SRv6 message forwarding security protection method and device, equipment and storage medium
By performing signature authentication and dynamic hash/key factor updates in the SRv6 packet header and SRH header, the security risks and compatibility issues in SRv6 network packet forwarding are resolved, achieving a balance between security and performance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- FIBERHOME TELECOMMUNICATION TECHNOLOGIES CO LTD
- Filing Date
- 2026-01-30
- Publication Date
- 2026-05-01
AI Technical Summary
The SRv6 network packet forwarding process is subject to path tampering and replay/spoofing attacks. Existing technical solutions increase the difficulty of network deployment and the loss of forwarding performance, and are not compatible with existing equipment.
By identifying the FLOW LABEL field in the SRv6 message header and the optional TLV information in the SRH header, signature authentication is achieved, hash and key algorithm factors are dynamically updated, SRH metadata is retained, security verification is performed, and it is compatible with existing network devices.
It reduces the risk of path tampering and replay/spoofing attacks, simplifies network deployment and maintenance, maintains forwarding performance, and is compatible with existing devices.
Smart Images
Figure CN121967014A_ABST
Abstract
Description
Technical Field
[0001] This application belongs to the field of communication network technology, and specifically relates to an SRv6 message forwarding security protection method, device, equipment and storage medium. Background Technology
[0002] As a next-generation IP bearer protocol, SRv6 relies on the IPv6 extension option header to achieve source routing forwarding. It has advantages such as network programmability, low latency and high flexibility, and has become one of the core technologies of 5G, cloud data centers and software-defined networking (SDN).
[0003] However, its highly flexible and scalable design also leads to significant security risks during SRv6 network packet forwarding. (Refer to...) Figure 1 , Figure 1 This diagram illustrates the security issues of SRv6 message forwarding in existing technology. (Example:) Figure 1 As shown, on the one hand, there is the risk of path tampering: the segment list carried by the SRH in the SRv6 packet header contains the complete path node addresses, and attackers can obtain network topology information or construct illegal paths to access restricted services by stealing or tampering with the SRH; on the other hand, there is the risk of replay and spoofing attacks: attackers can copy the legitimate packet segment list to carry out unauthorized service theft or denial-of-service attacks, which may eventually lead to the exhaustion of device resources.
[0004] To mitigate security risks during SRv6 network packet forwarding, existing technologies employ complex access control lists. This design significantly increases the difficulty of network deployment and maintenance, and its application scenarios are limited. (Refer to...) Figure 2 , Figure 2 This is a schematic diagram illustrating the implementation of existing SRv6 network packet security technologies. (For example...) Figure 2 As shown, Existing Technology 2 introduces additional extended option headers (adding HBH extended option header information on top of the SRv6 SRH extended header) to carry key information, etc. The introduction of new option headers will greatly increase the forwarding pipeline burden of the device chip. This design not only occupies internal chip bandwidth, but also greatly reduces forwarding performance, ultimately resulting in a decline in user experience. Existing Technology 3 directly encrypts the complete SID list or hop-by-hop SID information of the SRH in the SRv6 packet with specific key information, and then forwards it on the SRv6 domain path. When forwarding the SRv6 packet, the SID information needs to be copied to the DA field to guide the next-hop forwarding. At this time, the SID information is encrypted, which will cause existing devices to be unable to recognize the SID information and the forwarding will fail. This design is not compatible, and existing devices cannot directly process encrypted packets, making it difficult to deploy in actual network applications.
[0005] Therefore, there is an urgent need for a simple configuration and maintenance method that can both ensure normal packet forwarding of existing network devices without upgrades and minimize the impact on forwarding performance, thereby solving the security protection problem of SRv6 network packet forwarding. Summary of the Invention
[0006] This application provides a method, apparatus, device, and storage medium for SRv6 packet forwarding security protection, which can reduce the security risks in the SRv6 network packet forwarding process in the prior art.
[0007] To achieve the above objectives, this application provides the following technical solution: An SRv6 packet forwarding security protection method, the method comprising: When it is determined that the received SRv6 message needs to be verified for SRv6 security, and the preset bit position in the FLOW LABEL field of the SRv6 message header is set, the source address information and preset field information in the SRv6 message header are identified. Based on the source information mapping list, the source address information, and preset field information, the target HASH algorithm and target public key information are determined. Extract the SRH metadata fingerprint from the SRv6 message, and decrypt the SRH metadata fingerprint using the target public key information to obtain the first plaintext digest; Extract the SRH metadata from the SRv6 message, and calculate the second plaintext digest using the target HASH algorithm; If the first plaintext digest matches the second plaintext digest, then the SRv6 message is determined to have passed the security check, and the SRv6 message is forwarded.
