Two-layer service forwarding method and system, electronic equipment and storage medium

Abstract

The invention provides a two-layer service forwarding method and system, electronic equipment and a storage medium, and relates to the technical field of mobile communication. The method comprises the steps that a first two-layer Ethernet frame message is received, an ending type two-layer forwarding segment identifier corresponding to the first two-layer Ethernet frame message is determined, and the ending type two-layer forwarding segment identifier is used for indicating a corresponding ESP encryption and decryption mode; the first two-layer Ethernet frame message is packaged into a first target message, and the outermost layer message header of the first target message comprises an ending type two-layer forwarding segment identifier; performing ESP encapsulation on the first target message to obtain a target data packet; and sending the target data packet to the second PE. According to the invention, ESP packaging can be carried out based on the ending type two-layer forwarding segment identifier, and then the two-layer forwarding action is realized. Therefore, the security mechanism can be combined in the SRv6 network to ensure the data security in transmission.

Description

Background Art

[0002] With the development of mobile communication technology, SRv6 (Segment Routing IPv6) technology has been introduced into the network. SRv6 technology provides a flexible way to define network paths and service chains, but SRv6 technology itself does not have a built-in security mechanism.

[0003] Therefore, when performing network orchestration and scheduling, high-security users still need to encrypt service data to prevent data leakage. Therefore, there is an urgent need for a Layer 2 service forwarding method to combine security mechanisms in SRv6 networks to ensure data security during transmission.

[0004] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present disclosure, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention

[0005] The present disclosure provides a layer 2 service forwarding method, system, electronic device and storage medium, which at least to a certain extent realize the problem of combining a security mechanism in an SRv6 network to ensure the security of data in transmission.

[0006] Other features and advantages of the present disclosure will become apparent from the following detailed description, or may be learned in part by the practice of the present disclosure.

[0007] According to one aspect of the present disclosure, a layer 2 service forwarding method is provided, which is performed by a first PE (ProviderEdge, service provider edge device), including:

[0008] Receive a first layer 2 Ethernet frame message, determine an end-type layer 2 forwarding segment identifier corresponding to the first layer 2 Ethernet frame message, and the end-type layer 2 forwarding segment identifier is used to indicate a corresponding ESP (Encapsulating Security Payload) encryption and decryption mode;

[0009] encapsulating the first layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the end-type layer 2 forwarding segment identifier;

[0010] Performing ESP encapsulation on the first target message to obtain a target data packet;

[0011] The target data packet is sent to the second PE.

[0012] In some exemplary embodiments, the IPsec (Internet Protocol Security) policy interest flow of the first PE is the end-type layer 2 forwarding segment identifier, and the ESP encapsulation of the first target message to obtain the target data packet includes:

[0013] Determining, according to the end-type layer 2 forwarding segment identifier included in the first target message, that the first target message matches the IPsec policy;

[0014] The first target message is encapsulated by ESP based on the transmission mode of the IPsec policy to obtain a target data packet.

[0015] In some exemplary embodiments, sending the target data packet to the second PE includes:

[0016] Determine the address of the second PE according to the end-type layer 2 forwarding segment identifier;

[0017] The target data packet is sent to the second PE according to the address of the second PE.

[0018] In some exemplary embodiments, the end-type layer-2 forwarding segment identifier includes a target operation code, and the target operation code is used to indicate a corresponding ESP encryption and decryption method.

[0019] According to another aspect of the present disclosure, a layer 2 service forwarding method is also provided, which is performed by a second PE and includes:

[0020] Receive target data packets;

[0021] Identifying an end-type layer 2 forwarding segment identifier in the target data packet;

[0022] According to the end-type layer 2 forwarding segment identifier, the target data packet is decapsulated by ESP to obtain a second target message;

[0023] The second target message is decapsulated according to the end-type layer-2 forwarding segment identifier to obtain a second layer-2 Ethernet frame message.

[0024] In some exemplary embodiments, performing ESP decapsulation on the target data packet according to the end-type layer 2 forwarding segment identifier to obtain a second target message includes:

[0025] Determining whether the end-type layer 2 forwarding segment identifier includes a target operation code;

[0026] If it is determined that the target operation code is included, the target data packet is decapsulated by ESP to obtain the second target message.

[0027] In some exemplary embodiments, performing ESP decapsulation on the target data packet to obtain a second target message includes:

[0028] If the number of remaining segments field in the second target message is 0 and the second target message includes an ESP header, determining corresponding security association information according to the end-type layer 2 forwarding segment identifier;

[0029] According to the decapsulation mode in the security association information, the target data packet is decapsulated by ESP to obtain the second target message.

[0030] According to another aspect of the present disclosure, a layer 2 service forwarding device is provided, which is applied to a first PE and includes:

[0031] A first layer 2 Ethernet frame message receiving module, used for receiving a first layer 2 Ethernet frame message, and determining an end type layer 2 forwarding segment identifier corresponding to the first layer 2 Ethernet frame message, wherein the end type layer 2 forwarding segment identifier is used for indicating a corresponding ESP encryption and decryption mode;

[0032] A first target message determination module, configured to encapsulate the first layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the end-type layer 2 forwarding segment identifier;

[0033] A target data packet determination module, configured to perform ESP encapsulation on the first target message to obtain a target data packet;

[0034] The target data packet sending module is used to send the target data packet to the second PE.

