SRv6-based network cloud authentication method, storage medium and device

Abstract

The invention belongs to the technical field of network cloud authentication, and relates to an SRv6-based network cloud authentication method, storage medium and device, and the method comprises the steps that a network client sends an SRv6-based network authentication request message to a network management cloud through a basic network; after receiving the SRv6-based network authentication request message, the network management cloud replies an SRv6 path packet to the network client initiating the request message; after receiving the SRv6 path packet, the network client processes the identity authentication information and sends the processed identity authentication information to the network service cloud; the network service cloud authenticates the identity authentication information, if the authentication succeeds, the network client accesses the network service cloud, and if the authentication fails, the network client does not access the network service cloud; according to the method provided by the invention, the identity authentication information of the network client is divided into a plurality of parts and is sent to the network service cloud through a plurality of paths, so that the sub-identity authentication information is forwarded according to different paths, and line repetition is effectively avoided.

Description

TECHNICAL FIELD

[0001] The application belongs to the technical field of network cloud authentication, and particularly relates to a network cloud authentication method based on SRv6, a storage medium and an apparatus. BACKGROUND

[0002] SLA (Service Level Agreement) is a formal requirement between network providers and users, which clearly stipulates the quality standards and performance indicators of services. The core purpose is to ensure the predictability and reliability of service delivery.

[0003] SRv6, namely Segment Routing over IPv6, is a new generation of IP bearing protocol. It combines segment routing with IPv6, realizes segment routing by adding an extension header to the IPv6 packet header, can simplify the network, reduce operation and maintenance cost, provide flexible traffic control and path programming capability, and meet diversified business needs.

[0004] The network cloud system is a cloud computing architecture mode integrating network resources, computing resources and storage resources. It realizes dynamic allocation, management and scheduling of resources through network connection, emphasizes resource sharing and cooperation, and enables different devices, applications and services to efficiently interconnect. It has elastic scaling capability, can quickly respond to changes in business needs, provides stable and reliable network connection, and supports centralized management and monitoring, which helps to improve security and reduce operation and maintenance cost. The network cloud system integrates a large amount of data and applications, and the user group is diverse. Different types of user identity authentication are transmitted in a single network path, which is easy to cause identity authentication information leakage and tampering and misuse. SUMMARY

[0005] To solve the above problems existing in the prior art, the application provides a network cloud authentication method based on SRv6, which comprises the following steps: constructing a network architecture, the network architecture comprising a basic network, a network management cloud, a network service cloud and a network client; wherein the network management cloud, the network service cloud and the network client are interconnected through the basic network; and the network client authenticates the network service cloud by comprising the following steps:

[0006] S101, the network client sends a network authentication request message based on SRv6 to the network management cloud through the basic network;

[0007] S102, after receiving the network authentication request message based on SRv6, the network management cloud replies an SRv6 path packet to the network client initiating the request message;

[0008] S103, after receiving the SRv6 path packet, the network client processes the identity authentication information and sends the processed identity authentication information to the network service cloud;

[0009] In S104, the network service cloud authenticates the identity authentication information, if the authentication is successful, the network client accesses the network service cloud, if the authentication fails, the network client does not access the network service cloud.

[0010] The basic network includes information communication networks of various systems such as switching devices, transmission devices, terminals, etc., which provides an interconnected network environment for the network management cloud, the network service cloud, and the network client, and supports the SRv6 technology of the new generation of communication technology.

[0011] The network management cloud adopts a micro-service technology and a cloud-deployed network management system, and the network management cloud perceives and collects the network topology and the network state of the basic network, and forms the operation situation of the basic network through analysis and processing. The network management cloud has an SRv6 planning capability, and when the network management cloud issues an SRv6 path to an application system such as a network client, the SID information of the basic network device is updated at the same time, thereby providing support for the SRv6 identity authentication function of the network client.

[0012] The network service cloud adopts a micro-service technology and a cloud-deployed network service system, which provides information acquisition, information processing, and calculation sharing services for the network client and other network service clouds. The network client needs to perform identity authentication when obtaining the network service cloud service, and the network service cloud adopts an SRv6 technology for authentication.

[0013] The network client is the initiating end of the business, and mainly communicates with the network management cloud and the network service cloud to obtain identity authentication and service functions.

