Path verification method and device, storage medium and computer program product

Abstract

The present application provides a path verification method, device, storage medium and computer program product, the method comprising: a first device receiving a first message sent by a second device, the first message comprising a first calculation result determined by the second device based on first destination segment identification information, acquiring second target segment identification information of next-hop equipment of the first equipment; determining a second calculation result based on the second target segment identification information; inserting a first combined operation result of the first calculation result and the second calculation result into the first message to obtain a second message; and sending the second message to a third device.

Description

Technical Field

[0001] This application relates to the field of network communication technology, and in particular to a path verification method, device, storage medium, and computer program product. Background Technology

[0002] Segment Routing IPv6 (SRv6) is a protocol designed based on source routing principles for forwarding Internet Protocol Version 6 (IPv6) packets over a network. Based on the IPv6 forwarding plane, SRv6 inserts a Segment Routing Header (SRH) into IPv6 packets, pushing an explicit IPv6 address stack onto the SRH. Hop-by-hop forwarding is achieved by intermediate nodes continuously updating the destination address and offset address stack. To ensure reliability during forwarding, a Hash-based Message Authentication Code (HMAC) is added for path verification in SRv6. However, in related technologies, using HMAC for path verification results in significant network resource overhead. Summary of the Invention

[0003] In view of this, this application aims to provide a path verification method, device, storage medium, and computer program product that can reduce network resource overhead.

[0004] The technical solution of this application is implemented as follows:

[0005] In a first aspect, this application provides a path verification method applied to a first device, the method comprising:

[0006] The device receives a first message sent by a second device, wherein the first message includes a first calculation result determined by the second device based on the first destination segment identification information, and the second destination segment identification information of the next-hop device of the first device;

[0007] Based on the second destination segment identifier information, the second calculation result is determined;

[0008] Insert the first combined operation result of the first calculation result and the second calculation result into the first message to obtain the second message;

[0009] The second message is sent to the third device.

[0010] Secondly, this application provides a path verification method applied to a third device, the method comprising:

[0011] The device receives a second message sent by the first device, wherein the second message contains a first combined operation result of a first calculation result and a second calculation result, the first calculation result being determined based on the first destination segment identification information, and the second calculation result being determined based on the second destination segment identification information of the next-hop device of the first device;

[0012] Based on the result of the first combination operation, the forwarding path of the second message is verified.

[0013] Thirdly, this application provides a path verification method applied to a second device, the method comprising:

[0014] Obtain the first destination segment identifier information from the third message;

[0015] Based on a preset encryption algorithm and a preset shared key, the first destination segment identification information is encrypted to obtain the first calculation result;

[0016] The first calculation result is inserted into the third message to obtain the first message, and the first message is sent to the first device. The first message carries the second destination segment identification information of the next-hop device of the first device.

[0017] Fourthly, this application provides a first device, the first device comprising:

[0018] The first receiving unit is configured to receive a first message sent by the second device, wherein the first message includes a first calculation result determined by the second device based on the first destination segment identification information, and the second destination segment identification information of the next-hop device of the first device;

[0019] The determining unit is used to determine the second calculation result based on the second destination segment identification information;

[0020] The first insertion unit is used to insert the first combined operation result of the first calculation result and the second calculation result into the first message to obtain the second message;

[0021] The first sending unit is used to send the second message to the third device.

[0022] Fifthly, this application provides a third device, the third device comprising:

[0023] The second receiving unit is configured to receive a second message sent by the first device, wherein the second message includes a first combined calculation result of a first calculation result and a second calculation result, the first calculation result being determined based on the first destination segment identification information, and the second calculation result being determined based on the second destination segment identification information of the next-hop device of the first device;

[0024] The verification unit is used to verify the forwarding path of the second message based on the result of the first combination operation.

[0025] Sixthly, this application provides a second device, the second device comprising:

[0026] The acquisition unit is used to acquire the first destination segment identification information in the third message;

[0027] The encryption unit is used to encrypt the first destination segment identification information based on a preset encryption algorithm and a preset shared key to obtain a first calculation result.

[0028] The second sending unit is used to insert the first calculation result into the third message to obtain the first message, and send the first message to the first device, wherein the first message carries the second destination segment identification information of the next-hop device of the first device.

[0029] In a seventh aspect, this application provides a first device, the first device comprising: a first processor and a first memory; the first processor implements the path verification method on the first device side when executing a running program stored in the first memory.

[0030] Eighthly, this application provides a third device, the third device comprising: a second processor and a second memory; the second processor, when executing a running program stored in the second memory, implements the path verification method on the third device side described above.

[0031] In a ninth aspect, this application provides a second device, the second device comprising: a third processor and a third memory; the third processor, when executing a running program stored in the third memory, implements the path verification method on the second device side described above.

[0032] In a tenth aspect, this application provides a storage medium storing a computer program that, when executed by a processor, implements the path verification method on the first device side, or, when executed by a processor, implements the path verification method on the third device side, or when executed by a processor, implements the path verification method on the second device side.

[0033] In one aspect, this application provides a computer program product, including a computer program that, when executed by a processor, implements the path verification method on the first device side, or, when executed by a processor, implements the path verification method on the third device side, or when executed by a processor, implements the path verification method on the second device side.

[0034] This application provides a path verification method, device, storage medium, and computer program product. The method includes: a first device receiving a first message sent by a second device, wherein the first message includes a first calculation result determined by the second device based on a first destination segment identifier, and a second destination segment identifier of the next-hop device of the first device; determining a second calculation result based on the second destination segment identifier; inserting a first combination operation result of the first calculation result and the second calculation result into the first message to obtain a second message; sending the second message to a third device; and the third device receiving the second message sent by the first device, wherein the second message includes the first calculation result and the second calculation result. The first calculation result is determined based on the first destination segment identifier information, and the second calculation result is determined based on the second destination segment identifier information of the next-hop device of the first device. Based on the first calculation result, the forwarding path of the second packet is verified. The second device obtains the first destination segment identifier information from the third packet. Based on a preset encryption algorithm and a preset shared key, the first destination segment identifier information is encrypted to obtain the first calculation result. The first calculation result is inserted into the third packet to obtain the first packet, which is then sent to the first device. The first packet carries the second destination segment identifier information of the next-hop device of the first device. Using the above implementation scheme, the first device determines the second calculation result based on the second path identifier information in the first packet, while the first calculation result is determined by the second device based on the first path identifier of the first device. Therefore, the first and second calculation results are determined by the first and second devices respectively. The first device only performs a combined calculation on the received first calculation result and the second path identifier information of the next-hop device, and finally performs overall verification through the third device. Thus, the amount of data processed on the first device is reduced, achieving the goal of reducing network resource overhead. Attached Figure Description