[0035] In some exemplary embodiments, the IPsec policy interested flow of the first PE is the end-type Layer 2 forwarding segment identifier, and the target data packet determination module is used to determine that the first target message matches the IPsec policy based on the end-type Layer 2 forwarding segment identifier included in the first target message; and perform ESP encapsulation on the first target message based on the transmission mode of the IPsec policy to obtain a target data packet.

[0036] In some exemplary embodiments, the target data packet sending module is used to determine the address of the second PE according to the end-type layer-2 forwarding segment identifier; and send the target data packet to the second PE according to the address of the second PE.

[0037] In some exemplary embodiments, the end-type layer-2 forwarding segment identifier includes a target operation code, and the target operation code is used to indicate a corresponding ESP encryption and decryption mode.

[0038] According to another aspect of the present disclosure, a layer 2 service forwarding device is provided, which is applied to a second PE and includes:

[0039] A target data packet receiving module, used for receiving a target data packet;

[0040] An end-type layer 2 forwarding segment identifier identification module, used to identify an end-type layer 2 forwarding segment identifier in the target data packet;

[0041] A second target message determination module is used to perform ESP decapsulation on the target data packet according to the end-type layer 2 forwarding segment identifier to obtain a second target message;

[0042] The second layer 2 Ethernet frame message determination module is used to decapsulate the second target message according to the end-type layer 2 forwarding segment identifier to obtain a second layer 2 Ethernet frame message.

[0043] In some exemplary embodiments, the second target message determination module is used to determine whether the end-type layer 2 forwarding segment identifier includes a target operation code; if it is determined that the target operation code is included, ESP decapsulation is performed on the target data packet to obtain the second target message.

[0044] In some exemplary embodiments, the second target message determination module is used to determine the corresponding security association information according to the end-type layer 2 forwarding segment identifier if the remaining segment number field in the second target message is 0 and the second target message includes an ESP header; perform ESP decapsulation on the target data packet according to the decapsulation method in the security association information to obtain the second target message.

[0045] According to another aspect of the present disclosure, a layer 2 service forwarding system is provided, including a first PE and a second PE:

[0046] The first PE is used to receive a first layer 2 Ethernet frame message, determine an end-type layer 2 forwarding segment identifier corresponding to the first layer 2 Ethernet frame message, and the end-type layer 2 forwarding segment identifier is used to indicate a corresponding ESP encryption and decryption method; encapsulate the first layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the end-type layer 2 forwarding segment identifier; perform ESP encapsulation on the first target message to obtain a target data packet; and send the target data packet to the second PE;

[0047] The second PE is used to receive the target data packet; identify the end-type layer 2 forwarding segment identifier in the target data packet; perform ESP decapsulation on the target data packet according to the end-type layer 2 forwarding segment identifier to obtain a second target message; decapsulate the second target message according to the end-type layer 2 forwarding segment identifier to obtain a second layer 2 Ethernet frame message.

[0048] According to another aspect of the present disclosure, an electronic device is also provided, which includes: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to execute any one of the above-mentioned Layer 2 service forwarding methods by executing the executable instructions.

[0049] According to another aspect of the present disclosure, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the method for forwarding layer 2 services described above is implemented.

[0050] According to another aspect of the present disclosure, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the Layer 2 service forwarding method provided in various optional ways in any embodiment of the present disclosure.

[0051] The technical solution provided in the embodiments of the present disclosure can implement ESP encapsulation based on the end-type layer 2 forwarding segment identifier, and then implement the layer 2 forwarding action. Therefore, the embodiments of the present disclosure can be combined with a security mechanism in the SRv6 network to ensure the security of data in transmission.

[0052] It is to be understood that the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0053] The accompanying drawings herein are incorporated into the specification and constitute a part of the specification, illustrate embodiments consistent with the present disclosure, and together with the specification are used to explain the principles of the present disclosure. Obviously, the accompanying drawings described below are only some embodiments of the present disclosure, and for ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without creative work.

[0054] Figure 1 A schematic diagram showing a system architecture in an embodiment of the present disclosure;

[0055] Figure 2 A flow chart of a layer 2 service forwarding method in an embodiment of the present disclosure is shown;

[0056] Figure 3 Another flow chart of a method for forwarding Layer 2 services in an embodiment of the present disclosure is shown;

[0057] Figure 4 A schematic diagram showing an SRv6 SID in an embodiment of the present disclosure is shown;

[0058] Figure 5 A schematic diagram of a process of Layer 2 service forwarding in an embodiment of the present disclosure is shown;

[0059] Figure 6 A schematic diagram showing a VPWS service forwarding plane protocol stack in an embodiment of the present disclosure is shown;

[0060] Figure 7 A schematic diagram of a Layer 2 service forwarding device in an embodiment of the present disclosure is shown;

[0061] Figure 8 A schematic diagram of another layer 2 service forwarding device in an embodiment of the present disclosure is shown;

[0062] Fig. 9 A structural block diagram of an electronic device according to an embodiment of the present disclosure is shown;

[0063] Fig.10 A schematic diagram of a computer-readable storage medium in an embodiment of the present disclosure is shown. DETAILED DESCRIPTION

[0064] Example embodiments will now be described more fully with reference to the accompanying drawings. However, example embodiments can be implemented in a variety of forms and should not be construed as limited to the examples set forth herein; rather, these embodiments are provided so that the disclosure will be more comprehensive and complete and to fully convey the concepts of the example embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0065] In addition, the accompanying drawings are only schematic illustrations of the present disclosure and are not necessarily drawn to scale. The same reference numerals in the figures represent the same or similar parts, and their repeated description will be omitted. Some of the block diagrams shown in the accompanying drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities can be implemented in software form, or implemented in one or more hardware modules or integrated circuits, or implemented in different networks and / or processor devices and / or microcontroller devices.

