Data message transmission method, transmission authorization method and electronic equipment

Abstract

The invention discloses a data message transmission method, a transmission authorization method and electronic equipment. The data message transmission method comprises the following steps: acquiring first verification information; under the condition that a first data message is received, obtaining to-be-verified information based on the first data message; verifying the to-be-verified information based on the first verification information; and transmitting the first data message under the condition that the verification is passed.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of network security, and in particular to a data message transmission method, a transmission authorization method, and an electronic device. Background Art

[0002] With the continuous progress of society and the continuous development of economy, the network has become an indispensable part of people's daily life. In the process of network cloudification / ubiquitization evolution, the integration of business-oriented (To Business, 2B) services and ordinary user (To Customer, 2C) services, the openness of the network has led to an increasing risk of data information exposure, and the means of network attacks have continued to escalate. The traditional "patch-style" security protection model has problems such as rigid structure, late awareness, and lack of coordination. In addition, the stacked and reinforced security architecture relies on a passive protection model of prior information, which is difficult to meet the new network security protection needs.

[0003] Network security protection in related technologies usually uses special protection equipment such as external firewalls to protect the target, such as Figure 1 However, this network security protection method has the problem of delayed protection and low efficiency. Summary of the invention

[0004] The embodiments of the present application provide a data message transmission method, a transmission authorization method, and an electronic device, which can solve the problem of lagging and inefficient network security protection in related technologies.

[0005] In order to solve the above technical problems, this application is implemented as follows:

[0006] In a first aspect, a method for transmitting a data message is provided, which is applied to a transmission node between an initiator and a receiver, the method comprising: obtaining first verification information; upon receiving a first data message, obtaining information to be verified based on the first data message; verifying the information to be verified based on the first verification information; and transmitting the first data message when the verification passes.

[0007] In the second aspect, a method for authorizing the transmission of a data message is provided, the method comprising: a control node determines, based on the initiator information and the receiver information, that an initiator corresponding to the initiator information is allowed to access a receiver corresponding to the receiver information; the control node sends first verification information to the initiator or a transmission node between the initiator and the receiver.

[0008] In a third aspect, an electronic device is provided, comprising a processor and a memory, wherein the memory stores programs or instructions that can be run on the processor, and when the program or instructions are executed by the processor, the steps of the data message transmission method as described in the first aspect are implemented, or the steps of the data message transmission authorization method as described in the second aspect are implemented.

[0009] In a fourth aspect, a readable storage medium is provided, on which a program or instruction is stored. When the program or instruction is executed by a processor, the steps of the data packet transmission method as described in the first aspect are implemented, or the steps of the data packet transmission authorization method as described in the second aspect are implemented.

[0010] The technical solution provided by this application may have the following beneficial effects:

[0011] In an embodiment of the present application, the transmission node obtains first verification information from the control node and obtains information to be verified from the received first data packet, and verifies the information to be verified according to the first verification information to determine whether there is any abnormality in the data transmission of the current network. If the information to be verified passes the verification, it can be determined that there is no abnormality in the data transmission of the current first data packet, and the data transmission of the network is normal. The first data packet can be transmitted through the current transmission node. The data packet can be verified in time at the transmission node during the transmission of the data packet, instead of performing security protection until the data packet is transmitted to a nearby receiving end, thereby solving the problem of delayed and inefficient network security protection.

[0012] It should be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present application. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0014] Figure 1 A schematic diagram of the structure of a network security protection system in the related art is shown;

[0015] Figure 2 A schematic diagram of the structure of a distributed security protection system provided by an exemplary embodiment of the present application is shown;

[0016] Figure 3 A schematic diagram showing a flow chart of a data message transmission method provided by an exemplary embodiment of the present application;

[0017] Figure 4A schematic diagram of a flow chart of a data message transmission authorization method provided by an exemplary embodiment of the present application is shown;

[0018] Figure 5 A schematic diagram of a flow chart of another data message transmission authorization method provided by an exemplary embodiment of the present application is shown;

[0019] Figure 6 A schematic flow chart of another data message transmission method provided by an exemplary embodiment of the present application is shown;

[0020] Figure 7 A schematic diagram of a flow chart of another data message transmission authorization method provided by an exemplary embodiment of the present application is shown;

[0021] Figure 8 A schematic flow chart of another data message transmission method provided by an exemplary embodiment of the present application is shown;

[0022] Fig. 9 A schematic diagram of a flow chart of another data message transmission authorization method provided by an exemplary embodiment of the present application is shown;

[0023] Fig.10 A schematic flow chart of another data message transmission method provided by an exemplary embodiment of the present application is shown;

[0024] Fig.11 A schematic diagram of a flow chart of another data message transmission authorization method provided by an exemplary embodiment of the present application is shown;

[0025] Fig.12 A schematic flow chart of another data message transmission method provided by an exemplary embodiment of the present application is shown;

[0026] Fig.13 A schematic structural diagram of an electronic device provided by an exemplary embodiment of the present application is shown. DETAILED DESCRIPTION

[0027] Exemplary embodiments will be described in detail herein, examples of which are shown in the accompanying drawings. When the following description refers to the drawings, the same numbers in different drawings represent the same or similar elements unless otherwise indicated. The implementations described in the following exemplary embodiments do not represent all implementations consistent with the present application. Instead, they are merely examples of devices and methods consistent with some aspects of the present application as detailed in the appended claims.

[0028] Figure 2 FIG. 1 shows a schematic diagram of a distributed security protection system provided by an exemplary embodiment of the present application. Figure 2The distributed security protection system 200 includes a control node 21, an initiator 22, a receiver 23, and a transmission node 24. The transmission node 24 may include a first transmission node 241 and a second transmission node 242, and the first transmission node 241 and the second transmission node 242 may be used as security protection points for security protection. The embodiment of the present application is described by taking two transmission nodes as an example, but is not limited to two transmission nodes.

[0029] The distributed security protection system provided by the embodiment of the present application can verify the data message currently required to be transmitted at any transmission node between the initiator and the receiver, so that security protection can be performed at any transmission node, rather than concentrated near the receiving end, thereby dispersing the pressure of a single protection point and effectively solving the problem of delayed and inefficient network security protection.

[0030] Figure 3 A flow chart of a data message transmission method provided by an exemplary embodiment of the present application is shown, which is applied to a transmission node between an initiator and a receiver in the above system. The method includes the following steps.

[0031] Step 302, obtaining first verification information.

[0032] Optionally, the first verification information is sent by the control node to the transmission node after confirming the initiator information and the receiver information. The first verification information may include a key, a parameter value of a verification input, and policy information. The first verification information is used to verify the information to be verified.

[0033] Step 304: upon receiving the first data message, obtaining information to be verified based on the first data message.

[0034] The data message may include initiator information, receiver information, a slice identifier of the data packet, an enterprise identifier, and a tunnel identifier. The information to be verified includes at least one of them.

