Message transmission method and device

Abstract

A message transmission method, device, and system, relating to the technical field of communications. The method comprises: a head node acquires a first message, and then sends the first message, wherein the first message comprises first information, security information, and second information, the first information is information required to be used by an intermediate node, the security information is used for performing security verification on the second information, and the second information is information used only by a tail node. The present application solves the problem that the information required to be used by the intermediate node cannot be used by the intermediate node, and achieves normal forwarding processing while ensuring the security. The present application is used for message transmission.

Description

Message transmission method and device

[0001] This application claims priority to a Chinese patent application filed on July 21, 2023, with application number 202310909238.5 and application name “Message Transmission Method and Apparatus,” the entire contents of which are incorporated herein by reference. Technical Field

[0002] The present application relates to the field of communication technology, and in particular to a message transmission method and device. Background Art

[0003] In the field of communications technology, nodes can communicate with each other by transmitting messages. Currently, a node that needs to send a message can obtain the message based on its structure and send it to another node. A message typically includes a message header and a payload containing data. To encrypt the payload, the message header typically includes an Encapsulating Security Payload (ESP) header. Currently, the ESP header encrypts information used during forwarding, making it impossible for nodes to perceive the encrypted information during the forwarding process.

[0004] Summary of the Invention

[0005] This application provides a message transmission method and device that can achieve normal forwarding processing while ensuring security. The technical solution is as follows:

[0006] In the first aspect, the present application provides a message transmission method, which includes: after obtaining a first message, the head node sends the first message; wherein the first message includes: first information, security information and second information, the first information is information for use by the intermediate node, the security information is used to perform security verification on the second information, and the second information is information only for use by the tail node.

[0007] The first information may include: at least one of app aware networking (APN) information and generalized IPv6 tunnel (GIP6) information. The first information may also not include APN information and GIP6 information, which is not limited in this application. The security information may be an ESP header or other information used for security verification. Security verification may refer to encryption, or authentication, or encryption and authentication. The second information may include a payload, which is only used by the tail node, and the intermediate nodes do not need to pay attention to the payload. For another example, in addition to the payload, the second information also includes a parameter set, which is included in the message header of the first message. For another example, the second information may not include a payload, but include the parameter set.

[0008] The first message in the present application includes the first information, the second information and the security information. The second information for which the security information is security-verified is information that is only used by the tail node. In this way, the information that the intermediate node needs to use is the first information, and the information that the intermediate node does not need to use and that the tail node needs to use is the second information. The security information does not need to perform security verification on the information that the intermediate node needs to use. If the security verification includes encryption, then on the premise of ensuring the security of the first message, the intermediate node can use the unencrypted first information to realize the extended function brought by the first information. Since the security information is not used to perform security verification on the first information, even if the first information changes during transmission, it does not conflict with the object (second information) targeted by the security verification of the security information. When the security verification includes authentication, the authenticated object (second information) can be authenticated at the tail node.

[0009] Furthermore, the present application does not limit the positions of the first information, security information, and second information in the first message. These positions will be described with some examples below.

[0010] Optionally, the first information and the security information may both be included in a message header of the first message. For example, the message header includes a first destination options header (DOH), a segment routing header (SRH), and a second DOH, wherein a next header field of the first DOH is used to indicate the SRH. In this case, the second DOH includes the first information and the security information.

[0011] In the case where the first information and the security information are included in the second DOH, the second DOH may include multiple type-length-value (TLV) fields, the multiple TLV fields including a first TLV field and a second TLV field, the first TLV field may include at least one TLV field, and the second TLV field may also include at least one TLV field. The first TLV field includes the first information, and the second TLV field includes the security information.

[0012] Furthermore, the second information may be a payload, or the second information may include a parameter set in a message header in addition to the payload. Thus, the message header of the first message includes: first information and security information, or first information, security information, and a parameter set. The parameter set may be included in the same or different message header as the first information and security information.

[0013] For example, the first information, security information, and parameter set may be included in the second DOH. For example, the multiple TLV fields in the second DOH include a first TLV field, a second TLV field, and a third TLV field, the first TLV field includes the first information, the second TLV field includes the second information, and the third TLV field includes the parameter set.

[0014] For another example, the message header of the first message includes a first message header and a second message header, the first information is included in the first message header, the second information is included in the second message header, and the parameter set is included in the first message header or the second message header.

[0015] For another example, the message header of the first message includes a first message header, a second message header, and a third message header. The first information is included in the first message header, the second information is included in the second message header, and the parameter set is included in the third message header.

[0016] Optionally, the first message includes a message header and a payload. When the head node obtains the first message, it may first obtain the payload (including the data to be transmitted), and then obtain the first message including the message header and the payload based on the payload. Optionally, the payload may also include another message. In this case, the head node does not obtain the payload based on the data to be transmitted, but after receiving the other message, it may use the other message as the payload of the first message, and then obtain the first message based on the payload. In the case where the payload of the first message includes the received other message, if the second information of the first message includes the payload, then under the effect of the above-mentioned security information, it is possible to perform a security check on the other message, so that the security of the other message is higher. In the case where the payload of the first message does not include the received other message, but includes the data to be transmitted, the length of the payload is shorter. At this time, the transmission bandwidth required for the transmission of the first message is smaller, and the load on the network used to transmit the first message is smaller.

[0017] Furthermore, based on the foregoing, any first message provided in the present application may further include an authentication header (AH), which may be included in the same message header as the first information and security information. For example, the AH, the first information, and the security information may be included in the second DOH. For example, the multiple TLV fields of the second DOH include a TLV field corresponding to the AH, and the TLV field includes the AH. The second DOH may use different TLV fields to carry the AH, the first information, and the security information, or the second DOH may use different TLV fields to carry the AH, the first information, the security information, and the parameter set. Alternatively, the second DOH may include the AH in the same TLV field as the first information, the security information, or the parameter set.

[0018] Optionally, the first message is a segment routing IPv6 (SRv6) message or other message based on the IPv6 forwarding plane, which is not limited in this application.

[0019] In a second aspect, the present application provides another message transmission method, the method comprising: after receiving a first message, an intermediate node uses first information in the first message and forwards the first message. The first message includes: first information, security information, and second information, wherein the first information is information for use by the intermediate node, the security information is used to perform a security check on the second information, and the second information is information for use only by the tail node.

