Packet forwarding method and apparatus, device, storage medium, and program product

Abstract

Embodiments of the present application disclose a packet forwarding method and apparatus, a device, a storage medium, and a program product. The method comprises: receiving a service packet sent by an SRv6 node one hop previous to a first SRv6 node, wherein a first packet header of the service packet comprises segment identifier (SID) information that is encrypted by using a key of the first SRv6 node; using the key of the first SRv6 node to decrypt the first packet header so as to obtain decrypted SID information, wherein the decrypted SID information at least comprises a local operation instruction of the first SRv6 node; and executing the local operation instruction, and when the decrypted SID information comprises the identifier of an SRv6 node one hop after the first SRv6 node, sending the service packet to the SRv6 node one hop after the first SRv6 node on the basis of the identifier of the SRv6 node one hop after the first SRv6 node.

Description

Message forwarding methods, apparatus, devices, storage media and program products

[0001] Cross-references to related applications

[0002] This application claims priority based on Chinese Patent Application No. 202410977323.X, filed on July 19, 2024, the entire contents of which are incorporated herein by reference. Technical Field

[0003] This application belongs to the field of network communication technology, and specifically relates to a message forwarding method, apparatus, device, storage medium, and program product. Background Technology

[0004] Segment Routing IPv6 (SRv6), based on the Internet Protocol Version 6 (IPv6) forwarding plane, is an important future technology direction for IPv6. It supports network programmability, and relevant standards have been developed by the Internet Engineering Task Force (IETF). The overall idea of ​​SRv6 is to carry a list of Segment IDs (SIDs) in the IPv6 extension header and other packet headers, using the SIDs to execute specific functions on nodes. In the Internet, it is generally recommended to encrypt the packet payload, but the packet header is not encrypted. With SRv6, if specific traffic is subject to a special policy (SR-Policy), since the SR-Policy is usually encapsulated in the SID information of the packet header, this poses a risk of policy information leakage. Summary of the Invention

[0005] This application provides a message forwarding method, apparatus, device, storage medium, and program product.

[0006] This application provides a message forwarding method applied to a first SRv6 node, the method comprising:

[0007] Receive a service message sent by the previous SRv6 node of the first SRv6 node; the first header of the service message includes segment identifier (SID) information encrypted using the key of the first SRv6 node;

[0008] The first message header is decrypted using the key of the first SRv6 node to obtain the decrypted SID information, which includes at least the local operation instructions of the first SRv6 node.

[0009] Execute the local operation instruction, and if the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, send the service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

[0010] This application embodiment also provides another message forwarding method, applied in a head node, the method comprising: obtaining a service message to be sent, wherein the first message header of the service message includes SID information encrypted by the head node using the key of the target node, the target node includes at least one SRv6 node receiving the service message, and the SID information encrypted using the key of the target node includes at least the local operation instructions of the target node;

[0011] Based on the identifier of the next-hop SRv6 node of the header node carried in the first message header, the service message is sent to the target node. The target node receives the service message, decrypts the first message header using the target node's key to obtain the decrypted SID information, and executes the local operation instruction.

[0012] This application embodiment also provides a message forwarding device applied in a first SRv6 node, the device comprising:

[0013] The receiving module is configured to receive a service message sent by the previous hop SRv6 node of the first SRv6 node; the first header of the service message includes SID information encrypted using the key of the first SRv6 node.

[0014] The first processing module is used to decrypt the first packet header using the key of the first SRv6 node to obtain the decrypted SID information, wherein the decrypted SID information includes at least the local operation instructions of the first SRv6 node.

[0015] The second processing module is used to execute the local operation instruction, and when the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, to send the service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

[0016] This application embodiment also provides another message forwarding device, applied in a header node, the device comprising:

[0017] The acquisition module is used to acquire a service message to be sent. The first header of the service message includes SID information encrypted by the header node using the key of the target node. The target node includes at least one SRv6 node that receives the service message. The SID information encrypted by the key of the target node includes at least the local operation instructions of the target node.

[0018] The third processing module is used to send the service message to the target node according to the identifier of the next-hop SRv6 node of the header node carried in the first message header. The target node is used to receive the service message, decrypt the first message header using the key of the target node to obtain the decrypted SID information, and execute the local operation instruction.

