Aggregation port MACsec session creation method, network equipment and device

Abstract

The embodiment of the invention provides an aggregation port MACsec session creation method, network equipment and an aggregation port MACsec session creation device. The method comprises the following steps: determining a plurality of target ports from ports of the network equipment; sequentially enabling the MACsec session creation function of each target port in the plurality of target ports; and performing link aggregation on a plurality of target ports to form an aggregation group by interacting link aggregation protocol messages between the plurality of target ports which successfully create the MACsec session and opposite-end ports of the target ports in sequence, the opposite-end ports of the target ports being ports connected with the target ports on the opposite-end network equipment. By applying the scheme provided by the embodiment of the invention, the efficiency of creating the MACsec session of the aggregation port can be improved, and omission of enabling of the member port is avoided.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a method for creating a MACsec session of an aggregated port, a network device and an apparatus. BACKGROUND

[0002] Link aggregation refers to that when two network devices are connected through multiple Ethernet physical links, the multiple links can be bundled together to form a logical link, such a logical link is also called an aggregated link, and the bandwidth of the aggregated link can be equal to the total bandwidth of the multiple links, so that the bandwidth of the link can be increased. The multiple links in the aggregated link can back up each other, that is, when a link in the aggregated link fails, the packet of the link can be forwarded through other links.

[0003] Link bundling is realized through port bundling, multiple Ethernet ports are bundled together to form an aggregated group, and the Ethernet ports bundled together are called member ports of the aggregated group.

[0004] MACsec (Media Access Control Security) is a LAN security communication method based on IEEE (Institute of Electrical and Electronics Engineers) 802 standard, which can provide secure MAC (Media Access Control Layer) data transmission and reception services for users.

[0005] A technician can send a MACsec enabling instruction to a port in a network device through a command line to instruct the specified port to be MACsec enabled, so as to establish a MACsec session between the port and a peer port to protect the packets transmitted between the two ports.

[0006] However, this way of MACsec enabling the specified port through the command line is cumbersome, and when it is necessary to establish a MACsec session for multiple member ports in an aggregated group, the MACsec enabling of each member port has to be performed one by one, which is inefficient. Moreover, sometimes due to the negligence of the technician, MACsec enabling of some member ports is omitted, so that some member ports in the aggregated group establish a MACsec session, and the other member ports do not establish a MACsec session, which brings a security risk to the aggregated group. SUMMARY

[0007] The embodiments of the present application aim to provide a method for creating a MACsec session of an aggregation port, a network device and an apparatus, so as to improve the efficiency of creating a MACsec session of an aggregation port and avoid missing the enabling of a member port. The specific technical solutions are as follows.

[0008] In a first aspect, the embodiments of the present application provide a method for creating a MACsec session of an aggregation port, and the method comprises the following steps.

[0009] determining a plurality of target ports from ports of a network device, wherein the target ports are ports supporting MACsec;

[0010] enabling a media access control security protocol (MACsec) session creation function of each target port in the plurality of target ports in sequence;

[0011] forming an aggregation group by performing link aggregation on the plurality of target ports through interaction of link aggregation protocol packets between the plurality of target ports and opposite ports of the target ports in which a MACsec session is successfully created, wherein the opposite ports of the target ports are ports connected to the target ports on an opposite network device.

[0012] In an embodiment of the present application, before the step of enabling the MACsec session creation function of each target port in the plurality of target ports in sequence, the method further comprises the following steps.

[0013] setting all target ports in a member port to a closed state of not forwarding data packets;

[0014] after the step of enabling the MACsec session creation function of each target port in the plurality of target ports, the method further comprises the following steps.

[0015] setting the enabled target port to an open state of forwarding data packets.

[0016] In an embodiment of the present application, after the step of setting all target ports in a member port to a closed state of not forwarding data packets, the method further comprises the following steps.

[0017] switching a target packet to a standby port outside the target port for transmission, wherein the target packet is a packet to be transmitted through the target port in the closed state;

[0018] after the step of setting the enabled target port to an open state of forwarding data packets, the method further comprises the following steps.

[0019] switching the packet to be transmitted through the standby port to the target port in the open state for transmission.

[0020] In an embodiment of the present application, the step of determining a plurality of target ports from ports of a network device comprises the following steps.

[0021] determining a target slot in the network device that supports MACsec;

[0022] determining a target port from ports on a board card connected to the target slot that supports MACsec.

[0023] In a second aspect, an embodiment of the present application provides a network device, the network device comprising:

[0024] a processor;

[0025] a transceiver;

[0026] a machine readable storage medium storing machine executable instructions executable by the processor, the machine executable instructions causing the processor to perform the following steps:

[0027] determining a plurality of target ports from ports in the network device, wherein the target ports are ports that support MACsec;

[0028] sequentially enabling a media access control security protocol (MACsec) session creation function of each target port in the plurality of target ports;

[0029] forming an aggregation group by aggregating the plurality of target ports by successively exchanging link aggregation protocol (LACP) packets between the plurality of target ports and a peer port of a target port, wherein the peer port of the target port is a port on a peer network device that is connected to the target port.

