Layer 2 service forwarding methods, systems, electronic devices, and storage media

Abstract

This disclosure provides a Layer 2 service forwarding method, system, electronic device, and storage medium, relating to the field of mobile communication technology. The method includes: receiving a first Layer 2 Ethernet frame message; determining a termination-type Layer 2 forwarding segment identifier corresponding to the first Layer 2 Ethernet frame message, the termination-type Layer 2 forwarding segment identifier indicating the corresponding ESP encryption / decryption method; encapsulating the first Layer 2 Ethernet frame message into a first target message, wherein the outermost header of the first target message includes the termination-type Layer 2 forwarding segment identifier; performing ESP encapsulation on the first target message to obtain a target data packet; and sending the target data packet to a second PE. This disclosure can implement ESP encapsulation based on the termination-type Layer 2 forwarding segment identifier, and then implement Layer 2 forwarding. Therefore, this disclosure can combine security mechanisms in SRv6 networks to ensure data security during transmission.

Description

Technical Field

[0001] This disclosure relates to the field of mobile communication technology, and in particular to a Layer 2 service forwarding method, system, electronic device, and storage medium. Background Technology

[0002] With the development of mobile communication technology, SRv6 (Segment Routing IPv6) technology has begun to be introduced into networks. SRv6 technology provides a flexible way to define network paths and service chains, but SRv6 technology itself does not have built-in security mechanisms.

[0003] Therefore, during network orchestration and scheduling, high-security users still need to encrypt business data to prevent data leakage. Thus, there is an urgent need for a Layer 2 service forwarding method to incorporate security mechanisms into SRv6 networks to ensure data security during transmission.

[0004] It should be noted that the information disclosed in the background section above is only used to enhance the understanding of the background of this disclosure, and therefore may include information that does not constitute prior art known to those skilled in the art. Summary of the Invention

[0005] This disclosure provides a Layer 2 service forwarding method, system, electronic device, and storage medium, which at least partially addresses the issue of ensuring data security during transmission by incorporating security mechanisms in SRv6 networks.

[0006] Other features and advantages of this disclosure will become apparent from the following detailed description, or may be learned in part from practice of this disclosure.

[0007] According to one aspect of this disclosure, a Layer 2 service forwarding method is provided, executed by a first PE (ProviderEdge), comprising:

[0008] Receive the first Layer 2 Ethernet frame packet, determine the end-of-life Layer 2 forwarding segment identifier corresponding to the first Layer 2 Ethernet frame packet, the end-of-life Layer 2 forwarding segment identifier is used to indicate the corresponding ESP (Encapsulating Security Payload) encryption and decryption method;

[0009] The first Layer 2 Ethernet frame packet is encapsulated into a first destination packet, wherein the outermost header of the first destination packet includes the termination type Layer 2 forwarding segment identifier;

[0010] The first target message is encapsulated using ESP to obtain the target data packet;

[0011] The target data packet is sent to the second PE.

[0012] In some exemplary embodiments, the flow of interest of the first PE's IPsec (Internet Protocol Security) policy is the terminated Layer 2 forwarding segment identifier, and the step of performing ESP encapsulation on the first target packet to obtain the target data packet includes:

[0013] Based on the terminated Layer 2 forwarding segment identifier included in the first target packet, it is determined that the first target packet matches the IPsec policy;

[0014] The first target packet is encapsulated using ESP based on the transmission mode of the IPsec policy to obtain the target data packet.

[0015] In some exemplary embodiments, sending the target data packet to the second PE includes:

[0016] The address of the second PE is determined based on the terminated Layer 2 forwarding segment identifier;

[0017] The target data packet is sent to the second PE based on the address of the second PE.

[0018] In some exemplary embodiments, the termination-type Layer 2 forwarding segment identifier includes a target opcode, which is used to indicate the corresponding ESP encryption / decryption method.

[0019] According to another aspect of this disclosure, a Layer 2 service forwarding method is also provided, executed by a second PE, comprising:

[0020] Receive target data packets;

[0021] Identify the end-of-line Layer 2 forwarding segment identifier in the target data packet;

[0022] Based on the terminated Layer 2 forwarding segment identifier, the target data packet is decapsulated using ESP to obtain the second target packet;

[0023] Based on the terminated Layer 2 forwarding segment identifier, the second target packet is decapsulated to obtain the second Layer 2 Ethernet frame packet.

[0024] In some exemplary embodiments, the step of performing ESP decapsulation on the target data packet according to the termination type Layer 2 forwarding segment identifier to obtain a second target packet includes:

[0025] Determine whether the target opcode is included in the terminated Layer 2 forwarding segment identifier;

[0026] If the target opcode is determined to be included, the target data packet is decapsulated using ESP to obtain the second target message.

[0027] In some exemplary embodiments, the step of performing ESP decapsulation on the target data packet to obtain a second target message includes:

[0028] If the remaining segment number field in the second target message is 0 and the second target message includes an ESP header, then the corresponding security association information is determined according to the termination type Layer 2 forwarding segment identifier;

[0029] Based on the decapsulation method in the security association information, the target data packet is decapsulated using ESP to obtain the second target message.

[0030] According to another aspect of this disclosure, a Layer 2 service forwarding device is also provided, applied to a first PE, comprising:

[0031] The first and second layer Ethernet frame packet receiving module is used to receive the first and second layer Ethernet frame packets and determine the termination type layer 2 forwarding segment identifier corresponding to the first and second layer Ethernet frame packets. The termination type layer 2 forwarding segment identifier is used to indicate the corresponding ESP encryption and decryption method.