[0035] Step 306: verify the information to be verified based on the first verification information.

[0036] Among them, the transmission node verifies the information to be verified obtained from the first data message to be transmitted according to the first verification information obtained from the control node, and can know whether the first data message is correct, or whether the first data message has been attacked and tampered with during the previous transmission process, or whether the first data message is consistent with the first data message originally transmitted by the sending end, thereby performing security protection for data transmission in the network and preventing tampered or erroneous data messages from being transmitted normally to the receiving end.

[0037] Step 308: If the verification is successful, transmit the first data message.

[0038] Optionally, when there are multiple transmission nodes, if the verification is successful, the first data message is transmitted to the next transmission node of the current transmission node, and verification is performed again.

[0039] In an embodiment of the present application, the transmission node obtains the first verification information from the control node and obtains the information to be verified from the received first data message, verifies the information to be verified according to the first verification information, and determines whether the first data message is correct, or whether it has been tampered with during the transmission process, or whether it is consistent with the first data message initially sent by the initiator, so as to determine whether the data transmission of the network is abnormal. And if the information to be verified passes the verification, it can be determined that the data transmission of the current first data message is not abnormal, the data transmission of the network is normal, and the first data message can be transmitted through the current transmission node. If the information to be verified does not pass, the first data message can be discarded or refused to be transmitted, so as to avoid transmitting the wrong or tampered first data message to the next transmission node or even to the receiving end. The security protection during the transmission of the first data message is verified in time at the transmission node, rather than until the data message is transmitted to the receiving end, the security protection is performed, so as to solve the problem of delayed and inefficient network security protection.

[0040] In one implementation, the above-mentioned step 302 of obtaining the first verification information may include: the transmission node receiving a first message sent by the control node, wherein the first message carries the first verification information; or, the transmission node obtaining the first verification information configured on the transmission node.

[0041] Among them, before verifying the received data message, the transmission node needs to obtain the first verification information. The first verification information can be obtained by receiving the first message sent by the control node based on the initiator information and the receiver information. The message carries the first verification information, that is, the transmission node obtains the first verification information through the first message sent by the control node. Or the first verification information is pre-configured for the transmission node before the transmission of the first data message. Before the transmission node needs to verify the information to be verified, the transmission node obtains the first verification information configured in the transmission node, and verifies the information to be verified obtained from the first data message based on the first verification information obtained above, so as to determine whether the first data message to be transmitted is consistent with the first data message initially transmitted by the initiator, thereby determining whether the first data message has an abnormality in the previous transmission process, and realizing network security protection.

[0042] In an implementation, before the transmission node receives the first message sent by the control node, the method may further include: the transmission node sending a second message to the control node, wherein the second message is used to request the first verification information.

[0043] In an embodiment of the present application, the transmission node needs to obtain the first verification information before verifying the information to be verified. The transmission node can send a second message to the control node, request the first verification information from the control node through the second message, and the control node receives the second message and after determining the initiator message and the receiver message, sends the first message to the transmission node, and the first message carries the first verification information. The transmission node sends the second message to request the control node to send the second message carrying the first verification information, so that the control node sends the second message carrying the first verification information when there is a verification requirement, so as to save signaling overhead.

[0044] In one implementation, the above-mentioned transmission node sending the second message to the control node may include: the transmission node sending the second message to the control node after receiving the second data packet, wherein the second message carries the initiator information and the receiver information of the second data packet; or, the transmission node sending the second message to the control node after being powered on.

[0045] In an embodiment of the present application, the situation that triggers the transmission node to send the second message requesting the first verification information to the control node may include that the transmission node receives the second data message, or the transmission node is powered on. That is, after the transmission node is powered on, it immediately sends the second message for requesting the first verification information to the control node, so that it can be quickly called when verification is required for verification. Or the transmission node sends the second message for requesting the first verification information to the control node only when it receives the second data message, so as to save signaling overhead.

[0046] In one implementation, the above-mentioned initiator information includes at least one of the following: initiator identifier, initiator Internet Protocol (IP), initiator address segment, initiator port, and media access control (MAC); the above-mentioned receiving end information includes at least one of the following: receiving end identifier, receiving end IP, receiving end address segment, receiving end port, and MAC.

[0047] In an embodiment of the present application, the transmission node informs the control node through a second message based on the information carried by the received second data message, such as the initiator information and the receiver information, so that the control node confirms the initiator and the receiver based on the initiator information and the receiver information of the second data message, and then sends the first message carrying the first verification information to the transmission node after confirmation. The control node can send the first verification information corresponding to the second data message to the transmission node based on the initiator message and the receiver message of the second data message carried by the second message sent by the transmission node, rather than the verification information for the data message transmitted by other initiators, thereby ensuring the validity of the verification.

[0048] In one implementation, after the above-mentioned transmission node receives the first message sent by the control node, the method may also include: when the transmission node is a first transmission node, based on the second transmission node information carried in the first message, sending second verification information to the second transmission node, wherein, on the transmission path from the initiator to the receiving end, the first transmission node is located before the second transmission node.

[0049] Among them, the second transmission node information includes at least one of the following: the second transmission node IP, the second transmission node input interface, the second transmission node output interface, the virtual local area network (Virtual Local Area Network, VLAN) identifier of the second transmission node, the VXLAN identifier of the second transmission node, and the VXLAN network identifier (VXLAN Network Identifier, VNI) of the second transmission node.

[0050] Optionally, the first message carries first indication information, and the first indication information is used to indicate the node type of the transmission node. Thus, the node type of the transmission node can be determined by the first indication information carried in the first message, so as to determine whether the transmission verification information needs to be determined.

[0051] In an embodiment of the present application, the node type of the transmission node may include a first transmission node and a second transmission node, and the first transmission node is located before the second transmission node. It can also be understood that the first transmission node is closer to the initiator than the second transmission node, and the second transmission node is closer to the receiving end than the first transmission node. When the first transmission node receives a first message carrying first verification information sent by the control node, and the first data packet needs to be verified at the second transmission node after passing the verification of the first transmission node, the first transmission node sends the second verification information to the second transmission node based on the second transmission node information carried in the first message. At this time, the second verification information of the second transmission node for verifying the information to be verified does not need to be requested to the control node again, and can be sent by the first transmission node and obtained to save signaling overhead.

[0052] In one implementation, the above-mentioned acquisition of the first verification information may include, when the transmission node is a second transmission node, receiving a third message sent by the first transmission node, wherein the third message carries the first verification information, and on the transmission path from the initiator to the receiving end, the first transmission node is located before the second transmission node.

[0053] In the embodiment of the present application, the method of obtaining the first verification information is different based on the different node types of the transmission node. When the node type is the first transmission node, the first verification information can be obtained by requesting the control node for the first verification information, or obtaining the configured first verification information. When the node type is the second transmission node, the first verification information can be obtained by receiving a third message carrying the first verification information sent by the first transmission node, or obtaining the configured first verification information.