[0030] In an embodiment of the present application, before the sequentially enabling a MACsec session creation function of each target port in the plurality of target ports, the machine executable instructions further cause the processor to perform the following steps:

[0031] setting all target ports in the member ports to a closed state that does not forward data packets;

[0032] after each time the MACsec session creation function of a target port is enabled, further comprising:

[0033] setting the enabled target port to an open state that forwards data packets.

[0034] In an embodiment of the present application, after the setting all target ports in the member ports to a closed state that does not forward data packets, the machine executable instructions further cause the processor to perform the following steps:

[0035] switching a target packet to a backup port outside the target ports for transmission, wherein the target packet is a packet to be transmitted through a target port in the closed state.

[0036] After the target port which has been enabled is in the open state for forwarding data packets, the machine executable instructions further cause the processor to perform the following steps:

[0037] Switching the packets to be transmitted through the standby port to the target port in the open state for transmission.

[0038] In one embodiment of the present application, the target ports are determined from the ports in the network device, specifically comprising:

[0039] Determining the target slots in the network device supporting MACsec;

[0040] Determining the target ports supporting MACsec from the ports on the board connected to the target slots.

[0041] In a third aspect, an embodiment of the present application provides an aggregated port MACsec session creation device, the device comprising:

[0042] A target port determination module for determining a plurality of target ports from the ports in the network device, wherein the target ports are ports supporting MACsec;

[0043] A port enabling module for sequentially enabling the media access control security protocol (MACsec) session creation function of each target port in the plurality of target ports;

[0044] A link aggregation module for sequentially interacting link aggregation protocol packets with the opposite end port of the target port through the plurality of target ports in which the MACsec session is successfully created, to aggregate the plurality of target ports to form an aggregated group, wherein the opposite end port of the target port is the port on the opposite end network device connected to the target port.

[0045] In one embodiment of the present application, the device further comprises:

[0046] A first setting module for setting all target ports in the member port to a closed state of not forwarding data packets;

[0047] A second setting module for setting the enabled target port to an open state of forwarding data packets.

[0048] In one embodiment of the present application, the device further comprises:

[0049] A first packet switching module for switching the target packet to a standby port outside the target port for transmission, wherein the target packet is a packet to be transmitted through the target port in the closed state;

[0050] The second packet switching module is configured to switch the packet to be transmitted through the standby port to the target port in the open state.

[0051] In one embodiment of the present application, the target port determination module is specifically configured to:

[0052] determine a target slot supporting MACsec in the network device;

[0053] determine a target port supporting MACsec from the ports on the board card connected to the target slot.

[0054] In a fourth aspect, an embodiment of the present application provides a computer readable storage medium, wherein the computer readable storage medium stores a computer program, and the computer program is executed by a processor to implement the method steps of any of the first aspect.

[0055] In a fifth aspect, an embodiment of the present application further provides a computer program product containing instructions, which, when executed on a computer, cause the computer to perform the method of any of the first aspect.

[0056] The embodiment of the present application has the following beneficial effects:

[0057] The method for creating a MACsec session of an aggregation port provided by the embodiment of the present application can first determine a target port supporting MACsec in a network device, and sequentially enable the MACsec session creation function of the target port, and automatically perform link aggregation after successfully creating the MACsec session. Since the enabling process of the target port does not need to be manually enabled through a command line, but is automatically sequentially enabled after the target port is determined, the efficiency of creating a MACsec session of an aggregation port can be improved, and the security risk of an aggregation group caused by manual negligence in enabling MACsec for part of the member ports can be avoided. BRIEF DESCRIPTION OF DRAWINGS

[0058] In order to more clearly illustrate the technical solutions of the embodiments of the present application or the prior art, the following will briefly introduce the drawings needed to be used in the embodiment or prior art description. Obviously, the drawings in the following description are only some embodiments of the present application, and other embodiments can also be obtained by those skilled in the art based on these drawings.

[0059] Figure 1 A flowchart of a first method for creating a MACsec session of an aggregation port provided by an embodiment of the present application;

[0060] Figure 2 A schematic diagram of a connection relationship between a target port and a peer port provided by an embodiment of the present application;

[0061] Figure 3 A MACsec session creation and communication flow schematic diagram provided for an embodiment of the present application;

[0062] Figure 4 A port state determination flow schematic diagram provided for an embodiment of the present application;

[0063] Figure 5 A link aggregation schematic diagram provided for an embodiment of the present application;

[0064] Figure 6 A flow schematic diagram of a second aggregation port MACsec session creation method provided for an embodiment of the present application;

[0065] Figure 7 A flow schematic diagram of a third aggregation port MACsec session creation method provided for an embodiment of the present application;

[0066] Figure 8 A flow schematic diagram of a fourth aggregation port MACsec session creation method provided for an embodiment of the present application;

[0067] Figure 9 A flow schematic diagram of a fifth aggregation port MACsec session creation method provided for an embodiment of the present application;

[0068] Figure 10 A structure schematic diagram of a network device provided for an embodiment of the present application;

[0069] Figure 11 A structure schematic diagram of an aggregation port MACsec session creation apparatus provided for an embodiment of the present application. DETAILED DESCRIPTION

[0070] The technical solutions in the embodiments of the present application will be described clearly and completely below with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all the embodiments of the present application. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art based on the present application belong to the scope of protection of the present application.

[0071] In order to solve the problem that the way of manually enabling MACsec for a specified port through a command line is relatively cumbersome, low in efficiency, and prone to errors and omissions in the related art, the present application provides an aggregation port MACsec session creation method, a network device and an apparatus.

