Message processing method, device and equipment

Abstract

The invention provides a message processing method, device and equipment, and the method comprises the steps: obtaining a data message which comprises a segment routing tunnel head; obtaining a segment path identifier from the segment routing tunnel head; if an access control strategy corresponding to the segment path identifier exists, the access control strategy comprises path information, and the path information is used for sending a data message to a service node, sending the data message to the service node based on the access control strategy, so that the service node performs security processing on the data message; and if a data message returned by the service node is received, sending the data message based on the segmented routing tunnel head of the data message. According to the scheme of the invention, the access control of the data message can be realized based on the segment path identifier.

Description

A message processing method, device and equipment TECHNICAL FIELD

[0001] The present application relates to the technical field of communication, in particular to a message processing method, device and equipment. BACKGROUND

[0002] Segment routing is an extended source routing technology, a head-end node adds a segment routing list in a data message to guide the data message to be forwarded according to a specific path through the segment routing list, so as to implement traffic engineering. For example, in an IPv6 network, the segment routing list can include IPv6 addresses of nodes on a specific path, and the data message is guided to be forwarded according to the specific path based on the IPv6 addresses.

[0003] Segment routing policy is a tunnel diversion technology based on segment routing technology, and a head-end node encapsulates a segment routing tunnel header for a data message after receiving the data message, the segment routing tunnel header includes a segment routing list, and the segment routing list can include IPv6 addresses of nodes on a specific path, and the nodes on the specific path can forward the data message based on the segment routing tunnel header.

[0004] However, under segment routing, the destination address in the IPv6 protocol is dynamically changed based on the segment routing list, without unencapsulating the inner payload message or the segment routing tunnel header, the final destination of the data message is unknown, and the returned data message can be via different segment paths, resulting in a risk of failure of the method of establishing a session flow according to five-tuple parameters and the like to perform access control.

[0005] SUMMARY

[0006] The present application provides a message processing method applied to a network device, the method comprising:

[0007] Obtaining a data message, the data message including a segment routing tunnel header;

[0008] Obtaining a segment path identifier from the segment routing tunnel header;

[0009] If there is an access control policy corresponding to the segment path identifier, and the access control policy includes path information for sending the data message to a service node, the data message is sent to the service node based on the access control policy, so that the service node performs security processing on the data message;

[0010] If a data message returned by the service node is received, the data message is sent based on the segment routing tunnel header of the data message.

[0011] The present application provides a message processing device applied to a network device, the device comprising:

[0012] The obtaining module is configured to obtain a data packet, wherein the data packet comprises a segment routing tunnel header;

[0013] The segment path identifier is obtained from the segment routing tunnel header;

[0014] The sending module is configured to, if there is an access control policy corresponding to the segment path identifier, and the access control policy comprises path information, the path information being used for sending the data packet to a service node, send the data packet to the service node based on the access control policy, so that the service node performs security processing on the data packet; and if a data packet returned by the service node is received, send the data packet based on the segment routing tunnel header of the data packet.

[0015] The present application provides a network device, comprising a processor and a machine readable storage medium, wherein the machine readable storage medium stores machine executable instructions capable of being executed by the processor; and the processor is configured to execute the machine executable instructions to implement the packet processing method of the above examples.

[0016] As can be seen from the above technical solutions, in the embodiments of the present application, the segment path identifier is obtained from the segment routing tunnel header of the data packet, and the data packet is sent to the service node based on the access control policy corresponding to the segment path identifier, so that the service node performs security processing on the data packet, thereby providing security services for the data packet, transmitting the data packet subjected to security processing in the network, and avoiding security risks to the network. The access control on the data packet can be implemented based on the segment path identifier. BRIEF DESCRIPTION OF DRAWINGS

[0017] FIG. 1 is a flow diagram of a packet processing method according to an embodiment of the present application;

[0018] FIG. 2 is a schematic diagram of an application scenario of a segment routing policy according to an embodiment of the present application;

[0019] FIGS. 3A-3C are schematic diagrams of a segment routing tunnel header according to an embodiment of the present application;

[0020] FIG. 4 is a schematic diagram of an SR policy according to an embodiment of the present application;

[0021] FIG. 5 is a schematic diagram of an application scenario of providing multiple service nodes according to an embodiment of the present application;

[0022] FIG. 6A is a schematic diagram of a controller configuring an access control policy according to an embodiment of the present application;

[0023] FIG. 6B is a schematic diagram of a third party device configuring an access control policy according to an embodiment of the present application;

[0024] FIG. 7 is a structural schematic diagram of a packet processing apparatus in an embodiment of the present application;

[0025] FIG. 8 is a hardware structure diagram of a network device in an embodiment of the present application. DETAILED DESCRIPTION

[0026] An embodiment of the present application provides a packet processing method, which can be applied to a network device. The network device can be a head node, an intermediate node or a tail node. The intermediate node can be a router or a switch between the head node and the tail node, or a service node through which a data packet passes. The method is not limited to the above.

[0027] Referring to FIG. 1, a flowchart of the method is shown. The method can include the following steps.

[0028] In step 101, a data packet is obtained, which includes a segment routing tunnel header and an inner-layer payload.

[0029] In step 102, a segment path identifier is obtained from the segment routing tunnel header. The segment path identifier is used to describe the attribute characteristics of a segment path of segment routing, and the attribute characteristics are used for access control of the data packet. The segment path can represent a segment path between a head node, an intermediate node and a tail node.

[0030] In step 103, if there is an access control policy corresponding to the segment path identifier, and the access control policy includes path information used for sending the data packet to a service node, the data packet is sent to the service node based on the access control policy, so that the service node performs security processing on the data packet.

[0031] In one example, if there is an access control policy corresponding to the segment path identifier, and the access control policy is a pass strategy, the data packet can be sent based on the segment routing tunnel header of the data packet.

[0032] Alternatively, if there is an access control policy corresponding to the segment path identifier, and the access control policy is a discard strategy, the data packet is discarded, and the data packet is not sent based on the segment routing tunnel header of the data packet.

[0033] In step 104, if a data packet returned by the service node is received, the data packet is sent based on the segment routing tunnel header of the data packet.

[0034] In one example, the access control policy corresponding to the segment path identifier exists, which can include: querying whether the access control policy corresponding to the segment path identifier exists in the session table item; if yes, obtaining the access control policy corresponding to the segment path identifier from the session table item; if no, and the policy library of the network device has the access control policy corresponding to the segment path identifier, obtaining the access control policy corresponding to the segment path identifier from the policy library, and recording the access control policy corresponding to the segment path identifier in the session table item.

[0035] The access control policy in the policy library can be configured by a user on the network device. For example, the configured access control policy corresponding to the segment path identifier of the network device can be obtained, and the access control policy is recorded in the policy library. Alternatively, the access control policy in the policy library is the access control policy corresponding to the segment path identifier of the network device sent by the controller. For example, the access control policy corresponding to the segment path identifier of the network device sent by the controller can be received, and the access control policy is recorded in the policy library.

[0036] In one example, the access control policy corresponding to the segment path identifier exists, which can include: querying whether the access control policy corresponding to the segment path identifier exists in the session table item; if yes, obtaining the access control policy corresponding to the segment path identifier from the session table item; if no, sending the segment path identifier to the third-party device to enable the third-party device to query the access control policy corresponding to the segment path identifier. If the access control policy corresponding to the segment path identifier sent by the third-party device is received, the access control policy corresponding to the segment path identifier is recorded in the session table item.

[0037] In one example, the access control policy corresponding to the segment path identifier exists, which can include: obtaining a first target attribute feature from all attribute features of the segment path identifier; determining whether the access control policy corresponding to the first target attribute feature exists; if yes, the access control policy corresponding to the first target attribute feature can be determined as the access control policy corresponding to the segment path identifier.

[0038] The access control policy includes a matching condition and a matching action; if the matching condition includes an attribute feature value, and the first target attribute feature matches the attribute feature value, the access control policy corresponds to the first target attribute feature; or if the matching condition includes an attribute feature value interval, and the first target attribute feature is located in the attribute feature value interval, the access control policy corresponds to the first target attribute feature.

[0039] The first target attribute feature includes a candidate path identifier, and the candidate path identifier is used to indicate a candidate path to which the segment path belongs. The attribute feature value of the matching condition includes a specified network node. If the candidate path indicated by the candidate path identifier includes the specified network node, the first target attribute feature matches the attribute feature value.

[0040] In one example, the process of determining whether there is an access control policy corresponding to the segment path identifier can include: obtaining a second target attribute feature from all attribute features of the segment path identifier; wherein the second target attribute feature is used to indicate an application scenario corresponding to the segment path identifier. If the application scenario corresponding to the segment path identifier is a secure access control scenario, it is determined whether there is an access control policy corresponding to the segment path identifier.

[0041] In one example, obtaining the segment path identifier from the segment routing tunnel header can include: obtaining a specified flag bit from the segment routing tunnel header, the specified flag bit can be a first value or a second value; wherein the first value can indicate that the segment routing tunnel header includes the segment path identifier, and the second value can indicate that the segment routing tunnel header does not include the segment path identifier. On this basis, if the specified flag bit is the first value, the segment path identifier can be obtained from the segment routing tunnel header.

[0042] In one example, if the network device acts as a head node, obtaining the data packet can include: after receiving the inner layer payload packet, encapsulating a segment routing tunnel header for the inner layer payload packet to obtain the data packet; wherein when encapsulating the segment routing tunnel header, the segment routing tunnel header includes the segment path identifier and the segment routing list, and the segment routing list includes identification information of the tail end node, identification information of the intermediate node and identification information of the head node.

[0043] In one example, if the network device acts as a head node, it can also include: if the segment path between the head node, the intermediate node and the tail end node is generated by the network device, the segment path identifier is assigned to the segment path when the segment path is generated. The segment path identifier is published to the intermediate node and the tail end node; or the segment path identifier is published to the controller, so that the controller publishes the segment path identifier to the intermediate node and the tail end node.

[0044] Alternatively, if the segment path between the head node, the intermediate node and the tail end node is generated by the controller, the head node can receive a publishing message sent by the controller, the publishing message can include the segment path identifier, and the segment path identifier is assigned to the segment path by the controller when the segment path is generated. The intermediate node and the tail end node can also receive the publishing message sent by the controller, and the publishing message includes the segment path identifier.

[0045] In one example, if the network device is the tail node, the network device can further include: if the network device (the tail node) assigns a segment path identifier to a segment path between the head node, the intermediate node and the tail node, the tail node sends a path computation request to the head node to make the head node generate the segment path; the tail node receives the segment path sent by the head node, assigns a segment path identifier to the segment path; the tail node publishes the segment path identifier and the segment path to the intermediate node and the head node; or, the tail node publishes the segment path identifier and the segment path to the controller to make the controller publish the segment path identifier and the segment path to the intermediate node and the head node.

[0046] Alternatively, if the network device (the tail node) assigns a segment path identifier to a segment path between the head node, the intermediate node and the tail node, the tail node sends a path computation request to the controller to make the controller generate the segment path; the tail node receives the segment path sent by the controller, assigns a segment path identifier to the segment path; the tail node publishes the segment path identifier and the segment path to the intermediate node and the head node; or, the tail node publishes the segment path identifier and the segment path to the controller to make the controller publish the segment path identifier and the segment path to the intermediate node and the head node.

[0047] In one example, if the network device is the tail node, the network device can further include: determining whether the forwarding path of the data packet passes through a specified type node, wherein the specified type node is a node that needs to send the data packet to a service node based on an access control policy; if yes, the data packet can be sent based on the segment routing tunnel header; if no, the data packet is discarded, and a path update request is sent to the head node to make the head node reassign the forwarding path, and the forwarding path passes through the specified type node.

