A method and device for reliable transmission of network layer data plane based on hop-by-hop acknowledgement

Abstract

The application discloses a network layer data plane reliable transmission method and device based on hop-by-hop acknowledgement, and the method comprises the following steps: dividing the transmission path of a data packet into multiple transmission segments according to the routing information in an IP packet header; sending a Send packet at the starting node of each transmission segment, and transparently forwarding the Send packet to a terminal node along the transmission path through a common routing node; receiving an ACK packet corresponding to the Send packet returned by the terminal node, and reinitiating a new transmission segment as a new starting node according to the transmission path information carried by the data packet until the data packet reaches the terminal node of the last transmission segment so as to realize hop-by-hop acknowledgement; and verifying the legitimacy of the data packet to ensure the performance and resources of the hop-by-hop acknowledgement. The application can realize network layer reliable data packet transmission of an ultra-high-speed network, so as to realize high-speed and high-reliability transmission in the data plane for scenarios such as industrial internet and satellite internet.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of intelligent programmable data plane, and particularly relates to a network layer data plane reliable transmission method and device based on hop-by-hop acknowledgement. BACKGROUND

[0002] The diversified development of Internet application types puts forward higher requirements for network communication technology. With the rapid development of industrial Internet, satellite Internet and other technologies, more and more application scenarios require high-speed, reliable and low-latency data transmission and processing capabilities. The traditional network architecture and data plane technology have encountered a series of challenges such as high latency, low throughput and low reliability when facing these new application types. In recent years, programmable data plane as a new technology allows flexible configuration and programming of data plane functions in network devices, enabling the network to quickly adapt to different application scenarios and requirements. Moreover, programmable data plane technology introduces high-speed switching chips and programmable chips into network devices to realize high-speed processing and forwarding of data packets, providing higher performance and throughput for network devices. However, due to the limited hardware resources of current programmable switching chips, it is very difficult to achieve high-reliability transmission of network traffic on the data plane only by programmable switches, such as implementing data packet caching and retransmission. On the one hand, the current programmable switches have limited static random access memory resources and register resources, which cannot store a large number of data packets. On the other hand, the current programmable switches support limited types of operations, making it difficult to perform high-precision calculations. Therefore, in order to achieve on-demand high-speed and high-reliability transmission of network traffic on the data plane, external devices such as servers are needed to cache data packets, thus meeting different application scenarios and requirements. This method has three defects: it is difficult to achieve end-to-end high-speed transmission, and after transmission failure during packet transmission, the source end needs to resend the packet, which is not suitable for industrial Internet scenarios; the processing delay is large, and the external device has a large processing delay for data packets, which is difficult to meet the high real-time requirements of industrial Internet data transmission; and the energy consumption is large, such as using external servers for caching, which consumes a lot of energy, such as satellite Internet edge computing, which requires on-board devices to cache part of the packets, and the use of external devices increases energy consumption. In fact, different network traffic has different requirements for data packet processing, some require high security, some require high reliability, and some require high bandwidth. Therefore, it is necessary to intelligently process different traffic on the data plane.

[0003] Considering that using intelligent network traffic processing methods on the data plane can achieve efficient and reliable data transmission, thereby optimizing the utilization of network resources, the patent proposes a network layer data plane reliable transmission method and device based on hop-by-hop acknowledgment. In order to solve the resource limitation problem brought by the programmable switch chip at present, we use field programmable gate array chip (FPGA) to deploy data packet caching and processing. Field programmable gate array chip can provide highly parallel computing power, with low delay and high throughput characteristics, and because it has programmable logic unit, it can only be deployed by programming without replacing hardware devices to meet different processing needs. Specifically, in ASIC, according to the data packet header, the data packet is classified, and the data packet that needs high reliable transmission is verified based on CRC, and then sent to FPGA. FPGA has stronger computing and caching capability, and performs high-intensity security verification on data packets to ensure that data packets come from trusted devices, and caches the packets, forwards the processed data packets to ASIC, and ASIC forwards the data packets to the next hop; After a certain timeout (the delay is much lower than the current Internet end-to-end delay), if the ASIC receives an ACK reply from the next hop, it notifies the FPGA to delete the data packet, otherwise it takes the data packet from the FPGA and sends it to the next hop again until it receives an ACK from the next hop. After a certain number of retransmissions, if the next hop ACK is still not received, the ASIC sends the packet to the standby next hop. Through this method and device, the packet can be transmitted to the next hop with the lowest delay at each hop until it reaches the destination. Better meet the high throughput and low delay requirements of the traffic processing process in the super-speed network. In general, this method and device have the advantages of low transmission delay, fast processing speed, and strong scalability in network traffic processing, verification, and reliable transmission in the super-speed network scenario, and can adapt to different traffic processing tasks, and are very suitable for providing reliable end-to-end communication in super-speed network scenarios with complex traffic processing requirements. SUMMARY

