A message processing method and device and related equipment

Abstract

This application relates to the field of network security technology, and in particular to a message processing method, apparatus, and related equipment, especially suitable for FTTR scenarios. The method includes: receiving the first message of a target service sent by a terminal device; obtaining a comprehensive trust score for the target service, which is calculated by a trust scoring system based on weighted multi-dimensional security reputation data, including at least the terminal device's device environment information and service importance information; if the comprehensive trust score is greater than a first threshold, adding a trust level field to the tunnel encapsulation message of the target service, this field carrying the comprehensive trust score and the trust level of the first node of the tunnel encapsulation; and classifying service traffic based on the comprehensive trust scores of each service to implement differentiated forwarding strategies. In FTTR scenarios, combined with the distributed nodes of home or enterprise gateways, a unified trust assessment is performed on the first message of a service across rooms or nodes, improving security control efficiency.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a message processing method, apparatus and related equipment. Background Technology

[0002] With the deepening of enterprise digital transformation and the popularization of cloud services, Software-Defined Wide Area Network (SD-WAN) has become the mainstream choice for enterprise branch interconnection due to its ability to intelligently manage hybrid links, optimize cloud access experience, and reduce leased line costs. However, traditional SD-WAN solutions mainly focus on convenient deployment and visual operation and maintenance of network connections, and their native security capabilities have significant shortcomings. Especially in FTTR (Fiber to the Room) scenarios, multiple terminal devices in home or small office environments access a unified network through fiber optics, resulting in dense and diverse traffic, making the limitations of traditional security identification modes even more prominent.

[0003] Traditional security identification is based on a single device, using ACL (Access Control List) or DPI (Deep Packet Inspection) methods for simple or deep identification of all traffic. This approach relies on coarse access control, specifically the five-tuple and traffic characteristics, to indiscriminately inspect all traffic, wasting computing power and reducing forwarding capacity. In FTTR scenarios, because the main gateway and sub-gateways work together, each node must simultaneously handle concurrent traffic from different rooms. This indiscriminate inspection not only increases the computational burden on the main gateway but can also cause latency jitter in high-priority services (such as video conferencing or online gaming) due to resource contention. Furthermore, FTTR networks typically carry multiple services such as smart homes, office terminals, and entertainment devices. Traditional methods struggle to implement granular security policies based on user or service level and cannot dynamically adapt to traffic changes, thus weakening overall protection and user experience. Summary of the Invention

[0004] This application provides a message processing method, apparatus, and related equipment.

[0005] Firstly, this application provides a message processing method applied to the first node of a tunnel encapsulation; the method includes: Receive the first message of the target service sent by the terminal device; Obtain the comprehensive trust score of the target service corresponding to the first message of the target service, wherein the comprehensive trust score is obtained by the trust scoring system based on multi-dimensional security reputation data to weight the target service, and the multi-dimensional security reputation data includes at least the device environment information of the terminal device that sent the first message of the target service and the importance information of the target service; If the overall trust score of the target service is greater than the first threshold, a trust level field is added to the tunnel encapsulation message of the target service, wherein the trust level field carries the overall trust score of the target service and the trust level of the first node of the tunnel encapsulation. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, then the message of the target service is subjected to full security verification, and a trust level field is added to the tunnel encapsulation message of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, then the forwarding of all packets of the target service will be blocked.

[0006] Optionally, if the overall trust score of the target service is greater than the first threshold, a first forwarding strategy is generated, wherein the first forwarding strategy is to add a trust level field to the tunnel encapsulation message of the target service, the trust level field carrying the overall trust score of the target service and the trust level of the first node of the tunnel encapsulation; If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, a second forwarding strategy is generated. The second forwarding strategy is to perform full security verification on the packets of the target service and add a trust level field to the tunnel encapsulation packets of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, a third forwarding strategy is generated, which is to block the forwarding of all packets of the target service.

[0007] Optionally, the method further includes: If the overall trust score of a service changes and the change meets preset conditions, then the forwarding strategy for that service will be adjusted.

[0008] Optionally, a trust level field is added to the tunnel encapsulation header of the target service; The steps for obtaining the comprehensive trust score of the target service corresponding to the first message of the target service include: The comprehensive trust score of the target service corresponding to the first message of the target service is obtained in real time from the trust scoring system; or, Obtain the overall trust score of the target service corresponding to the first message of the target service from the overall trust scores of each service cached locally.

[0009] Optionally, the device environment information of the terminal device includes: whether a firewall is installed on the terminal device, whether the operating system of the terminal device has vulnerabilities, and whether the communication address of the terminal device is authenticated.