[0048] In one example, the segment path identifier can include, but is not limited to, at least one of the following attribute features:

[0049] The segment path type identifier can include, but is not limited to, at least one of the following: a first identifier, which can be used to indicate that the segment path identifier is a global identifier or a local identifier; a second identifier, which can be used to indicate that the segment path identifier is a static path identifier or a dynamic path identifier; a third identifier, which can be used to indicate whether the segment routing tunnel header includes the identification information of the head node or does not include the identification information of the head node; a fourth identifier, which can be used to indicate the content that needs to be verified; a fifth identifier, which can be used to indicate the verification algorithm; and a sixth identifier, which is used to indicate the application scenario corresponding to the segment path identifier. For example, the sixth identifier is used to indicate that the application scenario corresponding to the segment path identifier is security access control, or the application scenario is path performance measurement, or the application scenario is bidirectional path binding, or the application scenario is end-to-end path protection.

[0050] The segment routing policy identifier can be used to indicate a segment routing policy to which the segment path belongs.

[0051] The candidate path identifier can be used to indicate a candidate path to which the segment path belongs.

[0052] The segment routing path identifier can be used to indicate a segment routing path to which the segment path belongs.

[0053] The check value is obtained by checking the content indicated by the fourth identifier using the check algorithm indicated by the fifth identifier.

[0054] As can be seen from the above technical solutions, in the embodiments of the present application, the segment path identifier is obtained from the segment routing tunnel header of the data packet, the data packet is sent to the service node based on the access control policy corresponding to the segment path identifier, so that the service node performs security processing on the data packet, thereby providing security services for the data packet, and the security-processed data packet is transmitted in the network, thereby avoiding security risks to the network. The access control of the data packet can be implemented based on the segment path identifier.

[0055] The above technical solutions of the embodiments of the present application are described below in combination with specific application scenarios.

[0056] The segment routing policy is a tunnel diversion technology based on the segment routing technology. Based on the segment routing policy, the head-end node encapsulates a segment routing tunnel header for the data packet after receiving the data packet, and the segment routing tunnel header can include a segment routing list. For example, in an IPv6 network, the segment routing list can include segment routing addresses of nodes on a specific path, thereby guiding the data packet to be forwarded according to the specific path based on the segment routing address. In application scenarios such as SASE (Secure Access Service Edge) and computing power networks, it is necessary to provide security services based on information of the data packet, and these security services are provided by service nodes, such as service function chain (SFC) technology which can provide multiple service nodes.

[0057] In the embodiments of the present application, a packet processing method is provided, which can implement access control of the data packet.

[0058] Referring to FIG. 2, an application scenario of the segment routing strategy is shown. A source node C1 (such as a terminal device) can send a data packet to a destination node S1 (such as a server). P1 is a head node (such as a router, a switch, or the like), and P8 is a tail node (such as a router, a switch, or the like). On a forwarding path, P2, P4, and P6 are intermediate nodes (such as routers, switches, or the like). On another forwarding path, P3, P5, and P7 are intermediate nodes. In the above application scenario, a packet processing method is provided in the embodiments of the present application, which can involve the following processes:

[0059] First, a path segment identifier (Path Segment Identifier) is defined, which can represent a segment identifier of a segment path between a head node, an intermediate node, and a tail node. For example, the segment identifier can represent a segment identifier of a segment path between the head node P1, the intermediate node P2, the intermediate node P4, the intermediate node P6, and the tail node P8. Alternatively, the segment identifier can represent a segment identifier of a segment path between the head node P1, the intermediate node P3, the intermediate node P5, the intermediate node P7, and the tail node P8.

[0060] In one example, after receiving the data packet, the head node can encapsulate a segment routing tunnel head (SRH, also referred to as a segment routing head) for the data packet. Referring to FIG. 3A, a segment routing tunnel head is shown. The segment routing tunnel head can include the following contents in sequence:

[0061] Next Header (next header): used to represent the type of the packet header immediately following the segment routing tunnel head, such as IPv4 encapsulation, IPv6 encapsulation, IPv6-Route, ICMPv6, and the like.

[0062] Hdr Ext Len (header extension length): used to represent the length of the segment routing tunnel head. Hdr Ext Len can refer to the length of the segment routing tunnel head excluding the first 8 bytes (the first 8 bytes are of fixed length).

[0063] Routing Type (routing type): used to represent the type of the routing header.

[0064] Segments Left (left segment): used to represent the number of intermediate nodes that should be accessed before reaching the destination node, i.e., the number of intermediate nodes between the current node and the tail node.

[0065] Last Entry (last entry): used to represent the index of the last element in the segment routing list.

[0066] Flags: used to indicate some identification of the data packet, the Flags can include 8 bits, an application flag is applied from the 8 bits of the Flags field, the flag is recorded as P-flag, the P-flag can be called a specified flag bit, and the P-flag can be a first value (such as 1) or a second value (such as 0). When the P-flag is the first value, it indicates that the Path Segment Identifier is included in the segment routing tunnel header, and when the P-flag is the second value, it indicates that the Path Segment Identifier is not included in the segment routing tunnel header.

[0067] For nodes that do not support segment path identifier processing, the P-flag can be ignored, for nodes that support segment path identifier processing, if the segment path identifier processing is not enabled, the P-flag can also be ignored, for nodes that support segment path identifier processing, if the segment path identifier processing is enabled, the P-flag needs to be obtained.

[0068] Tag: used to identify the same group of data packets.

[0069] Segment List[0]~Segment List[n-1]: the segment routing list (also called the segment list) can include Segment List[0]~Segment List[n-1], the segment routing list is encoded from the last segment of the path, Segment List[0] is the last but one Segment of the path (used to indicate the identification information of the last but one node, which can be an IPv6 address), Segment List[1] is the last but two Segment of the path (used to indicate the identification information of the last but two node), Segment List[n-2] is the second Segment of the path (used to indicate the identification information of the second node), and Segment List[n-1] is the first Segment of the path (used to indicate the identification information of the first node).

[0070] Optional Type Length Value objects (optional type length value objects), which are optional.

[0071] On the basis of the segment routing tunnel header shown in FIG. 3A, if the P-flag is the first value, i.e., the segment routing tunnel header includes the path segment identifier (Path Segment Identifier), the segment routing tunnel header can refer to FIG. 3B, i.e., the segment routing tunnel header can include the Path Segment Identifier. In the IPv6 network, the Path Segment Identifier can also be referred to as SRv6 Path Segment.

[0072] On the basis of the segment routing tunnel header shown in FIG. 3B, the segment routing list of the segment routing tunnel header can include the identification information of the head-end node, which can refer to FIG. 3C, which is a schematic diagram of the segment routing tunnel header. The segment routing tunnel header includes the segment routing list, which in turn includes Segment List[0]~Segment List[n], and Segment List[n] is the identification information (such as an IPv6 address) of the head-end node.

[0073] The segment routing list of the segment routing tunnel header is not encapsulated from the first node behind the head-end node (ingress node), but the identification information of the head-end node is encapsulated into the segment routing list, i.e., the segment routing list is encapsulated from the head-end node, so as to implement the access control policy for the data packet at the head-end node.

[0074] Regarding the identification information of the head-end node, it can be located behind Segment List[n-1] and in front of the Path Segment Identifier, in which case the identification information of the head-end node can be denoted as Segment List[n]. The identification information of the head-end node can also be located behind the Path Segment Identifier, in which case the identification information of the head-end node can be denoted as Segment List[n+1].

[0075] Of course, the above is only an example, and the position of the identification information of the head-end node is not limited.

[0076] In one example, the segment path identifier can include, but is not limited to, at least one of the following fields: a segment path type identifier field, a segment routing policy identifier field, a candidate path identifier field, a segment routing path identifier field (a SID identifier field), a check field. For example, referring to Table 1, the segment path identifier can include a 16-bit fixed-length segment path type identifier field, a 32-bit fixed-length segment routing policy identifier field, a 32-bit fixed-length candidate path identifier field, a 32-bit (or 24-bit) fixed-length segment routing path identifier field, and a 16-bit fixed-length check field. Of course, Table 1 is only an example of a segment path identifier.

[0077] Table 1

[0078] For the segment path type identifier field, the segment path type identifier field is used to identify the type of the segment path, and is used to distinguish and identify segment paths of different application scenarios and types. The segment path type identifier field can be fixed-length 16 bits. The segment path type identifier field can include, but is not limited to, at least one of the following: a first identifier, a second identifier, a third identifier, a fourth identifier, a fifth identifier, and a sixth identifier.

[0079] The first identifier is used to indicate whether the segment path identifier is a global identifier or a local identifier. For example, the first identifier can be 1 bit. If the first identifier is a first value (such as 1), it indicates that the segment path identifier is a global identifier. If the first identifier is a second value (such as 0), it indicates that the segment path identifier is a local identifier. For example, if the segment path identifier is limited within one SR domain, the first identifier is used to indicate that the segment path identifier is a local identifier, i.e., the segment path identifier has uniqueness within one SR domain. If the segment path identifier can cross one or more SR domains, the first identifier is used to indicate that the segment path identifier is a global identifier.

[0080] The second identifier is used to indicate whether the segment path identifier is a static path identifier or a dynamic path identifier. For example, the second identifier can be 1 bit. If the second identifier is a first value (such as 1), it indicates that the segment path identifier is a static path identifier. If the second identifier is a second value (such as 0), it indicates that the segment path identifier is a dynamic path identifier. For example, when a segment path is statically configured, a segment path identifier can also be statically configured for the segment path. In this case, the second identifier can be used to indicate that the segment path identifier is a static path identifier. When an algorithm is used to dynamically generate a segment path, a segment path identifier can also be dynamically generated for the segment path. In this case, the second identifier can be used to indicate that the segment path identifier is a dynamic path identifier.

[0081] The third identifier can be used to indicate whether the segment routing tunnel header includes the identifier information of the head-end node or not. For example, the third identifier can be 1 bit. If the third identifier is a first value (e.g., 1), the third identifier is used to indicate that the segment routing tunnel header includes the identifier information of the head-end node. If the third identifier is a second value (e.g., 0), the third identifier is used to indicate that the segment routing tunnel header does not include the identifier information of the head-end node. For example, if the identifier information of the head-end node (i.e., the ingress node of the SR) is encapsulated in the segment routing tunnel header, the third identifier is used to indicate that the segment routing tunnel header includes the identifier information of the head-end node. If the identifier information of the head-end node is not encapsulated in the segment routing tunnel header, the third identifier is used to indicate that the segment routing tunnel header does not include the identifier information of the head-end node.

[0082] The fourth identifier can be used to indicate the content to be checked, i.e., to indicate the checking range of the checking field. For example, the fourth identifier can be 1 bit. If the fourth identifier is a first value (e.g., 1), the fourth identifier is used to indicate that the segment path and the segment path identifier are checked. If the fourth identifier is a second value (e.g., 0), the fourth identifier is used to indicate that only the segment path is checked. For example, if the segment path and the segment path identifier are checked, the fourth identifier is used to indicate that the segment path and the segment path identifier are checked. If only the segment path is checked, the fourth identifier is used to indicate that only the segment path is checked.

[0083] The fifth identifier can be used to indicate the checking algorithm. For example, the fifth identifier can be 3 bits, and the checking algorithm is indicated by the fifth identifier, such as a 16-bit cyclic redundancy check code and a 16-bit hash function. For example, if a 16-bit cyclic redundancy check code is used for checking, the fifth identifier is used to indicate the checking algorithm of the 16-bit cyclic redundancy check code. If a 16-bit hash function is used for checking, the fifth identifier is used to indicate the checking algorithm of the 16-bit hash function.

[0084] The sixth identifier is used to indicate the application scenario corresponding to the segment path identifier. For example, the sixth identifier can be 3 bits. The sixth identifier is used to indicate that the application scenario corresponding to the segment path identifier is security access control, or the sixth identifier is used to indicate that the application scenario corresponding to the segment path identifier is path performance measurement, or the sixth identifier is used to indicate that the application scenario corresponding to the segment path identifier is bidirectional path binding, or the sixth identifier is used to indicate that the application scenario corresponding to the segment path identifier is end-to-end path protection. Of course, the above are only a few examples of application scenarios, and the application scenario applicable to the present embodiment is security access control.