[0019] This application also provides an electronic device, which includes a processor and a memory for storing a computer program that can run on the processor; wherein the processor is used to run the computer program to execute any of the above-described packet forwarding methods applied to a first SRv6 node.

[0020] This application also provides another electronic device, which includes a processor and a memory for storing a computer program that can run on the processor; wherein the processor is used to run the computer program to execute any of the above-described packet forwarding methods applied to the head node.

[0021] This application also provides a computer storage medium storing a computer program that, when executed by a processor, implements any of the above-described message forwarding methods.

[0022] This application also provides a computer program product, including a computer program that, when executed by a processor, implements any of the above-described message forwarding methods. Attached Figure Description

[0023] Figure 1 is a schematic diagram of the IPv6 packet format in related technologies;

[0024] Figure 2 is a schematic diagram of SID information in related technologies;

[0025] Figure 3 is a schematic diagram of the SRH processing procedure in related technologies;

[0026] Figure 4 is a flowchart of packet forwarding via SRv6 nodes in related technologies;

[0027] Figure 5 is a flowchart of a packet forwarding method applied to a first SRv6 node according to an embodiment of this application;

[0028] Figure 6 is a flowchart of the first method of forwarding messages through an SRv6 node in the embodiments of this application;

[0029] Figure 7 is a flowchart of the second method of forwarding messages through an SRv6 node in this embodiment of the application;

[0030] Figure 8 is a flowchart of the third method of forwarding messages through an SRv6 node in this application embodiment;

[0031] Figure 9 is a flowchart of the fourth method of forwarding messages through an SRv6 node in this application embodiment;

[0032] Figure 10 is a flowchart of the fifth method of forwarding messages through an SRv6 node in this application embodiment;

[0033] Figure 11 is a flowchart of the sixth method of forwarding messages through an SRv6 node in the embodiments of this application;

[0034] Figure 12 is a flowchart of a message forwarding method applied to a head node according to an embodiment of this application;

[0035] Figure 13 is a schematic diagram of the structure of the message forwarding device applied to the first SRv6 node according to an embodiment of this application;

[0036] Figure 14 is a schematic diagram of the structure of a message forwarding device applied to a head node according to an embodiment of this application;

[0037] Figure 15 is a schematic diagram of the structure of an electronic device according to an embodiment of this application. Detailed Implementation

[0038] Figure 1 illustrates the format of an IPv6 packet in related technologies. Referring to Figure 1, an IPv6 packet may include an IPv6 header, a Segment Routing Header (SRH), and an IPv6 payload. The IPv6 header may carry SID information. Referring to Figure 2, the 128-bit SRv6 SID information may include a Locator field and a Function field (hereinafter referred to as a function or operation instruction). The Locator field is used to route to a node, and the Function field points to any possible function. For example, the Function field may carry an arg field containing parameters. The overall concept of SRv6 is to forward packets sequentially to specific nodes according to the SID list, and execute a function on the node using the SID. In the SID list, the SIDs are arranged in descending order.

[0039] Referring to Figure 1, an SRH may include a Next Header, Header Extension Length, Routing Type, Segments Left (SL) pointer, Last Entry index, Flags field, Tag field, and Segment List (containing n+1 entries, denoted as Segment List 0 to Segment List n). Each entry carries a Segment ID (SID), which is similar in format to a 128-bit IPv6 address. As mentioned earlier, it generally includes two parts: position and function, and optionally, a parameter part. The IPv6 payload represents the effective payload of the IPv6 packet. The position parts of Segment List 0 to Segment List n represent different nodes. Referring to Figure 3, the SRH processing procedure is as follows: after the source SRv6 node sends the IPv6 packet, it passes through the nodes corresponding to Segment List n to Segment List 1 sequentially, and finally is sent to the node corresponding to Segment List 0.

[0040] In related technologies, it is generally recommended to encrypt the message payload, but not the message header. After using SRv6, if a specific traffic is subject to a special policy (SR-Policy), since the SR-Policy is usually encapsulated in the message header, this will facilitate attacks on the network. This is because the relevant policies in the message header can be analyzed to infer that a user has accessed a certain service, thus bringing the risk of policy information leakage.

