Message path verification method and device, equipment and storage medium

Abstract

Provided are a message path verification method, apparatus and device, and a storage medium, relating to the field of communication technology, the method comprising: a first device obtaining a first message, the first message comprising first load information and a first segment routing extension header, the first segment routing extension header comprises first path information of the first message and a first path verification field of the first message; determining first path verification information of the first message based on the first path information and the first load information; packaging the first path verification information into a first path verification field to obtain a second message; sending the second message to a second device; the second message is used for the second device to verify whether the first path information is tampered or not based on the first load information and the first path verification information. The first path verification information is packaged in the first path verification field, so that the second equipment verifies whether the first path information is tampered or not, message path tampering detection in an SRv6 scene is realized, and the verification accuracy is improved.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a message path verification method, apparatus, device, and storage medium. Background Technology

[0002] SRv6 technology plans packet transmission paths by adding a Segment Routing Header (SRH) to IPv6. The Segment List field in the SRH carries the segment identifiers (SIDs) of the nodes the packet must traverse in sequence. The SRH header introduces new security challenges. The path information in the Segment List can be illegally modified, such as skipping hops, adding hops, or changing their order, thereby altering the packet transmission path.

[0003] In related technologies, Hash-based Message Authentication Code (HMAC) is used to verify messages and determine whether the message transmission path has been tampered with. HMAC TLV, as an optional component, provides verification of specific fields in SRv6 messages. In SRv6 scenarios, the above HMAC verification method may fail to detect message path tampering, allowing attackers to change message forwarding paths, bypass critical network devices, or redirect traffic to other devices. Summary of the Invention

[0004] This invention provides a message path verification method, apparatus, device, and storage medium to solve the problem of failing to verify that the message path has been illegally tampered with in SRv6 scenarios.

[0005] In a first aspect, the present invention provides a message path verification method, applied to a first device, comprising: Obtain a first message, the first message including first payload information and a first segmented routing extension header, the first segmented routing extension header including first path information of the first message and a first path verification field of the first message; Based on the first path information and the first payload information, the first path verification information of the first message is determined; The first path verification information is encapsulated into the first path verification field to obtain the second message; The second message is sent to the second device; the second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

[0006] According to a message path verification method provided by the present invention, the first path verification field includes: a pre-shared password and algorithm information; The step of determining the first path verification information of the first message based on the first path information and the first payload information includes: The first path information and the first load information are spliced ​​together to obtain the first splicing information; Using the pre-shared cipher and the algorithm information, the first path verification information of the first message is calculated from the first concatenation information.

[0007] According to a message path verification method provided by the present invention, the first path verification field further includes a type field; the type field is used to identify that the first path verification field carries the first path verification information.

[0008] Secondly, the present invention also provides a message path verification method, applied to a second device, comprising: The device receives a second message sent by a first device. The second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes second path information and a first path verification field of the second message. The first path verification field includes first path verification information. The first path verification information is determined by the first device based on the first path information and the first payload information. Based on the second path information and the first load information, determine the second path verification information; Based on the first path verification information and the second path verification information, verify whether the first path information has been tampered with.

[0009] According to a message path verification method provided by the present invention, the first path verification field further includes: a pre-shared password and algorithm information; The step of determining the second path verification information based on the second path information and the first load information includes: The second path information and the first load information are spliced ​​together to obtain the second spliced ​​information; The second concatenation information is calculated using the pre-shared password and the algorithm information to obtain the second path verification information.

[0010] According to a message path verification method provided by the present invention, the step of verifying whether the first path information has been tampered with based on the first path verification information and the second path verification information includes: Determine whether the first path verification information and the second path verification information are the same; If the first path verification information and the second path verification information are different, it is verified that the first path information has been tampered with. If the first path verification information and the second path verification information are the same, the first path information has been verified to have not been tampered with.

[0011] According to a message path verification method provided by the present invention, the first path verification field further includes a type field; the type field is used to identify that the first path verification field carries the first path verification information.

[0012] Thirdly, the present invention also provides a message path verification device, applied to a first device, comprising: The acquisition module is used to acquire a first message, the first message including first payload information and a first segmented routing extension header, the first segmented routing extension header including first path information of the first message and a first path verification field of the first message; The first determining module is used to determine the first path verification information of the first message based on the first path information and the first payload information. An encapsulation module is used to encapsulate the first path verification information into the first path verification field to obtain a second message; The sending module is used to send the second message to the second device; the second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

[0013] Fourthly, the present invention also provides a message path verification device, applied to a second device, comprising: The receiving module is configured to receive a second message sent by a first device. The second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes second path information and a first path verification field of the second message. The first path verification field includes first path verification information. The first path verification information is determined by the first device based on the first path information and the first payload information. The second determining module is used to determine the second path verification information based on the second path information and the first load information; The verification module is used to verify whether the first path information has been tampered with based on the first path verification information and the second path verification information.