[0004] The present application aims to at least partially solve one of the technical problems in the related art.

[0005] To this end, the present application proposes a network layer data plane reliable transmission method based on hop-by-hop acknowledgment, which meets the normal exchange of data packets in a super-speed network, and allows the processing traffic to be security verified according to the current traffic processing requirements in the super-speed network. This technology can effectively reduce the traffic transmission delay in the super-speed network and improve the network performance to meet the needs of different application scenarios.

[0006] Another object of the present application is to provide a network layer data plane reliable transmission device based on hop-by-hop acknowledgement.

[0007] To achieve the above object, the present application provides a network layer data plane reliable transmission method based on hop-by-hop acknowledgement, comprising:

[0008] dividing the transmission path of the data packet into multiple transmission segments according to the routing information in the IP packet header; wherein each transmission segment comprises a start node and a termination node of adjacent two hops supporting high reliable transmission;

[0009] sending a Send packet at the start node of each transmission segment and transparently forwarding the Send packet along the transmission path through the normal routing node to the termination node;

[0010] receiving the ACK packet corresponding to the Send packet replied by the termination node, and reinitiating a new transmission segment as a new start node according to the transmission path information carried by the data packet until the data packet reaches the termination node of the last transmission segment so as to realize hop-by-hop acknowledgement;

[0011] verifying the legality of the data packet to ensure the performance and resources of hop-by-hop acknowledgement; wherein the legality verification of the data packet comprises an identity key generation mechanism, an update verification code and verification of the verification code.

[0012] The network layer data plane reliable transmission method based on hop-by-hop acknowledgement of the present application can further have the following additional technical features:

[0013] In an embodiment of the present application, the IP packet header comprises RT_LIST[0-N], which is a sequence of routing nodes supporting transmission, hopID represents the ID of the routing node, S represents an indicator of whether it is the last routing node, RT_MAN is an identifier for realizing security verification, flag is used to indicate the state of the packet, nextHdr indicates the protocol type of the next packet header, seq is the sequence number of the data packet, ack is the sequence number of ACK, authcode1 is the CRC check code of ASIC, authcode2 is the encryption verification code of FPGA, and IP_ORIG is the original destination address of the data packet.

[0014] In an embodiment of the present application, the Send packet is processed in the first hop start node, comprising:

[0015] ASIC processes Send packet: The first hop starting node receives a common IP data packet or a segment routing data packet on the whole transmission path, and after identifying that the packet is a packet requiring high-reliability transmission, the first hop starting node updates the RT_LIST[0-N] used between nodes, copies the destination address to the IP_ORIG, updates the seq in the RT_MAN to the sequence number of the packet, obtains a Send packet, modifies the destination address to the termination node of the current transmission segment, and sends the data packet to the FPGA;

[0016] FPGA processes Send packet: After the FPGA receives the Send packet, the data packet is buffered, after the buffering is completed, a timeout limit T is set, and the data packet is forwarded to the termination node of the current segment according to normal IP forwarding.

[0017] In an embodiment of the present application, the common high-reliability node includes a common termination node, and after completing data packet ACK packet generation, the common termination node is converted into a common starting node to complete data forwarding.

[0018] In an embodiment of the present application, the common high-reliability node processes a Send packet, and the method includes:

[0019] ASIC: After receiving the Send packet, the destination address is updated to the next routing node supporting high-reliability transmission, and the Send packet is sent to the FPGA;

[0020] FPGA: After receiving the Send packet, an ACK packet is sent to the previous high-reliability node, and the sequence number of the Send packet and the sequence number of the ACK packet are carried; meanwhile, the current FPGA buffers the Send packet, and forwards the Send packet to the next high-reliability node, at this time, the FPGA becomes a common starting node of the next transmission segment.