[0010] Secondly, this application provides a message processing method applied to an intermediate forwarding node; the method includes: Receive a tunnel encapsulation message of the target service sent by the previous hop node, wherein the tunnel encapsulation message of the target service includes a trust level field, and the trust level field carries the comprehensive trust score of the target service and the trust level of the previous hop node. Decapsulate the tunnel-encapsulated message to obtain the comprehensive trust score of the target service and the trust level of the previous hop node; If the overall trust score of the target service is greater than the first threshold, and / or the trust level of the previous hop node is greater than the first preset trust level, then the original message of the target service is subjected to tunnel encapsulation processing, wherein a trust level field is added to the encapsulated tunnel encapsulated message, and the trust level field carries the overall trust score of the target service and the trust level of the intermediate forwarding node. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, and the trust level of the previous hop node is less than or equal to the first preset trust level and greater than or equal to the second preset trust level, then the message of the target service is subjected to full security verification, and the original message of the target service is subjected to tunnel encapsulation after the verification is passed. If the trust level of the previous hop node is less than the second preset trust level, then the forwarding of all packets of the target service will be blocked.

[0011] Thirdly, this application provides a message processing apparatus applied to the tunnel encapsulation head node; the apparatus includes: The receiving unit is used to receive the first message of the target service sent by the terminal device; The acquisition unit is used to acquire the comprehensive trust score of the target service corresponding to the first message of the target service, wherein the comprehensive trust score is obtained by the trust scoring system based on multi-dimensional security reputation data to weight the target service, and the multi-dimensional security reputation data includes at least the device environment information of the terminal device that sent the first message of the target service and the importance information of the target service; If the overall trust score of the target service is greater than a first threshold, the processing unit is used to add a trust level field to the tunnel encapsulation message of the target service, wherein the trust level field carries the overall trust score of the target service and the trust level of the first node of the tunnel encapsulation. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, the processing unit is used to perform full security verification on the message of the target service, and add a trust level field to the tunnel encapsulation message of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, the processing unit is used to block the forwarding of all packets of the target service.

[0012] Optionally, if the overall trust score of the target service is greater than the first threshold, the processing unit is used to generate a first forwarding strategy, wherein the first forwarding strategy is to add a trust level field to the tunnel encapsulation packet of the target service, the trust level field carrying the overall trust score of the target service and the trust level of the tunnel encapsulation first node. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, the processing unit is used to generate a second forwarding strategy, wherein the second forwarding strategy is to perform full security verification on the packets of the target service, and add a trust level field to the tunnel encapsulation packets of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, the processing unit is used to generate a third forwarding strategy, which is to block the forwarding of all packets of the target service.

[0013] Optionally, the device further includes: If the overall trust score of a service changes and the change meets preset conditions, the adjustment unit is used to adjust the forwarding strategy of that service.

[0014] Optionally, a trust level field is added to the tunnel encapsulation header of the target service; When obtaining the comprehensive trust score of the target service corresponding to the first message of the target service, the obtaining unit is specifically used for: The comprehensive trust score of the target service corresponding to the first message of the target service is obtained in real time from the trust scoring system; or, Obtain the overall trust score of the target service corresponding to the first message of the target service from the overall trust scores of each service cached locally.

[0015] Optionally, the device environment information of the terminal device includes: whether a firewall is installed on the terminal device, whether the operating system of the terminal device has vulnerabilities, and whether the communication address of the terminal device is authenticated.

[0016] Fourthly, this application provides a message processing apparatus for an intermediate forwarding node; the apparatus includes: The receiving unit is configured to receive a tunnel encapsulation message of a target service sent by the previous hop node, wherein the tunnel encapsulation message of the target service includes a trust level field, and the trust level field carries the comprehensive trust score of the target service and the trust level of the previous hop node. The acquisition unit is used to decapsulate the tunnel encapsulated message and obtain the comprehensive trust score of the target service and the trust level of the previous hop node; The processing unit is configured to perform tunnel encapsulation processing on the original message of the target service if the overall trust score of the target service is greater than a first threshold and / or the trust level of the previous hop node is greater than a first preset trust level. The processing unit is configured to add a trust level field to the encapsulated tunnel encapsulated message, wherein the trust level field carries the overall trust score of the target service and the trust level of the intermediate forwarding node. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, and the trust level of the previous hop node is less than or equal to the first preset trust level and greater than or equal to the second preset trust level, then the processing unit is used to perform full security verification on the message of the target service, and perform tunnel encapsulation processing on the original message of the target service after the verification is passed. If the trust level of the previous hop node is less than the second preset trust level, the processing unit is used to block the forwarding of all packets of the target service.

[0017] Fifthly, embodiments of this application provide a message processing apparatus, which includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the first aspects above, according to the obtained program instructions.

[0018] In a sixth aspect, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the steps of the method as described in any of the first aspects above.

[0019] In a seventh aspect, embodiments of this application provide a message processing apparatus, which includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of the second aspects above, according to the obtained program instructions.

[0020] Eighthly, embodiments of this application also provide a computer-readable storage medium storing computer-executable instructions for causing the computer to perform the steps of the method as described in any of the second aspects above.