[0014] Fifthly, the present invention also provides a first device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the message path verification method as described in any of the first aspects above.

[0015] In a sixth aspect, the present invention also provides a second device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the message path verification method as described in any of the second aspects above.

[0016] In a seventh aspect, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the message path verification method as described in any of the first aspects above, or implements the message path verification method as described in any of the second aspects above.

[0017] Eighthly, the present invention also provides a computer program product, comprising a computer program that, when executed by a processor, implements the message path verification method as described in any of the first aspects above, or implements the message path verification method as described in any of the second aspects above.

[0018] The present invention provides a message path verification method, apparatus, electronic device, and storage medium. A first device acquires a first message, the first message including first payload information and a first segmented routing extension header. The first segmented routing extension header includes first path information and a first path verification field of the first message. Based on the first path information and the first payload information, first path verification information of the first message is determined. The first path verification information is encapsulated into the first path verification field to obtain a second message. The second message is sent to a second device. The second message is used by the second device to verify whether the first path information has been tampered with, based on the first payload information and the first path verification information. By encapsulating the first path verification information in the first path verification field included in the first segmented routing extension header, and by determining the first path verification information based on the first path information and the first payload information, the second device can verify whether the first path information has been tampered with, thereby achieving path tampering detection of messages in SRv6 scenarios and improving the accuracy of verification. Attached Figure Description

[0019] To more clearly illustrate the technical solutions in this invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0020] Figure 1 This is a schematic diagram of the SRH extension header format provided by existing technology.

[0021] Figure 2 This is a schematic diagram of the HMAC TLV format provided by existing technology.

[0022] Figure 3 This is a diagram illustrating attack scenarios provided by existing technologies.

[0023] Figure 4 This is one of the flowcharts illustrating the message path verification method provided by the present invention.

[0024] Figure 5 This is a schematic diagram of the message format provided by the present invention.

[0025] Figure 6 This is the second flowchart of the message path verification method provided by the present invention.

[0026] Figure 7 This is the third flowchart of the message path verification method provided by the present invention.

[0027] Figure 8 This is one of the structural schematic diagrams of the message path verification device provided by the present invention.

[0028] Figure 9 This is the second schematic diagram of the message path verification device provided by the present invention.

[0029] Figure 10 This is a schematic diagram of the structure of the first device provided by the present invention. Detailed Implementation

[0030] To make the objectives, technical solutions, and advantages of this invention clearer, the technical solutions of this invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this invention. All other embodiments obtained by those skilled in the art based on the embodiments of this invention without creative effort are within the scope of protection of this invention.

[0031] To better understand the various embodiments of this application, the relevant background technology will be introduced first.

[0032] SRv6 technology enables the planning of message transmission paths by adding an SRH extension header to IPv6. Figure 1 This is a schematic diagram of the SRH extension header format provided by existing technology, such as... Figure 1 As shown, the Segment List field of the SRH header carries the segment identifiers (SIDs) of the nodes that the message needs to pass through in sequence. The SRH extension header introduces new security issues. The path information contained in the SegmentList can be illegally tampered with, such as skipping intermediate hops, adding intermediate hops, or changing their order, thereby altering the message transmission path.

[0033] In related technologies, HMAC is used to verify messages to determine whether the message transmission path has been tampered with. HMACTLV, as an optional component, provides verification of specific fields in SRv6 messages. Figure 2 This is a schematic diagram of the HMAC TLV format provided by existing technology, such as... Figure 2 As shown, the HMAC Key ID field represents the pre-shared key and algorithm required for HMAC, and the HMAC field is used to carry a data digest of specified fields in the IPv6 header and the SRH extension header. RFC8754 defines the specified fields as including the source address field in the IPv6 header, the LastEntry field, Flags field, Segment List field, the last 16 bits of the HMAC TLV Length field, and the HMAC Key ID field in the SRH.