[0041] The following diagram, Figure 4, illustrates the process of forwarding packets via SRv6 nodes in related technologies. Referring to Figure 4, the IPv6 packet header (Hdr) may include version, traffic class, flow label, payload length, next header, hop limit, source address, and destination address.

[0042] Referring to Figure 4, the process of forwarding packets via an SRv6 node in related technologies includes:

[0043] Operation S1: Node 1 sends a message to Node 2. The message encapsulation strategy is (AN::FN, A4::F4, A2::F2)SL=2. The meaning of the message encapsulation strategy is that the message first reaches Node 2 and executes the function corresponding to F2, then reaches Node 4 and executes the function corresponding to F4, and finally reaches Node N and executes the function corresponding to FN. F2, F4 and FN represent the function executed at Node 2, Node 4 and Node N, respectively.

[0044] Operation S2: Node 2 receives the message, matches the SID table of Node 2's segment route (SR), executes the function corresponding to F2, decrements the value of SL by 1, updates the destination address (DA), and sends the message to Node 4.

[0045] Operation S3: Node 4 receives the message, matches the SID table of Node 4's SR, executes the function corresponding to F4, decrements the value of SL by 1, updates DA, and sends the message to Node N.

[0046] Operation S4: Node N receives the message, matches the SID table of Node N's SR, executes the function corresponding to FN, and processes the payload.

[0047] When encapsulating a SID list in the IPv6 header, segment routing policies (SR-Policies) can be encapsulated within the IPv6 header. Although SR-Policies can be used by many users, this user-defined information can be considered personal privacy information (because this traffic involves reaching a certain node and performing a certain operation), and it is best not to expose it to the network. However, in related technologies, since the header is not encrypted, this introduces the risk of SR-Policy leakage.

[0048] To address the aforementioned technical problems, this application proposes a technical solution based on embodiments of the present application. The approach of this application is to minimize the exposure of information in the packet header by encrypting the SID list based on an improved SRv6 mechanism. This application provides an overall approach to Encrypted SRv6 (ESRv6). In this embodiment, the information exposed in the network still includes the packet header containing the Source Address (SA) and DA. The function fields and SID list are encrypted. When the packet reaches a node, the node decrypts the SID list and updates the DA, thereby reducing the information exposed in the network. Even with the use of SR Policy and the addition of the SRH extension header, attackers cannot decrypt the SR Policy.

[0049] In this embodiment, each node publishing a SID supports a key, and the SID list encapsulated by the header node for packet forwarding is also encrypted using the corresponding key, with the flag bit Flags1 (the first bit of the Flags field, also described below as flag b1) set to 1. Each node maintains its key locally and informs the orchestration node of the SID list (e.g., the network controller or header node) in some way.

[0050] The embodiments of this application will be further described in detail below with reference to the accompanying drawings and examples. It should be understood that the embodiments provided herein are merely illustrative of the embodiments of this application and are not intended to limit the embodiments of this application. Furthermore, the embodiments provided below are some embodiments for implementing this application, and not all embodiments for implementing this application. Unless otherwise specified, the technical solutions described in the embodiments of this application can be implemented in any combination.

[0051] It should be noted that, in the embodiments of this application, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a method or apparatus that includes a list of elements includes not only the elements expressly described, but also other elements not expressly listed, or elements inherent to implementing the method or apparatus. Without further limitations, an element defined by the phrase "comprising a..." does not exclude the presence of other related elements in the method or apparatus that includes that element (e.g., operations in the method or units in the apparatus; for example, a unit may be a portion of circuitry, a portion of a processor, a portion of a program or software, etc.).

[0052] The message forwarding method provided in this application includes a series of operations, but the message forwarding method provided in this application is not limited to the operations described therein. Similarly, the message forwarding device provided in this application includes a series of modules, but the device provided in this application is not limited to the modules explicitly described, but may also include modules that need to be set up for obtaining relevant information or processing based on information.

[0053] This application provides a packet forwarding method applied to a first SRv6 node, where the first SRv6 node refers to any SRv6 node in the packet forwarding path excluding the header node.

[0054] Figure 5 is a flowchart of a packet forwarding method applied to a first SRv6 node according to an embodiment of this application. As shown in Figure 5, the process may include:

[0055] Operation 501: Receive a service message sent by the previous SRv6 node of the first SRv6 node. The first header of the service message includes SID information encrypted using the key of the first SRv6 node.