[0021] In summary, the message processing method provided in this application is applied to the first node of tunnel encapsulation. The method includes: receiving the first message of a target service sent by a terminal device; obtaining the comprehensive trust score of the target service corresponding to the first message of the target service, wherein the comprehensive trust score is obtained by a trust scoring system based on multi-dimensional security reputation data for weighted calculation of the target service, and the multi-dimensional security reputation data includes at least the device environment information of the terminal device that sent the first message of the target service and the importance information of the target service; if the comprehensive trust score of the target service is greater than a first threshold, then adding a trust level field to the tunnel encapsulation message of the target service, wherein the trust level field carries the comprehensive trust score of the target service and the trust level of the first node of tunnel encapsulation; if the comprehensive trust score of the target service is less than or equal to the first threshold and greater than or equal to a second threshold, then performing full security verification on the message of the target service, and adding a trust level field to the tunnel encapsulation message of the target service after the verification is passed; if the comprehensive trust score of the target service is less than the second threshold, then blocking the forwarding of all messages of the target service.

[0022] The message processing method provided in this application calculates the comprehensive trust score corresponding to each traffic accessed by each terminal device, and performs hierarchical processing on the traffic accessed by each terminal device to each service based on the comprehensive trust score corresponding to each traffic accessed by each terminal device, so as to save the forwarding resources of the nodes. When encapsulating the original service message, the comprehensive trust score corresponding to the service message and the trust level of the node itself are carried in the encapsulated message, so that the next-hop node can determine the message processing strategy based on the comprehensive trust score carried in the received encapsulated message and the trust level of the previous hop node, which also realizes hierarchical processing of traffic. While ensuring network security, it improves the utilization rate of node forwarding resources. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments of this application or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments recorded in this application. For those skilled in the art, other drawings can be obtained based on these drawings of the embodiments of this application.

[0024] Figure 1 A detailed flowchart of a message processing method provided for an embodiment of this application; Figure 2 A detailed flowchart of another message processing method provided in this application embodiment; Figure 3 This is a schematic diagram of the structure of a message processing device provided in an embodiment of this application; Figure 4 A schematic diagram of another message processing apparatus provided in the embodiments of this application; Figure 5 A schematic diagram of the hardware architecture of a message processing device provided in this application embodiment; Figure 6 This is a schematic diagram of the hardware architecture of another message processing device provided in an embodiment of this application. Detailed Implementation

[0025] The terminology used in the embodiments of this application is for the purpose of describing particular embodiments only and is not intended to limit the application. The singular forms “a,” “the,” and “the” as used in this application and claims are also intended to include the plural forms unless the context clearly indicates otherwise. It should also be understood that the term “and / or” as used herein refers to any and all possible combinations comprising one or more of the associated listed items.

[0026] It should be understood that although the terms first, second, third, etc., may be used to describe various information in embodiments of this application, such information should not be limited to these terms. These terms are only used to distinguish information of the same type from one another. For example, without departing from the scope of this application, first information may also be referred to as second information, and similarly, second information may also be referred to as first information. Depending on the context, the word "if" may also be interpreted as "when," "when," or "in response to a determination."

[0027] For example, see Figure 1 The diagram shown is a detailed flowchart of a message processing method provided in an embodiment of this application. This method is applied to the tunnel encapsulation head node; the method includes the following steps: Step 100: Receive the first message of the target service sent by the terminal device.

[0028] Specifically, the tunnel encapsulation head node (e.g., CPE (Customer Premises Equipment)) receives the first message of the target service sent by the terminal device (e.g., user terminal) and sends it to the receiving end (e.g., service server) through a preset tunnel (the tunnel includes the tunnel head node, one or more intermediate forwarding nodes, and the tunnel tail node).

[0029] Step 110: Obtain the comprehensive trust score of the target service corresponding to the first message of the target service.

[0030] In this embodiment of the application, the comprehensive trust score is obtained by a trust scoring system through weighted calculation of the target service based on multi-dimensional security and reputation data. The multi-dimensional security and reputation data includes at least the device environment information of the terminal device that sends the first message of the target service and the importance information of the target service.

[0031] In practical applications, the trust scoring system can be deployed on any forwarding device that meets the hardware requirements (e.g., the tunnel encapsulation head node) or on an independent third-party server. In this embodiment, no specific limitation is made.

[0032] Trust scoring systems can standardize, integrate, and map external, multi-dimensional security reputation data (such as data from enterprise network security systems like IAM (Identity and Access Management), EDR (Endpoint Detection and Response), and SIEM (Security Information and Event Management)) based on preset rules (e.g., periodic triggering) to ultimately output a traffic trust level suitable for network forwarding strategies.

[0033] It should be noted that the multi-dimensional security reputation data includes at least the device environment information of the terminal device that sent the first message of the target service and the importance information of the target service. The device environment information of the terminal device includes at least: whether a firewall is installed on the terminal device, whether there are vulnerabilities in the terminal device's operating system, and whether the terminal device's communication address (e.g., IP address / MAC address) is authenticated.

