Message processing method and device

Abstract

The invention discloses a message processing method and device, in the method, a first communication device receives a first protocol message used for controlling channel authentication from a second communication device, the first protocol message comprises a first CA identifier used for indicating a first CA, and the first communication device sends a first certificate issued by the first CA to the second communication device. Thus, in the process of establishing a control channel between communication devices, a requester sends a protocol message for authentication of the control channel to an opposite side and carries the CA identifier, so that the opposite side can know that the requester wants to request the certificate issued by the CA indicated by the CA identifier, and the certificate wanted to request by the requester is sent to the requester; the communication device can accurately obtain the certificates which can be verified by the communication device from the opposite end and complete certificate verification in a certificate mixed use scene, and preconditions are provided for successful establishment of a control channel.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a message processing method and device. Background Art

[0002] When establishing a control channel between communication devices, the communication devices need to verify each other's certificates. Only when the verification is successful can the control channel be established. In the process of verifying the other party's certificate, it is necessary to first obtain the certificate to be verified from the other party, and then verify the obtained certificate. In some scenarios, there may be multiple certificates issued by a certificate authority (CA) on a communication device in the control channel. The communication device cannot accurately determine the certificate that the other party wants to obtain and verify. If the communication device sends a certificate that the other party cannot verify to the other party, the other party cannot verify the received certificate, which will cause the control channel to fail to be established. Summary of the invention

[0003] Based on this, the present application provides a message processing method and device. In a scenario where there are multiple certificates issued by a CA on a communication device that needs to establish a control channel, the communication device can accurately send a certificate that can be verified by the other end of the control channel to the other end, ensuring that certificate authentication can be completed between the communication devices, making it possible to establish a control channel between the two.

[0004] In the first aspect, the present application provides a message processing method, which is applied to a first communication device. The method may, for example, include: the first communication device receives a first protocol message for control channel authentication from a second communication device, the first protocol message includes a first CA identifier for indicating a first CA, and the first communication device can send a first certificate issued by the first CA to the second communication device. In this way, in the process of establishing a control channel between communication devices, the requester carries the CA identifier in the protocol message for control channel authentication sent to the other party, so that the other party can know that the requester wants to request a certificate issued by the CA indicated by the CA identifier, thereby sending the certificate that the requester wants to request to the requester, overcoming the problem that in the certificate mixing scenario, it is impossible to know which CA issued the certificate used by the requester, and it is likely that a certificate that the requester cannot verify is sent to the requester, resulting in the failure of the certificate verification, thereby causing the control channel connection to fail to be established, so that the communication device in the certificate mixing scenario can accurately obtain the certificate that it can verify from the other end and complete the certificate verification, which provides a prerequisite for the successful establishment of the control channel.

[0005] In a possible implementation, the method may also include: the first communication device receives a second protocol message for control channel authentication from a third communication device, the second protocol message includes a second CA identifier, and the second CA identifier is used to indicate a second CA; the first communication device sends a second certificate issued by the second CA to the third communication device. It can be seen that the first communication device can implement the method provided in this application in the process of establishing different control channels with different communication devices, determine the certificate issued by the specific CA that each communication device needs to obtain, and accurately send the corresponding certificate to the other party, so as to ensure that the establishment of the control channel is not affected by the inability to accurately obtain a verifiable certificate in the certificate mixing scenario.

[0006] In an optional design, the first communication device may correspond to the first tenant and the second tenant, the second communication device belongs to the first tenant, and the third communication device belongs to the second tenant. For example, the first communication device is a route reflector (RR) shared by multiple tenants, and the second communication device and the third communication device are customer-premises equipment (CPE) that do not belong to different tenants in the software-defined wide area network (SD-WAN). In this way, in the scenario of mixed use of certificates, in the process of communication devices of different tenants requesting certificates from communication devices shared by multiple tenants and performing certificate verification, this method can be used to ensure that the certificate verification link will not fail because the received certificate and the locally used certificate come from different CAs, thereby ensuring that the verification of the certificate during the establishment of the control channel can be effectively performed.

[0007] In an optional design, the first protocol message may carry the first CA identifier through any other field that can be extended or reused. For example, the first protocol message may include a Server Name Indication (SNI) field, and the SNI field carries the first CA identifier.

[0008] In an optional design, the first CA identifier may be any information that can indicate the first CA, for example, the first CA identifier may be the name of the first CA or the number of the first CA. After the first communication device receives the first protocol message sent by the second communication device, it can determine that the certificate that the second communication device wants to obtain comes from the first CA based on the first CA identifier in the first protocol message.

[0009] In a possible implementation, the method may further include: the first communication device receives a third protocol message from the fourth communication device; in response to the third protocol message not carrying any CA identifier, the first communication device sends a default certificate to the fourth communication device. The default certificate may refer to a certificate sent by the first communication device by default when the CA identifier is not carried in the protocol message. The default certificate may be any certificate maintained on the first communication device, and may be flexibly configured based on demand, for example, it may be a certificate issued by a certain CA, or it may be a certificate preset when the first communication device leaves the factory. In this way, the method provided in the present application is also applicable to the case where no CA identifier is obtained in the third protocol message received by the first communication device. In this case, the first communication device believes that the fourth communication device has not specifically specified the issuing authority of the certificate to be verified, and the first communication device can send the default certificate to the fourth communication device to ensure that the verification of the certificate can be effectively carried out during the establishment of the control channel in various cases.