[0054] Optionally, the second transmission node may obtain the first verification information not through the third message sent by the first transmission node, but may also request the first verification information from the control node.

[0055] In one implementation, the first data message carries a first verification code; the first verification information includes a key and a verification input parameter; then the verification of the information to be verified based on the first verification information may include the following steps:

[0056] Step 1, obtaining the parameter value of the verification input parameter of the first data message;

[0057] Step 2, performing calculation based on the key and the obtained parameter value to obtain a second verification code;

[0058] Step 3: Verify whether the first verification code carried in the first data message matches the obtained second verification code.

[0059] In an embodiment of the present application, the transmission node uses, for example, a cryptographic algorithm to calculate the key and the parameter value of the verification input in the first verification information to obtain a second verification code. Then, based on the first verification information, verification of the information to be verified can be performed by verifying whether the first verification code obtained from the first data message matches the second verification code to determine whether the information to be verified passes the verification.

[0060] In one implementation, by verifying whether the first verification code carried in the first data message matches the obtained second verification code, when the verification passes, transmitting the first data message may include: when the transmission node is the first transmission node, when the verification passes, after adding the first transmission node information to the first data message, transmitting the first data message to the second transmission node, wherein, on the transmission path from the receiving end to the receiving end, the first transmission node is located before the second transmission node.

[0061] Among them, the first transmission node information includes at least one of the following: the first transmission node IP, the first transmission node input interface, the first transmission node output interface, the VLAN identifier of the first transmission node, the VXLAN identifier of the first transmission node, and the VXLAN network identifier VNI of the first transmission node.

[0062] In an embodiment of the present application, when the transmission node is the first transmission node and the verification is passed, the first transmission node needs to add the first transmission node information in the first data message and then transmit the first data message to the second transmission node, so that the second transmission node can obtain the second verification information from the first transmission node without requesting the control node to save signaling overhead.

[0063] In one implementation, the first verification information may include: a verification value of a verification input parameter. The information to be verified obtained by the transmission node based on the first data message may include a parameter value of the verification input parameter of the first data message. The transmission node may verify whether the parameter value of the verification input parameter of the first data message matches the verification value in the first verification information to determine whether the information to be verified passes the verification. The information to be verified can be verified quickly without the need for complex calculations of keys and parameter values, thereby improving the efficiency of verification.

[0064] In one implementation, the first verification information includes: policy information, wherein the policy information includes: authorization result, and the authorization result includes one of the following: allowing transmission, not allowing transmission, or refusing transmission. Then, the verification of the information to be verified based on the first verification information may include one of the following:

[0065] (1) verifying whether the initiator and the receiver of the first data message match the initiator and the receiver allowed to be transmitted in the authorization result;

[0066] (2) verifying whether the initiator and the receiver of the first data message match the initiator and the receiver that are not allowed to transmit in the authorization result;

[0067] (3) Verify whether the initiator and the receiver of the first data message match the initiator and the receiver of the transmission rejection in the authorization result.

[0068] In an embodiment of the present application, the first verification information may include policy information, wherein the policy information may include: authorization result. The authorization result includes a variety of situations, such as allowing transmission, not allowing transmission, or refusing transmission. Accordingly, the information to be verified is verified based on the first verification information, which may include at least one of the above (1)(2)(3), comprehensively considering the verification under various authorization results and ensuring the reliability of security protection.

[0069] In one implementation, the above-mentioned policy information may also include a first value of a verification input parameter, and the verification of the information to be verified based on the first verification information may include: when the initiator and the receiver of the first data message match the initiator and the receiver in the authorization result, verifying whether the second value of the verification input parameter of the first data message matches the first value of the verification input parameter.

[0070] In an embodiment of the present application, the policy information includes the authorization result and may also include the first value of the verification input parameter. When the initiator and the receiver of the first data message match the initiator and the receiver in the authorization result, it is possible to determine whether the information to be verified has passed the verification by verifying whether the second value of the verification input parameter of the first data message matches the first value of the verification input parameter. That is, for the verification of the first data message whose initiator and the receiver in the authorization result match, it is possible to directly determine whether the verification has passed by matching the first value of the verification input parameter in the policy information with the second value of the verification input parameter of the first data message, thereby improving the efficiency of security protection.

[0071] In one implementation, the above-mentioned verification input parameters include at least one of the following: the initiator information, the receiving end information, the first transmission node information, the second transmission node information, the slice identifier, the enterprise identifier, and the tunnel identifier.

[0072] Among them, the transmission node can match the above information included in the verification input parameters in the first data message with the above information included in the verification input parameters in the policy information, so as to accurately determine whether the information of the two matches, thereby accurately determining whether the information to be verified has passed the verification.

[0073] In one implementation, the initiating end includes a terminal and a network side device; the receiving end includes a terminal and a network side device; wherein the network side device includes one of the following: a server, a manager, a controller, and an access gateway; the transmission node includes one of the following: a router, a switch, a gateway, and a customer premises equipment (CPE).

[0074] Figure 4 A flow chart of a data message transmission authorization method provided by an exemplary embodiment of the present application is shown, which is applied to a control node in the above system. The method includes the following steps.

[0075] Step 402: The control node determines, based on the initiator information and the receiver information, that the initiator corresponding to the initiator information is allowed to access the receiver corresponding to the receiver information.

[0076] The initiator information and the receiver information may be sent to the control node through the initiator or through the transmission node. The control node authorizes the initiator and the receiver according to the received initiator information and the receiver information.

[0077] Step 404: The control node sends first verification information to the initiator or a transmission node between the initiator and the receiver.

[0078] In an embodiment of the present application, after the control node determines that the initiator corresponding to the initiator information is allowed to access the receiver corresponding to the receiver information, it can send first verification information to the initiator or the transmission node between the initiator and the receiver. The initiator transmits a first data packet carrying the first verification information to the transmission node, so that the transmission node performs subsequent verification based on the first verification information obtained from the control node and the first verification information carried by the first data packet.

[0079] In an implementation manner, before the above step 402, the above method for authorizing transmission of data packets may further include: receiving an authorization request sent by the initiator or the transmission node.

[0080] The authorization request carries the initiator information and the receiver information. After receiving the authorization request initiated by the initiator or the transmission node, the control node determines the authorization status of the sender and the receiver according to the initiator information and the receiver information carried in the authorization request, and then further generates the first verification information, and then sends it to the initiator or the transmission node. Then the transmission node can perform verification based on the first verification information obtained from the control node and the information to be verified of the first data message.

[0081] In one implementation, the control node sending the first verification information to the initiator in step 404 may include:

[0082] Step 4041: The control node calculates a first verification code based on the key and a first value of a verification input parameter corresponding to the receiving end that allows the initiating end to access the receiving end;

[0083] Step 4042: The control node sends the authorization response to the initiator, wherein the authorization response carries the first verification code.

