Communication method, network device and storage medium

Abstract

The invention discloses a communication method, network equipment and a storage medium. In the application, a control node obtains a first SID used for indicating a first P node to execute encryption or decryption operation based on first SA information, and issues the first SID to a first PE node. When a first PE node receives a first message which is to be sent to a second PE node through a first P node and needs to be transmitted through an SA tunnel, a first SID is packaged in a first SRH of the first message. Therefore, after the first P node receives the first message, under the indication of the first SID, the first SA information is utilized to perform encryption or decryption operation on the first message, and the processed message is forwarded, so that the P node encrypts or decrypts the message, the requirement of secure transmission of the message on networking is reduced, the message encryption and decryption mode is more flexible, and the security of the message is improved. And the requirements of users can be better met.

Description

Technical Field

[0001] This application relates to the field of network technology, and in particular to a communication method, network device and storage medium. Background Technology

[0002] xSEC (x-security) technology is a point-to-multipoint adaptive encryption technology based on the Internet Protocol Security (IPsec) framework and the Border Gateway Protocol (BGP) extension protocol. It has advantages such as high reliability and easy deployment, and can effectively support the service encryption deployment in IPv6-based segment routing IPv6 (SRv6) networking scenarios.

[0003] In related technologies, the xSEC security policy is configured on the provider edge (PE) node, which serves as the service access node. Taking a first PE node configured with the xSEC security policy as an example, this first PE node can negotiate a security association (SA) with a second PE node using the BGP extended protocol based on the configured xSEC security policy to obtain SA information. Subsequently, after receiving a qualified packet, the first PE node encrypts the packet based on the SA information and sends the encrypted packet to the second PE node. After receiving the encrypted packet, the second PE node decrypts the encrypted packet based on the SA information and sends it to the destination device. Therefore, in related technologies, packet encryption and decryption are both performed by the PE node, which places high demands on network topology and lacks flexibility. Summary of the Invention

[0004] This application provides a communication method, network device, and storage medium that enables encryption and / or decryption of messages between PE nodes and provider (P) nodes, reducing the network requirements for secure message transmission and making message encryption and decryption more flexible.

[0005] To achieve the above objectives, this application adopts the following technical solution:

[0006] In a first aspect, a communication method is provided, applied to a first P node, the method comprising: receiving a first message, wherein the segment identifier (SID) to be processed in the first segment routing header (SRH) of the first message is a first SID, the first SID being used to instruct the first P node to perform a first operation based on first SA information; performing the first operation on the first message based on the first SA information to obtain a processed first message; and sending the processed first message.

[0007] In this application, the SRH of the first message sent to the first P node may include the first SID of the first P node. The first SID can instruct the first P node to perform a first operation based on the first SA information. In this way, the first P node can perform encryption or decryption operations on the first message according to the instruction of the first SID and the first SA information, and then send the processed message. This realizes the encryption or decryption of the message by the P node, reduces the network requirements for secure message transmission, and makes the implementation of message encryption and decryption more flexible.

[0008] Optionally, the first SID is a first encrypted SID generated by the first P node, the value of the functional segment of the first encrypted SID is used to indicate the encryption operation, and the first P node stores the mapping relationship between the first encrypted SID and the first SA information; or, the first SID is a first decrypted SID generated by the first P node, the value of the functional segment of the first decrypted SID is used to indicate the decryption operation, and the first P node stores the mapping relationship between the first decrypted SID and the first SA information.

[0009] In this application, the P node can generate a special SID to indicate encryption or decryption operations, and by establishing a mapping relationship between the first SID and the first SA information, the first SID can identify the first SA information.

[0010] Optionally, the method further includes: receiving the first SA information sent by the control node, wherein the first SA information is obtained by the first operator edge PE node and the second PE node through SA negotiation; and sending the first SID to the first PE node through the control node, wherein the first message is a message sent from the first PE node through the first P node to the second PE node.

[0011] In this application, the SA negotiation can be performed by the first and last PE nodes, and the first SA information obtained through the control node can be synchronized to the P node used to perform encryption or decryption. Based on this, the P node can further generate a first SID to indicate whether to perform encryption or decryption using the first SA information. Therefore, this application achieves the separation and flexible scheduling of the SA negotiation and encryption / decryption operations. Furthermore, since the SA negotiation is still performed by the first and last PE nodes, the BGP extended protocol can still be used for SA negotiation without extending or changing the original protocol and process.

[0012] Optionally, the first SID is a first binding segment identifier (BSID), the first BSID is used to identify the first SRv6 policy, the segment list of the first SRv6 policy includes the first encryption SID of the first P node and the second decryption SID of the second P node, the value of the function segment of the first encryption SID is used to indicate the encryption operation, the first P node stores the mapping relationship between the first encryption SID and the first SA information, the value of the function segment of the second decryption SID is used to indicate the decryption operation, and the second P node stores the mapping relationship between the second decryption SID and the first SA information.

[0013] In this application, when both the encryption execution node and the decryption execution node are P nodes, an associated SRv6 policy can be created to indicate the path from the encryption execution node to the decryption execution node, and this associated SRv6 policy can be identified by a BSID. Thus, after the subsequent control node sends the BSID to the first PE node, the path from the encryption execution node to the decryption execution node within the path indicated by the SRv6 encryption policy from the first PE node to the second PE node can be identified by the BSID. This minimizes the possibility that the SIDs included in the segment list of the SRv6 encryption policy exceed the maximum stack depth of the nodes.

[0014] Optionally, the processed first message may further include a second SRH, which includes the segment list in the first SRv6 policy.

[0015] Optionally, when the first SID is the first BSID, the method further includes: receiving first indication information sent by the control node, the first indication information being used to indicate SA negotiation; generating the first encrypted SID based on the first indication information, and negotiating SA with the second P node based on the Interior Gateway Protocol (IGP) extension protocol to obtain the first SA information and the second decrypted SID; obtaining the first SRv6 policy and the first BSID based on the first encrypted SID and the second decrypted SID; and sending the first BSID to the first PE node through the control node, wherein the first message is a message sent from the first PE node through the first P node and the second P node to the second PE node.

[0016] In this application, when both the encryption execution node and the decryption execution node are P nodes, the control node can instruct these two P nodes to perform SA negotiation independently to create an SA tunnel. These two P nodes can utilize the IGP extended protocol to implement the SA negotiation.

[0017] Optionally, the flag field of the first SRH carries first identification information, which is used to identify encryption and decryption operations; the value of the locator field of the first SID is the locator of the first P node; and the value of the parameter field of the first SID is a first security parameter index (SPI) used to identify the first SA information.

[0018] In this application, the first SPI can be carried in the parameter field of the first SID, and the first identification information for encrypting or decrypting the message can be carried in the flag field of the first SRH. In this way, the value of the function field of the first SID can still be used to indicate the forwarding of the message through the corresponding link. In other words, the first SA information can be indicated by carrying the SPI in the parameter field of the link SID that instructs the P node to forward the message through the corresponding link. In this way, there is no need to generate a SID specifically for indicating encryption or decryption operations. Thus, the number of SIDs included in the segment list of the message's SRH can be reduced, thereby reducing the number of bytes in the SRH and reducing bandwidth expansion.

[0019] Optionally, when the first SPI is carried through the parameter segment of the first SID, the method further includes: receiving first indication information sent by the control node, the first indication information being used to indicate SA negotiation; performing SA negotiation with the second P node based on the IGP extended protocol to obtain the first SA information; obtaining the first SPI based on the first SA information; and sending the first SPI to the control node, the control node being used to send the first SID to the first PE node based on the first SPI, wherein the first message is a message sent from the first PE node through the first P node to the second PE node.

[0020] In a second aspect, a communication method is provided for use in a control node. The method includes: obtaining a first SID, wherein the first SID is used to instruct a first P node to perform a first operation based on first SA information, the first operation being an encryption operation or a decryption operation; and sending the first SID to a first PE node, wherein the first SID is included in the SRH of a message of a first service sent from the first PE node through the first P node to the second PE node.

[0021] In this application, the control node can obtain a first SID used to instruct the first P node to perform encryption or decryption operations based on the first SA information, and send the first SID to the first PE node, which is the entry PE node. Based on this, the SRH of a message carrying the first service from the first PE node through the first P node to the second PE node can carry the first SID, thereby instructing the first P node to perform encryption or decryption operations on the message. This enables the P node to encrypt or decrypt the message, reduces the network requirements for secure message transmission, and makes the message encryption and decryption implementation more flexible.

[0022] Optionally, the process of obtaining the first SID may include: receiving the first SA information from the first PE node, wherein the first SA information is obtained by the first PE node and the second PE node through SA negotiation; sending the first SA information to the first P node; and receiving the first SID from the first P node.

[0023] In this application, the first and last PE nodes can negotiate the SA (SA Agreement) and report the negotiated first SA information to the control node. Based on this, the control node can synchronize the negotiated first SA information to the P nodes used for encryption or decryption. This allows the P nodes to further generate a first SID (Security ID) to instruct the use of the first SA information for encryption or decryption operations, and report the first SID to the control node. Therefore, this application achieves the separation and flexible scheduling of the SA negotiation and encryption / decryption operations. Furthermore, since the SA negotiation is still performed by the first and last PE nodes, the BGP extended protocol can still be used for SA negotiation without extending or modifying the original protocol and process.

[0024] Optionally, the first SID is a first encrypted SID, the value of the functional segment of the first encrypted SID is used to indicate an encryption operation, and the first P node stores a mapping relationship between the first encrypted SID and the first SA information; or, the first SID is a first decrypted SID, the value of the functional segment of the first decrypted SID is used to indicate a decryption operation, and the first P node stores a mapping relationship between the first decrypted SID and the first SA information.

[0025] In this application, the P node can generate a special SID to indicate encryption or decryption operations, and by establishing a mapping relationship between the first SID and the first SA information, the first SID can identify the first SA information.

[0026] Optionally, the process of obtaining the first SID may include: sending first indication information to the first P node, the first indication information being used to instruct the first P node to negotiate SA with the second P node to obtain the first SA information; and receiving the first SID from the first P node.

[0027] In this application, when both the encryption execution node and the decryption execution node are P nodes, the control node can instruct these two P nodes to perform SA negotiation on their own using the IGP extended protocol to create an SA tunnel.

[0028] Optionally, the first SID is a first BSID, which is used to identify a first SRv6 policy. The first SRv6 policy includes a first encrypted SID of the first P node and a second decrypted SID of the second P node. The value of the functional segment of the first encrypted SID is used to indicate an encryption operation. The first P node stores a mapping relationship between the first encrypted SID and the first SA information. The value of the functional segment of the second decrypted SID is used to indicate a decryption operation. The second P node stores a mapping relationship between the second decrypted SID and the first SA information.

[0029] In this application, when both the encryption execution node and the decryption execution node are P nodes, an associated SRv6 policy can be created to indicate the path from the encryption execution node to the decryption execution node, and this associated SRv6 policy can be identified by a BSID. Thus, after the subsequent control node sends the BSID to the first PE node, the path from the encryption execution node to the decryption execution node within the path indicated by the SRv6 encryption policy from the first PE node to the second PE node can be identified by the BSID. This minimizes the possibility that the SIDs included in the segment list of the SRv6 encryption policy exceed the maximum stack depth of the nodes.

[0030] Optionally, the process of obtaining the first SID may include: sending first indication information to the first P node, the first indication information being used to instruct the first P node to negotiate SA with the second P node to obtain the first SA information; receiving a first SPI from the first P node or the second P node, the first SPI being used to identify the first SA information; determining the first SID and the second SID, wherein the value of the locator field of the first SID is the locator of the first P node, the value of the parameter field of the first SID is the first SPI, the value of the locator field of the second SID is the locator of the second P node, the value of the parameter field of the second SID is the first SPI, the SRH of the first service packet also includes the second SID, and the flag field of the SRH of the first service packet also carries first identification information, the first identification information being used to identify encryption / decryption operations.

[0031] In this application, when both the encryption execution node and the decryption execution node are P nodes, the control node can instruct these two P nodes to independently negotiate the SA (SA) using the IGP (Integrated Gateway Protocol) to create an SA tunnel and receive the first SPI (Split Indicator) reported by the P nodes to identify the first SA information obtained through negotiation. Based on this, the control node can use the parameter segments of the first SID and the second SID to carry the first SPI, and use the flag field of the first SRH (Signal Header) to carry the first identification information used to identify the encryption and decryption of the packet. In this way, the values ​​of the function segments of the first SID and the second SID can still be used to indicate the forwarding of the packet through the corresponding link. In other words, the first SA information can be indicated by carrying the SPI in the parameter segment of the link SID that instructs the P nodes to forward the packet through the corresponding link. This eliminates the need to specifically generate SIDs to indicate encryption or decryption operations, thereby reducing the number of SIDs included in the SRH segment list of the packet, thus reducing the number of bytes in the SRH and minimizing bandwidth expansion.

[0032] Optionally, before obtaining the first SID, the control node may also receive resource information from the first PE node, the second PE node, and a plurality of P nodes, wherein the plurality of P nodes are P nodes traversed from the first PE node to the second PE node, and the plurality of P nodes include the first P node; the resource information includes encrypted resource information and decrypted resource information; and based on the resource information of the first PE node, the second PE node, and the plurality of P nodes, the first P node is determined from the plurality of P nodes.