[0010] In an optional design, the first protocol message may be, for example, a Datagram Transport Layer Security Client Hello (DTLS Client Hello) message.

[0011] In an optional design, the first communication device may be a RR, and the second communication device may be a CPE in a SD-WAN.

[0012] In the second aspect, the present application also provides a message processing method, which is applied to a second communication device. The method may include, for example: the second communication device sends a first protocol message for control channel authentication to the first communication device, the first protocol message includes a first CA identifier, and the first CA identifier is used to indicate the first CA; the second communication device receives the first certificate issued by the first CA sent by the first communication device. It can be seen that through this method, in the certificate verification link in the process of establishing a control channel between communication devices, the requesting party sends a protocol message for control channel authentication to the other party with a CA identifier, so that the other party can know that the requesting party wants to request a certificate issued by the CA indicated by the CA identifier, thereby sending the certificate that the requesting party wants to request to the requesting party, overcoming the problem that in the certificate mixing scenario, it is impossible to know which CA issued the certificate used by the requesting party, and it is likely that the certificate that the requesting party cannot verify is sent to the requesting party, resulting in the failure of the certificate verification, thereby causing the control channel connection to fail to be established, so that the communication device in the certificate mixing scenario can accurately obtain the certificate that it can verify from the other end and complete the certificate verification, which provides a prerequisite for the successful establishment of the control channel.

[0013] In a possible implementation, the method may further include: the second communication device may verify the first certificate based on a local second certificate, the second certificate being a certificate issued by the first CA on the second communication device; when the verification is successful, the second communication device establishes a control channel with the first communication device. It can be seen that the second communication device can obtain a certificate that can be verified by the certificate it uses, so that the second communication device can accurately complete the certificate verification in the certificate mixing scenario, which provides a prerequisite for the successful establishment of the control channel.

[0014] In an optional design, the first protocol message may carry the first CA identifier through any other field that can be extended or multiplexed. For example, the first protocol message may include an SNI field, and the SNI field carries the first CA identifier.

[0015] In an optional design, the first CA identifier may be any information that can indicate the first CA. For example, the first CA identifier may be the name of the first CA or the number of the first CA.

[0016] In an optional design, the first protocol message may be, for example, a DTLS Client Hello message.

[0017] In an optional design, the first communication device may be a RR, and the second communication device may be a CPE in a SD-WAN.

[0018] In a third aspect, the present application further provides a first communication device, which may include, for example: a receiving unit and a sending unit. The receiving unit is used to receive a first protocol message for control channel authentication from a second communication device, the first protocol message including a first CA identifier for indicating a first CA; and the sending unit is used to send a first certificate issued by the first CA to the second communication device.

[0019] In a possible implementation, the receiving unit is further used to receive a second protocol message for control channel authentication from a third communication device, where the second protocol message includes a second CA identifier, where the second CA identifier is used to indicate a second CA; the sending unit is further used to send a second certificate issued by the second CA to the third communication device.

[0020] In an optional design, the first communication device corresponds to the first tenant and the second tenant, the second communication device belongs to the first tenant, and the third communication device belongs to the second tenant.

[0021] In an optional design, the first protocol message may carry the first CA identifier through any other field that can be extended or multiplexed. For example, the first protocol message may include an SNI field, and the SNI field carries the first CA identifier.

[0022] In an optional design, the first CA identifier may be the name of the first CA or the number of the first CA.

[0023] In a possible implementation, the receiving unit is further configured to receive a third protocol message from a fourth communication device; and the sending unit is further configured to send a default certificate to the fourth communication device in response to the third protocol message not carrying any CA identifier.

[0024] In an optional design, the first protocol message may be a DTLS Client Hello message.

[0025] In an optional design, the first communication device may be a RR, and the second communication device may be a CPE in a SD-WAN.

[0026] In a fourth aspect, the present application further provides a second communication device, which may include, for example: a sending unit and a receiving unit. The sending unit is used to send a first protocol message for control channel authentication to the first communication device, wherein the first protocol message includes a first CA identifier, and the first CA identifier is used to indicate the first CA; the receiving unit is used to receive a first certificate issued by the first CA and sent by the first communication device.

[0027] In a possible implementation, the device may further include a processing unit. The processing unit is used to verify the first certificate based on a local second certificate, where the second certificate is issued by the first CA; and the processing unit is further used to establish a control channel with the first communication device if the verification is successful.

[0028] In an optional design, the first protocol message may carry the first CA identifier through any other field that can be extended or multiplexed. For example, the first protocol message may include an SNI field, and the SNI field carries the first CA identifier.

[0029] In an optional design, the first CA identifier may be the name of the first CA or the number of the first CA.

[0030] In an optional design, the first protocol message may be a DTLS Client Hello message.

[0031] In an optional design, the first communication device may be a RR, and the second communication device may be a CPE in a SD-WAN.

[0032] In a fifth aspect, an embodiment of the present application further provides a first communication device, comprising a first communication interface, a second communication interface, and a processor. The first communication interface is used to perform the receiving operation in the method provided in the first aspect; the second communication interface is used to perform the sending operation in the method provided in the first aspect; and the processor is used to perform other operations in the method provided in the first aspect except the receiving and sending operations.

[0033] In a sixth aspect, an embodiment of the present application further provides a second communication device, comprising a first communication interface, a second communication interface, and a processor. The first communication interface is used to perform the receiving operation in the method provided in the second aspect; the second communication interface is used to perform the sending operation in the method provided in the second aspect; and the processor is used to perform other operations in the method provided in the second aspect except the receiving and sending operations.