[0035] Figure 1 This is a schematic diagram of an HMAC field format;

[0036] Figure 2 A schematic flowchart of a path verification method provided in this application embodiment. Figure 1 ;

[0037] Figure 3 A schematic flowchart of a path verification method provided in this application embodiment. Figure 2 ;

[0038] Figure 4 A schematic flowchart of a path verification method provided in this application embodiment. Figure 3 ;

[0039] Figure 5 A schematic flowchart of a path verification method provided in this application embodiment. Figure 4 ;

[0040] Figure 6 A schematic diagram of the composition structure of a first device provided in an embodiment of this application. Figure 1 ;

[0041] Figure 7 A schematic diagram of the composition structure of a first device provided in an embodiment of this application. Figure 2 ;

[0042] Figure 8 A schematic diagram of the composition structure of a third device provided in this application embodiment. Figure 1 ;

[0043] Figure 9 A schematic diagram of the composition structure of a third device provided in this application embodiment. Figure 2 ;

[0044] Figure 10 A schematic diagram of the composition structure of a second device provided in an embodiment of this application. Figure 1 ;

[0045] Figure 11 A schematic diagram of the composition structure of a second device provided in an embodiment of this application. Figure 2 . Detailed Implementation

[0046] To gain a more detailed understanding of the features and technical content of the embodiments of this application, the technical solution of this application will be further described in detail below with reference to the accompanying drawings and specific embodiments. The accompanying drawings are for reference only and are not intended to limit the embodiments of this application.

[0047] Unless otherwise defined, all technical and scientific terms used in the embodiments of this application have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the embodiments of this application is for the purpose of describing the embodiments of this application only and is not intended to limit this application.

[0048] In the following description, references to "some embodiments" refer to a subset of all possible embodiments. It is understood that "some embodiments" may be the same or different subsets of all possible embodiments and may be combined with each other without conflict. It should also be noted that the terms "first / second / third" used in the embodiments of this application are merely for distinguishing similar objects and do not represent a specific ordering of objects. It is understood that "first / second / third" may be interchanged in a specific order or sequence where permitted, so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein.

[0049] Before explaining the embodiments of this application, we will first provide a brief explanation of some technologies involved in the embodiments of this application and the technical problems in related technologies, as follows:

[0050] 1. The relevant content of SRv6 technology is introduced as follows:

[0051] IPv6 segment routing (SRv6) is a protocol designed based on source routing principles for forwarding IPv6 packets over a network. SRv6, based on the IPv6 forwarding plane, inserts an SRH (Segment Redirecting Header) into IPv6 packets, pushes an explicit IPv6 address stack onto the SRH, and completes hop-by-hop forwarding by continuously updating the destination address and offset address stack through intermediate nodes.

[0052] The SRv6 Segment Identifier (SID) is used to identify the ID of an SRv6 Segment. The SRv6 SID contains three fields: Location, Function, and Argument, as shown in Table 1.

[0053] Table 1

[0054]

[0055] The Locator is an identifier assigned to a network node for routing and forwarding data packets. In SRv6SID, the Locator is a variable-length part to adapt to networks of different sizes. The Locator identifier has two important attributes: routable and aggregable.

[0056] A function is used to express the forwarding action to be performed by the instruction, equivalent to the opcode of a computer instruction. In SRv6 network programming, different forwarding behaviors are expressed by different functions.

[0057] Argument is an optional field used to carry parameters required when executing instructions. These parameters may contain streams, services, or any other relevant information.

[0058] The SRv6 message encapsulation format described above is shown in Table 2 below:

[0059] Table 2

[0060]

[0061]

[0062] In Table 2 above, the first four rows represent the IPv6 Header, and the fifth to tenth rows represent the SRH.

[0063] The newly introduced SRH is used to carry the sequence of SRv6 SIDs, enabling flexible programming of SRv6 network paths and various functions. SRH can also include an optional Type-Length-Value (TLV) field for carrying variable-length data, providing better scalability for SRv6.

[0064] The tag field marks a data packet as part of a class or group of data packets, such as data packets sharing the same set of attributes. When the source does not use a tag, it is set to zero during transmission.

[0065] 2. HMAC is introduced as follows:

[0066] HMAC is a message authentication mechanism based on hash keys. To improve security and address the risks associated with leaked SIDs to external domains, SRv6 adds an HMAC mechanism to verify SRHs, ensuring that incoming messages from external domains originate from trusted data sources and that SIDs are not leaked to external domains.

[0067] The keyed Hashed Message Authentication Code (TLV) is optional and is used to verify whether the source of the message allows the use of the current segment in the destination address (DA) of the message, and to ensure that the message has not been modified during transmission.

[0068] HMAC information is the result calculated on a sample (TXT) using a specific key and algorithm. The destination node corresponding to DA will encrypt the same sample (TXT) using the same locally stored pre-shared key and algorithm, and then compare the encrypted result with the encryption result in the HAMAC field to check if they match. The format of the HMAC field is as follows: Figure 1 As shown:

[0069] D:1 indicates that a reduced segment list is used, and destination address verification is disabled.

[0070] HMAC Key ID: Used to uniquely identify the pre-shared key and algorithm used to generate HMAC.<pre-sharedkey,algorithm> .

[0071] HMAC TLV is one of the optional TLVs in SRH. It can be used to verify whether the SRH applied to the packet was selected by the authorizing party and to ensure that the segment list is not modified after it is generated. It also allows verification of whether the current segment (in the authorizing segment list) has been authorized.

[0072] The HMAC field is the output of the HMAC calculation, defined as follows:

[0073] Key: The pre-shared key identified by the HMAC Key ID.

[0074] HMAC algorithm: identified by HMAC Key ID (cryptographic hash function such as Message Digest Algorithm Version 5 (MD-5), Secure Hash Algorithm 1 (SHA-1), SHA-256).

[0075] Text: The combination of the IPv6 header and SRH is received at the node that verifies the HMAC (i.e., the node on the forwarding path):

[0076] The IPv6 header, SRH last entry, Flags, HMAC length (less than 16 bits), HMAC KeyID, and all addresses in the segment list.

[0077] The HMAC digest is truncated to 32 octets and placed in the HMAC field of the HMAC TLV.