[0084] In an embodiment of the present application, after receiving the authorization request sent by the initiator, the control node calculates a first verification code based on the key and the first value of the verification input parameter corresponding to the receiving end that allows the initiator to access the receiving end, using, for example, a cryptographic algorithm, and carries the first verification code in the authorization response to send it to the initiator, so that security verification can be achieved at the transmission node by verifying the first verification code.

[0085] In one implementation, in one implementation, the above-mentioned step 404 of the control node sending the first verification information to the transmission node may include: the control node sending a first message to the transmission node, wherein the first message carries the initiator information and the receiver information.

[0086] In an embodiment of the present application, after receiving the authorization request from the transmission node and confirming the authorization of the initiator and the receiver, the control node sends a first message to the transmission node, where the first message carries first verification information, such as the initiator information and the receiver information, so that the transmission node verifies the information to be verified of the first data message based on the first verification information.

[0087] In one implementation, the first message also carries a key, so that the transmission node can calculate the second verification code based on the key and the parameter value of the verification input parameter in the first verification information after receiving the first message, and thus determine whether the information to be verified passes the verification based on whether the first verification code of the first data message matches the second verification code.

[0088] In one implementation, the first message also carries the node type of the transmission node. Based on the different node types of the transmission node, the transmission node obtains the first verification information in different ways. When the node type is the first transmission node, the first verification information can be requested from the control node, or the configured first verification information can be obtained. When the node type is the second transmission node, the first verification information can be obtained by receiving a third message sent by the first transmission node and carrying the first verification information, or the configured first verification information can be obtained. Optionally, the second transmission node may obtain the first verification information not through the third message sent by the first transmission node, but by requesting the first verification information from the control node.

[0089] In the embodiment of the present application, when both the first transmission node and the second transmission node send authorization requests to the control node, and when the second transmission node does not perform verification based on the verification information sent by the first transmission node, the control node will also authorize two verification codes for the initiator. Then, after the first transmission node passes the verification, it is not necessary to add the first transmission node information to the first data message. When the first data message is transmitted to the second transmission node, verification is performed using a verification code different from that of the first transmission node, which can reduce the information load of the data message.

[0090] In one implementation, the first verification information further includes: sending to the transmission node a first value of a verification input parameter that allows the initiator to access the corresponding verification input parameter of the receiver. The first value of the verification input parameter is used by the transmission node to verify whether the second value of the verification input parameter of the first data message matches the first value of the verification input parameter when the initiator and the receiver of the first data message match the initiator and the receiver in the authorization result, so as to determine whether the information to be verified has passed the verification and achieve security protection.

[0091] In one implementation, the first verification information mentioned above also includes an authorization result. The authorization result includes multiple situations, such as allowing transmission, not allowing transmission, or refusing transmission. Accordingly, verifying the information to be verified based on the first verification information may include (1) verifying whether the initiator and receiver of the first data message match the initiator and receiver of the authorization result that allows transmission; (2) verifying whether the initiator and receiver of the first data message match the initiator and receiver of the authorization result that does not allow transmission; (3) verifying whether the initiator and receiver of the first data message match at least one of the initiator and receiver of the authorization result that refuses transmission, which comprehensively considers the verification under various authorization results and ensures the reliability of security protection.

[0092] In one implementation, the first message includes all authorization information that allows the initiator to access the receiver. The authorization information covers the transmission allowed in the authorization result and the initiator and receiver that allow the transmission, so that the transmission node can know that there are the initiator and receiver that allow the transmission, and can also know the specific information of the initiator and receiver that allow the transmission.

[0093] Figure 5 The flowchart of another data message transmission authorization method provided by an exemplary embodiment of the present application is shown. In this method embodiment, the initiator sends an authorization request to the control node, wherein the first verification information includes a verification code and a verification input parameter. Figure 5 , the method comprising:

[0094] Step 501: The initiator sends an authorization request to the control node, carrying the initiator information and the receiver information. The message may or may not pass through the first transmission node.

[0095] Step 502: The control node determines that the initiator can access the receiver based on the initiator information and the receiver information, and then performs authorization. The control node determines that the initiator needs to pass through the first transmission node and the second transmission node to access the receiver, and generates a first verification code. The first verification code can be generated by calculating the value of the key and the verification input parameter using a cryptographic algorithm.

[0096] Step 503: The control node sends an authorization response to the initiator, carrying the first verification code. The message may or may not pass through the first transmission node.

[0097] Step 504: The initiator receives the authorization response, obtains and stores the first verification code.

[0098] Optionally, in step 505, the control node sends a notification message to the first transmission node, carrying the initiator information, the receiver information, the second transmission node information, and the node type, wherein the node type includes: the node is the first transmission node, and the verification operation corresponding to the first transmission node is performed.

[0099] Optionally, in step 506, the first transmission node stores the initiator information, the receiver information, the second transmission node information, and the node type.

[0100] Among them, the first transmission node can also obtain the initiator information, the receiver information, the second transmission node information, and the node type in the following manner: after the first transmission node receives the data message from the initiator, it sends an authorization request to the control node, and the control node sends the initiator information, the receiver information, the second transmission node information, and the node type to the first transmission node. In this manner, the first transmission node can cache the data message and send it to the receiver after verification, or discard the data message. In addition, the other steps are consistent with the above process and will not be repeated here.

[0101] Optionally, in step 507, the control node sends a notification message to the second transmission node, carrying the initiator information, the receiver information, and the node type.

[0102] Optionally, in step 508, the second transmission node stores the initiator information, the receiver information, and the node type, wherein the node type includes: the node is the second transmission node, and the verification operation corresponding to the second transmission node is performed.

[0103] Among them, the way for the second transmission node to obtain the initiator information, the receiver information, and the node type can also be one of the following: (1) The control node notifies the first transmission node of the second transmission node information and the node type, and the first transmission node notifies the second transmission node of the initiator information, the receiver information, and the node type. In this way, the other steps are consistent with the above process and will not be repeated here. (2) After the second transmission node receives the data message from the initiator, it sends an authorization request to the control node, and the control node sends the initiator information, the receiver information, and the node type to the second transmission node. In this way, the second transmission node can cache the data message and send it to the receiver after verification, or discard the data message. In addition, the other steps are consistent with the above process and will not be repeated here.

[0104] Figure 6 A schematic diagram of a flow chart of another data message transmission method provided by an exemplary embodiment of the present application is shown. In this method embodiment, the first transmission node and the second transmission node verify the data message. Figure 6 , the method comprising:

[0105] Step 601: The initiator sends a data message to the receiver via the first transmission node, carrying a first verification code, initiator information and receiver information.

[0106] Step 602: The first transmission node calculates the key and the verification input parameter using a cryptographic algorithm to generate a second verification code.