[0034] In this embodiment of the application, when obtaining the comprehensive trust score of the target service corresponding to the first message of the target service, a preferred implementation method is as follows: The comprehensive trust score of the target service corresponding to the first message of the target service is obtained in real time from the trust scoring system.

[0035] For example, the trust scoring system maintains a comprehensive trust score for each service accessible to each terminal device. For instance, for service 1 accessible to terminal device 1, a comprehensive trust score of 11 is calculated; for service 2 accessible to terminal device 1, a comprehensive trust score of 12 is calculated, and so on. For service 1 accessible to terminal device 2, a comprehensive trust score of 21 is calculated; for service 2 accessible to terminal device 2, a comprehensive trust score of 22 is calculated, and so on. The trust scoring system can periodically acquire environmental information from each terminal device and, based on this information and the user-defined importance of each service, calculate a weighted comprehensive trust score for each service accessible to each terminal device, maintaining this score locally within the trust scoring system. The tunnel encapsulation head node can obtain the comprehensive trust score for any service accessible to any terminal device from the trust scoring system in real time.

[0036] In this embodiment of the application, when obtaining the comprehensive trust score of the target service corresponding to the first message of the target service, another preferred implementation is as follows: Obtain the overall trust score of the target service corresponding to the first message of the target service from the overall trust scores of each service cached locally.

[0037] For example, the trust scoring system periodically acquires the environmental information of each terminal device, and based on the acquired environmental information of each terminal device and the importance of each service defined by the user, it calculates the comprehensive trust score corresponding to each service accessible to each terminal device in a weighted manner. Then, it synchronizes the comprehensive trust score corresponding to each service accessible to each terminal device to the tunnel encapsulation head node. In this way, the tunnel encapsulation head node can obtain the comprehensive trust score corresponding to any service accessible to any terminal device from the comprehensive trust scores of each service cached locally.

[0038] Step 120: If the overall trust score of the target service is greater than the first threshold, then add a trust level field to the tunnel encapsulation message of the target service.

[0039] In this embodiment of the application, the trust level field carries the comprehensive trust score of the target service and the trust level of the tunnel encapsulation first node.

[0040] In this embodiment of the application, a preferred implementation is to add a trust level field to the tunnel encapsulation header of the target service.

[0041] For example, an innovative "trust level" field is introduced and defined in SD-WAN tunnel encapsulation packets. This field serves as a digital identity label for traffic, carried throughout the network with the data packet, enabling network devices to efficiently identify the security context of traffic in a stateless manner. Specifically, a fixed number of bits (e.g., 8 bits) can be allocated in the vendor-defined tunnel encapsulation packet header to carry this field. This field structurally contains two key dimensions: The overall trust score for the current business is represented by a numerical range (e.g., 0-100), with a higher score indicating higher traffic trustworthiness. This score is calculated and dynamically populated in real time by the policy mapping engine.

[0042] Trust level of the upstream device: An enumerated value (e.g., 0-4, where 0 represents unknown / untrusted and 4 represents highly trusted) identifies the trust status of the upstream network device that forwarded the packet. This mechanism can effectively prevent spoofing attacks launched by malicious CPEs or compromised devices, and achieve hop-by-hop trust verification and tracing.

[0043] In this embodiment of the application, a preferred implementation is that if the overall trust score of the target service is greater than a first threshold, a first forwarding strategy is generated, wherein the first forwarding strategy is: adding a trust level field to the tunnel encapsulation packet of the target service, the trust level field carrying the overall trust score of the target service and the trust level of the tunnel encapsulation first node.

[0044] In practical applications, assuming the overall trust score ranges from 0 to 100, with a first threshold preset to 80 and a second preset value to 60, upon receiving the first packet from the target terminal device accessing the target service, the target overall trust score corresponding to the target service accessed by the target terminal device is obtained. If the target overall trust score is 90 (90 > 80), a corresponding first forwarding strategy is generated based on the target terminal device identifier and the packet characteristics of the target service. This first forwarding strategy involves directly performing tunnel encapsulation on the packet from the target terminal device accessing the target service, adding a trust field to the tunnel encapsulated packet, and the trust level field carrying the overall trust score corresponding to the target terminal accessing the target service, as well as the trust level of the tunnel encapsulation head node itself. The tunnel encapsulation head node then forwards the encapsulated packet to the next-hop forwarding node.

[0045] Step 130: If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, then perform full security verification on the message of the target service, and add a trust level field to the tunnel encapsulation message of the target service after the verification is passed.

[0046] In this embodiment of the application, if the comprehensive trust score of the target service is less than or equal to a first threshold and greater than or equal to a second threshold, a second forwarding strategy is generated. The second forwarding strategy is to perform full security verification on the packets of the target service and add a trust level field to the tunnel encapsulation packets of the target service after the verification is passed.