[0072] Referring to Figure 1 A flow schematic diagram of a first aggregation port MACsec session creation method provided for an embodiment of the present application includes the following steps S101-S103.

[0073] S101: determining a plurality of target ports from within a port of a network device.

[0074] The target ports are ports supporting MACsec.

[0075] In one embodiment of the present application, the target ports can be determined by searching a soft table configured in the network device, in which the identities of the target ports configured to be able to create MACsec sessions in the network device are recorded.

[0076] In another embodiment of the present application, step S101 can be implemented by following steps A-B.

[0077] Step A: determining a target slot supporting MACsec in the network device.

[0078] In one embodiment, the soft table can record the slots supporting MACsec, and the target slot can be determined by reading the soft table.

[0079] In another embodiment, the hardware specifications of each slot can be determined respectively, and then the target slot supporting MACsec can be determined according to the hardware specifications. Specifically, the slots supporting MACsec by default are different on different models of network devices, and the target slot supporting MACsec on the network device can be determined according to the model of the network device executing the embodiment of the present application.

[0080] Step B: determining a target port supporting MACsec from the ports on the board card connected to the target slot.

[0081] In one embodiment, after the target slot is determined, the member ports of the aggregation port corresponding to the target slot recorded in the soft table can be queried first. The member ports are ports configured to perform link aggregation. Then the target port can be determined from the member ports. Specifically, the ports recorded in the soft table and belonging to the member ports and capable of creating MACsec sessions can be determined as the target ports by querying the soft table. It should be noted that the ports configured to perform link aggregation but not supporting MACsec sessions will not be determined as the target ports.

[0082] Since the ports on the board card connected to the slots not supporting MACsec do not support MACsec, the member ports on the target slot can be determined only when the target slot is determined, and then the target port can be determined from the member ports, which can exclude the member ports corresponding to the non-target slots and accelerate the screening speed of the target port.

[0083] S102: sequentially enabling the MACsec session creation function of each target port in the plurality of target ports.

[0084] After enabling the MACsec session creation function, the target port creates a MACsec session.

[0085] In one embodiment of the present application, the target port completes MACsec session creation through MACsec key negotiation with the peer port based on a preconfigured pre-shared key. After completing MACsec session creation, the target port and the peer port can encrypt messages based on the MACsec key.

[0086] Referring to Figure 2 FIG. 1 shows a connection relationship between a target port and a peer port according to an embodiment of the present application.

[0087] In FIG. 1, network device A is a network device that executes an embodiment of the present application. GE1 / 0 / 1 on network device A is a target port, and GE1 / 0 / 1 on network device B connected to the target port is a peer port.

[0088] In one embodiment of the present application, a MACsec session can be created through the following Figure 3 embodiment, which is not described here.

[0089] After that, the MACsec session is terminated when any of the following conditions occurs.

[0090] 1. When network device A receives a network device B offline request message, network device A clears the corresponding MACsec session.

[0091] 2. After a MACsec session timeout timer expires, network device A does not receive an EAPOL-MKA message from the peer, and network device A clears the corresponding MACsec session. The timeout duration of the above-mentioned timeout timer can be configured, for example, 5s, 10s, etc. If not configured, the timeout duration is a default value, for example, 6s, 8s, etc.

[0092] It should be noted that for a target port that has not completed MACsec session creation, a network device can repeatedly execute MACsec session creation for the target port until the creation is completed. Or if the number of creation failures reaches a first preset number, the target port is skipped and MACsec session creation is not performed for the target port.

[0093] S103: Link aggregation protocol messages are exchanged between the above-mentioned multiple target ports and the peer ports of the target ports through which the MACsec sessions are successfully created, and the above-mentioned multiple target ports are aggregated to form an aggregation group.

[0094] The peer port of the target port is a port on a peer network device connected to the target port.

[0095] In the embodiment of the present application, after the target port completes link aggregation to form an aggregation group, the target port is written into a hard table recorded in a register of a switching chip of the network device, so that the switching chip can determine that the port is in the selected state, i.e., the port completes link aggregation.

[0096] If the link aggregation fails, the target port and the opposite port can interact link aggregation protocol packets again to attempt link aggregation until the link aggregation succeeds. Alternatively, if the number of times of link aggregation failure reaches a second preset number, the target port is skipped and link aggregation is not performed on the target port.

[0097] In one embodiment of the present application, before link aggregation is performed on the target port, the steps C1-C8 shown in the following table are first performed to determine whether the target port is a selected port in the selected state. The port in the selected state can perform link aggregation. For specific description of the steps C1-C8, refer to the following table, which is not described in detail here. Figure 4

[0098] In addition, it should be noted that for the ports on the board card connected to the slot not supporting MACsec on the network device, and the ports on the board card connected to the target slot not supporting MACsec, if the above ports are member ports, the member ports can also perform link aggregation. In this case, the ports included in the aggregation port finally formed by link aggregation include the ports performing communication based on the MACsec session and the ports directly performing communication without the MACsec session.

[0099] Referring to Figure 5 , a link aggregation diagram provided by the embodiment of the present application is shown.