[0021] In an embodiment of the present application, the common high-reliability node processes an ACK packet, and the method includes:

[0022] ASIC: After receiving the ACK packet, the FPGA forwards the ACK packet;

[0023] FPGA: After receiving the packet, the buffered data corresponding to the sequence number is deleted, and the transmission of the current transmission segment is completed; if the ACK data is not received within the timeout limit T, the Send data packet is retransmitted to the next high-reliability node until the ACK is received.

[0024] In an embodiment of the present application, the last high-reliability node processes a data packet, and the method includes:

[0025] ASIC: The IP destination address is restored to the original destination address, and the FPGA is sent;

[0026] FPGA: reply ACK packet to the upper hop high-reliability node, then remove the added header content, the IP data packet becomes the IP packet sent by the source end, and is forwarded to the next hop routing node or the destination terminal, and is restored to normal IP packet transmission.

[0027] In one embodiment of the application, the identity key generation mechanism comprises:

[0028] A pair of long-term valid keys LK is shared between adjacent high-reliability nodes i and j i,j The key is used as a root key to calculate and generate identity keys that dynamically change over time slices, and TS represents time slices; the control plane of the high-reliability network node periodically interacts with neighbor nodes to negotiate and generate the identity keys of each node, and then stores the identity keys in the data plane:

[0029]

[0030] In formula (1), MAC represents an encryption method, and F is 0, which is the key keyA(i,j) between ASICs.

[0031] In one embodiment of the application, the verification code updating and verification comprises:

[0032] The output of the verification code algorithm adopts formula (2), wherein key(i,j) is the key between adjacent nodes, nexthopID is the ID of the next hop, seq is the sequence number, and the output is the verification code authcode(i,j) of the data packet, which is encapsulated into the authcode1 or authcode2 field of the data packet by the sending node:

[0033] authcode(i,j)=MAC key(i,j) (nexthopID||seq) (2)

[0034] The first hop high-reliability node: only updates the verification code:

[0035] The ASIC adopts formula (2), wherein the MAC generation method can be a lightweight method such as CRC, the key is set as keyA(i,j), the verification code is generated according to the next hop and the sequence number seq, and the verification code is updated in authcode1.

[0036] The FPGA adopts formula (2), wherein the MAC generation method is a high-strength encryption method such as AES, the key is set as keyF(i,j), and the verification code is generated according to the next hop and the sequence number seq on the transmission path, and the verification code is updated in authcode2.

[0037] The normal high-reliability node: verifies and updates the verification code:

[0038] For ASIC, receiving Send packet or ACK packet, first, according to keyA(i,j) and formula (2), verifying whether authcode1 is correct, if correct, continuing to update authcode1 of Send packet for next hop by formula (2), if incorrect, discarding;

[0039] For FPGA, receiving Send packet or ACK packet, first, according to keyF(i,j) and formula (2), verifying whether authcode2 is correct, if incorrect, discarding, if correct, continuing to update authcode2 of Send packet for next hop by formula (2);

[0040] Last hop high-reliability node: only verification of authentication code:

[0041] For ASIC, receiving Send packet or ACK packet, first, verifying whether authcode1 is correct, if incorrect, discarding;

[0042] For FPGA, receiving Send packet, first, verifying whether authcode2 is correct, if incorrect, discarding, last hop node will not receive ACK packet.

[0043] To achieve the above purpose, another aspect of the present application provides a network layer data plane reliable transmission device based on hop-by-hop confirmation, comprising:

[0044] The hop-by-hop transmission module is used for dividing the transmission path of the data packet into multiple transmission segments according to the routing information in the IP packet header; wherein each transmission segment includes a starting node and a terminal node of adjacent two hops supporting high-reliability transmission; the Send packet is sent at the starting node of each transmission segment, and the Send packet is transparently forwarded to the terminal node along the transmission path through the ordinary routing node; the ACK packet corresponding to the Send packet is received in reply by the terminal node, and the terminal node reinitiates a new transmission segment as a new starting node according to the transmission path information carried by the data packet, until the data packet reaches the terminal node of the last transmission segment to enable hop-by-hop confirmation.

[0045] The security verification module is used for verifying the legality of the data packet to ensure the performance and resources of hop-by-hop confirmation; wherein the legality verification of the data packet includes an identity key generation mechanism, an updated authentication code and authentication code verification.

