Message forwarding method and device

Abstract

The invention provides a message forwarding method and device. According to the embodiment of the invention, an SRv6TE Policy source path route and a source path control detection message are respectively issued to other nodes on a current path through a head node, so that the other nodes on the current path are triggered to generate a source path control table, and the source path control table comprises route forwarding information which is not concerned by the nodes on the existing SRv6TE Policy path before. Risk vulnerabilities caused by the fact that nodes on an existing SRv6TE Policy path do not care about routing forwarding information are restrained by means of the source path control table, and the security of an SRv6 network is improved.

Description

Technical Field

[0001] The present application relates to network communication Internet of Things, and in particular to a message forwarding method and device. Background Art

[0002] In the Segment Routing IPv6 (SRv6) network, the SRv6 Traffic Engineering Policy (TE Policy) provides a flexible forwarding path selection method to meet different forwarding requirements of users. Proper use of SRv6 TE Policy to select forwarding paths can not only facilitate administrators to manage and plan the network, but also effectively reduce the forwarding pressure of network devices.

[0003] However, in specific applications, the security of SRv6 networks is often challenged. For example, for services on SRv6 networks, the nodes other than the head node on the transmission path included in the SRv6 TE Policy of the service only care about the destination address of the received message and the segment list (Segment List) in the SRv6 message header (SRH: Segment Routing Header) carried by the message, so as to guide the forwarding behavior of the message based on the segment list. The nodes other than the head node do not care about routing forwarding information such as the interface that receives the message (referred to as the message inbound interface), the source address carried by the message, and whether the Segment List carried in the SRH header is correct, which is equivalent to the existence of a risk loophole. Once a network attacker seizes this risk loophole to attack, for example, after knowing the SID configuration of a node, the network attacker can attack any interface of the node, which will cause the attack message to enter the SRv6 network and affect the security of the SRv6 network. Summary of the invention

[0004] The embodiments of the present application provide a message forwarding method and device to improve the security of the SRv6 network and effectively prevent attack messages from attacking the SRv6 network.

[0005] The present application provides a message forwarding method, which is applied to a network node and includes:

[0006] The network node, as a head node of the SRv6 traffic engineering policy TE Policy, sends an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information used for forwarding packets on the current path, so that any node on the current path except the head node records the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route;

[0007] The network node acts as the head node and sends a source path control detection message for detecting the current path to other nodes on the current path; the source path control detection message carries the second routing information for forwarding messages on the current path, so that when any node other than the head node on the current path identifies that the second routing information carried by the source path control detection message matches the recorded first routing information, a source path control table matching the first routing information is generated; any node other than the head node on the current path is used to perform forwarding control on the received service message based on the generated source path control table.

[0008] The present application provides a message forwarding method, which is applied to a network node and includes:

[0009] The network node is any node other than the head node of the SRv6 traffic engineering policy TE Policy, then:

[0010] receiving an SRv6 TE Policy source path route sent by the head node of the SRv6 TE Policy for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information for forwarding messages on the current path;

[0011] Identify whether the node is on the current path, and if so, record the first routing information carried by the SRv6 TE Policy source path route;

[0012] receiving a source path control detection message sent by the head node; the source path control detection message carries second routing information for the current path forwarding message; if it is identified that the second routing information carried by the source path control detection message matches the recorded first routing information, generating a source path control table matching the first routing information;

[0013] Based on the source path control table, forwarding control is performed on the service messages received by the node.

[0014] The embodiment of the present application provides a message forwarding device, which is applied to a network node, where the network node serves as a head node of an SRv6 traffic engineering policy TE Policy, and includes:

[0015] A first sending unit is configured to send an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information used for forwarding messages on the current path, so that any node on the current path other than the head node records the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route;

[0016] A second sending unit is used to send a source path control detection message for detecting the current path to other nodes on the current path; the source path control detection message carries second routing information for forwarding messages on the current path, so that when any node other than the head node on the current path recognizes that the second routing information carried by the source path control detection message matches the recorded first routing information, a source path control table matching the first routing information is generated; any node other than the head node on the current path is used to forward the received service message based on the generated source path control table.

[0017] The embodiment of the present application provides a message forwarding device, which is applied to a network node, where the network node is any node other than a head node of an SRv6 traffic engineering policy TE Policy, and includes:

[0018] a receiving unit, configured to receive an SRv6 TE Policy source path route sent by a head node of the SRv6 TE Policy for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information for forwarding messages on the current path;

[0019] a routing unit, configured to identify whether the node is on the current path, and if so, record the first routing information carried by the SRv6 TEPolicy source path routing;

[0020] The receiving unit is further used to receive a source path control detection message sent by the head node; the source path control detection message carries the second routing information used for the current path forwarding message;

[0021] a processing unit, configured to generate a source path control table matching the first routing information if it is identified that the second routing information carried by the source path control detection message matches the recorded first routing information;

[0022] The service control unit is used to control the forwarding of service messages received by the node based on the source path control table to suppress network attacks.

[0023] The embodiment of the present application also provides an electronic device. The electronic device includes: a processor and a machine-readable storage medium;

[0024] The machine-readable storage medium stores machine-executable instructions that can be executed by the processor;

[0025] The processor is used to execute machine executable instructions to implement the steps of the above disclosed method.