[0020] In a third aspect, the present application provides another message transmission method, comprising: after receiving a first message, the egress node performs a security check on the second message based on the security information, and uses the second message after the security check. The first message includes: first information, security information, and second information, wherein the first information is information for use by the intermediate node, the security information is used to perform a security check on the second information, and the second information is information for use only by the egress node.

[0021] The first message in the second aspect and the third aspect may have the characteristics of the first message in the first aspect, which will not be elaborated in this application.

[0022] In a fourth aspect, a message transmission device is provided. The message transmission device is provided at a head node and includes an acquisition module and a sending module. The acquisition module is configured to acquire a first message, and the sending module is configured to send the first message. The first message includes first information, security information, and second information. The first information is used by intermediate nodes, the security information is used to perform security verification on the second information, and the second information is used only by the tail node.

[0023] The first information may include at least one of APN information and GIP6 information. The first information may also include neither APN information nor GIP6 information, and this application does not limit this. The security information may be an ESP header or other information used for security verification. The second information may include a payload, which is used only by the egress node and does not need to be concerned with the payload by the intermediate nodes. For another example, in addition to the payload, the second information may also include a parameter set, which is included in the header of the first message. For another example, the second information may also include the parameter set instead of the payload.

[0024] The first message in the present application includes the first information, the second information and the security information. The second information for which the security information is security-verified is information that is only used by the tail node. In this way, the information that the intermediate node needs to use is the first information, and the information that the intermediate node does not need to use and that the tail node needs to use is the second information. The security information does not need to perform security verification on the information that the intermediate node needs to use. If the security verification includes encryption, then on the premise of ensuring the security of the first message, the intermediate node can use the unencrypted first information to realize the extended function brought by the first information. Since the security information is not used to perform security verification on the first information, even if the first information changes during transmission, it does not conflict with the object (second information) targeted by the security verification of the security information. When the security verification includes authentication, the authenticated object (second information) can be authenticated at the tail node.

[0025] Furthermore, the present application does not limit the positions of the first information, security information, and second information in the first message. These positions will be described with some examples below.

[0026] Optionally, the first information and the security information may both be included in a message header of the first message. For example, the message header includes a first DOH, an SRH, and a second DOH, wherein the next header field of the first DOH is used to indicate the SRH. In this case, the second DOH includes the first information and the security information.

[0027] When the first information and the security information are included in the second DOH, the second DOH may include multiple TLV fields, including a first TLV field and a second TLV field. The first TLV field may include at least one TLV field, and the second TLV field may also include at least one TLV field. The first TLV field includes the first information, and the second TLV field includes the security information.

[0028] Furthermore, the second information may be a payload, or the second information may include a parameter set in a message header in addition to the payload. Thus, the message header of the first message includes: first information and security information, or first information, security information, and a parameter set. The parameter set may be included in the same or different message header as the first information and security information.

[0029] For example, the first information, security information, and parameter set may be included in the second DOH. For example, the multiple TLV fields in the second DOH include a first TLV field, a second TLV field, and a third TLV field, the first TLV field includes the first information, the second TLV field includes the second information, and the third TLV field includes the parameter set.

[0030] For another example, the message header of the first message includes a first message header and a second message header, the first information is included in the first message header, the second information is included in the second message header, and the parameter set is included in the first message header or the second message header.

[0031] For another example, the message header of the first message includes a first message header, a second message header, and a third message header. The first information is included in the first message header, the second information is included in the second message header, and the parameter set is included in the third message header.

[0032] Optionally, the first message includes a message header and a payload. When the head node obtains the first message, it may first obtain the payload (including the data to be transmitted), and then obtain the first message including the message header and the payload based on the payload. Optionally, the payload may also include another message. In this case, the head node does not obtain the payload based on the data to be transmitted, but after receiving the other message, it may use the other message as the payload of the first message, and then obtain the first message based on the payload. In the case where the payload of the first message includes the received other message, if the second information of the first message includes the payload, then under the effect of the above-mentioned security information, it is possible to perform a security check on the other message, so that the security of the other message is higher. In the case where the payload of the first message does not include the received other message, but includes the data to be transmitted, the length of the payload is shorter. At this time, the transmission bandwidth required for the transmission of the first message is smaller, and the load on the network used to transmit the first message is smaller.

[0033] Furthermore, based on the foregoing, any first message provided in the present application may further include an AH, and the AH may be included in the same message header as the first information and security information. For example, the AH, the first information, and the security information may be included in the second DOH. For example, the multiple TLV fields of the second DOH include a TLV field corresponding to the AH, and the TLV field includes the AH. The second DOH may use different TLV fields to carry the AH, the first information, and the security information, or the second DOH may use different TLV fields to carry the AH, the first information, the security information, and the parameter set. Alternatively, the second DOH may include the AH in the same TLV field as the first information, the security information, or the parameter set.

[0034] Optionally, the first message is an SRv6 message or other message, which is not limited in this application.

[0035] In a fifth aspect, the present application provides a message transmission device, which is provided at an intermediate node and includes: a receiving module, a processing module, and a forwarding module. The receiving module is configured to receive a first message; wherein the first message includes: first information, security information, and second information, the first information being information for use by the intermediate node, the security information being used to perform security verification on the second information, and the second information being information for use only by the tail node; the processing module is configured to use the first information in the first message; and the forwarding module is configured to forward the first message.

[0036] In a sixth aspect, the present application provides a message transmission device, which is provided at an egress node and includes a receiving module, a security verification module, and a processing module. The receiving module is configured to receive a first message, wherein the first message includes first information, security information, and second information. The first information is information for use by the intermediate node, the security information is used to perform a security verification on the second information, and the second information is information only for use by the egress node. The security verification module is configured to perform a security verification on the second information based on the security information, and the processing module is configured to use the second information after security verification.

[0037] The first message in the fifth and sixth aspects may have the characteristics of the first message in the fourth aspect, which will not be elaborated in this application.

[0038] In the seventh aspect, the present application provides a message transmission device, which includes: a processor and a memory, wherein a program is stored in the memory; the processor is used to call the program stored in the memory so that the message transmission device executes the message transmission method described in any design in the first aspect.