[0046] The network layer data plane reliable transmission method and device based on hop-by-hop confirmation of the embodiments of the present application can realize network layer reliable data packet transmission of super-high-speed network, so as to realize high-speed and high-reliability transmission in the data plane for scenarios such as industrial internet and satellite internet.

[0047] Additional aspects and advantages of the invention will be set forth in part in the description which follows, and in part will be obvious from the description, or may be learned by practice of the invention. Attached Figure Description

[0048] The above and / or additional aspects and advantages of the present invention will become apparent and readily understood from the following description of the embodiments taken in conjunction with the accompanying drawings, wherein:

[0049] Figure 1 This is a logic diagram of a network layer data plane reliable transmission method based on hop-by-hop confirmation according to an embodiment of the present invention;

[0050] Figure 2 This is a schematic diagram of transmission segmentation according to an embodiment of the present invention;

[0051] Figure 3 This is a schematic diagram of the data packet header format according to an embodiment of the present invention;

[0052] Figure 4 This is a structural diagram of a reliable network layer data plane transmission device based on hop-by-hop confirmation according to an embodiment of the present invention. Detailed Implementation

[0053] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention will now be described in detail with reference to the accompanying drawings and embodiments.

[0054] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0055] The following description, with reference to the accompanying drawings, describes a reliable network layer data plane transmission method and apparatus based on hop-by-hop confirmation according to embodiments of the present invention.

[0056] Figure 1 This is a flowchart of a network layer data plane reliable transmission method based on hop-by-hop acknowledgment according to an embodiment of the present invention, as shown below. Figure 1 As shown, the method includes:

[0057] S1, the transmission path of the data packet is divided into multiple transmission segments according to the routing information in the IP packet header; each transmission segment includes a start node and an end node that support high-reliability transmission in two adjacent hops;

[0058] S2, sending a Send packet at the start node of each transmission segment, and transparently forwarding the Send packet along the transmission path through the common routing nodes to the termination node;

[0059] S3, receiving the ACK packet corresponding to the Send packet replied by the termination node, and reinitiating a new transmission segment as a new start node according to the transmission path information carried by the data packet until the data packet reaches the termination node of the last transmission segment to enable hop-by-hop acknowledgement;

[0060] S4, verifying the legality of the data packet to ensure the performance and resources of the hop-by-hop acknowledgement; wherein the legality verification of the data packet includes: identity key generation mechanism, update verification code and verification of the verification code.

[0061] It can be understood that the present application is mainly used in the scene of industrial internet, satellite internet, etc., by combining different intelligent data plane devices with high reliable transmission capability, the device integrates two modules of special chip (ASIC) for data packet header processing and FPGA for data packet caching and processing. Among them, the data packet header intelligent processing module analyzes, forwards and simply verifies the data packet according to the data packet header, the data packet caching processing verifies and caches the entire packet, and waits for the ACK packet information of the next hop node to return the packet, after receiving the corresponding ACK, the node deletes the cached packet; if the corresponding ACK is not received within a certain time, a certain number of times of timeout retransmission is performed after timeout, so as to realize the receiving acknowledgement mechanism and timeout retransmission mechanism of the data packet in the network layer. This method and device can realize the reliable data packet transmission in the network layer of the super-high-speed network, so as to realize the scene of high-speed and high-reliable transmission such as industrial internet, satellite internet, etc. in the data plane.

[0062] In an embodiment of the present application, the hop-by-hop transmission mechanism. The high-speed and high-reliable transmission mechanism of the present application is based on the IP network layer, and realizes the hop-by-hop sending and acknowledgement of the data packet in the data plane, specifically, Figure 2As shown, the data packet transmission path is divided into multiple transmission segments, each transmission segment including two adjacent hops of high-reliability nodes supporting high-reliability transmission of the application, i.e., a starting node and a terminating node (the routing nodes between the starting and terminating nodes are ordinary routing nodes not supporting the hop-by-hop acknowledgement of the application and only transparently forwarding data packets). The starting node of each transmission segment sends a Send packet (the data packet requiring high-reliability transmission is referred to as a Send packet in the patent), the terminating node receives the Send packet and replies to the starting node with an ACK packet corresponding to the Send packet. Then, the terminating node initiates a new transmission segment as a new starting node according to the transmission path information carried by the data packet, and repeats the process until the data packet reaches the destination node (the terminating node of the last transmission segment). The hop-by-hop transmission mechanism can be compatible with the end-to-end transmission mode of the IP network, fully utilize the interconnection infrastructure provided by the IP network, be compatible with the traditional network, and the ordinary routing nodes not supporting the hop-by-hop acknowledgement can be forwarded according to the IP packet header, having the ability of incremental deployment. First, a data packet analysis mechanism is established, and then the packets are processed and forwarded differently at each high-reliability node to complete reliable transmission.