[0066] The specific implementation of the embodiment of the present disclosure is described in detail below with reference to the accompanying drawings.

[0067] Figure 1FIG. 2 shows an exemplary application system architecture diagram to which the Layer 2 service forwarding method in the embodiment of the present disclosure can be applied. Figure 1 As shown, the system architecture 100 may include a first PE 101 , a network 102 , and a second PE 103 .

[0068] Among them, the first PE can be used to receive the first and second layer Ethernet frame messages, determine the end-type second layer forwarding segment identifier corresponding to the first and second layer Ethernet frame messages, and the end-type second layer forwarding segment identifier is used to indicate the corresponding ESP encryption and decryption method; encapsulate the first and second layer Ethernet frame messages into a first target message, wherein the outermost message header of the first target message includes the end-type second layer forwarding segment identifier; perform ESP encapsulation on the first target message to obtain a target data packet; and send the target data packet to the second PE.

[0069] Then, the second PE can be used to receive the target data packet; identify the end-type layer 2 forwarding segment identifier in the target data packet; perform ESP decapsulation on the target data packet according to the end-type layer 2 forwarding segment identifier to obtain a second target message; decapsulate the second target message according to the end-type layer 2 forwarding segment identifier to obtain a second layer 2 Ethernet frame message.

[0070] The network 102 is used as a medium for providing a communication link between the first PE 101 and the second PE 103 , and may be a wired network or a wireless network.

[0071] Optionally, the wireless network or wired network described above uses standard communication technology and / or protocol. The network is usually the Internet, but it can also be any network, including but not limited to a local area network (LAN), a metropolitan area network (MAN), a wide area network (WAN), a mobile, wired or wireless network, a dedicated network or any combination of a virtual private network). In some embodiments, the data exchanged through the network is represented by technologies and / or formats including Hyper Text Mark-up Language (HTML), Extensible Markup Language (XML), etc. In addition, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Network (VPN), Internet Protocol Security (IPSec) can also be used to encrypt all or some links. In other embodiments, customized and / or dedicated data communication technologies can also be used to replace or supplement the above data communication technologies.

[0072] The embodiment of the present disclosure does not limit the first PE 101 and the second PE 103. For example, the first PE 101 and the second PE 103 may be routers or switches located at the edge of the service provider network, responsible for connecting to the CE (Customer Edge) of the customer network.

[0073] Exemplarily, the first PE 101 and the second PE 103 may both be part of a service provider network, and are used to provide various value-added services, such as MPLS (Multiprotocol Label Switching), VPNs (Virtual Private Network), and the like.

[0074] Those skilled in the art will know that Figure 1 The number of the first PE 101, the network 102 and the second PE 103 is only for illustration, and any number of the first PE 101, the network 102 and the second PE 103 may be provided according to actual needs. The embodiments of the present disclosure are not limited to this.

[0075] Under the above system architecture, a layer 2 service forwarding method is provided in an embodiment of the present disclosure. The method can be executed by any electronic device with computing and processing capabilities.

[0076] In some embodiments, the Layer 2 service forwarding method provided in the embodiments of the present disclosure may be executed by the first PE in the above-mentioned system architecture; in other embodiments, the Layer 2 service forwarding method provided in the embodiments of the present disclosure may be executed by the second PE in the above-mentioned system architecture; in other embodiments, the Layer 2 service forwarding method provided in the embodiments of the present disclosure may be implemented by the first PE and the second PE in the above-mentioned system architecture through interaction.

[0077] Figure 2 A flow chart of a method for forwarding Layer 2 services in an embodiment of the present disclosure is shown as follows: Figure 2 As shown, the layer 2 service forwarding method provided in the embodiment of the present disclosure can be executed by the first PE, and the layer 2 service forwarding method includes the following steps S202 to S208.

[0078] S202: The first PE receives a first layer-2 Ethernet frame message, and determines an end-type layer-2 forwarding segment identifier corresponding to the first layer-2 Ethernet frame message, where the end-type layer-2 forwarding segment identifier is used to indicate a corresponding ESP encryption and decryption mode.

[0079] It should be noted that the second layer network is the data link layer, which is located above the physical layer and is responsible for reliable data transmission between nodes and processes the bit stream on the physical layer to ensure that data can be transmitted from one node to another without error. In the second layer network, data transmission can be achieved based on the second layer Ethernet frame message. The first second layer Ethernet frame message can be a second layer Ethernet frame message containing any content.

[0080] In some embodiments, the first CE may send a first layer 2 Ethernet frame message to the first PE, and the first PE may forward the first layer 2 Ethernet frame message to the second PE via the SRv6 network. The first CE may be connected to the first PE based on a layer 2 interface.

[0081] Exemplarily, after receiving the first layer 2 Ethernet frame message, the first PE may search for the associated SRv6 tunnel in the MAC (Media Access Control) address table, and obtain the end-type layer 2 forwarding segment identifier corresponding to the SRv6 tunnel.