[0047] In practical applications, assuming the comprehensive trust score ranges from 0 to 100, with a first threshold preset to 80 and a second preset value to 60, upon receiving the first packet from the target terminal device accessing the target service, the target comprehensive trust score corresponding to the target service accessed by the target terminal device is obtained. If the target comprehensive trust score is 70 (80 > 70 > 60), a corresponding second forwarding strategy is generated based on the target terminal device identifier and the packet characteristics of the target service. This second forwarding strategy involves: performing full security verification on the packet of the target service; and after successful verification, performing tunnel encapsulation on the packet from the target terminal device accessing the target service. A trust field is added to the tunnel encapsulated packet of the target service, and the trust level field carries the comprehensive trust score corresponding to the target terminal accessing the target service, as well as the trust level of the tunnel encapsulation head node itself. The tunnel encapsulation head node forwards the encapsulated tunnel encapsulated packet to the next-hop forwarding node. If the security verification fails, the service packet is not encapsulated and forwarded to the next hop.

[0048] Step 140: If the overall trust score of the target service is less than the second threshold, then block the forwarding of all packets of the target service.

[0049] If the overall trust score of the target service is less than the second threshold, a third forwarding strategy is generated, which is to block the forwarding of all packets of the target service.

[0050] In practical applications, assuming the comprehensive trust score ranges from 0 to 100, the first threshold is preset to 80, and the second preset value is 60; then, when the first packet of the target terminal device accessing the target service is received, the target comprehensive trust score corresponding to the target service accessed by the target terminal device is obtained. If the target comprehensive trust score is 300 (60 > 30), then based on the target terminal device identifier and the packet characteristics of the target service, a corresponding third forwarding strategy is generated. The third forwarding strategy is to block the forwarding of all packets of the target terminal accessing the target service.

[0051] In this embodiment of the application, if it is determined that the overall trust score of a service changes and the change meets a preset condition, then the forwarding strategy of that service is adjusted.

[0052] For example, if the target terminal device's environment does not have a firewall installed, or if the device system has vulnerabilities, or if the device's communication address is not authenticated, and the currently maintained target terminal's overall trust score for accessing the target service is 70 (80 > 70 > 60), then the second forwarding strategy is used to forward the packets from the target terminal device accessing the target service. If the target terminal device's environment changes (e.g., a firewall was not previously installed, but is now installed), the trust scoring system can be triggered to recalculate the target terminal's overall trust score for accessing the target service. If the updated target terminal's overall trust score reaches 85, the tunnel encapsulation first node, upon sensing that the target terminal's overall trust score for accessing the target service has reached 85, adjusts the forwarding strategy and uses the first forwarding strategy to forward the packets from the target terminal device accessing the target service.

[0053] In this embodiment of the application, after the tunnel encapsulation first node encapsulates a service message, it sends the tunnel encapsulated message to the next-hop forwarding node. The next-hop forwarding node forwards the message based on the comprehensive trust score carried by the tunnel encapsulated message and the trust level of the previous hop node.

[0054] For example, see Figure 2 The diagram shown is a detailed flowchart of a message processing method provided in an embodiment of this application. This method is applied to an intermediate forwarding node and includes the following steps: Step 200: Receive the tunnel encapsulation message for the target service sent by the previous hop node.

[0055] The tunnel encapsulation message of the target service includes a trust level field, which carries the comprehensive trust score of the target service and the trust level of the previous hop node. Step 210: Decapsulate the tunnel encapsulated message to obtain the comprehensive trust score of the target service and the trust level of the previous hop node.

[0056] Step 220: If the overall trust score of the target service is greater than the first threshold, and / or the trust level of the previous hop node is greater than the first preset trust level, then the original message of the target service is subjected to tunnel encapsulation processing.

[0057] The encapsulated tunnel packet includes a trust level field, which carries the overall trust score of the target service and the trust level of the intermediate forwarding node. Step 230: If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, and the trust level of the previous hop node is less than or equal to the first preset trust level and greater than or equal to the second preset trust level, then the message of the target service is subjected to full security verification, and the original message of the target service is subjected to tunnel encapsulation processing after the verification is passed.

[0058] Step 240: If the trust level of the previous hop node is less than the second preset trust level, then block the forwarding of all packets of the target service.

[0059] This application embodiment, through real-time decision-making by the policy mapping engine and rapid coordination with the SD-WAN controller, can downgrade the traffic trust level of a specific terminal or user within seconds and synchronize it across the entire network. Based on the latest traffic trust level label carried in the packet, the CPE device can locally and automatically perform drop or redirection actions, compressing the time window for lateral movement of threats to almost zero, and realizing a fundamental shift from "post-event response" to "real-time immunity".