[0033] In this application, PE nodes and each P node can report their own resource information to the control node. Based on this, the control node can schedule which node performs encryption operations and which node performs decryption operations based on the resource information of each node, realizing flexible scheduling of encryption and decryption resources and making full and reasonable use of the node's encryption and decryption resources. Especially in the event of failure of the ingress PE node and / or egress PE node, secure transmission of messages can still be achieved, improving service reliability.

[0034] Thirdly, a communication method is provided for a first PE node, the method comprising: receiving a first SID from a control node, the first SID being used to instruct a first P node to perform a first operation based on first SA information, the first operation being an encryption operation or a decryption operation; and sending a first message to a second PE node via a first path, the first message including the first SID in its first SRH, the first P node being an intermediate node on the first path.

[0035] In this application, the first PE node can receive a first SID sent by the control node, which instructs the first P node to perform encryption or decryption operations based on the first SA information. Based on this, the first PE node can send a first message via a first path. The first SRH of the first message includes the first SID, and the first path includes the first P node. Thus, when the first message arrives at the first P node, the first P node can, under the instruction of the first SID, use the first SA information to perform encryption or decryption operations on the first message. This enables the P node to encrypt or decrypt the message, reducing the network requirements for secure message transmission and making message encryption and decryption more flexible.

[0036] Optionally, the first PE node establishes a communication connection with the first customer edge (CE) node. When the first operation is an encrypted operation, the first PE node can also receive a third SID from the control node. The third SID is used to instruct the third P node to perform the first operation based on the second SA information. A second message is sent to the third PE node through a second path. The SRH of the second message includes the third SID. The third P node is an intermediate node on the second path. Both the second message and the first message are messages of the first service sent from the first CE node to the second CE node. The first link between the second PE node and the second CE node and the second link between the third PE node and the second CE node are aggregated links.

[0037] Optionally, the message of the first service is transmitted on the first path and the second path based on the decryption resource information of the second PE node and the decryption resource information of the third PE node, and the decryption resource information is used to indicate the remaining decryption resources of the node.

[0038] In this application, for a message to be sent to the second CE node, the first PE node can perform UCMP load balancing on the message of the first service based on the remaining decryption resources of the second and third PE nodes, thereby distributing the message of the first service to the first path and the second path for transmission. This approach, on the one hand, fully utilizes the encryption and decryption resources of multi-homed nodes in a multi-homed scenario, improving resource utilization; on the other hand, it also mitigates the traffic congestion or even interruption problems that may occur when traffic is transmitted through a single path.

[0039] Optionally, the decryption resource information of the second PE node is carried via an Ethernet auto-discovery per Ethernet segment (ES-AD) route sent by the second PE node to the first PE node, and the decryption resource information of the third PE node is carried via an ES-AD route sent by the third PE node to the first PE node. That is, in this application, decryption resource information can be carried by extending the ES-AD route during SA negotiation.

[0040] Optionally, the method further includes: obtaining decryption resource requirement information for a first service, wherein the first message is a message of the first service; sending a first ES-AD route to the second PE node, wherein the first ES-AD route carries first key information and the decryption resource requirement information, wherein the first key information is used to calculate a first key and the decryption resource requirement information is used to instruct the second PE node to allocate corresponding decryption resources for the first service; receiving a second ES-AD route sent by the second PE node, wherein the second ES-AD route carries second key information, wherein the second key information is used to calculate a first key and the first SA information includes the first key.

[0041] In this application, when PE nodes are negotiating SA, the ingress PE node can also extend the ES-AD route to carry the decryption resource requirement information of the service, thereby instructing the egress PE node to reserve decryption resources for the SA tunnel for transmitting the corresponding service based on the decryption resource requirement information, realizing the advance planning of decryption resources and reducing the probability of traffic congestion.

[0042] Fourthly, a communication device is provided, the communication device comprising at least one module, the at least one module being configured to perform the communication method described in the first, second, or third aspect above.

[0043] Fifthly, a network device is provided, the network device including a processor, the processor being configured to execute at least one program instruction or code stored in a memory to implement the communication method described in the first, second, or third aspects above.

[0044] In a sixth aspect, a computer-readable storage medium is provided, wherein instructions are stored therein, which, when executed on a computer device, cause the computer device to perform the communication method described in the first, second, or third aspect above.

[0045] In a seventh aspect, a computer program product containing instructions is provided, which, when run on a computer device, causes the computer device to perform the communication method described in the first, second, or third aspect above.

[0046] The technical effects achieved by the fourth to seventh aspects mentioned above are similar to those achieved by the corresponding technical means in the first, second and third aspects, and will not be repeated here. Attached Figure Description

[0047] Figure 1 A schematic diagram illustrating an application scenario involving the communication method provided in the embodiments of this application;

[0048] Figure 2An architecture diagram of a network system used in the communication method provided in the embodiments of this application;

[0049] Figure 3 An architecture diagram of another network system used in the communication method provided in the embodiments of this application;

[0050] Figure 4 A flowchart illustrating the first communication method provided in this application embodiment;

[0051] Figure 5 A flowchart illustrating the second communication method provided in this application embodiment;

[0052] Figure 6 A schematic diagram showing a list of time periods for P nodes as encryption execution nodes and the SID of each node, provided for an embodiment of this application;

[0053] Figure 7 A schematic diagram showing a list of time periods for P nodes as decryption execution nodes and the SID of each node, provided for an embodiment of this application;

[0054] Figure 8 This is a schematic diagram illustrating a list of encryption and decryption execution nodes, both of which are P-time periods, and the SID of each node, provided for an embodiment of this application.

[0055] Figure 9 A flowchart illustrating the third communication method provided in the embodiments of this application;

[0056] Figure 10 A flowchart illustrating the fourth communication method provided in this application embodiment;

[0057] Figure 11 This is a schematic diagram showing another encryption execution node and decryption execution node provided in an embodiment of this application, both of which are P-time period lists and the SID of each node;

[0058] Figure 12 This is a schematic diagram of the structure of an IGP extension protocol provided in an embodiment of this application;

[0059] Figure 13 A flowchart illustrating the fifth communication method provided in the embodiments of this application;

[0060] Figure 14 A schematic diagram of an SRH provided for an embodiment of this application;

[0061] Figure 15 This is a schematic diagram of the structure of a first type of communication device provided in an embodiment of this application;

[0062] Figure 16 This is a schematic diagram of the structure of a second communication device provided in an embodiment of this application;

[0063] Figure 17 This is a schematic diagram of the structure of a third communication device provided in the embodiments of this application;

[0064] Figure 18 This application provides a schematic diagram of the structure of a network device according to an embodiment of the present application.

[0065] Figure 19 This is a schematic diagram of another network device provided in an embodiment of this application. Detailed Implementation

[0066] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the implementation methods of this application will be further described in detail below with reference to the accompanying drawings.

[0067] Before providing a detailed explanation of the embodiments of this application, let's first introduce the application scenarios involved in the embodiments of this application.

[0068] xSEC technology, also known as any security (any-SEC) technology, refers to security technology that operates in any location, at any layer, and in any topology. Compared to IPsec technology, xSEC technology separates the control plane from the data plane of the encrypted tunnel. Furthermore, while adhering to security standards, it enables automatic tunnel creation and flexible control, reducing equipment and operational burdens.

[0069] Currently, in Internet Protocol (IP) networks, since PE nodes are service access nodes and support BGP, xSEC security policies are configured on PE nodes. Based on this, PE nodes can negotiate SA (Security Advisory) information based on the configured xSEC security policy to obtain SA information. Then, based on this SA information, they can encrypt and decrypt eligible packets to achieve secure packet transmission between PE nodes. However, this method, where SA negotiation and encryption / decryption are entirely performed by the PE nodes, may not meet the requirements for secure packet transmission in certain scenarios.

[0070] For example, in some possible scenarios, the encryption and decryption resources on the PE node may be insufficient, or the components on the PE node used for message encryption and decryption may malfunction. In such cases, the secure transmission of messages will be affected.

[0071] For example, in other possible scenarios, users may require P-nodes between PE nodes to encrypt and / or decrypt messages. For instance, for over-the-top (OTT) users or financial users, parts of the transmission path between two PE nodes may be secure. When transmitting messages on these secure parts of the path, encryption is unnecessary. In such cases, users will have a need for P-nodes between PE nodes to encrypt and / or decrypt messages.

[0072] For example, in the case of financial services, see Figure 1 City A and City B respectively house data centers 11 and 12 for the financial user, while City C houses the branch network 13 of the financial user. A backbone network 14 is deployed between data centers 11, 12, and the branch network 13. This backbone network 14 includes a data center provider edge (DC-PE) node 141 and a wide area network provider (WAN-P) node 142 deployed in City A; a DC-PE node 143 and a WAN-P node 144 deployed in City B; and a broadband router provider edge (BR-PE) node 145 and a BR-PE node 146 deployed in City C.

[0073] Specifically, the BR-PE node is used to enable branch network 13 to access the backbone network 14, the WAN-P node is used to aggregate data from branch network 13, and the DC-PE node is used to access the corresponding data center. For example, see... Figure 1Branch office 13 can connect to WAN-P node 142 via BR-PE node 145, and then to DC-PE node 141 via WAN-P node 142, thereby accessing data center 11. Link L1 between DC-PE node 141 and WAN-P node 142 is a secure link, while link L2 between WAN-P node 142 and BR-PE node 145 is an insecure link. Alternatively, branch office 13 can also connect to WAN-P node 144 via BR-PE node 146, and then to DC-PE node 143 via WAN-P node 144, thereby accessing data center 12. Link L3 between DC-PE node 143 and WAN-P node 144 is a secure link, while link L4 between WAN-P node 144 and BR-PE node 146 is an insecure link. Based on this, when branch office 13 transmits service messages between it and data center 11, since link L1 is a secure link and link L2 is an insecure link, the service message needs to be encrypted on link L2, but not on link L1. Therefore, in this case, the user needs WAN-P node 142 to encrypt and / or decrypt the service message. Similarly, when branch office 13 transmits service messages between it and data center 12, the user needs WAN-P node 144 to encrypt and / or decrypt the service message.

[0074] Based on the above description, this application provides a communication method applicable to the above-mentioned scenario. In this method, the SRH of the first message sent to the first P node may include the first SID of the first P node. The first SID can instruct the first P node to perform a first operation based on the first SA information. In this way, the first P node can perform encryption or decryption operations on the first message according to the instruction of the first SID and the first SA information, and then send the processed message. This realizes the encryption or decryption of the message by the P node, reduces the network requirements for secure message transmission, and makes the message encryption and decryption method more flexible, which can better meet the needs of users.

[0075] The network system used in the communication method provided in the embodiments of this application will be described next.

[0076] Figure 2 This is a network system architecture diagram used in the communication method provided in the embodiments of this application. For example... Figure 2 As shown, the network system may include a control node 201, a first PE node 202, a second PE node 203, and multiple P nodes (such as...). Figure 2(as shown in figures 204 and 205). Control node 201 can communicate with each PE node and each P node to control and manage them. First PE node 202 establishes a communication connection with P node 204, P node 204 establishes a communication connection with P node 205, and P node 205 establishes a communication connection with second PE node 203.

[0077] In this embodiment, taking the first PE node 202 as the ingress PE node and the second PE node 203 as the egress PE node as an example, in a first possible scenario, when P node 204 performs message encryption and / or P node 205 performs message decryption, the first PE node 202 can use the BGP extended protocol to negotiate SA with the second PE node 203 to create an SA tunnel between the first PE node 202 and the second PE node 203. After the SA tunnel is successfully created, the first PE node 202 can synchronize the SA information corresponding to the SA tunnel to the P node used to perform message encryption and / or message encryption operations through the control node 201. Based on this, the P node that obtains the SA information can send a SID to the first PE node 202 through the control node 201, which can instruct the P node to perform encryption or decryption operations based on the SA information. In this way, when the first PE node 202 sends a service message to be transmitted to the second PE node 203, it can carry the SID in the service message to instruct the corresponding P node to use the SA information synchronized by the PE node to encrypt or decrypt the message.

[0078] In the second possible scenario, where P node 204 performs message encryption and P node 205 performs message decryption, P node 204 can use the IGP extended protocol to negotiate SA with P node 205 to create an SA tunnel between them. After the SA tunnel is successfully created, the P node can send a SID to the first PE node 202 via control node 201, instructing the P node to perform encryption and decryption operations based on the SA information corresponding to the SA tunnel. Thus, when the first PE node 202 sends a service message to be transmitted to the second PE node 203, it can include the SIDs of both P nodes in the message, thereby instructing the corresponding P node to use the SA information corresponding to the SA tunnel to encrypt and decrypt the message.

[0079] In a third possible scenario, where P node 204 performs message encryption and P node 205 performs message decryption, control node 201 can also configure SA information for P nodes 204 and 205 to create an SA tunnel between them. Based on this, control node 201 can send a SID to the first PE node 202, instructing the P nodes to perform encryption and decryption operations based on the SA information. Thus, when the first PE node 202 sends a service message to the second PE node 203, it can include the SIDs of both P nodes in the message, instructing the corresponding P nodes to use the SA information for encryption and decryption.