[0107] Among them, the initiator information, receiving end information, slice identifier, enterprise identifier, and tunnel identifier in the verification input parameters are obtained from the data message; the first transmission node IP, input interface, VLAN / VxLAN / VNI identifier are the IP, interface, VLAN / VxLAN / VNI identifier of the first transmission node receiving the data message; the first transmission node output interface is the interface of the first transmission node sending the message; the second transmission node information is the first transmission node based on the local storage information through the initiator information and the receiving end information to obtain the corresponding second transmission node information. The first transmission node compares the second verification code with the first verification code carried in the message. If they are the same, the verification is successful and the message is allowed to pass. Otherwise, the message is rejected.

[0108] Optionally, before step 602, the process may further include: the first transmission node determines that it is the first transmission node according to the node type.

[0109] Step 603: The first transmission node sends a data message to the receiving end via the second transmission node, carrying the information of the first transmission node. The first transmission node may encapsulate the outer IP header, put the first transmission node IP and the second transmission node IP in the outer IP header, and put the remaining information of the first transmission node in the options or extension header of the message. Alternatively, the outer IP header may not be encapsulated, and the information of the first transmission node may be put in the options or extension header of the message.

[0110] Step 604: The second transmission node calculates the key and the verification input parameter using a cryptographic algorithm to generate a third verification code.

[0111] Among them, the initiator information, receiving end information, first transmission node information, slice identifier, enterprise identifier, and tunnel identifier in the verification input parameters are obtained from the data message; the second transmission node IP, input interface, VLAN / VxLAN / VNI identifier are the IP, interface, VLAN / VxLAN / VNI identifier of the second transmission node receiving the data message; the second transmission node output interface is the interface of the second transmission node sending the message. The second transmission node compares the third verification code with the first verification code carried in the message. If they are the same, the verification is successful and the message is allowed to pass. Otherwise, the message is rejected. Optional, the processing before this step: the second transmission node determines that it is the second transmission node by the node type.

[0112] Step 605: The second transmission node sends the data message to the receiving end.

[0113] In the embodiment of the present application, the first transmission node and the second transmission node may perform security checks on some flows instead of all data packets. Information on some flows may be pre-statically configured or configured through a control node.

[0114] In the embodiment of the present application, the second transmission node may not perform verification based on the first transmission node information. In this case, Figure 5 In the embodiment, the first transmission node does not need to obtain the second transmission node information, and the control node authorizes two verification codes for the initiator. Figure 6 In the embodiment, the initiator carries two verification codes, the first transmission node verifies one of the verification codes, the first transmission node does not need to carry the first transmission node information in the data message, and the second transmission node verifies the other verification code carried in the message. Other verification steps are consistent with the above embodiment and are not repeated here.

[0115] Figure 7 A schematic diagram of a flow chart of another data message transmission authorization method provided by an exemplary embodiment of the present application is shown. In this method embodiment, a first transmission node sends an authorization request to a control node, wherein the first verification information includes verification input parameters. Figure 7 , the method comprising:

[0116] Step 701: an initiator sends a data message to a receiver via a first transmission node.

[0117] Step 702: The first transmission node determines that there is no first verification input parameter corresponding to the initiator information and the receiver information, and then sends an authorization request to the control node, carrying the initiator information and the receiver information, and caches or discards the data message.

[0118] Step 703: The control node determines that the initiator can access the receiver based on the initiator and receiver information, and then performs authorization. The control node determines that the initiator needs to pass through the first transmission node and the second transmission node to access the receiver.

[0119] Step 704: The control node sends an authorization response to the first transmission node, carrying the first verification input parameter.

[0120] Step 705: The first transmission node obtains and stores the first verification input parameter. In the case of caching the data message in step 702, if the verification input parameter is checked and passed, the cached data message is sent.

[0121] The first transmission node may also obtain the first verification input parameter in the following manner: the initiator sends an authorization request to the control node, and the control node notifies the first transmission node of the first verification input parameter. In addition, the other steps are consistent with the above process and will not be repeated here.

[0122] Step 706: The control node sends a notification message to the second transmission node, carrying the second verification input parameter.

[0123] Step 707: The second transmission node obtains and stores the second verification input parameter.

[0124] Among them, the way for the second transmission node to obtain the second verification input parameter can also be one of the following: (1) The control node sends the second transmission node information and the second verification input parameter to the first transmission node, and the first transmission node notifies the second transmission node of the second verification input parameter. In this way, the other steps are consistent with the above process and will not be repeated here. (2) After the second transmission node receives the data message from the initiator, it sends an authorization request to the control node, and the control node sends the second verification input parameter to the second transmission node. In this way, the second transmission node can cache the data message and send it to the receiving end after the verification is passed, or discard the data message. In addition, the other steps are consistent with the above process and will not be repeated here.

[0125] In this embodiment, the first verification input parameter may not include the second transmission node information, and the second verification input parameter may not include the first transmission node information.

[0126] Figure 8 A schematic diagram of a flow chart of another data message transmission method provided by an exemplary embodiment of the present application is shown, in which the first transmission node and the second transmission node obtain verification information from stored verification information. Figure 8 , the method comprising:

[0127] Step 801: an initiator sends a data message to a receiver via a first transmission node.

[0128] In step 802, the first transmission node searches for the corresponding first verification input parameter from the storage based on the initiator information and the receiver information. At the same time, the third verification input parameter is obtained. Then the first transmission node compares the third verification input parameter with the first verification input parameter. If they are the same, the verification is successful and the message is allowed to pass. Otherwise, the message is rejected. Optionally, before step 802, it can include: the first transmission node determines that it is the first transmission node through the node type.

[0129] Among them, (1) the initiator information, the receiving end information, the slice identifier, the enterprise identifier, and the tunnel identifier are obtained from the message; (2) the first transmission node IP, the input interface, and the VLAN / VxLAN / VNI identifier are the IP, interface, and VLAN / VxLAN / VNI identifier of the first transmission node receiving the data message; (3) the first transmission node output interface is the interface of the first transmission node sending the message.

[0130] Step 803: The first transmission node sends a data message to the receiving end via the second transmission node, carrying the information of the first transmission node. The first transmission node may encapsulate the outer IP header, put the first transmission node IP and the second transmission node IP in the outer IP header, and put the remaining information of the first transmission node in the options or extension header of the message. Alternatively, the outer IP header may not be encapsulated, and the information of the first transmission node may be put in the options or extension header of the message.

[0131] In step 804, the second transmission node searches for the corresponding second verification input parameter from the storage based on the initiator information and the receiver information. At the same time, the fourth verification input parameter is obtained. Then the second transmission node compares the fourth verification input parameter with the third verification input parameter. If they are the same, the verification is successful and the message is allowed to pass. Otherwise, the message is rejected. Optionally, before step 804, it can include: the second transmission node determines that it is the second transmission node through the node type.

[0132] Among them, (1) the initiator information, the receiving end information, the first transmission node information, the slice identifier, the enterprise identifier, and the tunnel identifier are obtained from the message; (2) the second transmission node IP, input interface, and VLAN / VxLAN / VNI identifier are the IP, interface, and VLAN / VxLAN / VNI identifier of the second transmission node receiving the data message; (3) the second transmission node output interface is the interface of the second transmission node sending the message.