[0056] Operation 502: Decrypt the first message header using the key of the first SRv6 node to obtain the decrypted SID information. The decrypted SID information includes at least the local operation instructions of the first SRv6 node.

[0057] In this embodiment of the application, the decrypted SID information may include a Function field, and the local operation instruction of the first SRv6 node is the content of the Function field in the SID information.

[0058] Operation 503: Execute the local operation instruction. If the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, send a service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

[0059] In this embodiment, if the currently processed SID is not the last SID in the SID list (SL>0 in this case), it means that the first SRv6 node is not the end node of the packet forwarding path of the service packet. The object to be decrypted is the Function field of the current SID (i.e., the SID written in DA) and the Locator field of the next-hop node. The decrypted SID information will include the identifier of the next-hop SRv6 node of the first SRv6 node. If the currently processed SID is the last SID in the SID list (SL=0 in this case), it means that the first SRv6 node is the end node of the packet forwarding path of the service packet. The object to be decrypted is the Function field of the current SID (i.e., the SID written in DA). The decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node.

[0060] In some embodiments, the identifier of the next-hop SRv6 node of the first SRv6 node may be a name, number, address or other identification information.

[0061] In some embodiments, the SID information also includes a Locator field, where the identifier of the next-hop SRv6 node of the first SRv6 node is located in the Locator field of the SID information.

[0062] In some embodiments, if the identifier of the next-hop SRv6 node of the first SRv6 node includes the next-hop SRv6 node, a service message can be sent to the next-hop SRv6 node of the first SRv6 node according to the address of the next-hop SRv6 node of the first SRv6 node.

[0063] In practical applications, operations 501 to 503 can be implemented based on a processor, which can be at least one of the following: Application Specific Integrated Circuit (ASIC), Digital Signal Processor (DSP), Digital Signal Processing Device (DSPD), Programmable Logic Device (PLD), Field Programmable Gate Array (FPGA), Central Processing Unit (CPU), Controller, Microcontroller, and Microprocessor.

[0064] As can be seen, since the first header of the business message includes SID information encrypted with the key of the first SRv6 node, and policies such as SR-Policy are usually encapsulated in the SID information, it is impossible to analyze the relevant policies in the header through network attack methods. This reduces the risk of policy information leakage and improves the confidentiality and security of the business message transmission process.

[0065] In some embodiments of this application, the method further includes: if the first message header includes a preset encryption flag, determining that the first message header includes SID information encrypted using the key of the first SRv6 node.

[0066] Here, the flag b1 bit can be carried in the first message header. When flag b1 = 1, it means that the first message header carries a preset encryption flag.

[0067] Referring to Figure 6, the first process for forwarding packets via an SRv6 node in this embodiment of the application includes:

[0068] Operation 61: Node 1 sends a message to Node 2. The message encapsulation strategy is (XNYN, X4Y4, A2::Y2)SL=2. The message encapsulation strategy means that the message first reaches Node 2, executes the function corresponding to Y2, then reaches Node 4, executes the function corresponding to Y4, and finally reaches Node N, executes the function corresponding to YN. Y2, Y4 and YN represent the function fields encrypted by F2 in Node 2, F4 in Node 4 and FN in Node N, respectively.

[0069] Operation 62: Node 2 receives the message, confirms that flag b1 = 1 and SL > 0, and triggers the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the Locator field of the next SID. At this time, the key of Node 2 can be used to decrypt, obtaining F2 and the identifier A4 of the next hop SRv6 node. A2::F2 is used to match the SID table of Node 2's SR, the function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::Y4, and the message is sent to Node 4.

[0070] Operation 63: Node 4 receives the message, determines that flag b1 = 1 and SL > 0, and triggers the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the Locator field of the next SID. At this time, the key of Node 4 can be used to decrypt and obtain F4 and the identifier AN of the next hop SRv6 node. A4::F4 is used to match the SID table of Node 4's SR, the function corresponding to F4 is executed, the value of SL is decremented by 1, the destination address is updated to AN::YN, and the message is sent to Node N.