[0085] Of course, in addition to the first identifier, the second identifier, the third identifier, the fourth identifier, the fifth identifier and the sixth identifier, the segment path type identifier field can also include a reserved bit, which can be defined and allocated according to the scene.

[0086] For the segment routing policy identifier field, the segment routing policy identifier field can include a segment routing policy identifier, and the segment routing policy identifier can be used to indicate the segment routing policy (SR Policy) to which the segment path belongs, that is, to indicate which segment routing policy the segment path identified by the segment path belongs to.

[0087] For example, the color in the triple <head-end node, color, tail-end node> of the segment routing policy can be used as the segment routing policy identifier, and the fixed length of the segment routing policy identifier is 32 bits. The color (Color) is used to distinguish multiple segment routing policies between the same head-end node and tail-end node, and the color is an important attribute of the segment routing policy, usually representing the intention, indicating a specific way to reach the tail-end node (such as low delay, low cost, security, etc.), so the color in the triple can be used as the segment routing policy identifier.

[0088] For the candidate path identifier field, the candidate path identifier field can include a candidate path identifier, and the candidate path identifier can be used to indicate the candidate path to which the segment path belongs, that is, to indicate which candidate path (Candidate Path) in the SR domain the segment path identified by the segment path belongs to.

[0089] For example, the Discriminator attribute in the candidate path triple <Protocol-Origin, Originator, Discriminator> is used to distinguish different candidate paths in the SR policy, so the Discriminator attribute can be used as the candidate path identifier, and the length of the candidate path identifier is the same as the length of the Discriminator attribute, both of which are 32 bits. Among them, <Protocol-Origin, Originator, Discriminator> is an identifier that uniquely identifies a candidate path in the SR policy, Protocol-Origin is used to describe how the candidate path is generated by which protocol / way, Originator describes the node that generates the candidate path, and Discriminator is an identifier used to distinguish candidate paths in the <Protocol-Origin, Originator> space.

[0090] For the segment routing path identifier field, the segment routing path identifier field can include a segment routing path identifier, and the segment routing path identifier can be used to indicate the segment routing path to which the segment path belongs, i.e., to identify which segment routing path (Segment List) the segment path belongs to, which can be composed of a fixed-length field.

[0091] As can be seen from the above, the segment path identifier can include a segment routing policy identifier, a candidate path identifier, and a segment routing path identifier, which are beneficial to the quick identification of the segment routing policy (SR Policy), the candidate path (Candidate Path), and the segment routing path (Segment List) by each node on the path, so as to perform access control at different levels, and to aggregate and analyze the segment path (Path Segment). For example, all segment routing paths under a candidate path identifier can be controlled according to the candidate path identifier in the segment path identifier.

[0092] The SR policy takes the triple <head node, color, tail node> as the key value, and each SR policy can include multiple candidate paths (Candidate Path). The candidate path can also be an SRv6-based path, i.e., the multiple segment lists in the candidate path are IPv6 addresses. For example, each candidate path has a preference value (Preference), and the higher the preference value of the path, the more preferred it is. The candidate path can include multiple Segment Lists, each of which has a weight. In the SR policy, an effective and highest-priority candidate path is selected as the active candidate path, and the multiple segment lists in the active candidate path share the carried traffic according to the weights. Referring to FIG. 4, which is a schematic diagram of an SR policy. In the SR policy, the segment routing policy identifier, the candidate path identifier, and the segment routing path identifier are involved, so the segment routing policy identifier, the candidate path identifier, and the segment routing path identifier can be taken as the segment path identifier.

[0093] For the check field, the check field can include a check value, and the check value is obtained by checking the content to be checked indicated by the fifth identifier using the check algorithm indicated by the fourth identifier.

[0094] For example, if the fifth identifier is used to indicate the check algorithm of the 16-bit redundancy cyclic check code, and the fourth identifier is used to indicate the check of the segment path and the segment path identifier, the check algorithm of the 16-bit redundancy cyclic check code is used to check the segment path and the segment path identifier, a check value is obtained, and the check field includes the check value. Alternatively, if the fifth identifier is used to indicate the check algorithm of the 16-bit hash function, and the fourth identifier is used to indicate the check of only the segment path, the check algorithm of the 16-bit hash function is used to check the segment path, a check value is obtained, and the check field includes the check value.

[0095] For example, the check field is used to check specific fields in the segment routing tunnel header, such as the contents of the segment path and the segment path identifier, and is mainly used to check errors, damages, and modifications in the data transmission process. The segment routing tunnel header can be checked for damages, tampering, and modifications in the forwarding process to prevent security control failures due to the above reasons. The binding between the segment path and the segment path identifier can be achieved.

[0096] The above process gives an embodiment of the segment path identifier. In addition to the segment path type identifier field, the segment routing policy identifier field, the candidate path identifier field, the segment routing path identifier field, and the check field, the segment path identifier can also include the Protocol-Origin field in the candidate path triple, which is used to distinguish different path generation methods, such as configuration, PCEP, and BGP. The Protocol-Origin field can be placed in the segment path type identifier field. The segment path identifier is not limited in this regard.

[0097] Secondly, a method for allocating the segment path identifier and a method for publishing the segment path identifier are proposed.

[0098] In one example, based on the above segment path identifier, the segment path identifier needs to be allocated to the segment path, and the head-end node, the intermediate node, and the tail-end node all need to obtain the segment path identifier. In order to make the head-end node, the intermediate node, and the tail-end node all obtain the segment path identifier, the following methods can be used to achieve this purpose:

[0099] Method 1: The head-end node generates the segment path between the head-end node, the intermediate node, and the tail-end node. When the segment path is generated, the head-end node allocates the segment path identifier to the segment path. After obtaining the segment path identifier, the head-end node can publish the segment path identifier to the intermediate node and the tail-end node. For example, the head-end node publishes the segment path identifier to the intermediate node (the intermediate node with the ability to process the segment path identifier) and the tail-end node through a routing protocol (such as the BGP protocol or other types of routing protocols).

[0100] Way 2: The head-end node generates a segment path between the head-end node, the intermediate nodes and the tail-end node, and assigns a segment path identifier to the segment path when generating the segment path. After obtaining the segment path identifier, the head-end node can publish the segment path identifier to the controller, so that the controller publishes the segment path identifier to the intermediate nodes (intermediate nodes with the ability to process segment path identifiers) and the tail-end node.

[0101] Way 3: The controller generates a segment path between the head-end node, the intermediate nodes and the tail-end node, and assigns a segment path identifier to the segment path when generating the segment path. After obtaining the segment path identifier, the controller publishes the segment path identifier to the head-end node, the intermediate nodes (intermediate nodes with the ability to process segment path identifiers) and the tail-end node. The head-end node receives the publish message sent by the controller and obtains the segment path identifier from the publish message. The intermediate nodes receive the publish message sent by the controller and obtain the segment path identifier from the publish message. The tail-end node receives the publish message sent by the controller and obtains the segment path identifier from the publish message.

[0102] Way 4: The tail-end node assigns a segment path identifier to a segment path between the head-end node, the intermediate nodes and the tail-end node. The tail-end node can send a path computation request to the head-end node, and the head-end node can generate a segment path between the head-end node, the intermediate nodes and the tail-end node after receiving the path computation request. When sending the path computation request to the head-end node, the tail-end node can also send a path constraint policy (such as specifying a specific node address in the path). The path constraint policy represents the constraint condition of the segment path, so that the head-end node generates a segment path that satisfies the path constraint policy. After the head-end node generates the segment path, the head-end node publishes the segment path to the tail-end node.

[0103] The tail-end node receives the segment path sent by the head-end node, and assigns a segment path identifier to the segment path. After generating the segment path identifier, the tail-end node can publish the segment path identifier to the intermediate nodes and the head-end node. For example, the tail-end node can publish the segment path identifier to the intermediate nodes (intermediate nodes with the ability to process segment path identifiers) and the head-end node through a routing protocol. When publishing the segment path identifier to the intermediate nodes and the head-end node, the tail-end node can also publish the segment path to the intermediate nodes and the head-end node.

[0104] Manner 5: The tail-end node allocates a segment path identifier for the segment path between the head-end node, the intermediate nodes and the tail-end node. The tail-end node can send a path computation request to the head-end node, and can also send a path constraint policy (such as specifying a specific node address in the path), which represents a constraint condition of the segment path, so that the head-end node generates a segment path satisfying the path constraint policy. After receiving the path computation request, the head-end node generates the segment path between the head-end node, the intermediate nodes and the tail-end node, and publishes the segment path to the tail-end node. The tail-end node receives the segment path sent by the head-end node, and allocates a segment path identifier for the segment path. The tail-end node can publish the segment path and the segment path identifier to the head-end node, and the head-end node can publish the segment path and the segment path identifier to the intermediate nodes (the intermediate nodes having the ability to process the segment path identifier).

[0105] Manner 6: The tail-end node allocates a segment path identifier for the segment path between the head-end node, the intermediate nodes and the tail-end node. The tail-end node can send a path computation request to the head-end node, and can also send a path constraint policy (such as specifying a specific node address in the path), which represents a constraint condition of the segment path, so that the head-end node generates a segment path satisfying the path constraint policy. After receiving the path computation request, the head-end node generates the segment path between the head-end node, the intermediate nodes and the tail-end node, and publishes the segment path to the tail-end node. The tail-end node receives the segment path sent by the head-end node, and allocates a segment path identifier for the segment path. The tail-end node can publish the segment path and the segment path identifier to the controller, and the controller can publish the segment path and the segment path identifier to the head-end node and the intermediate nodes (the intermediate nodes having the ability to process the segment path identifier).

[0106] Manner 7: The tail-end node allocates a segment path identifier for the segment path between the head-end node, the intermediate nodes and the tail-end node. The tail-end node can send a path computation request to the controller, and can also send a path constraint policy (such as specifying a specific node address in the path), which represents a constraint condition of the segment path, so that the controller generates a segment path satisfying the path constraint policy. After receiving the path computation request, the controller generates the segment path between the head-end node, the intermediate nodes and the tail-end node, and publishes the segment path to the tail-end node. The tail-end node receives the segment path sent by the controller, allocates a segment path identifier for the segment path, and publishes the segment path and the segment path identifier to the intermediate nodes (the intermediate nodes having the ability to process the segment path identifier) and the head-end node.

[0107] Way 8: The tail-end node allocates the segment path identifier of the segment path between the head-end node, the intermediate nodes and the tail-end node. The tail-end node can send the path computation request to the controller, and also send the path constraint policy (such as specifying the address of a specific node in the path), which represents the constraint condition of the segment path, so that the controller generates the segment path satisfying the path constraint policy. After receiving the path computation request, the controller generates the segment path between the head-end node, the intermediate nodes and the tail-end node, and publishes the segment path to the tail-end node. The tail-end node receives the segment path sent by the controller, and allocates the segment path identifier for the segment path. The tail-end node can publish the segment path and the segment path identifier to the head-end node, and the head-end node can publish the segment path and the segment path identifier to the intermediate nodes (the intermediate nodes having the ability to process the segment path identifier).

[0108] Way 9: The tail-end node allocates the segment path identifier of the segment path between the head-end node, the intermediate nodes and the tail-end node. The tail-end node can send the path computation request to the controller, and also send the path constraint policy (such as specifying the address of a specific node in the path), which represents the constraint condition of the segment path, so that the controller generates the segment path satisfying the path constraint policy. After receiving the path computation request, the controller generates the segment path between the head-end node, the intermediate nodes and the tail-end node, and publishes the segment path to the tail-end node. The tail-end node receives the segment path sent by the controller, and allocates the segment path identifier for the segment path. The tail-end node can publish the segment path identifier and the segment path to the controller, so that the controller publishes the segment path identifier and the segment path to the intermediate nodes (the intermediate nodes having the ability to process the segment path identifier) and the head-end node.