[0133] Step 805: The second transmission node sends the data message to the receiving end.

[0134] In this embodiment, the second transmission node may not perform verification based on the first transmission node information. In this case, Figure 7 In the embodiment, the first transmission node does not need to obtain the second transmission node information. Figure 8 In the embodiment, the first transmission node does not need to carry the first transmission node information in the data message. Other verification steps are consistent with the above embodiment and will not be repeated here.

[0135] Fig. 9 A schematic diagram of a flow chart of another data message transmission authorization method provided by an exemplary embodiment of the present application is shown. In this method embodiment, a first transmission node sends an authorization request to a control node, wherein the first verification information includes an authorization result and a verification input parameter. Fig. 9 , the method comprising:

[0136] Step 901: an initiator sends a data message to a receiver via a first transmission node.

[0137] Step 902: The first transmission node determines that there is no authorization result corresponding to the initiator information and the receiver information, and then sends an authorization request to the control node, carrying the initiator information and the receiver information, wherein the initiator information and the receiver information are mandatory, and other verification parameters are optional.

[0138] Step 903, the control node determines, based on the initiator information and the receiver information, that the initiator can access the receiver, and the first verification input parameter carried is the verification input parameter corresponding to the initiator accessing the receiver, then the authorization result is allowed, otherwise the authorization result is not allowed or rejected.

[0139] Step 904: The control node sends an authorization response to the first transmission node, carrying the authorization result.

[0140] Step 905: The first transmission node obtains and stores the first verification input parameter and the authorization result. In the case of caching the data message in step 902, if the verification passes, the cached data message is sent.

[0141] The first transmission node may obtain the first verification input parameter in the following manner: the initiator sends an authorization request to the control node, and the control node notifies the first transmission node of the first verification input parameter and the authorization result. In addition, the other steps are consistent with the above process and will not be repeated here.

[0142] Step 906: The control node sends a notification message to the second transmission node, carrying the second verification input parameter and the authorization result.

[0143] Step 907: The second transmission node obtains and stores the second verification input parameter and authorization result.

[0144] Among them, the way for the second transmission node to obtain the second verification input parameter can also be at least one of the following: (1) The control node sends the second transmission node information and the second verification input parameter to the first transmission node, and the first transmission node notifies the second transmission node of the second verification input parameter and the authorization result. In this way, the other steps are consistent with the above process and will not be repeated here. (2) After the second transmission node receives the data message from the initiator, it sends an authorization request to the control node, carrying the second verification input parameter, and the control node sends the authorization result to the second transmission node. In this way, the second transmission node can cache the data message and send it to the receiving end after the verification is passed, or discard the data message. In addition, the other steps are consistent with the above process and will not be repeated here.

[0145] The first transmission node or the second transmission node thus verifies the data message through the obtained verification input parameters and authorization results.

[0146] Fig.10 A schematic diagram of a flow chart of another data message transmission method provided by an exemplary embodiment of the present application is shown. The method embodiment is based on the first transmission node and the second transmission node obtaining verification information from the stored verification information, wherein the verification information includes the authorization result and the verification input parameter. Fig.10 , the method comprising:

[0147] Step 1001: an initiator sends a data message to a receiver via a first transmission node.

[0148] In step 1002, the first transmission node searches for the corresponding first verification input parameter and authorization result from the storage based on the initiator information and the receiver information. At the same time, the third verification input parameter is obtained. Then the first transmission node compares the third verification input parameter with the first verification input parameter. If they are the same, the data message is processed according to the authorization result. Optionally, before step 1002, it may include: the first transmission node determines that it is the first transmission node by the node type.

[0149] Among them, (1) the initiator information, the receiving end information, the slice identifier, the enterprise identifier, and the tunnel identifier are obtained from the message; (2) the first transmission node IP, the input interface, and the VLAN / VxLAN / VNI identifier are the IP, interface, and VLAN / VxLAN / VNI identifier of the first transmission node receiving the data message; (3) the first transmission node output interface is the interface of the first transmission node sending the message.

[0150] Step 1003: The first transmission node sends a data message to the receiving end via the second transmission node, carrying the information of the first transmission node. The first transmission node may encapsulate an outer IP header, put the first transmission node IP and the second transmission node IP in the outer IP header, and put the remaining information of the first transmission node in the options or extension header of the message. Alternatively, the outer IP header may not be encapsulated, and the information of the first transmission node may be put in the options or extension header of the message.

[0151] In step 1004, the second transmission node searches for the corresponding second verification input parameter and authorization result from the storage based on the initiator information and the receiver information. At the same time, the fourth verification input parameter is obtained. Then the second transmission node compares the fourth verification input parameter with the third verification input parameter. If they are the same, the data message is processed according to the authorization result. Optionally, before step 1004, it can include: the second transmission node determines that it is the second transmission node by the node type.

[0152] Among them, (1) the initiator information, the receiving end information, the first transmission node information, the slice identifier, the enterprise identifier, and the tunnel identifier are obtained from the message; (2) the second transmission node IP, input interface, and VLAN / VxLAN / VNI identifier are the IP, interface, and VLAN / VxLAN / VNI identifier of the second transmission node receiving the data message; (3) the second transmission node output interface is the interface of the second transmission node sending the message.

[0153] Step 1005: The second transmission node sends the data message to the receiving end.

[0154] In this embodiment, the second transmission node may not perform verification based on the first transmission node information. In this case, Fig. 9 In the embodiment, the first transmission node does not need to obtain the second transmission node information. Fig.10In the embodiment, the first transmission node does not need to carry the first transmission node information in the data message. Other verification steps are consistent with the above embodiment and will not be repeated here.

[0155] Fig.11 A flow chart of another data message transmission authorization method provided by an exemplary embodiment of the present application is shown. In this method embodiment, a first transmission node sends an authorization request to a control node, wherein the first verification information includes policy information, and the policy information may include verification input parameters and authorization results. Fig.11 , the method comprising:

[0156] Step 1101: Power on the first transmission node.

[0157] Step 1102: The first transmission node sends an authorization request to the control node, requesting policy information.

[0158] Optionally, the triggering method for the first transmission node to send an authorization request to the control node may also include: when the first transmission node receives a data message from the initiator, it sends a policy request to the control node, and the first transmission node may cache or discard the message. In addition, the other steps are consistent with the above process and will not be repeated here.

[0159] Step 1103: The control node sends an authorization response to the first transmission node, carrying policy information. The policy information may include: verification input parameters and authorization results. The policy information may be a single policy or multiple policies.

[0160] Step 1104: The first transmission node obtains and stores policy information.

[0161] Step 1105: Power on the second transmission node.

[0162] Step 1106: The second transmission node sends an authorization request to the control node, requesting policy information.