[0034] In a seventh aspect, an embodiment of the present application further provides a first communication device, the first communication device comprising a memory and a processor. The memory comprises instructions; the processor communicating with the memory is used to execute the instructions, so that the first communication device is used to execute the method provided in the first aspect above.

[0035] In an eighth aspect, an embodiment of the present application further provides a second communication device, the second communication device comprising a memory and a processor. The memory comprises instructions; the processor communicating with the memory is used to execute the instructions, so that the second communication device is used to execute the method provided in the second aspect above.

[0036] In a ninth aspect, an embodiment of the present application further provides a storage medium, in which instructions are stored. When the instructions are executed on a processor, the method provided in the first aspect or the second aspect above is executed.

[0037] In the tenth aspect, an embodiment of the present application further provides a program product, including a program, which, when running on a processor, executes the method provided in the first or second aspect.

[0038] In the eleventh aspect, an embodiment of the present application further provides a communication system, which includes the first communication device provided in the third aspect, the fifth aspect or the seventh aspect and the second communication device provided in the fourth aspect, the sixth aspect or the eighth aspect. BRIEF DESCRIPTION OF THE DRAWINGS

[0039] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in the present application. For ordinary technicians in this field, other drawings can also be obtained based on these drawings.

[0040] Figure 1 A schematic diagram of a network architecture applicable to an embodiment of the present application;

[0041] Figure 2 For Figure 1 Schematic diagram of the DTLS channel establishment process in the network architecture;

[0042] Figure 3 A flowchart of a message processing method 100 in an embodiment of the present application;

[0043] Figure 4 This is a schematic diagram of a certificate mixing scenario in an embodiment of the present application;

[0044] Figure 5 This is a schematic diagram of the structure of a first communication device 500 in an embodiment of the present application;

[0045] Figure 6 This is a schematic diagram of the structure of a second communication device 600 in an embodiment of the present application;

[0046] Figure 7 This is a schematic diagram of the structure of a first communication device 700 in an embodiment of the present application;

[0047] Figure 8 This is a schematic diagram of the structure of a second communication device 800 in an embodiment of the present application;

[0048] Fig. 9 This is a schematic diagram of the structure of a first communication device 900 in an embodiment of the present application;

[0049] Fig.10 This is a schematic diagram of the structure of a second communication device 1000 in an embodiment of the present application;

[0050] Fig.11 11 is a schematic diagram of the structure of a communication system 1100 in an embodiment of the present application. DETAILED DESCRIPTION

[0051] In order to make data transmission between communication devices more secure, a control channel is usually established between communication devices using a security protocol so that data between communication devices can be securely transmitted on the established control channel. For example, in a Software-defined Wide-Area Network (SD-WAN), communication devices can establish a DTLS channel through the Datagram Transport Layer Security (DTLS) protocol. The data transmitted on the DTLS channel can be protected by DTLS over the User Datagram Protocol (UDP) or the Stream Control Transmission Protocol (SCTP), and can be transmitted between communication devices in a way that prevents eavesdropping, tampering, and forgery.

[0052] In the process of establishing a control channel between communication devices, the communication devices need to mutually verify each other's certificates, and can continue to establish the control channel only when the verification is successful. At present, the communication devices in the network all use the certificates issued by the same certificate authority (CA). This scenario can be called a single certificate scenario. For example, the communication devices all use the initial certificates issued by the equipment manufacturer when leaving the factory, or the communication devices all use certificates issued by a certain CA. In the single certificate scenario, the process of communication device A and communication device B who want to establish a control channel mutually verifying each other's certificates, taking the process of communication device A verifying the certificate of communication device B as an example, can include: communication device A sends a protocol message 1 to communication device B, communication device B sends the certificate 1 maintained by itself to communication device A based on the protocol message 1, communication device A receives the certificate 1 sent by communication device B, communication device A verifies the certificate 1 based on the locally maintained certificate 2, if the verification is successful, then continue the subsequent process of establishing the control channel, if the verification fails, then interrupt the process of establishing the control channel. Among them, communication device A can be, for example, a communication device that acts as a client in the SD-WAN network, and communication device B can be, for example, a communication device that acts as a server in the SD-WAN network. For example, communication device A is a customer-premises equipment (CPE) in the SD-WAN network, and communication device B can be a route reflector (RR) connected to communication device A. CPE can obtain routes to other devices from RR by accessing RR to guide the forwarding of traffic on CPE.

[0053] However, as users in the network control their own communication devices, some communication devices may maintain certificates issued by multiple CAs, and the certificates maintained on different communication devices may come from different CAs. This scenario can be called a mixed certificate scenario. For example, communication device A maintains certificates issued by CA1, CA 2, and CA 3, communication device B maintains certificates issued by CA 2 and CA 4, and communication device C maintains certificates issued by CA 4. In the mixed certificate scenario, during the process of establishing a control channel between communication devices, during the certificate verification link, when a communication device requests the certificate of another communication device from the other communication device, since the other communication device does not know which CA issued the certificate used by the requester, the certificate sent by the other communication device to the requester is likely not to be the certificate issued by the CA used by the requester. If the requester receives the certificate sent by the other communication device and finds that it cannot authenticate the received certificate, the certificate verification will fail, thereby causing the control channel connection to fail to be established.