[0034] The HMAC verification process is as follows: The source node calculates the specified field of the message based on the HMAC key and algorithm, and writes the result into the HMAC field of the message. The destination node calculates the same field using the same key and algorithm, and compares the result with the value of the message's HMAC field. If they match, it means the message has not been tampered with and passes the verification; if the HMAC verification fails, the received SRv6 message is discarded.

[0035] Figure 3 This is a diagram illustrating attack scenarios provided by existing technologies, such as... Figure 3 As shown, there are two different SRv6 paths between nodes R1 and R5. Traffic 1 is transmitted via path 1 (R1, R2, R3, R4, R5), and traffic 2 is transmitted via path 2 (R1, R2, R4, R5). Both packets carry HMAC checksum information. For simplicity, Figure 3 Only some key fields of the SRv6 message are marked.

[0036] An attacker can manipulate packets to make traffic 1 travel through path 2. The process includes the following steps 1-5.

[0037] 1. The attacker intercepted the packet of traffic 2 and parsed out the SRH and HMAC TLV fields.

[0038] 2. The attacker modifies the SRH extension header of the traffic 1 packet, that is, copies the Segment List and other fields in the traffic 2 packet to the corresponding fields in the traffic 1 packet.

[0039] 3. The attacker modifies the HMAC TLV field of the traffic 1 packet, that is, copies the HMAC TLV field in the traffic 2 packet to the corresponding field in the traffic 1 packet.

[0040] 4. The modified traffic 1 packet continues to be transmitted. According to the modified Segment List, the packet will be transmitted along path 2.

[0041] 5. Node R5 receives the modified packet and performs HMAC verification. It extracts fields such as Segment List and HMAC Key ID for HMAC calculation. Since the fields involved in HMAC verification have been replaced with the values ​​of the legitimate packet from traffic 2, the calculation result will be equal to the HMAC value of traffic 2, which is the same as the HMAC field of the tampered packet. Therefore, it passes HMAC verification, and the tampering cannot be detected.

[0042] The following is combined with Figures 4-7 The message path verification method of the present invention is described.

[0043] Figure 4 This is one of the flowcharts illustrating the message path verification method provided by the present invention, such as... Figure 4 As shown, when applied to a first device, the method includes the following steps 401-404.

[0044] Step 401: Obtain the first message, which includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes first path information of the first message and a first path verification field of the first message.

[0045] It should be noted that the message path verification method provided by this invention can be applied to message path verification scenarios in SRv6 environments. The executing entity of this method can be a message path verification device, such as an electronic device, a first device, a second device, or a control module in the message path verification device for executing the message path verification method. The first device is a source node in the communication network, which can be a terminal or a network-side device. The second device is a destination node in the communication network, which can be a terminal or a network-side device.

[0046] Specifically, the first device acquires the first packet, such as a traffic packet. The first packet includes first payload information and a first segment routing header, which includes first path information (Segment List) and a first path verification field (Path TLV).

[0047] The first message may also include an IPv6 header. The first segment routing extension header may also include a Next Header, extension header length (Hdr Ext Len), routing header type, number of remaining segments (Segments Left), last entry, packet flags, and tag. The Next Header indicates the type of the header immediately following the SRH. Hdr Ext Len indicates the length of the SRH, mainly the length occupied from Segment List [0] to Segment List [n]. Routing Type indicates the routing header type; SRH Type is 4. Segments Left indicates the number of intermediate nodes that should still be visited before reaching the destination node. Last Entry indicates the index of the last element of the segment list in the segment list.

[0048] Optionally, the first message may also include an HMAC checksum field (HMAC TLV), the specific format of which is as follows: Figure 2 As shown, this will not be elaborated further to avoid repetition. HMAC TLV is used for HMAC verification. In one possible implementation, after receiving the packet, the second device first performs HMAC verification. If it passes, it then uses the Path TLV field included in the segmented routing extension header to further verify whether the packet path has been tampered with. This can detect path tampering methods that modify both path information and HMAC verification information simultaneously, and it does not change the SRv6 HMAC verification method, thus having compatibility.

[0049] Step 402: Based on the first path information and the first payload information, determine the first path verification information of the first message.

[0050] Specifically, based on the first path information and the first payload information, the first path verification information of the first message can be determined.

[0051] Step 403: Encapsulate the first path verification information into the first path verification field to obtain the second message.

[0052] Specifically, the second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes first path information of the first message and a first path verification field of the first message. The first path verification field includes first path verification information.