[0026] It can be seen from the above technical solutions that in this embodiment, the head node publishes SRv6 TE Policy source path routing and source path control detection messages to other nodes on the current path respectively, so as to trigger other nodes on the current path to generate a source path control table. The source path control table contains routing forwarding information that the nodes on the path of the existing SRv6 TE Policy did not care about before, so as to suppress the risk vulnerability caused by the fact that the nodes on the path of the existing SRv6 TE Policy do not care about the above routing forwarding information with the help of the source path control table, thereby improving the security of the SRv6 network. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present disclosure and, together with the description, serve to explain the principles of the present disclosure.

[0028] Figure 1 A flow chart of the method provided in the embodiment of the present application;

[0029] Figure 2 Another method flow chart provided for an embodiment of the present application;

[0030] Figures 3 to 8 This is a schematic diagram of an embodiment of the present application;

[0031] Fig. 9 A structural diagram of a device provided in an embodiment of the present application;

[0032] Fig.10 Another device structure diagram provided for an embodiment of the present application;

[0033] Fig.11 A structural diagram of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0034] In order to enable those skilled in the art to better understand the technical solutions provided by the embodiments of the present application and to make the above-mentioned purposes, features and advantages of the embodiments of the present application more obvious and understandable, the technical solutions in the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings.

[0035] The method provided in the embodiment of the present application is described below by taking the head node (Headend) applied to SRv6 TE Policy as an example.

[0036] See also Figure 1 , Figure 1 A flowchart of a method provided in an embodiment of the present application. The method is applied to a network node in an SRv6 network.

[0037] like Figure 1 As shown, the process may include the following steps:

[0038] Step 101: A network node, as a head node of an SRv6 TE Policy, sends an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy.

[0039] In a specific application, an SRv6 TE Policy may include multiple paths with different priorities. As an embodiment, the current path here may be an available path (also called a primary path for the service) in the SRv6 TE Policy determined based on service requirements.

[0040] In this embodiment, the SRv6 TE Policy source path route carries the first route information for forwarding packets on the current path. Optionally, the first route information here may include: the route identifier (RouterID) of the head node, the source IPv6 address of the head node for SRv6 encapsulation, and the Segment List of the current path. Here, the Segment List of the current path includes the SIDs of each node on the current path except the head node.

[0041] After the head node sends the SRv6 TE Policy source path route to other nodes on the current path, any node on the current path other than the head node receives the SRv6 TE Policy source path route and records the first routing information carried in the SRv6 TE Policy source path route. Figure 2 The process shown.

[0042] Step 102, the network node acts as the head node, and sends a source path control detection message for detecting the current path to other nodes on the current path; the source path control detection message carries the second routing information for forwarding messages on the current path, so that when any node other than the head node on the current path recognizes that the second routing information carried by the source path control detection message matches the recorded first routing information, a source path control table matching the first routing information is generated; any node other than the head node on the current path is used to perform forwarding control on the received service message based on the generated source path control table.

[0043] If the first routing information includes: the RouterID of the head node, the source IPv6 address of the head node used for SRv6 encapsulation, and the Segment List of the current path (including the SID of each node on the current path except the head node), then as an embodiment, the second routing information may also include: the RouterID of the head node, the source IPv6 address of the head node used for SRv6 encapsulation, and the Segment List of the current path, and the Segment List includes the SID of each node on the current path except the head node.

[0044] As an embodiment, in order to ensure that the source path control detection message carries the above second routing information, in this embodiment, the source path control detection message can encapsulate the IPv6 basic header, the SRv6 message header (SRH: Segment Routing Header) and the RouterID header;

[0045] The IPv6 basic header at least includes a source address field, and the source address field carries the source IPv6 address of the above-mentioned header node for SRv6 encapsulation.

[0046] SRH at least includes: Routing Type field, Next Header field, and Segment List field. Among them, the Routing Type field carries a first value such as 254, and the first value such as 254 is used to indicate that the message is a source path control detection message. The Next Header field carries a second value such as 254, and the second value such as 254 is used to indicate that the next message header of the SRH carries the RouterID of the head node. The Segment List field carries the Segment List of the current path, and the Segment List includes the SIDs of each node on the current path except the head node.

[0047] The RouterID header carries the RouterID of the head node.

[0048] Based on this, it can be seen that the second routing information includes: the RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

[0049] As for any node other than the head node on the current path, how to identify that the second routing information carried by the source path control detection message matches the recorded first routing information will be described below with examples, and will not be repeated here. If any node other than the head node on the current path identifies that the second routing information carried by the source path control detection message matches the recorded first routing information, a source path control table matching the first routing information will be generated.

[0050] As an embodiment, the source path control table here may include, for example, routing forwarding information that the nodes on the path of the existing SRv6 TE Policy did not care about before, such as whether the source IPv6 address of the head node is correct, whether the Segment List is correct, etc. In this embodiment, by recording the routing forwarding information that the nodes on the path of the existing SRv6 TE Policy did not care about before in the source path control table, the source path control table can be used to control the forwarding of the received service message, so as to suppress the risk loopholes caused by the nodes on the path of the existing SRv6 TE Policy not caring about the above routing forwarding information with the help of the source path control table, effectively prevent the message from spoofing and entering the SRv6 network, suppress network attacks, and improve the security of the SRv6 network. The following is an example description, which will not be repeated here.