[0078] If HMAC authentication succeeds, processing continues as normal. If authentication fails, an Internet Control Message Protocol (ICMP) error message (such as parameter problem, error code, or pointing to HMACTLV) will be generated and logged, and the packet will be discarded.

[0079] 3. The path segment (which can be expressed in English as Path Segment) is described as follows:

[0080] The Path Segment identifier is a segment identifier type in segment routing (SR), and it is a path identifier used to uniquely identify an SR path.

[0081] Based on path segment identifiers, the tail node of the forwarding path can identify the path of the data flow, thereby supporting the measurement of performance such as latency and packet loss rate of the service path and realizing real-time visibility of network quality. After inserting path segment identifiers into the packets, the service path can be identified, and when a fault occurs, rapid protection switching can be achieved, improving network reliability. In addition, the SR tunnel itself is unidirectional. Through path segment identifiers, two unidirectional paths can be bound together to realize a bidirectional tunnel, further improving network availability.

[0082] The SRv6 path segment is inserted at the top of the stack, not the bottom, as shown in Table 3 below:

[0083] Table 3

[0084]

[0085] The HMAC mechanism in related technologies significantly increases the processing performance and storage overhead of forwarding chips, especially because the overall overhead of processing the entire IPv6 packet header and SRH packet header is large. That is, the encryption calculation of the IPv6 packet header and SRH packet header is performed on all node devices. Therefore, a better mechanism is needed to improve the current segment routing path verification mechanism.

[0086] To address the above problems, embodiments of this application provide a path verification method, such as... Figure 2 As shown, when applied to a first device, the method may include:

[0087] S201, Receive the first message sent by the second device.

[0088] The first message contains a first calculation result determined by the second device based on the first destination segment identification information, and the second destination segment identification information of the next-hop device of the first device.

[0089] In this embodiment of the application, the first device may be an intermediate node device.

[0090] In this embodiment of the application, the second device may be a head node device.

[0091] In this embodiment of the application, the first destination segment identification information can be represented as the first destination SID, and the second destination segment identification information can be represented as the second destination SID.

[0092] In this embodiment of the application, the first destination segment identifier information can be the destination SID corresponding to the next-hop device (i.e., the intermediate node device) that the head node device needs to forward.

[0093] In this embodiment, the intermediate node device receives a first message sent by the head node device. In the first message, the first calculation result is calculated by the head node device based on the destination SID corresponding to its next-hop device.

[0094] In this embodiment of the application, the first message also includes the second destination SID corresponding to the next-hop device that the intermediate node device needs to forward.

[0095] It should be noted that the next-hop device of the intermediate node device here can be the tail node device or the next-hop intermediate node device of the intermediate node device. Here, we will take the tail node device as the example for explanation.

[0096] S202. Based on the second destination segment identification information, determine the second calculation result.

[0097] In this embodiment of the application, the second calculation result is determined based on the second destination segment identifier information, which can be implemented in the following ways:

[0098] Based on the preset encryption algorithm and preset shared key in the first device, the second destination segment identification information is encrypted to obtain the second calculation result.

[0099] In this embodiment, the preset encryption algorithm can be an HMAC algorithm identified by the HMAC Key ID. Specifically, it can be selected according to the actual situation, and this embodiment does not impose any specific limitations.

[0100] In this embodiment of the application, the preset shared key is a pre-shared key value identified by the HMAC Key ID.

[0101] In this embodiment of the application, the second SID is encrypted and calculated according to the HMAC algorithm and the key value to obtain the second calculation result.

[0102] S203. Insert the first combined operation result of the first calculation result and the second calculation result into the first message to obtain the second message.

[0103] In this embodiment of the application, the first calculation result is calculated by the head node device according to the SID of the next hop device to be jumped to, and the second calculation result is calculated by the intermediate node device according to the SID of the next hop device to be jumped to. After the intermediate node device reads the first calculation result from the first message and calculates the second calculation result, the intermediate node device combines the first calculation result and the second calculation result to obtain the combined calculation result of the first calculation result and the second calculation result.

[0104] It should be noted that the combination operation can be the addition of the first calculation result and the second calculation result, or other combination operations. Specifically, it can be selected according to the actual situation, and no specific limitation is made in the embodiments of this application.

[0105] In this embodiment of the application, the intermediate node device inserts the combined operation result into the received first message to form a second message, and continues to perform subsequent forwarding operations.

[0106] In this embodiment of the application, the intermediate node device may set the first combined operation result of the first calculation result and the second calculation result in the label field, SRH TLV field, path segment field or IPv6 extended header of the second message.

[0107] In the embodiments of this application, the tag field of SRH can be understood as the Tag field of the SRH message header.

[0108] In this embodiment of the application, the path segment field can be understood as the path Segment field in the SRH header.

[0109] In this embodiment of the application, the IPv6 extended header can be understood as the IPv6 hop-by-hop (i.e., HBH) extended header.

[0110] In this embodiment of the application, the SRH TLV field can be understood as the SID check TLV field in the SRH header.

[0111] S204. Send the second message to the third device.

[0112] In this embodiment of the application, the third device is a tail node device.

[0113] In this embodiment of the application, the intermediate node device forwards the second message carrying the first combined operation result to the tail node device, so that the tail node device can verify the forwarding path of the message based on the received first combined operation result.

[0114] It is understood that in the path verification method provided in this application embodiment, the first device determines the second calculation result based on the second path identification information in the first message, while the first calculation result is determined by the second device based on the first path identification of the first device. It can be seen that the first calculation result and the second calculation result are determined by the first device and the second device respectively. The first device only performs combined calculations on the received first calculation result and the second path identification information of the next hop device, and finally performs overall verification through the third device. Therefore, the amount of data processed on the first device is reduced, which can achieve the purpose of reducing network resource overhead.

[0115] In one embodiment of this application, after the intermediate node device sends the second message to the third device, the following process may also be performed:

[0116] The system receives first information sent by a third device, wherein the first information is used to retrieve the first calculation result and the second calculation result from the first device.

[0117] The first calculation result is resent from the second device to the first device, so that the third device can determine whether the verification process of the first device and the second device has encountered any abnormalities based on the first calculation result and the second calculation result.

[0118] In this embodiment of the application, the first information is an ICMP message or a User Datagram Protocol (UDP) message.

[0119] In this embodiment of the application, when the tail node device fails to verify the forwarding path of the second message, the tail node can also send ICMP or UDP messages to the head node device and all intermediate node devices to trigger the head node device and all intermediate node devices to resend the first calculation result and the second calculation result to the tail node device.