[0053] Step 404: Send the second message to the second device; the second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

[0054] Specifically, the first path verification information is encapsulated into a Path TLV field to obtain a second message, which is then sent to a second device. The second device receives the second message sent by the first device. This second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes first path information and a first path verification field, with the first path verification field containing first path verification information. Based on the first path information, first payload information, and first path verification information, the second device verifies whether the first path information has been tampered with.

[0055] The message path verification method provided by this invention involves obtaining a first message, which includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes first path information and a first path verification field of the first message. Based on the first path information and the first payload information, first path verification information of the first message is determined. The first path verification information is encapsulated into the first path verification field to obtain a second message. The second message is sent to a second device. The second message is used by the second device to verify whether the first path information has been tampered with, based on the first payload information and the first path verification information. By encapsulating the first path verification information in the first path verification field included in the first segmented routing extension header, and by determining the first path verification information based on the first path information and the first payload information, the second device can verify whether the first path information has been tampered with, thereby achieving path tampering detection of messages in SRv6 scenarios and improving the accuracy of verification.

[0056] Optionally, the first path verification field includes: a pre-shared password and algorithm information; the specific implementation of step 402 above includes: The first path information and the first payload information are concatenated to obtain the first concatenated information; the first path verification information is calculated using the pre-shared password and the algorithm information.

[0057] Specifically, the first path verification field (Path TLV) includes: pre-shared password and algorithm information. This pre-shared password and algorithm information is encapsulated within the HMAC Key ID field of the first path verification field (Path TLV). The HMAC Key ID field is 4 bytes long and uniquely identifies the pre-shared HMAC key and algorithm information. The algorithm information can be the HMAC algorithm, and can reuse the hash algorithm and key from the HMAC verification (i.e., HMAC TLV), or it can use other algorithms and keys.

[0058] Optionally, the first path verification field further includes a type field; the type field is used to identify that the first path verification field carries the first path verification information.

[0059] The first path checksum field (Path TLV) may also include a length field, a reserve field, and a path HMAC field. The length field identifies the length of the variable-length data in bytes. The reserve field is 16 bits and is set to 0. The path HMAC field stores the path checksum value, which is a data digest of the SegmentList and payload fields, expressed in multiples of 8 octets, up to a maximum of 32 octets. Figure 5 This is a schematic diagram of the message format provided by the present invention.

[0060] By concatenating the first path information and the first payload information, the first concatenation information (SegmentList||payload) can be obtained; using pre-shared cipher K and algorithm information, such as pre-shared cipher K and HMAC algorithm, the first concatenation information (SegmentList||payload) can be obtained. The first path verification information is calculated from the first concatenation information and stored in the Path HMAC field of the first path verification field.

[0061] Figure 6 This is the second flowchart of the message path verification method provided by the present invention, as shown below. Figure 6 As shown, the method is applied to the second device and includes steps 601-603.

[0062] Step 601: Receive a second message sent by the first device. The second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes second path information and a first path verification field of the second message. The first path verification field includes first path verification information. The first path verification information is determined by the first device based on the first path information and the first payload information.

[0063] Specifically, the second device receives a second message sent by the first device. The second message includes first payload information and a first segment routing header. The first segment routing header includes second path information (Segment List) and a first path check field (PathTLV). The first path check field (Path TLV) includes first path check information. The first path information is encapsulated in the Path HMAC field of the first path check field (Path TLV). The first path check information is determined by the first device based on the first path information and the first payload information. That is, the first path check information is determined by the first device before sending the second message, based on the first path information and the first payload information in the first message.

[0064] The second message may also include an IPv6 header. The first segment routing extension header may also include a Next Header, extension header length (Hdr Ext Len), routing header type (Routing Type), number of remaining segments (Segments Left), last entry (Last Entry), packet identifiers (Flags), and group packet identifiers (Tags). The Next Header indicates the type of the header immediately following the SRH. Hdr Ext Len indicates the length of the SRH, mainly referring to the length occupied from Segment List [0] to Segment List [n]. Routing Type indicates the routing header type; SRH Type is 4. Segments Left indicates the number of intermediate nodes that should still be visited before reaching the destination node. Last Entry indicates the index of the last element of the segment list in the segment list.

[0065] Optionally, the second message may also include an HMAC checksum field (HMAC TLV), the specific format of which is as follows: Figure 2 As shown, this will not be elaborated further to avoid repetition. HMAC TLV is used for HMAC verification. In one possible implementation, after receiving the second packet, the second device first performs an HMAC verification. If successful, it then uses the first path verification field (Path TLV) included in the first segmented routing extension header to further verify whether the packet path has been tampered with. This can simultaneously detect path tampering methods that modify both path information and HMAC verification information, without changing the SRv6 HMAC verification method, thus ensuring compatibility.