[0080] It should be noted that in the above scenarios, each PE node and each P node can report their own encryption and decryption resource information to the control node 201. In this way, the control node 201 can determine whether to use a P node for encryption and / or decryption, and which specific P node to use, based on the encryption and decryption resource information of each node.

[0081] Optionally, see Figure 3 The network system may further include a first CE node 206, a second CE node 207, a third PE node 208, a P node 209, and a P node 210. The first CE node 206 establishes a communication connection with the first PE node 201; the first PE node 202 establishes a communication connection with the third PE node 208 through P nodes 209 and 210; and the second CE node 207 establishes communication connections with both the second PE node 203 and the third PE node 208. The communication links between the second PE node 203 and the second CE node 207, and between the third PE node 208 and the second CE node 207, are aggregated links, meaning that the second PE node 203 and the third PE node 208 are dual-homed nodes of the second CE node 207. Thus, service packets originating from the first CE node 206 and destined for the second CE node 207 can reach the second CE node 207 via two transmission paths. One transmission path is: First PE node 202 → P node 204 → P node 205 → Second PE node 203 → Second CE node 207; the other transmission path is: First PE node 202 → P node 209 → P node 210 → Third PE node 208 → Second CE node 207.

[0082] Based on this, in one possible implementation, when performing message decryption operations through the exiting PE node, the first PE node 202 can not only negotiate SA with the second PE node 203 to create an SA tunnel, but also negotiate SA with the third PE node 208 to create an SA tunnel between the first PE node 202 and the third PE node 208. The SA tunnel between the first PE node 202 and the second PE node 203 is called the first SA tunnel, and the SA tunnel between the first PE node 202 and the third PE node 208 is called the second SA tunnel. It should be noted that during the SA negotiation process between the first PE node 202 and the second PE node 203 and the third PE node 208, both the second PE node 203 and the third PE node 208 can send their own decryption resource information back to the first PE node 202. Based on this, after the two SA tunnels are successfully created, for service packets with flow characteristic information that conform to the configured security policy and are to be sent to the second CE node 207, the first PE node 202 can load balance the service packets based on the decryption resource information of the second PE node 203 and the third PE node 208, thereby determining which SA tunnel to transmit the service packets through.

[0083] Alternatively, in another possible implementation, when performing message decryption operations through the egress PE node, the first PE node 202, during SA negotiation with the second PE node 203 and the third PE node 208, can send decryption resource requirement information for the service to be transmitted to the second PE node 203 and the third PE node 208. Based on this, the second PE node 203 and the third PE node 208 can allocate decryption resources for the SA corresponding to the service according to the decryption resource requirement information. If the allocation of decryption resources is successful, the corresponding SA tunnel can be successfully established; if the allocation of decryption resources fails, the creation of the corresponding SA tunnel also fails.

[0084] It should be noted that the aforementioned PE nodes can also be called service access nodes. For example, PE nodes can be access routers (AR), service routers (SR), packet transport network (PTN) devices, etc. The aforementioned P nodes can also be called intermediate nodes or traffic aggregation nodes. For example, P nodes can be core routers (CR), BR, or PTN devices, etc. Control node 201 can be a software-defined network (SDN) controller, or it can also be a network cloud engine (NCE).

[0085] The communication method provided in the embodiments of this application will be described next.

[0086] Figure 4 This is a flowchart illustrating a communication method provided in an embodiment of this application. This communication method can be applied to the network system described above. The implementation process of this communication method will be described below, taking a first PE node as the entry PE node and a second PE node as the exit PE node as an example. For example, see [link to example]. Figure 4 The process may include the following steps:

[0087] S41: The control node obtains the first SID, which is used to instruct the first P node to perform a first operation based on the first SA information. The first operation is an encryption operation or a decryption operation.

[0088] In this embodiment of the application, the control node obtains the first SID in different ways depending on how the first SA information is obtained. For example, the control node can obtain the first SID through any of the methods A to D described below.

[0089] Method A: The control node can obtain the first SID based on the first SA information obtained through SA negotiation between the first PE node and the second PE node. For example, see... Figure 5 The process may include the following steps:

[0090] a411: The first PE node and the second PE node negotiate SA.

[0091] In this embodiment, the control node can configure a first security policy on the first PE node. This first security policy may include flow characteristic information of the first service to which the first security policy applies, the security protocol used, the data encapsulation mode, encryption and verification algorithms, key exchange algorithms, etc. The first PE node can negotiate an SA with the second PE node based on this first security policy to create a first SA tunnel.

[0092] In this process, the first PE node can advertise a first ES-AD route to the second PE node, which may carry first key information. This first key information may include a first SPI, first key material calculated by the first PE node based on a key exchange algorithm, and the aforementioned first security policy. Upon receiving the first ES-AD route, the second PE node can calculate second key information based on the first key material and send this second key information to the first PE node via the second ES-AD route. The second key information includes second key material calculated by the second PE node based on the key exchange algorithm. Additionally, the second PE node can calculate a first key based on the first key material and store the first key and its information. Upon receiving the second key information from the second PE node, the first PE node can calculate the first key based on the second key material within the second key information and store the first key, the second key information, and the aforementioned first key information accordingly. Thus, the SA negotiation between the first and second PE nodes is completed, and the first SA tunnel is successfully created.

[0093] Optionally, in some embodiments, when the first PE node negotiates SA with the second PE node based on the first security policy, it can also obtain decryption resource requirement information for the first service to which the first security policy applies. This decryption resource requirement information is used to indicate the amount of decryption resources required for the first service. Furthermore, when the first PE node sends a first ES-AD route to the second PE node, it can also carry the decryption resource requirement information in the first ES-AD route. After receiving the decryption resource requirement information, the second PE node can allocate corresponding decryption resources for the first service, i.e., the first SA tunnel, according to the indicated amount of decryption resources. If the second PE node has sufficient decryption resources and successfully allocates the corresponding decryption resources for the first service, the second PE node can return a second ES-AD route carrying the second key information to the first PE node and store the location of the decryption resources allocated for the first SA tunnel, the first decryption key, and the first key information accordingly. Optionally, if the decryption resources on the second PE node are insufficient to allocate the corresponding decryption resources for the first SA tunnel, the second PE node can return an SA negotiation failure message to the first PE node to indicate that the SA negotiation failed and the first SA tunnel establishment failed.

[0094] a412: The first PE node sends the first SA information to the control node.

[0095] After the first PE node completes SA negotiation with the second PE node and establishes the first SA tunnel, it can report the first SA information corresponding to the first SA tunnel to the control node. This first SA information may include first key information, second key information, the address of the head node of the first SA tunnel, and the address of the tail node, where the head node is the first PE node and the tail node is the second PE node. Optionally, the first SA information may also include a first key. In this case, the first SPI included in the first key information can be used to uniquely identify the first SA information.

[0096] In some embodiments, the first PE node may report the first SA information to the control node while requesting the SRv6 encryption policy from the first PE node to the second PE node.

[0097] For example, after receiving the BGP route from the second PE node, the first PE node can match the corresponding on-demand nexthop (ODN) template based on the second PE node's BGP route. Then, the first PE node can send an SRv6 encryption policy creation request to the control node. This SRv6 encryption policy creation request may carry the ODN template, an encryption policy identifier, and first SA information. The encryption policy identifier indicates that the first PE node is requesting an SRv6 encryption policy corresponding to the first SA information.

[0098] a413: The control node obtains the first SID based on the first SA information.

[0099] After receiving the first SA information reported by the first PE node, the control node can determine the first P node from among the multiple P nodes between the first PE node and the second PE node, and then obtain the first SID based on the first SA information and the first P node.

[0100] In some embodiments, within the autonomous system (AS) where the first PE node and / or the second PE node reside, one or more PE nodes have BGP link state (BGP-LS) features deployed. The PE nodes and P nodes in this AS can use IGP extended protocols to flood their own resource information to target PE nodes with BGP-LS features deployed. The target PE nodes then send the resource information of each node to the control node via BGP-LS node routing. This resource information may include encrypted and decrypted resource information; the encrypted resource information indicates the encrypted resources of the corresponding node, and the decrypted resource information indicates the decrypted resources of the corresponding node. Based on this, the control node can determine the first P node using the encrypted resource information of the first PE node, the decrypted resource information of the second PE node, and the encrypted and decrypted resource information of each P node between the first and second PE nodes.

[0101] For example, the encryption resource information may include the encryption capability information of the node. For instance, this encryption capability information may indicate whether the node has a value-added service board capable of performing encryption operations. Similarly, the decryption resource information may include the decryption capability information of the node. For instance, this decryption capability information may indicate whether the node has a value-added service board capable of performing decryption operations. Based on this, the control node can determine whether the first PE node has encryption capabilities based on its encryption resource information. If the first PE node does not have encryption capabilities, the control node can determine, based on the encryption resource information of multiple P nodes between the first and second PE nodes, a P node adjacent to the first PE node that has encryption capabilities. This P node is the first P node, and in this case, the first P node is the encryption execution node determined by the control node.

[0102] Optionally, if the first PE node has encryption capabilities, the control node can determine whether the second PE node has decryption capabilities based on the decryption resource information of the second PE node. If the second PE node does not have decryption capabilities, the control node can determine the P node that is adjacent to the second PE node and has decryption capabilities from among the multiple P nodes between the first PE node and the second PE node based on the decryption resource information of the multiple P nodes. This P node is the first P node. In this case, the first P node is the decryption execution node determined by the control node.

[0103] Optionally, if the first PE node does not have encryption capability and the second PE node does not have decryption capability, the control node can refer to the above method to determine from multiple P nodes the P node that is adjacent to the first PE node and has encryption capability as the first P node, and the P node that is adjacent to the second PE node and has decryption capability as the second P node. In this case, the first P node is the encryption execution node and the second P node is the decryption execution node.

[0104] For example, see Figure 6 The first PE node is PE1, and the second PE node is PE2. If the control node determines that PE1 does not have encryption capabilities and PE2 has decryption capabilities, then the P1 node, which has established a communication connection with PE1, can be used as the encryption execution node. In this case, the P1 node is the first P node.

[0105] For example, see Figure 7 The first PE node is PE1, and the second PE node is PE2. If the control node determines that PE1 has encryption capabilities and PE2 does not have decryption capabilities, then the P2 node, which has established a communication connection with PE2, can be used as the decryption execution node. In this case, the P2 node is the first P node.

[0106] For example, see Figure 8 The first PE node is PE1, and the second PE node is PE2. If the control node determines that PE1 does not have encryption capabilities and PE2 does not have decryption capabilities, then P1, which has established a communication connection with PE1, can be used as the encryption execution node. In this case, P1 is the first P node. P2, which has established a communication connection with PE2, can be used as the decryption execution node. In this case, P2 is the second P node.

[0107] Optionally, when the encryption capability information in the encryption resource information indicates that the node has encryption capability, the encryption resource information may further include the node's remaining encryption bandwidth. Similarly, the decryption resource information may further include the node's remaining decryption bandwidth. Based on this, when the first PE node has encryption capability and the second PE node has decryption capability, the control node may further determine whether the remaining encryption bandwidth of the first PE node can meet the encryption requirements of the first SA tunnel corresponding to the first SA information, based on the encryption resource requirement information of the first service to be transmitted. Based on the decryption resource requirement information of the first service, the control node may determine whether the remaining decryption units of the second PE node meet the decryption requirements of the first SA tunnel. If the first PE node cannot meet the encryption requirements of the first SA tunnel but the second PE node can meet the decryption requirements of the first SA tunnel, the control node may select from the multiple P nodes between the first PE node and the second PE node the P node that can meet the encryption requirements of the first SA tunnel as the first P node. In this case, the first P node is the encryption execution node. If the first PE node can meet the encryption requirements of the first SA tunnel but the second PE node cannot meet the decryption requirements, the control node can select the P node that meets the encryption requirements of the first SA tunnel from among the multiple P nodes between the first and second PE nodes as the first P node. In this case, the first P node is the decryption execution node. If neither the first PE node nor the second PE node can meet the encryption requirements of the first SA tunnel, the control node can select the P node that meets the encryption requirements of the first SA tunnel as the first P node and the P node that meets the decryption requirements as the second P node. In this case, the first P node is the encryption execution node, and the second P node is the decryption execution node.

[0108] In other embodiments, the control node may include a user-preconfigured unencrypted link. This unencrypted link refers to a user-specified secure link where data does not require encryption; in other words, data transmitted on this unencrypted link does not need to be encrypted. Based on this, the control node can detect whether each path from the first PE node to the second PE node contains an unencrypted link. If an unencrypted link is found, the first P node is determined based on that unencrypted link.

[0109] For example, for multiple P nodes between the first PE node and the second PE node, the control node can detect whether the link between the first PE node and each P node is an unencrypted link. If the link between the first PE node and a certain P node is an unencrypted link, the control node can take that P node as the first P node. At this time, the first P node is the encrypted execution node.

[0110] For example, with Figure 6 For example, if the link between PE1 node and P1 node is an unencrypted link, then P1 node can be used as an encrypted execution node.