[0120] In this embodiment, when an intermediate node device receives an ICMP or UDP packet, it retransmits the second calculation result to the tail node device. Since packet forwarding occurs sequentially by node, the head node device first sends its first calculation result to the intermediate node device. Thus, the head node device's first calculation result is ultimately retransmitted to the tail node device via the intermediate node device. After the tail node device re-obtains the first and second calculation results, it performs calculations based on these results to determine which node is experiencing an anomaly and performs a source tracing check.

[0121] This application also provides a path verification method, such as... Figure 3 As shown, when applied to a third device, the method may include:

[0122] S301, Receive the second message sent by the first device.

[0123] The second message contains a first combined calculation result of the first calculation result and the second calculation result. The first calculation result is determined based on the first destination segment identification information, and the second calculation result is determined based on the second destination segment identification information of the next-hop device of the first device.

[0124] In this embodiment of the application, the third device is a tail node device.

[0125] In this embodiment of the application, the first device is an intermediate node device.

[0126] In this embodiment of the application, the tail node device receives a second message sent by the intermediate node device and inserts a first combined calculation result obtained by combining the first calculation result and the second calculation result.

[0127] S302. Based on the result of the first combination operation, verify the forwarding path of the second message.

[0128] In this embodiment of the application, the forwarding path of the second message is verified based on the result of the first combination operation, which can be achieved in the following way:

[0129] Obtain the first destination segment identifier information and the second destination segment identifier information; determine the second combination operation result based on the first destination segment identifier information and the second destination segment identifier information; verify the forwarding path of the second message based on the second combination operation result and the first combination operation result.

[0130] In this embodiment of the application, since the second message also contains a SID list, which is an ordered set of segment identifiers used to guide forwarding according to a predefined path, the tail node can obtain the first destination SID and the second destination SID from the received second message.

[0131] It should be noted that the first destination SID can be the destination SID of the next-hop device forwarded by the head node device, that is, the destination SID of the intermediate node device, and the second destination SID is the destination SID of the next-hop device forwarded by the intermediate node, that is, the destination SID of the tail node.

[0132] In this embodiment of the application, after obtaining the first destination SID and the second destination SID, the second combination operation result is determined based on the first destination segment identifier information and the second destination segment identifier information. This can be achieved in the following way:

[0133] Based on a preset encryption algorithm and a preset shared key, the first destination segment identification information is encrypted to obtain a third calculation result; based on a preset encryption algorithm and preset encryption parameters, the second destination segment identification information is encrypted to obtain a fourth calculation result; based on the third and fourth calculation results, the second combined operation result is determined.

[0134] In this embodiment, the tail node performs encryption calculation on the first destination SID using the same locally stored HMAC algorithm and key, obtaining a third calculation result. Simultaneously, it performs encryption calculation on the second destination SID using the same locally stored HMAC algorithm and key value, obtaining a fourth calculation result. Finally, the third and fourth calculation results are combined to obtain a second combined operation result.

[0135] In this embodiment of the application, the tail node device compares the first combination operation result and the second combination operation result to determine whether they are consistent, thereby verifying whether the forwarding path of the second message is trustworthy. If the first combination operation result is the same as the second combination operation result, it means that the forwarding path of the second message is trustworthy. If the first combination operation result and the second combination operation result are different, it means that the forwarding path of the second message is untrustworthy.

[0136] In this embodiment of the application, after verifying the forwarding path of the second message based on the second combination operation result and the first combination operation result, if the second combination operation result and the first combination operation result are the same, the second message is received and forwarded; or, if the second combination operation result and the first combination operation result are different, the second message is discarded.

[0137] In this embodiment of the application, when the result of the first combination operation and the result of the second combination operation are the same, the second message is considered trustworthy because the forwarding path of the second message is trustworthy. The table is then looked up according to the last hop SID and the second message is forwarded.

[0138] In this embodiment of the application, when the result of the first combination operation and the result of the second combination operation are different, the second message is considered untrustworthy because the forwarding path of the second message is untrustworthy, and thus the second message can be discarded.

[0139] In one embodiment of this application, if the result of the second combination operation is different from the result of the first combination operation, the following process may also be performed:

[0140] Send the first message to the first device and the second device.

[0141] The first information is used by the second device to resend the first calculation result to the first device, and the third device to re-obtain the first calculation result and the second calculation result from the first device.

[0142] Based on the first and second calculation results, determine whether there are any abnormalities in the verification process of the first and second devices.

[0143] In this embodiment of the application, the first information is an ICMP message or a UDP message.

[0144] In this embodiment of the application, when the tail node device verifies that the first combination operation result and the second combination operation result are different, it sends ICMP messages or UDP messages to the head node device and all intermediate node devices, thereby triggering the head node and all intermediate node devices to send the calculation results to the tail node device one by one through the ICMP messages or UDP messages.

[0145] In this embodiment of the application, the head node device may resend the first calculation result to the tail node device by first sending the first calculation result to the intermediate node device, and then resending the first calculation result to the tail node device through the intermediate node device in sequence. The intermediate node device may also resend the second calculation result to the tail node device at the same time.

[0146] In this embodiment of the application, the tail node device determines whether the verification process of the intermediate node device and the head node device is abnormal based on the first calculation result and the second calculation result. Specifically, the tail node device can compare the first calculation result and the second calculation result with its own calculation results one by one to determine which node device's final verification is inconsistent and perform a source tracing check.

[0147] It is understood that in the path verification method provided in this application embodiment, when the third device performs verification, the first device determines the second calculation result based on the second path identification information in the first message, while the first calculation result is determined by the second device based on the first path identification of the first device. It can be seen that the first calculation result and the second calculation result are determined by the first device and the second device respectively, while the third device receives the result of the combined operation of the two, and finally performs overall verification through the third device. Therefore, the computational load in the path verification process can be reduced, and the purpose of reducing network resource overhead can be achieved.

[0148] This application also provides a path verification method, such as... Figure 4 As shown, when applied to a second device, the method may include:

[0149] S401, Obtain the first destination segment identifier from the third message.

[0150] In this embodiment of the application, the second device is a head node device.

[0151] In this embodiment of the application, the third message can be understood as the initial message in the head node device.

[0152] In this embodiment of the application, the initial message of the head node device contains the first destination SID of the next-hop device to which the message is forwarded, and the head node device directly reads the first destination SID from the initial message.

[0153] S402. Based on the preset encryption algorithm and the preset shared key, the first destination segment identification information is encrypted to obtain the first calculation result.

[0154] In this embodiment of the application, the head node device encrypts the first destination SID according to its own stored HMAC algorithm and key value to obtain the first calculation result.