[0063] The data packet analysis mechanism is shown in the following table. The application defines a new IP packet header to analyze different data packets. Figure 3 As shown, the new IP packet header includes RT_LIST[0-N], which is a sequence of routing nodes supporting the transmission of the application, wherein hopID represents the ID (generally IP address or IP prefix) of the routing node, and S represents an indicator of whether it is the last routing node (0 for a new terminating node behind and 1 for the last terminating node at this hop). RT_MAN is an identifier for security verification, wherein flag is used to indicate the state of the packet, nextHdr indicates the protocol type of the next packet header, seq is the sequence number of the data packet, ack is the sequence number of the ACK, authcode1 is the CRC check code of the ASIC, and authcode2 is the encryption verification code of the FPGA. The IP header is a standard IP protocol (IPv4 or IPv6) header, and the protocol field (tentatively 157 in the application) of the IP header indicates that the data packet is a packet requiring hop-by-hop acknowledgement. For this type of packet, each transmission segment performs hop-by-hop transmission. IP_ORIG is the original destination address of the data packet. The ASIC of the patent is a special chip for processing ultra-high-speed network data packets in the current data plane, and the FPGA is a chip that can cache and process and forward, which can perform different operations on the data packet according to the analysis result of the data packet.

[0064] The Send packet is processed in the first-hop starting node.

[0065] (1) ASIC processing Send packet: The first hop starting node receives a normal IP (v4 or v6) data packet or a segment routing (SRv6) data packet on the entire transmission path. After the first hop starting node identifies that the packet is a packet that needs high-reliability transmission (the IP header protocol field is 157), the node updates the RT_LIST[0-N] used between nodes, copies the destination address to IP_ORIG, updates the seq in RT_MAN to the sequence number of the packet, and adds the authentication code field authcode1 in step 2 (if security function is not required, it can also not be added). At this time, it becomes a data Send packet that needs high-reliability transmission, referred to as a Send packet. Then, the destination address is modified to the termination node of the current transmission segment, and the data packet is sent to the FPGA.

[0066] (2) FPGA processing Send packet: After the FPGA receives the Send packet, the data packet is buffered, and after the buffering is completed, a timeout T is set, and the data packet is forwarded to the termination node of the current segment according to normal IP forwarding. If security is required, an authentication code can be added in authcode2.

[0067] Among them, the ordinary high-reliability node processes the Send packet: the ordinary high-reliability node includes an ordinary termination node, completes the generation of the data packet ACK packet, and then converts to an ordinary starting node to complete data forwarding.

[0068] (1) ASIC: After receiving the Send packet, the destination address is updated to the next high-reliability transmission supporting routing node, and the Send packet is sent to the FPGA.

[0069] (2) FPGA: After receiving the Send packet, an ACK packet is sent to the previous high-reliability node, with the sequence number of the Send packet and the sequence number of the ACK packet. At the same time, the current Send packet is buffered in the FPGA, and is forwarded to the next high-reliability node. At this time, it becomes an ordinary starting node of the next transmission segment.

[0070] Among them, the ordinary high-reliability node processes the ACK packet.

[0071] (1) ASIC: After receiving the ACK packet, the FPGA is forwarded.

[0072] (2) FPGA: After receiving the packet, the buffered data corresponding to the sequence number is deleted, and the transmission of the current transmission segment is completed. If an ACK data is not received within a certain timeout T, the Send data packet is retransmitted to the next high-reliability node until an ACK is received, or if the timeout occurs for a certain number of times (such as 3 times), the data packet is discarded and reported, a backup route is selected and transmission is continued, which is not required in the present patent.

[0073] The last-hop high-reliability node processes the data packet.

[0074] (1) The ASIC sends the IP destination address to the FPGA, because the subsequent node cannot process the new packet header.