[0039] In the eighth aspect, the present application provides a message transmission device, which includes: a processor and a memory, wherein a program is stored in the memory; the processor is used to call the program stored in the memory so that the message transmission device executes the message transmission method described in any design in the second aspect.

[0040] In the ninth aspect, the present application provides a message transmission device, which includes: a processor and a memory, wherein a program is stored in the memory; the processor is used to call the program stored in the memory so that the message transmission device executes the message transmission method described in any design in the third aspect.

[0041] In a tenth aspect, the present application provides a message transmission system, comprising: a head node, an intermediate node, and an egress node; the head node comprises the message transmission apparatus described in any one of the designs of the fourth aspect, the intermediate node comprises the message transmission apparatus described in any one of the designs of the fifth aspect, and the egress node comprises the message transmission apparatus described in any one of the designs of the sixth aspect. Alternatively, the head node comprises the message transmission apparatus described in any one of the designs of the seventh aspect, the intermediate node comprises the message transmission apparatus described in any one of the designs of the eighth aspect, and the egress node comprises the message transmission apparatus described in any one of the designs of the ninth aspect;

[0042] In the eleventh aspect, the present application provides a computer-readable storage medium, which stores a computer program; when the computer program is run on a computer, the computer executes the message transmission method described in any design of the first aspect; or, when the computer program is run on a computer, the computer executes the message transmission method described in any design of the second aspect; or, when the computer program is run on a computer, the computer executes the message transmission method described in any design of the third aspect.

[0043] In the twelfth aspect, a computer program product comprising instructions is provided, which, when the computer program product is run on a computer, enables the computer to execute the message transmission method as described in any design of the first aspect; or, when the computer program product is run on a computer, enables the computer to execute the message transmission method as described in any design of the second aspect; or, when the computer program product is run on a computer, enables the computer to execute the message transmission method as described in any design of the third aspect.

[0044] The technical effects brought about by any design method in the second aspect to the twelfth aspect can refer to the technical effects brought about by the corresponding design method in the first aspect, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0045] FIG1 is a schematic structural diagram of a message transmission device provided by the present application;

[0046] FIG2 is a schematic diagram of a message transmission system provided by the present application;

[0047] FIG3 is a schematic diagram of another message transmission system provided by the present application;

[0048] FIG4 is a schematic diagram of the structure of a message provided by this application;

[0049] FIG5 is a flow chart of a message transmission method provided by the present application;

[0050] FIG6 is a schematic diagram of the structure of another message provided by the present application;

[0051] FIG7 is a schematic structural diagram of a message transmission device provided by the present application;

[0052] FIG8 is a schematic structural diagram of another message transmission device provided by the present application;

[0053] FIG9 is a schematic structural diagram of another message transmission device provided in this application. DETAILED DESCRIPTION

[0054] In order to make the principles and technical solutions of the present application clearer, the implementation methods of the present application will be further described in detail below with reference to the accompanying drawings.

[0055] An embodiment of the present application provides a message transmission system, which includes multiple communication nodes (such as gateways, routers, terminals, servers, etc.). The communication nodes may include a message transmission device, which may be a communication device or a portion of a communication device (such as an interface board, etc.). For example, the message transmission device may include: a processor; the processor is configured to couple with a memory, read instructions from the memory, and then execute the method described in the embodiment of the present application as performed by the message transmission device according to the instructions. In the message transmission device, there may be multiple processors, and the memory coupled to the processor may be independent of the processor or the message transmission device, or it may be within the processor or network device. The memory may be a physically independent unit, or it may be storage space on a cloud server or a network hard drive. Optionally, there may be one or more memories. When there are multiple memories, they may be located in the same or different locations and may be used independently or in combination. For example, when the memory is located within the message transmission device, please refer to Figure 1, which is a schematic structural diagram of a message transmission device provided in an embodiment of the present application. The message transmission device 200 includes a processor 202 and a memory 201, wherein the memory 201 is used to store programs, and the processor 202 is used to call the programs stored in the memory 201 so that the message transmission device performs the corresponding method or function. Optionally, as shown in Figure 1, the message transmission device 200 may also include at least one communication interface 203 and at least one communication bus 204. The memory 201, the processor 202, and the communication interface 203 are communicatively connected via the communication bus 204. The communication interface 203 is used to communicate with other devices under the control of the processor 202, and the processor 202 can call the programs stored in the memory 201 via the communication bus 204.

[0056] Communication nodes in a message transmission system can communicate with each other by transmitting messages. For example, referring to Figure 2, the message transmission system includes: a head node and a tail node (both are communication nodes). The head node can encapsulate a first message and send the first message to the tail node. After receiving the first message, the tail node can parse the first message to extract the data included in the payload of the first message. The first message includes a message header and a payload, and the payload includes data. The tail node can parse the first message based on the message header to extract the data included in the payload.

[0057] Figure 2 uses the example of a first message being transmitted from a head node to an egress node without passing through an intermediate node. In a feasible embodiment, the first message may also pass through an intermediate node during transmission from the head node to the egress node. As shown in Figure 3, based on the message transmission system shown in Figure 2, the message transmission system further includes an intermediate node, which is located on the link between the head node and the egress node. The head node can send a first message to the intermediate node. After receiving the first message, the intermediate node can forward the first message to the egress node based on the message header of the first message. After receiving the first message, the egress node can parse the first message based on the message header to extract the data included in the payload. The message header of the first message includes a basic message header. The basic message header is used to support the transmission of the message from the source address (such as the address of the head node mentioned above) to the destination address. In addition to the basic message header, the message header of the first message may also include multiple extended message headers. The extended message header is used to extend the transmission of the message between the source address and the destination address. For example, taking the first message as an SRv6 message, the structure of the first message can be as shown in Figure 4. The first message includes: a message header and a payload arranged in sequence. The message header includes: a basic message header (Internet Protocol version 6 (IPv6) header) and multiple extended message headers arranged in sequence. The multiple extended message headers include: a hop-by-hop (HBH) extended message header, DOH1, SRH, AH, ESP header, and DOH2.

[0058] The basic message header (IPv6 header) includes basic information required for message transmission, such as the source address and destination address of the first message.