[0155] S403. Insert the first calculation result into the third message to obtain the first message, and send the first message to the first device.

[0156] The first message carries the second destination segment identification information of the next-hop device of the first device.

[0157] In this embodiment of the application, the third device inserts the first calculation result into the initial message to obtain the first message to be forwarded.

[0158] In this embodiment of the application, the head node device sets the first calculation result in a specific location in the first message. The specific location may include: the SRH label field, the SRH TLV field, the path segment field, or the IPv6 extended header.

[0159] In this embodiment of the application, the tag field of SRH can be understood as the Tag field of the SRH message header.

[0160] In this embodiment of the application, the path segment field can be understood as the path Segment field in the SRH header.

[0161] In this embodiment of the application, the IPv6 extended header can be understood as the IPv6 hop-by-hop (i.e., HBH) extended header.

[0162] In this embodiment of the application, the SRH TLV field can be understood as the SID check TLV field in the SRH header.

[0163] In this embodiment of the application, the first message forwarded by the head node device also carries the second destination SID corresponding to the next-hop device (i.e., the tail node device) of the intermediate node device. The second destination SID is used by the intermediate node device to calculate the second calculation result.

[0164] It is understood that in the path verification method provided in this application embodiment, the second device only calculates the first calculation result corresponding to the first destination segment identifier information and inserts the first calculation result into the third message for the next forwarding. The second device does not need to perform the encryption process of all information in the message header of the forwarded message, which can reduce the amount of calculation and achieve the purpose of reducing network resource consumption.

[0165] In one embodiment of this application, after the head node device sends the first message to the first device, it may also perform the following process:

[0166] Receive the first message sent by the third device.

[0167] The first information is used by the second device to resend the first calculation result to the first device, so that the third device can retrieve the first calculation result from the first device again.

[0168] In this embodiment, if the tail node device fails to verify the first combined calculation result and the second combined calculation result, the head node device receives an ICMP message or UDP message sent by the tail node device and triggers the head node device to resend the first calculation result to the tail node device through the ICMP message or UDP message. Since the first calculation result is forwarded hop by hop with the message, the head node device forwards the first calculation result to the intermediate node device first. Finally, the tail node device obtains the first calculation result of the head node device from the intermediate node device for comparison again.

[0169] In the above embodiments, the head node device, an intermediate node device, and a tail node device are used to illustrate that the method of calculating the destination SID of the node hop by hop and performing an overall verification at the last hop reduces the processing overhead of hop-by-hop HMAC.

[0170] In this application embodiment, if there are multiple intermediate node devices, the implementation method is the same as the above embodiments, and the specific implementation method can be as follows.

[0171] Based on the above embodiments, this application also provides a path verification method, such as... Figure 5 As shown, the specific steps include:

[0172] S1, Head Node Device (can be represented as SR Source): Inserts HMAC or Cyclic Redundancy Check (CRC) verification information. Specifically, it performs encrypted calculation on the destination SID (corresponding to DA) of the node based on the key value and HMAC algorithm, obtains the calculation result 1, and inserts the calculation result 1 into the message (such as SRv6 message).

[0173] It should be noted that the calculation result 1 is the test information.

[0174] The first calculation result is usually located at a specific position in the message. This specific position includes: the tag in the SRH header, the SID checksum TLV, the path segment, and the IPv6 HBH extended header, etc.

[0175] In this embodiment of the application, the target SID verification TLV (which can be expressed as Verify TLV) format is shown in Table 4 below:

[0176] Table 4

[0177]

[0178] S2, Intermediate Node Device 1 (can be represented as SR Transit1): Inserts HMAC / CRC verification information for the destination SID of the current node. Specifically, it reads the information of calculation result 1 from the first message, and performs encrypted calculation on the destination SID of the node according to the locally stored key value and HMAC algorithm to obtain calculation result 2. The combined operation result 1 of calculation result 2 and calculation result 1 is placed in a specific position of the message.

[0179] S3, Intermediate Node Device 2 (can be represented as SR Transit2): Inserts HMAC / CRC verification information for the current destination SID, reads the first combined operation result of the previous two node devices from a specific position in the message sent by Intermediate Node Device 1, and performs encrypted calculation on the destination SID of the node according to the locally stored key value and HMAC algorithm, and places the combined operation result 2 obtained by calculating the combined operation result 3 and the combined operation result 1 of the previous hop node device (i.e., intermediate node device 1) in a specific position in the message. That is, the combined operation result 2 of the combined operation result 1, the combined operation result 2 of the combined operation result 3 and the combined operation result 3 is placed in a specific position in the message.

[0180] S4. Tail Node Device (can be represented as SR Endpoint): Parses path verification information. Specifically, using the same pre-shared key (key value) and preset encryption algorithm (HMAC algorithm) stored locally, it performs the same combination operation based on the encryption results of the destination SID of all the aforementioned node devices, obtaining combination operation result 3. It then compares combination operation result 3 with combination operation result 2 to determine if they match. If they do not match, the packet forwarding path is considered untrusted, and the forwarded packet is discarded; if they match, the packet is forwarded normally according to the last hop SID lookup table.

[0181] It should be noted that if there is a discrepancy, the tail node device can also trigger the head node device and all intermediate node devices to send ICMP / UDP messages to each of them to place their calculation results in a specific location and then send them back to the tail node device. The tail node device will then compare the results with its own calculations to determine which node device ultimately has a discrepancy and perform a source tracing check.

[0182] In this embodiment, the SID verification information of each node device and the combined calculation result with the previous node device can be stored in flash / non-volatile random access memory (NVRAM) / memory or other locations, and aged out (i.e. deleted) based on a certain period.

[0183] It should be noted that when tracing the source, the information required for tracing can also be obtained from the aforementioned storage location.

[0184] Based on the above embodiments, in this embodiment, the main approach is to reduce the processing overhead of hop-by-hop HMAC by encrypting the destination SID of the current node device and performing overall verification at the last hop node device. The encryption results of each hop node device and the combined calculation results with the previous hop node device are stored in a specific location in the message and carried to the next node device. The last hop node device performs overall end-to-end verification, and if the verification is inconsistent, it can choose to discard the message or further trace back to which node device has a problem.

[0185] Compared with related technologies, it has the following main technical advantages:

[0186] In related technologies, the SRv6 HMAC mechanism significantly increases the processing performance and storage overhead of forwarding chips, especially because the overall overhead of processing the entire IPv6 packet header and SRH packet header is particularly large, making it difficult to implement in actual commercial applications. In the embodiments of this application, the forwarding of each hop node device does not need to calculate all destination SIDs, but only performs overall verification in the last hop, which greatly reduces the processing overhead and prevents security risks such as the SRv6 path being easily counterfeited and tampered with.