[0032] The first target message determination module is used to encapsulate the first Layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the termination type Layer 2 forwarding segment identifier;

[0033] The target data packet determination module is used to perform ESP encapsulation on the first target message to obtain the target data packet;

[0034] The target data packet sending module is used to send the target data packet to the second PE.

[0035] In some exemplary embodiments, the IPsec policy interest flow of the first PE is the End-of-Line Layer 2 Forwarding Segment Identifier. The target packet determination module is used to determine that the first target packet matches the IPsec policy based on the End-of-Line Layer 2 Forwarding Segment Identifier included in the first target packet; and to perform ESP encapsulation on the first target packet based on the transmission mode of the IPsec policy to obtain the target packet.

[0036] In some exemplary embodiments, the target data packet sending module is configured to determine the address of the second PE based on the termination type Layer 2 forwarding segment identifier; and send the target data packet to the second PE based on the address of the second PE.

[0037] In some exemplary embodiments, the terminated Layer 2 forwarding segment identifier includes a target opcode, which is used to indicate the corresponding ESP encryption / decryption method.

[0038] According to another aspect of this disclosure, a Layer 2 service forwarding device is also provided, applied to a second PE, comprising:

[0039] The target data packet receiving module is used to receive target data packets;

[0040] A termination-type Layer 2 forwarding segment identifier identification module is used to identify termination-type Layer 2 forwarding segment identifiers in the target data packet;

[0041] The second target message determination module is used to perform ESP decapsulation on the target data packet according to the termination type Layer 2 forwarding segment identifier to obtain the second target message;

[0042] The second Layer 2 Ethernet frame packet determination module is used to decapsulate the second target packet according to the termination type Layer 2 forwarding segment identifier to obtain the second Layer 2 Ethernet frame packet.

[0043] In some exemplary embodiments, the second target message determination module is used to determine whether the termination type Layer 2 forwarding segment identifier includes a target opcode; if it is determined that the target opcode is included, the target data packet is decapsulated using ESP to obtain the second target message.

[0044] In some exemplary embodiments, the second target packet determination module is configured to determine the corresponding security association information based on the end-of-line forwarding segment identifier if the remaining segment number segment in the second target packet is 0 and the second target packet includes an ESP header; and to perform ESP decapsulation on the target data packet according to the decapsulation method in the security association information to obtain the second target packet.

[0045] According to another aspect of this disclosure, a Layer 2 service forwarding system is also provided, comprising a first PE and a second PE:

[0046] The first PE is configured to receive a first Layer 2 Ethernet frame packet, determine the termination type Layer 2 forwarding segment identifier corresponding to the first Layer 2 Ethernet frame packet, wherein the termination type Layer 2 forwarding segment identifier is used to indicate the corresponding ESP encryption / decryption method; encapsulate the first Layer 2 Ethernet frame packet into a first target packet, wherein the outermost header of the first target packet includes the termination type Layer 2 forwarding segment identifier; perform ESP encapsulation on the first target packet to obtain a target data packet; and send the target data packet to the second PE.

[0047] The second PE is used to receive the target data packet; identify the end-of-line (E2) forwarding segment identifier in the target data packet; decapsulate the target data packet using the E2 forwarding segment identifier to obtain a second target message; and decapsulate the second target message using the E2 forwarding segment identifier to obtain a second layer 2 Ethernet frame message.

[0048] According to another aspect of this disclosure, an electronic device is also provided, comprising: a processor; and a memory for storing executable instructions of the processor; wherein the processor is configured to perform a Layer 2 service forwarding method of any of the above by executing the executable instructions.

[0049] According to another aspect of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored, which, when executed by a processor, implements the Layer 2 service forwarding method of any one of the above.

[0050] According to another aspect of this disclosure, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of an electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the Layer 2 traffic forwarding method provided in various alternative embodiments of this disclosure.

[0051] The technical solutions provided in the embodiments of this disclosure can implement ESP encapsulation based on the terminated Layer 2 forwarding segment identifier, and then perform Layer 2 forwarding. Therefore, the embodiments of this disclosure can combine security mechanisms in SRv6 networks to ensure data security during transmission.

[0052] It should be understood that the above general description and the following detailed description are exemplary and explanatory only, and are not intended to limit this disclosure. Attached Figure Description

[0053] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure. It is obvious that the drawings described below are merely some embodiments of this disclosure, and those skilled in the art can obtain other drawings based on these drawings without any inventive effort.

[0054] Figure 1 A schematic diagram of a system architecture according to an embodiment of this disclosure is shown;

[0055] Figure 2 This diagram illustrates a flowchart of a Layer 2 service forwarding method according to an embodiment of the present disclosure.

[0056] Figure 3 This diagram illustrates another Layer 2 service forwarding method in an embodiment of this disclosure.

[0057] Figure 4 A schematic diagram of an SRv6 SID according to an embodiment of this disclosure is shown;

[0058] Figure 5 This diagram illustrates a Layer 2 service forwarding process in an embodiment of the present disclosure.

[0059] Figure 6 This diagram illustrates a VPWS service forwarding plane protocol stack according to an embodiment of the present disclosure;

[0060] Figure 7 This diagram illustrates a Layer 2 service forwarding device according to an embodiment of the present disclosure.

[0061] Figure 8 This diagram illustrates another Layer 2 service forwarding device in an embodiment of this disclosure.

[0062] Figure 9 This diagram illustrates a structural block diagram of an electronic device according to an embodiment of the present disclosure.