[0059] The information included in the extended message header is used to implement some extended functions related to the transmission of the first message on the basis of the basic message header. For example, the SRH in the multiple extended message headers includes segment routing information. The segment routing information can be a segment identifier list, and the segment identifier list includes segment identifiers (SIDs) of multiple nodes. The segment identifier list is used to indicate that the first message is transmitted along the path where the multiple nodes are located. Optionally, the above-mentioned multiple extended message headers may also not include SRH, that is, the first message will not be transmitted along the path where the multiple nodes are located, so that the multiple extended message headers do not include DOH1.

[0060] For example, the information included in the AH in multiple extended message headers is mainly used to provide data source verification, data integrity verification, and message replay protection. For example, this information is used to authenticate the entire first message, and the node receiving the first message can verify the integrity of the first message based on this information.

[0061] As another example, the information included in the ESP header among the multiple extended message headers is primarily used to provide encryption, data origin verification, data integrity verification, and message replay protection. For example, this information is used to encrypt the first part of a first message and authenticate the second part of the first message. A node receiving the first message can decrypt the first part based on this information and verify the integrity of the second part. The first part may include DOH2 and a payload, while the second part may include the ESP header, DOH2, and a payload.

[0062] As another example, DOH2 may include app aware networking (APN) information and / or generalized IPv6 tunnel (GIP6) information, etc. APN information may also be referred to as application information, and APN information may include application identification information (APN ID) and application requirement parameter information (APN Parameters). The APN ID is used to distinguish different application flows and different users of a certain application / class of applications, etc. The APN ID may be an application group identifier (APP Group ID), a user group identifier (User Group ID), etc. The application requirement parameter information may include information on network performance requirement parameters that the application is concerned about, such as bandwidth, latency, jitter, packet loss rate, etc. DOH2 may include multiple TLV fields, and DOH2 may use these TLV fields to include information. In the case where DOH2 includes APN information and / or GIP6 information, DOH2 includes a TLV field including APN information, and / or a TLV field including GIP6 information.

[0063] The structure of the first message may also be different from that shown in FIG4 . For example, the first message may include other parts (such as a Transmission Control Protocol (TCP) message header) between the DOH2 and the payload. The first message may also include an ESP trailer.

[0064] Among the multiple extended headers described above, the AH header authenticates the first message, while the ESP header encrypts the first part of the first message and authenticates the second part. Thus, the AH and ESP headers contribute to message security and both perform security verification. Because messages themselves lack integrated security features, malicious users can easily forge message addresses, modify message content, replay previous packets, and intercept and view packet content during transmission. Therefore, the security services provided by the AH and ESP headers can enhance message transmission security.

[0065] The message header of the first message includes a variety of information. In the process of the first message being transmitted along a certain transmission path, some of this information needs to be used by the intermediate node, and some of this information needs to be used by the tail node but does not need to be used by the intermediate node. For example, the segment identifier list in the above-mentioned SRH needs to be used by the intermediate node, the APN information and GIP6 information in DOH2 need to be used by the intermediate node, and the above-mentioned load needs to be used by the tail node but does not need to be used by the intermediate node. Among them, when the intermediate node uses the information, it can report the information to the controller (not shown in the accompanying drawings), or change the information, or forward the first message based on the information. When using the information, the tail node can also report the information to the controller, or perform relevant statistics based on the information, or decide whether to discard the first message based on the information. The embodiment of the present application does not limit the operations performed by the intermediate node using the information and the operations performed by the tail node using the information.

[0066] Conventional ESP headers not only encrypt the payload but also certain information within the message header that is needed by intermediate nodes. However, intermediate nodes lack decryption capabilities, making this encrypted information unusable. For example, the first encrypted portion of the ESP header includes the aforementioned DOH2. During transmission of the first message, the APN ID included in DOH2 needs to be used by the intermediate node (such as the second node in Figure 3). However, the intermediate node lacks the ability to decrypt the first portion based on the ESP header. Consequently, the information included in DOH2 cannot be used by the intermediate node, preventing the extended functionality provided by this information. Furthermore, the potentially modified information in DOH2 conflicts with the encryption and authentication functions of the ESP header. If the ESP header is placed between DOH2 and the payload, so that neither the first nor the second portion includes DOH2, the information included in DOH2 cannot be encrypted or authenticated, resulting in a lower security risk.

[0067] Therefore, current security verification has the following two problems: 1. If the security verification includes encryption, and the encrypted object includes information that the intermediate node needs to use, the intermediate node will not be able to perceive this information. 2. If the security verification includes authentication, and the authentication object includes information that the intermediate node needs to change, the authentication object will not be authenticated at the end node.

[0068] An embodiment of the present application provides a message transmission method, in which the first message in the method includes first information, second information and security information, and the second information targeted by the security verification of the security information is information used only by the tail node. In this way, the information that the intermediate node needs to use is the first information, and the information that the intermediate node does not need to use and the tail node needs to use is the second information. The security information does not need to perform security verification on the information that the intermediate node needs to use. If the security verification includes encryption, then on the premise of ensuring the security of the first message, the intermediate node can use the unencrypted first information to realize the extended function brought by the first information. Since the security information is not used to perform security verification on the first information, even if the first information changes during the transmission process, it does not conflict with the object (second information) targeted by the security verification of the security information. When the security verification includes authentication, the authenticated object (second information) can be authenticated at the tail node.

[0069] For example, FIG5 is a flowchart of a message transmission method provided in an embodiment of the present application. As shown in FIG5 , the method includes:

[0070] S101. The head node obtains a first message; the first message includes first information, security information, and second information. The first information is information used by the intermediate node, the security information is used to perform security verification on the second information, and the second information is information only used by the tail node.

[0071] The first message includes first information, security information and second information. These three pieces of information will be described below.

[0072] (1) The first information is information used by the intermediate node. For example, the first information includes at least one of APN information and GIP6 information. Taking the APN ID in the APN information as an example, when the intermediate node uses the APN ID, it can report the APN ID to the controller, or modify the APN ID, or determine a forwarding method for the first message based on the APN ID.

[0073] On this basis, the first information may also be information used by the egress node. When using the first information, the egress node may also report the first information to the controller, or collect statistics on the first information, or determine whether to discard the first message based on the first information, or perform corresponding processing on the first message based on the first information.