[0187] Based on the above embodiments, another embodiment of this application provides a first device 1, such as... Figure 6 As shown, the first device 1 includes:

[0188] The first receiving unit 10 is configured to receive a first message sent by the second device, wherein the first message includes a first calculation result determined by the second device based on the first destination segment identification information, and the second destination segment identification information of the next-hop device of the first device.

[0189] The determining unit 11 is used to determine the second calculation result based on the second destination segment identification information.

[0190] The first insertion unit 12 is used to insert the first combined operation result of the first calculation result and the second calculation result into the first message to obtain the second message.

[0191] The first sending unit 13 is used to send the second message to the third device.

[0192] In one embodiment, the first device 1 may further include an encryption unit.

[0193] The encryption unit is used to encrypt the second destination segment identification information based on the preset encryption algorithm and preset shared key in the first device to obtain the second calculation result.

[0194] In one embodiment, the first receiving unit 10 is further configured to receive first information sent by the third device, wherein the first information is used to re-obtain the first calculation result and the second calculation result from the first device, wherein the first calculation result is re-sent to the first device by the second device, so as to enable the third device to determine whether the verification process of the first device and the second device has an anomaly based on the first calculation result and the second calculation result.

[0195] In one embodiment, the combined result of the first calculation result and the second calculation result is set in the label field, SRH TLV field, path segment field or IPv6 extension header of the second message's SRH.

[0196] This application provides a first device that receives a first message sent by a second device. The first message includes a first calculation result determined by the second device based on a first destination segment identifier, and a second destination segment identifier of the next-hop device of the first device. Based on the second destination segment identifier, a second calculation result is determined. A first combined operation result of the first and second calculation results is inserted into the first message to obtain a second message. The second message is then sent to a third device. Thus, the first device proposed in this application determines the second calculation result based on the second path identifier in the first message, while the first calculation result is determined by the second device based on the first path identifier. The first and second calculation results are determined by the first and second devices respectively. The first device only performs a combined operation on the received first calculation result and the second path identifier of the next-hop device, and finally performs overall verification through the third device. Therefore, the amount of data processed on the first device is reduced, achieving the goal of reducing network resource overhead.

[0197] Figure 7 This is a schematic diagram of the composition structure of a first device 1 provided in an embodiment of this application. In practical applications, based on the same disclosed concept of the above embodiments, such as... Figure 7 As shown, the first device 1 in this application embodiment includes a first processor 14, a first memory 15, and a first communication bus 16.

[0198] In specific embodiments, the first receiving unit 10, determining unit 11, first inserting unit 12, first sending unit 13, and encryption unit can be implemented by a first processor 14 located on the first device 1. The first processor 14 can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), CPU, controller, microcontroller, and microprocessor. It is understood that for different devices, the electronic device used to implement the above processor functions can also be other types, and this application does not impose specific limitations.

[0199] In this embodiment, the first communication bus 16 is used to establish a connection and communication between the first processor 14 and the first memory 15; when the first processor 14 executes the running program stored in the first memory 15, it implements the following path verification method:

[0200] The system receives a first message sent by a second device, wherein the first message contains a first calculation result determined by the second device based on the first destination segment identifier information, and the second destination segment identifier information of the next-hop device of the first device; determines a second calculation result based on the second destination segment identifier information; inserts a first combined operation result of the first calculation result and the second calculation result into the first message to obtain a second message; and sends the second message to a third device.

[0201] In one embodiment, the first processor 14 is further configured to encrypt the second destination segment identification information based on a preset encryption algorithm and a preset shared key in the first device, and obtain a second calculation result.

[0202] In one embodiment, the first processor 14 is further configured to receive first information sent by the third device, wherein the first information is used to re-obtain the first calculation result and the second calculation result from the first device, wherein the first calculation result is re-sent to the first device by the second device, so as to enable the third device to determine whether the verification process of the first device and the second device has encountered an anomaly based on the first calculation result and the second calculation result.

[0203] In one embodiment, the combined result of the first calculation result and the second calculation result is set in the label field, SRH TLV field, path segment field or IPv6 extension header of the second message's SRH.

[0204] Based on the above embodiments, another embodiment of this application provides a third device 2, such as... Figure 8 As shown, the third device 2 includes:

[0205] The second receiving unit 20 is used to receive a second message sent by the first device, wherein the second message includes a first combined calculation result of a first calculation result and a second calculation result, the first calculation result being determined based on the first destination segment identification information, and the second calculation result being determined based on the second destination segment identification information of the next-hop device of the first device.

[0206] The verification unit 21 is used to verify the forwarding path of the second message based on the result of the first combination operation.

[0207] In one embodiment, the third device 2 may further include: an acquisition unit and a determination unit.

[0208] The acquisition unit is used to acquire the first destination segment identification information and the second destination segment identification information.

[0209] The determining unit is used to determine the second combined operation result based on the first destination segment identification information and the second destination segment identification information.

[0210] The verification unit 21 is also used to verify the forwarding path of the second message based on the second combination operation result and the first combination operation result.

[0211] In one embodiment, the determining unit is further configured to encrypt the first destination segment identification information based on a preset encryption algorithm and a preset shared key to obtain a third calculation result.

[0212] The determining unit is also used to encrypt the second destination segment identification information based on a preset encryption algorithm and preset encryption parameters to obtain a fourth calculation result.

[0213] The determining unit is also used to determine the second combined operation result based on the third and fourth calculation results.

[0214] In one embodiment, the third device 2 may further include a processing unit.

[0215] The processing unit is configured to receive and forward the second message if the result of the second combination operation is the same as the result of the first combination operation; or to discard the second message if the result of the second combination operation is different from the result of the first combination operation.

[0216] In one embodiment, the third device 2 may further include a transmitting unit.

[0217] The sending unit is used to send first information to the first device and the second device when the second combined calculation result is different from the first combined calculation result. The first information is used by the second device to resend the first calculation result to the first device, and the third device to re-obtain the first calculation result and the second calculation result from the first device.

[0218] The determining unit is used to determine whether an abnormality has occurred in the verification process of the first device and the second device based on the first calculation result and the second calculation result.