[0075] (2) The FPGA sends an ACK packet to the previous-hop high-reliability node, removes the new packet header, and sends the IP packet to the next-hop routing node or the destination terminal.

[0076] In an embodiment of the present application, security verification. Based on the above scheme, hop-by-hop acknowledgement can be realized, but in order to improve security, such as an attacker consuming a large amount of computing and storage resources of network element devices through a denial-of-service attack, the hop-by-hop acknowledgement can be guaranteed in performance and resources by verifying the legitimacy of the data packet. The data packet legitimacy verification function mainly includes identity key generation mechanism, update verification code, and verification code verification.

[0077] The identity key generation mechanism.

[0078] A pair of long-term valid keys LK i,j (effective period is one day or longer) is shared between adjacent high-reliability nodes i and j, which is used as a root key to calculate and generate an identity key that changes dynamically with time slicing. This key generation method can effectively reduce the overhead required for nodes to negotiate and generate identity keys. The identity information of the high-reliability network node (such as using the node IP address as the identity information) and TS represent time slicing. After the control plane of the high-reliability network node periodically interacts with the neighbor node to negotiate and generate the identity key of each node, it is stored in the data plane.

[0079]

[0080] In formula (1), MAC represents an encryption method, and the present patent can use AES. When F is 0, it is the key keyA(i,j) between ASICs, and when F is 1, it is the key keyF(i,j) between FPGAs. Because CRC verification is used between ASICs, it is easy to be cracked, and AES and other high-strength verification code generation methods are used between FPGAs, so the keys are different. When ASIC also uses a high-strength encryption method, it can also be combined into one key.

[0081] The verification code is updated and verified.

[0082] The output of the verification code algorithm uses equation (2), where key(i,j) is the key between adjacent nodes, nexthopID is the ID of the next hop, seq is the sequence number (for ACK packets, the sequence number is ack in the field), and the output is the verification code authcode(i,j) of the data packet, which is encapsulated by the sending node into the authcode1 or authcode2 field of the data packet.

[0083] authcode(i,j) = MAC key(i,j) (nexthopID || seq) (2)

[0084] First-hop high-reliability node: only update the verification code:

[0085] The ASIC uses equation (2), where the MAC generation method can be a lightweight method such as CRC, and the key is set to keyA(i,j). The verification code is generated according to the next hop and the sequence number seq, and the verification code is updated in authcode1.

[0086] The FPGA uses equation (2), where the MAC generation method is a high-strength encryption method such as AES, and the key is set to keyF(i,j). On the transmission path, the verification code is generated according to the next hop and the sequence number seq, and the verification code is updated in authcode2.

[0087] Ordinary high-reliability node: verify and update the verification code:

[0088] For ASIC, when receiving a Send packet or an ACK packet, first verify whether authcode1 is correct according to keyA(i,j) and equation (2). If correct, continue to update authcode1 of the Send packet for the next hop using equation (2); if incorrect, discard (all discard behaviors are not mandatory requirements of this patent, and can be configured to use special identifiers to mark and report to the management center, etc.).

[0089] For FPGA, when receiving a Send packet or an ACK packet, first verify whether authcode2 is correct according to keyF(i,j) and equation (2). If incorrect, discard; if correct, continue to update authcode2 of the Send packet for the next hop using equation (2).

[0090] Last-hop high-reliability node: only verification of the verification code:

[0091] For ASIC, when receiving a Send packet or an ACK packet, first verify whether authcode1 is correct. If incorrect, discard.

[0092] For the FPGA, the Send packet is received, and first, the authcode2 is verified to be correct, and if not, it is discarded. The last hop node will not receive the ACK packet.

[0093] According to the network layer data plane reliable transmission method based on hop-by-hop acknowledgement provided in the embodiments of the present application, the network layer reliable data packet transmission of the super-high-speed network can be realized, so that the scenarios requiring high-speed and high-reliability transmission such as industrial internet and satellite internet can be implemented in the data plane, the traffic transmission delay in the super-high-speed network can be effectively reduced, and the network performance can be improved to meet the requirements of different application scenarios.