[0054] Based on this, in order to ensure that another communication device can accurately know the certificate issued by the CA used by the requester in a certificate mixing scenario, so as to feedback to the requester the certificate that the requester can verify, and avoid the problem that the certificate verification fails due to the sending of the certificate that the requester cannot verify, thereby resulting in the inability to successfully establish a control channel, an embodiment of the present application provides a message processing method. In the process of establishing a control channel from a second communication device to a first communication device, the second communication device sends a first protocol message for control channel authentication to the first communication device. The first protocol message includes a first CA identifier, and the first CA identifier is used to indicate the first CA. In this way, after the first communication device receives the first protocol message, it can determine based on the first CA identifier in the first protocol message that the second communication device wants to verify the certificate issued by the first CA, thereby sending the first certificate issued by the locally maintained first CA to the second communication device. In this way, the second communication device can receive the first certificate issued to the first communication device by the first CA that it wants to verify. It can be seen that through this method, in the certificate verification link in the process of establishing a control channel between communication devices, the requesting party sends a protocol message for control channel authentication to the other party carrying the CA identifier, so that the other party can know that the requesting party wants to request a certificate issued by the CA indicated by the CA identifier, and thus send the certificate the requesting party wants to request to the requesting party. This overcomes the problem that in the certificate mixing scenario, it is impossible to know which CA issued the certificate used by the requesting party, and it is very likely that a certificate that the requesting party cannot verify will be sent to the requesting party, resulting in failure of certificate verification, thereby causing failure to establish the control channel connection. This enables the communication device in the certificate mixing scenario to accurately obtain a certificate that it can verify from the other end and complete the certificate verification, providing a prerequisite for the successful establishment of the control channel.

[0055] Below Figure 1 In the architecture shown, the process of establishing a DTLS channel in a mixed certificate scenario is used as an example to illustrate.

[0056] Figure 1 The diagram is an architecture diagram of the SD-WAN network including CPE 1, CPE 2 and RR 3. Figure 1 In the example, CPE 1 and RR3 can establish DTLS channel 1, and CPE 2 and RR 3 can establish DTLS channel 2. The following takes the establishment process of DTLS channel 1 as an example for explanation. In the establishment process of DTLS channel 1, CPE 1 plays the role of Client and RR 3 plays the role of Server. Figure 2 .like Figure 2 As shown, the establishment process of DTLS channel 1 may include: the first hello negotiation, the second hello negotiation and the key negotiation. Among them, the certificate verification link involved in the embodiment of the present application belongs to the second hello negotiation part, so, Figure 2 The secondary Hello negotiation is introduced. The secondary Hello negotiation may include: S11, CPE 1 sends Client Hello message 1 to RR 3; S12, RR 3 sends Server Hello message 2 to CPE 1; S13, RR 3 sends Certificate 1 to CPE 1; S14, RR 3 sends Server KeyExchange message to CPE 1; S15, RR 3 sends Certificate Request message to CPE 1; S16, RR 3 sends Server Hello Done message to CPE 1. Among them, the certificate verification link in the embodiment of the present application involves the above-mentioned S11, S13 and the verification step of CPE 1 on Certificate 1 ( Figure 2 (not shown), the verification step of the certificate 1 by CPE 1 can be performed after S13. If the verification is successful, the subsequent process will continue to be executed. If the verification is not successful, the subsequent process will be interrupted.

[0057] Assume that CPE 1 maintains certificates issued by CA 1, CA 2, and CA 3, and RR 3 maintains certificates issued by CA 2 and CA 4. Based on the current solution, Figure 2In the process shown, the certificate 1 in S13 can be a randomly determined or default certificate when RR 3 cannot determine which certificate among the multiple certificates maintained locally to send. If certificate 1 is a certificate issued by CA 4, then when CPE 1 receives certificate 1 issued by CA 4 sent by RR 3, since CPE 1 does not maintain the certificate issued by CA 4, it is impossible to verify certificate 1, that is, CPE 1 fails to verify certificate 1, interrupting the subsequent process, causing the establishment of DTLS channel 1 to fail. Based on the solution provided in the embodiment of the present application, Figure 2 In the process shown, the Client Hello message 1 of S11 includes the CA identifier 2, and the CA identifier 2 is used to indicate the CA 2. Then, the RR 3 that receives the Client Hello message 1 can determine that the certificate 1 issued by the CA 2 indicated by the CA identifier 2 needs to be fed back to the CPE 1 based on the CA identifier 2 in the Client Hello message 1. Therefore, in S13, the RR 3 sends the certificate 1 issued by the CA 2 to the CPE 1. In this way, the verification of the certificate 1 by the CPE 1 will not fail because the received certificate and the locally used certificate are from different CAs, thereby ensuring that the verification of the certificate 1 by the CPE 1 can be effectively performed, which provides a prerequisite for the successful establishment of the DTLS channel 1.

[0058] It should be understood that Figure 1 The network architecture shown in the figure is only an example. The application scenario of the method provided in the embodiment of the present application is not limited to Figure 1 The network architecture shown.

[0059] In the embodiments of the present application, the communication device may be a network device such as a switch or a router; it may also be a component of a network device, such as a single board or a line card on the network device; it may also be a functional module on the network device; it may also be a chip used to implement the method provided in the embodiments of the present application, and the embodiments of the present application are not specifically limited. When the communication device is a chip, the transceiver unit used to implement the method may be, for example, an interface circuit of the chip, and the processing unit may be a processing circuit with processing functions in the chip. Communication devices may be directly connected, for example, but not limited to, via Ethernet cables or optical cables.

[0060] In order to more clearly introduce the embodiments of the present application, Figure 3 The technical solution provided in the embodiments of the present application is described.