[0109] Way 10: The tail-end node allocates the segment path identifier of the segment path between the head-end node, the intermediate nodes and the tail-end node. The controller can generate the segment path between the head-end node, the intermediate nodes and the tail-end node, and publish the segment path to the tail-end node. Compared with Way 7, Way 8 and Way 9, in Way 10, the controller generates the segment path and publishes the segment path to the tail-end node, instead of generating the segment path between the head-end node, the intermediate nodes and the tail-end node after receiving the path computation request sent by the tail-end node.

[0110] The tail-end node receives the segment path sent by the controller, and allocates the segment path identifier for the segment path. The tail-end node publishes the segment path and the segment path identifier to the intermediate nodes (the intermediate nodes having the ability to process the segment path identifier) and the head-end node. Or, the tail-end node publishes the segment path and the segment path identifier to the head-end node, and the head-end node publishes the segment path and the segment path identifier to the intermediate nodes (the intermediate nodes having the ability to process the segment path identifier). Or, the tail-end node publishes the segment path identifier and the segment path to the controller, and the controller publishes the segment path identifier and the segment path to the intermediate nodes (the intermediate nodes having the ability to process the segment path identifier) and the head-end node.

[0111] In the manner 1 to the manner 10, the segment path is dynamically calculated, and after the segment path is obtained, the segment path identifier is dynamically allocated for the segment path, that is, the segment path identifier is a dynamic path identifier.

[0112] The manner 11, the segment path identifier is statically configured in the head-end node, the tail-end node or the controller. In the manner 11, the segment path identifier is statically allocated for the segment path, that is, the segment path identifier is a static path identifier.

[0113] For example, the segment path identifier can be statically configured in the head-end node, and the head-end node can publish the segment path identifier to the intermediate node and the tail-end node through the routing protocol or the control interface protocol.

[0114] For example, the segment path identifier can be statically configured in the head-end node, and the head-end node can publish the segment path identifier to the controller through the routing protocol or the control interface protocol, and the controller can publish the segment path identifier to the intermediate node and the tail-end node through the routing protocol or the control interface protocol.

[0115] For example, the segment path identifier can be statically configured in the controller, and the controller can publish the segment path identifier to the head-end node, the intermediate node and the tail-end node through the routing protocol or the control interface protocol.

[0116] For example, the segment path identifier can be statically configured in the tail-end node, and the tail-end node can publish the segment path identifier to the head-end node and the intermediate node through the routing protocol or the control interface protocol.

[0117] For example, the segment path identifier can be statically configured in the tail-end node, and the tail-end node can publish the segment path identifier to the controller through the routing protocol or the control interface protocol, and the controller can publish the segment path identifier to the head-end node and the intermediate node through the routing protocol or the control interface protocol.

[0118] In the manner 1 to the manner 11, the segment path identifier can be published through the extension field of the BGP protocol, can be published through the extension field of the BGP-LS protocol, can be published through the extension field of the PCEP protocol, and can be published through the extension field of the IS-IS protocol, and the publishing message of the segment path identifier is not limited.

[0119] Thirdly, a configuration method of an access control policy is provided.

[0120] In the application scenarios of SASE, computing power network, etc., a service node can be provided for a user to provide a security service, such as a service function chain (SFC) technology can provide multiple service nodes, such as a service node for implementing a traffic cleaning service (the service node filters unsafe data packets through the traffic cleaning service), a service node for implementing an intrusion prevention service (the service node filters unsafe data packets through the intrusion prevention service), or a service node for implementing other services, without limiting the functions of the service node.

[0121] In one example, the node connected with the service node can be determined from the intermediate node and the tail node, as shown in FIG. 5, which is a schematic diagram of an application scenario of providing multiple service nodes. It is assumed that the intermediate node P2 is connected with the service node 1 for implementing a traffic cleaning service, and the intermediate node P4 is connected with the service node 2 for implementing an intrusion prevention service, and the subsequent description takes FIG. 5 as an example.

[0122] Since the intermediate node P2 is connected with the service node 1, it is necessary to configure an access control policy for the intermediate node P2, and the access control policy is used to make the intermediate node P2 send data packets to the service node 1, without limiting the content of the access control policy as long as the access control policy is used to make the intermediate node P2 send data packets to the service node 1. For example, the access control policy can include path information (such as the IP address of the service node 1), and the path information is used to make the intermediate node P2 send data packets to the service node 1. For example, based on the IP address of the service node 1, the intermediate node P2 sends data packets to the service node 1, and the service node 1 can perform traffic cleaning service on the data packets. Since the intermediate node P4 is connected with the service node 2, it is necessary to configure an access control policy for the intermediate node P4, and the access control policy is used to make the intermediate node P4 send data packets to the service node 2. For example, the access control policy includes path information (such as the IP address of the service node 2), and the path information is used to make the intermediate node P4 send data packets to the service node 2, and the service node 2 performs intrusion prevention service on the data packets.

[0123] When configuring the access control policy, the access control policy can include a matching condition and a matching action.

[0124] For the matching action of the access control policy, the matching action is used to send data packets to the service node, for example, the matching action includes path information, and the path information is used to send data packets to the service node. Alternatively, the matching action can be a pass-through policy, that is, directly forwarding data packets without the above-mentioned service node. Alternatively, the matching action can be a discard policy, that is, directly discarding data packets.

[0125] For the matching condition of the access control policy, the matching condition can include the segment path identifier. Assuming that the segment path identifier includes three attribute features A, B and C, the matching condition includes the three attribute features A, B and C of the segment path identifier. On this basis, if the segment path identifier in the data packet matches the segment path identifier in the matching condition, it means that the access control policy corresponds to the segment path identifier.

[0126] For the matching condition of the access control policy, the matching condition can include attribute feature values (i.e. part of the attribute feature values of all attribute features of the segment path identifier). Assuming that the segment path identifier includes three attribute features A, B and C, the matching condition includes the A attribute feature value of the segment path identifier. On this basis, the A attribute feature value can be obtained from the segment path identifier in the data packet, and if the A attribute feature value matches the A attribute feature value in the matching condition, it means that the access control policy corresponds to the segment path identifier.

[0127] For the matching condition of the access control policy, the matching condition can include attribute feature value intervals (i.e. intervals of part of the attribute feature values of all attribute features of the segment path identifier). Assuming that the segment path identifier includes three attribute features A, B and C, the matching condition includes the interval (i.e. a value range) of the A attribute feature value of the segment path identifier. On this basis, the A attribute feature value can be obtained from the segment path identifier in the data packet, and if the A attribute feature value is located in the interval of the A attribute feature value in the matching condition, it means that the access control policy corresponds to the segment path identifier.

[0128] In summary, the matching condition of the access control policy can correspond to the value or value range of a certain specific field attribute of the segment path identifier, or the value or value range of the combination of several specific field attributes. For example, access control can be performed for a certain specific segment routing type, at which time only the specific segment routing policy type field needs to be matched, i.e. <segment path type identifier field (Path Segment type field), segment routing policy identifier field>.

[0129] In addition, access control can also be performed for a certain specific candidate path family, at which time only the candidate path segment type field needs to be matched, i.e. <segment path type identifier field (Path Segment type field), segment routing policy identifier field, candidate path identifier field>.

[0130] Of course, the above is only an example, and the matching condition of the access control policy is not limited.

[0131] In one example, when configuring the access control policy, the following method can be used:

[0132] Manner 1: The node obtains the configured access control policy corresponding to the segment path identifier of the node, and records the access control policy in the policy library. The access control policy in the policy library can be stored persistently.

[0133] For example, the access control policy can be configured by the local node, i.e., the access control policy a1 can be configured at the intermediate node P2, and the matching condition of the access control policy a1 is the value or value range of a certain specific field attribute in the segment path identifier, or the combination of several specific field attribute values or value ranges. The matching action of the access control policy a1 is to make the intermediate node P2 send the data packet to the service node 1. In addition, the access control policy a2 can be configured at the intermediate node P4, the condition of the access control policy a2 is the value or value range of a certain specific field attribute in the segment path identifier, or the combination of several specific field attribute values or value ranges, and the matching action of the access control policy a2 is to make the intermediate node P4 send the data packet to the service node 2. After obtaining the access control policy a1, the intermediate node P2 can record the access control policy a1 in the policy library. After obtaining the access control policy a2, the intermediate node P4 can record the access control policy a2 in the policy library.

[0134] Manner 2: The node can receive the access control policy corresponding to the segment path identifier of the node sent by the controller, and record the access control policy in the policy library.

[0135] For example, the access control policy can be configured by the controller, as shown in FIG. 6A, which is a schematic diagram of configuring the access control policy of the controller. The process can include the following steps:

[0136] Step 611: The controller configures the access control policy corresponding to the segment path identifier.

[0137] For example, the controller configures the access control policy a1 of the segment path identifier, and configures the access control policy a2 of the segment path identifier. The contents of the access control policy a1 and the access control policy a2 are described in manner 1, which will not be repeated here.

[0138] Step 612: The controller sends the access control policy corresponding to the segment path identifier to the node connected with the service node.

[0139] For example, the controller sends the access control policy a1 to the intermediate node P2, and the access control policy a1 is used to make the intermediate node P2 send the data packet to the service node 1. The controller sends the access control policy a2 to the intermediate node P4, and the access control policy a2 is used to make the intermediate node P4 send the data packet to the service node 2.

[0140] Step 613, after the node receives the access control policy corresponding to the segment path identifier, the node sends a successful configuration response to the controller.

[0141] For example, after the intermediate node P2 receives the access control policy a1 corresponding to the segment path identifier, the node sends a successful configuration response to the controller, which indicates that the access control policy a1 has been successfully configured for the segment path identifier. After the intermediate node P4 receives the access control policy a2 corresponding to the segment path identifier, the successful configuration response indicates that the access control policy a2 has been successfully configured for the segment path identifier.

[0142] Step 614, the node records the access control policy in the policy library. For example, after the intermediate node P2 obtains the access control policy a1, the node can record the access control policy a1 in the policy library. After the intermediate node P4 obtains the access control policy a2, the node can record the access control policy a2 in the policy library.

[0143] In mode 2, the access control policy is configured by the controller, the access control policy of the segment path identifier of each node is uniformly configured by the controller, and the access control policy of the segment path identifier of each node is sent to each node through the control interface protocol, so as to realize the access control of the traffic path of each node.

[0144] Mode 3: After the node obtains the data packet and acquires the segment path identifier from the segment routing tunnel header of the data packet, the node sends the segment path identifier to a third-party device to query the access control policy corresponding to the segment path identifier. The node can receive the access control policy and record the access control policy corresponding to the segment path identifier in the session table item.

[0145] For example, the access control policy can be configured by the third-party device, as shown in FIG. 6B, a schematic diagram for configuring the access control policy for the third-party device, the process can include the following steps:

[0146] Step 621, configuring the access control policy corresponding to the segment path identifier in the third-party device.

[0147] For example, the access control policy a1 corresponding to the segment path identifier is configured in the third-party device, and the access control policy a2 corresponding to the segment path identifier is configured in the third-party device.

[0148] In one example, the third-party device can be an admission server, a policy server, etc.

[0149] Step 622, after the node obtains the data packet and acquires the segment path identifier from the segment routing tunnel header of the data packet, the node sends the segment path identifier to the third-party device.

[0150] The process of obtaining the segment path identifier from the segment routing tunnel header by the node can be referred to subsequent embodiments. In mode 3, the access control policy is obtained based on the data packet.

[0151] For example, the head node, each intermediate node, and the tail node obtain the segment path identifier from the segment routing tunnel header of the data packet after obtaining the data packet, and send the segment path identifier to the third-party device.

[0152] In step 623, the third-party device queries the access control policy corresponding to the segment path identifier of the node, and sends the access control policy corresponding to the segment path identifier to the node connected to the service node.