[0111] If there is no unencrypted link between the first PE node and each P node, the control node can detect whether the link between the second PE node and each P node is an unencrypted link. If the link between the second PE node and a certain P node is an unencrypted link, the control node can use that P node as the first P node. At this time, the first P node is the decryption execution node.

[0112] For example, with Figure 7 For example, if the link between the PE2 node and the P2 node is an unencrypted link, then the P2 node can be used as the decryption execution node.

[0113] If the link between the first PE node and a certain P node is an unencrypted link, and the link between the second PE node and another P node is an unencrypted link, then the control node can use the aforementioned P node with an unencrypted link to the first PE node as the first P node, and the P node with an unencrypted link to the second PE node as the second P node. In this case, the first P node is the encryption execution node, and the second P node is the decryption execution node.

[0114] For example, with Figure 8 For example, if the link between PE1 node and P1 node is an unencrypted link, and the link between P2 node and PE2 node is also an unencrypted link, then P1 node can be used as the encryption execution node, and P2 node can be used as the decryption execution node.

[0115] Optionally, in some possible situations, the control node can also determine the first P node by simultaneously combining the user-configured unencrypted link and the encryption and decryption resource information of each node. For example, after detecting the unencrypted link based on the above method, the control node can further determine whether the corresponding P node has encryption or decryption capabilities, or whether the corresponding P node can meet the encryption or decryption requirements of the first SA tunnel. If the corresponding P node has encryption or decryption capabilities, or if the corresponding P node can meet the encryption or decryption requirements of the first SA tunnel, then the P node is determined as the encryption execution node or decryption execution node.

[0116] After the first P node is identified, the control node can obtain the first SID based on the first SA information and the first P node.

[0117] In some embodiments, see Figure 9The control node can obtain the first SID through the following a4131 to a4133.

[0118] a4131: The control node sends the first SA information to the first P node.

[0119] After identifying the first P node, the control node can send the first SA information and the operation identifier corresponding to the first P node to the first P node.

[0120] Among them, a remote backup service (RBS) channel can be established between the first P node and the control node. Based on this, the control node can send the first SA information and the operation identifier to the first P node through the RBS channel.

[0121] It should be noted that if the first P node is an encryption execution node, then the operation identifier corresponding to the first P node is an identifier used to indicate the encryption operation; if the first P node is a decryption execution node, then the operation identifier corresponding to the first P node is an identifier used to indicate the decryption operation.

[0122] Optionally, if the first P node is an encryption execution node, and there is also a second P node as a decryption execution node, the control node can also send the first SA information and the operation identifier corresponding to the second P node to the second P node.

[0123] An RBS channel is also established between the second P node and the control node. The control node can send the first SA information and the operation identifier corresponding to the second P node to the second P node through this RBS channel. The operation identifier corresponding to the second P node is used to indicate the decryption operation.

[0124] a4132: The first P node generates the first SID based on the first SA information.

[0125] After receiving the first SA information and its corresponding operation identifier, the first P node can generate a first SID for the first SA information based on the operation identifier. The first SID can be used to instruct the first P node to perform the first operation indicated by the operation identifier based on the first SA information. The first operation can be an encryption operation or a decryption operation.

[0126] In one example, a first P node can generate a first SID based on its own locator and its corresponding operation identifier, and create a mapping relationship between the first SID and the first SA information. In this case, the first SID includes a locator segment and a function segment. The value of the locator segment is the locator of the first P node, and the value of the function segment indicates the operation indicated by the operation identifier corresponding to the first P node. For example, the value of the function segment can be the operation identifier corresponding to the first P node. Alternatively, when the operation identifier corresponding to the first P node indicates an encryption operation, the value of the function segment is a first function value, which indicates the encryption operation; in this case, the first SID is the first encrypted SID generated by the first P node for the first SA information. When the operation identifier corresponding to the first P node indicates a decryption operation, the value of the function segment is a second function value, which indicates the decryption operation; in this case, the first SID is the first decrypted SID generated by the first P node for the first SA information.

[0127] In another example, the first P node can generate a first SID based on its own locator, the corresponding operation identifier, and the first SPI in the first SA information. In this case, the first SID includes a locator segment, a function segment, and an arguments segment. The locator segment contains the locator of the first P node, the function segment indicates the operation identified by the operation identifier, and the arguments segment contains the first SPI, used to uniquely identify the first SA information.

[0128] It is worth noting that the length of the SID is fixed, usually 128 bits. The locator segment occupies the high bits, and the function segment occupies the low bits. When the SID does not include the arguments segment, the remaining low bits, excluding the locator segment, constitute the function segment. In this case, the SID format can be locator:function. When the SID includes the arguments segment, a portion of the remaining low bits, excluding the locator segment, are used as the function segment, and the other portion is used as the arguments segment. In this case, the SID format can be locator:function:arguments.

[0129] a4133: The first P node sends the first SID to the control node.

[0130] After generating the first SID, the first P node can send the first SID to the control node.

[0131] For example, the first P node can use the IGP extended protocol to flood the first SID to the PE node in its AS that has BGP-LS feature deployed. Then, the PE node reports the first SID to the control node through BGP-LS.

[0132] Optionally, the first P node can send the addresses of the head node and the tail node contained in the first SID and first SA information to the control node.

[0133] It should be noted that if there is a second P node as the decryption execution node, the second P node can refer to the implementation method of the first P node in a4132 to generate the first encrypted SID, generate a second decryption SID to instruct the second P node to perform decryption operation based on the first SA information, and report the second decryption SID to the control node.

[0134] In the above embodiments, the implementation process of the control node sending the first SA information to the first P node and the first P node generating the first SID is mainly described.

[0135] In other embodiments, the control node may generate the first SID based on the locator of the first P node and the first SA information. In addition, the control node also sends the first SA information to the first P node.

[0136] For example, the control node can obtain the locator of the first P node and the first SPI used to uniquely identify the first SA information. Then, the control node can generate a first SID based on the locator of the first P node and the first SPI. This first SID includes a locator segment, a function segment, and an arguments segment. The value of the locator segment is the locator of the first P node, and the value of the arguments segment is the first SPI. The value of the function segment can be used to indicate an encryption or decryption operation, or it can be a function value obtained based on another SID of the first P node, for example, the function value used to instruct the first P node to forward packets through the corresponding link.

[0137] In addition, the implementation method of the control node sending the first SA information to the first P node can be found in the relevant introduction in a4131, and will not be repeated here.

[0138] Optionally, when the value of the function segment of the first SID is a first function value used to indicate an encryption operation or a second function value used to indicate a decryption operation, the control node may also send the value of the function segment of the first SID and the information of the indicated operation when sending the first SA information to the first P node. In this way, the first P node can store the value and the corresponding operation information.

[0139] Method B: The control node can control the first P node and the second P node to perform SA negotiation to create a first SA tunnel. Based on this, the control node can receive a first SID obtained from the first SA information corresponding to the first SA tunnel sent by either the first P node or the second P node. This first SID is the first BSID. For example, see [link to example]. Figure 10 The process may include the following steps:

[0140] b411: The control node sends a first indication message to the first P node, which is used to indicate that SA negotiation should be performed.

[0141] The control node can create a second SRv6 policy based on the SRv6 encryption policy of the user or the first PE node, with the first PE node as the head node and the second PE node as the tail node. This second SRv6 policy includes a first path, which includes a first P node and a second P node. The first P node is the encryption execution node selected by the control node, and the second P node is the decryption execution node selected by the control node. Based on this, the control node can send a first instruction message to the first P node to instruct it to perform SA negotiation with the second P node. Optionally, the control node can also send the first instruction message to the second P node.

[0142] In some embodiments, during the creation of the second SRv6 policy, the control node can perform path calculation based on the first PE node and the second PE node. During path calculation, if the control node determines, based on the encryption resource information of the first PE node and the decryption resource information of the second PE node, that the first PE node cannot perform encryption and the second PE node cannot perform decryption, and / or, if the control node determines, based on the user-pre-configured unencrypted link, that the first PE node does not need to perform encryption and the second PE node does not need to perform decryption, then the control node can determine the first P node performing encryption and the second P node performing decryption based on the encryption and decryption resource information of each P node between the first and second PE nodes. The relevant implementation methods can be referred to in the aforementioned a413 description, and will not be repeated here. After determining the first P node and the second P node, the control node can calculate, based on the first PE node, the second PE node, the first P node, and the second P node, a first path from the first PE node, through the first P node and the second P node, finally reaching the second PE node using a shortest path algorithm, and send a first indication message to the first P node to instruct the first P node to perform SA negotiation with the second P node.

[0143] For example, the first indication information may include a first SRv6 policy, an encryption policy identifier, and encryption / decryption parameters. The encryption policy identifier indicates that the first SRv6 policy is an encrypted SRv6 policy. This first SRv6 policy may include a segment list, which includes one or more link SIDs from a first P node to a second P node. Each link SID indicates that the corresponding P node forwards packets through the corresponding link. The encryption / decryption parameters may include the security protocol used, the secure encapsulation type of the data, the encryption and verification algorithm, the key exchange algorithm, etc.

[0144] For example, such as Figure 11 As shown, PE1 is the first PE node, PE2 is the second PE node, P1 is the first P node, P2 is the second P node, and the SID of the link between P1 and P2 is End.X-SID2. Therefore, the segment list of the first SRv6 policy includes (End.X-SID2).

[0145] In other embodiments, during the creation of the second SRv6 policy, if the control node determines, based on the encryption resource information of the first PE node and the decryption resource information of the second PE node, that the first PE node cannot perform encryption operations and the second PE node cannot perform decryption operations, and / or if the control node determines, based on the user-pre-configured unencrypted link, that the first PE node does not need to perform encryption operations and the second PE node does not need to perform decryption operations, then the control node may first perform path calculation based on the first PE node and the second PE node to obtain at least one candidate path. Then, based on the encryption and decryption resource information of each P node between the first PE node and the second PE node, the control node may select a first path from the at least one candidate path that includes a first P node capable of performing encryption operations and a second P node capable of performing decryption operations, and send a first indication message to the first P node to instruct the first P node and the second P node to perform SA negotiation. The implementation of the first indication message can be referred to the above description and will not be repeated here.

[0146] b412: The first P node generates the first encrypted SID based on the first indication information.

[0147] After receiving the first indication information, the first P node can generate a first encrypted SID based on the first indication information. The state of the first encrypted SID is the initial state.

[0148] In one example, the first P node can generate a first encrypted SID based on its own locator. In this case, the first encrypted SID includes a locator segment and a function segment. The value of the locator segment is the locator of the first P node, and the value of the function segment is used to indicate the encryption operation; for example, the value of the function segment is a first function value.

[0149] In another example, the first P node can generate a first encrypted SID based on its own locator and the first SPI carried in the first indication information. In this case, the first encrypted SID includes a locator segment, a function segment, and an arguments segment. The locator segment contains the locator of the first P node, the function segment indicates the encryption operation, and the arguments segment contains the first SPI.

[0150] b413: The first P node uses the IGP extended protocol to negotiate the SA with the second P node to obtain the first SA information and the second decrypted SID.

[0151] After generating the first encrypted SID, the first P node can use the IGP extended protocol to negotiate SA with the second P node to create the first SA tunnel with the first P node as the head node and the second P node as the tail node.

[0152] As an example, a first P node can generate a first message including an SRv6 Locator type length value (TLV). The first P node can flood this first message in the IGP domain. The SRv6 Locator TLV of the first message carries a first encrypted SID, encryption / decryption parameters from the first indication information, first key information, and IPv6 router identifiers (Router-IDs) for both the first and second P nodes. The first key information may include a first SPI and first key material calculated by the first P node based on the key exchange algorithm in the encryption / decryption parameters. After receiving the first message from the first P node, the second P node can perform calculations based on the first key material to obtain second key information, create a decryption tunnel based on the encryption / decryption parameters carried in the first message, and generate a second decryption SID, which is in an UP state. Subsequently, the second P node can send the second key information, encryption / decryption parameters, and second decryption SID to the first P node in a second message. This second message also includes an SRv6 Locator TLV, which carries the second decryption SID, encryption / decryption parameters, and second key information. The second key information includes the second key material calculated by the second P node based on the key exchange algorithm. Additionally, the second P node can calculate the first key based on the first key material and store the first key, first key information, and second key information. After receiving the second key information from the second P node, the first P node can calculate the first key based on the second key material in the second key information and store the first key, second key information, and the aforementioned first key information accordingly. Thus, the SA negotiation between the first and second P nodes is completed, the first SA tunnel is successfully created, and the first SA information corresponding to this first SA tunnel can include the first key, first key information, and second key information. The state of the first encrypted SID also changes to the UP state.