[0074] (2) The security information is used to perform security verification on the second information. The security information can be an ESP header or other information with security verification function. The security verification can be encryption, authentication, or both encryption and authentication.

[0075] (3) The second information is information used only by the egress node. For example, the second information may include a payload, which is used only by the egress node, and intermediate nodes do not need to pay attention to the payload. For another example, in addition to the payload, the second information may also include a parameter set, which is carried in the message header of the first message. When the first message also includes an ESP tail, the second information may also include the ESP tail. For another example, the second information may not include a payload, but may include the parameter set. For example, these parameter sets may include: a line identification option, a home address, etc.

[0076] In addition, in addition to the first information, security information and second information, the first message may also include other information (such as the aforementioned SRH, DOH1, etc.). The other information can be used by at least one of the intermediate nodes and the tail node, and this embodiment of the present application does not limit this.

[0077] Furthermore, the first message includes a message header and a payload. When the head node obtains the first message, it may first obtain the payload (including the data to be transmitted), and then obtain the first message including the message header and the payload based on the payload.

[0078] S102: The head node sends a first message to the intermediate node.

[0079] After encapsulating the first message, the head node may send the first message to the intermediate node based on the message header of the first message. Optionally, when the message header of the first message includes an SRH, the head node may send the first message based on the segment identifier list in the SRH, so that the first message is transmitted to the intermediate node along the path indicated by the segment identifier list.

[0080] S103: The intermediate node uses the first information in the first message.

[0081] After receiving the first message, the intermediate node may read the first information in the first message and use the first information. For example, in S103, the intermediate node may report the first information to the controller, or the intermediate node may modify the first information, or the intermediate node may determine a forwarding method for the first message based on the first information.

[0082] S104: The intermediate node forwards the first message to the egress node.

[0083] After using the first information, the intermediate node may continue to transmit the first message to the egress node. For example, if the intermediate node uses the first information to determine the forwarding method of the first message in S103, the intermediate node may use the forwarding method to forward the first message in S104 so that the first message can be transmitted to the egress node.

[0084] Optionally, when the message header of the first message includes an SRH, the intermediate node may also forward the first message according to the segment identifier list in the SRH, so that the first message is transmitted to the tail node along the path indicated by the segment identifier list.

[0085] In the case where an intermediate node is included between the head node and the tail node, one or more intermediate nodes may be included between the head node and the tail node. When there is only one intermediate node, the first message is transmitted from the intermediate node to the tail node; when there are multiple intermediate nodes, the first message passes through multiple intermediate nodes in sequence and is finally transmitted to the tail node.

[0086] S105. The egress node performs a security check on the second information based on the security information.

[0087] After receiving the first message, the egress node may identify the security information and the second information in the first message, and perform a security check on the second information based on the security information, such as decrypting or authenticating the second information, or both.

[0088] S106. The tail node uses the second information after security verification.

[0089] After performing a security check on the second information, the egress node may use the verified second information. For example, if the second information includes a payload, the egress node may extract the data in the payload. If the second information does not include a payload, the egress node may also parse the payload to obtain the data included in the payload. If the second information includes a parameter set, the egress node may report the parameter set to the controller, perform relevant statistics based on the parameter set, or determine whether to discard the first message based on the parameter set.

[0090] The tail node may also use the first information after security verification. For example, the tail node may report the first information to the controller, or collect statistics on the first information, or decide whether to discard the first message based on the first information, or perform corresponding processing on the data extracted from the payload based on the first information.

[0091] In an embodiment of the present application, the second information for which the security information is security-verified is information that is only used by the tail node. In this way, the information that the intermediate node needs to use is the first information, and the information that the intermediate node does not need to use and that the tail node needs to use is the second information. The security information does not need to perform security verification on the information that the intermediate node needs to use. If the security verification includes encryption, then on the premise of ensuring the security of the first message, the intermediate node can use the unencrypted first information to realize the extended function brought by the first information. Since the security information is not used to perform security verification on the first information, even if the first information changes during the transmission process, it does not conflict with the object (second information) targeted by the security verification of the security information. When the security verification includes authentication, the authenticated object (second information) can be authenticated at the tail node.

[0092] Furthermore, the embodiments of the present application do not limit the positions of the first information, security information, and second information in the first message. These positions will be described with some examples below.

[0093] For example, the first information and the security information can both be included in the same message header of the first message. For example, taking the SRv6 message shown in Figure 4 as an example, as shown in Figure 6, the message header of the first message includes a first DOH (such as DOH1 in Figure 6), an SRH, and a second DOH (such as DOH2 in Figure 6), wherein the next header field of the first DOH is used to indicate the SRH. In this case, the second DOH includes the above-mentioned first information and security information. The message shown in Figure 6 does not include the AH and ESP headers in the message shown in Figure 4.

[0094] When the first information and security information are included in the second DOH, as shown in FIG6 , the second DOH may include multiple TLV fields, including a first TLV field and a second TLV field (not shown in FIG6 ). The first TLV field may include at least one TLV field, and the second TLV field may also include at least one TLV field. The first TLV field includes the first information, and the second TLV field includes the security information.

[0095] For example, the first information may include a portion of the information in a first TLV field, and another portion of the information and the security information in a second TLV field; or, the first information and a portion of the security information may be included in the first TLV field, and another portion of the security information may be included in the second TLV field. As shown in FIG6 , in addition to including multiple TLV fields, DOH2 may also include a next header field and a header extended length (Hdr Ext Len) field, and the next header field, the header extended length field, and the multiple TLV fields are arranged in sequence.

[0096] In the embodiment of the present application, the first message is an SRv6 message, and the first information and security information are included in DOH2 as an example. The first message may not be an SRv6 message (for example, the first message is an Internet Protocol (IP) message that is different from the SRv6 message). At least one of the first information and the security information may also be included in the message header of the first message in another message header (such as a basic message header, SRH) that is different from the second DOH, or at least one of the first information and the security information may also not be included in the message header of the first message. For example, when the message header of the first message does not include the above-mentioned first DOH and SRH, the message header only includes one DOH, in which case the DOH includes the first information and security information. For another example, the message header of the first message includes: a first message header and a second message header, the first message header includes the first information, and the second message header includes the security information, and the first message header and the second message header are different message headers of the first message. It can be seen that the first information and the security information are included in different message headers of the first message. Optionally, one of the first packet header and the second packet header may be the second DOH, or neither the first packet header nor the second packet header may be the second DOH.