[0060] This application's embodiments employ a trust-based traffic classification system. This allows high-trust-level business traffic (such as communications with core executives and video conferencing) to be flagged and prioritized for forwarding via a "green channel," thereby ensuring the lowest latency and highest bandwidth. Simultaneously, low-trust or unknown traffic is strictly directed to a secure resource pool. This "differentiated treatment" mechanism maximizes the user experience for critical businesses without compromising the overall security level.

[0061] Based on the same inventive concept as the above-described method embodiment applied to the first node of tunnel encapsulation, see, for example, the following... Figure 3 The diagram shown is a structural schematic of a message processing device provided in an embodiment of this application. This device is applied to the tunnel encapsulation head node and includes: The receiving unit 30 is used to receive the first message of the target service sent by the terminal device; The acquisition unit 31 is used to acquire the comprehensive trust score of the target service corresponding to the first message of the target service, wherein the comprehensive trust score is obtained by the trust scoring system based on multi-dimensional security reputation data to perform weighted calculation on the target service, and the multi-dimensional security reputation data includes at least the device environment information of the terminal device that sent the first message of the target service and the importance information of the target service; If the overall trust score of the target service is greater than the first threshold, the processing unit 32 is used to add a trust level field to the tunnel encapsulation message of the target service, wherein the trust level field carries the overall trust score of the target service and the trust level of the tunnel encapsulation first node. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, the processing unit 32 is used to perform full security verification on the message of the target service, and add a trust level field to the tunnel encapsulation message of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, the processing unit 32 is used to block the forwarding of all packets of the target service.

[0062] Optionally, if the overall trust score of the target service is greater than the first threshold, the processing unit 32 is used to generate a first forwarding strategy, wherein the first forwarding strategy is to add a trust level field to the tunnel encapsulation message of the target service, the trust level field carrying the overall trust score of the target service and the trust level of the first node of the tunnel encapsulation; If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, the processing unit 32 is used to generate a second forwarding strategy, wherein the second forwarding strategy is to perform full security verification on the packets of the target service and add a trust level field to the tunnel encapsulation packets of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, the processing unit 32 is used to generate a third forwarding strategy, which is to block the forwarding of all packets of the target service.

[0063] Optionally, the device further includes: If the overall trust score of a service changes and the change meets preset conditions, the adjustment unit is used to adjust the forwarding strategy of that service.

[0064] Optionally, a trust level field is added to the tunnel encapsulation header of the target service; When obtaining the comprehensive trust score of the target service corresponding to the first message of the target service, the obtaining unit 31 is specifically used for: The comprehensive trust score of the target service corresponding to the first message of the target service is obtained in real time from the trust scoring system; or, Obtain the overall trust score of the target service corresponding to the first message of the target service from the overall trust scores of each service cached locally.

[0065] Optionally, the device environment information of the terminal device includes: whether a firewall is installed on the terminal device, whether the operating system of the terminal device has vulnerabilities, and whether the communication address of the terminal device is authenticated.

[0066] Based on the same inventive concept as the above-described method embodiments applied to intermediate forwarding nodes, see, for example, the following... Figure 4 The diagram shown is a structural schematic of a message processing device provided in an embodiment of this application. This device is applied to an intermediate forwarding node; the device includes: The receiving unit 40 is used to receive a tunnel encapsulation message of a target service sent by the previous hop node, wherein the tunnel encapsulation message of the target service includes a trust level field, and the trust level field carries the comprehensive trust score of the target service and the trust level of the previous hop node. The acquisition unit 41 is used to decapsulate the tunnel encapsulated message and obtain the comprehensive trust score of the target service and the trust level of the previous hop node. If the overall trust score of the target service is greater than a first threshold, and / or the trust level of the previous hop node is greater than a first preset trust level, then the processing unit 42 is used to perform tunnel encapsulation processing on the original message of the target service, wherein a trust level field is added to the encapsulated tunnel encapsulation message, and the trust level field carries the overall trust score of the target service and the trust level of the intermediate forwarding node. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, and the trust level of the previous hop node is less than or equal to the first preset trust level and greater than or equal to the second preset trust level, then the processing unit 42 is used to perform full security verification on the message of the target service, and perform tunnel encapsulation processing on the original message of the target service after the verification is passed. If the trust level of the previous hop node is less than the second preset trust level, the processing unit 42 is used to block the forwarding of all packets of the target service.

[0067] These units can be one or more integrated circuits configured to implement the above methods, such as one or more Application Specific Integrated Circuits (ASICs), one or more digital signal processors (DSPs), or one or more Field Programmable Gate Arrays (FPGAs). Alternatively, when one of these units is implemented using processing element scheduler code, the processing element can be a general-purpose processor, such as a Central Processing Unit (CPU) or other processor capable of calling program code. Furthermore, these units can be integrated together to form a system-on-a-chip (SOC).