[0219] This application provides a third device that receives a second message sent by a first device. The second message includes a first calculation result and a first combined operation result of the second calculation result. The first calculation result is determined based on the first destination segment identifier information, and the second calculation result is determined based on the second destination segment identifier information of the next-hop device of the first device. Based on the first combined operation result, the forwarding path of the second message is verified. Thus, in the verification process provided by this application, the first device determines the second calculation result based on the second path identifier information in the first message, while the second device determines the first calculation result based on the first path identifier of the first device. Therefore, the first calculation result and the second calculation result are determined by the first device and the second device respectively, while the third device receives the result of the combined operation of the two. Finally, the third device performs overall verification, thereby reducing the computational load in the path verification process and achieving the goal of reducing network resource overhead.

[0220] Figure 9 This is a schematic diagram of the composition structure of a third device 2 provided in an embodiment of this application. In practical applications, based on the same disclosed concept of the above embodiments, such as... Figure 9 As shown, the third device 2 in this embodiment of the application includes a second processor 22, a second memory 23, and a second communication bus 24.

[0221] In specific embodiments, the second receiving unit 20, verification unit 21, acquisition unit, determination unit, processing unit, and sending unit described above can be implemented by a second processor 22 located on the third device 2. The second processor 22 can be at least one of an ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, or microprocessor. It is understood that for different devices, the electronic device used to implement the above processor functions can also be other types, and this application embodiment does not impose specific limitations.

[0222] In this embodiment, the second communication bus 24 is used to establish communication between the second processor 22 and the second memory 23; when the second processor 22 executes the running program stored in the second memory 23, it implements the following path verification method:

[0223] The system receives a second message sent by a first device, wherein the second message contains a first combined operation result of a first calculation result and a second calculation result, the first calculation result being determined based on a first destination segment identifier information, and the second calculation result being determined based on a second destination segment identifier information of the next-hop device of the first device; and verifies the forwarding path of the second message based on the first combined operation result.

[0224] In one embodiment, the second processor 22 is further configured to acquire first destination segment identification information and second destination segment identification information; determine a second combination operation result based on the first destination segment identification information and the second destination segment identification information; and verify the forwarding path of the second message based on the second combination operation result and the first combination operation result.

[0225] In one embodiment, the second processor 22 is further configured to encrypt the first destination segment identification information based on a preset encryption algorithm and a preset shared key to obtain a third calculation result; encrypt the second destination segment identification information based on a preset encryption algorithm and preset encryption parameters to obtain a fourth calculation result; and determine the second combined operation result based on the third calculation result and the fourth calculation result.

[0226] In one embodiment, the second processor 22 is further configured to receive and forward the second message if the second combination operation result is the same as the first combination operation result; or to discard the second message if the second combination operation result is different from the first combination operation result.

[0227] In one embodiment, the second processor 22 is further configured to send first information to the first device and the second device when the second combined calculation result and the first combined calculation result are different. The first information is used for the second device to resend the first calculation result to the first device, and for the third device to re-obtain the first calculation result and the second calculation result from the first device. Based on the first calculation result and the second calculation result, it is determined whether the verification process of the first device and the second device has been abnormal.

[0228] Based on the above embodiments, another embodiment of this application provides a second device 3, such as... Figure 10 As shown, the second device 3 includes:

[0229] Acquisition unit 30 is used to acquire the first destination segment identification information in the third message.

[0230] The encryption unit 31 is used to encrypt the first destination segment identification information based on a preset encryption algorithm and a preset shared key to obtain a first calculation result.

[0231] The second sending unit 32 is used to insert the first calculation result into the third message to obtain the first message, and send the first message to the first device, wherein the first message carries the second destination segment identification information of the next-hop device of the first device.

[0232] In one embodiment, the first calculation result is set in the label field, SRH TLV field, path segment field, or IPv6 extended header of the first message's SRH.

[0233] In one embodiment, the acquisition unit 30 is further configured to receive first information sent by the third device, wherein the first information is used by the second device to resend the first calculation result to the first device so that the third device can reacquire the first calculation result from the first device.

[0234] This application provides a second device that obtains first destination segment identification information from a third message; encrypts the first destination segment identification information based on a preset encryption algorithm and a preset shared key to obtain a first calculation result; inserts the first calculation result into the third message to obtain a first message, and sends the first message to the first device. The first message carries the second destination segment identification information of the next-hop device of the first device. Therefore, this application provides a second device that only calculates the first calculation result corresponding to the first destination segment identification information and inserts the first calculation result into the third message for further forwarding. The second device does not need to perform encryption processing on all information in the header of the forwarded message, thus reducing computational load and achieving the goal of reducing network resource overhead.

[0235] Figure 11 This is a schematic diagram of the composition structure of a second device 3 provided in an embodiment of this application. In practical applications, based on the same disclosed concept of the above embodiments, such as... Figure 11 As shown, the second device 3 in this embodiment includes a third processor 33, a third memory 34, and a third communication bus 35.

[0236] In specific embodiments, the acquisition unit 30, encryption unit 31, and second sending unit 32 can be implemented by a third processor 33 located on the second device 3. The third processor 33 can be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor. It is understood that for different devices, the electronic device used to implement the above processor functions can also be other types, and this application embodiment does not impose specific limitations.

[0237] In this embodiment, the third communication bus 35 is used to establish communication between the third processor 33 and the third memory 34; when the third processor 33 executes the running program stored in the third memory 34, it implements the following path verification method:

[0238] Obtain the first destination segment identifier information from the third message; encrypt the first destination segment identifier information based on a preset encryption algorithm and a preset shared key to obtain a first calculation result; insert the first calculation result into the third message to obtain the first message, and send the first message to the first device, wherein the first message carries the second destination segment identifier information of the next-hop device of the first device.

[0239] In one embodiment, the first calculation result is set in the label field, SRH TLV field, path segment field, or IPv6 extended header of the first message's SRH.

[0240] In one embodiment, the third processor 33 is further configured to receive first information sent by the third device, wherein the first information is used by the second device to resend the first calculation result to the first device so that the third device can re-obtain the first calculation result from the first device.

[0241] Based on the above embodiments, this application provides a storage medium storing a computer program thereon. The computer-readable storage medium stores one or more programs, which can be executed by one or more processors and applied in a first device / second device / third device. The computer program implements the path verification method as described above.

[0242] Based on the above embodiments, this application provides a computer program product, including a computer program that can be executed by one or more processors and applied in a first device / second device / third device. The computer program implements the path verification method described above.

[0243] It should be noted that, in the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0244] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solutions of the embodiments of this application, or the parts that contribute to the related technology, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause an image display device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the embodiments of this application.