[0061] Figure 3 1 shows a flow chart of a method 100 provided in an embodiment of the present application. The method 100 is introduced in the form of interaction between a first communication device and a second communication device. For example, the first communication device may correspond to Figure 1 RR 3 shown, the second communication device corresponds to Figure 1 The communication device CPE 1 in FIG. 1 ; for another example, Figure 1 RR 3 shown, the second communication device corresponds to Figure 1 The communication device CPE 2 in the communication device.

[0062] like Figure 3 As shown, the method 100 provided in the embodiment of the present application may include, for example, the following S101 to S104:

[0063] S101: A second communication device sends a first protocol message for controlling channel authentication to a first communication device, where the first protocol message includes a first CA identifier, where the first CA identifier is used to indicate a first CA.

[0064] S102: The first communication device receives a first protocol message for control channel authentication from the second communication device.

[0065] The control channel may be a communication channel between communication devices established using a security protocol that can make data transmission more secure. Method 100 is described by taking the establishment of a control channel between a second communication device and a first communication device as an example. The first communication device may be an RR, and the second communication device may be a CPE in an SD-WAN.

[0066] As an example, the control channel may be a DTLS channel, and the first protocol message may be a DTLS Client Hello message. Figure 1 Taking DTLS channel 1 in the SD-WAN network architecture as an example, the first communication device may be RR 3, the second communication device may be CPE 1, and the first protocol message may be Figure 2 ClientHello message 1 in S11. If the first CA corresponds to Figure 2 If CA 2 is in the first protocol message, then the first CA identifier in the first protocol message is Figure 2 The CA identifier in 2.

[0067] In one possible implementation, the second communication device can determine the certificate used by itself to verify the certificate of the first communication device during the certificate verification process, and determine that the certificate is a certificate issued by the first CA. Then, the second communication device generates a first protocol message, and the first protocol message carries a first CA identifier indicating the first CA. The first protocol message is used to request the recipient of the first protocol message (i.e., the first communication device) to feedback the certificate issued by the first CA indicated by the first CA identifier.

[0068] The manner of carrying the first CA identifier in the first protocol message is not specifically limited in the embodiment of the present application. As an example, the first protocol message may include a server name identifier (SNI) field, and the SNI field is used to carry the first CA identifier. As another example, the first protocol message may carry the first CA identifier through any other field that can be extended or multiplexed.

[0069] The first protocol message may also include an Internet Protocol (IP) address, which is used to indicate the destination communication device (i.e., the first communication device) of the first protocol message. The second communication device determines to send the first protocol message to the first communication device indicated by the IP address based on the IP address in the first protocol message.

[0070] The first CA identifier may be any information that can indicate the first CA, for example, the first CA identifier may be the name of the first CA, or the first CA identifier may be the number of the first CA. After the first communication device receives the first protocol message sent by the second communication device, it can determine that the certificate that the second communication device wants to obtain is from the first CA based on the first CA identifier in the first protocol message.

[0071] S103: The first communication device sends a first certificate issued by the first CA to the second communication device.

[0072] S104: The second communication device receives a first certificate issued by the first CA and sent by the first communication device.

[0073] As an example, after receiving the first protocol message, the first communication device obtains the first CA identifier by parsing the first protocol message, obtains the first certificate issued by the first CA indicated by the first CA identifier from the locally maintained certificate, and then sends the first certificate to the second communication device. The first certificate is a certificate issued by the first CA to the first communication device.

[0074] When the second communication device receives the first certificate sent by the first communication device, it can verify the received first certificate based on the local second certificate. If the verification is successful, the subsequent process will continue to be executed to establish a control channel with the first communication device. If the verification fails, the execution of the subsequent process will be interrupted to determine that the control channel with the first communication device has failed to be established. The second certificate is a certificate issued by the first CA to the second communication device.

[0075] In some implementations, each communication device may pre-save the correspondence between each certificate and the CA identifier of the issuing authority of the certificate. For example, a first correspondence between a first CA identifier and a first certificate is saved on a first communication device. The first communication device matches the first correspondence based on the first CA identifier in the first protocol message, thereby obtaining a first certificate from the first correspondence.

[0076] In other implementations, when each communication device saves a certificate, the CA identifier of the issuing authority of the certificate can be saved as an attribute of the certificate. For example, a first certificate is saved on a first communication device, and the attributes of the first certificate include a first CA identifier. The first communication device determines that the first certificate has the attribute of the first CA identifier based on the first CA identifier in the first protocol message.

[0077] In an embodiment of the present application, the first certificate is a device certificate issued by a first CA to a first communication device. The first certificate may include, for example, a certificate serial number, a certificate signature algorithm, a certificate issuer, a validity period, a public key, or a digital signature. The second certificate may be a CA certificate issued by a first CA to a second communication device. The second certificate may include, for example, a public key. The first certificate may be understood as a certification document that can indicate that the first CA issued the certificate to the first communication device. The second certificate may be understood as a public certificate of the first CA, which can indicate the characteristics of the certificate issued by the first CA. Then, the second communication device verifies the first certificate based on the second certificate, which may include but is not limited to: verifying the digital signature in the first certificate based on the public key in the second certificate to verify the integrity and source legitimacy of the first certificate; verifying whether the first certificate is an expired certificate based on the validity period of the first certificate.