[0082] In an exemplary embodiment, the end-type Layer 2 forwarding segment identifier may be represented as End.DX2SID (End.Direct eXit 2Segment Identifier). As a segment identifier in SRv6, End.DX2 SID may be used in L2VPN (Layer 2 Virtual Private Network), EVPN (Ethernet Virtual Private Network) or VPWS (Virtual Private Wire Service) scenarios.

[0083] It should be noted that the main function of the end-type layer 2 forwarding segment identifier is to decapsulate the received SRH (Segment Routing Header) and the outer IPv6 (Internet Protocol Version 6) message header, and then directly forward the remaining message from the outbound interface bound to the end-type layer 2 forwarding segment identifier. On this basis, the embodiment of the present disclosure implements ESP encryption and decryption based on the end-type layer 2 forwarding segment identifier.

[0084] In some exemplary embodiments, the end-type layer-2 forwarding segment identifier includes a target operation code, and the target operation code is used to indicate a corresponding ESP encryption and decryption mode.

[0085] In a possible implementation, the target opcode may be an SRv6 SID opcode, and the target opcode may carry Decryption behavior information (also referred to as End.DX2 withDecryption). Furthermore, the first PE may be locally pre-configured with the Decryption behavior information corresponding to the end-type layer 2 forwarding segment identifier.

[0086] In some embodiments, the fields contained in the first and second layer Ethernet frame messages may include, in addition to the end-type second layer forwarding segment identifier, destination MAC address, source MAC address, type / length field, data field, and FCS (Frame Check Sequence).

[0087] S204: The first PE encapsulates the first layer-2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the end-type layer-2 forwarding segment identifier.

[0088] In an exemplary embodiment, the format of the first target message may be an SRv6 message, so the outermost message header of the first target message may be an IPv6 message header.

[0089] In this case, the destination address in the IPv6 message header may be a termination-type layer 2 forwarding segment identifier, that is, the termination-type layer 2 forwarding segment identifier may be used to indicate that the destination address of the SRv6 message is the second PE.

[0090] S206: The first PE performs ESP encapsulation on the first target message to obtain a target data packet.

[0091] In some exemplary embodiments, the IPsec policy interested flow of the first PE is the end-type layer 2 forwarding segment identifier.

[0092] In this case, performing ESP encapsulation on the first target message to obtain a target data packet may include: determining that the first target message matches the IPsec policy based on an end-type layer 2 forwarding segment identifier included in the first target message; and performing ESP encapsulation on the first target message based on a transmission mode of the IPsec policy to obtain a target data packet.

[0093] It should be noted that an IPsec policy can be a set of rules and parameters used to define how to protect a specific type of traffic. An IPsec policy determines which data flows need to be protected by IPsec, and an interest flow can be used to describe a specific type of network traffic that needs to be protected by IPsec.

[0094] In the embodiment of the present disclosure, the flow of interest of the IPsec policy can be identified by the end-type layer 2 forwarding segment identifier. It should be noted that the flow of interest can also be identified by parameters such as source IP address, destination IP address, protocol type, port number, etc., which is not limited in the embodiment of the present disclosure.

[0095] In some possible implementations, the IP of the interested stream in the IPsec policy of the first PE may be set to End.DX2SID. When the first target message hits the IPsec policy, the first PE may perform ESP encryption protection on the payload of the first target message based on the IPSec transmission mode.

[0096] It should be noted that the IPsec transport mode inserts an ESP header between the original IP packet header and the IP payload, and adds the ESP trailer and ESP verification data part at the end. In addition, IPsec also includes a tunnel mode, which can encapsulate the entire original IP packet into a new IP packet, insert the ESP header between the new IP header and the original IP header, and add the ESP trailer and ESP verification data part at the end.

[0097] S208: The first PE sends the target data packet to the second PE.

[0098] In some exemplary embodiments, sending the target data packet to the second PE includes: determining the address of the second PE according to the end-type layer-2 forwarding segment identifier; and sending the target data packet to the second PE according to the address of the second PE.

[0099] In a possible embodiment, the first PE may search the IPv6 routing table according to the end-type layer 2 forwarding segment identifier to determine the path information of the second PE, thereby forwarding the target data packet to the second PE through the SRv6 network.

[0100] The method provided by the embodiment of the present disclosure can implement ESP encapsulation based on the end-type layer 2 forwarding segment identifier, and then implement the layer 2 forwarding action. Therefore, the embodiment of the present disclosure can combine the security mechanism in the SRv6 network to ensure the security of data in transmission.

[0101] Figure 3 A flow chart of a method for forwarding Layer 2 services in an embodiment of the present disclosure is shown as follows: Figure 3 As shown, the layer 2 service forwarding method provided in the embodiment of the present disclosure can be executed by the second PE, and the layer 2 service forwarding method includes the following steps S302 to S208.

[0102] S302: The second PE receives a target data packet.

[0103] Exemplarily, the second PE may receive a target data packet sent by the first PE via an SRv6 network, wherein the SRv6 network may be combined with an IPsec tunnel, thereby ensuring data security while achieving flexible forwarding of the target data packet.

[0104] S304: The second PE identifies the end-type layer-2 forwarding segment identifier in the target data packet.