[0063] Figure 10 A schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure is shown. Detailed Implementation

[0064] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0065] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0066] The specific implementation methods of the embodiments of this disclosure will now be described in detail with reference to the accompanying drawings.

[0067] Figure 1A schematic diagram of an exemplary application system architecture to which the Layer 2 service forwarding method of this disclosure can be applied is shown. For example... Figure 1 As shown, the system architecture 100 may include a first PE 101, a network 102, and a second PE 103.

[0068] The first PE can be used to receive the first Layer 2 Ethernet frame message, determine the end-of-line forwarding segment identifier corresponding to the first Layer 2 Ethernet frame message, the end-of-line forwarding segment identifier is used to indicate the corresponding ESP encryption / decryption method; encapsulate the first Layer 2 Ethernet frame message into a first target message, wherein the outermost header of the first target message includes the end-of-line forwarding segment identifier; perform ESP encapsulation on the first target message to obtain a target data packet; and send the target data packet to the second PE.

[0069] Then, the second PE can be used to receive the target data packet; identify the end-of-line (E2) forwarding segment identifier in the target data packet; decapsulate the target data packet using the E2 forwarding segment identifier to obtain the second target message; and decapsulate the second target message using the E2 forwarding segment identifier to obtain the second E2 Ethernet frame message.

[0070] Network 102 is a medium used to provide a communication link between the first PE 101 and the second PE 103, and can be a wired network or a wireless network.

[0071] Optionally, the aforementioned wireless or wired networks use standard communication technologies and / or protocols. The network is typically the Internet, but can also be any network, including but not limited to Local Area Networks (LANs), Metropolitan Area Networks (MANs), Wide Area Networks (WANs), mobile, wired or wireless networks, private networks, or any combination of virtual private networks. In some embodiments, technologies and / or formats, including Hyper Text Markup Language (HTML), Extensible Markup Language (XML), etc., are used to represent data exchanged over the network. Furthermore, conventional encryption technologies such as Secure Socket Layer (SSL), Transport Layer Security (TLS), Virtual Private Networks (VPNs), and Internet Protocol Security (IPSec) can be used to encrypt all or some links. In other embodiments, custom and / or dedicated data communication technologies can be used to replace or supplement the aforementioned data communication technologies.

[0072] This disclosure does not limit the first PE 101 and the second PE 103. For example, the first PE 101 and the second PE 103 can be routers or switches located at the edge of the service provider network, responsible for connecting to the CE (Customer Edge) of the customer network.

[0073] For example, both the first PE 101 and the second PE 103 may be part of a service provider network for providing various value-added services. These value-added services may include, for example, MPLS (Multiprotocol Label Switching), VPNs (Virtual Private Networks), etc.

[0074] Those skilled in the art will know that Figure 1 The number of the first PE 101, network 102, and second PE 103 is merely illustrative. Depending on actual needs, any number of first PE 101, network 102, and second PE 103 can be used. This disclosure does not limit this.

[0075] Under the above system architecture, this disclosure provides a Layer 2 service forwarding method, which can be executed by any electronic device with computing capabilities.

[0076] In some embodiments, the Layer 2 service forwarding method provided in this disclosure can be executed by the first PE in the above system architecture; in other embodiments, the Layer 2 service forwarding method provided in this disclosure can be executed by the second PE in the above system architecture; in still other embodiments, the Layer 2 service forwarding method provided in this disclosure can be implemented by the first PE and the second PE in the above system architecture through interaction.

[0077] Figure 2 This invention discloses a flowchart of a Layer 2 service forwarding method according to an embodiment of the present invention, as shown below. Figure 2 As shown, the Layer 2 service forwarding method provided in this embodiment can be executed by the first PE, and the Layer 2 service forwarding method includes the following steps S202 to S208.

[0078] S202, the first PE receives the first Layer 2 Ethernet frame message and determines the end-of-line forwarding segment identifier corresponding to the first Layer 2 Ethernet frame message. The end-of-line forwarding segment identifier is used to indicate the corresponding ESP encryption / decryption method.

[0079] It should be noted that Layer 2 networking refers to the data link layer, which sits above the physical layer. The data link layer is responsible for reliable data transmission between nodes and processes the bit streams at the physical layer to ensure data is transmitted error-free from one node to another. Data transmission in a Layer 2 network can be achieved based on Layer 2 Ethernet frames. This Layer 2 Ethernet frame can contain arbitrary content.

[0080] In some embodiments, a first CE can send a first Layer 2 Ethernet frame message to a first PE, and then forward the first Layer 2 Ethernet frame message to a second PE via the SRv6 network through the first PE. The first CE can be connected to the first PE based on a Layer 2 interface.

[0081] For example, after receiving the first Layer 2 Ethernet frame message, the first PE can look up the associated SRv6 tunnel in the MAC (Media Access Control) address table and obtain the terminal Layer 2 forwarding segment identifier corresponding to the SRv6 tunnel.

[0082] In an exemplary embodiment, the termination-type Layer 2 forwarding segment identifier can be represented as End.DX2 SID (Endpoint with Decapsulation and Cross-connect to Layer 2 Segment Identifier). As a segment identifier in SRv6, End.DX2 SID can be used in L2VPN (Layer 2 Virtual Private Network), EVPN (Ethernet Virtual Private Network), or VPWS (Virtual Private Wire Service) scenarios.