[0008] Based on the same inventive concept, this application also provides an SRv6 message forwarding security protection device, the device comprising: The information acquisition module is configured to identify the source address information and preset field information in the SRv6 message header when it is determined that the received SRv6 message needs to be verified for SRv6 security and the preset bit position in the FLOW LABEL field of the SRv6 message header is set. The information matching module is configured to determine the target HASH algorithm and the target public key information based on the source information mapping list, the source address information, and preset field information. The information decryption module is configured to extract the SRH metadata fingerprint from the SRv6 message, and decrypt the SRH metadata fingerprint using the target public key information to obtain the first plaintext digest; The hash calculation module is configured to extract the SRH metadata from the SRv6 message, and calculate the SRH metadata using the target HASH algorithm to obtain a second plaintext digest; The information verification module is configured to determine that the SRv6 message has passed the security verification if the first plaintext digest is consistent with the second plaintext digest, and to forward the SRv6 message.
[0009] Based on the same inventive concept, this application also provides an electronic device, including: a memory and a processor; the processor is used to read and execute a computer program stored in the memory to implement the steps of the aforementioned SRv6 message forwarding security protection method.
[0010] Based on the same inventive concept, embodiments of this application also provide a computer storage medium storing computer-executable instructions, which, when executed, implement the steps of the aforementioned SRv6 message forwarding security protection method.
[0011] Compared with the prior art, this application has the following advantages: On the one hand, based on the FLOW LABEL field attribute in the SRv6 packet header and the optional TLV information extension in the SRH header, a secure verification scheme for signature authentication is implemented. This scheme does not require encrypting the SRH header information, is compatible with the functions of existing network devices, and is not detected by devices that have not been upgraded. This greatly reduces the risk of network hackers tampering with the path of network attacks by modifying the SRH or inserting new SRHs. On the other hand, by dynamically changing the hash algorithm factor and key algorithm factor to update the fingerprint of the SRH metadata of the SRv6 packet, the risk of packet replay and spoofing attacks is reduced to a certain extent.
[0012] On the other hand, by directly extending the SRv6 packet header attributes and SRH META TLV information, and retaining the SRH metadata in the SRv6 packet, network deployment and maintenance can be achieved through the complete SID list in the SRH metadata. This avoids the technical problem of existing technologies that require the deployment of complex access control list policies, which greatly increases the difficulty of network deployment and maintenance and has limited application scenarios. The hash algorithm factor and key algorithm factor are dynamically changed and forwarded with the message, eliminating the need to introduce additional extended option headers to carry key information. This avoids the technical problems of existing technology 2, which not only occupies internal chip bandwidth but also greatly reduces forwarding performance, ultimately leading to a decline in user experience.
[0013] The SRH metadata fingerprint is obtained by encrypting the hash value of the SRH metadata in the SRv6 message using a key algorithm. This SRH metadata fingerprint is then encapsulated in the META TLV of the SRH header of the SRv6 message and forwarded with the message. The hash algorithm and key algorithm used are controlled by dynamic hash algorithm factors and dynamic key algorithm factors, and their values are updated at fixed intervals. Subsequently, they are encapsulated in the FLOW LABEL information and forwarded with the message to inform the SRv6 receiving device of the hash algorithm and key algorithm required for the current SRv6 message encapsulation. This allows the SRv6 receiving device to identify the SID information in the SRH metadata by decryption. This solves the technical problem in the third existing technology where the encrypted SID information causes existing devices to be unable to identify the SID information, resulting in forwarding failure. This design lacks compatibility, existing devices cannot directly process encrypted messages, and deployment in actual network applications is difficult.
[0014] This application not only reduces the security risks in the SRv6 network packet forwarding process in the prior art, but also avoids the technical problems existing in the prior art.
[0015] Other features and advantages of this application will be set forth in the description which follows, and will be apparent in part from the description, or may be learned by practicing the application. The objectives and other advantages of this application may be realized and obtained by means of the structures pointed out in the description, claims and drawings. Attached Figure Description
[0016] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.