[0153] It should be noted that the SRv6 Locator TLV can include an SRv6 SID sub-TLV, and the SRv6 SID sub-TLV can further include an SRv6 SID sub-sub-TLV. Based on this, the first P node and the second P node can carry the SID in the SRv6 SID sub-TLV, and the SRv6 SID sub-sub-TLV can carry encryption / decryption parameters and key information. For example, taking the SRv6 Locator TLV in the first message sent by the first P node as an example, the format of the SRv6 SID sub-sub-TLV in this first message can be as follows: Figure 12 As shown, in this SRv6 SID sub-sub-TLV, the type field can carry a first type value, which indicates that the TLV carries key information; the length field carries a value indicating the length of the subsequent value field; the value field can carry the first SPI, security encapsulation type, encryption algorithm, source IPv6 Router-ID, destination IPv6 Router-ID, and first key material. The source IPv6 Router-ID is the IPv6 Router-ID of the first P node, and the destination IPv6 Router-ID is the IPv6 Router-ID of the second P node. It can be understood that... Figure 12 The value field shown can carry more or less information, as long as it ensures that the first P node and the second P node can successfully complete the SA negotiation. For example, if the second P node and the first P node have not agreed on the key exchange algorithm in advance, the value field of the SRv6 SID sub-sub-TLV of the first message mentioned above can also carry the key exchange algorithm in the encryption and decryption parameters.

[0154] Furthermore, in this embodiment, the second P node can generate a second decryption SID based on its own locator. In this case, the second decryption SID includes a locator segment and a function segment. The value of the locator segment is the locator of the second P node, and the value of the function segment is used to indicate the decryption operation; for example, the value of the function segment is a second function value.

[0155] Alternatively, the second P node can generate a second decryption SID based on its own locator and the first SPI. In this case, the second decryption SID includes a locator segment, a function segment, and an arguments segment. The locator segment contains the locator of the second P node, the function segment indicates the decryption operation, and the arguments segment contains the first SPI.

[0156] It should be noted that, for the aforementioned first encrypted SID and second decrypted SID, this application embodiment can also define corresponding additional behavior (flavor), wherein the flavor is used to identify whether the corresponding SID is used for encryption or decryption. Based on this, in this application embodiment, the first encrypted SID and the second decrypted SID can also carry this flavor.

[0157] After obtaining the first SA information, the first P node can create a mapping relationship between the first encrypted SID and the first SA information. Similarly, after obtaining the first SA information, the second P node can create a mapping relationship between the second decrypted SID and the first SA information.

[0158] b414: The first P node obtains the first SRv6 policy and the first BSID based on the first encrypted SID and the second decrypted SID.

[0159] After successfully creating the first SA tunnel and obtaining the first SA information, the first encrypted SID, and the second decrypted SID, the first P node can obtain the first SRv6 policy and the first BSID based on the first encrypted SID and the second decrypted SID.

[0160] If the first instruction information includes a first SRv6 policy, the first P node can update the first SRv6 policy based on the first encrypted SID and the second decrypted SID.

[0161] In one example, the first P node can assign a BSID specifically for identifying the first SRv6 policy based on its own locator. Based on this, the first P node can add the first encrypted BSID and the second decrypted BSID to the segment list of the first SRv6 policy.

[0162] For example, see Figure 11 The segment list of the first SRv6 policy issued in the first instruction message is (End.X-SID2), the first encrypted SID is End-enSID, and the second decrypted SID is End-deSID. Then the updated segment list is (End-enSID, End.X-SID2, End-deSID). The order of the SIDs in parentheses is the order in which the SIDs are processed.

[0163] In another example, the first P node can also use the first encrypted SID as the first BSID. In this case, the first encrypted SID is used not only to instruct the first P node to perform encryption operations based on the first SA information, but also to identify the first SRv6 policy. Based on this, the first P node may not add the first encrypted SID to the segment list of the first SRv6 policy, but only add the second decrypted SID to the segment list.

[0164] Optionally, if the first indication information does not include the first SRv6 policy, the first P node may create the first SRv6 policy based on the first encrypted SID and the first decrypted SID.

[0165] The first P node can first determine the first BSID by referring to the method described above. Then, if the first BSID is a BSID specifically used to identify the first SRv6 policy, the first P node can generate a segment list based on the first encrypted SID, the second decrypted SID, and the SID of the link from the first P node to the second P node. If the first BSID is the first encrypted SID, the first P node can generate a segment list based on the second decrypted SID and the SID of the link from the first P node to the second P node. Finally, the first P node can generate the first SRv6 policy based on the first BSID and the segment list.

[0166] b415: The first P node sends the first BSID to the control node. The first SID is the first BSID.

[0167] After obtaining the first BSID used to identify the first SRv6 policy, the first P node can send the first BSID to the control node.

[0168] Optionally, the first P node can also flood the information of the first encrypted SID, the second decrypted SID, and the head and tail nodes of the first SA tunnel to a PE node with BGP-LS capabilities via the IGP protocol, and the PE node can then use BGP-LS node routing to report the above information to the control node. In this case, the head node of the first SA tunnel is the first P node, and the tail node is the second P node.

[0169] Method C: The control node can control the first P node and the second P node to negotiate the SA to create a first SA tunnel. Based on this, the control node can obtain the first SID based on the first SPI used by the first P node or the second P node to identify the first SA information. For example, see... Figure 13 The process may include the following steps:

[0170] c411: The control node sends a first indication message to the first P node, which is used to indicate that SA negotiation should be performed.

[0171] The implementation method for this step can refer to the implementation method of b411 mentioned above.

[0172] c412: Based on the first indication information, the first P node uses the IGP extended protocol to negotiate the SA with the second P node and obtain the first SA information.

[0173] The implementation method of this step can refer to the implementation method of b413 mentioned above. The difference from b413 is that in this step, the first P node and the second P node do not need to carry the SID in the messages they send to each other when they are negotiating SA.

[0174] c413: The first P node sends the first SPI to the control node.

[0175] In this implementation, after obtaining the first SA information, the first P node can send the first SPI, which is used to uniquely identify the first SA information, to the control node.

[0176] The first P node can flood the first SPI to the PE node with BGP-LS capability through the IGP protocol, and the PE node can then use the BGP-LS node routing to report the first SPI to the control node.

[0177] It should be noted that the first P node can also flood the information of the head node and tail node of the first SA tunnel along with the first SPI to the PE node deployed with BGP-LS features via the IGP protocol. The PE node then uses BGP-LS node routing to report the above information to the control node. In this case, the head node of the first SA tunnel is the first P node, and the tail node is the second P node.

[0178] c414: The control node determines the first SID based on the first SPI.

[0179] After receiving the first SPI, the control node can generate a first SID based on the first SPI and the SID of the link from the first P node to the second P node. In addition, it can also generate a second SID based on the first SPI and the SID of the link from the second P node to the second PE node.

[0180] The first SID includes a locator segment, a function segment, and an arguments segment. The value of the locator segment is the locator of the first P node, the value of the arguments segment is the first SPI, and the value of the function segment can be used to instruct the first P node to forward packets through the corresponding link. In this case, the link is the link to the second P node.

[0181] In addition, the second SID also includes a locator segment, a function segment, and an arguments segment. The value of the locator segment is the locator of the second P node, the value of the arguments segment is the first SPI, and the value of the function segment can be used to instruct the second P node to forward packets through the corresponding link. In this case, the link is the link to the second PE node.

[0182] For example, with Figure 8 Taking the PE and P nodes shown as an example, P1 is the first P node, and P2 is the second P node. The SID of the link from P1 to P2 is End.X-SID2. A portion of the original function segment in this link's SID can be used as the arguments segment to carry the first SPI, thus obtaining the first SID. That is, the first SID is End.X-(SID2+SPI). Similarly, the SID of the link from P2 to PE2 is End.X-SID3, so the second SID is End.X-(SID3+SPI).

[0183] Method D: The control node can create a second SRv6 policy with the first PE node as the head node and the second PE node as the tail node based on the user's or the first PE node's SRv6 encryption policy creation request. During the creation of the second SRv6 policy, the control node can perform path calculation based on the first and second PE nodes. During path calculation, if the control node determines, based on the encryption resource information of the first PE node and the decryption resource information of the second PE node, that the first PE node cannot perform encryption and the second PE node cannot perform decryption, and / or, if the control node determines, based on the user-pre-configured unencrypted link, that the first PE node does not need to perform encryption and the second PE node does not need to perform decryption, then the control node can determine the first P node to perform encryption and the second P node to perform decryption based on the encryption and decryption resource information of each P node between the first and second PE nodes. The relevant implementation methods can be referred to the description in a413 above, and will not be repeated here. After determining the first and second P nodes, the control node can generate first SA information including encryption / decryption parameters, a first SPI, and a first key, and send this first SA information to the first and second P nodes. Based on this, the control node can generate a first SID and a second SID based on the first SPI and refer to the aforementioned introduction of c414.

[0184] It should be noted that in this implementation, the control node can send the first SA information to the first P node and the second P node in encrypted form. Furthermore, when sending the first SA information to the first and second P nodes, the control node can also send the encryption resource requirements for the services to be transmitted in the first SA tunnel indicated by the first SA information to the first P node, and the decryption resource requirements for the services to be transmitted in the first SA tunnel to the second P node. Based on this, the first P node can allocate corresponding encryption resources for the first SA tunnel based on the first SA information and the encryption resource requirements, and the second P node can allocate corresponding decryption resources for the first SA tunnel based on the first SA information and the decryption resource requirements. This achieves advance planning of encryption and decryption resources.

[0185] S42: The control node sends the first SID to the first PE node.

[0186] In some embodiments, as described above, the control node can trigger the acquisition of a first SID after receiving an SRv6 encryption policy creation request that requests the creation of an SRv6 encryption policy from a first PE node to a second PE node. In this case, after obtaining the first SID, the control node can issue a second SRv6 policy from the first PE node to the second PE node. This second SRv6 policy includes path information of a first path, which passes through a first P node, and this path information includes the first SID. The first P node may be an encryption execution node or a decryption execution node.

[0187] Optionally, after passing through the first P node, the first path may also pass through a second P node, and the path information of the first path may also include a second SID. In this case, the first P node is the encryption execution node, and the second P node is the decryption execution node.

[0188] In one scenario, during the process of determining the encryption execution node and / or decryption execution node, the control node calculates a first path from the first PE node to the second PE node and generates initial path information to characterize this first path. This initial path information can be an initial segment list, which may include the SIDs of each link from the first PE node to the second PE node. Based on this, after obtaining the first SID, the control node can update the initial segment list, and the updated segment list becomes the path information for the first path.

[0189] For example, such as Figure 6As shown, the first PE node is PE1, and the second PE node is PE2. The path from PE1 to PE2 passes through P1 and P2, where P1 is the encryption execution node and PE2 is the decryption execution node. The SID of the link from PE1 to P1 is End.X-SID1, the SID of the link from P1 to P2 is End.X-SID2, the SID of the link from P2 to PE2 is End.X-SID3, and the SID of PE2 is End-SID4. Based on this, the initial segment list representing the first path is (End.X-SID1, End.X-SID2, End.X-SID3, End-SID4). Based on this, when the first SID is the first encrypted SID, that is, when the value of the function segment of the first SID is used to indicate the encryption operation, the segment list updated based on the first SID can be (End.X-SID1, End-enSID, End.X-SID2, End.X-SID3, End-SID4), where End-enSID is the first encrypted SID.

[0190] Alternatively, in one possible scenario, the first SID can also be obtained by carrying the first SPI as an arguments segment in the function segment of the SID of the link from node P1 to node P2. In this case, the first SID will be End.X-(SID2+SPI), and the segment list updated based on the first SID can be (End.X-SID1, End.X-(SID2+SPI), End.X-SID3, End-SID4).

[0191] For example, such as Figure 7 As shown, PE1 is the encryption execution node, and P2 is the decryption execution node. The initial segment list used to represent the first path is (End.X-SID1, End.X-SID2, End.X-SID3, End-SID4). Based on this, when the first SID is the first decryption SID, that is, when the value of the function segment of the first SID is used to indicate the decryption operation, the segment list updated based on the first SID can be (End.X-SID1, End.X-SID2, End-deSID, End.X-SID3, End-SID4), where End-deSID represents the first decryption SID.

[0192] Alternatively, in one possible scenario, the first SID can also be obtained by carrying the first SPI as an arguments segment in the function segment of the SID of the link from the P2 node to the PE2 node. In this case, the first SID will be End.X-(SID3+SPI), and the segment list updated based on the first SID can be (End.X-SID1, End.X-SID2, End.X-(SID3+SPI), End-SID4).

[0193] For example, such as Figure 11 As shown, node P1 is the encryption execution node, and node P2 is the decryption execution node. The initial segment list used to represent the first path is (End.X-SID1, End.X-SID2, End.X-SID3, End-SID4). Based on this, when the first SID is the first BSID, the segment list updated based on the first SID can be (End.X-SID1, BSID1, End.X-SID3, End-SID4), where BSID1 represents the first BSID.

[0194] Optionally, in one possible scenario, the first SID can be obtained by carrying the first SPI as an arguments segment from the function segment of the SID of the link from node P1 to node P2, and the control node also obtains a second SID, which is obtained by carrying the first SPI as an arguments segment from the function segment of the SID of the link from node P2 to node PE2. In this case, the first SID will be End.X-(SID2+SPI), the second SID will be End.X-(SID3+SPI), and the segment list updated based on the first SID and the second SID can be (End.X-SID1, End.X-(SID2+SPI), End.X-(SID3+SPI), End-SID4).