[0083] It should be noted that the main function of the terminating Layer 2 forwarding segment identifier is to decapsulate the received SRH (Segment Routing Header) and the outer IPv6 (Internet Protocol Version 6) header, and then forward the remaining packet directly from the outgoing interface bound to the terminating Layer 2 forwarding segment identifier. This embodiment of the disclosure, based on this terminating Layer 2 forwarding segment identifier, implements ESP encryption and decryption.

[0084] In some exemplary embodiments, the terminated Layer 2 forwarding segment identifier includes a target opcode that indicates the corresponding ESP encryption / decryption method.

[0085] In one possible implementation, the target opcode can be an SRv6 SID opcode, and the target opcode can carry decryption behavior information (also known as End.DX2 with Decryption). Furthermore, the first PE can be pre-configured with the decryption behavior information corresponding to the end-type Layer 2 forwarding segment identifier.

[0086] In some embodiments, the fields included in the first and second layer Ethernet frame messages, in addition to the end-of-line layer 2 forwarding segment identifier, may also include, for example, the destination MAC address, source MAC address, type / length field, data field, and FCS (Frame Check Sequence).

[0087] S204, the first PE encapsulates the first Layer 2 Ethernet frame message into a first destination message, wherein the outermost header of the first destination message includes the termination type Layer 2 forwarding segment identifier.

[0088] In an exemplary embodiment, the format of the first target message can be an SRv6 message, and therefore the outermost header of the first target message can be an IPv6 header.

[0089] In this case, the destination address in the IPv6 packet header can be a terminated Layer 2 forwarding segment identifier. That is, this terminated Layer 2 forwarding segment identifier can be used to indicate that the destination address of the SRv6 packet is the second PE.

[0090] S206, the first PE performs ESP encapsulation on the first target message to obtain the target data packet.

[0091] In some exemplary embodiments, the flow of interest of the first PE's IPsec policy is the terminated Layer 2 forwarding segment identifier.

[0092] In this case, performing ESP encapsulation on the first target message to obtain the target data packet may include: determining that the first target message matches the IPsec policy based on the termination type Layer 2 forwarding segment identifier included in the first target message; and performing ESP encapsulation on the first target message based on the transmission mode of the IPsec policy to obtain the target data packet.

[0093] It should be noted that an IPsec policy is a set of rules and parameters used to define how to protect specific types of traffic. An IPsec policy determines which data flows need to be protected by IPsec, and the flows of interest can be used to describe the specific types of network traffic that need to be protected by IPsec.

[0094] In this embodiment of the disclosure, the flow of interest under the IPsec policy can be identified by a termination-type Layer 2 forwarding segment identifier. It should be noted that the flow of interest can also be identified by parameters such as source IP address, destination IP address, protocol type, and port number; this embodiment of the disclosure does not limit this identification.

[0095] In some possible implementations, the IP address of the flow of interest in the IPsec policy of the first PE can be set to End.DX2SID. When the first target packet hits the IPsec policy, the first PE can perform ESP encryption protection on the payload of the first target packet based on the IPsec transmission mode.

[0096] It should be noted that, in IPsec transmission mode, an ESP header is inserted between the original IP packet header and the IP payload, and an ESP trailer and ESP authentication data are added at the end. Additionally, IPsec also includes a tunnel mode, which encapsulates the entire original IP packet into a new IP packet, inserts an ESP header between the new IP header and the original IP header, and adds an ESP trailer and ESP authentication data at the end.

[0097] S208, the first PE sends the target data packet to the second PE.

[0098] In some exemplary embodiments, sending the target data packet to the second PE includes: determining the address of the second PE based on the termination type Layer 2 forwarding segment identifier; and sending the target data packet to the second PE based on the address of the second PE.

[0099] In one possible implementation, the first PE can look up the IPv6 routing table based on the terminated Layer 2 forwarding segment identifier to determine the path information of the second PE, and then forward the target data packet to the second PE through the SRv6 network.

[0100] The method provided in this disclosure can perform ESP encapsulation based on the terminated Layer 2 forwarding segment identifier, and then implement Layer 2 forwarding. Therefore, this disclosure can combine security mechanisms in SRv6 networks to ensure data security during transmission.

[0101] Figure 3 This invention discloses a flowchart of a Layer 2 service forwarding method according to an embodiment of the present invention, as shown below. Figure 3 As shown, the Layer 2 service forwarding method provided in this embodiment can be executed by a second PE, and the Layer 2 service forwarding method includes the following steps S302 to S208.

[0102] S302, the second PE receives the target data packet.

[0103] For example, the second PE can receive target data packets sent by the first PE through an SRv6 network. This SRv6 network can be combined with an IPsec tunnel to ensure data security while enabling flexible forwarding of target data packets.

[0104] S304, the second PE identifies the end-of-line Layer 2 forwarding segment identifier in the target data packet.

[0105] In an exemplary embodiment, the second PE can determine whether the target data packet contains a termination-type Layer 2 forwarding segment identifier. This termination-type Layer 2 forwarding segment identifier may contain a target opcode, which indicates the corresponding ESP encryption / decryption method.

[0106] S306, the second PE performs ESP decapsulation on the target data packet according to the termination type Layer 2 forwarding segment identifier to obtain the second target message.

[0107] For example, the second target message can be an SRv6 message.

[0108] In some exemplary embodiments, performing ESP decapsulation on the target data packet based on the termination type Layer 2 forwarding segment identifier to obtain a second target message includes: determining whether the termination type Layer 2 forwarding segment identifier includes a target opcode; if it is determined that the target opcode is included, then performing ESP decapsulation on the target data packet to obtain the second target message.