[0153] After the third-party device receives the segment path identifier of the intermediate node P2, the access control policy a1 corresponding to the segment path identifier is queried and sent to the intermediate node P2. The matching action of the access control policy a1 is to make the intermediate node P2 send the data packet to the service node 1.

[0154] After the third-party device receives the segment path identifier of the intermediate node P4, the access control policy a2 corresponding to the segment path identifier is queried and sent to the intermediate node P4. The matching action of the access control policy a2 is to make the intermediate node P4 send the data packet to the service node 2.

[0155] In step 624, after the node receives the access control policy corresponding to the segment path identifier, the access control policy corresponding to the segment path identifier is recorded in the session table item, and the data packet is processed based on the matching action of the access control policy. For example, after the intermediate node P2 receives the access control policy a1, the access control policy a1 corresponding to the segment path identifier is recorded in the session table item, and the data packet is sent to the service node 1 based on the matching action of the access control policy a1. After the intermediate node P4 receives the access control policy a2, the access control policy a2 corresponding to the segment path identifier is recorded in the session table item, and the data packet is sent to the service node 2 based on the matching action of the access control policy a2.

[0156] In mode 3, the access control policy is configured by the third-party device. The third-party device configures the access control policy based on the segment path identifier. When the data packet passes through each node, each node extracts the segment path identifier in the data packet and sends the segment path identifier to the third-party device. The third-party device performs policy authentication based on the segment path identifier, and sends the access control policy to the node, so that the node processes the data packet based on the access control policy, thereby realizing access control of the traffic path of each node.

[0157] The service node for deploying a traffic cleaning service or an intrusion prevention service can be a network device or a security device with a three-layer and above processing capability, such as a three-layer switch, a router, a firewall, etc.

[0158] Fourthly, a packet processing method based on a segment path identifier is provided.

[0159] In the application scenario shown in FIG. 5, the packet processing method can include:

[0160] In step S11, the head-end node P1 receives a data packet sent by the source node C1, and the data packet is referred to as an inner-layer load packet. The head-end node P1 encapsulates a segment routing tunnel header for the inner-layer load packet to obtain a data packet.

[0161] In one example, when the segment routing tunnel header is encapsulated, the segment routing tunnel header can include a segment path identifier and a segment routing list, and the segment routing list can include identification information (such as an IPv6 address, etc.) of the tail-end node, identification information of the intermediate node, and identification information of the head-end node. When the segment routing tunnel header is encapsulated, the segment routing tunnel header can also include a specified flag (such as P-flag), and the specified flag is a first value, and the first value indicates that the segment routing tunnel header includes the segment path identifier. Referring to FIG. 3C, a structure diagram of the segment routing tunnel header encapsulated by the head-end node P1 is shown, and the segment routing tunnel header is not limited.

[0162] In step S12, the head-end node P1 sends the data packet to the intermediate node P2 based on the segment routing tunnel header.

[0163] In step S13, the intermediate node P2 receives the data packet sent by the head-end node P1, and the data packet includes the segment routing tunnel header and the inner-layer load packet. The intermediate node P2 obtains the segment path identifier from the segment routing tunnel header.

[0164] When the segment path identifier is obtained from the segment routing tunnel header, the intermediate node P2 first obtains the specified flag (such as P-flag) from the segment routing tunnel header. If the specified flag is a first value (such as 1), the intermediate node P2 can obtain the segment path identifier from the segment routing tunnel header. If the specified flag is a second value (such as 0), the intermediate node P2 does not obtain the segment path identifier from the segment routing tunnel header.

[0165] In step S14, the intermediate node P2 queries whether the session table item exists an access control policy corresponding to the segment path identifier. If yes, the intermediate node P2 obtains the access control policy corresponding to the segment path identifier from the session table item. If no, the access control policy corresponding to the segment path identifier can be obtained in the following manner:

[0166] For the way 1 and the way 2 in the third point, the intermediate node P2 queries whether the access control policy corresponding to the segment path identifier exists in the policy library of the node. If yes, the intermediate node P2 can obtain the access control policy corresponding to the segment path identifier from the policy library, and record the access control policy corresponding to the segment path identifier in the session table item. In this way, for subsequent data packets, the access control policy corresponding to the segment path identifier can be obtained from the session table item. The session table item is a temporary table item, and if no data packet is received within a preset time period for the session table item, the session table item can be deleted, thereby saving memory resources.

[0167] If no, the intermediate node P2 cannot obtain the access control policy from the policy library, that is, cannot obtain the access control policy. Taking the case that the intermediate node P2 can obtain the access control policy a1 as an example.

[0168] For the way 3 in the third point, the intermediate node P2 can send the segment path identifier to the third-party device, so that the third-party device queries the access control policy corresponding to the segment path identifier. If the third-party device has the access control policy corresponding to the segment path identifier, the third-party device can send the access control policy to the intermediate node P2, and the intermediate node P2 can obtain the access control policy and record the access control policy corresponding to the segment path identifier in the session table item. In this way, for subsequent data packets, the access control policy corresponding to the segment path identifier can be obtained from the session table item. If the third-party device does not have the access control policy corresponding to the segment path identifier, the intermediate node P2 cannot obtain the access control policy.

[0169] Step S15, if the intermediate node P2 can query the access control policy corresponding to the segment path identifier, the data packet is processed based on the access control policy. If the intermediate node P2 does not query the access control policy corresponding to the segment path identifier, the data packet is sent to the intermediate node P4 based on the segment routing tunnel header.

[0170] When the intermediate node P2 processes the data packet based on the access control policy, if the access control policy includes path information, the path information is used to send the data packet to the service node 1, the data packet is sent to the service node 1 based on the access control policy, so that the service node 1 performs security processing on the data packet. If the intermediate node P2 receives the data packet returned by the service node 1, the data packet is sent based on the segment routing tunnel header, that is, the data packet is sent to the intermediate node P4 based on the segment routing tunnel header.

[0171] For example, since the access control policy a1 is used to make the intermediate node P2 send the data packet to the service node 1, the content of the access control policy a1 is not limited, as long as the data packet can be sent to the service node 1, therefore, the intermediate node P2 can send the data packet to the service node 1.

[0172] After receiving the data packet, the service node 1 can perform security processing on the data packet. For example, if the service node 1 is configured to implement a traffic cleaning service, the service node 1 can perform traffic cleaning on the data packet, and the traffic cleaning process is not limited. If the data packet passes the traffic cleaning, the service node 1 can send the data packet to the intermediate node P2. If the data packet fails to pass the traffic cleaning, the service node 1 filters the data packet and does not send the data packet to the intermediate node P2.

[0173] After receiving the data packet returned by the service node 1, the intermediate node P2 can send the data packet to the intermediate node P4 based on the segment routing tunnel header.

[0174] When sending the data packet to the service node 1, the intermediate node P2 can remove the segment routing tunnel header of the data packet, i.e., send the data packet without the segment routing tunnel header to the service node 1. After receiving the data packet returned by the service node 1, the intermediate node P2 can restore the segment routing tunnel header of the data packet, i.e., re-encapsulate the segment routing tunnel header to the data packet.

[0175] When processing the data packet based on the access control policy, if the access control policy is a pass policy, the intermediate node P2 can send the data packet based on the segment routing tunnel header of the data packet, i.e., the intermediate node P2 can send the data packet to the intermediate node P4 based on the segment routing tunnel header.

[0176] When processing the data packet based on the access control policy, if the access control policy is a discard policy, the intermediate node P2 discards the data packet and does not forward the data packet.

[0177] In one example, before step S14, the intermediate node P2 can obtain a second target attribute feature from all attribute features of the segment path identifier, and the second target attribute feature is used to indicate an application scenario corresponding to the segment path identifier. For example, the second target attribute feature can be the sixth identifier in the segment path identifier.

[0178] If the application scenario corresponding to the segment path identifier indicated by the sixth identifier is a security access control scenario, step S14 can be performed, i.e., the intermediate node P2 queries whether the access control policy corresponding to the segment path identifier exists in the session table item. If the application scenario corresponding to the segment path identifier indicated by the sixth identifier is not an access control scenario, such as a path performance measurement scenario, or a bidirectional path binding scenario, or an end-to-end path protection scenario, the intermediate node P2 directly sends the data packet to the intermediate node P4 based on the segment routing tunnel header, without querying whether the access control policy corresponding to the segment path identifier exists in the session table item.

[0179] In one example, when the intermediate node P2 acquires the access control policy corresponding to the segment path identifier, if the matching condition of the access control policy includes the segment path identifier, the matching condition of the access control policy is queried based on the segment path identifier in the data packet. If the segment path identifier in the data packet matches the segment path identifier in the matching condition, it indicates that the access control policy corresponds to the segment path identifier.

[0180] If the matching condition of the access control policy includes the attribute feature value, the first target attribute feature can be acquired from all attribute features of the segment path identifier of the data packet. On this basis,

[0181] If the first target attribute feature matches the attribute feature value in the matching condition, the access control policy corresponds to the first target attribute feature, that is, the access control policy corresponds to the segment path identifier.

[0182] If the first target attribute feature does not match the attribute feature value in the matching condition, the access control policy does not correspond to the first target attribute feature, that is, the access control policy does not correspond to the segment path identifier.

[0183] For example, if the attribute feature value in the matching condition is the segment routing policy identifier, the segment routing policy identifier (i.e., the first target attribute feature) can be acquired from all attribute features of the segment path identifier of the data packet. In this way, if the segment routing policy identifier is the same as the attribute feature value in the matching condition, the access control policy corresponds to the segment path identifier. Or, if the segment routing policy identifier is not the same as the attribute feature value in the matching condition, the access control policy does not correspond to the segment path identifier.

[0184] For another example, if the attribute feature value in the matching condition is the segment routing path identifier, the segment routing path identifier (i.e., the first target attribute feature) can be acquired from all attribute features of the segment path identifier of the data packet. In this way, if the segment routing path identifier is the same as the attribute feature value in the matching condition, the access control policy corresponds to the segment path identifier. Or, if the segment routing path identifier is not the same as the attribute feature value in the matching condition, the access control policy does not correspond to the segment path identifier.

[0185] If the matching condition of the access control policy includes the attribute feature value interval, the first target attribute feature can be acquired from all attribute features of the segment path identifier of the data packet. On this basis,

[0186] If the first target attribute feature is located in the attribute feature value interval in the matching condition, the access control policy corresponds to the first target attribute feature, that is, the access control policy corresponds to the segment path identifier.

[0187] If the first target attribute feature does not locate in the attribute feature value interval in the matching condition, the access control policy does not correspond to the first target attribute feature, i.e., the access control policy does not correspond to the segment path identifier.

[0188] For example, if the attribute feature value interval in the matching condition is a segment routing policy identifier interval, the segment routing policy identifier (i.e., the first target attribute feature) can be obtained from all attribute features of the segment path identifier of the data packet, so that if the segment routing policy identifier locates in the segment routing policy identifier interval, the access control policy corresponds to the segment path identifier. Otherwise, the access control policy does not correspond to the segment path identifier.

[0189] In one example, the first target attribute feature includes a candidate path identifier, and the candidate path identifier is used to indicate a candidate path to which the segment path belongs. The attribute feature value of the matching condition can include a specified network node. Based on this, if the candidate path indicated by the candidate path identifier includes the specified network node, the first target attribute feature matches the attribute feature value. Otherwise, the first target attribute feature does not match the attribute feature value.

[0190] For example, the attribute feature value of the matching condition can include the intermediate node P2 (i.e., the specified network node), i.e., only the data packet passing through the intermediate node P2 can match the access control policy, and the data packet not passing through the intermediate node P2 cannot match the access control policy. On this basis, the candidate path identifier (i.e., the first target attribute feature) can be obtained from all attribute features of the segment path identifier of the data packet, and the candidate path identifier is used to indicate a candidate path to which the segment path belongs. The candidate path is a set of segment paths having certain same attributes, if the set passes through the intermediate node P2, it means that the data packet will pass through the intermediate node P2, so that the first target attribute feature matches the attribute feature value in the matching condition, and the access control policy corresponds to the first target attribute feature, i.e., the access control policy corresponds to the segment path identifier. In addition, if the set does not pass through the intermediate node P2, it means that the data packet will not pass through the intermediate node P2, so that the access control policy does not correspond to the segment path identifier.