[0051] So far, completed Figure 1 The process shown.

[0052] The method provided in the embodiment of the present application is described below from the perspective of any node other than the head node on the current path included in the SRv6 TE Policy:

[0053] See also Figure 2 , Figure 2 Another method flow chart provided in an embodiment of the present application. The method is applied to any node on the current path except the head node.

[0054] like Figure 2 As shown, the process may include the following steps:

[0055] Step 201: Receive an SRv6 TE Policy source path route sent by a head node of the SRv6 TE Policy for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information used for forwarding packets on the current path.

[0056] This step 201 corresponds to the above step 101.

[0057] Step 202: Identify whether the node is on the current path. If yes, record the first routing information carried by the SRv6 TE Policy source path route.

[0058] As an embodiment, the first routing information at least includes: Segment List. Segment List includes SIDs of nodes on the current path except the head node. Based on this, in step 202, identifying whether the node is in the current path includes: identifying whether the SID of the node is in the Segment List, if so, determining that the node is in the current path, otherwise, determining that the node is not in the current path.

[0059] Optionally, if the node is not on the current path, the received SRv6 TE Policy source path route may be ignored.

[0060] Step 203, receiving a source path control detection message sent by the head node; the source path control detection message carries second routing information for forwarding messages on the current path, and if it is identified that the second routing information carried by the source path control detection message matches the recorded first routing information, a source path control table matching the first routing information is generated.

[0061] This step 203 corresponds to the above-mentioned step 102 .

[0062] Specifically, in this step 203, receiving a source path control detection message sent by the head node for detecting the current path includes: receiving a message sent by the head node; if the message type carried by the message is a first value, the first value is used to indicate a source path control detection message, then determining that the source path control detection message sent by the head node is received.

[0063] As an embodiment, the source path control detection message received here encapsulates the IPv6 basic header, the SRv6 message header SRH, and the RouterID header;

[0064] The IPv6 basic header at least includes a source address field, which carries the source IPv6 address of the header node for SRv6 encapsulation.

[0065] The SRH at least includes: a routing type (Routing Type) field, a next header type (NextHeader) field, and a Segment List field.

[0066] As an embodiment, the Routing Type field carries a first value, and the first value is used to indicate a source path control detection message. Based on this, when it is identified that the Routing Type field carries the first value, it is determined that the message is a source path control detection message. The Next Header field carries a second value, such as 254. The second value, such as 254, is used to indicate that the next message header of the SRH carries the RouterID of the head node. The Segment List field carries the Segment List of the current path, and the Segment List includes the SIDs of each node on the current path except the head node.

[0067] The RouterID header carries the RouterID of the head node.

[0068] Based on the above description of the source path control detection message, in this embodiment, the second routing information includes at least: the RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

[0069] Based on this, in the above step 203, identifying whether the second routing information carried by the source path control detection message matches the recorded first routing information may include:

[0070] Determine whether the RouterID carried by the source path control detection message and the RouterID in the recorded first routing information meet the first set matching requirement, whether the source IPv6 address carried by the source path control detection message and the source IPv6 address in the recorded first routing information meet the second set matching requirement, and whether the Segment List carried by the source path control detection message and the Segment List in the recorded first routing information meet the third set matching requirement. If all are satisfied, determine that the second routing information carried by the source path control detection message matches the recorded first routing information; otherwise, determine that the second routing information carried by the source path control detection message does not match the recorded first routing information.

[0071] Optionally, the first setting matching requirement, the second setting matching requirement, and the third setting matching requirement may be the same, for example, they are equal, or the similarity meets the setting requirements, which is not specifically limited in this embodiment.

[0072] In this embodiment, the IPv6 basic header further includes a destination address field; the SRH further includes: an SL field, the SL field carries an SL. Here, the SL indicates the number of remaining SIDs in the Segment List, and the remaining SIDs here refer to the segment identifiers SIDs corresponding to the nodes that the source path control detection message has not passed through.

[0073] Based on this, as an embodiment, the source path control table matched by the above-mentioned first routing information at least includes: the interface that receives the source path control detection message, the source IPv6 address carried by the source address field, the destination address carried by the destination address field, the Segment List carried by the source path control detection message, and the above-mentioned SL.

[0074] It should be noted that in Figure 2 In the process shown, for any node other than the head node on the current path, if it is found that the node is not the last node of the current path (for example, if SL is not 0, it is determined that the node is not the last node of the current path), the source path control detection message will be modified as follows and continued to be forwarded: the destination address field in the source path control detection message is modified to the node identifier of the next node after the current node on the current path, and the number in the SL field is updated, and the updated number is 1 less than the number before the update.

[0075] Step 204: Based on the source path control table, forwarding control is performed on the service message received by the node.

[0076] Based on the above-mentioned source path control table, in this step 204, the forwarding control of the service message received by this node may include: checking whether the interface of the received service message, the source IPv6 address and destination address of the service message encapsulated, and the Segment List and SL of the service message encapsulated match the input interface, source IPv6 address, destination address, Segment List, and SL in the source path control table respectively; if so, continue to forward the service message; if not, discard the service message.