[0078] In some possible implementations, the embodiments of the present application may further include: the first communication device receives a second protocol message for control channel authentication from a third communication device, the second protocol message includes a second CA identifier, and the second CA identifier is used to indicate a second CA; the first communication device sends a third certificate issued by the second CA to the third communication device. It can be seen that in the process of establishing different control channels with different communication devices, the first communication device can determine which CA-issued certificate each communication device needs to obtain based on the method provided in the embodiments of the present application, and accurately send the corresponding certificate to the other party. Among them, the first communication device can correspond to Figure 1 RR 3 shown, if the second communication device corresponds to Figure 1 The CPE 1 shown, then, the third communication device may correspond to Figure 1 CPE 2 is shown.

[0079] As an example, the tenants corresponding to the first communication device may include a first tenant and a second tenant, the second communication device belongs to the first tenant, and the third communication device belongs to the second tenant. Figure 1 In the network architecture shown, RR3 corresponds to tenant 1 and tenant 2, CPE 1 belongs to tenant 1, and CPE 2 belongs to tenant 2. If tenant 1 applies for a certificate from CA 1 and tenant 2 applies for a certificate from CA 2, then Figure 4 As shown, CPE 1 may include CA certificate 1 issued by CA 1, CPE 2 may include CA certificate 2 issued by CA 2, RR 3 may include device certificate 1 issued by CA 1 and device certificate 2 issued by CA 2, CPE 1 uses CA certificate 1 to verify device certificate 1 received from RR 3, and CPE 2 uses CA certificate 2 to verify device certificate 2 received from RR 3. Figure 4 The scenario shown is a possible scenario of mixed certificate use. The method provided in the embodiment of the present application can ensure that the certificate verification link will not fail the certificate verification because the received certificate and the locally used certificate come from different CAs, thereby ensuring that the CPE can effectively verify the certificate.

[0080] In some other possible implementations, the embodiments of the present application may further include: the first communication device receives a third protocol message from a fourth communication device; in response to the third protocol message not carrying any CA identifier, the first communication device sends a default certificate to the fourth communication device. The default certificate may refer to a certificate sent by the first communication device by default when the CA identifier is not carried in the protocol message. The default certificate may be any certificate maintained on the first communication device, and may be flexibly configured based on demand, for example, it may be a certificate issued by a CA, or it may be a certificate preset when the first communication device leaves the factory.

[0081] Among them, in response to the third protocol message not carrying any CA identifier, the first communication device sends a default certificate to the fourth communication device, which may include: the first communication device parses the third protocol message and does not obtain any CA identifier, then determines that the fourth communication device has not specifically specified the issuing authority of the verified certificate, and the first communication device can send the default certificate to the fourth communication device.

[0082] It can be seen that through this method 100, in the certificate verification link in the process of establishing a control channel between communication devices, the requesting party carries a CA identifier in the protocol message for control channel authentication sent to the other party, so that the other party can know that the requesting party wants to request a certificate issued by the CA indicated by the CA identifier, and thus send the certificate that the requesting party wants to request to the requesting party. This overcomes the problem that in the certificate mixing scenario, it is impossible to know which CA issued the certificate used by the requesting party, and it is very likely that a certificate that the requesting party cannot verify will be sent to the requesting party, resulting in failure of certificate verification, thereby causing failure to establish the control channel connection. In the certificate mixing scenario, it is ensured that the certificate verification link will not cause certificate verification to fail because the received certificate and the locally used certificate come from different CAs, thereby ensuring that the communication device can effectively verify the certificate, providing a prerequisite for the successful establishment of the control channel.

[0083] It should be noted that, for ease of understanding, method 100 is introduced in the form of interaction between a first communication device and a second communication device. However, the steps implemented by the first communication device can be used as an independent embodiment, and the steps implemented by the second communication device can be used as an independent embodiment.

[0084] In addition, the present application embodiment also provides a first communication device 500, see Figure 5 The first communication device 500 may include a receiving unit 501 and a sending unit 502 .

[0085] The receiving unit 501 is configured to receive a first protocol message for controlling channel authentication from a second communication device, wherein the first protocol message includes a first CA identifier for indicating a first CA. The receiving unit 501 may execute Figure 3 S102 shown.

[0086] The sending unit 502 is configured to send a first certificate issued by a first CA to a second communication device. The sending unit 502 may execute Figure 3 S103 shown.

[0087] In a possible implementation, the receiving unit 501 is further used to receive a second protocol message for control channel authentication from a third communication device, where the second protocol message includes a second CA identifier, where the second CA identifier is used to indicate a second CA; the sending unit 502 is further used to send a second certificate issued by the second CA to the third communication device.

[0088] In an optional design, the first communication device corresponds to the first tenant and the second tenant, the second communication device belongs to the first tenant, and the third communication device belongs to the second tenant.

[0089] In an optional design, the first protocol message may carry the first CA identifier through any other field that can be extended or multiplexed. For example, the first protocol message may include an SNI field, and the SNI field carries the first CA identifier.

[0090] In an optional design, the first CA identifier may be the name of the first CA or the number of the first CA.

[0091] In a possible implementation, the receiving unit 501 is further configured to receive a third protocol message from a fourth communication device; and the sending unit 502 is further configured to send a default certificate to the fourth communication device in response to the third protocol message not carrying any CA identifier.

[0092] In an optional design, the first protocol message may be a DTLS Client Hello message.

[0093] In an optional design, the first communication device 500 may be a RR, and the second communication device may be a CPE in a SD-WAN.