[0195] In other embodiments, a second SRv6 policy is pre-configured on the first PE node. This second SRv6 policy includes an encryption policy identifier and an initial segment list for the first path. In this case, the control node can directly issue a first SID to the first PE node. After receiving the first SID, the first PE node can update the initial segment list in the second SRv6 policy based on the first SID, using the method described above, to obtain the SRv6 encryption policy.

[0196] Optionally, if a second SID exists, the control node can also send the second SID to the first PE node. Based on this, the first PE node can refer to the method described above to update the initial segment list in the second SRv6 policy based on the first SID and the second SID, thereby obtaining the SRv6 encryption policy.

[0197] After obtaining the second SRv6 policy containing the first SA tunnel through the above method, the first PE node can use the second SRv6 policy to forward packets through S43 to S46.

[0198] S43: The first PE node receives the first message.

[0199] In this embodiment, the first PE node can receive a first message sent by the first CE node. This first message can be a service message for a first service sent to the second CE node.

[0200] S44: The first PE node sends a first message through the first path. The first SRH of the first message includes the first SID, and the first path includes the first P node.

[0201] Upon receiving the first message, the first PE node can detect whether the first message conforms to the flow characteristic information in the first security policy. If the first message conforms to the flow characteristic information in the first security policy, and if the first PE node is an encryption execution node, then the first PE node can use the first SA information to encrypt the message payload of the first message and encapsulate the first message with a first SRH based on the second SRv6 policy. If the first PE node is not an encryption execution node, then the first PE node does not encrypt the payload of the first message and directly encapsulates the first message with a first SRH. The segment list of the first SRH is the segment list in the second SRv6 policy. Therefore, the segment list of the first SRH includes the first SID. Optionally, the segment list of the first SRH may also include a second SID.

[0202] It should be noted that if the first SID is a SID generated based on the link SID and the first SPI, the first PE node can also carry first identification information in the flag field of the first SRH. This first identification information is used to identify the encryption and decryption operation. In other words, this first identification information is used to indicate that the first message is a message that needs to be transmitted in encryption.

[0203] For example, see Figure 14The first SRH includes a next header field, an extended header length field, a routing type field, a segment left (SL) field, a last entry field, a flag field, a tag field, a segment list, and an optional TLV field. The flag field consists of 8 bits. In this embodiment, the first identification information can be carried using reserved bits of the flag field; for example, the first identification information can be carried using the last bit of the flag field, and the first identification information can be 1. Furthermore, when the segment list in the first SRv6 policy is (End.X-SID1, End.X-(SID2+SPI), End.X-(SID3+SPI), End-SID4), the segment list in the first SRH is as follows: Figure 14 As shown, in the segment list of the first SRv6 policy, each SID is arranged in reverse order in the first SRH. That is, the last SID in the segment list of the first SRH will be the first SID to be processed, the second to last SID will be the second SID to be processed, and so on, with the first SID being the last SID to be processed.

[0204] After encapsulating the first SRH into the first message, the first PE node can send the first message to the next hop node based on the link indicated by the first pending SID in the segment list of the first SRH.

[0205] S45: The first P node performs a first operation on the first message based on the first SA information indicated by the first SID in the first message, and obtains the processed first message.

[0206] After the first PE node sends the first message, the first message will be forwarded along the links indicated by the SIDs in the segment list of the first SRH, thus reaching the first P node. After receiving the first message, the first P node will recognize that the first SID in the first SRH is its own generated SID. Then, the first P node can perform encryption or decryption operations on the first message based on the first SA information indicated by the first SID, thereby obtaining the processed first message.

[0207] In the first example, the first SID is a first encrypted SID. The first P node determines that the first SID is a self-generated SID based on the locator segment of the first SID, that is, the first SID is the SID to be processed by the first P node. In this case, the first P node can determine that it needs to perform encryption on the first message by using the value of the function segment of the first SID. If the first SID also includes an arguments segment carrying the first SPI, the first P node can obtain the first SA information based on the first SPI, and then use the first SA information to encrypt the payload of the first message. If the first SID does not include an arguments segment carrying the first SPI, the first P node can obtain the first SA information corresponding to the first SID from its own stored mapping relationship of SID and SA information, and then use the first SA information to encrypt the payload of the first message.

[0208] In the second example, the first SID is the first decryption SID. The first P node determines that the first SID is a self-generated SID based on the locator segment of the first SID, that is, the first SID is the SID to be processed by the first P node. In this case, the first P node can determine that it needs to perform a decryption operation on the first message through the value of the function segment of the first SID. If the first SID also includes an arguments segment carrying the first SPI, the first P node can obtain the first SA information based on the first SPI, and then use the first SA information to decrypt the payload of the first message. If the first SID does not include an arguments segment carrying the first SPI, the first P node can obtain the first SA information corresponding to the first SID from its own stored mapping relationship of SID and SA information, and then use the first SA information to decrypt the payload of the first message.

[0209] In the two examples above, after the first P node encrypts or decrypts the payload of the first message based on the first SID, it can decrement the value of the SL field of the first SRH by 1, thereby pointing to the next SID to be processed.

[0210] In the third example, the first SID is the first BSID. The first P node determines that the first BSID is a self-generated BSID based on the locator segment of the first BSID. If the first BSID is the first encrypted SID, the first P node can identify the first encrypted SID using the method described above, and then encrypt the payload of the first message using the first SA information. Afterward, the first P node can determine the first SRv6 policy identified by the first BSID, and encapsulate the first message with a second SRH based on the segment list in the first SRv6 policy, where the segment list in the second SRH is the segment list in the first SRv6 policy. If the first BSID is a BSID specifically used to identify the first SRv6 policy, the first P node can first encapsulate the first message with a second SRH based on the segment list in the first SRv6 policy, where the segment list in the second SRH is the segment list in the first SRv6 policy. Then, the first P node can identify the first SID in the segment list of the second SRH as the first encrypted SID, and thus encrypt the payload of the first message based on the first encrypted SID.

[0211] After encrypting the payload of the first message, the first P node can decrement the value of the SL field of the second SRH by 1, thus pointing to the next SID to be processed.

[0212] In the fourth example, the first SID is a SID generated based on the link SID and the first SPI, and the first SRH's flag field carries first identification information. Based on this first identification information, the first P node can determine that the first message is a message to be encrypted and transmitted, that is, the first message is a message transmitted through the SA tunnel. Furthermore, the first P node determines that the first SID is a self-generated SID based on the locator segment of the first SID, that is, the first SID is the SID to be processed by the first P node, and the first P node identifies that the first SID includes an arguments segment, and the arguments segment carries the first SPI. Thus, the first P node can determine whether it needs to perform encryption or decryption operations on the first message. Based on this, the first P node obtains the first SA information based on the first SPI and checks whether the first message has been encrypted. If the first message is not encrypted, the first P node uses the first SA information to encrypt the payload of the first message. If the first message has been encrypted, the first P node uses the first SA information to decrypt the payload of the first message.

[0213] It should be noted that in S44 and S45 above, after encrypting the payload of the first message, the first P node or the first PE node will also add an encapsulating security payload (ESP) header between the encrypted payload and the SRH for the first message. The ESP header will carry the first SPI.

[0214] S46: The first P node sends the processed first message.

[0215] When the first SID is the first encrypted SID, the first decrypted SID, or the first BSID, after encrypting or decrypting the payload of the first packet, the first P node decrements the value of the SL field of the first SRH or the second SRH by 1 to proceed with the next pending SID. As shown in the segment list of the first SRv6 policy described above, the next SID after the first SID is the SID of the link from the first P node to the second P node. Based on this, the first P node will identify the next pending SID as the SID of its corresponding link. Therefore, the first P node can decrement the value of the SL field in the first SRH or the second SRH by 1 again and forward the processed first packet based on the link indicated by that link SID.

[0216] For example, with Figure 6 Taking the scenario shown as an example, under the instruction of the End-enSID in the first SRH, the first P node encrypts the payload of the first message using the first SA information, and then decrements the value of the SL field of the first SRH by 1 to point to the next SID to be processed, which is End.X-SID2. Since End.X-SID2 is still the link SID corresponding to the first P node, the first P node decrements the SL field by 1 again. Then, based on the link indicated by End.X-SID2, the first message is forwarded to the second P node.

[0217] When the first SID is a SID generated based on the link SID and the first SPI, that is, the first SID is the link SID, after the first P node encrypts or decrypts the payload of the first message, it can decrement the value of the SL field of the first SRH by 1 and forward the processed first message through the link indicated by the first SID.

[0218] For example, with Figure 8 Taking the scenario shown as an example, the first P node, under the guidance of the first identification information and End.X-(SID2+SPI) in the first SRH, encrypts the payload of the first message using the first SA information, decrements the value of the SL field of the first SRH by 1, and forwards the first message to the second P node based on the link indicated by End.X-(SID2+SPI).

[0219] Subsequently, the processed first message will continue to be forwarded downwards along the first SRH, or the first path indicated by the segment list in the first SRH and the second SRH. If the first P node is the encryption execution node and the second PE node is not the decryption execution node, then when the encrypted first message arrives at the second P node, which is the decryption execution node, the second P node will, as described in S45 and S46, decrypt the first message using the first SA information under the indication of the second decryption SID or the second SID, and forward the decrypted first message to the second PE node. Of course, if the second PE node is the decryption execution node, after the encrypted first message is forwarded to the second PE node along the first path, the second PE node can obtain the first SA information based on the first SPI carried in the ESP header of the first message, and then use the first SA information to decrypt the payload of the first message.

[0220] In this embodiment, the control node can obtain a first SID used to instruct the first P node to perform encryption or decryption operations based on the first SA information, and then distribute the first SID to the first PE node. Based on this, when the first PE node receives a first message destined for the second PE node via the first P node and requiring transmission through the SA tunnel, it can encapsulate the first SID in the first SRH of the first message. Thus, after receiving the first message, the first P node can, under the guidance of the first SID, perform encryption or decryption operations on the first message using the first SA information, and forward the processed message. This achieves encryption or decryption of messages by the P node, reduces the network requirements for secure message transmission, and provides a more flexible message encryption / decryption method, better meeting user needs.

[0221] Furthermore, in this embodiment, PE nodes and each P node can flood their resource information to PE nodes deployed with BGP-LS capabilities via the IGP protocol, and the PE nodes then report the resource information of each node to the control node. Based on this, the control node can schedule which node performs encryption and which performs decryption operations according to the resource information of each node, achieving flexible scheduling of encryption and decryption resources and making full and reasonable use of the nodes' encryption and decryption resources. Especially in the event of failure of the ingress PE node and / or egress PE node, secure message transmission can still be achieved, improving service reliability.

[0222] It is also worth noting that, in the embodiments of this application, the first SID can be obtained by carrying the first SPI as a function segment in the link SID as an agurements segment. Based on this, carrying the first SID in the first SRH of the first message will not cause additional bandwidth expansion, thereby helping to reduce communication costs.

[0223] Finally, in this embodiment, PE nodes can negotiate SA based on the BGP extended protocol to create a first SA tunnel, or P nodes can negotiate SA based on the IGP extended protocol to create a first SA tunnel. Compared with IPsec technology, point-to-point configuration is not required, which improves operation and maintenance efficiency and reduces operation and maintenance costs.

[0224] Based on the above embodiments, in some possible scenarios, such as Figure 3 As shown, the first PE node can connect to the first CE node, the second PE node can connect to the second CE node, and the second CE node can also connect to the third PE node. Furthermore, the first link between the second PE node and the second CE node, and the second link between the third PE node and the second CE node, are aggregated links. In this case, the control node can also obtain a third SID and send it to the first PE node. This third SID is used to instruct the third P node to perform a first operation based on the second SA information. Subsequently, when the first PE node receives a second message destined for the second CE node, it can send the second message to the third PE node through a second path. The SRH of the second message may include the third SID, and the third P node is an intermediate node on this second path.

[0225] It should be noted that the process of the control node obtaining the third SID and sending the third SID to the first PE node can refer to the process of obtaining the first SID and sending the first SID to the first PE node in the aforementioned embodiments. Furthermore, when the first PE node receives the second message to be sent to the second CE node, the process of the first PE node sending the second message through the second path and the processing of the second message by the third P node during the forwarding process of the second message can all refer to the description of the forwarding process of the first message in S44 to S46 of the aforementioned embodiments, and will not be repeated here.

[0226] Optionally, in one possible scenario, if the control node obtains the first SA information and the second SA information through SA negotiation between the first PE node and the second PE node and the third PE node respectively during the process of obtaining the first SID and the third SID, then during the SA negotiation between the first PE node and the second PE node and the third PE node using the BGP extended protocol, if the second PE node and the third PE node have decryption resources, they can carry their own decryption resource information in the ES-AD route sent to the first PE node to indicate their remaining decryption resources. Based on this, when the second PE node acts as the decryption execution node on the first path from the first PE node to the second PE node, and the third PE node acts as the decryption execution node on the second path, for the first service packet to be sent to the second CE node through the SA tunnel, the first PE node can perform unequal cost multipath (UCMP) load balancing on the first service packet based on the remaining decryption resources of the second PE node and the third PE node, thereby distributing the first service packet to the first path and the second path for transmission. In this way, on the one hand, the encryption and decryption resources of multi-homed nodes in multi-homed scenarios can be fully utilized to improve resource utilization; on the other hand, the traffic congestion or even interruption that may be caused by traffic transmission through a single path can also be alleviated.