[0100] Figure 5 The opposite port of the port A1 on the network device A is the port B1 of the network device B, the opposite port of the port A2 on the network device A is the port B2 of the network device B, and the opposite interface of the interface A3 on the network device A is the interface B3 of the network device B. The physical link between the port A1 and the port B1, the physical link between the port A2 and the port B2, and the physical link between the port A3 and the port A3 are aggregated to form a logical link 1. The bandwidth of the logical link 1 is equal to the sum of the bandwidths of the three physical links.

[0101] If the execution subject of the embodiment of the present application is the network device A in Figure 5 , the network device A enables the port A1, the port A2, and the port A3, respectively, and creates the MACsec session between the port A1 and the port B1, the MACsec session between the port A2 and the port B2, and the MACsec session between the port A3 and the port B3, respectively, so as to realize secure communication of the whole logical link 1.​

[0102] Therefore, if the MACsec session of the aggregation link is created by using the method in the related art, the ports A1, A2 and A3 of the network device A need to be manually enabled respectively, which is inefficient and may be omitted.

[0103] The method for creating the MACsec session of the aggregation port provided by the embodiments of the present application can first determine the target ports supporting the MACsec in the network device, and sequentially enable the MACsec session creation function of the target ports, and automatically perform the link aggregation after the MACsec session is successfully created. Since the enabling process of the target ports does not need to be manually performed by using the command line, but is automatically performed after the target ports are determined, the efficiency of creating the MACsec session of the aggregation port can be improved, and the MACsec enabling of part of the member ports can be avoided due to human negligence, which can bring a security risk to the aggregation group.

[0104] Referring to Figure 3 , a MACsec session creation and communication flow diagram is provided by the embodiments of the present application, and the process of creating the MACsec session and communication between the target ports on the network device A and the opposite ports on the network device B in the foregoing Figure 2 is taken as an example, the process of creating the MACsec session and communication between the ports is described, and it should be noted that the data interaction process between the network device A and the network device B described below is completed by the target ports and the opposite ports, and the network device A and the network device B are preconfigured with the PSK (Pre-Shared Key, pre-shared key) as the CAK (Certificate-based Authorization Key, certificate authorization key), including the following steps S301-S305.

[0105] Step S301: The network device A sends a key server message to the network device B.

[0106] The key server message indicates that the target port of the network device A is a port with a higher priority elected as the key server, which is responsible for generating and distributing the SAK (Secure Association Key, secure association key).

[0107] Step S302: The network device A and the network device B send their own capability information and parameters required for creating the session to each other.

[0108] The capability information and the parameters include the priority of the port and whether the encrypted session is expected.

[0109] Step S303: The network device A sends the key name and the secure association key to the network device B.

[0110] Step S304: The network device B sends a security association key configuration completion message to the network device A.

[0111] The above steps S301-S304 are a session negotiation process, in which the network device A and the network device B transmit media access control security protocol session creation messages, which can be Extensible Authentication Protocol over LANs-MACsec Key Agreement (EAPOL-MKA) messages, so as to realize the secure communication between the target port of the network device A and the opposite port of the network device B in step S305 below.

[0112] Step S305: The network device A and the network device B transmit encrypted messages.

[0113] The encrypted message is encrypted based on the SAK. Step S305 is a secure communication process, in which the transmitted message is a media access control security protocol message.

[0114] The ports participating in the link aggregation exist in three states: 1. selected state, which means that the member port in this state can participate in the forwarding of user data, and the member port in this state is referred to as a "selected port"; 2. unselected state, which means that the member port in this state cannot participate in the forwarding of user data, and the member port in this state is referred to as an "unselected port"; and 3. individual state, which means that the member port in this state can participate in the forwarding of data as a normal port. When the aggregation interface type is configured as an aggregation edge interface, the member port in this state has not received the LACP (Link Aggregation Control Protocol) message sent by the opposite port.

[0115] Referring to Figure 4 FIG. 1 is a schematic diagram of a port state determination process provided by an embodiment of the present application, which includes the following steps C1-C8.

[0116] Step C1: Determine whether the target port cannot participate in the link aggregation due to hardware limitation.

[0117] If yes, step C8 is performed, otherwise step C2 is performed.

[0118] Step C2: Determine whether the target port is in a connected state.

[0119] It is to be noted that the connection state, i.e. UP state, is a state in which the target port has not failed. If the target port has not completed the MACsec session creation in the case of supporting the MACsec session creation, the target port is in a disconnection state in the present application.

[0120] If yes, step C3 is performed, otherwise step C8 is performed.

[0121] Step C3: Determine whether the operational key and attribute class configuration of the target port are the same as those of the reference port.

[0122] The reference port is elected from the member ports of the aggregation group of the network device, and the attribute class configuration and the operational key thereof will be taken as a reference for other member ports in the same aggregation group to determine the state of the member ports.

[0123] If yes, step C4 is performed, otherwise step C8 is performed.

[0124] Step C4: Determine whether the operational key and attribute class configuration of the peer port of the target port are the same as those of the peer port of the reference port.

[0125] Specifically, the operational key and attribute class configuration of the peer port of the target port and the operational key and attribute class configuration of the peer port of the reference port are both sent by the network device where the peer port is located to the execution subject of the present application.

[0126] If yes, step C5 is performed, otherwise step C8 is performed.

[0127] Step C5: Determine whether the number of the ports to be candidate for link aggregation has exceeded a preset upper limit number.