[0105] In an exemplary embodiment, the second PE may determine whether the target data packet includes a terminated layer 2 forwarding segment identifier. The terminated layer 2 forwarding segment identifier may include a target operation code, and the target operation code is used to indicate a corresponding ESP encryption and decryption method.

[0106] S306: The second PE performs ESP decapsulation on the target data packet according to the end-type layer-2 forwarding segment identifier to obtain a second target message.

[0107] Exemplarily, the second target message may be an SRv6 message.

[0108] In some exemplary embodiments, the target data packet is decapsulated by ESP according to the end-type layer-2 forwarding segment identifier to obtain a second target message, including: determining whether the end-type layer-2 forwarding segment identifier includes a target operation code; if it is determined that the target operation code is included, the target data packet is decapsulated by ESP to obtain the second target message.

[0109] Exemplarily, the target opcode may carry Decryption behavior information. Furthermore, the second PE may be locally pre-configured with Decryption behavior information corresponding to the end-type layer 2 forwarding segment identifier. Therefore, when it is determined that the target opcode is included, the second PE can determine that the target data packet needs to be decapsulated by ESP.

[0110] In some exemplary embodiments, the target data packet is decapsulated by ESP to obtain a second target message, including: if the remaining segment number field in the second target message is 0 and the second target message includes an ESP header, the corresponding security association information is determined according to the end-type layer 2 forwarding segment identifier; according to the decapsulation method in the security association information, the target data packet is decapsulated by ESP to obtain the second target message.

[0111] In a possible implementation, the logical pseudocode of End.DX2 with Decryption may include the following steps: First, when processing an SRv6 message, it may be determined whether Segments Left is equal to 0, and whether the message contains IPsec header information, that is, whether it contains ESP.

[0112] It should be noted that the Segments Left field can be located in the SRH of the SRv6 message to indicate how many segments the current SRv6 message needs to go through before reaching the final destination. When Segments Left is equal to 0, it means that the SRv6 message has reached the last specified segment in its path.

[0113] When Segments Left is equal to 0 and the message contains IPsec header information, the second PE can search for corresponding security association information according to the SPI (Security Parameter Index) value, destination IP address, etc. in the IPsec header information.

[0114] Exemplarily, the security association information may be an IPsec SA (Security Association) record. It should be noted that the IPsec SA may be used to define how to process encrypted and decrypted messages. Therefore, the second PE may perform ESP decapsulation according to the security association information to remove the ESP message header to obtain the second target message.

[0115] S308: The second PE decapsulates the second target message according to the end-type layer-2 forwarding segment identifier to obtain a second layer-2 Ethernet frame message.

[0116] In some embodiments, the logic pseudo code of End.DX2 with Decryption may further include the following steps: removing the external IPv6 message header and other extension headers to obtain a second layer 2 Ethernet frame message, and then forwarding the second layer 2 Ethernet frame message to the layer 2 outbound interface bound to End.DX2, thereby sending the second layer 2 Ethernet frame message to the corresponding second CE.

[0117] It should be noted that, when no error or abnormality occurs in the Layer 2 service forwarding process and the message content is not adjusted in the process, the content of the second Layer 2 Ethernet frame message is the same as the first Layer 2 Ethernet frame message.

[0118] The method provided by the embodiment of the present disclosure defines a new SRv6 SID opcode behavior, namely End.DX2with Decryption, which can be executed at the VPWS instance end node to first unpack the ESP encapsulation and then unpack the SRv6 header for layer 2 forwarding. In addition, the embodiment of the present disclosure defines the IPsec implementation process of End.DX2 with Decryption in the SRv6 VPWS instance node. Therefore, the embodiment of the present disclosure can realize the combination of security mechanisms in the SRv6 network to ensure the security of data in transmission.

[0119] For example, a schematic diagram of an SRv6 SID provided in an embodiment of the present disclosure may be as follows: Figure 4 shown.

[0120] In this Figure 4In the SRv6 SID defined in the embodiment of the present disclosure, three fields, namely, Locator, Function, and Argument, may be included. The SRv6 SID has a total of 128 bits. The Locator field is the prefix part of the SID and can be used for routing selection. The Function field can be used to define the specific behavior or operation of the SID. The Argument field is an optional field that can carry parameters related to the IPsec service, such as encrypted streams, SPI identifiers, etc.

[0121] In some embodiments, the target opcode may be located in the Function field, that is, the Function field includes End.DX2 with Decryption, where Decryption refers to the action of decrypting the ESP encapsulation performed at the instance end node. The Decryption action is performed before the corresponding End.DX2 action is performed and needs to be used in conjunction with End.DX2, which can be understood as an additional action attached to End.DX2.

[0122] For example, a schematic diagram of a process of Layer 2 service forwarding provided by an embodiment of the present disclosure may be as follows: Figure 5 shown.

[0123] In this Figure 5 In the example, the first CE can send the first and second layer Ethernet frame messages to the first PE through the second layer interface. The first PE can perform SRv6 encapsulation on the first and second layer Ethernet frame messages and match the IPsec policy. Then, when the match is successful, ESP encapsulation is performed to obtain the target data packet. Then, the target data packet can be sent to the second PE through the SRv6 network. Exemplarily, the first PE can send the target data packet based on the IPv6 protocol layer and the IPsec tunnel.

[0124] Exemplarily, the second PE may receive the target data packet, and perform ESP decapsulation and SRv6 decapsulation on the target data packet to obtain a second layer 2 Ethernet frame message. Then the second PE may send the second layer 2 Ethernet frame message to the second CE based on the layer 2 interface.