[0017] Figure 1 A diagram illustrating security issues in existing SRv6 message forwarding technology; Figure 2 A schematic diagram illustrating the implementation of existing SRv6 network packet security technologies; Figure 3 This is a flowchart illustrating an embodiment of the SRv6 message forwarding security protection method according to this application. Figure 4 This is a schematic diagram of the message encapsulation process of an SRv6 source device according to an embodiment of this application; Figure 5 This is a schematic diagram of the message parsing process of an SRv6 receiving device according to an embodiment of this application; Figure 6 This is a schematic diagram of SRv6 message extension according to an embodiment of this application; Figure 7 This is a schematic diagram illustrating the publication and acquisition of SRv6 domain key information according to an embodiment of this application; Figure 8 This is a schematic diagram of an SRv6 domain source information mapping list according to an embodiment of this application; Figure 9 This is a schematic diagram of the SRv6 source device message metadata fingerprint processing flow according to an embodiment of this application; Figure 10 This is a schematic diagram of the SRv6 receiver device message signature authentication process in this application; Figure 11 This is a schematic diagram of the functional modules of an embodiment of the SRv6 message forwarding security protection device of this application; Figure 12 This is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation
[0018] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.
[0019] To address the shortcomings of existing technologies, refer to Figure 3 This application discloses an SRv6 message forwarding security protection method, including: Step S10: When it is determined that the received SRv6 message needs to be verified by SRv6 security, and the preset bit position in the FLOWLABEL field of the SRv6 message header is set, the source address information and preset field information in the SRv6 message header are identified. In this embodiment, when the SRv6 receiving device receives an SRv6 packet from the network side, it needs to complete the SRv6 packet processing process, first checking whether the IPv6 DA matches the local SID. The IPv6 DA is a field in the IPv6 packet header used to store the IPv6 address of the final destination to which the packet is sent. If the IPv6 DA does not match the local SID, the normal IPv6 forwarding process is directly followed.
[0020] If the IPv6 DA matches the local SID, the local system performs the decapsulation process to decapsulate the received SRv6 packet from the network side. It should be noted that the SRv6 packet sent by the network side is the encapsulated SRv6 packet.
[0021] Specifically, the encapsulation process of SRv6 messages by the SRv6 source device is as follows: (Refer to...) Figure 4 After receiving a user-side packet, the SRv6 source device queries the service table information and encapsulates the original SRv6 packet, including service data, SRH option header information, and IPv6 packet header information. The source device needs to select whether to encapsulate the SRv6 packet with security information based on its local SRv6 security verification configuration information. For example, if the flag bit of the source device's local SRv6 security verification configuration information is 0, it is determined that no security encapsulation is needed, and the original SRv6 packet is forwarded. If the flag bit of the source device's local SRv6 security verification configuration information is 1, it is determined that security encapsulation is needed, i.e., the SRH metadata in the SRv6 packet is extracted, and a hash calculation is performed on the SRH metadata based on the local default hash algorithm to generate the original SRv6 packet security digest. It should be noted that the packet hash algorithm is updated periodically, ultimately reflected in the packet as a change in the dynamic hash algorithm factor.
[0022] After obtaining the original SRv6 message security digest, the SRv6 message security digest information is encrypted based on the private key information corresponding to the local default key algorithm, generating an SRH metadata fingerprint. It should be noted that the encryption key algorithm is periodically updated, ultimately reflected in the message as a change in the dynamic key algorithm factor. The generated SRH metadata fingerprint is then filled into the META TLV of the SRH header, where TYPE is filled with 0x11, Length is filled with the length of the encrypted information, and VALUE is filled with the SRv6 metadata fingerprint.
[0023] Finally, the complete SRv6 network security message is encapsulated, the business table entry is queried, and the encapsulated SRv6 message is forwarded through the network side.
[0024] Furthermore, referring to Figure 5After desealing the received SRv6 packets from the network side, the receiving node selects whether to perform security verification on the SRv6 packets based on its local SRv6 security verification configuration information. For example, if the flag bit of the receiving node's local SRv6 security verification configuration information is 0, it is determined that SRv6 security verification is not required, and the original SRv6 packet forwarding process continues. If the flag bit of the receiving node's local SRv6 security verification configuration information is 1, it is determined that SRv6 security verification is required. The node then checks whether the preset bit (e.g., the P bit) in the FLOW LABEL field of the SRv6 packet header is set. If it is not set, the packet is invalid, and a pre-set processing strategy needs to be executed: either discard the packet directly or forward it to a designated traffic scrubbing center. If the preset bit (e.g., the P bit) is set, the packet meets the initial security requirements, and the source address information and preset field information in the SRv6 packet header are identified.