[0128] If not, step C6 is performed, and if yes, step C7 is performed.

[0129] Step C6: Determine that the target port is a selected port.

[0130] Step C7: Sort the ports to be candidate for link aggregation according to the port number, and determine whether the target port belongs to the first preset upper limit number of ports.

[0131] If yes, step C6 is performed, otherwise step C8 is performed.

[0132] Step C8: Determine that the target port is a non-selected port.

[0133] If the port belongs to the selected port, step S103 is performed to perform link aggregation.

[0134] In one embodiment of the present application, the member ports do not include the ports that have enabled the MACsec session creation.

[0135] Specifically, when setting a port as a member port participating in link aggregation, the network device detects whether the set port is a port enabled for MACsec session creation, i.e., whether the MACsec session creation state of the port is enable, and if yes, the port will not be set as a member port. In an embodiment, a prompt of port setting failure can also be fed back. That is, in the embodiment, the port enabled for MACsec session creation will not participate in link aggregation.

[0136] In another embodiment of the present application, only target ports in the member ports are enabled for MACsec session creation, but the key configuration of each target port can not be set uniformly, i.e., the key configuration of each target port can be different, so as to ensure that the keys of different target ports are independent of each other, improve security, and ensure the flexibility of key configuration.

[0137] Referring to Figure 6 A flowchart of a second aggregation port MACsec session creation method provided by an embodiment of the present application includes the following steps S601-S605, and the following steps S606-S613 are executed for each member port, and the member port 1 is taken as an example in the figure, and steps S607-S613 are executed for other member ports.

[0138] S601: Enable link aggregation media access control security protocol session creation.

[0139] After enabling link aggregation media access control security protocol session creation, the scheme provided by the embodiment of the present application is started to be executed.

[0140] S602: Traverse all slots.

[0141] S603: Judge whether the current slot supports media access control security protocol.

[0142] If yes, step S604 is executed, otherwise, all member ports on the board connected to the current slot continue to execute from step S611.

[0143] S604: Turn on the aggregation enable media access control security protocol switch of the current slot.

[0144] S605: Query the software table and traverse all member ports of the current slot.

[0145] S606: Judge whether the member port 1 supports media access control security protocol.

[0146] If yes, it means that the member port 1 is a target port, and step S607 is executed, otherwise, the member port 1 continues to execute from step S611.

[0147] S607: Member port 1 enables the media access control security protocol session creation.

[0148] S608: Member port 1 is opened, and a media access control security protocol session creation message is sent.

[0149] S609: It is determined whether the media access control security protocol session creation is successful.

[0150] If successful, step S610 is performed, and if not successful, step S608 is returned to perform.

[0151] S610: Member port 1 successfully establishes the media access control security protocol session.

[0152] S611: A link aggregation protocol message is sent.

[0153] S612: It is determined whether the link aggregation is successfully created.

[0154] If successful, step S613 is performed, and otherwise, step S611 is returned to perform.

[0155] S613: The selected state of the member port is written into a hard table.

[0156] Referring to Figure 7 , a flowchart of a third aggregation port MACsec session creation method provided by the embodiment of the present application is shown. Compared with the foregoing Figure 1 , the following step S104 is further performed before step S102, and the following step S105 is further performed after each time the target port is enabled to create a MACsec session.

[0157] S104: All target ports in the member port are set to a closed state of not forwarding data messages.

[0158] After the target port is set to the closed state, the target port cannot forward data messages and enters a non-selected state.

[0159] S105: The enabled target port is set to an open state of forwarding data messages.

[0160] Since the target port cannot forward the message during the subsequent MACsec session creation function enabling period of the target port, the data message forwarded through the target port will cause packet loss. In order to solve the packet loss problem, the network device may transfer the data message forwarded through the target port to other ports for forwarding, but it may be transferred to other target ports, but the transferred target port may be enabled for MACsec session creation in the subsequent period, which will cause data message loss, thereby causing continuous packet loss problem, affecting the normal forwarding of data message of the network device. Therefore, in the embodiment, all target ports in the member port are uniformly set to the enabled closed state of not forwarding data message, so as to avoid the data message being switched to the target port which will enable the MACsec session creation function, thereby causing the above data message loss problem. And after enabling the target port for MACsec session creation each time, the enabled target port is set to the enabled state of forwarding data message, so as to fully utilize the target port which has enabled the MACsec session creation function to forward the data message, and improve the forwarding efficiency.

[0161] Referring to Figure 8 , the flowchart of the fourth aggregated port MACsec session creation method provided by the embodiment of the present application is compared with the embodiment shown in the foregoing Figure 6 , the following steps S614-S615 are further included before step S607, and the following step S616 is further included after step S607.

[0162] S614: set the member port 1 to the closed state.

[0163] S615: the member port 1 is closed, which is a non-selected port.

[0164] S616: set the member port 1 to the enabled state.

[0165] Referring to Figure 9 , the flowchart of the fifth aggregated port MACsec session creation method provided by the embodiment of the present application is compared with the embodiment shown in the foregoing Figure 7 , the following step S106 is further included after step S104, and the following step S107 is further included after step S105.

[0166] S106: switch the target message to a standby port outside the target port for transmission.

[0167] Among them, the above target message is: the message to be transmitted through the target port in the closed state.