[0125] Similarly, the second PE can also receive the layer 2 Ethernet frame message sent by the second CE based on the same process as the first PE, and send the corresponding data packet to the first PE. In addition, the first PE can receive the corresponding data packet based on the same process as the second PE, and send its corresponding layer 2 Ethernet frame message to the first CE.

[0126] For example, a schematic diagram of a VPWS service forwarding plane protocol stack combining IPsec and SRv6 provided in an embodiment of the present disclosure can be as follows: Figure 6 shown.

[0127] In this Figure 6 In the figure, Payload and private network service IP are both user service messages, which are transparently transmitted between CE devices and will not be changed. OSI L3 (Open Systems Interconnection Layer3) is the network layer, OSI L2 is the data link layer, and OSI L1 is the physical layer. The data link layer corresponds to MAC, and the third layer corresponds to SRv6 and ESP. Among them, ESP is the security encapsulation header of IPsec, which is transparently transmitted between PE end nodes and encapsulated and decapsulated by PE nodes. SRv6 messages can carry or not carry the IPv6 message header with the SRH header. If the SRH header is carried, the intermediate node P needs to process it. If the SRH header is not carried, the intermediate node P does not need to process it. Regardless of whether the SRH header is carried, the ESP message header can be encapsulated behind the SRv6 message header to avoid affecting the parsing of the SRv6 message.

[0128] It should be noted that the acquisition, storage, use, and processing of data in the technical solution disclosed in this disclosure are in compliance with the relevant provisions of national laws and regulations, and various types of data such as personal identity data, operation data, behavioral data, etc. related to individuals, customers, and groups obtained in the embodiments of this disclosure have all been authorized.

[0129] Based on the same inventive concept, the embodiment of the present disclosure also provides a layer 2 service forwarding device, as described in the following embodiment. Since the principle of solving the problem in the device embodiment is similar to that in the above method embodiment, the implementation of the device embodiment can refer to the implementation of the above method embodiment, and the repeated parts will not be repeated.

[0130] Figure 7 A schematic diagram of a layer 2 service forwarding device in an embodiment of the present disclosure is shown. Figure 7 As shown, the device is applied to the first PE and includes:

[0131] The first layer 2 Ethernet frame message receiving module 701 is used to receive the first layer 2 Ethernet frame message, determine the end type layer 2 forwarding segment identifier corresponding to the first layer 2 Ethernet frame message, and the end type layer 2 forwarding segment identifier is used to indicate the corresponding ESP encryption and decryption mode;

[0132] A first target message determination module 702, configured to encapsulate the first layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the end-type layer 2 forwarding segment identifier;

[0133] A target data packet determination module 703 is used to perform ESP encapsulation on the first target message to obtain a target data packet;

[0134] The target data packet sending module 704 is configured to send the target data packet to the second PE.

[0135] In some exemplary embodiments, the IPsec policy interested flow of the first PE is the end-type Layer 2 forwarding segment identifier, and the target data packet determination module is used to determine that the first target message matches the IPsec policy based on the end-type Layer 2 forwarding segment identifier included in the first target message; and perform ESP encapsulation on the first target message based on the transmission mode of the IPsec policy to obtain a target data packet.

[0136] In some exemplary embodiments, the target data packet sending module 704 is used to determine the address of the second PE according to the end-type layer-2 forwarding segment identifier; and send the target data packet to the second PE according to the address of the second PE.

[0137] In some exemplary embodiments, the end-type layer-2 forwarding segment identifier includes a target operation code, and the target operation code is used to indicate a corresponding ESP encryption and decryption mode.

[0138] It should be noted that the first layer 2 Ethernet frame message receiving module 701, the first target message determination module 702, the target data packet determination module 703, and the target data packet sending module 704 correspond to S202 to S208 in the method embodiment, and the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above method embodiment. It should be noted that the above modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0139] The device provided by the embodiment of the present disclosure can implement ESP encapsulation based on the end-type layer 2 forwarding segment identifier, and then implement the layer 2 forwarding action. Therefore, the embodiment of the present disclosure can be combined with a security mechanism in the SRv6 network to ensure the security of data in transmission.

[0140] Figure 8 A schematic diagram of a layer 2 service forwarding device in an embodiment of the present disclosure is shown. Figure 8 As shown, the device is applied to the second PE and includes:

[0141] The target data packet receiving module 801 is used to receive the target data packet;

[0142] An end-type layer 2 forwarding segment identifier identification module 802, used to identify an end-type layer 2 forwarding segment identifier in the target data packet;

[0143] A second target message determination module 803 is used to perform ESP decapsulation on the target data packet according to the end-type layer 2 forwarding segment identifier to obtain a second target message;

[0144] The second layer 2 Ethernet frame message determining module 804 is configured to decapsulate the second target message according to the end-type layer 2 forwarding segment identifier to obtain a second layer 2 Ethernet frame message.

[0145] In some exemplary embodiments, the second target message determination module 803 is used to determine whether the end-type layer 2 forwarding segment identifier includes a target operation code; if it is determined that the target operation code is included, the target data packet is ESP decapsulated to obtain the second target message.