[0025] Furthermore, in this embodiment, the preset field information is the extended information of the FLOW LABEL flag bit in the SRv6 message header; the extended information includes several bit information and is located at the end of the FLOW LABEL flag bit.
[0026] For example, refer to Figure 6 The extended information consists of the lower 5 bits of the FLOW LABEL flag in the extended SRv6 header: P, Q, R, S, and T bits. The P bit represents the check bit, controlled by the device configuration, indicating whether the device supports SRv6 security verification. The Q and R bits represent the dynamic hash algorithm factor bits, used to control the device to calculate the SRv6 message security digest. The S and T bits represent the dynamic key algorithm factor bits, used to guide the device to obtain the key information for decrypting the SRH metadata fingerprint in the SRv6 message.
[0027] The specific meanings of the extended information are shown in Table 1.
[0028] Table 1
[0029] As shown in Table 1, when the Q and R flag bits are 00, the target HASH algorithm is MD5; when the Q and R flag bits are 01, the target HASH algorithm is SHA-256; when the Q and R flag bits are 10, the target HASH algorithm is BLAKE3; and when the Q and R flag bits are 11, it indicates that it is not currently supported and will be used for future expansion.
[0030] When the S and T flag bits are 00, the target public key information is the public key information corresponding to the AES algorithm; when the S and T flag bits are 01, the target public key information is the public key information corresponding to the SM2 algorithm; when the S and T flag bits are 10, the target public key information is the public key information corresponding to the ECC algorithm; when the S and T flag bits are 11, it indicates that it is not currently supported and is intended for future expansion.
[0031] Step S20: Based on the source information mapping list, the source address information, and preset field information, determine the target HASH algorithm and the target public key information; In some specific embodiments, step S20 includes: Based on the source address information, match the source information mapping list to determine the n key algorithm factor information corresponding to the source address information; Based on the preset field information, the target hash algorithm factor information and the target key algorithm factor information are determined; Based on the target hash algorithm factor information, the target hash algorithm is determined. Based on the target key algorithm factor information, the target public key information is determined.
[0032] In this embodiment, refer to Figure 7 Nodes in the SRv6 domain need to interact with the PCE included in the SDN controller to obtain and publish the key information required for security authentication. Nodes in the SRv6 domain include source nodes and other receiving nodes. Source device nodes (e.g., R1): need to generate local key information based on a specific key algorithm set and publish the public key information to the SDN controller. Other receiving device nodes (e.g., R2 to R7): select to receive the source node's public key information based on the verification enable configuration, and generate a source information mapping list locally based on the source IP address for subsequent identification of how to dynamically process the received SRH metadata.
[0033] Specifically, parameters Figure 8 The source information mapping list includes SRv6 source address, key algorithm factor information and public key information. There is a one-to-many relationship between SRv6 source address and key algorithm factor information, and a one-to-one correspondence between key algorithm factor information and public key information.
[0034] The process of generating the source information mapping list is as follows: Each entry node in the SRv6 domain needs to maintain the key pair information required for this SRv6 security authentication, including a private key and a public key. The private key is specifically used to encrypt the SRH digest information (corresponding to 1 local key algorithm factor), and the public key is used to publish to other SRv6 nodes to parse the SRH metadata fingerprint in the SRv6 message.
[0035] The SRv6 source device, based on its local SRv6 security authentication and verification configuration, locally generates a combination of information including the SRv6 source address, key algorithm factor, and public key information, and sends it to the SDN controller. Specifically, if the flag bit of the security verification configuration information is 0, the status quo is maintained and no generation or publication is required; if the flag bit is 1, the local SRv6 processing module generates the corresponding combination information. The SDN controller then publishes this information within the SRv6 domain. It should be noted that the source device sends this message periodically, firstly because key pair information may be updated, and secondly to prevent the receiving device from aging and publishing security information, which could ultimately prevent the receiving device from properly processing the SRH metadata fingerprint and completing message security authentication.
[0036] The SRv6 receiving device obtains the combined information published by the SDN controller and selects to receive this combined information based on its local SRv6 security authentication and verification configuration. That is, devices with SRv6 security verification configuration receive this combined information, while devices without SRv6 security verification configuration can directly ignore the published combined information.