[0227] The above mainly introduced the multi-homing scenario at the destination. In other possible scenarios, the first CE node can also be connected to a fourth PE node, and the link between the fourth PE node and the first CE node is an aggregated link with the link between the first PE node and the first CE node. That is, the fourth PE node and the first PE node are dual-homed nodes of the first CE node. In this case, the fourth PE node can also negotiate SA with the second PE node to create an SA tunnel. Based on this, if both the first PE node and the fourth PE node are encryption execution nodes, when the first CE node sends a packet of the first service to be transmitted through the SA tunnel to the second CE node, it can also perform UCMP load balancing on the packet of the first service based on the encryption resource information of the first PE node and the fourth PE node, thereby distributing the load to the first PE node and the fourth PE node. Then, the first PE node and the fourth PE node each use their corresponding path to the second PE node or the third PE node, which contains the SA tunnel, to forward the corresponding packet.

[0228] The communication device provided in the embodiments of this application will be described next.

[0229] Figure 15 This is a schematic diagram of a communication device provided in an embodiment of this application. The communication device 1500 can be deployed in a network device to implement the functions of the first P node in the aforementioned embodiment. For example... Figure 15 As shown, the communication device 1500 includes: a receiving module 1501, a processing module 1502, and a transmitting module 1503.

[0230] The receiving module 1501 is used to receive the first message after S44 in the aforementioned embodiment, the processing module 1502 is used to execute S45 in the aforementioned embodiment, and the sending module 1503 is used to execute S46 in the aforementioned embodiment.

[0231] Optionally, the first SID is a first encrypted SID generated by the first P node, and the value of the functional segment of the first encrypted SID is used to indicate the encryption operation. The first P node stores the mapping relationship between the first encrypted SID and the first SA information; or, the first SID is a first decrypted SID generated by the first P node, and the value of the functional segment of the first decrypted SID is used to indicate the decryption operation. The first P node stores the mapping relationship between the first decrypted SID and the first SA information.

[0232] Optionally, the receiving module 1501 is further configured to: receive first SA information sent by the control node, wherein the first SA information is obtained by the first operator edge PE node and the second PE node through SA negotiation; the sending module 1503 is further configured to send a first SID to the first PE node through the control node, wherein the first message is a message sent from the first PE node through the first P node to the second PE node.

[0233] Optionally, the first SID is a first binding segment identifier BSID, which is used to identify the first SRv6 policy. The segment list of the first SRv6 policy includes the first encryption SID of the first P node and the second decryption SID of the second P node. The value of the function segment of the first encryption SID is used to indicate the encryption operation. The first P node stores the mapping relationship between the first encryption SID and the first SA information. The value of the function segment of the second decryption SID is used to indicate the decryption operation. The second P node stores the mapping relationship between the second decryption SID and the first SA information.

[0234] Optionally, the processed first message may also include a second SRH, which includes a list of segments in the first SRv6 policy.

[0235] Optionally, the device 1500 further includes a security negotiation module 1504, wherein the receiving module 1501 is further configured to receive first indication information sent by the control node, the first indication information being used to indicate SA negotiation; the processing module 1502 is further configured to generate a first encrypted SID based on the first indication information; the security negotiation module 1504 is further configured to perform SA negotiation with the second P node based on the IGP extended protocol to obtain the first SA information and the second decrypted SID; the processing module 1502 is further configured to obtain a first SRv6 policy and a first BSID based on the first encrypted SID and the second decrypted SID; the sending module 1503 is further configured to send the first BSID to the first PE node through the control node, wherein the first message is a message sent from the first PE node through the first P node and the second P node to the second PE node.

[0236] Optionally, the flag field of the first SRH carries first identification information, which is used to identify the encryption / decryption operation; the value of the locator field of the first SID is the locator of the first P node; and the value of the parameter field of the first SID is the first security parameter index (SPI) used to identify the first SA information.

[0237] Optionally, the receiving module 1501 is further configured to receive first indication information sent by the control node, the first indication information being used to indicate SA negotiation; the security negotiation module 1504 is configured to perform SA negotiation with the second P node based on the Interior Gateway Protocol (IGP) to obtain first SA information; the processing module 1502 is further configured to obtain a first SPI based on the first SA information; the sending module 1503 is further configured to send the first SPI to the control node, the control node being configured to send a first SID to the first PE node based on the first SPI, wherein the first message is a message sent from the first PE node through the first P node to the second PE node.

[0238] In this embodiment, the SRH of the first message sent to the first P node may include the first SID of the first P node. The first SID can instruct the first P node to perform a first operation based on the first SA information. In this way, the first P node can perform encryption or decryption operations on the first message according to the instruction of the first SID and the first SA information, and then send the processed message. This realizes the encryption or decryption of the message by the P node, reduces the network requirements for secure message transmission, and makes the implementation of message encryption and decryption more flexible.

[0239] Figure 16 This is a schematic diagram of another communication device provided in an embodiment of this application. This communication device 1600 can be deployed in a network device to implement the related functions of the control node in the aforementioned embodiments. For example... Figure 16 As shown, the communication device may include a control module 1601 and a transmission module 1602.

[0240] The control module 1601 is used to execute the relevant steps of the control node in S41 of the aforementioned embodiment. The sending module 1602 is used to execute S42 of the aforementioned embodiment.

[0241] Optionally, the communication device 1600 further includes a receiving module 1603, and a control module 1601 is specifically used to control the receiving module 1603 to receive first SA information from the first PE node, the first SA information being obtained by the first PE node and the second PE node through SA negotiation; control the sending module 1602 to send the first SA information to the first P node; and control the receiving module 1603 to receive the first SID from the first P node.

[0242] Optionally, the first SID is a first encrypted SID, the value of the functional segment of the first encrypted SID is used to indicate the encryption operation, and the first P node stores the mapping relationship between the first encrypted SID and the first SA information; or, the first SID is a first decrypted SID, the value of the functional segment of the first decrypted SID is used to indicate the decryption operation, and the first P node stores the mapping relationship between the first decrypted SID and the first SA information.

[0243] Optionally, the control module 1601 is specifically used to: control the sending module 1602 to send first indication information to the first P node, the first indication information being used to instruct the first P node to negotiate SA with the second P node to obtain first SA information; and control the receiving module 1603 to receive the first SID from the first P node.

[0244] Optionally, the first SID is the first BSID, which is used to identify the first SRv6 policy. The first SRv6 policy includes the first encrypted SID of the first P node and the second decrypted SID of the second P node. The value of the functional segment of the first encrypted SID is used to indicate the encryption operation. The first P node stores the mapping relationship between the first encrypted SID and the first SA information. The value of the functional segment of the second decrypted SID is used to indicate the decryption operation. The second P node stores the mapping relationship between the second decrypted SID and the first SA information.

[0245] Optionally, the control module 1601 is specifically configured to: control the sending module 1602 to send first indication information to the first P node, the first indication information being used to instruct the first P node to negotiate SA with the second P node to obtain first SA information; control the receiving module 1603 to receive a first SPI from the first P node or the second P node, the first SPI being used to identify the first SA information; determine a first SID and a second SID, the value of the locator field of the first SID being the locator of the first P node, the value of the parameter field of the first SID being the first SPI, the value of the locator field of the second SID being the locator of the second P node, the value of the parameter field of the second SID being the first SPI, the SRH of the first service message also including the second SID, and the flag field of the SRH of the first service message also carrying first identification information, the first identification information being used to identify encryption and decryption operations.

[0246] Optionally, the receiving module 1603 is further configured to: receive resource information of the first PE node, the second PE node, and a plurality of P nodes, wherein the plurality of P nodes are P nodes traversed from the first PE node to the second PE node, the plurality of P nodes include the first P node, and the resource information includes encrypted resource information and decrypted resource information; the control module 1601 is further configured to determine the first P node from the plurality of P nodes based on the resource information of the first PE node, the second PE node, and the plurality of P nodes.

[0247] In this embodiment, the control node can obtain a first SID used to instruct the first P node to perform encryption or decryption operations based on the first SA information, and send the first SID to the first PE node, which is the entry PE node. Based on this, the SRH of a first service message sent from the first PE node through the first P node to the second PE node can carry the first SID, thereby instructing the first P node to perform encryption or decryption operations on the message. This enables the P node to encrypt or decrypt the message, reduces the network requirements for secure message transmission, and makes the message encryption and decryption implementation more flexible.

[0248] Figure 17 This is a schematic diagram of another communication device provided in an embodiment of this application. This communication device can be deployed in a network device to implement the functions of the first PE node in the aforementioned embodiments. See also... Figure 17 The communication device 1700 may include a receiving module 1701 and a transmitting module 1702.

[0249] The receiving module 1701 is used to execute S43 in the aforementioned embodiment, and the sending module 1702 is used to execute S44 in the aforementioned embodiment.

[0250] Optionally, the first PE node establishes a communication connection with the first user edge CE node. When the first operation is an encrypted operation, the receiving module 1701 is further configured to receive a third SID from the control node. The third SID is used to instruct the third P node to perform the first operation based on the second SA information. The sending module 1702 is further configured to send a second message to the third PE node through the second path. The SRH of the second message includes the third SID. The third P node is an intermediate node on the second path. Both the second message and the first message are messages of the first service sent from the first CE node to the second CE node. The first link between the second PE node and the second CE node and the second link between the third PE node and the second CE node are aggregated links.

[0251] Optionally, the message of the first service is transmitted to the first path and the second path based on the decryption resource information of the second PE node and the decryption resource information of the third PE node. The decryption resource information is used to indicate the remaining decryption resources of the node.

[0252] Optionally, the decryption resource information of the second PE node is carried via the Ethernet Auto Discovery (ES-AD) route of the Ethernet segment sent by the second PE node to the first PE node, and the decryption resource information of the third PE node is carried via the ES-AD route sent by the third PE node to the first PE node.

[0253] Optionally, the communication device 1700 further includes a processing module 1703, used to obtain decryption resource requirement information for the first service, wherein the first message is a message of the first service; the sending module 1702 is further used to send a first ES-AD route to the second PE node, wherein the first ES-AD route carries first key information and decryption resource requirement information, wherein the first key information is used to calculate the first key, and the decryption resource requirement information is used to instruct the second PE node to allocate corresponding decryption resources for the first service; the receiving module 1701 is further used to receive a second ES-AD route sent by the second PE node, wherein the second ES-AD route carries second key information, wherein the second key information is used to calculate the first key, and the first SA information includes the first key.

[0254] In this embodiment, the first PE node can receive a first SID sent by the control node, which instructs the first P node to perform encryption or decryption operations based on the first SA information. Based on this, the first PE node can send a first message via a first path. The first SRH of the first message includes the first SID, and the first path includes the first P node. Thus, when the first message arrives at the first P node, the first P node can, under the instruction of the first SID, use the first SA information to perform encryption or decryption operations on the first message. This enables the P node to encrypt or decrypt the message, reducing the network requirements for secure message transmission and making message encryption and decryption more flexible.

[0255] It should be noted that the module division in the communication device provided in the above embodiments is illustrative and only represents one logical functional division. In actual implementation, other division methods may also be used. Furthermore, the functional modules in the various embodiments of this application can be integrated into a single processor, exist as separate physical entities, or be integrated into a single module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0256] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solutions of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a router, switch, or other network device) or processor to execute all or part of the steps of the methods in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0257] Furthermore, the communication device and communication method embodiments provided in the above embodiments belong to the same concept, and their specific implementation process can be found in the method embodiments, which will not be repeated here.

[0258] Figure 18 This is a schematic diagram of the structure of a network device provided in an embodiment of this application. The PE node, P node, and control node involved in this embodiment can all be accessed via... Figure 18 This is achieved using the network devices shown. For example... Figure 18 As shown, the network device may include at least one processor 1801, a communication bus 1802, a memory 1803, and a transceiver 1804. It should be noted that... Figure 18 The illustrated device structure does not constitute a limitation on the network device. A network device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. This application's embodiments do not limit this. The following, in conjunction with... Figure 18 A detailed introduction to each component of the network device:

[0259] Processor 1801 is the control center of the network device and can be a single processor or a collective term for multiple processing elements. For example, processor 1801 can be a general-purpose central processing unit (CPU), an application-specific integrated circuit (ASIC), or one or more integrated circuits used to control the execution of programs according to this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs). Processor 1801 can perform various functions of the network device by running or executing software programs stored in memory 1803 and by calling data stored in memory 1803. For example, in the various embodiments described below, the actions of the network device can be executed by the processor of the corresponding device calling data in memory.

[0260] As one embodiment, processor 1801 may include one or more CPUs.

[0261] As one embodiment, a network device may include multiple processors. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Here, a processor may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0262] The communication bus 1802 may include a path for transmitting information between the aforementioned components. This communication bus 1802 may be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus, etc. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, Figure 18 The bus is represented by a single thick line, but this does not mean that there is only one bus or one type of bus.