[0163] Optionally, the triggering method for the second transmission node to send an authorization request to the control node may also include: when the second transmission node receives a data message from the initiator, it sends a policy request to the control node, and the second transmission node may cache or discard the message. In addition, the other steps are consistent with the above process and will not be repeated here.

[0164] Step 1107: The control node sends an authorization response to the second transmission node, carrying policy information. The policy information may include: verification input parameters and authorization results. The policy information may be a single policy or multiple policies.

[0165] Step 1108: The second transmission node obtains and stores the policy information.

[0166] There is no necessary order between steps 1101 to 1104 and steps 1105 to 1108.

[0167] Thus, the first transmission node or the second transmission node verifies the data message through the acquired policy information.

[0168] Fig.12 A schematic diagram of a flow chart of another data message transmission method provided by an exemplary embodiment of the present application is shown. The method embodiment is based on the first transmission node and the second transmission node obtaining verification information from the stored verification information, wherein the verification information includes policy information. Fig.12 , the method comprising:

[0169] Step 1201: The initiator sends a data message to the receiver via the first transmission node.

[0170] In step 1202, the first transmission node searches for corresponding policy information from storage based on the relevant information of the received data message. At the same time, the verification input is obtained. Then the first transmission node compares the verification input with the policy information. If they are the same, the data message is processed according to the authorization result of the policy information. Optionally, before step 1202, it may include: the first transmission node determines that it is the first transmission node by the node type.

[0171] Among them, (1) the initiator information, the receiving end information, the slice identifier, the enterprise identifier, and the tunnel identifier are obtained from the message; (2) the first transmission node IP, the input interface, and the VLAN / VxLAN / VNI identifier are the IP, interface, and VLAN / VxLAN / VNI identifier of the first transmission node receiving the data message; (3) the first transmission node output interface is the interface of the first transmission node sending the message.

[0172] Step 1203: The first transmission node sends a data message to the receiving end via the second transmission node. Optionally, the data message carries information about the first transmission node.

[0173] In step 1204, the second transmission node searches for corresponding policy information from storage based on the relevant information of the received data message. At the same time, the verification input is obtained. Then the second transmission node compares the verification input with the policy information. If they are the same, the data message is processed according to the authorization result of the policy information. Optionally, before step 1204, it can include: the second transmission node determines that it is the second transmission node by the node type.

[0174] Among them, (1) the initiator information, the receiver information, the first transmission node information, the slice identifier, the enterprise identifier, and the tunnel identifier are obtained from the message; (2) the second transmission node IP, the input interface, and the VLAN / VxLAN / VNI identifier are the IP, interface, and VLAN / VxLAN / VNI identifier of the second transmission node receiving the data message; (3) the second transmission node output interface is the interface of the second transmission node sending the message;

[0175] Step 1205: The second transmission node sends the data message to the receiving end.

[0176] In this embodiment, the second transmission node may not perform verification based on the first transmission node information. In this case, Fig.11 In the embodiment, the first transmission node does not need to obtain the second transmission node information. Fig.12 In the embodiment, the first transmission node does not need to carry the first transmission node information in the data message. Other verification steps are consistent with the above embodiment and will not be repeated here.

[0177] It should be noted that in the above embodiments, the node type and the key can be pre-configured on the first transmission node and the second transmission node, or can be configured by the control node when the first transmission node and the second transmission node are powered on.

[0178] Through the embodiments of the present application, the data message to be transmitted can be checked at any transmission node between the initiator and the receiver, so as to realize timely and accurate network security protection and solve the problem of delayed and inefficient network security protection in related technologies.

[0179] In an exemplary embodiment, an electronic device is further provided, the electronic device being used to execute the above-mentioned data message transmission method and data message transmission authorization method. Fig.13 A schematic diagram of the structure of an electronic device for implementing various embodiments of the present application. The electronic device may have relatively large differences due to different configurations or performances, and may include a processor 1301, a communications interface 1302, a memory 1303, and a communication bus 1304, wherein the processor 1301, the communications interface 1302, and the memory 1303 communicate with each other through the communication bus 1304. The processor 1301 can call a computer program stored in the memory 1303 and can be run on the processor 1301 to execute all or part of the steps of the above method embodiments, and can achieve the same technical effect, so it will not be repeated here to avoid repetition.

[0180] The above electronic device structure does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or arrange the components differently. For example, the input unit may include a graphics processing unit (GPU) and a microphone, and the display unit may be configured with a display panel in the form of a liquid crystal display, an organic light emitting diode, etc. The user input unit includes a touch panel and at least one of other input devices. The touch panel is also called a touch screen. Other input devices may include, but are not limited to, a physical keyboard, function keys (such as volume control buttons, switch buttons, etc.), a trackball, a mouse, and a joystick, which will not be repeated here.

[0181] The memory can be used to store software programs and various data. The memory may mainly include a first storage area for storing programs or instructions and a second storage area for storing data, wherein the first storage area may store an operating system, an application program or instructions required for at least one function (such as a sound playback function, an image playback function, etc.), etc. In addition, the memory may include a volatile memory or a non-volatile memory, or the memory may include both volatile and non-volatile memories. Among them, the non-volatile memory may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), or a flash memory. Volatile memory can be random access memory (RAM), static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM) and direct memory bus random access memory (DRRAM).

[0182] The processor may include one or more processing units; optionally, the processor integrates an application processor and a modem processor, wherein the application processor mainly processes operations related to the operating system, user interface, and application programs, and the modem processor mainly processes wireless communication signals, such as a baseband processor. It is understandable that the modem processor may not be integrated into the processor.

[0183] In an exemplary embodiment, a readable storage medium is also provided, on which a program or instruction is stored, and when the program or instruction is executed by a processor, the steps of the data message transmission method embodiment described above are implemented, or the steps of the data message transmission authorization method embodiment described above are implemented. For example, the readable storage medium can be a read-only memory (ROM), a random access memory (RAM), a compact disc read-only memory (CD-ROM), a magnetic tape, a floppy disk, an optical data storage device, etc.

[0184] Those skilled in the art will readily appreciate other embodiments of the present application after considering the specification and practicing the invention disclosed herein. The present application is intended to cover any modification, use or adaptation of the present application, which follows the general principles of the present application and includes common knowledge or customary techniques in the art that are not disclosed in the present application. The specification and examples are intended to be exemplary only, and the true scope and spirit of the present application are indicated by the claims.

[0185] It should be understood that the present application is not limited to the precise structures that have been described above and shown in the drawings, and that various modifications and changes may be made without departing from the scope thereof. The scope of the present application is limited only by the appended claims.

Claims

1. A method for transmitting a data message, characterized in that: Applied to a transmission node between an initiator and a receiver, the method comprises: Obtaining first verification information; When receiving the first data message, obtaining information to be verified based on the first data message; Verifying the information to be verified based on the first verification information; If the verification is successful, the first data message is transmitted.

2. The method according to claim 1, characterized in that: The obtaining of the first verification information comprises: The transmission node receives a first message sent by the control node, wherein the first message carries the first verification information; or, The transmission node obtains first verification information configured on the transmission node.