[0109] For example, the target opcode may carry decryption behavior information. Furthermore, the second PE may be pre-configured locally with the decryption behavior information corresponding to the terminated Layer 2 forwarding segment identifier. Therefore, when it is determined that the target opcode is included, the second PE can determine that ESP decapsulation processing is required for the target data packet.

[0110] In some exemplary embodiments, performing ESP decapsulation on the target data packet to obtain a second target message includes: if the remaining segment number segment in the second target message is 0 and the second target message includes an ESP header, then determining the corresponding security association information based on the end-of-line forwarding segment identifier; and performing ESP decapsulation on the target data packet according to the decapsulation method in the security association information to obtain the second target message.

[0111] In one possible implementation, the logical pseudocode for End.DX2 with Decryption can include the following steps: First, when processing an SRv6 packet, it can be determined whether Segments Left (remaining number of segments) is equal to 0, and whether the packet contains IPsec header information, i.e., whether it contains ESP.

[0112] It should be noted that the Segments Left field can be located in the SRH of an SRv6 message, and it indicates how many more segments the current SRv6 message needs to traverse before reaching its final destination. When Segments Left equals 0, it means that the SRv6 message has reached the last specified segment in its path.

[0113] When Segments Left equals 0 and the packet contains IPsec header information, the second PE can look up the corresponding security association information based on the SPI (Security Parameter Index) value and destination IP address in the IPsec header information.

[0114] For example, this security association information can be an IPsec SA (Security Association) record. It should be noted that this IPsec SA can be used to define how to process encrypted and decrypted packets. Therefore, the second PE can perform ESP decapsulation based on this security association information to remove the ESP header and obtain the second target packet.

[0115] S308, the second PE decapsulates the second target packet according to the termination type Layer 2 forwarding segment identifier to obtain the second Layer 2 Ethernet frame packet.

[0116] In some embodiments, the logical pseudocode of End.DX2 with Decryption may further include the following steps: removing the external IPv6 header and other extension headers to obtain a second Layer 2 Ethernet frame, which can then be forwarded to the Layer 2 outgoing interface bound to End.DX2. This sends the second Layer 2 Ethernet frame to the corresponding second CE.

[0117] It should be noted that if no errors or anomalies occur during the Layer 2 service forwarding process, and the message content is not adjusted during this process, the content of the second Layer 2 Ethernet frame message is the same as that of the first Layer 2 Ethernet frame message.

[0118] The method provided in this disclosure defines a novel SRv6 SID opcode behavior, namely End.DX2withDecryption, which allows for Layer 2 forwarding by first decrypting the ESP encapsulation and then decrypting the SRv6 header at the VPWS instance node. Furthermore, this disclosure defines the IPsec implementation process of End.DX2 with Decryption on the SRv6 VPWS instance node. Therefore, this disclosure can integrate security mechanisms into SRv6 networks to ensure data security during transmission.

[0119] For example, a schematic diagram of an SRv6 SID provided in this disclosure embodiment can be as follows: Figure 4 As shown.

[0120] In Figure 4In this embodiment, the SRv6 SID defined may include three fields: Locator, Function, and Argument, totaling 128 bits. The Locator field is the prefix of the SID and can be used for routing. The Function field can be used to define the specific behavior or operation of the SID. The Argument field is optional and can carry parameters related to IPsec services, such as encrypted streams and SPI identifiers.

[0121] In some embodiments, the target opcode can be located in the Function field, that is, the Function field contains End.DX2 with Decryption, where Decryption refers to the action of unpacking the ESP encapsulation performed on the instance end node. The Decryption action precedes and needs to be used in conjunction with End.DX2 before the corresponding End.DX2 action is executed; it can be understood as an additional action attached to End.DX2.

[0122] For example, a schematic diagram of a Layer 2 service forwarding process provided in this disclosure embodiment can be as follows: Figure 5 As shown.

[0123] In Figure 5 In this scenario, the first CE can send a first Layer 2 Ethernet frame to the first PE via a Layer 2 interface. The first PE can then encapsulate the first Layer 2 Ethernet frame with SRv6 and match it against an IPsec policy. If the match is successful, it can then perform ESP encapsulation to obtain the target data packet. This target data packet can then be sent to the second PE via the SRv6 network. For example, the first PE can send the target data packet based on an IPv6 protocol layer and an IPsec tunnel.

[0124] For example, the second PE can receive the target data packet and perform ESP decapsulation and SRv6 decapsulation on the target data packet to obtain a second Layer 2 Ethernet frame message. Then, the second PE can send the second Layer 2 Ethernet frame message to the second CE based on the Layer 2 interface.

[0125] Similarly, the second PE can also receive Layer 2 Ethernet frame messages sent by the second CE using the same process as the first PE, and send the corresponding data packets to the first PE. Furthermore, the first PE can receive the corresponding data packets using the same process as the second PE, and send the corresponding Layer 2 Ethernet frame messages to the first CE.

[0126] For example, a schematic diagram of a VPWS service forwarding plane protocol stack combining IPsec and SRv6 provided in this disclosure embodiment can be shown as follows: Figure 6 As shown.