[0077] According to the forwarding process of the existing SRv6 TE Policy, when receiving a service message, the network nodes on the path included in the SRv6 TE Policy do not pay attention to routing forwarding information such as whether the message input interface is correct, whether the message source address is correct, and whether the Segment List carried in the SRH header is correct, but directly forward based on the Segment List in the service message. However, when receiving a service message, this embodiment does not directly forward based on the Segment List and SL in the service message, but first pays attention to whether the message input interface is correct, whether the message source address is correct, whether the destination address is correct, and whether the Segment List carried in the SRH header is correct. This avoids the risk loopholes caused by not paying attention to this information and ensures the security of the SRv6 network.

[0078] The method provided in the embodiment of the present application is described above. The present application is described below through a specific embodiment:

[0079] Application Figure 3 In the SRv6 network shown in the figure, the current path of the SRv6 TE Policy is as follows (denoted as path 1): node A -> node B -> node D. Node A serves as the head node and advertises the SRv6 TE Policy source path route.

[0080] Optionally, in this embodiment, the SRv6 TE Policy source path routing can be published by extending BGP to define the SRv6 TE Policy source path routing address family. Taking extending BGP to define the SRv6 TE Policy source path routing address family as an example, Figure 3 Nodes A, B, C, and D in the SRv6 network shown in the figure will communicate with the BGP route reflector ( Figure 3 Node A establishes a BGP neighbor relationship with the BGP route reflector (not shown). Node A publishes the SRv6 TE Policy source path route to the BGP route reflector, and the BGP route reflector publishes the SRv6 TE Policy source path route to all other BGP neighbors.

[0081] As an embodiment, the SRv6 TE Policy source path route published by node A includes the following first routing information: RouterID of node A, source IPv6 address of node A used for SRv6 encapsulation, and Segment list of path 1 in SRv6 TEPolicy configured for node A (here, Segment list is specifically: <21::1, 41::1). Figure 3An example of SRv6 TE Policy source path routing is also shown.

[0082] After any node in the SRv6 network receives the SRv6 TE Policy source path route, it determines whether the Segment list carried in the SRv6TEPolicy source path route contains the SID of the local node. If so, it generates a local source path routing table. The local source path routing table records the first routing information carried in the SRv6 TE Policy source path route: the RouterID of the head node, the source IPv6 address of the head node for SRv6 encapsulation, and the Segment list (<21::1, 41::1) of path 1 in the SRv6 TE Policy configured on the head node. Figure 4 After receiving the SRv6 TE Policy source path route, nodes B and D find that the segment list carried in the SRv6 TE Policy source path route contains the SID of the local node, and then generate a local source path routing table.

[0083] Of course, after any node in the SRv6 network receives an SRv6 TE Policy source path route, if it determines that the segment list carried by the SRv6 TE Policy source path route does not contain the SID of the local node, the SRv6 TE Policy source path route will not be processed. Figure 4 The node C shown in the figure determines that the segment list carried by the SRv6 TE Policy source path route does not contain the SID of the local node, and therefore does not process the SRv6 TE Policy source path route.

[0084] Node A, as the head node, sends a source path control detection message to other nodes on path 1 after confirming that the source path routes of the SRv6 TE Policy it publishes have reached other nodes on path 1. Figure 5 In this embodiment, node A confirms that the SRv6 TE Policy source path routes it publishes have reached other nodes on path 1 through time. For example, a set time period is determined based on experience. After node A publishes the SRv6 TE Policy source path routes, it confirms that the SRv6 TE Policy source path routes it publishes have reached other nodes on path 1 within the set time period.

[0085] In this embodiment, the source path control detection message encapsulates the IPv6 basic header, the SRv6 message header SRH, and the RouterID header;

[0086] The IPv6 basic header contains at least a source address field and a destination address field. The source address field carries the source IPv6 address of the head node for SRv6 encapsulation. The destination address field is the SID of the next node after the head node on path 1, namely, node B.

[0087] SRH at least includes: Routing Type field, Next Header field, Segment List field, SL field; Routing Type field carries a first value such as 254, which is used to indicate the source path control detection message; NextHeader field carries a second value such as 254, which is used to indicate that the next message header of SRH carries the RouterID of the head node; Segment List field carries the Segment List of the current path, and the Segment List includes the segment identifier SID of each node on the current path except the head node. The SL field carries the SL of 1. The RouterID header carries the RouterID of the head node.

[0088] like Figure 6 As shown, the B node on path 1 receives the source path control detection message, checks that the RoutingType field in the SRH carries the first value of 254 (decimal), and confirms that it is a source path control detection message. The B node parses the source path control detection message and obtains the following second routing information: source IPv6 address, segment list, and RouterID. The B node finds that the source IPv6 address, segment list, and RouterID in the second routing information match the source IPv6 address, segment list, and RouterID in the above-mentioned first routing information, respectively, and generates a source path strict control table that matches the first routing information.

[0089] like Figure 6 As shown, the source path control table matched by the above-mentioned first routing information includes at least: the input interface receiving the source path control detection message, the source IPv6 address carried by the source address field, the destination address carried by the destination address field, the Segment List carried by the source path control detection message, and the above-mentioned SL.

