message type value is a MACSec value, it is determined that the message is a MACSec protocol message; if the message type value is not a MACSec value, it is determined that the message is a service message.

[0083] The message type value may refer to, for example, an indication field after the source MAC and destination MAC of the message, which is used to indicate the Ethernet type (EtherType) or field length, and the length of the indication field may be 2 bytes. The value of the indication field may identify whether the message is a service message or a MACSec protocol message, for example, the MACSec value refers to the EtherType value of Macsec, such as 0x88E5.

[0084] In some other embodiments, the first port may also receive a MACSec protocol message sent by the second network device, and then the first network device may forward the MACSec protocol message sent by the second network device.

[0085] It can be seen that, by adopting the present implementation method, although the first port is not configured with the MACSec protocol, since in the block state, the port will not forward any business messages, but can only forward MACSec protocol messages. Therefore, by configuring the first port that is not configured with the MACSec protocol to the block state, it is possible to effectively prevent the forwarding of business messages while ensuring that the MACSec protocol messages can be effectively transmitted, thereby helping to improve the situation of business message loss.

[0086] Corresponding to the operation of the first network device, the embodiment of the present disclosure also provides another message transmission method for the second network device.

[0087] See also Figure 3B , Figure 3B A method flow diagram of a message transmission method provided by another embodiment of the present disclosure is shown. The second network device may be any network device in the above-mentioned device cluster 2000. In this embodiment, the second network device is, for example, a network device configured with a MACSec protocol. The method includes:

[0088] Step S21: in response to receiving the MACSec protocol configuration instruction, configure the second port to enable the MACSec protocol.

[0089] The MACSec protocol configuration instruction may be sent by a server, which may be implemented as Figure 2 The server 1000 in the embodiment. The second port is a physical port of the second network device.

[0090] Step S22: Send the MACSec protocol to the first port of the first network device based on the second port.

[0091] and Figure 3A Corresponding to the illustrated embodiment, the first network device is a device that establishes a physical connection with the second network device, and the first port of the first network device establishes a physical connection with the second network device through the second port.

[0092] In some embodiments, after configuring the second port to enable the MACSec protocol, the chip in the second network device can call the second port to send the MACSec protocol to the first port of the first network device, so that the first network device, when determining that the first port is not configured with the MACSec protocol, configures the port state of the first port to a block state, thereby preventing the first network device from forwarding service packets to the second network device, which is beneficial to improving the situation of service packet loss.

[0093] Step S23: In response to the request to send a message through the second port, send a MACSec protocol message to the first port through the second port.

[0094] The MACSec protocol message may be, as described in the above embodiment, a message that complies with the MACSec protocol but does not include a MACSec security tag.

[0095] like Figure 3A As described in the illustrated embodiment, since the port state of the first port is only in the block state and the MACSec protocol is not configured, based on this, the second network device cannot perform key negotiation with the first port, and if the second network device adds the MACSec security tag to the message, the first network device cannot parse the MACSec security tag after receiving the message. Accordingly, in response to the request to send a message through the second port, the chip in the second network device can control not to perform key negotiation with the first network device, and does not encrypt the MACSec protocol message, but directly forwards it to the first network device through the second port.

[0096] The above is an explanation of the operation between two network devices using the scenario where the first network device is not configured with the MACSec protocol as an example. In other embodiments, when the first network device is configured with the MACSec protocol, after the first network device receives the MACSec protocol sent by the second network device through the first port, it may not perform any processing on the first port, but may feed back to the server the message that both the first network device and the second network device have enabled the MACSec protocol. In addition, after the first network device is configured with the MACSec protocol, it may also send the MACSec protocol to the second network device through the first port.

[0097] In summary, in the embodiment of the present disclosure, if the first port of the first network device is not configured with the MACSec protocol, and the second port of the second network device connected to the first port is configured with the MACSec protocol, then the first network device can receive the MACSec protocol from the second network device through the first port, and then configure the port state of the first port to a block state. Then, in response to a request to send a message through the first port, and the message is a MACSec protocol message, the first network device can send the MACSec protocol message to the second network device through the first port. In the embodiment of the present disclosure, the MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag. It can be seen that by adopting the technical solution of the embodiment of the present disclosure, although the first port is not configured with the MACSec protocol, since in the block state, the port will not forward any service message, but can only forward the MACSec protocol message, then, by configuring the first port that is not configured with the MACSec protocol to a block state, it is possible to effectively prevent the forwarding of service messages while ensuring that the MACSec protocol message can be effectively transmitted, thereby helping to improve the situation of service message loss.

[0098] Corresponding to the message transmission method and each network device illustrated in the above embodiment, the embodiment of the present disclosure further provides a chip, which can be deployed in the network device, so that the network device is used to execute the above FIG. 3A to FIG. 3B The operation of the first network device or the second network device, such as Figure 4 As shown, the chip may include: a processor 401 and an interface 402, wherein the interface 402 is coupled to the processor 401, the interface 402 is used to communicate with a port of a corresponding network device, and the processor is used to execute computer programs or instructions to implement the functions of each network device in the embodiment of the present application.