[0068] Furthermore, regarding the message processing apparatus provided in this application embodiment, from a hardware perspective, the hardware architecture schematic diagram of the message processing apparatus can be found in [reference needed]. Figure 5 As shown, the message processing device may include: a memory 50 and a processor 51. The memory 50 is used to store program instructions; the processor 51 calls the program instructions stored in the memory 50 and executes the method embodiment applied to the first node of tunnel encapsulation according to the obtained program instructions. The specific implementation method and technical effect are similar, and will not be described again here.

[0069] Optionally, this application also provides a tunneling encapsulation first node device, including at least one processing element (or chip) for performing the above-described method embodiments applied to the tunneling encapsulation first node.

[0070] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to execute the above-described method embodiment applied to the tunnel encapsulation first node.

[0071] Furthermore, regarding the packet forwarding device provided in this application embodiment, from a hardware perspective, the hardware architecture diagram of the packet forwarding device can be found in [reference needed]. Figure 6 As shown, the message forwarding device may include: a memory 60 and a processor 61. The memory 60 is used to store program instructions; the processor 61 calls the program instructions stored in the memory 60 and executes the method embodiment applied to the intermediate forwarding node according to the obtained program instructions. The specific implementation and technical effects are similar, and will not be described again here.

[0072] Optionally, this application also provides an intermediate forwarding node device, including at least one processing element (or chip) for performing the above-described method embodiments applied to an intermediate forwarding node.

[0073] Optionally, this application also provides a program product, such as a computer-readable storage medium storing computer-executable instructions for causing the computer to execute the above-described method embodiments applied to intermediate forwarding nodes.

[0074] Here, a machine-readable storage medium can be any electronic, magnetic, optical, or other physical storage device that can contain or store information, such as executable instructions, data, etc. For example, a machine-readable storage medium can be: RAM (Random Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard disk drives), solid-state drives, any type of storage disk (such as optical discs, DVDs, etc.), or similar storage media, or combinations thereof.

[0075] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer, which can take the form of a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email sending and receiving device, game console, tablet computer, wearable device, or any combination of these devices.

[0076] For ease of description, the above devices are described separately by function as various units. Of course, in implementing this application, the functions of each unit can be implemented in one or more software and / or hardware.

[0077] Those skilled in the art will understand that embodiments of this application can be provided as methods, systems, or computer program products. Therefore, this application can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, embodiments of this application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0078] This application is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this application. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0079] Furthermore, these computer program instructions can also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in the process. Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0080] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0081] The above description is merely a preferred embodiment of this application and is not intended to limit this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A message processing method, characterized in that, Applied to the first node of tunnel encapsulation; the method includes: Receive the first message of the target service sent by the terminal device; Obtain the comprehensive trust score of the target service corresponding to the first message of the target service. The comprehensive trust score is obtained by the trust scoring system based on multi-dimensional security reputation data to weight the target service. The multi-dimensional security reputation data includes at least the device environment information of the terminal device that sent the first message of the target service and the importance information of the target service. If the overall trust score of the target service is greater than the first threshold, a trust level field is added to the tunnel encapsulation message of the target service, wherein the trust level field carries the overall trust score of the target service and the trust level of the first node of the tunnel encapsulation. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, then the message of the target service is subjected to full security verification, and a trust level field is added to the tunnel encapsulation message of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, then the forwarding of all packets of the target service will be blocked.

2. The method as described in claim 1, characterized in that, If the overall trust score of the target service is greater than the first threshold, a first forwarding strategy is generated, wherein the first forwarding strategy is to add a trust level field to the tunnel encapsulation message of the target service, the trust level field carrying the overall trust score of the target service and the trust level of the first node of the tunnel encapsulation; If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, a second forwarding strategy is generated. The second forwarding strategy is to perform full security verification on the packets of the target service and add a trust level field to the tunnel encapsulation packets of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, a third forwarding strategy is generated, which is to block the forwarding of all packets of the target service.

3. The method as described in claim 2, characterized in that, The method further includes: If the overall trust score of a service changes and the change meets preset conditions, then the forwarding strategy for that service will be adjusted.

4. The method according to any one of claims 1-3, characterized in that, Add a trust level field to the tunnel encapsulation header of the target service; The steps for obtaining the comprehensive trust score of the target service corresponding to the first message of the target service include: The comprehensive trust score of the target service corresponding to the first message of the target service is obtained in real time from the trust scoring system. or, Obtain the overall trust score of the target service corresponding to the first message of the target service from the overall trust scores of each service cached locally.

5. The method as described in claim 1, characterized in that, The device environment information of the terminal device includes: whether a firewall is installed on the terminal device, whether there are vulnerabilities in the terminal device's operating system, and whether the terminal device's communication address is authenticated.