[0094] To achieve the above-mentioned embodiments, as shown in the Figure 4 The network layer data plane reliable transmission device 10 based on hop-by-hop acknowledgement provided in the embodiments of the present application comprises:

[0095] The hop-by-hop transmission module 100 is configured to divide the transmission path of the data packet into a plurality of transmission segments according to the routing information in the IP packet header; each transmission segment comprises a start node and a termination node of adjacent two hops supporting high-reliability transmission; the Send packet is sent at the start node of each transmission segment, and the Send packet is transparently forwarded to the termination node along the transmission path through the ordinary routing node; the ACK packet corresponding to the Send packet is received in reply by the termination node, the termination node initiates a new transmission segment as a new start node according to the transmission path information carried by the data packet, and the hop-by-hop acknowledgement is performed until the data packet reaches the termination node of the last transmission segment.

[0096] The security verification module 200 is configured to perform data packet legality verification to ensure the performance and resources of the hop-by-hop acknowledgement; the data packet legality verification comprises an identity key generation mechanism, an update verification code, and verification of the verification code.

[0097] According to the network layer data plane reliable transmission device based on hop-by-hop acknowledgement provided in the embodiments of the present application, the network layer reliable data packet transmission of the super-high-speed network can be realized, so that the scenarios requiring high-speed and high-reliability transmission such as industrial internet and satellite internet can be implemented in the data plane, the traffic transmission delay in the super-high-speed network can be effectively reduced, and the network performance can be improved to meet the requirements of different application scenarios.

[0098] In the description of the present specification, the description of the terms "one embodiment", "some embodiments", "an example", "a specific example", or "some examples" and the like means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the present specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Also, the specific features, structures, materials or characteristics described can be combined in any appropriate manner in any one or more embodiments or examples. Furthermore, the person skilled in the art can combine and combine the different embodiments or examples described in the present specification and the features of the different embodiments or examples, without contradiction.

[0099] In addition, the terms "first", "second", are used only for descriptive purposes and cannot be understood to indicate or imply relative importance or imply the number of the indicated technical features. Thus, the features defined with "first", "second" can explicitly or implicitly include at least one of the features. In the description of the present application, the meaning of "a plurality of" is at least two, for example, two, three, etc., unless otherwise explicitly specified.

Claims

1. A method for hop-by-hop acknowledgement based network layer data plane reliable transmission, characterized in that, Comprise: According to the routing information in the IP packet header, the transmission path of the data packet is divided into multiple transmission segments; wherein each transmission segment includes the starting node and the terminal node of the adjacent two hops supporting high reliable transmission; Send packet is sent at the starting node of each transmission segment, and the Send packet is transparently forwarded along the transmission path through the normal routing node to the terminal node; The ACK packet corresponding to the Send packet replied by the terminal node is received, and the terminal node reinitiates a new transmission segment as a new starting node according to the transmission path information carried by the data packet, until the data packet reaches the terminal node of the last transmission segment to enable hop-by-hop acknowledgement; The data packet legality verification is performed to ensure the performance and resources of hop-by-hop acknowledgement; wherein the data packet legality verification includes identity key generation mechanism, update verification code and verification of verification code; The IP packet header includes RT_LIST[0-N], which is a sequence of routing nodes supporting high reliable transmission, hopID represents the ID of the routing node, S represents the indicator of whether it is the last routing node, RT_MAN is an identifier for implementing security verification, flag is used to indicate the state of the packet, nextHdr indicates the protocol type of the next packet header, seq is the sequence number of the data packet, ack is the sequence number of ACK, authcode1 is the CRC check code of ASIC, authcode2 is the encryption verification code of FPGA, and IP_ORIG is the original destination address of the data packet; The Send packet is processed in the first hop starting node, including: ASIC processes the Send packet: the first hop starting node receives a normal IP data packet or a segmented routing data packet on the entire transmission path, identifies that the packet is a packet requiring high reliable transmission, updates the RT_LIST[0-N] used between nodes, copies the destination address to IP_ORIG, updates the seq in RT_MAN as the sequence number of the packet to obtain the Send packet, modifies the destination address to the terminal node of the transmission segment, and sends the data packet to FPGA; FPGA processes the Send packet: FPGA receives the Send packet, buffers the data packet, sets the timeout limit T after completing the buffering, and forwards the data packet to the terminal node of the segment according to the normal IP; The normal high reliable node processes the Send packet, including: ASIC: receives the Send packet, updates the destination address to the next routing node supporting high reliable transmission, and sends the Send packet to FPGA; FPGA: receives the Send packet, sends an ACK packet to the previous high reliable node, carries the sequence number of the Send packet and the sequence number of the ACK packet, buffers the Send packet in the FPGA, and forwards it to the next high reliable node, which becomes the normal starting node of the next transmission segment; The normal high reliable node processes the ACK packet, including: ASIC: After receiving the ACK packet, the ASIC forwards it to the FPGA; FPGA: After receiving the ACK packet, the FPGA deletes the cached data corresponding to the sequence number, and the transmission of the transmission segment is complete. If the ACK data is not received within the timeout period T, the FPGA retransmits the Send packet to the next high-reliability node until the ACK is received.