[0099] Corresponding to the message transmission method illustrated in the above embodiment, the embodiments of the present disclosure also provide a message transmission device. Figure 5A As shown, a message transmission device is provided, which can be deployed in a first network device and is used to perform the above FIG. 3A to FIG. 3B The operations performed by the first network device of any embodiment are as follows: Figure 5A As shown, the message transmission device includes:

[0100] A receiving module 501, configured to receive a media access control security MACSec protocol sent by a second network device through a first port, where the second network device is a network device that establishes a physical connection with the first network device;

[0101] A configuration module 502 is configured to configure the port state of the first port to a blocking state if it is determined that the first port is not configured with the MACSec protocol;

[0102] The sending module 503 is used to respond to the request to send a message through the first port. If it is determined that the message is a MACSec protocol message, the message is sent to the second network device through the first port. The MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag.

[0103] Optionally, the message transmission device further includes a process termination module, which is used to terminate the process of sending the message if the message is a business message.

[0104] Optionally, the message transmission device also includes a reading module and a determination module; the reading module is used to read the MACSec configuration information of the first port from the configuration information library; the determination module is used to determine that the first port is not configured with the MACSec protocol if the configuration information does not include a MACSec enable flag, or the configuration information includes the MACSec enable flag but the state of the MACSec enable flag is disabled.

[0105] Optionally, the message transmission device also includes a parsing module, which is used to parse the message to obtain a message type value of the message; a determination module is also used to determine that the message is a MACSec protocol message if the message type value is a MACSec value; and if the message type value is not a MACSec value, determine that the message is a service message.

[0106] Optionally, the message transmission device further comprises a forwarding module. The receiving module 501 is further configured to receive a MACSec protocol message sent by the second network device through the first port; and the forwarding module is configured to forward the MACSec protocol message sent by the second network device.

[0107] The message transmission device provided in the above-mentioned embodiment of the present disclosure and the message transmission method provided in the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0108] Correspondingly, such as Figure 5B As shown, another message transmission device is also provided, which can be deployed in the second network device to perform the above FIG. 3A to FIG. 3B The operation performed by the second network device of any embodiment is as follows: Figure 5B As shown, the message transmission device includes:

[0109] A configuration module 511, configured to configure the second port to enable the MACSec protocol in response to receiving a MACSec protocol configuration instruction, wherein the first network device is a network device that establishes a physical connection with the second network device;

[0110] The sending module 512 is used to send the MACSec protocol to the first port of the first network device based on the second port, so that the first network device configures the port state of the first port to a blocking state when it is determined that the first port is not configured with the MACSec protocol; and is also used to respond to a request to send a message through the second port, send a MACSec protocol message to the first port through the second port, and the MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag.

[0111] The message transmission device provided in the above-mentioned embodiment of the present disclosure and the message transmission method provided in the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0112] The disclosed embodiment also provides an electronic device, which can be implemented as any of the above network devices to execute the above message transmission method. Figure 6 , which shows a schematic diagram of an electronic device provided by some embodiments of the present disclosure. Figure 6 As shown, the electronic device 6 includes: a processor 600, a memory 601, a bus 602 and a communication interface 603, and the processor 600, the communication interface 603 and the memory 601 are connected via the bus 602; the memory 601 stores a computer program that can be run on the processor 600, and the function of the processor 600 can execute the message transmission method provided in any of the aforementioned embodiments of the present disclosure when running the computer program.

[0113] The memory 601 may include a high-speed random access memory (RAM), and may also include a non-volatile memory, such as at least one disk storage. The communication connection between the virtual devices of the system is realized through at least one communication interface 603 (which may be wired or wireless), and the Internet, wide area network, local area network, metropolitan area network, etc. may be used.

[0114] The bus 602 may be an ISA bus, a PCI bus, or an EISA bus, etc. The bus may be divided into an address bus, a data bus, a control bus, etc. The memory 601 is used to store programs, and the processor 600 executes the programs after receiving execution instructions. The message transmission method disclosed in any implementation of the aforementioned embodiment of the present disclosure may be applied to the processor 600, or implemented by the processor 600.

[0115] The processor 600 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by the hardware integrated logic circuit in the processor 600 or the instruction in the form of software. The above processor 600 can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components. The methods, steps and logic block diagrams disclosed in the embodiments of the present disclosure can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor. The steps of the method disclosed in conjunction with the embodiments of the present disclosure can be directly embodied as a hardware decoding processor to be executed, or a combination of hardware and software modules in the decoding processor can be executed. The software module can be located in a mature storage medium in the field such as a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register, etc. The storage medium is located in the memory 601, and the processor 600 reads the content in the memory 601 and completes the steps of the above method in combination with its hardware.