[0097] Furthermore, when the second information includes the parameter set in addition to the parameter set, the message header of the first message includes: the first information, the security information, and the parameter set. The parameter set may be included in the same or different message header as the first information and the security information.

[0098] For example, the first information, security information, and parameter set may be included in the second DOH. For example, the multiple TLV fields in the second DOH include a first TLV field, a second TLV field, and a third TLV field, the first TLV field includes the first information, the second TLV field includes the second information, and the third TLV field includes the parameter set.

[0099] For another example, the message header of the first message includes a first message header and a second message header, the first information is included in the first message header, the second information is included in the second message header, and the parameter set is included in the first message header or the second message header.

[0100] For another example, the message header of the first message includes a first message header, a second message header, and a third message header. The first information is included in the first message header, the second information is included in the second message header, and the parameter set is included in the third message header.

[0101] The foregoing description uses the example of a head node obtaining a payload based on the data to be transmitted and then obtaining a first message based on the payload. Alternatively, the payload may include another message. In this case, the head node does not obtain a payload based on the data to be transmitted. Instead, upon receiving the other message, the head node may use the other message as the payload of the first message and then obtain the first message based on the other message.

[0102] If the payload of a first message includes another received message, and the second information of the first message includes the payload, the security information can be used to verify the security of the other message, thereby enhancing the security of the other message. If the payload of the first message does not include another received message but instead includes data to be transmitted, the payload is shorter, requiring less bandwidth for transmission of the first message, and thus reducing the load on the network used to transmit the first message.

[0103] Furthermore, based on the foregoing, any first message provided in the embodiments of the present application may also include an AH, which may be included in the same message header as the security information in multiple message headers of the first message. For example, the AH and security information may be included in a second DOH.

[0104] For example, the multiple TLV fields of the second DOH include a TLV field corresponding to the AH, and the TLV field includes the AH. The second DOH may use different TLV fields to carry the AH, the first information, and the security information, or the second DOH may use different TLV fields to carry the AH, the first information, the security information, and the parameter set. Alternatively, the second DOH may include the AH and the first information, the security information, or the parameter set in the same TLV field.

[0105] An embodiment of the present application provides a first message that does not include an AH or ESP header. Furthermore, in the first message, at least one of the AH and security information can be included in the same message header among multiple message headers of the first message, along with other information (e.g., at least one of the first information and the parameter set). For example, the AH, security information, first information, and parameter set are all included in a second DOH, and the second DOH can use different TLV fields to include the AH, security information, first information, and parameter set.

[0106] In conjunction with Figures 1 to 6, the message transmission method provided by the embodiment of the present application is described in detail. In order to implement the functions described in the above methods, the communication node needs to include hardware and / or software modules that perform the corresponding functions. In conjunction with the execution process of each method described in the embodiments disclosed herein, the embodiments of the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application in combination with the embodiments, but such implementation should not be considered to exceed the scope of the embodiments of the present application.

[0107] In this embodiment, the corresponding device can be divided into functional modules based on the above-mentioned method embodiment. For example, each functional module can be divided according to each function, or two or more functions can be integrated into a single processing module. The above-mentioned integrated modules can be implemented in the form of hardware. The module division in this embodiment is illustrative and is specifically used as a possible division method of logical functions. In actual implementation, other division methods may be used.

[0108] When the functional module division method is adopted, the message transmission device provided in the embodiment of the present application will be described below in combination with Figures 7, 8 and 9.

[0109] For example, Figure 7 is a structural diagram of a message transmission device provided in an embodiment of the present application. The message transmission device can be provided in the head node in the aforementioned content. As shown in Figure 7, the message transmission device includes: an acquisition module 301 and a sending module 302. The acquisition module 301 is used to acquire a first message; the sending module 302 is used to send the first message. The first message includes: first information, security information, and second information. The first information is information for use by intermediate nodes, the security information is used to perform security verification on the second information, and the second information is information only for use by the tail node. The operations performed by the acquisition module 301 can refer to S101 in the aforementioned embodiment, and the operations performed by the sending module 201 can refer to S102 in the aforementioned embodiment. The embodiments of the present application will not be described in detail here.

[0110] The first information may include at least one of APN information and GIP6 information. The first information may also include neither APN information nor GIP6 information, and this is not limited in the embodiments of the present application. The security information may be an ESP header or other information with security verification functions. The second information may include a payload, which is used only by the egress node and does not need to be concerned with the payload by the intermediate nodes. For another example, in addition to the payload, the second information may also include a parameter set, which is included in the header of the first message. For another example, the second information may also include the parameter set instead of the payload.

[0111] The first message in the embodiment of the present application includes the first information, the second information and the security information. The second information for which the security information is security-verified is information that is only used by the tail node. In this way, the information that the intermediate node needs to use is the first information, and the information that the intermediate node does not need to use and that the tail node needs to use is the second information. The security information does not need to perform security verification on the information that the intermediate node needs to use. If the security verification includes encryption, then on the premise of ensuring the security of the first message, the intermediate node can use the unencrypted first information to realize the extended function brought by the first information. Since the security information is not used to perform security verification on the first information, even if the first information changes during transmission, it does not conflict with the object (second information) targeted by the security verification of the security information. When the security verification includes authentication, the authenticated object (second information) can be authenticated at the tail node.

[0112] Furthermore, the embodiments of the present application do not limit the positions of the first information, security information, and second information in the first message. These positions will be described with some examples below.

[0113] Optionally, the first information and the security information may both be included in a message header of the first message. For example, the message header includes a first DOH, an SRH, and a second DOH, wherein the next header field of the first DOH is used to indicate the SRH. In this case, the second DOH includes the first information and the security information.

[0114] When the first information and the security information are included in the second DOH, the second DOH may include multiple TLV fields, including a first TLV field and a second TLV field. The first TLV field may include at least one TLV field, and the second TLV field may also include at least one TLV field. The first TLV field includes the first information, and the second TLV field includes the security information.