[0263] The memory 1803 may be a read-only memory (ROM) or other type of static storage device capable of storing static information and instructions, random access memory (RAM) or other type of dynamic storage device capable of storing information and instructions, or it may be an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium capable of carrying or storing desired program code in the form of instructions or data structures and accessible by a computer, but is not limited thereto. The memory 1803 may exist independently and be connected to the processor 1801 via the communication bus 1802. The memory 1803 may also be integrated with the processor 1801. The memory 1803 is used to store software programs that execute the schemes provided in the embodiments of this application, and its execution is controlled by the processor 1801.

[0264] Transceiver 1804 is used to communicate with other devices or communication networks. For example, transceiver 1804 can be used to send and receive messages or data information.

[0265] It should be noted that the aforementioned devices can be disposed on separate chips, or at least partially or entirely on the same chip. Whether the devices are disposed independently on different chips or integrated on one or more chips often depends on the needs of the product design. This application does not limit the specific implementation of the aforementioned devices.

[0266] Figure 19 This is a schematic diagram of another network device structure provided in an embodiment of this application. The PE node and P node involved in this embodiment can also be... Figure 19 The network devices shown are used to implement this.

[0267] like Figure 19 As shown, the network device 1900 includes a main control board 1901 and an interface board 1902. The main control board 1901 and the interface board 1902 can communicate with each other via a system bus connected to the system backplane. The main control board 1901 is used for system management, device maintenance, and protocol processing. The interface board 1902 provides various service interfaces (e.g., POS interface, GE interface, ATM interface, etc.) and enables data packet forwarding.

[0268] For example, the main control board 1901 may include a processor 19011 and a memory 19012. The processor 19011 is used to call program instructions in the memory 19012 to execute corresponding processing functions. For instance, in this embodiment, when the network device 1900 is used to implement the functions of a P-node, the processor 19011 can process information or instructions issued by the control node by calling program instructions in the memory 19012.

[0269] Interface board 1902 may include processor 19021, memory 19022, and interface card 19023. Processor 19021 controls and manages the interface board and communicates with processor 19011 on the main control board. Memory 19022 stores information such as forwarding table entries and program instructions. Processor 19021 can control interface card 19023 to receive and send traffic by calling the information stored in memory 19022. For example, in this embodiment, interface board 1902 can be used to encrypt or decrypt packets and then forward the processed packets based on the link indicated by the corresponding SID.

[0270] Optionally, in this embodiment of the application, the network device 1900 may further include a value-added services board 1903. In this case, the interface board 1902 may be used to forward packets that do not need to be transmitted through the SA tunnel, while the value-added services board 1903 may be used to encrypt or decrypt packets to be transmitted through the SA tunnel, and then forward the processed packets based on the link indicated by the corresponding SID.

[0271] For example, the value-added service board may include a processor 19031, a memory 19032, and an interface card 19033. The processor 19031 is used to control and manage the interface board and communicate with the processor 19011 on the main control board. The memory 19032 is used to store information such as forwarding table entries and program instructions. The processor 19031 can control the interface card 19033 to receive and send value-added service messages by calling the information stored in the memory 19032.

[0272] Furthermore, it should be noted that there may be one or more main control boards, which may include a primary main control board and a backup main control board. There may also be one or more interface boards; the stronger the data processing capability of the network device, the more interface boards it provides. Each interface board may also have one or more physical interface cards. There may also be one or more value-added service boards; the more value-added service boards, the stronger the value-added service processing capability of the network device. Additionally, in a centralized forwarding architecture, the network device may not require a switching board, with the interface boards handling the entire system's service data processing. In a distributed forwarding architecture, the network device may also have at least one switching board, which enables data exchange between multiple interface boards, providing high-capacity data exchange and processing capabilities. Therefore, the data access and processing capabilities of a distributed architecture network device are greater than those of a centralized architecture device. The specific architecture adopted depends on the specific network deployment scenario, and no restrictions are imposed here.

[0273] In the above embodiments, implementation can be achieved, in whole or in part, through software, hardware, firmware, or any combination thereof. When implemented in software, it can be implemented, in whole or in part, as a computer program product. The computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium accessible to a computer or a data storage device such as a server or data center that integrates one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., digital versatile discs (DVDs)), or semiconductor media (e.g., solid-state disks (SSDs)).

[0274] In the various embodiments of this application, unless otherwise specified or logically conflicting, the terminology and / or descriptions between different embodiments are consistent and can be referenced mutually. Technical features in different embodiments can be combined to form new embodiments based on their inherent logical relationships. In the embodiments of this application, "at least one" refers to one or more, and "more than one" refers to two or more. "And / or" describes the association relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone, where A and B can be singular or plural. In the textual description of the embodiments of this application, the character " / " generally indicates that the preceding and following related objects have an "or" relationship. In this application, "first," "second," and various numerical designations are only for ease of description and are not used to limit the scope of the embodiments of this application. For example, they are used to distinguish different messages, rather than to describe a specific order or sequence.

[0275] It is understood that the various numerical designations used in the embodiments of this application are merely for descriptive convenience and are not intended to limit the scope of the embodiments of this application. The order of the process numbers does not imply the order of execution; the execution order of each process should be determined by its function and internal logic.

[0276] Finally, it should be noted that the above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A communication method, characterized in that, Applied to the first operator's P node, the method includes: Receive a first message, wherein the segment identifier SID to be processed in the first segment routing header (SRH) of the first message is a first SID, and the first SID is used to instruct the first P node to perform a first operation based on the first security association (SA) information. Based on the first SA information, the first operation is performed on the first message to obtain the processed first message; Send the processed first message.

2. The method according to claim 1, characterized in that, The first SID is the first encrypted SID generated by the first P node. The value of the function segment of the first encrypted SID is used to indicate the encryption operation. The first P node stores the mapping relationship between the first encrypted SID and the first SA information. Alternatively, the first SID is the first decryption SID generated by the first P node, and the value of the function segment of the first decryption SID is used to indicate the decryption operation. The first P node stores the mapping relationship between the first decryption SID and the first SA information.

3. The method according to claim 2, characterized in that, The method further includes: The first SA information is received from the control node. The first SA information is obtained by the first operator edge PE node and the second PE node through SA negotiation. The first SID is sent from the control node to the first PE node, wherein the first message is a message sent from the first PE node through the first P node to the second PE node.

4. The method according to claim 1, characterized in that, The first SID is a first binding segment identifier (BSID), which is used to identify a first SRv6 policy. The segment list of the first SRv6 policy includes a first encryption SID of the first P node and a second decryption SID of the second P node. The value of the function segment of the first encryption SID is used to indicate the encryption operation. The first P node stores a mapping relationship between the first encryption SID and the first SA information. The value of the function segment of the second decryption SID is used to indicate the decryption operation. The second P node stores a mapping relationship between the second decryption SID and the first SA information.

5. The method according to claim 4, characterized in that, The processed first message also includes a second SRH, which includes the segment list in the first SRv6 policy.

6. The method according to claim 4 or 5, characterized in that, The method further includes: Receive first indication information sent by the control node, the first indication information being used to indicate SA negotiation; Based on the first indication information, the first encrypted SID is generated; Based on the Interior Gateway Protocol (IGP) extension protocol, SA negotiation is performed with the second P node to obtain the first SA information and the second decrypted SID. The first SRv6 policy and the first BSID are obtained based on the first encrypted SID and the second decrypted SID; The first BSID is sent from the control node to the first PE node, wherein the first message is a message sent from the first PE node through the first P node and the second P node to the second PE node.

7. The method according to claim 1, characterized in that, The first SRH's flag field carries first identification information, which is used to identify encryption and decryption operations. The value of the first SID's locator field is the locator of the first P node, and the value of the first SID's parameter field is the first security parameter index (SPI) used to identify the first SA information.

8. The method according to claim 7, characterized in that, The method further includes: Receive first indication information sent by the control node, the first indication information being used to indicate SA negotiation; Based on the IGP extended protocol, SA negotiation is performed with the second P node to obtain the first SA information; Based on the first SA information, obtain the first SPI; The first SPI is sent to the control node, which is used to send the first SID to the first PE node based on the first SPI, wherein the first message is a message sent from the first PE node through the first P node to the second PE node.

9. A communication method, characterized in that, Applied to a control node, the method includes: Obtain a first SID, which is used to instruct the first P node to perform a first operation based on the first SA information, wherein the first operation is an encryption operation or a decryption operation. The first SID is sent to the first PE node, wherein the first SID is included in the SRH of the first service message sent from the first PE node through the first P node to the second PE node.

10. The method according to claim 9, characterized in that, The process of obtaining the first SID includes: Receive the first SA information from the first PE node, wherein the first SA information is obtained by the first PE node and the second PE node through SA negotiation; Send the first SA information to the first P node; Receive the first SID from the first P node.

11. The method according to claim 10, characterized in that, The first SID is a first encrypted SID. The value of the functional segment of the first encrypted SID is used to indicate the encryption operation. The first P node stores the mapping relationship between the first encrypted SID and the first SA information. Alternatively, the first SID is the first decryption SID, the value of the function segment of the first decryption SID is used to indicate the decryption operation, and the first P node stores the mapping relationship between the first decryption SID and the first SA information.

12. The method according to claim 9, characterized in that, The process of obtaining the first SID includes: Send a first indication message to the first P node, the first indication message being used to instruct the first P node to negotiate the SA with the second P node in order to obtain the first SA information; Receive the first SID from the first P node.

13. The method according to claim 12, characterized in that, The first SID is the first BSID, which is used to identify the first SRv6 policy. The first SRv6 policy includes the first encryption SID of the first P node and the second decryption SID of the second P node. The value of the functional segment of the first encryption SID is used to indicate the encryption operation. The first P node stores the mapping relationship between the first encryption SID and the first SA information. The value of the functional segment of the second decryption SID is used to indicate the decryption operation. The second P node stores the mapping relationship between the second decryption SID and the first SA information.

14. The method according to claim 9, characterized in that, The process of obtaining the first SID includes: Send a first indication message to the first P node, the first indication message being used to instruct the first P node to negotiate the SA with the second P node in order to obtain the first SA information; Receive a first SPI from the first P node or the second P node, wherein the first SPI is used to identify the first SA information; The first SID and the second SID are determined. The value of the locator field of the first SID is the locator of the first P node, and the value of the parameter field of the first SID is the first SPI. The value of the locator field of the second SID is the locator of the second P node, and the value of the parameter field of the second SID is the first SPI. The SRH of the first service message also includes the second SID, and the flag field of the SRH of the first service message also carries first identification information, which is used to identify encryption and decryption operations.

15. The method according to any one of claims 9 to 14, characterized in that, Before obtaining the first SID, the process also includes: The system receives resource information from the first PE node, the second PE node, and a plurality of P nodes, wherein the plurality of P nodes are the P nodes traversed from the first PE node to the second PE node, and the plurality of P nodes include the first P node; the resource information includes encrypted resource information and decrypted resource information. Based on the resource information of the first PE node, the second PE node, and the plurality of P nodes, the first P node is determined from the plurality of P nodes.

16. A communication method, characterized in that, Applied to the first PE node, the method includes: Receive a first SID from the control node, the first SID being used to instruct the first P node to perform a first operation based on the first SA information, the first operation being an encryption operation or a decryption operation; A first message is sent to the second PE node via the first path. The first message includes the first SID in the first SRH. The first P node is an intermediate node on the first path.

17. The method according to claim 16, characterized in that, The first PE node establishes a communication connection with the first user edge CE node. When the first operation is an encryption operation, the method further includes: Receive a third SID from the control node, the third SID being used to instruct the third P node to perform the first operation based on the second SA information; A second message is sent to a third PE node via a second path. The SRH of the second message includes the third SID. The third PE node is an intermediate node on the second path. Both the second message and the first message are messages of the first service sent from the first CE node to the second CE node. The first link between the second PE node and the second CE node and the second link between the third PE node and the second CE node are aggregated links.

18. The method according to claim 17, characterized in that, The message of the first service is transmitted on the first path and the second path based on the decryption resource information of the second PE node and the decryption resource information of the third PE node. The decryption resource information is used to indicate the remaining decryption resources of the node.

19. The method according to claim 18, characterized in that, The decryption resource information of the second PE node is carried through the Ethernet Auto Discovery (ES-AD) route of the Ethernet segment sent by the second PE node to the first PE node, and the decryption resource information of the third PE node is carried through the ES-AD route sent by the third PE node to the first PE node.

20. The method according to claim 16, characterized in that, The method further includes: Obtain the decryption resource requirement information for the first service, where the first message is the message for the first service; Send a first ES-AD route to the second PE node. The first ES-AD route carries first key information and decryption resource requirement information. The first key information is used to calculate the first key. The decryption resource requirement information is used to instruct the second PE node to allocate corresponding decryption resources for the first service. The system receives a second ES-AD route sent by the second PE node. The second ES-AD route carries second key information, which is used to calculate a first key. The first SA information includes the first key.

21. A network device, characterized in that, The network device includes a processor for executing at least one program instruction or code stored in a memory to implement the communication method according to any one of claims 1 to 20.

22. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores instructions that, when executed on a network device, cause the network device to perform the communication method according to any one of claims 1 to 20.

Images