[0037] The receiving device parses the combined information published by the SDN controller and generates a source information mapping list locally. The key information is the SRv6 source IP address. When forwarding SRv6 packets, the public key information required for packet security authentication can be obtained through the SA information in the packet. The SA is a field in the IPv4 or IPv6 packet header used to store the source IP address of the device sending the packet.
[0038] As shown in Table 1 above, the target hash algorithm factor information can be determined based on the Q and R flag bits of the SRv6 message, and the target hash algorithm can be determined based on the target hash algorithm factor information. It should be noted that the SRv6 message carries hash algorithm factors, and the algorithm corresponding to each hash algorithm factor is standardized and does not need to be published.
[0039] Step S30: Extract the SRH metadata fingerprint from the SRv6 message, and decrypt the SRH metadata fingerprint using the target public key information to obtain the first plaintext digest; In this embodiment, the SRH metadata fingerprint is obtained by encrypting the hash value of the SRH metadata in the SRv6 message. Further details are provided below. Figure 6SRH metadata, used in the calculation of SRv6 message security digest information, includes: source address, Next Header, HDR Ext Len, Routing Type, Last Entry, and a complete list of SIDs. The SRH metadata fingerprint is located in the META TLV of the SRH header of the SRv6 message. The META TLV is obtained by extending the optional TLV information of the SRH header. (Continue referring to...) Figure 6 That is, the optional TLV information of the extended SRH header is introduced, with a new METATLV, TYPE=0x11, and vlaue is used to store the SRH meta information fingerprint, which is forwarded along the path with the SRv6 message.
[0040] The process of obtaining the SRH metadata fingerprint is as follows: Reference Figure 9 When the SRv6 source device receives a user-side message, it queries its local service forwarding table, encapsulates SRH metadata to assemble a complete SRv6 message, extracts predefined SRH metadata based on the SRv6 message content, applies the device's default hash algorithm to the SRH metadata to obtain the SRv6 message security digest. The SRv6 source device then encrypts the SRH metadata using the private key of the default key algorithm to obtain an SRH metadata fingerprint, which is then filled into the newly added Meta TLV in the SRH header. Finally, the FLOW LABEL information is updated, and the SRv6 message is forwarded to other nodes according to the data table entries. The HASH algorithm and key algorithm used are controlled by dynamic HASH algorithm factors and dynamic key algorithm factors. Their values are updated at fixed intervals and then encapsulated in the FLOW LABEL information and forwarded with the message. On the one hand, this is used to notify the SRv6 receiving device of the hash algorithm and key algorithm required for the current SRv6 message encapsulation. On the other hand, the SRv6 message content can be updated periodically, which can help prevent message replay attacks to some extent.
[0041] Reference Figure 10 After extracting the SRH metadata fingerprint from the SRv6 message, the SRH metadata fingerprint is decrypted using the target public key information to obtain the first plaintext digest (i.e., SRH security digest 1).
[0042] Step S40: Extract the SRH metadata from the SRv6 message, and calculate the SRH metadata using the target HASH algorithm to obtain the second plaintext digest; In this embodiment, we continue to refer to... Figure 10Extract the META TLV information from the SRH, and decrypt the encrypted metadata fingerprint in the vlaue using the public key information corresponding to the key algorithm to obtain the second plaintext digest (i.e., SRH security digest 2).
[0043] Step S50: If the first plaintext digest is consistent with the second plaintext digest, then the SRv6 message is determined to have passed the security check, and the SRv6 message is forwarded.
[0044] In this embodiment, we continue to refer to... Figure 10 The system compares the first plaintext digest with the second plaintext digest. If they match, the SRv6 packet passes the security check and is forwarded. If they do not match, the system executes the appropriate security policy, either discarding the SRv6 packet or forwarding it to a designated traffic scrubbing center.
[0045] In this embodiment, on the one hand, a secure verification scheme for signature authentication is implemented based on the FLOW LABEL field attribute in the SRv6 packet header and the optional TLV information extension in the SRH header. This scheme does not require encryption of the SRH header information, is compatible with the functions of existing network devices, and is not detected by devices that have not been upgraded. This greatly reduces the risk of network hackers tampering with the path of network attacks by modifying the SRH or inserting new SRHs. On the other hand, by dynamically changing the hash algorithm factor and key algorithm factor to update the fingerprint of the SRH metadata of the SRv6 packet, the risk of packet replay and spoofing attacks is reduced to a certain extent.