[0014] To achieve the above purpose, the application further provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to implement any of the above SRv6-based network cloud authentication methods.

[0015] To achieve the above purpose, the application further provides an SRv6-based network cloud authentication device, which includes a processor and a memory. The memory is used to store a computer program, and the processor is connected with the memory and used to execute the computer program stored in the memory, so that the SRv6-based network cloud authentication device executes any of the above SRv6-based network cloud authentication methods.

[0016] The application has the following beneficial effects:

[0017] The method of the present application realizes the forwarding of sub-identity authentication information according to different paths, effectively avoids line duplication, and information stealing, and a fake cannot penetrate through single-node attacks to realize information acquisition and fraud, solves the problem of single-path sending of identity authentication information leakage, and effectively improves the security of identity authentication of the network cloud system. BRIEF DESCRIPTION OF DRAWINGS

[0018] In order to more clearly illustrate the technical solutions of the present application, the following will briefly introduce the drawings needed to be used in the description of the present application. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0019] Figure 1 is a scene diagram of a network cloud authentication method based on SRv6 provided by some embodiments of the present application;

[0020] Figure 2 is a data flow forwarding diagram of a network cloud authentication method based on SRv6 provided by some embodiments of the present application;

[0021] Figure 3 is an authentication flowchart of a network client obtaining services from a network service cloud provided by some embodiments of the present application;

[0022] Figure 4 is a flowchart of a network management cloud generating an SRv6 path packet provided by some embodiments of the present application;

[0023] Figure 5 is a processing flowchart of a network service cloud receiving identity authentication information provided by some embodiments of the present application. DETAILED DESCRIPTION

[0024] The technical solutions in the embodiments of the present application will be described clearly and completely in the following with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only some embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0025] A network cloud authentication method based on SRv6, the method comprising: constructing a network architecture, the network architecture comprising a basic network, a network management cloud, a network service cloud and a network client; wherein the network management cloud, the network service cloud and the network client are interconnected through the basic network; the network client authenticates the network service cloud, comprising:

[0026] S101, the network client sends an SRv6-based network authentication request message to the network management cloud through the basic network;

[0027] S102, after receiving the SRv6-based network authentication request message, the network management cloud replies to the network client initiating the request message with an SRv6 path packet;

[0028] S103, after receiving the SRv6 path packet, the network client processes the identity authentication information and sends the processed identity authentication information to the network service cloud;

[0029] S104, the network service cloud authenticates the identity authentication information, if the authentication is successful, the network client accesses the network service cloud, if the authentication fails, the network client does not access the network service cloud.

[0030] As Figure 1 is a scenario diagram of an SRv6-based network cloud authentication method provided by some embodiments of the application. Specifically, the diagram includes a basic network, a network management cloud, a network service cloud, and a network client, and they are interconnected. The basic network includes routers R1, R2, R3, R4, and R5, which are connected to each other by dashed lines, and the dashed lines represent that there may be other devices in between.

[0031] As Figure 2 is an authentication path diagram for the network client to obtain services from the network service cloud. Specifically, the network client initiates two path sub-identity authentication information data packets to the network service cloud, one of which reaches the network service cloud from the network client through the order of R1-R3-R5, and the other reaches the network service cloud from the network client through the order of R1-R4-R5, and the two paths store two different sub-identity authentication information. In this link, if the identity information is stolen at R3 or R4, it will be invalid because the complete identity information cannot be obtained.

[0032] As Figure 3 is an authentication step diagram for the network client to obtain services from the network service cloud. Specifically as follows:

[0033] S101, the network client sends an SRv6-based network authentication request message to the network management cloud, and the request message includes the IP address of the network service cloud, the service name of the network service cloud, the expected number of SRv6 paths, and the policy name. For example, the IP address of the network client is 8.1.1.8, the IP address of the network service cloud is 8.1.8.9, the service name of the network service cloud is ChartServer, the expected number of SRv6 paths is 3, and the policy name is shortest path first;

[0034] S102. The network management cloud receives a network authentication request message based on SRv6 and replies with an SRv6 path packet to the network client that initiated the request message. The SRv6 path packet contains three SRv6 path information from the network client to the network service cloud.