[0090] If node B is not the tail node of path 1, it forwards the source path control detection message based on the SRv6 TE Policy forwarding process. Specifically, node B modifies the source path control detection message as follows and continues to forward it: it modifies the destination address field in the source path control detection message to the node identifier of the next node after this node on the current path, and updates the number in the SL field. The updated number is 1 less than the number before the update. At this time, Figure 6As shown, the destination address field of the source path control detection message carries the SID of the D node, and the SL is 0.

[0091] like Figure 6 As shown, the D node on path 1 receives the source path control detection message, checks that the RoutingType field in the SRH carries the first value of 254 (decimal), and confirms that it is a source path control detection message. The D node parses the source path control detection message and obtains the following second routing information: source IPv6 address, segment list, and RouterID. The D node finds that the source IPv6 address, segment list, and RouterID in the second routing information match the source IPv6 address, segment list, and RouterID in the first routing information, respectively, and generates a source path strict control table that matches the first routing information.

[0092] like Figure 6 As shown, the source path control table matched by the above-mentioned first routing information includes at least: the input interface receiving the source path control detection message, the source IPv6 address carried by the source address field, the destination address carried by the destination address field, the Segment List carried by the source path control detection message, and the above-mentioned SL.

[0093] Node D is the tail node of path 1, and thus the source path control detection message is no longer forwarded.

[0094] Finally, all nodes except the head node on path 1 will generate source path control detection messages that match the first routing information. Afterwards, all nodes except the head node on path 1 will forward the received service messages based on the source path control detection messages that match the first routing information. Figure 8 Taking the B node shown as an example, after receiving the service message, the B node checks whether the interface of the received service message, the source IPv6 address and destination address of the service message, and the Segment List and SL of the service message are respectively matched with the input interface, source IPv6 address, destination address, Segment List, and SL in the source path control table. If so, the service message continues to be forwarded; if not, the service message is discarded.

[0095] In this embodiment, the SRv6 TE Policy source path route issued by the head node further includes: an identifier (ID) of the SRv6 TE Policy. Figure 7 Optionally, the value range of the SRv6 TE Policy ID is, for example, 1 to 65535. Any SRv6 TE Policy ID is used to uniquely identify an SRv6 TE Policy.

[0096] Based on this, after receiving the SRv6 TE Policy source path route, all other nodes except the head node on path 1 will identify whether the routing information associated with the above SRv6 TE Policy ID has been recorded. If not, the first routing information carried by the currently received SRv6 TE Policy source path route is associated with the SRv6 TE Policy ID and recorded; if yes, the routing information associated with the SRv6 TE Policy ID and the source path control table matched by the routing information are deleted, and the SRv6 TE Policy ID is associated with the first routing information carried by the currently received SRv6 TE Policy source path route and recorded. This realizes the timely update of routes. Figure 8 Gave a hint.

[0097] The method provided in the embodiment of the present application has been improved above. The device provided in the embodiment of the present application is described below:

[0098] See also Fig. 9 , Fig. 9 This is a diagram of the structure of the device provided in the embodiment of the present application. Figure 1 The device is applied to a network node, and the network node is used as a head node of an SRv6 traffic engineering policy TE Policy. The device includes:

[0099] A first sending unit is configured to send an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information used for forwarding messages on the current path, so that any node on the current path other than the head node records the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route;

[0100] A second sending unit is used to send a source path control detection message for detecting the current path to other nodes on the current path; the source path control detection message carries the second routing information for forwarding messages on the current path, so that when any node other than the head node on the current path recognizes that the second routing information carried by the source path control detection message matches the recorded first routing information, a source path control table matching the first routing information is generated; any node other than the head node on the current path is used to forward the received service message based on the generated source path control table to suppress network attacks.

[0101] As an embodiment, the first routing information includes: a routing identifier RouterID of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a segment list Segment List; the Segment List includes a segment identifier SID of each node on the current path except the head node;

[0102] The second routing information includes: a routing identifier RouterID of the head node, a source IPv6 address of the head node used for SRv6 encapsulation, and a segment list Segment List of the current path, where the Segment List contains segment identifiers SIDs of each node on the current path except the head node.

[0103] As an embodiment, the source path control detection message encapsulates an IPv6 basic header, an SRv6 message header SRH, and a RouterID header;

[0104] The IPv6 basic header at least includes a source address field, and the source address field carries the source IPv6 address of the head node for SRv6 encapsulation;

[0105] The SRH at least includes: a Routing Type field, a Next Header field, and a Segment List field; the Routing Type field carries a first value, and the first value is used to indicate a source path control detection message; the Next Header field carries a second value, and the second value is used to indicate that the next message header of the SRH carries the routing identifier RouterID of the head node; the Segment List field carries the Segment List of the current path, and the Segment List includes the segment identifier SID of each node on the current path except the head node;

[0106] The RouterID header carries the routing identifier RouterID of the head node;

[0107] The second routing information includes: the routing identifier RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

[0108] As an embodiment, when the current path is abnormal, the first sending unit further uses the backup path serving as the current path in the SRv6 TE Policy as the current path, and returns to the step of sending the SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy.

[0109] As an embodiment, the SRv6 TE Policy source path routing further includes: an identification ID of the SRv6 TE Policy;

[0110] The SRv6 TE Policy ID is used to enable: after receiving the SRv6 TE Policy source path route, any node other than the head node on the current path associates and records the first routing information carried by the currently received SRv6 TE Policy source path route with the SRv6 TE Policy ID if it is found that the SRv6 TE Policy ID is not recorded; if the SRv6 TE Policy ID has been recorded, delete the routing information associated with the SRv6 TE Policy ID and the source path control table matched by the routing information, and associate and record the SRv6 TE Policy ID with the first routing information carried by the currently received SRv6 TEPolicy source path route.