[0046] On the other hand, by directly extending the SRv6 packet header attributes and SRH META TLV information, and retaining the SRH metadata in the SRv6 packet, network deployment and maintenance can be achieved through the complete SID list in the SRH metadata. This avoids the technical problem of existing technologies that require the deployment of complex access control list policies, which greatly increases the difficulty of network deployment and maintenance and has limited application scenarios. The hash algorithm factor and key algorithm factor are dynamically changed and forwarded with the message, eliminating the need to introduce additional extended option headers to carry key information. This avoids the technical problems of existing technology 2, which not only occupies internal chip bandwidth but also greatly reduces forwarding performance, ultimately leading to a decline in user experience.
[0047] The SRH metadata fingerprint is obtained by encrypting the hash value of the SRH metadata in the SRv6 message using a key algorithm. This SRH metadata fingerprint is then encapsulated in the META TLV of the SRH header of the SRv6 message and forwarded with the message. The hash algorithm and key algorithm used are controlled by dynamic hash algorithm factors and dynamic key algorithm factors, and their values are updated at fixed intervals. Subsequently, they are encapsulated in the FLOW LABEL information and forwarded with the message to inform the SRv6 receiving device of the hash algorithm and key algorithm required for the current SRv6 message encapsulation. This allows the SRv6 receiving device to identify the SID information in the SRH metadata by decryption. This solves the technical problem in the third existing technology where the encrypted SID information causes existing devices to be unable to identify the SID information, resulting in forwarding failure. This design lacks compatibility, existing devices cannot directly process encrypted messages, and deployment in actual network applications is difficult.
[0048] This embodiment not only reduces the security risks in the SRv6 network packet forwarding process in the prior art, but also avoids the technical problems existing in the prior art.
[0049] Based on the same inventive concept, this application also provides an SRv6 message forwarding security protection device.
[0050] In one embodiment, reference is made to Figure 11 , Figure 11 This is a functional module diagram of an embodiment of the SRv6 message forwarding security protection device of this application. Figure 11 As shown, the SRv6 message forwarding security protection device includes: The information acquisition module 10 is configured to identify the source address information and preset field information in the SRv6 message header when it is determined that the received SRv6 message needs to be verified for SRv6 security and the preset bit in the FLOW LABEL field of the SRv6 message header is set. Information matching module 20 is configured to determine the target HASH algorithm and target public key information based on the source information mapping list, the source address information and preset field information; The information decryption module 30 is configured to extract the SRH metadata fingerprint from the SRv6 message, and decrypt the SRH metadata fingerprint using the target public key information to obtain the first plaintext digest; The hash calculation module 40 is configured to extract the SRH metadata from the SRv6 message and calculate the SRH metadata using the target HASH algorithm to obtain a second plaintext digest. The information verification module 50 is configured to determine that the SRv6 message has passed the security verification if the first plaintext digest is consistent with the second plaintext digest, and to forward the SRv6 message.
[0051] Optionally, in one embodiment, the SRH metadata includes: source address, Next Header, HdrExt Len, Routing Type, Last Entry, and a complete list of SIDs.
[0052] Optionally, in one embodiment, the SRH metadata fingerprint is obtained by encrypting the hash value of the SRH metadata in the SRv6 message.
[0053] Optionally, in one embodiment, the SRH metadata fingerprint is located in the META TLV of the SRH header of the SRv6 message, and the META TLV is obtained by extending the optional TLV information of the SRH header.
[0054] Optionally, in one embodiment, the source information mapping list includes SRv6 source address, key algorithm factor information, and public key information, wherein there is a one-to-many relationship between the SRv6 source address and the key algorithm factor information, and a one-to-one correspondence between the key algorithm factor information and the public key information.
[0055] Optionally, in one embodiment, the information matching module 20 is configured to: Based on the source address information, match the source information mapping list to determine the n key algorithm factor information corresponding to the source address information; Based on the preset field information, the target hash algorithm factor information and the target key algorithm factor information are determined; Based on the target hash algorithm factor information, the target hash algorithm is determined. Based on the target key algorithm factor information, the target public key information is determined.
[0056] Optionally, in one embodiment, the preset field information is the extended information of the FLOW LABEL flag bit in the SRv6 message header; the extended information includes several bits and is located at the end of the FLOW LABEL flag bit.
[0057] The functions of each module in the aforementioned SRv6 message forwarding security protection device correspond to the steps in the aforementioned SRv6 message forwarding security protection method embodiment, and their functions and implementation processes will not be described in detail here.