[0168] The standby port is a port other than all target ports, and is not enabled with the function of MACsec session creation, so that the target packet is transferred to the standby port for forwarding, and is not affected by the subsequent step S102.

[0169] The number of the above-mentioned standby ports can be one or more, and the target packets of different target ports can be switched to different standby ports for forwarding, or can be switched to the same standby port for forwarding, which is not limited in the embodiments of the application.

[0170] S107: Switch the packet to be transmitted through the above-mentioned standby port to the target port in the enabled state for transmission.

[0171] After enabling the MACsec session creation function of the target port, the target port returns to the enabled state and can perform packet forwarding, so that the switching of the packet of the standby port to the target port can normally transmit the data packet.

[0172] As can be seen from the above, in the embodiments of the application, before enabling the MACsec session creation function of the target port, all target ports are uniformly configured to be in the disabled state, and the target packet of the target port is switched to the standby port for transmission, which can solve the problem that the target port cannot temporarily perform data packet forwarding, and can ensure the normal forwarding of the data packet as much as possible, and the standby packet will not be affected by the enabled MACsec session creation function, so that the packet loss problem can be avoided as much as possible. After the target port is enabled, the target port restores the data packet forwarding capability, and the switching of the packet of the standby port to the target port for transmission can relieve the packet forwarding pressure of the standby port and improve the packet forwarding efficiency.

[0173] Corresponding to the above-mentioned aggregation port MACsec session creation method, the embodiments of the application further provide a network device.

[0174] Referring to Figure 10 A structural schematic diagram of a network device provided by the embodiments of the application is provided, and the network device comprises:

[0175] a processor 1001;

[0176] a transceiver 1004;

[0177] a machine readable storage medium 1002, which stores machine executable instructions capable of being executed by the processor 1001, and the machine executable instructions cause the processor 1001 to execute the following steps:

[0178] determining a plurality of target ports from the ports of the network device, wherein the target ports are MACsec supported ports;

[0179] sequentially enable a media access control security protocol (MACsec) session creation function of each of the plurality of target ports;

[0180] sequentially interact link aggregation protocol packets with a peer port of the target port through the plurality of target ports successfully creating the MACsec session to form an aggregated group by link aggregation of the plurality of target ports, wherein the peer port of the target port is a port on a peer network device connected to the target port.

[0181] As shown in Figure 10 The network device can further include a communication bus 1003. The processor 1001, the machine readable storage medium 1002 and the transceiver 1004 can communicate with each other through the communication bus 1003. The communication bus 1003 can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus 1003 can be divided into an address bus, a data bus, a control bus, etc.

[0182] The transceiver 1004 can be a wireless communication module. The transceiver 1004 can interact with other devices for data under the control of the processor 1001.

[0183] The machine readable storage medium 1002 can include a Random Access Memory (RAM) and can also include a Non-Volatile Memory (NVM), such as at least one disk memory. In addition, the machine readable storage medium 1002 can also be at least one storage device located away from the aforementioned processor.

[0184] The processor 1001 can be a general-purpose processor, including a Central Processing Unit (CPU), a Network Processor (NP), etc. The processor 1001 can also be a Digital Signal Processor (DSP), an Application Specific Integrated Circuit (ASIC), a Field-Programmable Gate Array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component.

[0185] The aggregation port MACsec session creation method provided in this application first identifies target ports in the network device that support MACsec, then sequentially enables the MACsec session creation function of the target ports, and automatically performs link aggregation after successfully creating a MACsec session. Since the target port enabling process does not require manual command-line intervention, but is automatically performed sequentially after the target ports are identified, the efficiency of aggregation port MACsec session creation can be improved. Furthermore, it avoids security risks to the aggregation group due to human error in neglecting to enable MACsec for some member ports.

[0186] In one embodiment of this application, before sequentially enabling the Media Access Control Security Protocol (MACsec) session creation function for each of the plurality of target ports, the machine-executable instructions further cause the processor 1001 to perform the following steps:

[0187] Set all target ports in the member port to the closed state, where data packets are not forwarded;

[0188] After enabling MACsec session creation on the target port each time, the following is also included:

[0189] Set the enabled target port to the enabled state for forwarding data packets.

[0190] Because the target port cannot forward packets during the subsequent MACsec session creation function enablement, packet loss will occur in data packets forwarded through the target port. To handle packet loss, network devices may transfer data packets forwarded through the target port to other ports. However, these transferred target ports may subsequently have MACsec session creation enabled again, leading to further packet loss and causing continuous packet loss, thus affecting the normal forwarding of data packets by the network device. Therefore, this embodiment uniformly sets all target ports in the member ports to a disabled state (no data packet forwarding) to prevent data packets from being switched to target ports where MACsec session creation is about to be enabled, thus avoiding the aforementioned packet loss problem. Furthermore, after each MACsec session creation is enabled on a target port, the enabled target port is set to an enabled state (data packet forwarding enabled), thereby fully utilizing the target ports with MACsec session creation enabled for data packet forwarding and improving forwarding efficiency.