[0191] In step S16, the intermediate node P4 receives the data packet sent by the intermediate node P2, the data packet includes a segment routing tunnel header and an inner payload packet, and the segment path identifier is obtained from the segment routing tunnel header.

[0192] Step S17, the intermediate node P4 queries whether the session table item exists the access control policy corresponding to the segment path identifier. If yes, the intermediate node P4 acquires the access control policy corresponding to the segment path identifier from the session table item. If no, the access control policy corresponding to the segment path identifier can be acquired from the policy library, or the access control policy corresponding to the segment path identifier can be acquired from the third-party device.

[0193] Step S18, if the intermediate node P4 can query the access control policy corresponding to the segment path identifier, the data packet is processed based on the access control policy. If the intermediate node P4 cannot query the access control policy corresponding to the segment path identifier, the data packet is sent to the intermediate node P6 based on the segment routing tunnel header.

[0194] The processing process of the intermediate node P4 is similar to that of the intermediate node P2, which will not be described here.

[0195] Step S19, the intermediate node P6 receives the data packet sent by the intermediate node P4, the data packet includes the segment routing tunnel header and the inner layer load packet, and the segment path identifier is acquired from the segment routing tunnel header.

[0196] Step S20, the intermediate node P6 queries whether the session table item exists the access control policy corresponding to the segment path identifier. If yes, the intermediate node P6 acquires the access control policy corresponding to the segment path identifier from the session table item. If no, the access control policy corresponding to the segment path identifier can be acquired from the policy library, or the access control policy corresponding to the segment path identifier can be acquired from the third-party device.

[0197] Step S21, if the intermediate node P6 can query the access control policy corresponding to the segment path identifier, the data packet is processed based on the access control policy. If the intermediate node P6 cannot query the access control policy corresponding to the segment path identifier, the data packet is sent to the tail end node P8 based on the segment routing tunnel header.

[0198] The processing process of the intermediate node P6 is similar to that of the intermediate node P2, except that the intermediate node P6 cannot query the access control policy corresponding to the segment path identifier.

[0199] Step S22, the tail end node P8 receives the data packet sent by the intermediate node P6, the data packet includes the segment routing tunnel header and the inner layer load packet, and the segment path identifier is acquired from the segment routing tunnel header.

[0200] Step S23, the tail end node P8 queries whether the session table item exists the access control policy corresponding to the segment path identifier. If yes, the tail end node P8 acquires the access control policy corresponding to the segment path identifier from the session table item. If no, the access control policy corresponding to the segment path identifier can be acquired from the policy library, or the access control policy corresponding to the segment path identifier can be acquired from the third party device.

[0201] Step S24, if the tail end node P8 can query the access control policy corresponding to the segment path identifier, the data packet is processed based on the access control policy. If the tail end node P8 cannot query the access control policy corresponding to the segment path identifier, the data packet is sent to the destination node S1 based on the segment routing tunnel header.

[0202] At this point, the data packet is successfully sent to the destination node S1, and the transmission process of the data packet is completed.

[0203] In one example, the above-mentioned access control method based on the segment path identifier can be conveniently applied to network service function chain (SFC) or security service function chain (SFC) scenarios. In the SRv6-based network service function chain or security service function chain, an SRv6 SID is allocated to each SFF and SR-aware SF, and the service chain is described by an SRv6 SID list. The SF can be SR-aware or SR-unaware. For the SR-unaware SF, an SR Proxy needs to be deployed. The SR Proxy removes the SRH of the data packet and continues to send it to the SF, and restores the SRH when receiving the data packet processed by the SF.

[0204] In the SRv6-based network service function chain or security service function chain, access control of the data packet can be implemented based on the segment path identifier. For example, referring to FIG. 5, the intermediate node P2 configures an access control policy a1 based on the segment path identifier, and then sends the data packet to the service node 1. The intermediate node P4 configures an access control policy a2 based on the segment path identifier, and then sends the data packet to the service node 2.

[0205] In one example, the destination node S1 performs local policy control based on its own security requirements, requiring all access traffic to pass through the traffic cleaning service and the intrusion prevention service, that is, only the data packet passing through the traffic cleaning service and the intrusion prevention service can access the destination node S1. Based on this, the data packet needs to pass through the service node 1 to implement the traffic cleaning service, and also needs to pass through the service node 2 to implement the intrusion prevention service.

[0206] Based on this, the tail end node P8 can configure a security policy based on the segment path identification, and the security policy is used to check whether the forwarding path of the data packet passes through the specified type node, such as the intermediate node P2 and the intermediate node P4. For example, on the tail end node P8, the access control policy a3 configured in the segment path identification of the segment routing path (P2, P4, P6, P8) can be accessed, and the corresponding matching action of release can be set. The access control policy a4 configured in the segment path identification of the segment routing path (P3, P5, P7, P8) can be accessed, and the corresponding matching action of blocking can be set.

[0207] If the forwarding path of the data packet passes through the specified type node, that is, the forwarding path of the data packet is the head end node P1, the intermediate node P2, the intermediate node P4, the intermediate node P6 and the tail end node P8, the tail end node P8 can obtain the segment path identification attribute value from the segment routing tunnel header of the data packet, match the access control policy a3 according to the path identification attribute value, and execute the matching action of the access control policy a3, that is, send the data packet to the destination node S1.

[0208] If the forwarding path of the data packet does not pass through the specified type node, that is, the forwarding path of the data packet is the head end node P1, the intermediate node P3, the intermediate node P5, the intermediate node P7 and the tail end node P8, the tail end node P8 can obtain the segment path identification attribute value from the segment routing tunnel header of the data packet, match the access control policy a4 according to the path identification attribute value, and execute the matching action of the access control policy a4, that is, discard the data packet. Then, the tail end node P8 can also send the path feedback data packet discard reason to the head end node P1, and the head end node P1 can re-specify the forwarding path after receiving the feedback information, so that the forwarding path passes through the specified type node, that is, the head end node P1 can specify the forwarding path as "head end node P1-intermediate node P2-intermediate node P4-intermediate node P5-tail end node P8".

[0209] Based on the above processing, since the access control policy a3 configured in the segment path identification of the segment routing path (P2, P4, P6, P8) allows the data packet passing through the intermediate node P2 and the intermediate node P4, when the forwarding path is the head end node P1-intermediate node P2-intermediate node P4-intermediate node P5-tail end node P8, the data packet is allowed to pass through, and the tail end node P8 sends the data packet to the destination node S1. When the forwarding path is the head end node P1-intermediate node P3-intermediate node P5-intermediate node P7-tail end node P8, since the access control policy a4 configured in the segment path identification of the segment routing path (P3, P5, P7, P8) does not allow the data packet to pass through, the tail end node P8 does not send the data packet to the destination node S1.

[0210] For each node, when the node sends the data packet based on the segment routing tunnel header, the node detects the Last Entry field (used to represent the index of the last element in the segment routing list) of the segment routing tunnel header. If the content in the Last Entry field is the same as the identifier of the node, it means that the node is the last node in the segment routing list, and the inner payload packet behind the segment routing tunnel header is sent to the destination node S1. If the content in the Last Entry field is different from the identifier of the node, it means that the node is not the last node in the segment routing list, and the data packet is forwarded based on the segment routing tunnel header, and so on.

[0211] In one example, in the configuration method of the access control policy, the segment path identifier is replaced by the network layer data session flow attribute identifier and the segment path identifier, that is, the matching condition of the access control policy is related to the network layer data session flow attribute identifier and the segment path identifier, or related to the attribute value of the network layer data session flow attribute identifier and the attribute value of the segment path identifier. In the packet processing method based on the segment path identifier, the segment path identifier is replaced by the network layer data session flow attribute identifier and the segment path identifier. For example, it is determined whether there is an access control policy corresponding to the network layer data session flow attribute identifier and the segment path identifier.

[0212] In one example, the network layer data session flow attribute identifier can include at least one of the following contents:

[0213] Source address. In addition to the segment routing tunnel header and the inner payload packet, the outer layer of the data packet is also encapsulated with an IPv6 packet header, and the IPv6 packet header includes the source address of the data packet, that is, the IP address of the source node C1. Based on this, for the head node, the intermediate node and the tail node, the source address can be obtained from the IPv6 packet header.

[0214] Traffic type. In addition to the segment routing tunnel header and the inner payload packet, the outer layer of the data packet is also encapsulated with an IPv6 packet header, and the IPv6 packet header includes the traffic type of the data packet. Based on this, for the head node, the intermediate node and the tail node, the traffic type can be obtained from the IPv6 packet header.

[0215] Traffic identifier. In addition to the segment routing tunnel header and the inner payload packet, the outer layer of the data packet is also encapsulated with an IPv6 packet header, and the IPv6 packet header includes the traffic identifier of the data packet. Based on this, for the head node, the intermediate node and the tail node, the traffic identifier can be obtained from the IPv6 packet header.

[0216] Ingress address. The data packet is encapsulated with the segment routing tunnel header, and the segment routing tunnel header includes the identification information of the head-end node (i.e., the ingress address). Based on this, the ingress address can be obtained from the segment routing tunnel header for the head-end node, the intermediate node, and the tail-end node. For example, the ingress address is obtained from the last Segment List[n] of the segment routing list of the segment routing tunnel header. For example, in the segment path type identification field of the segment path identification of the segment routing tunnel header, the third identification is used to indicate that the segment routing tunnel header includes the identification information of the head-end node or does not include the identification information of the head-end node. Based on this, if the third identification is used to indicate that the segment routing tunnel header includes the identification information of the head-end node, the identification information of the head-end node can be obtained from the segment routing tunnel header, and the identification information of the head-end node is the ingress address.

[0217] Egress address. The data packet is encapsulated with the segment routing tunnel header, and the segment routing tunnel header includes the identification information of the tail-end node (i.e., the egress address). Based on this, the egress address can be obtained from the segment routing tunnel header for the head-end node, the intermediate node, and the tail-end node. For example, the egress address is obtained from the first Segment List[0] of the segment routing list of the segment routing tunnel header.

[0218] Routing type. The data packet is encapsulated with the segment routing tunnel header, and the segment routing tunnel header includes the routing type (Routing Type, which is used to represent the routing header type), as shown in FIG. 3C. Based on this, the routing type can be obtained from the segment routing tunnel header for the head-end node, the intermediate node, and the tail-end node.

[0219] Data identification. The data packet is encapsulated with the segment routing tunnel header, and the segment routing tunnel header includes the data identification. The data identification is obtained from the segment routing tunnel header for the head-end node, the intermediate node, and the tail-end node.

[0220] As can be seen from the above, the network layer data session flow attribute identification can include at least one of the source address, the traffic type, the traffic identification, the ingress address, the egress address, the routing type, and the data identification. Of course, in addition to the above, the inner layer session information of the segment routing tunnel header can be obtained, i.e., the information of the inner layer payload packet is obtained, such as the destination address, the source port number, the target port number, the protocol type, and the like. The network layer data session flow attribute identification can also include at least one of the destination address, the source port number, the target port number, and the protocol type.

[0221] From the above technical solutions, in the embodiment of the application, the segment path identifier is acquired from the segment routing tunnel header of the data packet, the data packet is sent to the service node based on the access control policy corresponding to the segment path identifier, so that the service node performs security processing on the data packet, thereby providing security service for the data packet, and the security-processed data packet is transmitted in the network, thereby avoiding security risks to the network.