[0066] Step 602: Determine the second path verification information based on the second path information and the first load information.

[0067] Specifically, based on the second path information (Segment List) and the first payload information, the second path verification information can be determined.

[0068] Step 603: Based on the first path verification information and the second path verification information, verify whether the first path information has been tampered with.

[0069] Specifically, based on the first path verification information and the second path verification information, it is possible to verify whether the first path information has been tampered with.

[0070] The message path verification method provided by this invention involves receiving a second message sent by a first device. The second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes second path information and a first path verification field. The first path verification field includes the first path verification information. The first path verification information is determined by the first device based on the first path information and the first payload information. Second path verification information is determined based on the second path information and the first payload information. Finally, based on the first path verification information and the second path verification information, the method verifies whether the first path information has been tampered with. By using the first path verification information and the second path verification information in the received second message, and since the first path verification information is determined by the first device based on the first path information and the first payload information, the second device can verify whether the first path information has been tampered with. This achieves path tampering detection of messages in SRv6 scenarios, improving the accuracy of the verification.

[0071] Optionally, the first path verification field further includes: a pre-shared password and algorithm information; the specific implementation of step 602 above includes: The second path information and the first payload information are concatenated to obtain the second concatenated information; the second concatenated information is calculated using the pre-shared cipher and the algorithm information to obtain the second path verification information.

[0072] Specifically, the first path verification field (Path TLV) includes: pre-shared password and algorithm information. This pre-shared password and algorithm information is encapsulated within the HMAC Key ID field of the first path verification field (Path TLV). The HMAC Key ID field is 4 bytes long and uniquely identifies the pre-shared HMAC key and algorithm information. The algorithm information can be the HMAC algorithm, and can reuse the hash algorithm and key from the HMAC verification (i.e., HMAC TLV), or it can use other algorithms and keys.

[0073] Optionally, the first path verification field further includes a type field; the type field is used to identify that the path verification field carries the first path verification information.

[0074] The first path check field (Path TLV) may also include a length field, a reserve field, and a path HMAC field. The length field identifies the length of the variable-length data in bytes. The reserve field is 16 bits and is set to 0. The path HMAC field stores the path check value, which is a data digest of the Segment List and payload fields, expressed in multiples of 8 octets, up to a maximum of 32 octets. The message format provided by this invention is as follows: Figure 5 As shown.

[0075] By concatenating the second path information and the first payload information, the second concatenation information (SegmentList||payload) can be obtained; using pre-shared cipher K and algorithm information, such as pre-shared cipher K and HMAC algorithm, the second concatenation information is obtained. The second path verification information is obtained by calculating the second splicing information.

[0076] Optionally, the specific implementation of step 603 above includes: Determine whether the first path verification information and the second path verification information are the same; if the first path verification information and the second path verification information are different, verify that the first path information has been tampered with; if the first path verification information and the second path verification information are the same, verify that the first path information has not been tampered with.

[0077] Specifically, it is determined whether the first path verification information and the second path verification information are the same; if the first path verification information and the second path verification information are different, it indicates that the first path information has been tampered with, that is, the second path information received by the second device is the tampered path information; if the first path verification information and the second path verification information are the same, it indicates that the first path information has not been tampered with.

[0078] Figure 7 This is the third flowchart of the message path verification method provided by the present invention, as shown below. Figure 7 As shown, the method includes steps 701-712.

[0079] Step 701: The first device obtains the first message, which includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes first path information and a first path verification field. The first path verification field includes: pre-shared password and algorithm information.

[0080] Step 702: The first device determines the first path verification information based on the first path information and the first load information, using pre-shared password and algorithm information.

[0081] Step 703: The first device encapsulates the first path verification information into the first path verification field, and encapsulates the pre-shared password and algorithm information that determine the first path verification information into the first path verification field to obtain the second message.

[0082] Step 704: The first device sends the second message to the second device; the second message includes first payload information, a first segmented routing extension header and an HMAC verification field. The first segmented routing extension header includes second path information and a first path verification field. The first path verification field includes first path verification information and pre-shared cipher and algorithm information for determining the first path verification information; the first path verification information is determined by the first device based on the first path information and the first payload information.