[0111] The present application embodiment also provides another device structure diagram. Fig.10 , Fig.10 Another device structure diagram provided in the embodiment of the present application. The device corresponds to Figure 2 The device is applied to a network node, which is any node other than the head node of the SRv6 traffic engineering policy TE Policy, and includes:

[0112] a receiving unit, configured to receive an SRv6 TE Policy source path route sent by a head node of the SRv6 TE Policy for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information for forwarding messages on the current path;

[0113] a routing unit, configured to identify whether the node is on the current path, and if so, record the first routing information carried by the SRv6 TEPolicy source path routing;

[0114] The receiving unit is further used to receive a source path control detection message sent by the head node; the source path control detection message carries the second routing information used for the current path forwarding message;

[0115] a processing unit, configured to generate a source path control table matching the first routing information if it is identified that the second routing information carried by the source path control detection message matches the recorded first routing information;

[0116] The service control unit is used to control the forwarding of service messages received by the node based on the source path control table to suppress network attacks.

[0117] As an embodiment, the first routing information at least includes: a segment list Segment List; the Segment List includes the segment identifier SID of each node on the current path except the head node;

[0118] The identifying whether the node is in the current path includes: identifying whether the segment identifier SID of the node is in the Segment List; if so, determining that the node is in the current path; otherwise, determining that the node is not in the current path.

[0119] As an embodiment, the first routing information includes: a routing identifier RouterID of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a segment list Segment List; the Segment List includes a segment identifier SID of each node on the current path except the head node;

[0120] The second routing information includes: a routing identifier RouterID of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a segment list Segment List of the current path, where the Segment List includes a segment identifier SID of each node on the current path except the head node;

[0121] The identifying that the second routing information carried by the source path control detection message matches the recorded first routing information includes: if the RouterID carried by the source path control detection message and the RouterID in the recorded first routing information meet the first set matching requirement, the source IPv6 address carried by the source path control detection message and the source IPv6 address in the recorded first routing information meet the second set matching requirement, and the Segment List carried by the source path control detection message and the Segment List in the recorded first routing information meet the third set matching requirement, then it is determined that the second routing information carried by the source path control detection message matches the recorded first routing information.

[0122] As an embodiment, the receiving a source path control detection message sent by the head node for detecting the current path includes:

[0123] Receiving a message sent by the head node;

[0124] If the message type carried by the message is a first value, and the first value is used to indicate a source path control detection message, it is determined that the source path control detection message sent by the head node is received.

[0125] As an embodiment, the source path control detection message encapsulates an IPv6 basic header, an SRv6 message header SRH, and a RouterID header;

[0126] The IPv6 basic header at least includes a source address field, and the source address field carries the source IPv6 address of the head node for SRv6 encapsulation;

[0127] The SRH at least includes: a Routing Type field, a Next Header field, and a Segment List field; the Routing Type field carries a first value, and the first value is used to indicate a source path control detection message; the Next Header field carries a second value, and the second value is used to indicate that the next message header of the SRH carries the routing identifier RouterID of the head node; the Segment List field carries the Segment List of the current path, and the Segment List includes the segment identifier SID of each node on the current path except the head node;

[0128] The RouterID header carries the routing identifier RouterID of the head node;

[0129] The second routing information includes at least: the routing identifier RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

[0130] As an embodiment, the IPv6 basic header further includes a destination address field; the SRH further includes: an SL field, the SL field carries an SL, the SL indicates the number of remaining segment identifiers SIDs in the Segment List, and the remaining segment identifiers SIDs refer to the segment identifiers SIDs corresponding to the nodes that the source path control detection message has not passed through;

[0131] The source path control table matched by the first routing information includes at least: the interface receiving the source path control detection message, the source IPv6 address carried by the source address field, the destination address carried by the destination address field, the Segment List carried by the source path control detection message, and the SL;

[0132] The forwarding control of the service message received by this node based on the source path control table includes: checking whether the interface receiving the service message, the source IPv6 address and destination address of the service message encapsulated, and the Segment List and SL of the service message encapsulated match the input interface, source IPv6 address, destination address, Segment List, and SL in the source path control table respectively; if so, continue to forward the service message; if not, discard the service message.

[0133] As an embodiment, the processing unit is further used to make the following modifications to the source path control detection message and continue forwarding it when the network node is not the last node of the current path: modify the destination address field in the source path control detection message to the node identifier of the next node after the current node on the current path, and update the number in the SL field, wherein the updated number is 1 less than the number before the update.

[0134] As an embodiment, the SRv6 TE Policy source path routing further includes: an identification ID of the SRv6 TE Policy;

[0135] The recording of the first routing information carried by the SRv6 TE Policy source path route includes: identifying whether routing information associated with the SRv6 TE Policy ID is currently recorded, and if not, associating and recording the first routing information carried by the currently received SRv6 TE Policy source path route with the SRv6 TE Policy ID; if yes, deleting the routing information associated with the SRv6 TE Policy ID and the source path control table matched by the routing information, and associating and recording the SRv6 TEPolicy ID with the first routing information carried by the currently received SRv6 TE Policy source path route.