[0127] In Figure 6 In this context, both the payload and the private network service IP address belong to the user service packets and are transparently transmitted between CE devices without alteration. OSI L3 (Open Systems Interconnection Layer 3) is the network layer, OSI L2 is the data link layer, and OSI L1 is the physical layer. The data link layer corresponds to MAC, and the third layer corresponds to SRv6 and ESP. ESP is the IPsec security encapsulation header, transparently transmitted between PE end nodes, where the PE nodes perform encapsulation and decapsulation. SRv6 packets may or may not carry an IPv6 header with an SRH header. If an SRH header is included, intermediate node P needs to process it. If no SRH header is included, intermediate node P does not need to process it. Regardless of whether an SRH header is included, the ESP header can be encapsulated after the SRv6 header to avoid affecting the parsing of the SRv6 packet.

[0128] It should be noted that the acquisition, storage, use, and processing of data in this disclosed technical solution comply with the relevant provisions of national laws and regulations. The various types of data, such as personal identity data, operational data, and behavioral data related to individuals, customers, and groups, obtained in the embodiments of this disclosure have all been authorized.

[0129] Based on the same inventive concept, this disclosure also provides a Layer 2 service forwarding device, as described in the following embodiments. Since the principle by which this device solves the problem is similar to that of the above-described method embodiments, the implementation of this device embodiment can refer to the implementation of the above-described method embodiments, and repeated details will not be elaborated further.

[0130] Figure 7 This diagram illustrates a Layer 2 service forwarding device according to an embodiment of the present disclosure, such as... Figure 7 As shown, the device is applied to the first PE and includes:

[0131] The first and second layer Ethernet frame packet receiving module 701 is used to receive the first and second layer Ethernet frame packets and determine the termination type layer 2 forwarding segment identifier corresponding to the first and second layer Ethernet frame packets. The termination type layer 2 forwarding segment identifier is used to indicate the corresponding ESP encryption and decryption method.

[0132] The first target message determination module 702 is used to encapsulate the first Layer 2 Ethernet frame message into a first target message, wherein the outermost message header of the first target message includes the termination type Layer 2 forwarding segment identifier;

[0133] The target data packet determination module 703 is used to perform ESP encapsulation on the first target message to obtain a target data packet;

[0134] The target data packet sending module 704 is used to send the target data packet to the second PE.

[0135] In some exemplary embodiments, the IPsec policy interest flow of the first PE is the End-of-Line Layer 2 Forwarding Segment Identifier. The target packet determination module is used to determine that the first target packet matches the IPsec policy based on the End-of-Line Layer 2 Forwarding Segment Identifier included in the first target packet; and to perform ESP encapsulation on the first target packet based on the transmission mode of the IPsec policy to obtain the target packet.

[0136] In some exemplary embodiments, the target data packet sending module 704 is configured to determine the address of the second PE based on the termination type Layer 2 forwarding segment identifier; and send the target data packet to the second PE based on the address of the second PE.

[0137] In some exemplary embodiments, the terminated Layer 2 forwarding segment identifier includes a target opcode, which is used to indicate the corresponding ESP encryption / decryption method.

[0138] It should be noted that the aforementioned first and second layer Ethernet frame message receiving module 701, first target message determination module 702, target data packet determination module 703, and target data packet sending module 704 correspond to S202 to S208 in the method embodiment. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in the above method embodiment. It should also be noted that these modules, as part of the apparatus, can be executed in a computer system such as a set of computer-executable instructions.

[0139] The apparatus provided in this disclosure can perform ESP encapsulation based on a termination-type Layer 2 forwarding segment identifier, and then perform Layer 2 forwarding. Therefore, this disclosure can incorporate security mechanisms in SRv6 networks to ensure data security during transmission.

[0140] Figure 8 This diagram illustrates a Layer 2 service forwarding device according to an embodiment of the present disclosure, such as... Figure 8 As shown, the device is applied to a second PE and includes:

[0141] The target data packet receiving module 801 is used to receive target data packets;

[0142] The termination type Layer 2 forwarding segment identifier identification module 802 is used to identify the termination type Layer 2 forwarding segment identifier in the target data packet;

[0143] The second target message determination module 803 is used to perform ESP decapsulation on the target data packet according to the termination type Layer 2 forwarding segment identifier to obtain the second target message;

[0144] The second Layer 2 Ethernet frame packet determination module 804 is used to decapsulate the second target packet according to the termination type Layer 2 forwarding segment identifier to obtain the second Layer 2 Ethernet frame packet.

[0145] In some exemplary embodiments, the second target message determination module 803 is used to determine whether the termination type Layer 2 forwarding segment identifier includes a target opcode; if it is determined that the target opcode is included, the target data packet is decapsulated using ESP to obtain the second target message.

[0146] In some exemplary embodiments, the second target packet determination module 803 is configured to determine the corresponding security association information based on the end-of-line forwarding segment identifier if the remaining segment number segment in the second target packet is 0 and the second target packet includes an ESP header; and to perform ESP decapsulation on the target data packet according to the decapsulation method in the security association information to obtain the second target packet.

[0147] It should be noted that the target data packet receiving module 801, the termination type Layer 2 forwarding segment identifier identification module 802, the second target message determination module 803, and the second Layer 2 Ethernet frame message determination module 804 correspond to S302 to S308 in the method embodiment. The examples and application scenarios implemented by these modules and their corresponding steps are the same, but they are not limited to the content disclosed in the above method embodiment. It should also be noted that these modules, as part of the apparatus, can be executed in a computer system such as a set of computer-executable instructions.

[0148] Those skilled in the art will understand that various aspects of this disclosure can be implemented as a system, method, or program product. Therefore, various aspects of this disclosure can be specifically implemented in the following forms: a completely hardware implementation, a completely software implementation (including firmware, microcode, etc.), or a combination of hardware and software aspects, collectively referred to herein as a "circuit," "module," or "system."