[0083] Step 705: The second device performs HMAC verification based on the HMAC verification field and determines whether the HMAC verification passes. If the HMAC verification fails, proceed to step 706; if the HMAC verification passes, proceed to step 707.

[0084] Step 706: The second device discards the second message.

[0085] Step 707: The second device determines whether to enable packet path verification. This determination is based on pre-configured information, which indicates whether packet path verification is enabled. If the configuration information indicates that packet path verification is enabled, the second device enables packet path verification; if the configuration information indicates that packet path verification is not enabled, the second device determines that packet path verification is not enabled. If packet path verification is enabled, proceed to step 708; if packet path verification is not enabled, proceed to step 712.

[0086] Step 708: The second device determines the second path verification information based on the second path information and the first payload information, using pre-shared password and algorithm information.

[0087] Step 709: Determine whether the first path verification information and the second path verification information are the same. If the first path verification information and the second path verification information are different, proceed to step 710; if the first path verification information and the second path verification information are the same, proceed to step 711.

[0088] Step 710: If the first path information has been tampered with, it means that the second message has failed the verification and is therefore discarded.

[0089] Step 711: Verify that the first path information has not been tampered with, indicating that the second message verification has passed.

[0090] Step 712: Continue processing the second message and send the second message to the next device.

[0091] The method provided by this invention verifies SRv6 packets to ensure that the Segment List and payload have not been tampered with, thereby ensuring that the path information carried by the SRv6 packets has not been modified. It can detect path tampering methods that modify both path information and HMAC verification information at the same time, solving the problem that a single HMAC verification cannot identify packet tampering in scenarios where attackers modify both path information and HMAC verification information simultaneously.

[0092] The deployment of SRv6 technology in networks presents new challenges to network security. Network service providers offer varying quality network and service offerings. Since packets carry network path information, attackers can alter the transmission path by tampering with the packets. To protect network resource security, the SRv6 path tampering prevention issue must be considered and addressed during network deployment. This invention proposes a packet path verification method that addresses the inability of current HMAC verification technology to detect path tampering that simultaneously modifies both path information and HMAC verification information, thereby improving network security.

[0093] The message path verification device provided by the present invention is described below. The message path verification device described below and the message path verification method described above can be referred to in correspondence.

[0094] Figure 8 This is one of the structural schematic diagrams of the message path verification device provided by the present invention, such as... Figure 8 As shown, the message path verification device 800, applied to the first device, includes: an acquisition module 801, a first determination module 802, and a sending module 803; wherein, The acquisition module 801 is used to acquire a first message, the first message including first payload information and a first segmented routing extension header, the first segmented routing extension header including first path information of the first message and a first path verification field of the first message; The first determining module 802 is used to determine the first path verification information of the first message based on the first path information and the first payload information. The encapsulation module 803 is used to encapsulate the first path verification information into the first path verification field to obtain the second message; The sending module 804 is used to send the second message to the second device; the second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

[0095] The message path verification device provided by this invention obtains a first message, which includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes first path information and a first path verification field of the first message. Based on the first path information and the first payload information, it determines first path verification information of the first message. It then encapsulates the first path verification information into the first path verification field to obtain a second message. The second message is sent to a second device. The second message is used by the second device to verify whether the first path information has been tampered with, based on the first payload information and the first path verification information. By encapsulating the first path verification information in the first path verification field included in the first segmented routing extension header, and by ensuring that the first path verification information is determined based on the first path information and the first payload information, the second device can verify whether the first path information has been tampered with, thereby achieving path tampering detection of messages in SRv6 scenarios and improving the accuracy of the verification.

[0096] Optionally, the first path verification field includes: a pre-shared password and algorithm information; the first determining module 802 is specifically used for: The first path information and the first load information are spliced ​​together to obtain the first splicing information; Using the pre-shared cipher and the algorithm information, the first path verification information of the first message is calculated from the first concatenation information.

[0097] Optionally, the first path verification field further includes a type field; the type field is used to identify that the first path verification field carries the first path verification information.

[0098] Figure 9 This is a second schematic diagram of the message path verification device provided by the present invention, as shown below. Figure 9 As shown, the message path verification device 900, applied to the second device, includes: a receiving module 901, a second determining module 902, and a verification module 903; wherein, The receiving module 901 is configured to receive a second message sent by the first device. The second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes second path information and a first path verification field of the second message. The first path verification field includes first path verification information. The first path verification information is determined by the first device based on the first path information and the first payload information. The second determining module 902 is used to determine the second path verification information based on the second path information and the first load information; The verification module 903 is used to verify whether the first path information has been tampered with based on the first path verification information and the second path verification information.