[0146] In some exemplary embodiments, the second target message determination module 803 is used to determine the corresponding security association information according to the end-type layer 2 forwarding segment identifier if the remaining segment number field in the second target message is 0 and the second target message includes an ESP header; perform ESP decapsulation on the target data packet according to the decapsulation method in the security association information to obtain the second target message.

[0147] It should be noted that the target data packet receiving module 801, the end-type layer 2 forwarding segment identifier identification module 802, the second target message determination module 803, and the second layer 2 Ethernet frame message determination module 804 correspond to S302 to S308 in the method embodiment, and the examples and application scenarios implemented by the above modules and corresponding steps are the same, but are not limited to the contents disclosed in the above method embodiment. It should be noted that the above modules as part of the device can be executed in a computer system such as a set of computer executable instructions.

[0148] Those skilled in the art will appreciate that various aspects of the present disclosure may be implemented as systems, methods or program products. Therefore, various aspects of the present disclosure may be specifically implemented in the following forms, namely: complete hardware implementation, complete software implementation (including firmware, microcode, etc.), or a combination of hardware and software, which may be collectively referred to herein as "circuits", "modules" or "systems".

[0149] The embodiment of the present disclosure provides an electronic device, which exemplarily includes: a processor and a memory. The memory can be used to store executable instructions of the processor. The processor is configured to implement the layer 2 service forwarding method provided by the embodiment of the present disclosure by executing the above executable instructions.

[0150] Refer to the following Fig. 9 The electronic device 900 according to this embodiment of the present disclosure is described. Fig. 9The electronic device 900 shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0151] like Fig. 9 As shown, the electronic device 900 is in the form of a general computing device. The components of the electronic device 900 may include, but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0152] The storage unit stores a program code, which can be executed by the processing unit 910, so that the processing unit 910 executes the steps described in the above "Exemplary Method" section of this specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 910 can execute the following steps of the above method embodiment: receiving a first layer 2 Ethernet frame message, determining an end-type layer 2 forwarding segment identifier corresponding to the first layer 2 Ethernet frame message, the end-type layer 2 forwarding segment identifier is used to indicate the corresponding ESP encryption and decryption method; encapsulating the first layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the end-type layer 2 forwarding segment identifier; performing ESP encapsulation on the first target message to obtain a target data packet; and sending the target data packet to the second PE.

[0153] Alternatively, the processing unit 910 may execute the following steps of the above-mentioned method embodiment: receiving a target data packet; identifying an end-type Layer 2 forwarding segment identifier in the target data packet; performing ESP decapsulation on the target data packet according to the end-type Layer 2 forwarding segment identifier to obtain a second target message; decapsulating the second target message according to the end-type Layer 2 forwarding segment identifier to obtain a second Layer 2 Ethernet frame message.

[0154] The storage unit 920 may include a readable medium in the form of a volatile storage unit, such as a random access storage unit (RAM) 9201 and / or a cache storage unit 9202 , and may further include a read-only storage unit (ROM) 9203 .

[0155] The storage unit 920 may also include a program / utility 9204 having a set (at least one) of program modules 9205, such program modules 9205 including but not limited to: an operating system, one or more application programs, other program modules, and program data, each of which or some combination may include an implementation of a network environment.

[0156] Bus 930 may represent one or more of several types of bus structures, including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

[0157] The electronic device 900 may also communicate with one or more external devices 940 (e.g., keyboards, pointing devices, Bluetooth devices, etc.), may also communicate with one or more devices that enable a user to interact with the electronic device 900, and / or may communicate with any device that enables the electronic device 900 to communicate with one or more other computing devices (e.g., routers, modems, etc.). Such communication may be performed via an input / output (I / O) interface 950. Furthermore, the electronic device 900 may also communicate with one or more networks (e.g., local area networks (LANs), wide area networks (WANs), and / or public networks, such as the Internet) via a network adapter 960. As shown, the network adapter 960 communicates with other modules of the electronic device 900 via a bus 930. It should be understood that, although not shown in the figure, other hardware and / or software modules may be used in conjunction with the electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems, etc.

[0158] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a terminal device, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0159] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart may be implemented as a computer program product, which includes: a computer program, which implements the above-mentioned layer 2 service forwarding method when executed by a processor.

[0160] In an exemplary embodiment of the present disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, and when the computer program is executed by a processor, the layer 2 service forwarding method provided in the embodiment of the present disclosure can be implemented. The computer-readable storage medium can be a readable signal medium or a readable storage medium.

[0161] Fig.10 A schematic diagram of a computer-readable storage medium in an embodiment of the present disclosure is shown. Fig.10As shown, a program product capable of implementing the above method of the present disclosure is stored on the computer-readable storage medium 1000. In some possible implementations, various aspects of the present disclosure may also be implemented in the form of a program product, which includes a program code. When the program product is run on a terminal device, the program code is used to enable the terminal device to execute the steps according to various exemplary implementations of the present disclosure described in the above “Exemplary Method” section of this specification.

[0162] More specific examples of computer-readable storage media in the present disclosure may include, but are not limited to, an electrical connection having one or more conductors, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0163] In the present disclosure, a computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, wherein a readable program code is carried. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A readable signal medium may also be any readable medium other than a readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0164] Alternatively, the program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wired, optical cable, RF, etc., or any suitable combination of the foregoing.

[0165] In a specific implementation, the program code for performing the operation of the present disclosure may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, C++, etc., and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user computing device, partially on the user device, as a separate software package, partially on the user computing device and partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device may be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computing device (e.g., using an Internet service provider to connect through the Internet).