6. A message processing method, characterized in that, Applied to intermediate forwarding nodes; the method includes: Receive a tunnel encapsulation message of the target service sent by the previous hop node, wherein the tunnel encapsulation message of the target service includes a trust level field, and the trust level field carries the comprehensive trust score of the target service and the trust level of the previous hop node. Decapsulate the tunnel-encapsulated message to obtain the comprehensive trust score of the target service and the trust level of the previous hop node; If the overall trust score of the target service is greater than the first threshold, and / or the trust level of the previous hop node is greater than the first preset trust level, then the original message of the target service is subjected to tunnel encapsulation processing, wherein a trust level field is added to the encapsulated tunnel encapsulated message, and the trust level field carries the overall trust score of the target service and the trust level of the intermediate forwarding node. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, and the trust level of the previous hop node is less than or equal to the first preset trust level and greater than or equal to the second preset trust level, then the message of the target service is subjected to full security verification, and the original message of the target service is subjected to tunnel encapsulation after the verification is passed. If the trust level of the previous hop node is less than the second preset trust level, then the forwarding of all packets of the target service will be blocked.

7. A message processing apparatus, characterized in that, Applied to the first node of tunnel sealing; the device includes: The receiving unit is used to receive the first message of the target service sent by the terminal device; The acquisition unit is used to acquire the comprehensive trust score of the target service corresponding to the first message of the target service. The comprehensive trust score is obtained by the trust scoring system based on multi-dimensional security reputation data to weight the target service. The multi-dimensional security reputation data includes at least the device environment information of the terminal device that sent the first message of the target service and the importance information of the target service. If the overall trust score of the target service is greater than a first threshold, the processing unit is used to add a trust level field to the tunnel encapsulation message of the target service, wherein the trust level field carries the overall trust score of the target service and the trust level of the first node of the tunnel encapsulation. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, the processing unit is used to perform full security verification on the message of the target service, and add a trust level field to the tunnel encapsulation message of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, the processing unit is used to block the forwarding of all packets of the target service.

8. The apparatus as claimed in claim 7, characterized in that, If the overall trust score of the target service is greater than the first threshold, the processing unit is used to generate a first forwarding strategy, wherein the first forwarding strategy is to add a trust level field to the tunnel encapsulation packet of the target service, the trust level field carrying the overall trust score of the target service and the trust level of the first node of the tunnel encapsulation. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, the processing unit is used to generate a second forwarding strategy, wherein the second forwarding strategy is to perform full security verification on the packets of the target service, and add a trust level field to the tunnel encapsulation packets of the target service after the verification is passed. If the overall trust score of the target service is less than the second threshold, the processing unit is used to generate a third forwarding strategy, which is to block the forwarding of all packets of the target service.

9. The apparatus as claimed in claim 8, characterized in that, The device further includes: If the overall trust score of a service changes and the change meets preset conditions, the adjustment unit is used to adjust the forwarding strategy of that service.

10. The apparatus according to any one of claims 7-9, characterized in that, Add a trust level field to the tunnel encapsulation header of the target service; When obtaining the comprehensive trust score of the target service corresponding to the first message of the target service, the obtaining unit is specifically used for: The comprehensive trust score of the target service corresponding to the first message of the target service is obtained in real time from the trust scoring system; or, Obtain the overall trust score of the target service corresponding to the first message of the target service from the overall trust scores of each service cached locally.

11. The apparatus as claimed in claim 7, characterized in that, The device environment information of the terminal device includes: whether a firewall is installed on the terminal device, whether there are vulnerabilities in the terminal device's operating system, and whether the terminal device's communication address is authenticated.

12. A message processing apparatus, characterized in that, Applied to intermediate forwarding nodes; the device includes: The receiving unit is configured to receive a tunnel encapsulation message of a target service sent by the previous hop node, wherein the tunnel encapsulation message of the target service includes a trust level field, and the trust level field carries the comprehensive trust score of the target service and the trust level of the previous hop node. The acquisition unit is used to decapsulate the tunnel encapsulated message and obtain the comprehensive trust score of the target service and the trust level of the previous hop node; The processing unit is configured to perform tunnel encapsulation processing on the original message of the target service if the overall trust score of the target service is greater than a first threshold and / or the trust level of the previous hop node is greater than a first preset trust level. The processing unit is configured to add a trust level field to the encapsulated tunnel encapsulated message, wherein the trust level field carries the overall trust score of the target service and the trust level of the intermediate forwarding node. If the overall trust score of the target service is less than or equal to the first threshold and greater than or equal to the second threshold, and the trust level of the previous hop node is less than or equal to the first preset trust level and greater than or equal to the second preset trust level, then the processing unit is used to perform full security verification on the message of the target service, and perform tunnel encapsulation processing on the original message of the target service after the verification is passed. If the trust level of the previous hop node is less than the second preset trust level, the processing unit is used to block the forwarding of all packets of the target service.

13. A message processing apparatus, characterized in that, The message processing device includes: Memory, used to store program instructions; A processor is configured to invoke program instructions stored in the memory and execute the steps of the method as described in any one of claims 1-6 according to the obtained program instructions.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions for causing the computer to perform the steps of the method as described in any one of claims 1-6.

Images