[0191] In one embodiment of this application, after setting all target ports in the member port to a closed state where data packets are not forwarded, the machine-executable instructions further cause the processor 1001 to perform the following steps:

[0192] switching the target message to a backup port out of the target port, wherein the target message is a message to be transmitted through the target port in the closed state;

[0193] After the set target port is in the open state for forwarding data messages, the machine executable instructions further cause the processor to perform the following steps:

[0194] Switch the message to be transmitted through the backup port to the target port in the open state.

[0195] As can be seen from the above, in the embodiment of the application, before enabling the MACsec session creation function of the target port, all target ports are uniformly configured in the closed state, and then the target message of the target port is switched to the backup port for transmission, which can solve the problem that the target port cannot temporarily forward data messages, and can ensure the normal forwarding of data messages as much as possible. And the backup message will not be affected by the function of enabling the MACsec session creation, so as to avoid the problem of packet loss as much as possible. And after the target port is opened, the target port restores the data message forwarding capability, and the message of the backup port is switched to the target port for transmission, which can relieve the message forwarding pressure of the backup port and improve the message forwarding efficiency.

[0196] In an embodiment of the application, the target ports are determined from the ports in the network device, specifically comprising:

[0197] Determine the target slot in the network device that supports MACsec;

[0198] Determine the target port on the board card connected to the target slot that supports MACsec.

[0199] Corresponding to the foregoing method for creating a MACsec session for an aggregation port, an embodiment of the application further provides an apparatus for creating a MACsec session for an aggregation port.

[0200] Referring to Figure 11 An apparatus for creating a MACsec session for an aggregation port provided in an embodiment of the application has the structure shown in the figure, and the apparatus comprises:

[0201] A target port determination module 1101 is configured to determine a plurality of target ports from the ports in the network device, wherein the target ports are ports that support MACsec;

[0202] A port enabling module 1102 is configured to sequentially enable the media access control security protocol (MACsec) session creation function of each target port in the plurality of target ports;

[0203] The link aggregation module 1103 is configured to sequentially interact with a peer port of the target port through the plurality of target ports whose MACsec session is successfully created, to perform link aggregation on the plurality of target ports to form an aggregation group, wherein the peer port of the target port is a port on a peer network device connected to the target port.

[0204] The method for creating an aggregation port MACsec session provided by the embodiments of the present application can first determine the target ports supporting MACsec in a network device, sequentially enable the MACsec session creation function of the target ports, and automatically perform link aggregation after the MACsec session is successfully created. Since the enabling process of the target ports does not need to be manually performed through a command line, but is automatically performed after the target ports are determined, the efficiency of creating an aggregation port MACsec session can be improved, and the security risk of an aggregation group caused by manual negligence in enabling MACsec for some member ports can be avoided.

[0205] In one embodiment of the present application, the device further comprises:

[0206] The first setting module is configured to set all the target ports in the member ports to a closed state of not forwarding data packets.

[0207] The second setting module is configured to set the enabled target ports to an open state of forwarding data packets.

[0208] Since the target ports cannot forward packets during the subsequent enabling of the MACsec session creation function of the target ports, packet loss of data packets forwarded through the target ports will occur. In order to handle the packet loss problem, the network device can transfer the data packets forwarded through the target ports to other ports for forwarding, but the data packets may be transferred to other target ports, and the target ports to which the data packets are transferred may be enabled with the MACsec session creation function in the subsequent process, which will cause the data packets to be lost again, thereby causing continuous packet loss and affecting the normal forwarding of data packets of the network device. Therefore, in the embodiments, all the target ports in the member ports are uniformly set to an enabled closed state of not forwarding data packets, so as to avoid the data packets from being switched to the target ports to be enabled with the MACsec session creation function, thereby avoiding the above packet loss problem. In addition, after enabling the MACsec session creation of the target ports each time, the enabled target ports are set to an open state of forwarding data packets, so that the target ports enabled with the MACsec session creation function can be fully utilized to forward data packets, thereby improving the forwarding efficiency.

[0209] In one embodiment of the present application, the device further comprises:

[0210] The first packet switching module is configured to switch the target packet to a backup port outside the target port for transmission, wherein the target packet is a packet to be transmitted through the target port in the closed state;

[0211] The second packet switching module is configured to switch the packet to be transmitted through the backup port to the target port in the open state for transmission.

[0212] As can be seen from the above, in the embodiment of the application, before enabling the MACsec session creation function of the target port, all target ports are uniformly configured in a closed state, and then the target packet of the target port is switched to the backup port for transmission, which can solve the problem that the target port cannot temporarily forward data packets, and can ensure the normal forwarding of data packets as much as possible, and the backup packet will not be affected by the function of enabling the MACsec session creation, so as to avoid the packet loss problem as much as possible. And after the target port is opened, the target port restores the data packet forwarding capability, and the packet of the backup port is switched to the target port for transmission, which can relieve the packet forwarding pressure of the backup port and improve the packet forwarding efficiency.

[0213] In an embodiment of the application, the target port determination module 1101 is specifically configured to:

[0214] Determine a target slot supporting MACsec in the network device;

[0215] Determine a target port supporting MACsec from the ports on the board card connected to the target slot.

[0216] In another embodiment provided by the application, a computer readable storage medium is also provided, and the computer readable storage medium stores a computer program. When the computer program is executed by a processor, the steps of any of the above-mentioned aggregated port MACsec session creation methods are implemented.