[0035] S103. The network client receives the SRv6 path packet. The network client divides the identity authentication information into 3 sub-identity authentication information according to the SRv6 path packet. The sub-identity authentication information is given a unique sequence number (1,2,3), a total packet count identifier of 3 and a timestamp, and is sent to the network service cloud according to the 3 SRv6 paths respectively.

[0036] S104. After receiving the authentication information sent by the network client, the network service cloud will start authentication after receiving all three sub-identity authentication messages sent by the network client in one authentication process. If no complete messages are received, the authentication will be deemed to have failed.

[0037] The SRv6 path information and sub-identity authentication information are mentioned; the policy names include shortest path, low latency, high bandwidth, and load balancing. The shortest path SRv6 path selection scheme prioritizes shorter paths, the low latency SRv6 path selection scheme prioritizes lower transmission latency, and the high bandwidth SRv6 path selection scheme prioritizes higher transmission bandwidth.

[0038] like Figure 4 This is a flowchart illustrating the steps involved in generating SRv6 path packets in a network management cloud, as provided in some embodiments of the present invention. Specifically:

[0039] S201. The network management cloud receives a network authentication request message based on SRv6, identifies the IP address of the request message sender, the IP address of the network service cloud, the service name of the network service cloud, the expected number of SRv6 paths, and the policy name. The IP address of the request message is used as the source node, and the IP address of the network service cloud is used as the destination node. For example, the IP address of the request message is 8.1.1.8, the IP address of the network service cloud is 8.1.8.9, the service name of the network service cloud is ChartServer, the expected number of SRv6 paths is 3, and the policy name is Shortest Path First.

[0040] S202. The network management cloud senses, parses, and generates the topology of the basic network, extracts constraints such as link weights and node resources, and generates and sorts all paths from the source node to the destination node by calling the corresponding policy according to the policy name.

[0041] S203. Conduct path screening, filter paths according to SLA requirements such as bandwidth and latency, retain paths that meet the conditions, and retain 3 paths to form SRv6 path packets.

[0042] S204. Reply with an SRv6 path packet to the network client that initiated the request message.

[0043] like Figure 5 This is a diagram illustrating the processing steps for receiving identity authentication information in a network service cloud, as provided in some embodiments of the present invention. Specifically:

[0044] S301. After receiving the sub-identity authentication information data packet from the network client, the network service cloud starts a global timer. If the global timer expires and all sub-identity authentication information data packets for this authentication have not been received, it is determined that there is packet loss in this authentication.

[0045] S302. The network service cloud establishes a buffer and stores sub-packets according to their sequence numbers. If a sub-packet with a sequence number other than the currently expected sequence number is received, the sub-packet is temporarily stored and the cloud waits for subsequent sub-packets. At the same time, the missing sequence number is recorded. For example, when the network client sends three sub-authentication information with sequence numbers 1, 2, and 3, but the network service cloud receives the sequence number 2 but has not yet received the sequence number 1, the data of sequence number 1 is recorded as a missing sequence number, and the data of sequence number 2 is stored.

[0046] S303. When a missing sequence number exists, start a timer. If a sub-packet with a certain sequence number is not received within the timeout period, it is determined that there is a packet loss in this authentication. For example, when the data of sequence number 1 is missing, start a timer. If the data of sequence number 1 is not received within the timeout period, it is determined that there is a packet loss in the authentication.

[0047] S304. If any packet is lost during this authentication process, the authentication is deemed to have failed, all received sub-packets are discarded, and the process is terminated.

[0048] S305. If all sub-packets are received completely, they are concatenated into complete authentication information and the process proceeds to the next verification step.

[0049] In one embodiment of the present invention, the present invention further includes a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements any of the above-described SRv6-based cloud authentication methods.

[0050] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented using computer program-related hardware. The aforementioned computer program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0051] An SRv6-based cloud-based authentication device includes a processor and a memory; the memory is used to store computer programs; the processor is connected to the memory and is used to execute the computer programs stored in the memory, so that the SRv6-based cloud-based authentication device performs any of the above-described SRv6-based cloud-based authentication methods.

[0052] Specifically, the memory includes various media capable of storing program code, such as ROM, RAM, magnetic disk, USB flash drive, memory card, or optical disk.

[0053] Preferably, the processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0054] The above-described embodiments further illustrate the purpose, technical solution, and advantages of the present invention. It should be understood that the above-described embodiments are merely preferred embodiments of the present invention and are not intended to limit the present invention. Any modifications, equivalent substitutions, improvements, etc., made to the present invention within the spirit and principles of the present invention should be included within the protection scope of the present invention.