[0222] An access control method based on a segment path identifier is proposed, a new traffic control dimension under segment routing is provided, and the access control is implemented by maintaining and searching for segment path lists with different lengths and long structures, thereby greatly reducing the implementation and maintenance of the segment path control policy. A session flow establishment and access control method based on a segment path identifier in a segment routing domain is proposed, and the problem that there is no simple and effective control method for service traffic under segment routing is solved. The application of segment routing technology in path performance measurement, bidirectional path binding, and end-to-end path protection scenarios is simplified. A new dimension is provided for security control of network security devices such as switches and firewalls, and the difficulty of implementation, maintenance, and management is greatly reduced.

[0223] Based on the same application concept as the above method, in the embodiment of the application, a packet processing device is proposed, which is applied to a network device serving as a head node, an intermediate node, or a tail node. Referring to FIG. 7, a structure diagram of the packet processing device is shown. The device can include:

[0224] An acquisition module 71 is configured to acquire a data packet, wherein the data packet includes a segment routing tunnel header; and acquire a segment path identifier from the segment routing tunnel header.

[0225] A sending module 72 is configured to, if there is an access control policy corresponding to the segment path identifier, and the access control policy includes path information used for sending a data packet to a service node, send the data packet to the service node based on the access control policy, so that the service node performs security processing on the data packet; and if a data packet returned by the service node is received, send the data packet based on the segment routing tunnel header of the data packet.

[0226] In one example, the acquisition module 71 is configured to, when acquiring the access control policy corresponding to the segment path identifier, query whether the access control policy corresponding to the segment path identifier exists in a session table item.

[0227] If yes, the access control policy corresponding to the segment path identifier is acquired from the session table item.

[0228] If no, and there is an access control policy corresponding to the segment path identifier in a policy library of the network device, the access control policy corresponding to the segment path identifier is obtained from the policy library, and the access control policy corresponding to the segment path identifier is recorded in the session table item; wherein the access control policy in the policy library is configured by a user on the network device; or the access control policy in the policy library is the access control policy corresponding to the segment path identifier of the network device sent by a controller.

[0229] Or, if no, the segment path identifier is sent to a third-party device, so that the third-party device queries the access control policy corresponding to the segment path identifier; and if the access control policy corresponding to the segment path identifier sent by the third-party device is received, the access control policy corresponding to the segment path identifier is recorded in the session table item.

[0230] In one example, the segment path identifier is used to describe attribute characteristics of a segment path of a segment routing, the attribute characteristics are used for access control on data packets, and the segment path represents a segment path between a head-end node, an intermediate node and a tail-end node; the obtaining module 71 is specifically configured to: obtain a first target attribute characteristic from all attribute characteristics of the segment path identifier; determine whether there is an access control policy corresponding to the first target attribute characteristic; if yes, the access control policy corresponding to the first target attribute characteristic is determined as the access control policy corresponding to the segment path identifier; wherein the access control policy includes a matching condition and a matching action;

[0231] If the matching condition includes an attribute characteristic value, and the first target attribute characteristic matches the attribute characteristic value, the access control policy corresponds to the first target attribute characteristic;

[0232] Or, if the matching condition includes an attribute characteristic value interval, and the first target attribute characteristic is located in the attribute characteristic value interval, the access control policy corresponds to the first target attribute characteristic.

[0233] In one example, the first target attribute characteristic includes a candidate path identifier, and the candidate path identifier is used to indicate a candidate path to which the segment path belongs; the attribute characteristic value of the matching condition includes a specified network node; if the candidate path indicated by the candidate path identifier includes the specified network node, the first target attribute characteristic matches the attribute characteristic value.

[0234] In one example, the obtaining module 71 is further configured to obtain a second target attribute feature from all attribute features identified by the segment path identifier; the second target attribute feature is used to indicate an application scenario corresponding to the segment path identifier; and if the application scenario corresponding to the segment path identifier is a security access control scenario, it is determined whether there is an access control policy corresponding to the segment path identifier.

[0235] In one example, when the obtaining module 71 obtains the segment path identifier from the segment routing tunnel header, it is specifically configured to: obtain a specified flag bit from the segment routing tunnel header; the specified flag bit is a first value or a second value; the first value indicates that the segment routing tunnel header includes a segment path identifier, and the second value indicates that the segment routing tunnel header does not include a segment path identifier; and if the specified flag bit is the first value, the segment path identifier is obtained from the segment routing tunnel header.

[0236] In one example, if the network device acts as a head-end node, the obtaining module 71 is specifically configured to: after receiving an inner-layer payload message, encapsulate a segment routing tunnel header for the inner-layer payload message to obtain the data message; when encapsulating the segment routing tunnel header, the segment routing tunnel header includes a segment path identifier and a segment routing list, and the segment routing list includes identification information of the tail-end node, identification information of the intermediate node, and identification information of the head-end node.

[0237] In one example, if the network device acts as a head-end node, the obtaining module 71 is further configured to:

[0238] If the segment path between the head-end node, the intermediate node, and the tail-end node is generated by the network device, the segment path identifier is assigned to the segment path when the segment path is generated; the segment path identifier is published to the intermediate node and the tail-end node; or the segment path identifier is published to a controller, so that the controller publishes the segment path identifier to the intermediate node and the tail-end node; or if the segment path between the head-end node, the intermediate node, and the tail-end node is generated by a controller, a publishing message sent by the controller is received, the publishing message includes a segment path identifier, and the segment path identifier is assigned to the segment path by the controller when the segment path is generated.

[0239] In one example, if the network device acts as a tail-end node, the obtaining module 71 is further configured to:

[0240] if the network device allocates the segment path identifier of the segment path between the head node, the intermediate node and the tail node, the sending module 72 is further configured to send a path computation request to the head node, so that the head node generates the segment path; receive the segment path sent by the head node, allocate a segment path identifier to the segment path; publish the segment path identifier and the segment path to the intermediate node and the head node; or, publish the segment path identifier and the segment path to a controller, so that the controller publishes the segment path identifier and the segment path to the intermediate node and the head node.

[0241] Or, if the network device allocates the segment path identifier of the segment path between the head node, the intermediate node and the tail node, the sending module 72 is further configured to send a path computation request to a controller, so that the controller generates the segment path; receive the segment path sent by the controller, allocate a segment path identifier to the segment path; publish the segment path identifier and the segment path to the intermediate node and the head node; or, publish the segment path identifier and the segment path to the controller, so that the controller publishes the segment path identifier and the segment path to the intermediate node and the head node.

[0242] In one example, if the network device acts as a tail node, the sending module 72 is further configured to:

[0243] determine whether the forwarding path of the data packet passes through a specified type node, the specified type node being a node that needs to send the data packet to a service node based on an access control policy;

[0244] if yes, send the data packet based on the segment routing tunnel header;

[0245] if no, discard the data packet, send a path update request to the head node, and re-assign the forwarding path by the head node, and the forwarding path passes through the specified type node.

[0246] In one example, the segment path identifier includes at least one of the following attribute features:

[0247] a segment path type identifier, the segment path type identifier including at least one of the following: a first identifier for indicating that the segment path identifier is a global identifier or a local identifier; a second identifier for indicating that the segment path identifier is a static path identifier or a dynamic path identifier; a third identifier for indicating that the segment routing tunnel header includes identification information of the head node or does not include identification information of the head node; a fourth identifier for indicating content that needs to be verified; a fifth identifier for indicating a verification algorithm; and a sixth identifier for indicating an application scenario corresponding to the segment path identifier.

[0248] a segment routing policy identifier, the segment routing policy identifier being used to indicate a segment routing policy to which the segment path belongs;

[0249] a candidate path identifier, the candidate path identifier being used to indicate a candidate path to which the segment path belongs;

[0250] a segment routing path identifier, the segment routing path identifier being used to indicate a segment routing path to which the segment path belongs;

[0251] a check value, the check value being obtained by checking the content indicated by the fourth identifier using a check algorithm indicated by the fifth identifier.

[0252] Based on the same application concept as the above method, the embodiment of the present application proposes a network device, as shown in FIG. 8, the network device comprises: a processor 81 and a machine readable storage medium 82, the machine readable storage medium 82 stores machine executable instructions which can be executed by the processor 81; the processor 81 is used to execute the machine executable instructions to realize the packet processing method disclosed in the above examples of the present application.

[0253] Based on the same application concept as the above method, the embodiment of the present application further provides a machine readable storage medium, the machine readable storage medium stores a plurality of computer instructions, when the computer instructions are executed by a processor, the packet processing method disclosed in the above examples of the present application can be realized.

[0254] The above machine readable storage medium can be any electronic, magnetic, optical or other physical storage device, and can contain or store information such as executable instructions, data, etc. For example, the machine readable storage medium can be: RAM (Radom Access Memory, Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drive (such as hard disk drive), solid state disk, any type of storage disk (such as optical disk, dvd, etc.), or similar storage medium, or combination thereof.

[0255] Based on the same application concept as the above method, the embodiment of the present application further provides a computer program product, comprising a computer program, the computer program is executed by a processor to realize the above packet processing method.

[0256] Those skilled in the art will appreciate that embodiments of the present application can be readily used as a method, a system or a computer program product. Accordingly, the present application can take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, embodiments of the present application can take the form of a computer program product on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROMs, optical storage devices, etc.) embodying computer readable program code thereon for use by or in connection with an instruction execution system. For the purposes of this description, a computer-usable or computer readable storage medium can be any apparatus that can contain, store, communicate, propagate, or transport the program for use by or in connection with the instruction execution system, apparatus, or device. The medium can be electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system (or apparatus or device) or a propagation medium. The computer-usable or computer readable program code can be downloaded from an Internet location (such as websites, server, or other host computers) or from one computer to another over the network.

[0257] The embodiments of the present application described above are merely intended to illustrate the principles of the present application, and should not be used to limit the scope of the present application. Various modifications and changes can be made by those skilled in the art to the embodiments of the present application without departing from the spirit and scope of the present application. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principle of the present application should be included in the scope of the claims of the present application.

Claims

1. A method of processing a packet, the method comprising: The method is applied to a network device, and comprises the following steps: obtaining a data packet, wherein the data packet comprises a segment routing tunnel header; obtaining a segment path identifier from the segment routing tunnel header; if there is an access control policy corresponding to the segment path identifier, and the access control policy comprises path information used for sending the data packet to a service node, then sending the data packet to the service node based on the access control policy, so that the service node performs security processing on the data packet; if a data packet returned by the service node is received, then sending the data packet based on the segment routing tunnel header of the data packet.

2. The method of claim 1, wherein the existence of the access control policy corresponding to the segment path identifier comprises: querying whether the access control policy corresponding to the segment path identifier exists in a session table item; if yes, obtaining the access control policy corresponding to the segment path identifier from the session table item; if no, and the network device has a policy library, then obtaining the access control policy corresponding to the segment path identifier from the policy library, and recording the access control policy corresponding to the segment path identifier in the session table item; wherein the access control policy in the policy library is configured by a user on the network device, or the access control policy in the policy library is the access control policy corresponding to the segment path identifier of the network device sent by a controller; or, if no, sending the segment path identifier to a third-party device, so that the third-party device queries the access control policy corresponding to the segment path identifier; and if the access control policy corresponding to the segment path identifier sent by the third-party device is received, recording the access control policy corresponding to the segment path identifier in the session table item. The segment path identifier is used to describe attribute characteristics of a segment path of segment routing, and the attribute characteristics are used for access control of the data packet; and the segment path represents a segment path between a head node, an intermediate node, and a tail node.

3. The method according to claim 1 or 2, characterized in that, The existence of the access control policy corresponding to the segment path identifier comprises: obtaining a first target attribute characteristic from all attribute characteristics of the segment path identifier; determining whether there is an access control policy corresponding to the first target attribute characteristic; if yes, determining the access control policy corresponding to the first target attribute characteristic as the access control policy corresponding to the segment path identifier. The access control policy comprises a matching condition and a matching action; if the matching condition comprises an attribute characteristic value, and the first target attribute characteristic matches the attribute characteristic value, then the access control policy corresponds to the first target attribute characteristic; or, if the matching condition comprises an attribute characteristic value interval, and the first target attribute characteristic is located in the attribute characteristic value interval, then the access control policy corresponds to the first target attribute characteristic.