[0058] Based on the same inventive concept, embodiments of this application also provide an electronic device, the structure of which is as follows: Figure 12As shown, it includes: a memory and a processor, wherein the processor is used to read and execute the computer program stored in the memory to implement the aforementioned SRv6 packet forwarding security protection method.
[0059] Based on the same inventive concept, this application also provides a computer storage medium storing computer-executable instructions, which, when executed, implement the aforementioned SRv6 message forwarding security protection method.
[0060] Finally, it should be noted that while some processes described in the embodiments of this application include multiple operations or steps that appear in a specific order, it should be understood that these operations or steps may not be executed in the order they appear in the embodiments of this application, or may be executed in parallel. The sequence number of the operation is only used to distinguish different operations, and the sequence number itself does not represent any execution order. In addition, these processes may include more or fewer operations, and these operations or steps may be executed sequentially or in parallel, and these operations or steps may be combined.
[0061] Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.
Claims
1. A method for protecting the security of SRv6 message forwarding, characterized in that, The method includes: When it is determined that the received SRv6 message needs to be verified for SRv6 security, and the preset bit position in the FLOW LABEL field of the SRv6 message header is set, the source address information and preset field information in the SRv6 message header are identified. Based on the source information mapping list, the source address information, and preset field information, the target HASH algorithm and target public key information are determined. Extract the SRH metadata fingerprint from the SRv6 message, and decrypt the SRH metadata fingerprint using the target public key information to obtain the first plaintext digest; Extract the SRH metadata from the SRv6 message, and calculate the second plaintext digest using the target HASH algorithm; If the first plaintext digest matches the second plaintext digest, then the SRv6 message is determined to have passed the security check, and the SRv6 message is forwarded.
2. The method according to claim 1, characterized in that, The SRH metadata includes: source address, Next Header, Hdr Ext Len, Routing Type, Last Entry, and a complete list of SIDs.
3. The method according to claim 1 or 2, characterized in that, The SRH metadata fingerprint is obtained by encrypting the hash value of the SRH metadata in the SRv6 message.
4. The method according to claim 1, characterized in that, The SRH metadata fingerprint is located in the META TLV of the SRH header of the SRv6 message, and the META TLV is obtained by extending the optional TLV information of the SRH header.
5. The method according to claim 1, characterized in that, The source information mapping list includes SRv6 source address, key algorithm factor information and public key information, wherein there is a one-to-many relationship between the SRv6 source address and the key algorithm factor information, and a one-to-one correspondence between the key algorithm factor information and the public key information.
6. The method according to claim 1 or 5, characterized in that, The determination of the target HASH algorithm and target public key information based on the source information mapping list, the source address information, and preset field information includes: Based on the source address information, match the source information mapping list to determine the n key algorithm factor information corresponding to the source address information; Based on the preset field information, the target hash algorithm factor information and the target key algorithm factor information are determined; Based on the target hash algorithm factor information, the target hash algorithm is determined. Based on the target key algorithm factor information, the target public key information is determined.
7. The method according to claim 1, characterized in that, The preset field information is the extended information of the FLOWLABEL flag bit in the SRv6 message header; the extended information includes several bits and is located at the end of the FLOW LABEL flag bit.
8. An SRv6 message forwarding security protection device, characterized in that, The device includes: The information acquisition module is configured to identify the source address information and preset field information in the SRv6 message header when it is determined that the received SRv6 message needs to be verified for SRv6 security and the preset bit position in the FLOW LABEL field of the SRv6 message header is set. The information matching module is configured to determine the target HASH algorithm and the target public key information based on the source information mapping list, the source address information, and preset field information. The information decryption module is configured to extract the SRH metadata fingerprint from the SRv6 message, and decrypt the SRH metadata fingerprint using the target public key information to obtain the first plaintext digest; The hash calculation module is configured to extract the SRH metadata from the SRv6 message, and calculate the SRH metadata using the target HASH algorithm to obtain a second plaintext digest; The information verification module is configured to determine that the SRv6 message has passed the security verification if the first plaintext digest is consistent with the second plaintext digest, and to forward the SRv6 message.
9. An electronic device, characterized in that, include: Memory, processor; The processor is configured to read and execute the computer program stored in the memory to implement the steps of the SRv6 packet forwarding security protection method according to any one of claims 1-7.
10. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed, implement the steps of the SRv6 message forwarding security protection method according to any one of claims 1-7.