[0136] The present application also provides Fig. 9 or Fig.10 The hardware structure of the device shown. Fig.11 , Fig.11 This is a structural diagram of an electronic device provided in an embodiment of the present application. Fig.11 As shown, the hardware structure may include: a processor and a machine-readable storage medium, the machine-readable storage medium storing machine-executable instructions that can be executed by the processor; the processor is used to execute the machine-executable instructions to implement the method disclosed in the above example of this application.

[0137] Based on the same application concept as the above method, an embodiment of the present application also provides a machine-readable storage medium, on which a number of computer instructions are stored. When the computer instructions are executed by a processor, the method disclosed in the above example of the present application can be implemented.

[0138] Exemplarily, the above-mentioned machine-readable storage medium can be any electronic, magnetic, optical or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, the machine-readable storage medium can be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state drive, any type of storage disk (such as CD, DVD, etc.), or similar storage medium, or a combination thereof.

[0139] The above is only an embodiment of the present application and is not intended to limit the present application. For those skilled in the art, the present application may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A message forwarding method, characterized in that: The method is applied to a network node, and the method comprises: The network node, as a head node of the SRv6 traffic engineering policy TE Policy, sends an SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information used for forwarding packets on the current path, so that any node on the current path except the head node records the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route; The network node acts as the head node and sends a source path control detection message for detecting the current path to other nodes on the current path; the source path control detection message carries the second routing information for forwarding messages on the current path, so that when any node other than the head node on the current path identifies that the second routing information carried by the source path control detection message matches the recorded first routing information, a source path control table matching the first routing information is generated; any node other than the head node on the current path is used to perform forwarding control on the received service message based on the generated source path control table.

2. The method according to claim 1, characterized in that: The first routing information includes: a routing identifier RouterID of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a segment list Segment List; the Segment List includes a segment identifier SID of each node on the current path except the head node; The second routing information includes: a routing identifier RouterID of the head node, a source IPv6 address of the head node used for SRv6 encapsulation, and a segment list Segment List of the current path, where the Segment List contains segment identifiers SIDs of each node on the current path except the head node.

3. The method according to claim 1 or 2, characterized in that: The source path control detection message encapsulates an IPv6 basic header, an SRv6 message header SRH, and a RouterID header; The IPv6 basic header at least includes a source address field, and the source address field carries the source IPv6 address of the head node for SRv6 encapsulation; The SRH at least includes: a Routing Type field, a Next Header field, and a Segment List field; the Routing Type field carries a first value, and the first value is used to indicate a source path control detection message; the Next Header field carries a second value, and the second value is used to indicate that the next message header of the SRH carries the routing identifier RouterID of the head node; the Segment List field carries the Segment List of the current path, and the Segment List includes the segment identifier SID of each node on the current path except the head node; The RouterID header carries the routing identifier RouterID of the head node; The second routing information includes: the routing identifier RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

4. The method according to claim 1, characterized in that: The method further comprises: The network node serves as the head node, and when the current path is abnormal, uses the backup path serving as the current path in the SRv6 TE Policy as the current path, and returns to the step of sending the SRv6 TE Policy source path route to other nodes on a current path included in the SRv6 TE Policy.

5. The method according to claim 1 or 4, characterized in that: The SRv6 TE Policy source path route further includes: an SRv6 TE Policy identification ID; The SRv6 TE PolicyID is used to enable: after receiving the SRv6 TE Policy source path route, any node other than the head node on the current path associates and records the first routing information carried by the currently received SRv6 TE Policy source path route with the SRv6 TE PolicyID if it is found that the SRv6 TE Policy ID is not recorded; if the SRv6 TE PolicyID has been recorded, delete the routing information associated with the SRv6 TE Policy ID and the source path control table matched by the routing information, and associate and record the SRv6 TE PolicyID with the first routing information carried by the currently received SRv6 TE Policy source path route.

6. A message forwarding method, characterized in that: The method is applied to a network node, and the method comprises: The network node is any node other than the head node of the SRv6 traffic engineering policy TE Policy, then: receiving an SRv6 TE Policy source path route sent by the head node of the SRv6 TE Policy for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information for forwarding messages on the current path; Identify whether the node is on the current path, and if so, record the first routing information carried by the SRv6 TE Policy source path route; receiving a source path control detection message sent by the head node; the source path control detection message carries second routing information for the current path forwarding message; if it is identified that the second routing information carried by the source path control detection message matches the recorded first routing information, generating a source path control table matching the first routing information; Based on the source path control table, forwarding control is performed on the service messages received by the node.

7. The method according to claim 6, characterized in that The first routing information at least includes: a segment list Segment List; the Segment List includes the segment identifier SID of each node on the current path except the head node; The identifying whether the node is in the current path includes: identifying whether the segment identifier SID of the node is in the Segment List; if so, determining that the node is in the current path; otherwise, determining that the node is not in the current path.