[0116] The electronic device provided by the embodiment of the present disclosure and the message transmission method provided by the embodiment of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by them.

[0117] The present disclosure also provides a computer-readable storage medium corresponding to the message transmission method provided in the above embodiment. Figure 7 The computer-readable storage medium shown is a CD 30 on which a computer program (ie, a program product) is stored. When the computer program is run by a processor, the message transmission method provided by any of the aforementioned embodiments will be executed.

[0118] It should be noted that examples of the computer-readable storage medium may also include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other optical or magnetic storage media, which are not listed here one by one.

[0119] The computer-readable storage medium provided by the above-mentioned embodiments of the present disclosure and the message transmission method provided by the embodiments of the present disclosure are based on the same inventive concept and have the same beneficial effects as the methods adopted, run or implemented by the application programs stored therein.

[0120] Although the optional embodiments of the present disclosure have been described, those skilled in the art may make additional changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present disclosure.

[0121] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present disclosure. It should be understood that the above description is only the specific implementation method of the present disclosure and is not intended to limit the protection scope of the present disclosure. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present disclosure should be included in the protection scope of the present invention.

Claims

1. A message transmission method, characterized in that: Applied to a first network device, the method comprises: Receiving, through the first port, a media access control security MACSec protocol sent by a second network device, where the second network device is a network device that establishes a physical connection with the first network device; If it is determined that the first port is not configured with the MACSec protocol, configuring the port state of the first port to a blocking state; In response to a request to send a message through the first port, if it is determined that the message is a MACSec protocol message, the message is sent to the second network device through the first port, and the MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag.

2. The method according to claim 1, characterized in that Also includes: If the message is a business message, the process of sending the message is terminated.

3. The method according to claim 1, characterized in that After receiving the MACSec protocol sent by the second network device through the first port, the method further includes: Reading the MACSec configuration information of the first port from a configuration information base; If the configuration information does not include a MACSec enabling flag, or the configuration information includes the MACSec enabling flag but the state of the MACSec enabling flag is disabled, it is determined that the first port is not configured with a MACSec protocol.

4. The method according to claim 1 or 2, characterized in that: Before sending the message to the second network device through the first port, the method further includes: Parsing the message to obtain a message type value of the message; If the message type value is a MACSec value, determining that the message is a MACSec protocol message; If the message type value is not a MACSec value, it is determined that the message is a service message.

5. The method according to claim 1, characterized in that: Also includes: receiving a MACSec protocol message sent by the second network device through the first port; Forward the MACSec protocol message sent by the second network device.

6. A message transmission method, characterized in that: Applied to the second network device, the method comprises: In response to receiving the MACSec protocol configuration instruction, configuring the second port to enable the MACSec protocol; Sending the MACSec protocol to a first port of a first network device based on the second port, so that the first network device configures the port state of the first port to a blocking state when determining that the first port is not configured with the MACSec protocol, wherein the first network device is a network device that establishes a physical connection with the second network device; In response to a request to send a message through the second port, a MACSec protocol message is sent to the first port through the second port, where the MACSec protocol message refers to a message that complies with the MACSec protocol but does not include a MACSec security tag.

7. A message transmission device, characterized in that: Applied to a first network device, the apparatus comprises: A receiving module, configured to receive a media access control security MACSec protocol sent by a second network device through a first port, wherein the second network device is a network device that establishes a physical connection with the first network device; A configuration module, configured to configure the port state of the first port to a blocking state if it is determined that the first port is not configured with the MACSec protocol; A sending module is used to respond to a request to send a message through the first port. If it is determined that the message is a MACSec protocol message, the message is sent to the second network device through the first port. The MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag.

8. A chip, characterized in that: The chip is applied to a first network device, the chip includes a processor and an interface, the interface is coupled to the processor, the interface is used to communicate with the first port, and the processor is used to execute a computer program or instruction to implement the message transmission method described in any one of claims 1 to 6.

9. A network system, characterized in that: The network system includes a first network device and a second network device, the first network device includes a first port, the second network device includes a second port, the first port is connected to the second port, The second network device is used to configure the second port to enable the MACSec protocol after receiving the MACSec protocol configuration instruction, and is also used to send the MACSec protocol to the first port based on the second port; The first network device is used to configure the port state of the first port to a blocking state when it is determined that the MACSec protocol is not configured on the first port; and is also used to respond to a request to send a message through the first port, and if it is determined that the message is a MACSec protocol message, send the message to the second network device through the first port, where the MACSec protocol message refers to a message that complies with the MACSec protocol but does not contain a MACSec security tag. The second network device is further configured to send a MACSec protocol message to the first port through the second port in response to a request to send a message through the second port.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: The processor executes the computer program to implement the method according to any one of claims 1 to 6.

Images