[0217] In another embodiment provided by the application, a computer program product containing instructions is also provided, which, when running on a computer, causes the computer to execute any of the aggregated port MACsec session creation methods in the above-mentioned embodiments.

[0218] In the embodiments described above, all or some of the steps can be implemented by software, hardware or firmware, or any combination thereof. When implemented by software, all or some of the steps can be implemented in the form of one or more computer programs. The computer program can be stored in any computer readable medium, and loaded into the computer for execution. The computer readable medium can include: a computer storage medium (e.g., a floppy disk, a hard disk, a CD, a DVD, a magnetic disk, a magnetic tape, a USB key, a flash memory, an optical storage medium, a memory card, etc.), a computer network, or any other medium suitable for storing computer programs. The computer storage medium does not include computer readable medium in the transitory or propagating signals per se.

[0219] It should be noted that, in the present document, the terms such as first and second are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply there is any such actual relationship or order between these entities or operations. Also, the terms "comprising", "containing", or any other similar term are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not necessarily include those elements only, but can include other elements not expressly listed, or can include elements inherent in such process, method, article, or apparatus. Without more limitations, an element defined by the phrase "comprising a" does not exclude the existence of additional identical elements in the process, method, article, or apparatus that includes the element.

[0220] Each of the embodiments in the present document is described in a related manner, and the same or similar parts between the embodiments can be referred to each other. Each of the embodiments focuses on the difference from other embodiments. In particular, for the network device, apparatus, computer readable storage medium, and computer program product embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the part of the method embodiment.

[0221] The above merely provides the preferred embodiment of the present application, and not intended to limit the protection scope of the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method for creating a MACsec session on an aggregated port, characterized in that, The method includes: Multiple target ports are identified from the ports of the network device, wherein the target ports are ports that support MACsec; Enable the Media Access Control Security Protocol (MACsec) session creation function for each of the plurality of target ports in sequence; Link aggregation protocol messages are exchanged between the multiple target ports that have successfully created MACsec sessions and their peer ports to form an aggregation group. The peer port of the target port is the port on the peer network device that is connected to the target port.

2. The method according to claim 1, characterized in that, Before sequentially enabling the Media Access Control Security Protocol (MACsec) session creation function for each of the plurality of target ports, the method further includes: Set all target ports in the member port to the closed state, where data packets are not forwarded; After enabling MACsec session creation on the target port each time, the following is also included: Set the enabled target port to the enabled state for forwarding data packets.

3. The method according to claim 2, characterized in that, After setting all target ports in the member ports to a closed state where they do not forward data packets, the following is also included: The target message is switched to an alternate port other than the target port for transmission, wherein the target message is: a message to be transmitted through the target port which is in a closed state; After setting the enabled target port to the enabled state for forwarding data packets, the following is also included: The message to be transmitted through the backup port is switched to the target port that is in the open state for transmission.

4. The method according to claim 1, characterized in that, The step of determining multiple target ports from within the ports of the network device includes: Identify the target slots in the network device that support MACsec; Identify the target port that supports MACsec from the ports on the board connected to the target slot.

5. A network device, characterized in that, The network device includes: processor; transceiver; A machine-readable storage medium storing machine-executable instructions that can be executed by the processor, the machine-executable instructions causing the processor to perform the following steps: Multiple target ports are identified from the ports of the network device, wherein the target ports are ports that support MACsec; Enable the Media Access Control Security Protocol (MACsec) session creation function for each of the plurality of target ports in sequence; Link aggregation protocol messages are exchanged between the multiple target ports that have successfully created MACsec sessions and their peer ports to form an aggregation group. The peer port of the target port is the port on the peer network device that is connected to the target port.

6. The network device according to claim 5, characterized in that, Before sequentially enabling the Media Access Control Security Protocol (MACsec) session creation function for each of the plurality of target ports, the machine-executable instructions also cause the processor to perform the following steps: Set all target ports in the member port to the closed state, where data packets are not forwarded; After enabling MACsec session creation on the target port each time, the following is also included: Set the enabled target port to the enabled state for forwarding data packets.

7. The network device according to claim 6, characterized in that, After setting all target ports in the member port to a closed state where data packets are not forwarded, the machine-executable instructions further cause the processor to perform the following steps: The target message is switched to an alternate port other than the target port for transmission, wherein the target message is: a message to be transmitted through the target port which is in a closed state; After setting the enabled target port to the enabled state for forwarding data packets, the machine-executable instructions further cause the processor to perform the following steps: The message to be transmitted through the backup port is switched to the target port that is in the open state for transmission.

8. The network device according to claim 5, characterized in that, The step of determining multiple target ports from within the ports of the network device specifically includes: Identify the target slots in the network device that support MACsec; Identify the target port that supports MACsec from the ports on the board connected to the target slot.

9. A device for creating a MACsec session on an aggregated port, characterized in that, The device includes: The target port determination module is used to determine multiple target ports from the ports of the network device, wherein the target ports are ports that support MACsec; The port enabling module is used to sequentially enable the Media Access Control Security Protocol (MACsec) session creation function of each of the plurality of target ports; The link aggregation module is used to sequentially exchange link aggregation protocol messages between the multiple target ports that have successfully created MACsec sessions and their peer ports to form an aggregation group. The peer port of the target port is the port on the peer network device that is connected to the target port.

10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the method described in any one of claims 1-4.

Images