[0099] The message path verification device provided by this invention receives a second message sent by a first device. The second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes second path information and a first path verification field of the second message. The first path verification field includes the first path verification information. The first path verification information is determined by the first device based on the first path information and the first payload information. Based on the second path information and the first payload information, second path verification information is determined. Based on the first path verification information and the second path verification information, the device verifies whether the first path information has been tampered with. By using the first path verification information and the second path verification information in the received second message, and since the first path verification information is determined by the first device based on the first path information and the first payload information, the second device can verify whether the first path information has been tampered with, thereby achieving path tampering detection of messages in SRv6 scenarios and improving the accuracy of verification.

[0100] Optionally, the first path verification field further includes: pre-shared password and algorithm information; the second determining module 902 is specifically used for: The second path information and the first load information are spliced ​​together to obtain the second spliced ​​information; The second concatenation information is calculated using the pre-shared password and the algorithm information to obtain the second path verification information.

[0101] Optionally, the verification module 903 is specifically used for: Determine whether the first path verification information and the second path verification information are the same; If the first path verification information and the second path verification information are different, it is verified that the first path information has been tampered with. If the first path verification information and the second path verification information are the same, the first path information has been verified to have not been tampered with.

[0102] Optionally, the first path verification field further includes a type field; the type field is used to identify that the first path verification field carries the first path verification information.

[0103] Figure 10 This is a schematic diagram of the physical structure of a first device provided by the present invention, as shown below. Figure 10 As shown, the electronic device 1000 may include a processor 1010, a communications interface 1020, a memory 1030, and a communication bus 1040, wherein the processor 1010, the communications interface 1020, and the memory 1030 communicate with each other through the communication bus 1040. The processor 1010 can call logical instructions in the memory 1030 to execute a message path verification method, which includes: acquiring a first message, the first message including first payload information and a first segmented routing extension header, the first segmented routing extension header including first path information and a first path verification field of the first message; determining first path verification information of the first message based on the first path information and the first payload information; encapsulating the first path verification information into the first path verification field to obtain a second message; and sending the second message to a second device; the second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

[0104] Furthermore, the logical instructions in the aforementioned memory 1030 can be implemented as software functional units and, when sold or used as independent products, can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0105] Optionally, the present invention also provides a second device, which may include: a processor, a communications interface, a memory, and a communication bus, wherein the processor, the communications interface, and the memory communicate with each other through the communication bus. The processor may invoke logical instructions in the memory to execute a message path verification method, the method comprising: receiving a second message sent by a first device, the second message including first payload information and a first segmented routing extension header, the first segmented routing extension header including second path information and a first path verification field of the second message, the first path verification field including first path verification information; the first path verification information being determined by the first device based on the first path information and the first payload information; determining second path verification information based on the second path information and the first payload information; and verifying whether the first path information has been tampered with based on the first path verification information and the second path verification information.

[0106] On the other hand, the present invention also provides a computer program product, the computer program product including a computer program, which can be stored on a non-transitory computer-readable storage medium. When the computer program is executed by a processor, the computer can execute the message path verification method provided by the above methods. The method includes: obtaining a first message, the first message including first payload information and a first segmented routing extension header, the first segmented routing extension header including first path information of the first message and a first path verification field of the first message; determining first path verification information of the first message based on the first path information and the first payload information; encapsulating the first path verification information into the first path verification field to obtain a second message; sending the second message to a second device; the second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

[0107] Optionally, when the computer program is executed by the processor, the computer can execute the message path verification method provided by the above methods. The method includes: receiving a second message sent by a first device, the second message including first payload information and a first segmented routing extension header, the first segmented routing extension header including second path information and a first path verification field of the second message, the first path verification field including first path verification information; the first path verification information being determined by the first device based on the first path information and the first payload information; determining second path verification information based on the second path information and the first payload information; and verifying whether the first path information has been tampered with based on the first path verification information and the second path verification information.