Claims

1. A cloud-based authentication method for web applications based on SRv6, characterized in that, include: Construct a network architecture that includes a basic network, a network management cloud, a network service cloud, and network clients; This involves enabling interconnection between the network management cloud, network service cloud, and network clients through a basic network. The authentication process between a network client and the network service cloud includes: S101. The network client sends a network authentication request message based on SRv6 to the network management cloud through the basic network. S102. After receiving the SRv6-based network authentication request message, the network management cloud replies with an SRv6 path packet to the network client that initiated the request message. S103. After receiving the SRv6 path packet, the network client processes the authentication information and sends the processed authentication information to the network service cloud. S104. The network service cloud authenticates the identity authentication information. If the authentication is successful, the network client accesses the network service cloud. If the authentication fails, the network client does not access the network service cloud.

2. The cloud-based authentication method based on SRv6 according to claim 1, characterized in that, The SRv6-based network authentication request message includes: the IP address of the network service cloud, the service name of the network service cloud, the expected number of SRv6 paths, and the policy name.

3. The cloud-based authentication method based on SRv6 according to claim 2, characterized in that, The strategy names include Shortest Path, Low Latency, and High Bandwidth. The shortest path SRv6 path selection scheme prioritizes the shortest path, the low latency SRv6 path selection scheme prioritizes the lowest transmission latency, and the high bandwidth SRv6 path selection scheme prioritizes the highest transmission bandwidth.

4. The cloud-based authentication method based on SRv6 according to claim 1, characterized in that, The network management cloud generates the SRv6 path package, which includes: Step 1: The network management cloud receives a network authentication request message based on SRv6, identifies the IP address of the request message sender, the IP address of the network service cloud, the service name of the network service cloud, the expected number of SRv6 paths, and the policy name. The IP address of the request message is used as the source node, and the IP address of the network service cloud is used as the destination node. Step 2: The network management cloud senses, parses, and generates the topology of the basic network, extracts link weight constraints and node resource constraints; and generates and sorts all paths from the source node to the destination node by calling the corresponding policy according to the policy name. Step 3: Filter the sorted paths and form an SRv6 path package from the filtered paths.

5. The cloud-based authentication method based on SRv6 according to claim 1, characterized in that, The SRv6 path packet contains N SRv6 path information from the network client to the network service cloud.

6. The cloud-based authentication method based on SRv6 according to claim 1, characterized in that, The process of processing the identity authentication information includes dividing the identity authentication information into N sub-identity authentication information based on the SRv6 path information, and adding a unique serial number, total number of packets and timestamp to each sub-identity authentication information.

7. The cloud-based authentication method based on SRv6 according to claim 1, characterized in that, The network service cloud authenticates identity information in the following ways: Step 1: After receiving the sub-identity authentication information data packet from the network client, the network service cloud starts a global timer. If the global timer expires and all sub-identity authentication information data packets for this authentication have not been received, it is determined that there is packet loss in this authentication. Step 2: The network service cloud establishes a buffer and stores sub-packets according to their sequence numbers. If a sub-packet with a sequence number other than the current expected sequence number is received, the sub-packet is temporarily stored and the system waits for subsequent sub-packets. At the same time, the missing sequence number is recorded. Step 3: When a missing sequence number is found, start a timer. If a sub-packet with a certain sequence number is not received within the timeout period, it is determined that a packet is lost during this authentication process. Step 4: If any packets are lost during this authentication process, the authentication is deemed to have failed, all received sub-packets are discarded, and the process is terminated. Step 5: If all sub-packets are received completely, they are concatenated into complete authentication information and the subsequent verification process begins.

8. A computer-readable storage medium having a computer program stored thereon, characterized in that, The computer program is executed by a processor to implement the SRv6-based cloud authentication method as described in any one of claims 1 to 7.

9. A cloud-based authentication device based on SRv6, characterized in that, It includes a processor and a memory; the memory is used to store computer programs; the processor is connected to the memory and is used to execute the computer programs stored in the memory, so that the SRv6-based cloud authentication device performs the SRv6-based cloud authentication method as described in any one of claims 1 to 7.

Images