[0094] It should be noted that the specific implementation method and technical effect achieved by the device 500 provided in the embodiment of the present application can refer to the relevant description of the first communication device in the method 100.

[0095] In addition, the present embodiment also provides a second communication device 600, see Figure 6 The second communication device 600 may include a sending unit 601 and a receiving unit 602 .

[0096] The sending unit 601 is configured to send a first protocol message for controlling channel authentication to a first communication device, wherein the first protocol message includes a first CA identifier, and the first CA identifier is used to indicate a first CA. The sending unit 601 may execute Figure 3 S101 shown.

[0097] The receiving unit 602 is configured to receive a first certificate issued by the first CA and sent by the first communication device. The receiving unit 602 may execute Figure 3 S104 shown.

[0098] In a possible implementation, the device 600 may further include a processing unit. The processing unit is configured to verify the first certificate based on a local second certificate, where the second certificate is issued by the first CA; and the processing unit is further configured to establish a control channel with the first communication device if the verification is successful.

[0099] In an optional design, the first protocol message may carry the first CA identifier through any other field that can be extended or multiplexed. For example, the first protocol message may include an SNI field, and the SNI field carries the first CA identifier.

[0100] In an optional design, the first CA identifier may be the name of the first CA or the number of the first CA.

[0101] In an optional design, the first protocol message may be a DTLS Client Hello message.

[0102] In an optional design, the first communication device may be a RR, and the second communication device 600 may be a CPE in a SD-WAN.

[0103] It should be noted that the specific implementation method and technical effect achieved by the device 600 provided in the embodiment of the present application can refer to the relevant description of the second communication device in the method 100.

[0104] In addition, the present application embodiment also provides a first communication device 700, see Figure 7 The first communication device 700 may include a first communication interface 701 , a second communication interface 702 , and a processor 703 .

[0105] The processor 703 is used to execute the above Figure 2 In the embodiment shown, the communication device RR 3 or Figure 3 The processing operation performed by the first communication device in the embodiment shown; the first communication interface 701 is used to perform the above Figure 2 In the embodiment shown, the communication device RR 3 or Figure 3 In the embodiment shown, the first communication device performs a receiving operation; the second communication interface 702 is used to perform the above Figure 2 In the embodiment shown, the communication device RR 3 or Figure 3 The sending operation performed by the first communication device in the embodiment shown. For example, the first communication interface 701 may perform Figure 3 The operations in the illustrated embodiment include: receiving a first protocol message for controlling channel authentication; the second communication device 702 may execute Figure 3 The operations in the illustrated embodiment include sending a first certificate issued by a first CA.

[0106] In addition, the present application embodiment also provides a second communication device 800, see Figure 8 The first communication device 800 may include a first communication interface 801 , a second communication interface 802 , and a processor 803 .

[0107] The processor 803 is used to execute the above Figure 2 In the embodiment shown, the communication device CPE 1 or Figure 3 The processing operation performed by the second communication device in the embodiment shown; the first communication interface 801 is used to perform the above Figure 2 In the embodiment shown, the communication device CPE 1 or Figure 3 The receiving operation performed by the second communication device in the embodiment shown; the second communication interface 802 is used to perform the above Figure 2 In the embodiment shown, the communication device CPE 1 or Figure 3 The sending operation performed by the second communication device in the embodiment shown. For example, the second communication interface 802 can perform Figure 3 The operations in the illustrated embodiment include: sending a first protocol message for controlling channel authentication to the first communication device; the first communication interface 801 may execute Figure 3 The operation in the illustrated embodiment includes: receiving a first certificate issued by the first CA and sent by the first communication device. Optionally, the processor 803 may execute Figure 3 The operation in the embodiment includes: verifying the first certificate based on a local second certificate, and if the verification is successful, establishing a control channel with the first communication device.

[0108] In addition, the present application embodiment further provides a first communication device 900, see Fig. 9 The first communication device 900 includes a memory 901 and a processor 902 communicating with the memory 901. The memory 901 includes instructions; the processor 902 is used to execute the instructions, so that the first communication device 900 executes the above Figure 2 In the embodiment shown, the communication device RR3 or Figure 3 The method in the illustrated embodiment is performed by a first communication device.

[0109] In addition, the present application embodiment also provides a second communication device 1000, see Fig.10 The second communication device 1000 includes a memory 1001 and a processor 1002 communicating with the memory 1001. The memory 1001 includes instructions; the processor 1002 is used to execute the instructions, so that the second communication device 1000 executes the above Figure 2 In the embodiment shown, the communication device CPE 1 or Figure 3 The method in the illustrated embodiment is performed by the second communication device.

[0110] It is understandable that in the above embodiments, the processor may be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and a NP. The processor may also be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The above PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL) or any combination thereof. The processor may refer to one processor or may include multiple processors. The memory may include a volatile memory (English: volatile memory), such as a random access memory (English: random-access memory, abbreviated: RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as a read-only memory (English: read-only memory, abbreviated: ROM), a flash memory (English: flash memory), a hard disk drive (English: hard disk drive, abbreviated: HDD) or a solid-state drive (English: solid-state drive, abbreviated: SSD); the memory may also include a combination of the above-mentioned types of memory. The memory may refer to one memory or may include multiple memories. In a specific embodiment, the memory stores computer-readable instructions, and the computer-readable instructions include multiple software modules, such as a sending module, a processing module and a receiving module. After executing each software module, the processor may perform corresponding operations according to the instructions of each software module. In this embodiment, the operation performed by a software module actually refers to the operation performed by the processor according to the instructions of the software module. After the processor executes the computer-readable instructions in the memory, it may perform all operations that can be performed by each network node of the active flow detection according to the instructions of the computer-readable instructions.