[0115] Furthermore, the second information may be a payload, or the second information may include a parameter set in a message header in addition to the payload. Thus, the message header of the first message includes: first information and security information, or first information, security information, and a parameter set. The parameter set may be included in the same or different message header as the first information and security information.

[0116] For example, the first information, security information, and parameter set may be included in the second DOH. For example, the multiple TLV fields in the second DOH include a first TLV field, a second TLV field, and a third TLV field, the first TLV field includes the first information, the second TLV field includes the second information, and the third TLV field includes the parameter set.

[0117] For another example, the message header of the first message includes a first message header and a second message header, the first information is included in the first message header, the second information is included in the second message header, and the parameter set is included in the first message header or the second message header.

[0118] For another example, the message header of the first message includes a first message header, a second message header, and a third message header. The first information is included in the first message header, the second information is included in the second message header, and the parameter set is included in the third message header.

[0119] Optionally, the first message includes a message header and a payload. When the head node obtains the first message, it may first obtain the payload (including the data to be transmitted), and then obtain the first message including the message header and the payload based on the payload. Optionally, the payload may also include another message. In this case, the head node does not obtain the payload based on the data to be transmitted, but after receiving the other message, it may use the other message as the payload of the first message, and then obtain the first message based on the payload. In the case where the payload of the first message includes the received other message, if the second information of the first message includes the payload, then under the effect of the above-mentioned security information, security verification of the other message can be achieved, so that the security of the other message is higher. In the case where the payload of the first message does not include the received other message, but includes the data to be transmitted, the length of the payload is shorter. At this time, the transmission bandwidth required for the transmission of the first message is smaller, and the load on the network used to transmit the first message is smaller.

[0120] Furthermore, based on the foregoing, any first message provided in the embodiments of the present application may further include an AH, and the AH may be included in the same message header as the first information and security information. For example, the AH, the first information, and the security information may be included in the second DOH. For example, the multiple TLV fields of the second DOH include a TLV field corresponding to the AH, and the TLV field includes the AH. The second DOH may use different TLV fields to carry the AH, the first information, and the security information, or the second DOH may use different TLV fields to carry the AH, the first information, the security information, and the parameter set. Alternatively, the second DOH may include the AH in the same TLV field as the first information, the security information, or the parameter set.

[0121] Optionally, the first message is an SRv6 message or other messages, which is not limited in this embodiment of the present application.

[0122] FIG8 is a schematic structural diagram of another message transmission device provided in an embodiment of the present application. The message transmission device is provided in an intermediate node. As shown in FIG8 , the message transmission device includes: a receiving module 401, a processing module 402, and a forwarding module 403. The receiving module 401 is used to receive a first message; wherein the first message includes: first information, security information, and second information, the first information being information for use by the intermediate node, the security information being used to perform security verification on the second information, and the second information being information only for use by the tail node; the processing module 402 is used to use the first information in the first message; and the forwarding module 403 is used to forward the first message. The operations performed by the receiving module 401 can refer to the operations related to the intermediate node in S102 in the aforementioned embodiment, the operations performed by the processing module 402 can refer to S103 in the aforementioned embodiment, and the operations performed by the forwarding module 403 can refer to S104 in the aforementioned embodiment. The embodiments of the present application will not be described in detail here.

[0123] Figure 9 is a schematic diagram of the structure of another message transmission device provided in an embodiment of the present application. The message transmission device is provided at an egress node. As shown in Figure 9, the message transmission device includes a receiving module 501, a security verification module 502, and a processing module 503. The receiving module 501 is configured to receive a first message; the first message includes first information, security information, and second information. The first information is information for use by intermediate nodes, the security information is used to perform security verification on the second information, and the second information is information for use only by the egress node. The security verification module 502 is configured to perform security verification on the second information based on the security information, and the processing module 503 is configured to use the second information after security verification. The operations performed by the receiving module 501 can refer to the operations related to the egress node in S104 of the aforementioned embodiment, the operations performed by the security verification module 502 can refer to S105 of the aforementioned embodiment, and the operations performed by the processing module 503 can refer to S106 of the aforementioned embodiment. This embodiment of the present application will not be described in detail here.

[0124] When an integrated unit is used, the message transmission device provided in the head node, intermediate node, or tail node provided in the embodiments of the present application may include a processing module, a storage module, and a communication module. The processing module may be used to control and manage the actions of the device. For example, it may be used to support the device in executing the actions performed by the head node, intermediate node, or tail node in S101 to S106 above. The storage module may be used to support the device in executing and storing program code and data. The communication module may be used for the device to communicate with other devices.

[0125] The processing module may be a processor or a controller. It may implement or execute the various exemplary logic blocks, modules, and circuits described in conjunction with the disclosure of the embodiments of this application. The processor may also be a combination that implements computing functions, such as a combination of one or more microprocessors, a combination of digital signal processing (DSP) and a microprocessor, and the like. The storage module may be a memory. The communication module may be a device that interacts with other devices, such as a radio frequency circuit, a Bluetooth chip, or a Wi-Fi chip.

[0126] In one embodiment, when the processing module is a processor, the storage module is a memory, and the communication module is a communication interface, the message transmission device involved in this embodiment can be as shown in Figure 1. In one implementation, the above-mentioned modules included in the message transmission device can be computer programs stored in the memory and called by the processor to implement the corresponding execution functions of each module.

[0127] The present application also provides a communication system including a head node, an intermediate node, and an egress node. The head node is configured to execute the operations performed by the head node in any of the message transmission methods provided in the present application, the intermediate node is configured to execute the operations performed by the intermediate node in any of the message transmission methods provided in the present application, and the egress node is configured to execute the operations performed by the egress node in any of the message transmission methods provided in the present application.

[0128] The head node may include any one of the message transmission devices provided in the embodiments of the present application and arranged at the head node (the device as shown in Figure 7); the intermediate node may include any one of the message transmission devices provided in the embodiments of the present application and arranged at the intermediate node (the device as shown in Figure 8); the tail node may include any one of the message transmission devices provided in the embodiments of the present application and arranged at the tail node (the device as shown in Figure 9).