[0149] This disclosure provides an electronic device, which, exemplarily, includes a processor and a memory. The memory can be used to store executable instructions of the processor. The processor is configured to execute the aforementioned executable instructions to perform the Layer 2 service forwarding method provided in this disclosure.

[0150] The following reference Figure 9 To describe an electronic device 900 according to such an embodiment of the present disclosure. Figure 9The electronic device 900 shown is merely an example and should not impose any limitation on the functionality and scope of use of the embodiments disclosed herein.

[0151] like Figure 9 As shown, the electronic device 900 is presented in the form of a general-purpose computing device. The components of the electronic device 900 may include, but are not limited to: at least one processing unit 910, at least one storage unit 920, and a bus 930 connecting different system components (including the storage unit 920 and the processing unit 910).

[0152] The storage unit stores program code that can be executed by the processing unit 910, causing the processing unit 910 to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure. For example, the processing unit 910 can perform the following steps of the above method embodiment: receiving a first Layer 2 Ethernet frame packet; determining the end-of-line forwarding segment identifier corresponding to the first Layer 2 Ethernet frame packet, the end-of-line forwarding segment identifier being used to indicate the corresponding ESP encryption / decryption method; encapsulating the first Layer 2 Ethernet frame packet into a first target packet, wherein the outermost header of the first target packet includes the end-of-line forwarding segment identifier; performing ESP encapsulation on the first target packet to obtain a target data packet; and sending the target data packet to the second PE.

[0153] Alternatively, the processing unit 910 may perform the following steps in the above method embodiment: receiving a target data packet; identifying the end-of-line (E2) forwarding segment identifier in the target data packet; performing ESP decapsulation on the target data packet according to the E2 forwarding segment identifier to obtain a second target message; and decapsulating the second target message according to the E2 forwarding segment identifier to obtain a second layer 2 Ethernet frame message.

[0154] Storage unit 920 may include readable media in the form of volatile storage units, such as random access memory (RAM) 9201 and / or cache memory 9202, and may further include read-only memory (ROM) 9203.

[0155] The storage unit 920 may also include a program / utility 9204 having a set (at least one) program module 9205, such program module 9205 including but not limited to: an operating system, one or more application programs, other program modules and program data, each or some combination of these examples may include an implementation of a network environment.

[0156] Bus 930 can represent one or more of several types of bus structures, including a memory cell bus or memory cell controller, a peripheral bus, a graphics acceleration port, a processing unit, or a local bus using any of the various bus structures.

[0157] Electronic device 900 can also communicate with one or more external devices 940 (e.g., keyboard, pointing device, Bluetooth device, etc.), and with one or more devices that enable a user to interact with electronic device 900, and / or with any device that enables electronic device 900 to communicate with one or more other computing devices (e.g., router, modem, etc.). This communication can be performed via input / output (I / O) interface 950. Furthermore, electronic device 900 can also communicate with one or more networks (e.g., local area network (LAN), wide area network (WAN), and / or public networks, such as the Internet) via network adapter 960. As shown, network adapter 960 communicates with other modules of electronic device 900 via bus 930. It should be understood that, although not shown in the figures, other hardware and / or software modules can be used in conjunction with electronic device 900, including but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, and data backup storage systems.

[0158] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, terminal device, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0159] In particular, according to embodiments of this disclosure, the process described above with reference to the flowchart can be implemented as a computer program product, which includes a computer program that, when executed by a processor, implements the above-described Layer 2 service forwarding method.

[0160] In exemplary embodiments of this disclosure, a computer-readable storage medium is also provided, on which a computer program is stored. When executed by a processor, the computer program can implement the Layer 2 service forwarding method provided in the embodiments of this disclosure. The computer-readable storage medium may be a readable signal medium or a readable storage medium.

[0161] Figure 10 This illustration shows a schematic diagram of a computer-readable storage medium according to an embodiment of the present disclosure, such as... Figure 10As shown, the computer-readable storage medium 1000 stores a program product capable of implementing the methods described above. In some possible embodiments, various aspects of this disclosure may also be implemented as a program product comprising program code that, when run on a terminal device, causes the terminal device to perform the steps described in the "Exemplary Methods" section of this specification according to various exemplary embodiments of this disclosure.

[0162] More specific examples of computer-readable storage media in this disclosure may include, but are not limited to: electrical connections having one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0163] In this disclosure, a computer-readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, carrying readable program code. Such propagated data signals may take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. A readable signal medium may also be any readable medium other than a readable storage medium, capable of transmitting, propagating, or transmitting a program for use by or in connection with an instruction execution system, apparatus, or device.

[0164] Optionally, the program code contained on the computer-readable storage medium may be transmitted using any suitable medium, including but not limited to wireless, wired, optical fiber, RF, etc., or any suitable combination thereof.

[0165] In practical implementation, program code for performing the operations of this disclosure can be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java and C++, and conventional procedural programming languages ​​such as C or similar languages. The program code can execute entirely on the user's computing device, partially on the user's computing device, as a standalone software package, partially on the user's computing device and partially on a remote computing device, or entirely on a remote computing device or server. In cases involving remote computing devices, the remote computing device can be connected to the user's computing device via any type of network, including a local area network (LAN) or a wide area network (WAN), or it can be connected to an external computing device (e.g., via the Internet using an Internet service provider).