[0245] The above description is merely a specific implementation of the embodiments of this application, but the protection scope of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in this application should be included within the protection scope of this application. Therefore, the protection scope of this application should be determined by the protection scope of the claims.

Claims

1. A path verification method, characterized in that, Applied to a first device, the method includes: Receive a first message sent by a second device, wherein the first message includes a first calculation result determined by the second device based on a first destination segment identifier, and a second destination segment identifier of the next-hop device of the first device; Based on the second destination segment identification information, the second calculation result is determined; Insert the first combined operation result of the first calculation result and the second calculation result into the first message to obtain the second message; The second message is sent to the third device.

2. The method according to claim 1, characterized in that, The step of determining the second calculation result based on the second destination segment identifier information includes: Based on the preset encryption algorithm and preset shared key in the first device, the second destination segment identification information is encrypted to obtain the second calculation result.

3. The method according to claim 1, characterized in that, After sending the second message to the third device, the method further includes: The system receives first information sent by the third device, wherein the first information is used to re-obtain the first calculation result and the second calculation result from the first device, wherein the first calculation result is re-sent from the second device to the first device, so that the third device can determine whether the verification process of the first device and the second device has encountered an anomaly based on the first calculation result and the second calculation result.

4. The method according to claim 1, characterized in that, The combined result of the first calculation result and the second calculation result is set in the label field, SRH type length value (TLV) field, path segment field, or IPv6 extension header of the segment routing header (SRH) of the second message.

5. A path verification method, characterized in that, Applied to a third device, the method includes: The device receives a second message sent by a first device, wherein the second message contains a first combined operation result of a first calculation result and a second calculation result, the first calculation result being determined based on a first destination segment identifier information, and the second calculation result being determined based on a second destination segment identifier information of the next-hop device of the first device; Based on the result of the first combined operation, the forwarding path of the second message is verified.

6. The method according to claim 5, characterized in that, The step of verifying the forwarding path of the second message based on the first combined calculation result includes: Obtain the first destination segment identifier information and the second destination segment identifier information; Based on the first destination segment identifier information and the second destination segment identifier information, the second combined operation result is determined; Based on the second combined operation result and the first combined operation result, the forwarding path of the second message is verified.

7. The method according to claim 6, characterized in that, The step of determining the second combined operation result based on the first destination segment identifier information and the second destination segment identifier information includes: Based on a preset encryption algorithm and a preset shared key, the first destination segment identification information is encrypted to obtain a third calculation result; Based on the preset encryption algorithm and the preset encryption parameters, the second destination segment identification information is encrypted to obtain the fourth calculation result; Based on the third calculation result and the fourth calculation result, the second combined operation result is determined.

8. The method according to claim 6, characterized in that, After verifying the forwarding path of the second message based on the second combined operation result and the first combined operation result, the method further includes: If the result of the second combined operation is the same as the result of the first combined operation, the second message is received and forwarded. Alternatively, if the result of the second combination operation is different from the result of the first combination operation, the second message may be discarded.

9. The method according to claim 6, characterized in that, After verifying the forwarding path of the second message based on the second combined operation result and the first combined operation result, the method further includes: If the second combined calculation result is different from the first combined calculation result, first information is sent to the first device and the second device. The first information is used by the second device to resend the first calculation result to the first device, and the third device re-obtains the first calculation result and the second calculation result from the first device. Based on the first calculation result and the second calculation result, determine whether there is an abnormality in the verification process of the first device and the second device.

10. A path verification method, characterized in that, Applied to a second device, the method includes: Obtain the first destination segment identifier information from the third message; Based on a preset encryption algorithm and a preset shared key, the first destination segment identification information is encrypted to obtain a first calculation result; The first calculation result is inserted into the third message to obtain the first message, and the first message is sent to the first device. The first message carries the second destination segment identification information of the next-hop device of the first device.

11. The method according to claim 10, characterized in that, The first calculation result is set in the label field, SRH TLV field, path segment field, or IPv6 extended header of the segment routing header (SRH) of the first message.

12. The method according to claim 10, characterized in that, After sending the first message to the first device, the method further includes: The device receives first information sent by a third device, wherein the first information is used by the second device to resend the first calculation result to the first device, so that the third device can retrieve the first calculation result from the first device again.

13. A first device, characterized in that, The first device includes: The first receiving unit is configured to receive a first message sent by the second device, wherein the first message includes a first calculation result determined by the second device based on the first destination segment identifier information, and the second destination segment identifier information of the next-hop device of the first device; The determining unit is used to determine the second calculation result based on the second destination segment identification information; The first insertion unit is used to insert the first combined operation result of the first calculation result and the second calculation result into the first message to obtain the second message; The first sending unit is used to send the second message to the third device.

14. A third device, characterized in that, The third device includes: The second receiving unit is configured to receive a second message sent by the first device, wherein the second message includes a first combined calculation result of a first calculation result and a second calculation result, the first calculation result being determined based on a first destination segment identifier information, and the second calculation result being determined based on a second destination segment identifier information of the next-hop device of the first device; The verification unit is used to verify the forwarding path of the second message based on the result of the first combined operation.

15. A second device, characterized in that, The second device includes: The acquisition unit is used to acquire the first destination segment identification information in the third message; An encryption unit is used to encrypt the first destination segment identification information based on a preset encryption algorithm and a preset shared key to obtain a first calculation result. The second sending unit is used to insert the first calculation result into the third message to obtain the first message, and send the first message to the first device, wherein the first message carries the second destination segment identification information of the next-hop device of the first device.

16. A first device, characterized in that, The first device includes a first processor and a first memory; when the first processor executes the running program stored in the first memory, it implements the method as described in any one of claims 1 to 4.

17. A third device, characterized in that, The third device includes: a second processor and a second memory; the second processor executes the running program stored in the second memory to implement the method as described in any one of claims 5 to 9.

18. A second device, characterized in that, The second device includes a third processor and a third memory; the third processor executes a running program stored in the third memory to implement the method as described in any one of claims 10 to 12.

19. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the method as described in any one of claims 1 to 4; or, when the computer program is executed by a processor, it implements the method as described in any one of claims 5 to 9; or, when the computer program is executed by a processor, it implements the method as described in any one of claims 10 to 12.

20. A computer program product, comprising a computer program, characterized in that, The computer program, when executed by a processor, implements the method as described in any one of claims 1 to 4, or, when executed by a processor, the computer program implements the method as described in any one of claims 5 to 9, or, when executed by a processor, the computer program implements the method as described in any one of claims 10 to 12.

Images