[0071] Operation 64: Node N receives the message, determines that flag b1 = 1 and SL = 0, and triggers the decryption of the first message header. Specifically, the object to be decrypted is the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL). At this time, the key of node N can be used to decrypt and obtain FN. AN::FN is used to match the SID table of Node N's SR, and the function corresponding to FN is executed. Then the payload of the message is processed.

[0072] It can be seen that when the first message header includes a preset encryption flag, it can be determined that the first message header includes encrypted SID information. Therefore, the decrypted SID information can be obtained by decryption using the key of the first SRv6 node. Thus, in this embodiment, the decryption method of the first message header can be determined according to the preset encryption flag, thereby achieving accurate decryption of the SID information.

[0073] In some embodiments of this application, the method further includes: decrypting the second header of the service message using the key of the first SRv6 node when the decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node; the second header carries the destination address actually accessed by the user.

[0074] In some embodiments, the payload of the message may include an inner IP packet. The source address of the inner IP packet may be the user's IP address, and the destination address of the inner IP packet may be the actual destination address accessed by the user. The user's IP address can be denoted as userIP, and the actual destination address accessed by the user refers to the IP address of the service actually accessed by the user, which can be denoted as serverIP. The source and destination addresses of the inner IP packet can also be encrypted to ensure the confidentiality of the address of the service actually accessed by the user.

[0075] In some embodiments, the first header may be the user's external IPv6 header, and the source address in the first header may be the Headend IP, which may also be called the Ingress IP; the destination address in the second header may be the Endpoint IP, which may also be called the Egress IP.

[0076] In some embodiments, the second header may be the user's internal IPv6 header, which includes the source address and destination address of the inner IP packet.

[0077] Referring to Figure 7, the second process for forwarding packets via an SRv6 node in this embodiment includes:

[0078] Operation 71: Node 1 sends a message to Node 2. The message encapsulation strategy is (XNYN, X4Y4, A2::Y2)SL=2. The message encapsulation strategy means that the message first reaches Node 2, executes the function corresponding to Y2, then reaches Node 4, executes the function corresponding to Y4, and finally reaches Node N, executes the function corresponding to YN. Y2, Y4 and YN represent the function fields encrypted by F2 in Node 2, F4 in Node 4 and FN in Node N, respectively.

[0079] Operation 72: Node 2 receives the message, confirms that flag b1 = 1 and SL > 0, and triggers the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the Locator field of the next SID. At this time, the key of Node 2 can be used to decrypt, obtaining F2 and the identifier A4 of the next hop SRv6 node. A2::F2 is used to match the SID table of SR, the function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::Y4, and the message is sent to Node 4.

[0080] Operation 73: Node 4 receives the message, confirms that flag b1 = 1 and SL > 0, and triggers the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the Locator field of the next SID. At this time, the key of Node 4 can be used to decrypt and obtain F4 and the identifier AN of the next hop SRv6 node. A4::F4 is used to match the SID table of SR, the function corresponding to F4 is executed, the value of SL is decremented by 1, the destination address is updated to AN::YN, and the message is sent to Node N.

[0081] Operation 74: Node N receives the message, determines that flag b1=1, SL=0 and NextHeader=41, triggering the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) and the second message header. At this time, the key of node N can be used to decrypt, obtaining FN and the decrypted second message header. AN::FN is used to match the SID table of SR, the function corresponding to FN is executed, and then the message is forwarded according to the second message header.

[0082] As can be seen, if the first SRv6 node is the end node of the packet forwarding path of the service packet, then the decrypted SID information does not include the identifier of the next hop SRv6 node of the SRv6 node. In this case, the actual destination address accessed by the user can be determined by decrypting the second packet header of the service packet. Since the actual destination address accessed by the user can only be known through decryption, the confidentiality of the address of the service accessed by the user is guaranteed to a certain extent.

[0083] In some embodiments of this application, the method further includes: if the first message header matches a predefined field of the first SRv6 node, determining that the first message header of the service message includes SID information encrypted using the key of the first SRv6 node; after decrypting the first message header using the key of the first SRv6 node to obtain the decrypted SID information, replacing the predefined field with a specific field, wherein the specific field is an unencrypted field in the SID information.