[0166] It should be noted that, although several modules or units of the device for action execution are mentioned in the above detailed description, this division is not mandatory. In fact, according to the embodiments of the present disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. On the contrary, the features and functions of one module or unit described above can be further divided into multiple modules or units to be embodied.

[0167] In addition, although the steps of the method in the present disclosure are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.

[0168] Through the description of the above implementation, it is easy for those skilled in the art to understand that the example implementation described here can be implemented by software, or by software combined with necessary hardware. Therefore, the technical solution according to the implementation of the present disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (which can be a CD-ROM, a USB flash drive, a mobile hard disk, etc.) or on a network, including several instructions to enable a computing device (which can be a personal computer, a server, a mobile terminal, or a network device, etc.) to execute the method according to the implementation of the present disclosure.

[0169] Those skilled in the art will readily appreciate other embodiments of the present disclosure after considering the specification and practicing the invention disclosed herein. The present disclosure is intended to cover any variations, uses or adaptations of the present disclosure, which follow the general principles of the present disclosure and include common knowledge or customary technical means in the art that are not disclosed in the present disclosure. The description and examples are to be regarded as exemplary only, and the true scope of the present disclosure is indicated by the appended claims.

Claims

1. A layer 2 service forwarding method, characterized in that: The process is executed by the first service provider edge device PE and includes: receiving a first layer 2 Ethernet frame message, and determining an end-type layer 2 forwarding segment identifier corresponding to the first layer 2 Ethernet frame message, wherein the end-type layer 2 forwarding segment identifier is used to indicate a corresponding encapsulating security payload ESP encryption and decryption mode; encapsulating the first layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the end-type layer 2 forwarding segment identifier; Performing ESP encapsulation on the first target message to obtain a target data packet; The target data packet is sent to the second PE.

2. The layer 2 service forwarding method according to claim 1, characterized in that: The Internet Protocol Security IPsec policy interested flow of the first PE is the end-type layer 2 forwarding segment identifier, and the ESP encapsulation of the first target message to obtain the target data packet includes: Determining, according to the end-type layer 2 forwarding segment identifier included in the first target message, that the first target message matches the IPsec policy; The first target message is encapsulated by ESP based on the transmission mode of the IPsec policy to obtain a target data packet.

3. The layer 2 service forwarding method according to claim 1 or 2, characterized in that: The sending the target data packet to the second PE includes: Determine the address of the second PE according to the end-type layer 2 forwarding segment identifier; The target data packet is sent to the second PE according to the address of the second PE.

4. The layer 2 service forwarding method according to claim 1 or 2, characterized in that: The end-type layer 2 forwarding segment identifier includes a target operation code, and the target operation code is used to indicate a corresponding ESP encryption and decryption method.

5. A layer 2 service forwarding method, characterized in that: Executed by the second PE, including: Receive target data packets; Identifying an end-type layer 2 forwarding segment identifier in the target data packet; According to the end-type layer 2 forwarding segment identifier, the target data packet is decapsulated by ESP to obtain a second target message; The second target message is decapsulated according to the end-type layer-2 forwarding segment identifier to obtain a second layer-2 Ethernet frame message.

6. The layer 2 service forwarding method according to claim 5, characterized in that: The step of performing ESP decapsulation on the target data packet according to the end-type layer 2 forwarding segment identifier to obtain a second target message includes: Determining whether the end-type layer 2 forwarding segment identifier includes a target operation code; If it is determined that the target operation code is included, the target data packet is decapsulated by ESP to obtain a second target message.

7. The layer 2 service forwarding method according to claim 5 or 6, characterized in that: The step of performing ESP decapsulation on the target data packet to obtain a second target message includes: If the number of remaining segments field in the second target message is 0 and the second target message includes an ESP header, determining corresponding security association information according to the end-type layer 2 forwarding segment identifier; According to the decapsulation mode in the security association information, the target data packet is decapsulated by ESP to obtain the second target message.

8. A layer 2 service forwarding system, characterized in that: Including the first PE and the second PE: The first PE is used to receive a first layer 2 Ethernet frame message, determine an end-type layer 2 forwarding segment identifier corresponding to the first layer 2 Ethernet frame message, and the end-type layer 2 forwarding segment identifier is used to indicate a corresponding ESP encryption and decryption method; encapsulate the first layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the end-type layer 2 forwarding segment identifier; perform ESP encapsulation on the first target message to obtain a target data packet; and send the target data packet to the second PE; The second PE is used to receive the target data packet; identify the end-type layer 2 forwarding segment identifier in the target data packet; perform ESP decapsulation on the target data packet according to the end-type layer 2 forwarding segment identifier to obtain a second target message; decapsulate the second target message according to the end-type layer 2 forwarding segment identifier to obtain a second layer 2 Ethernet frame message.

9. An electronic device, characterized in that: include: processor; as well as A memory, configured to store executable instructions of the processor; The processor is configured to execute the layer 2 service transmission method according to any one of claims 1 to 7 by executing the executable instructions.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the layer 2 service transmission method according to any one of claims 1 to 7 is implemented.

11. A computer program product, characterized in that The computer program product includes computer instructions, which are stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the electronic device executes the Layer 2 service transmission method as described in any one of claims 1 to 7.

Images