[0166] It should be noted that although several modules or units for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of this disclosure, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0167] Furthermore, although the steps of the method in this disclosure are described in a specific order in the accompanying drawings, this does not require or imply that the steps must be performed in that specific order, or that all the steps shown must be performed to achieve the desired result. Additional or alternative steps may be omitted, multiple steps may be combined into one step, and / or a step may be broken down into multiple steps.

[0168] From the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of this disclosure can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, external hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, mobile terminal, or network device, etc.) to execute the methods according to the embodiments of this disclosure.

[0169] Other embodiments of this disclosure will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This disclosure is intended to cover any variations, uses, or adaptations of this disclosure that follow the general principles of this disclosure and include common knowledge or customary techniques in the art not disclosed herein. The specification and examples are to be considered exemplary only, and the true scope of this disclosure is indicated by the appended claims.

Claims

1. A Layer 2 service forwarding method, characterized in that, Performed by the first service provider's edge device (PE), including: Upon receiving a first Layer 2 Ethernet frame packet, the system determines the termination type Layer 2 forwarding segment identifier corresponding to the first Layer 2 Ethernet frame packet. The termination type Layer 2 forwarding segment identifier is used to indicate the corresponding Encapsulated Security Payload (ESP) encryption / decryption method. Specifically, after receiving the first Layer 2 Ethernet frame packet, the system searches for the associated SRv6 tunnel in the Media Access Control (MAC) address table and obtains the termination type Layer 2 forwarding segment identifier corresponding to the SRv6 tunnel. The termination type Layer 2 forwarding segment identifier contains a target opcode, which is used to indicate the corresponding ESP encryption / decryption method. The first Layer 2 Ethernet frame packet is encapsulated into a first destination packet, wherein the outermost header of the first destination packet includes the termination type Layer 2 forwarding segment identifier; The first target message is encapsulated using ESP to obtain the target data packet; The target data packet is sent to the second PE.

2. The Layer 2 service forwarding method according to claim 1, characterized in that, The first PE's Internet Protocol Security (IPsec) policy interest flow is the terminated Layer 2 forwarding segment identifier. The step of performing ESP encapsulation on the first target packet to obtain the target data packet includes: Based on the terminated Layer 2 forwarding segment identifier included in the first target packet, it is determined that the first target packet matches the IPsec policy; The first target packet is encapsulated using ESP based on the transmission mode of the IPsec policy to obtain the target data packet.

3. The Layer 2 service forwarding method according to claim 1 or 2, characterized in that, Sending the target data packet to the second PE includes: The address of the second PE is determined based on the terminated Layer 2 forwarding segment identifier; The target data packet is sent to the second PE based on the address of the second PE.

4. A Layer 2 service forwarding method, characterized in that, Performed by the second service provider's edge device (PE), including: Receive target data packets; Identify the end-of-line Layer 2 forwarding segment identifier in the target data packet; Based on the terminated Layer 2 forwarding segment identifier, the target data packet is decapsulated using ESP to obtain a second target message. This includes determining whether the terminated Layer 2 forwarding segment identifier contains a target opcode. If the target opcode is found to be included, the target data packet is decapsulated using ESP to obtain a second target message. The target opcode is used to indicate the corresponding ESP encryption / decryption method. Based on the terminated Layer 2 forwarding segment identifier, the second target packet is decapsulated to obtain the second Layer 2 Ethernet frame packet.

5. The Layer 2 service forwarding method according to claim 4, characterized in that, The step of performing ESP decapsulation on the target data packet to obtain the second target message includes: If the remaining segment number field in the second target message is 0 and the second target message includes an ESP header, then the corresponding security association information is determined according to the termination type Layer 2 forwarding segment identifier; Based on the decapsulation method in the security association information, the target data packet is decapsulated using ESP to obtain the second target message.

6. A Layer 2 service forwarding system, characterized in that, Including the first PE and the second PE: The first PE is configured to receive a first Layer 2 Ethernet frame packet, determine the termination type Layer 2 forwarding segment identifier corresponding to the first Layer 2 Ethernet frame packet, the termination type Layer 2 forwarding segment identifier being used to indicate the corresponding ESP encryption / decryption method, wherein, after receiving the first Layer 2 Ethernet frame packet, it searches for the associated SRv6 tunnel in the Media Access Control (MAC) address table, obtains the termination type Layer 2 forwarding segment identifier corresponding to the SRv6 tunnel, the termination type Layer 2 forwarding segment identifier containing a target opcode, the target opcode being used to indicate the corresponding ESP encryption / decryption method; encapsulates the first Layer 2 Ethernet frame packet into a first target packet, wherein the outermost header of the first target packet includes the termination type Layer 2 forwarding segment identifier; performs ESP encapsulation on the first target packet to obtain a target data packet; and sends the target data packet to the second PE. The second PE is used to receive the target data packet; identify the end-of-line (E2) forwarding segment identifier in the target data packet; decapsulate the target data packet using the E2 forwarding segment identifier to obtain a second target message; and decapsulate the second target message using the E2 forwarding segment identifier to obtain a second layer 2 Ethernet frame message.

7. An electronic device, characterized in that, include: processor; as well as Memory for storing the executable instructions of the processor; The processor is configured to execute the Layer 2 service forwarding method according to any one of claims 1 to 5 by executing the executable instructions.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the Layer 2 service forwarding method according to any one of claims 1 to 5.

9. A computer program product, characterized in that, The computer program product includes computer instructions stored in a computer-readable storage medium. The processor of the electronic device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the electronic device to perform the Layer 2 service forwarding method as described in any one of claims 1 to 5.

Images