8. The method according to claim 6, characterized in that The first routing information includes: a routing identifier RouterID of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a segment list Segment List; the Segment List includes a segment identifier SID of each node on the current path except the head node; The second routing information includes: a routing identifier RouterID of the head node, a source IPv6 address of the head node for SRv6 encapsulation, and a segment list Segment List of the current path, where the Segment List includes a segment identifier SID of each node on the current path except the head node; The identifying that the second routing information carried by the source path control detection message matches the recorded first routing information includes: if the RouterID carried by the source path control detection message and the RouterID in the recorded first routing information meet the first set matching requirement, the source IPv6 address carried by the source path control detection message and the source IPv6 address in the recorded first routing information meet the second set matching requirement, and the Segment List carried by the source path control detection message and the Segment List in the recorded first routing information meet the third set matching requirement, then it is determined that the second routing information carried by the source path control detection message matches the recorded first routing information.

9. The method according to claim 6, characterized in that The receiving the source path control detection message sent by the head node for detecting the current path includes: Receiving a message sent by the head node; If the message type carried by the message is a first value, and the first value is used to indicate a source path control detection message, it is determined that the source path control detection message sent by the head node is received.

10. The method according to claim 9, characterized in that The source path control detection message encapsulates an IPv6 basic header, an SRv6 message header SRH, and a RouterID header; The IPv6 basic header at least includes a source address field, and the source address field carries the source IPv6 address of the head node for SRv6 encapsulation; The SRH at least includes: a Routing Type field, a Next Header field, and a Segment List field; the Routing Type field carries a first value, and the first value is used to indicate a source path control detection message; the Next Header field carries a second value, and the second value is used to indicate that the next message header of the SRH carries the routing identifier RouterID of the head node; the Segment List field carries the Segment List of the current path, and the Segment List includes the segment identifier SID of each node on the current path except the head node; The RouterID header carries the routing identifier RouterID of the head node; The second routing information includes at least: the routing identifier RouterID of the head node carried by the RouterID header, the Segment List carried by the Segment List field, and the source IPv6 address carried by the source address field.

11. The method according to claim 10, characterized in that The IPv6 basic header also includes a destination address field; the SRH also includes: an SL field, the SL field carries an SL, the SL indicates the number of remaining segment identifiers SID in the Segment List, and the remaining segment identifier SID refers to the segment identifier SID corresponding to the node that the source path control detection message has not passed through; The source path control table matched by the first routing information includes at least: the interface receiving the source path control detection message, the source IPv6 address carried by the source address field, the destination address carried by the destination address field, the Segment List carried by the source path control detection message, and the SL; The forwarding control of the service message received by this node based on the source path control table includes: checking whether the interface receiving the service message, the source IPv6 address and destination address of the service message encapsulated, and the Segment List and SL of the service message encapsulated match the input interface, source IPv6 address, destination address, Segment List, and SL in the source path control table respectively; if so, continue to forward the service message; if not, discard the service message.

12. The method according to claim 11, characterized in that The method further comprises: When the network node is not the last node of the current path, the source path control detection message is modified as follows and continues to forward: the destination address field in the source path control detection message is modified to be the node identifier of the next node after the current node on the current path, and the number in the SL field is updated, and the updated number is 1 less than the number before the update.

13. The method according to claim 6, characterized in that The SRv6 TE Policy source path route further includes: an SRv6 TE Policy identification ID; The network node recording the first routing information carried by the SRv6 TE Policy source path route includes: identifying whether routing information associated with the SRv6 TE Policy ID is currently recorded, and if not, associating and recording the first routing information carried by the currently received SRv6 TE Policy source path route with the SRv6 TE Policy ID; if yes, deleting the routing information associated with the SRv6 TE Policy ID and the source path control table matched by the routing information, and associating and recording the SRv6 TE Policy ID with the first routing information carried by the currently received SRv6 TE Policy source path route.

14. A message forwarding device, characterized in that: The device is applied to a network node, the network node being a head node of an SRv6 traffic engineering policy TE Policy, and the device includes: A first sending unit is configured to send an SRv6 TE Policy source path route to other nodes on the current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information used for forwarding messages on the current path, so that any node on the current path other than the head node records the first routing information carried by the SRv6 TE Policy source path route after receiving the SRv6 TE Policy source path route; A second sending unit is used to send a source path control detection message for detecting the current path to other nodes on the current path; the source path control detection message carries second routing information for forwarding messages on the current path, so that when any node other than the head node on the current path recognizes that the second routing information carried by the source path control detection message matches the recorded first routing information, a source path control table matching the first routing information is generated; any node other than the head node on the current path is used to forward the received service message based on the generated source path control table.

15. A message forwarding device, characterized in that: The device is applied to a network node, which is any node other than the head node of the SRv6 traffic engineering policy TE Policy. The device includes: a receiving unit, configured to receive an SRv6 TE Policy source path route sent by a head node of the SRv6 TE Policy for a current path included in the SRv6 TE Policy; the SRv6 TE Policy source path route carries first routing information for forwarding messages on the current path; a routing unit, configured to identify whether the node is on the current path, and if so, record the first routing information carried by the SRv6 TEPolicy source path routing; The receiving unit is further used to receive a source path control detection message sent by the head node; the source path control detection message carries the second routing information used for the current path forwarding message; a processing unit, configured to generate a source path control table matching the first routing information if it is identified that the second routing information carried by the source path control detection message matches the recorded first routing information; The service control unit is used to control the forwarding of service messages received by the node based on the source path control table.

Images