[0129] An embodiment of the present application provides a computer storage medium, in which a computer program is stored. When the computer program runs on a computer, the computer executes a method performed by a head node, an intermediate node, or a tail node in any one of the message transmission methods provided in the embodiments of the present application.

[0130] An embodiment of the present application also provides a computer program product containing instructions. When the computer program product is run on a communication device, the communication device executes any method performed by a head node, an intermediate node or a tail node in any of the message transmission methods provided in the embodiments of the present application.

[0131] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When software is used for implementation, it can be implemented in whole or in part in the form of a computer program product, which includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer can be a general-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line) or wireless (e.g., infrared, wireless, microwave, etc.) mode. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrations. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium, or a semiconductor medium (e.g., a solid-state hard disk).

[0132] In this application, the terms "first" and "second" are used for descriptive purposes only and should not be understood to indicate or imply relative importance. The term "at least one" refers to one or more, and "plurality" refers to two or more, unless otherwise expressly limited. The term "and / or" simply describes an association relationship between associated objects, indicating that three possible relationships can exist. For example, A and / or B can mean: A exists alone, A and B exist simultaneously, or B exists alone.

[0133] The different types of embodiments, such as the method embodiments and device embodiments provided in the embodiments of this application, can refer to each other, and the embodiments of this application are not limited thereto. The order of the operations of the method embodiments provided in the embodiments of this application can be appropriately adjusted, and the operations can be increased or decreased accordingly according to the circumstances. Any person skilled in the art who can easily think of a method of variation within the technical scope disclosed in this application should be included in the scope of protection of this application, and therefore will not be described in detail.

[0134] In the corresponding embodiments provided in this application, it should be understood that the disclosed systems and devices can be implemented through other configurations. For example, the device embodiments described above are merely illustrative. For example, the division of modules is merely a logical function division. In actual implementation, there may be other division methods, such as multiple modules can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, and the indirect coupling or communication connection of devices or modules can be electrical or other forms.

[0135] Units described as separate components may or may not be physically separate, and components described as units may or may not be physical units, and may be located in one place or distributed across multiple devices. Some or all of these units may be selected to achieve the purpose of this embodiment based on actual needs.

[0136] The above are merely optional embodiments of the present application, but the scope of protection of the present application is not limited thereto. Any person skilled in the art can easily conceive of various equivalent modifications or substitutions within the technical scope disclosed in this application, and such modifications or substitutions should be included in the scope of protection of this application. Therefore, the scope of protection of this application should be based on the scope of protection of the claims.

Claims

1. A message transmission method, characterized in that: The method comprises: The head node obtains a first message, where the first message includes: first information, security information, and second information, where the first information is information used by the intermediate node, the security information is used to perform security verification on the second information, and the second information is information used only by the tail node; The head node sends the first message.

2. The method according to claim 1, characterized in that: The message header of the first message includes the first information and the security information.

3. The method according to claim 1 or 2, characterized in that: The message header of the first message includes a first destination options header, a segment routing header, and a second destination options header. The next header field of the first destination options header is used to indicate the segment routing header. The second destination options header includes: the first information and the security information.

4. The method according to claim 3, characterized in that The second destination option header includes: a first type-length-value TLV field and a second TLV field, the first TLV field includes the first information, and the second TLV field includes the security information.

5. The method according to claim 1 or 2, characterized in that: The message header of the first message includes a first message header and a second message header, the first message header includes the first information, and the second message header includes the security information.

6. The method according to any one of claims 1 to 5, characterized in that: The second information includes a payload.

7. The method according to claim 2, characterized in that The second information includes a payload and a parameter set, and the parameter set included in the second information is included in a message header of the first message.

8. The method according to claim 3 or 4, characterized in that: The second information includes a payload and a parameter set, and the parameter set included in the second information is included in the second destination option header.

9. The method according to claim 5, characterized in that The second information includes a payload and a parameter set, and the message header of the first message further includes a third message header, and the third message header includes the parameter set included in the second information.

10. The method according to any one of claims 1 to 9, characterized in that: The first information includes: at least one of the following: application-aware network APN information and generalized Internet Protocol version 6 tunnel GIP6 information.

11. The method according to any one of claims 6 to 9, characterized in that: The head node obtains the first message, including: The head node obtains the load; The head node obtains the first message based on the payload.

12. A message transmission device, characterized in that: The message transmission device is arranged at the head node, and the message transmission device comprises: an acquisition module, configured to acquire a first message, wherein the first message includes: first information, security information, and second information, wherein the first information is information used by an intermediate node, the security information is used to perform security verification on the second information, and the second information is information used only by an end node; A sending module is used to send the first message.

13. The message transmission device according to claim 12, characterized in that: The message header of the first message includes the first information and the security information.

14. The message transmission device according to claim 12 or 13, characterized in that: The message header of the first message includes a first destination options header, a segment routing header, and a second destination options header. The next header field of the first destination options header is used to indicate the segment routing header. The second destination options header includes: the first information and the security information.

15. The message transmission device according to claim 14, characterized in that: The second destination option header includes: a first type-length-value TLV field and a second TLV field, the first TLV field includes the first information, and the second TLV field includes the security information.

16. The message transmission device according to claim 12 or 13, characterized in that: The message header of the first message includes a first message header and a second message header, the first message header includes the first information, and the second message header includes the security information.

17. The message transmission device according to any one of claims 12 to 16, characterized in that: The second information includes a payload.

18. The message transmission device according to claim 13, characterized in that: The second information includes a payload and a parameter set, and the parameter set included in the second information is included in a message header of the first message.

19. The message transmission device according to claim 14 or 15, characterized in that: The second information includes a payload and a parameter set, and the parameter set included in the second information is included in the second destination option header.

20. The message transmission method according to claim 16, characterized in that: The second information includes a payload and a parameter set, and the message header of the first message further includes a third message header, and the third message header includes the parameter set included in the second information.

21. The message transmission device according to any one of claims 12 to 20, characterized in that: The first information includes: at least one of the following: application-aware network APN information and generalized Internet Protocol version 6 tunnel GIP6 information.

22. The message transmission device according to any one of claims 17 to 20, characterized in that: The acquisition module is used for: obtaining the load; The first message is obtained based on the payload.

Images