3. The method according to claim 2, characterized in that Before the transmission node receives the first message sent by the control node, the method further includes: The transmission node sends a second message to the control node, wherein the second message is used to request the first verification information.

4. The method according to claim 3, characterized in that The transmitting node sends a second message to the control node, including: After receiving the second data message, the transmission node sends the second message to the control node, wherein the second message carries the initiator information and the receiver information of the second data message; or, After being powered on, the transmission node sends the second message to the control node.

5. The method according to claim 4, characterized in that The initiator information includes at least one of the following: an initiator identifier, an initiator Internet Protocol IP, an initiator address segment, an initiator port, and a media access control MAC; The receiving end information includes at least one of the following: a receiving end identifier, a receiving end IP, a receiving end address segment, a receiving end port, and a media access control MAC.

6. The method according to claim 2, characterized in that After the transmission node receives the first message sent by the control node, the method further includes: In a case where the transmission node is a first transmission node, sending second verification information to the second transmission node based on the second transmission node information carried in the first message, wherein the first transmission node is located before the second transmission node on the transmission path from the initiator to the receiver; Among them, the second transmission node information includes at least one of the following: the second transmission node IP, the second transmission node input interface, the second transmission node output interface, the virtual local area network VLAN identifier of the second transmission node, the extensible virtual local area network VXLAN identifier of the second transmission node, and the VXLAN network identifier VNI of the second transmission node.

7. The method according to claim 6, characterized in that The first message carries first indication information, where the first indication information is used to indicate the node type of the transmission node.

8. The method according to claim 1, characterized in that The obtaining of the first verification information comprises: In the case that the transmission node is the second transmission node, a third message sent by the first transmission node is received, wherein the third message carries the first verification information, and on the transmission path from the initiator to the receiving end, the first transmission node is located before the second transmission node.

9. The method according to any one of claims 1 to 8, characterized in that: The first data message carries a first verification code; the first verification information includes a key and a verification input parameter; The verifying the information to be verified based on the first verification information includes: Obtaining a verification input parameter value of the first data message; Calculate based on the key and the obtained parameter value to obtain a second verification code; Verify whether the first verification code carried in the first data message matches the obtained second verification code.

10. The method according to claim 9, characterized in that The transmitting the first data message when the verification is passed includes: In the case where the transmission node is a first transmission node, if the verification is passed, after adding the first transmission node information to the first data message, the first data message is transmitted to the second transmission node, wherein on the transmission path from the receiving end to the receiving end, the first transmission node is located before the second transmission node; Among them, the first transmission node information includes at least one of the following: the first transmission node IP, the first transmission node input interface, the first transmission node output interface, the virtual local area network VLAN identifier of the first transmission node, the extensible virtual local area network VXLAN identifier of the first transmission node, and the VXLAN network identifier VNI of the first transmission node.

11. The method according to any one of claims 1 to 10, characterized in that: The first verification information includes: a verification value of a verification input parameter; The obtaining the information to be verified based on the first data message includes: obtaining a parameter value of a verification input parameter of the first data message based on the first data message; The verifying the information to be verified based on the first verification information includes: verifying whether a parameter value of a verification input parameter of the first data message matches a verification value of the verification input parameter.

12. The method according to any one of claims 1 to 10, characterized in that: The first verification information includes: policy information, wherein the policy information includes: an authorization result, and the authorization result includes one of the following: allowing transmission, not allowing transmission, or refusing transmission; The verifying the information to be verified based on the first verification information includes one of the following: Verify whether the initiator and the receiver of the first data message match the initiator and the receiver allowed to be transmitted in the authorization result; Verify whether the initiator and the receiver of the first data message match the initiator and the receiver that are not allowed to transmit in the authorization result; Verify whether the initiator and the receiver of the first data message match the initiator and the receiver of the transmission rejection in the authorization result.

13. The method according to claim 12, characterized in that The policy information further includes: a first value of a verification input parameter; and the verifying the information to be verified based on the first verification information includes: When the initiator and the receiver of the first data message match the initiator and the receiver in the authorization result, verify whether the second value of the verification input parameter of the first data message matches the first value of the verification input parameter.

14. The method according to claim 13, characterized in that The verification input parameters include at least one of the following: the initiator information, the receiver information, the first transmission node information, the second transmission node information, a slice identifier, an enterprise identifier, and a tunnel identifier.

15. The method according to claim 1, characterized in that The initiator includes a terminal and a network side device; the receiver includes a terminal and a network side device; wherein the network side device includes one of the following: a server, a manager, a controller, and an access gateway; The transmission node includes one of the following: a router, a switch, a gateway, and a customer terminal equipment CPE.

16. A data message transmission authorization method, characterized in that: include: The control node determines, based on the initiating end information and the receiving end information, that the initiating end corresponding to the initiating end information is allowed to access the receiving end corresponding to the receiving end information; The control node sends first verification information to the initiator or a transmission node between the initiator and the receiver.

17. The method according to claim 16, characterized in that Before the control node determines, based on the initiating end information and the receiving end information, that an initiating end corresponding to the initiating end information is allowed to access a receiving end corresponding to the receiving end information, the method further includes: An authorization request sent by the initiator or the transmission node is received, wherein the authorization request carries the initiator information and the receiver information.

18. The method according to claim 17, characterized in that The control node sends first verification information to the initiator, including: The control node calculates a first verification code based on the key and a first value of a verification input parameter corresponding to the receiving end that allows the initiating end to access the receiving end; The control node sends the authorization response to the initiator, wherein the authorization response carries the first verification code.

19. The method according to claim 17, characterized in that The control node sends first verification information to the transmission node, including: The control node sends a first message to the transmission node, where the first message carries the initiator information and the receiver information.

20. The method according to claim 19, characterized in that The first message also carries the key.

21. The method according to claim 19, characterized in that The first message also carries the node type of the transmission node.

22. The method according to claim 19, characterized in that The first verification information also includes: Sending to the transmission node a first value of a verification input parameter that allows the initiator to access a corresponding verification input parameter of the receiver.

23. The method according to any one of claims 19 to 22, characterized in that The first verification information also includes an authorization result.

24. The method according to any one of claims 19 to 22, characterized in that The first message includes all authorization information that allows the initiating end to access the receiving end.

25. An electronic device, characterized in that: The electronic device includes a processor and a memory, the memory storing programs or instructions that can be run on the processor, and the programs or instructions, when executed by the processor, implement the steps of the data message transmission method as described in any one of claims 1 to 15, or implement the steps of the data message transmission authorization method as described in any one of claims 16 to 24.

26. A readable storage medium, characterized in that: The readable storage medium stores a program or instruction, and when the program or instruction is executed by the processor, it implements the steps of the data message transmission method as described in any one of claims 1 to 15, or implements the steps of the data message transmission authorization method as described in any one of claims 16 to 24.

Images