[0108] In another aspect, the present invention also provides a non-transitory computer-readable storage medium storing a computer program thereon. When executed by a processor, the computer program implements the message path verification method provided by the above methods. The method includes: acquiring a first message, the first message including first payload information and a first segmented routing extension header, the first segmented routing extension header including first path information of the first message and a first path verification field of the first message; determining first path verification information of the first message based on the first path information and the first payload information; encapsulating the first path verification information into the first path verification field to obtain a second message; and sending the second message to a second device. The second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

[0109] Optionally, when the computer program is executed by a processor, it implements the message path verification method provided by the above methods. The method includes: receiving a second message sent by a first device, the second message including first payload information and a first segmented routing extension header, the first segmented routing extension header including second path information of the second message and a first path verification field, the first path verification field including first path verification information; the first path verification information being determined by the first device based on the first path information and the first payload information; determining second path verification information based on the second path information and the first payload information; and verifying whether the first path information has been tampered with based on the first path verification information and the second path verification information.

[0110] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs. Those skilled in the art can understand and implement this without any creative effort.

[0111] Through the above description of the embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus necessary general-purpose hardware platforms, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solutions, in essence or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, magnetic disk, optical disk, etc., and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute the methods described in the various embodiments or some parts of the embodiments.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A message path verification method, characterized in that, Applied to the first device, including: Obtain a first message, the first message including first payload information and a first segmented routing extension header, the first segmented routing extension header including first path information of the first message and a first path verification field of the first message; Based on the first path information and the first payload information, the first path verification information of the first message is determined; The first path verification information is encapsulated into the first path verification field to obtain the second message; The second message is sent to the second device; the second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

2. The message path verification method according to claim 1, characterized in that, The first path verification field includes: pre-shared password and algorithm information; The step of determining the first path verification information of the first message based on the first path information and the first payload information includes: The first path information and the first load information are spliced ​​together to obtain the first splicing information; Using the pre-shared cipher and the algorithm information, the first path verification information of the first message is calculated from the first concatenation information.

3. The message path verification method according to claim 1 or 2, characterized in that, The first path verification field further includes a type field; the type field is used to identify that the first path verification field carries the first path verification information.

4. A message path verification method, characterized in that, Applied to a second device, including: The device receives a second message sent by a first device. The second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes second path information and a first path verification field of the second message. The first path verification field includes first path verification information. The first path verification information is determined by the first device based on the first path information and the first payload information. Based on the second path information and the first load information, determine the second path verification information; Based on the first path verification information and the second path verification information, verify whether the first path information has been tampered with.

5. The message path verification method according to claim 4, characterized in that, The first path verification field also includes: pre-shared password and algorithm information; The step of determining the second path verification information based on the second path information and the first load information includes: The second path information and the first load information are spliced ​​together to obtain the second spliced ​​information; The second concatenation information is calculated using the pre-shared password and the algorithm information to obtain the second path verification information.

6. The message path verification method according to claim 4, characterized in that, The step of verifying whether the first path information has been tampered with based on the first path verification information and the second path verification information includes: Determine whether the first path verification information and the second path verification information are the same; If the first path verification information and the second path verification information are different, it is verified that the first path information has been tampered with. If the first path verification information and the second path verification information are the same, the first path information has been verified to have not been tampered with.

7. The message path verification method according to any one of claims 4 to 6, characterized in that, The first path verification field further includes a type field; the type field is used to identify that the first path verification field carries the first path verification information.

8. A message path verification device, characterized in that, Applied to the first device, including: The acquisition module is used to acquire a first message, the first message including first payload information and a first segmented routing extension header, the first segmented routing extension header including first path information of the first message and a first path verification field of the first message; The first determining module is used to determine the first path verification information of the first message based on the first path information and the first payload information. An encapsulation module is used to encapsulate the first path verification information into the first path verification field to obtain a second message; The sending module is used to send the second message to the second device; the second message is used by the second device to verify whether the first path information has been tampered with based on the first payload information and the first path verification information.

9. A message path verification device, characterized in that, Applied to a second device, including: The receiving module is configured to receive a second message sent by a first device. The second message includes first payload information and a first segmented routing extension header. The first segmented routing extension header includes second path information and a first path verification field of the second message. The first path verification field includes first path verification information. The first path verification information is determined by the first device based on the first path information and the first payload information. The second determining module is used to determine the second path verification information based on the second path information and the first load information; The verification module is used to verify whether the first path information has been tampered with based on the first path verification information and the second path verification information.

10. A first device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the message path verification method as described in any one of claims 1 to 3.

11. A second device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the message path verification method as described in any one of claims 4 to 7.

12. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by the processor, it implements the message path verification method as described in any one of claims 1 to 3, or the message path verification method as described in any one of claims 4 to 7.

13. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements the message path verification method as described in any one of claims 1 to 3, or the message path verification method as described in any one of claims 4 to 7.

Images