4. The method of claim 3, wherein ​ The first target attribute feature includes a candidate path identifier, and the candidate path identifier is used to indicate a candidate path to which the segment path belongs. The first target attribute feature matches the attribute feature value if the candidate path indicated by the candidate path identifier includes the specified network node.

5. The method according to claim 1 or 2, characterized in that, The process of determining whether there is an access control policy corresponding to the segment path identifier includes: obtaining a second target attribute feature from all attribute features of the segment path identifier, wherein the second target attribute feature is used to indicate an application scenario corresponding to the segment path identifier; and if the application scenario corresponding to the segment path identifier is a secure access control scenario, determining whether there is an access control policy corresponding to the segment path identifier.

6. The method of claim 1, wherein the obtaining of the segment path identifier from the segment routing tunnel header includes: obtaining a specified flag bit from the segment routing tunnel header, the specified flag bit being a first value or a second value, wherein the first value indicates that the segment routing tunnel header includes a segment path identifier, and the second value indicates that the segment routing tunnel header does not include a segment path identifier; and if the specified flag bit is the first value, obtaining the segment path identifier from the segment routing tunnel header.

7. The method of claim 1, wherein if the network device serves as a head-end node, the obtaining of the data packet includes: after receiving an inner-layer payload packet, encapsulating a segment routing tunnel header for the inner-layer payload packet to obtain the data packet; and in encapsulating the segment routing tunnel header, the segment routing tunnel header includes a segment path identifier and a segment routing list, and the segment routing list includes identification information of a tail-end node, identification information of an intermediate node, and identification information of the head-end node.

8. The method of claim 1, wherein if the network device serves as a head-end node, the method further includes: if a segment path between the head-end node, the intermediate node, and the tail-end node is generated by the network device, assigning a segment path identifier to the segment path when the segment path is generated; publishing the segment path identifier to the intermediate node and the tail-end node; or publishing the segment path identifier to a controller, so that the controller publishes the segment path identifier to the intermediate node and the tail-end node; or if a segment path between the head-end node, the intermediate node, and the tail-end node is generated by a controller, receiving a publishing message sent by the controller, the publishing message including a segment path identifier, and the segment path identifier being assigned to the segment path by the controller when the segment path is generated.

9. The method of claim 1, wherein if the network device serves as a tail-end node, the method further includes: if the network device allocates the segment path identifier of the segment path between the head node, the intermediate node and the tail node, the network device sends a path computation request to the head node to make the head node generate the segment path; the network device receives the segment path sent by the head node, allocates a segment path identifier to the segment path, and publishes the segment path identifier and the segment path to the intermediate node and the head node; or, the network device publishes the segment path identifier and the segment path to a controller to make the controller publish the segment path identifier and the segment path to the intermediate node and the head node; or, if the network device allocates the segment path identifier of the segment path between the head node, the intermediate node and the tail node, the network device sends a path computation request to a controller to make the controller generate the segment path; the network device receives the segment path sent by the controller, allocates a segment path identifier to the segment path, and publishes the segment path identifier and the segment path to the intermediate node and the head node; or, the network device publishes the segment path identifier and the segment path to the controller to make the controller publish the segment path identifier and the segment path to the intermediate node and the head node.

10. The method of claim 1, wherein, if the network device is the tail node, the method further comprises: determining whether the forwarding path of the data packet passes through a specified type node which needs to send the data packet to a service node based on an access control policy; if yes, sending the data packet based on the segment routing tunnel header; if no, discarding the data packet, sending a path update request to the head node, and re-designating the forwarding path by the head node, wherein the forwarding path passes through the specified type node.

11. The method of claim 3, wherein, the segment path identifier comprises at least one of the following attribute features: a segment path type identifier, which comprises at least one of the following: a first identifier for indicating that the segment path identifier is a global identifier or a local identifier; a second identifier for indicating that the segment path identifier is a static path identifier or a dynamic path identifier; a third identifier for indicating whether the segment routing tunnel header includes the identification information of the head node or does not include the identification information of the head node; a fourth identifier for indicating the content to be verified; a fifth identifier for indicating the verification algorithm; and a sixth identifier for indicating the application scenario corresponding to the segment path identifier; a segment routing policy identifier for indicating the segment routing policy to which the segment path belongs; a candidate path identifier for indicating the candidate path to which the segment path belongs; a segment routing path identifier for indicating the segment routing path to which the segment path belongs; and a verification value obtained by verifying the content to be verified indicated by the fourth identifier using the verification algorithm indicated by the fifth identifier. The apparatus is applied to a network device and comprises: ​ 12. A packet processing device, characterized by, ​ An obtaining module is configured to obtain a data packet, wherein the data packet comprises a segment routing tunnel header; obtain a segment path identifier from the segment routing tunnel header; A sending module is configured to, if there is an access control policy corresponding to the segment path identifier, and the access control policy comprises path information, the path information being used for sending the data packet to a service node, send the data packet to the service node based on the access control policy, so that the service node performs security processing on the data packet; and if a data packet returned by the service node is received, send the data packet based on a segment routing tunnel header of the data packet.

13. The apparatus of claim 12, wherein when the obtaining module obtains the access control policy corresponding to the segment path identifier, the obtaining module is specifically configured to: query whether the access control policy corresponding to the segment path identifier exists in a session table item; if yes, obtain the access control policy corresponding to the segment path identifier from the session table item; if no, and the access control policy corresponding to the segment path identifier exists in a policy library of the network device, obtain the access control policy corresponding to the segment path identifier from the policy library, and record the access control policy corresponding to the segment path identifier in the session table item; wherein the access control policy in the policy library is configured by a user on the network device, or the access control policy in the policy library is the access control policy corresponding to the segment path identifier of the network device sent by a controller; or, if no, send the segment path identifier to a third-party device, so that the third-party device queries the access control policy corresponding to the segment path identifier; and if the access control policy corresponding to the segment path identifier sent by the third-party device is received, record the access control policy corresponding to the segment path identifier in the session table item.

14. The apparatus of claim 12 or 13, wherein, The segment path identifier is used to describe attribute characteristics of a segment path of segment routing, the attribute characteristics are used for access control on the data packet, and the segment path indicates a segment path between a head node, an intermediate node, and a tail node. when the obtaining module obtains the access control policy corresponding to the segment path identifier, the obtaining module is specifically configured to: obtain a first target attribute characteristic from all attribute characteristics of the segment path identifier; determine whether there is an access control policy corresponding to the first target attribute characteristic; if yes, determine the access control policy corresponding to the first target attribute characteristic as the access control policy corresponding to the segment path identifier; wherein the access control policy comprises a matching condition and a matching action; if the matching condition comprises an attribute characteristic value, and the first target attribute characteristic matches the attribute characteristic value, the access control policy corresponds to the first target attribute characteristic; or, if the matching condition comprises an attribute characteristic value interval, and the first target attribute characteristic is located in the attribute characteristic value interval, the access control policy corresponds to the first target attribute characteristic.

15. The apparatus of claim 14, wherein The first target attribute feature includes a candidate path identifier, and the candidate path identifier is used to indicate a candidate path to which the segment path belongs. The first target attribute feature matches the attribute feature value if the candidate path indicated by the candidate path identifier includes the specified network node.

16. The apparatus of claim 12 or 13, wherein the obtaining module is further configured to: obtain a second target attribute feature from all attribute features of the segment path identifier, wherein the second target attribute feature is used to indicate an application scenario corresponding to the segment path identifier, and determine whether there is an access control policy corresponding to the segment path identifier if the application scenario corresponding to the segment path identifier is a security access control scenario.

17. The apparatus of claim 12, wherein the obtaining module is specifically configured to obtain the segment path identifier from the segment routing tunnel header by: obtaining a specified flag bit from the segment routing tunnel header, wherein the specified flag bit is a first value or a second value, the first value indicates that the segment routing tunnel header includes the segment path identifier, and the second value indicates that the segment routing tunnel header does not include the segment path identifier; and obtaining the segment path identifier from the segment routing tunnel header if the specified flag bit is the first value.

18. The apparatus of claim 12, wherein the obtaining module is specifically configured to obtain the data packet by: encapsulating a segment routing tunnel header for an inner-layer payload packet to obtain the data packet after receiving the inner-layer payload packet, wherein the segment routing tunnel header includes the segment path identifier and a segment routing list when encapsulating the segment routing tunnel header, and the segment routing list includes identification information of a tail-end node, identification information of an intermediate node, and identification information of a head-end node.

19. The apparatus of claim 12, wherein the obtaining module is further configured to: if a segment path between the head-end node, the intermediate node, and the tail-end node is generated by the network device, assign a segment path identifier to the segment path when generating the segment path; and publish the segment path identifier to the intermediate node and the tail-end node, or publish the segment path identifier to a controller to enable the controller to publish the segment path identifier to the intermediate node and the tail-end node. Alternatively, if a segment path between the head-end node, the intermediate node, and the tail-end node is generated by a controller, receive a publishing message sent by the controller, wherein the publishing message includes a segment path identifier assigned to the segment path by the controller when generating the segment path.

20. The apparatus of claim 12, wherein the obtaining module is further configured to: if the network device is a tail-end node, ​ ​ ​ If the network device allocates a segment path identifier of a segment path between a head node, an intermediate node and a tail node, the network device sends a path computation request to the head node to make the head node generate the segment path; and receives the segment path sent by the head node, and allocates a segment path identifier to the segment path. The network device publishes the segment path identifier and the segment path to the intermediate node and the head node; or publishes the segment path identifier and the segment path to a controller to make the controller publish the segment path identifier and the segment path to the intermediate node and the head node. Or, if the network device allocates a segment path identifier of a segment path between a head node, an intermediate node and a tail node, the network device sends a path computation request to a controller to make the controller generate the segment path; and receives the segment path sent by the controller, and allocates a segment path identifier to the segment path. The network device publishes the segment path identifier and the segment path to the intermediate node and the head node; or publishes the segment path identifier and the segment path to the controller to make the controller publish the segment path identifier and the segment path to the intermediate node and the head node.

21. The apparatus of claim 12, wherein, if the network device is the tail node, the sending module is further configured to: determine whether a forwarding path of the data packet passes through a specified type node, the specified type node being a node that needs to send the data packet to a service node based on an access control policy; if yes, send the data packet based on the segment routing tunnel header; if no, discard the data packet, send a path update request to a head node, and re-assign a forwarding path by the head node, wherein the forwarding path passes through the specified type node.

22. The apparatus of claim 14, wherein the segment path identifier comprises at least one of the following attribute features: a segment path type identifier, the segment path type identifier comprising at least one of the following: a first identifier indicating that the segment path identifier is a global identifier or a local identifier; a second identifier indicating that the segment path identifier is a static path identifier or a dynamic path identifier; a third identifier indicating whether the segment routing tunnel header includes identification information of the head node or does not include identification information of the head node; a fourth identifier indicating content that needs to be verified; a fifth identifier indicating a verification algorithm; and a sixth identifier indicating an application scenario corresponding to the segment path identifier; a segment routing policy identifier, the segment routing policy identifier indicating a segment routing policy to which the segment path belongs; a candidate path identifier, the candidate path identifier indicating a candidate path to which the segment path belongs; a segment routing path identifier, the segment routing path identifier indicating a segment routing path to which the segment path belongs; and a verification value, the verification value being obtained by verifying content indicated by the fourth identifier using the verification algorithm indicated by the fifth identifier. ​ ​ ​ 23. A network device, comprising: ​ a processor and a machine readable storage medium storing machine executable instructions executable by the processor; the processor is configured to execute the machine executable instructions to implement the method of any one of claims 1-11.

Images