[0111] It can be understood that, in the above embodiment, the first communication interface 701 of the first communication device 700 can be specifically used as the receiving unit 501 in the first communication device 500, and the second communication interface 702 can be specifically used as the sending unit 5027 in the first communication device 500. Similarly, the first communication interface 801 of the second communication device 800 can be specifically used as the receiving unit 602 in the second communication device 600, and the second communication interface 802 can be specifically used as the sending unit 601 in the second communication device 600; the processor 803 of the second communication device 800 can be specifically used as the processing unit in the second communication device 600.

[0112] In addition, the present application embodiment also provides a communication system 1100, see Fig.11 The communication system 1100 includes a first communication device 1101 and a second communication device 1102, wherein the first communication device 1101 may be the first communication device 500, the first communication device 700 or the first communication device 900, and the second communication device 1102 may be the second communication device 600, the second communication device 800 or the second communication device 1000.

[0113] In addition, the embodiment of the present application further provides a storage medium in which instructions or programs are stored. When the instructions or programs are executed on the processor, the computer executes the above Figure 3 The method in the illustrated embodiment.

[0114] In addition, the embodiment of the present application also provides a program product, including a program or an instruction, which, when the program or the instruction is executed on a processor, enables the computer to execute the aforementioned Figure 3 The method in the illustrated embodiment.

[0115] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0116] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for system embodiments and device embodiments, since they are basically similar to method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. The device and system embodiments described above are merely schematic, in which the modules described as separate components may or may not be physically separated, and the components displayed as modules may or may not be physical modules, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0117] The above is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application. It should be noted that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the present application, and these improvements and modifications should also be regarded as the protection scope of the present application.

Claims

1. A message processing method, characterized in that: Applied to a first communication device, the method comprises: receiving a first protocol message for control channel authentication from a second communication device, wherein the first protocol message includes a first certificate authority CA identifier, and the first CA identifier is used to indicate a first CA; A first certificate issued by the first CA is sent to the second communication device.

2. The method according to claim 1, characterized in that The method further comprises: receiving, from a third communication device, a second protocol message for control channel authentication, wherein the second protocol message includes a second CA identifier, and the second CA identifier is used to indicate a second CA; A second certificate issued by the second CA is sent to the third communication device.

3. The method according to claim 2, characterized in that The first communication device corresponds to a first tenant and a second tenant, the second communication device belongs to the first tenant, and the third communication device belongs to the second tenant.

4. The method according to any one of claims 1 to 3, characterized in that: The first protocol message includes a server name identifier SNI field, and the SNI field carries the first CA identifier.

5. The method according to any one of claims 1 to 4, characterized in that: The first CA identifier is the name of the first CA or the number of the first CA.

6. The method according to any one of claims 1 to 5, characterized in that: The method further comprises: receiving a third protocol message from a fourth communication device; In response to the third protocol message not carrying any CA identifier, sending a default certificate to the fourth communication device.

7. The method according to any one of claims 1 to 6, characterized in that: The first protocol message is a Datagram Transport Layer Security Client Hello (DTLS Client Hello) message.

8. The method according to any one of claims 1 to 7, characterized in that: The first communication device is a route reflector RR, and the second communication device is a customer terminal equipment CPE in a software-defined wide area network SD-WAN.

9. A message processing method, characterized in that: Applied to a second communication device, comprising: Sending a first protocol message for control channel authentication to a first communication device, wherein the first protocol message includes a first certificate authority CA identifier, and the first CA identifier is used to indicate a first CA; Receive a first certificate issued by the first CA and sent by the first communication device.

10. The method according to claim 9, characterized in that The method further comprises: Verify the first certificate based on a local second certificate, where the second certificate is issued by the first CA; If the verification is successful, a control channel with the first communication device is established.

11. The method according to claim 9 or 10, characterized in that: The first protocol message includes a server name identifier SNI field, and the SNI field carries the first CA identifier.

12. The method according to any one of claims 9 to 11, characterized in that: The first CA identifier is the name of the first CA or the number of the first CA.

13. The method according to any one of claims 9 to 12, characterized in that: The first protocol message is a Datagram Transport Layer Security Client Hello (DTLS Client Hello) message.

14. The method according to any one of claims 9 to 13, characterized in that: The first communication device is a route reflector RR, and the second communication device is a customer terminal equipment CPE in a software-defined wide area network SD-WAN.

15. A communication device, characterized in that: include: A processing unit, configured to perform other operations except the receiving operation and the sending operation in the method according to any one of claims 1 to 14; A transceiver unit, used to perform the receiving operation and the sending operation in the method described in any one of claims 1-14.

16. A communication device, characterized in that: The communication device includes a memory and a processor; The memory is used to store instructions; The processor is used to execute the instructions in the memory and perform the method according to any one of claims 1 to 14.

17. A communication system, characterized in that: The communication system comprises a first communication device and a second communication device; The first communication device is used to execute the method according to any one of claims 1 to 8; The second communication device is used to execute the method described in any one of claims 9 to 14.

18. A storage medium, characterized in that: The storage medium includes instructions, and when the instructions are executed on a processor, the processor is caused to execute the method according to any one of claims 1 to 14.

19. A program product, characterized in that The program product comprises a program, and when the program is run on a processor, the method according to any one of claims 1 to 14 is executed.

Images