2. The method of claim 1, wherein, Ordinary high-reliability nodes include ordinary termination nodes that generate ACK packets for data packets and then convert to ordinary starting nodes to complete data forwarding.

3. The method of claim 1, wherein, The last-hop high-reliability node processes data packets, including: ASIC: The IP destination address is restored to the original destination address, and the FPGA is sent; FPGA: The FPGA returns an ACK packet to the previous high-reliability node, then removes the added packet header content, the IP data packet becomes the IP packet sent by the source, and is forwarded to the next-hop routing node or the destination terminal, restoring it to ordinary IP packet transmission.

4. The method of claim 1, wherein, The identity key generation mechanism includes: A pair of long-term valid keys is shared between adjacent high-reliability nodes i, j The keys are used as root keys to compute identity keys that dynamically change over time slices, TS denotes time slices; After the control plane of the high-reliability network node periodically interacts with the neighbor nodes to negotiate the identity keys of each node, the identity keys are stored in the data plane: （1） In Equation (1), MAC represents an encryption method, and F is a key between ASICs when F is 0 .

5. The method of claim 1, wherein, Verification code update and verification includes: The output of the verification code algorithm uses equation (2), where is the key between adjacent nodes, nexthopID is the ID of the next hop, seq is the sequence number, and output is the verification code of the data packet The verification code is encapsulated by the sending node into the authcode1 or authcode2 field of the data packet: （2） First-hop high-reliability node: only update the verification code: The ASIC adopts formula (2), wherein the MAC generation mode is a lightweight mode such as CRC, and the key is set as According to the next hop and the sequence number seq, the verification code is generated, and the verification code is updated in authcode1. The FPGA adopts formula (2), wherein the MAC generation mode is an AES high-strength encryption mode, and the key is set as On the transmission path, an authentication code is generated according to a next hop and a sequence number seq, and the authentication code is updated as authcode2. Ordinary high-reliability node: verify and update the verification code: For ASIC, receiving Send packet or ACK packet, first, according to and formula (2), verifying whether authcode1 is correct, if correct, continuing to update authcode1 of Send packet for next hop by formula (2), if incorrect, discarding; For FPGA, receiving Send packet or ACK packet, first, according to and formula (2), verifying whether authcode2 is correct, if not, discarding; if correct, continuing to update authcode2 of Send packet for next hop by formula (2); Last-hop high-reliability node: only verification of the verification code: For ASIC, receiving a Send packet or an ACK packet, first verify whether authcode1 is correct, if not, discard it; For FPGA, receiving a Send packet, first verify whether authcode2 is correct, if not, discard it; The last-hop node will not receive an ACK packet.

6. A device for reliable transmission of network layer data plane based on hop-by-hop acknowledgement using the method of claim 1, characterized by, Including: A hop-by-hop transmission module is configured to divide a transmission path of a data packet into multiple transmission segments according to routing information in an IP packet header, wherein each transmission segment includes a starting node and a termination node of adjacent two hops supporting high-reliability transmission; a Send packet is sent at the starting node of each transmission segment, and the Send packet is transparently forwarded to the termination node along the transmission path through ordinary routing nodes; an ACK packet corresponding to the Send packet is received from the termination node, and the termination node reinitiates a new transmission segment as a new starting node according to transmission path information carried by the data packet, until the data packet reaches the termination node of the last transmission segment to enable hop-by-hop confirmation; A security verification module is configured to perform data packet legality verification to ensure the performance and resources of hop-by-hop confirmation, wherein the data packet legality verification includes an identity key generation mechanism, verification code updating, and verification code verification.

Images