[0084] In some embodiments of this application, the method further includes: if the first header matches the encrypted Locator field of the first SRv6 node, determining that the first header of the service message includes SID information encrypted using the key of the first SRv6 node; the first SRv6 node has pre-established an association between the encrypted Locator field and the unencrypted Locator field of the first SRv6 node. The unencrypted Locator field is the Locator currently used by SRv6; in these embodiments, the SRv6 node has both this ordinary Locator and extended support for encrypted Locators. The encrypted Locator indicates that the SID information (FUNCTION field) following the Locator is encrypted, and the optional next-hop Locator field is encrypted (the next-hop Locator field may be an encrypted Locator or an ordinary Locator).

[0085] After decrypting the first message header using the key of the first SRv6 node to obtain the decrypted SID information, the encrypted Locator field is replaced with the unencrypted Locator field of the first SRv6 node according to the association relationship.

[0086] Based on the aforementioned description, the presence or absence of an encrypted header can be determined by the flag b1 bit carried in the first header. If flag b1 = 1, it can be assumed that all functional fields in the SID information are encrypted (this may also include the identifier of the next-hop SRv6 node). In some embodiments, if it is deemed unnecessary to encrypt each SID, the identifier can be placed at the granularity of the SID information. In this case, a one-bit flag b1 bit is no longer needed. However, it is necessary to support SRv6 nodes in announcing specific encrypted Locator fields, and the SRv6 nodes need to associate the encrypted Locator fields with the unencrypted Locator fields. Here, the prefix of the encrypted Locator field is SLOC, and the prefix of the unencrypted Locator field is LOC.

[0087] In some embodiments, each SRv6 node advertises its own LOC and SLOC to the network to facilitate SID table matching. For example, the LOC might be B:0:0:AAA0:: / 64, and the SLOC might be B:0:0:AAA1:: / 64. This means that IPv6 packets with either prefix will be routed to the current SRv6 node. However, if the SLOC is matched at the current SRv6 node, decryption is triggered, the corresponding function is decrypted, the prefix is ​​modified to the LOC, and the local SID table is queried again based on the LOC and the decrypted function to execute the corresponding function.

[0088] Referring to Figure 8, the third process for forwarding packets via an SRv6 node in this embodiment of the application includes:

[0089] Operation 81: Node 1 sends a message to Node 2. The message encapsulation strategy is (XNSYN, X4SY4, A2S::Y2)SL=2. The meaning of the message encapsulation strategy is that the message first reaches Node 2, executes the function corresponding to Y2, then reaches Node 4, executes the function corresponding to Y4, and finally reaches Node N, executes the function corresponding to YN. Y2, Y4 and YN represent the function fields encrypted by F2 in Node 2, F4 in Node 4 and FN in Node N, respectively.

[0090] Operation 82: Node 2 receives the message and determines that the LOC field of the current SID (i.e., the SID written in DA, and also the SID pointed to by SL) in the first message header matches the encrypted Locator field (i.e., SLOC) of Node 2, triggering the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID and the Locator field of the next SID. At this time, Node 2's key can be used for decryption to obtain F2 and the identifier A4S of the next hop SRv6 node. SLOC is replaced with A2, and A2::F2 is used to match the SID table of Node 2's SR. The function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4S::Y4, and the message is sent to Node 4.

[0091] Operation 83: Node 4 receives the message and determines that the Locator field of the current SID (i.e., the SID written in DA, and also the SID pointed to by SL) in the first message header matches the encrypted Locator field (i.e., SLOC) of Node 4, triggering the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID and the Locator field of the next SID. At this time, Node 4's key can be used for decryption to obtain F4 and the identifier ANS of the next hop SRv6 node. SLOC is replaced with A4, and A4::F4 is used to match the SID table of Node 4's SR. The function corresponding to F4 is executed, the value of SL is decremented by 1, the destination address is updated to ANS::YN, and the message is sent to Node N.

[0092] Operation 84: Node N receives the message and determines that the Locator field of the current SID (i.e., the SID written in DA, and also the SID pointed to by SL) in the first message header matches the encrypted Locator field (i.e., SLOC) of Node N, triggering the decryption of the first message header. Specifically, the object to be decrypted is the Function field of the current SID. At this time, the key of Node N can be used to decrypt and obtain FN. Replace SLOC with AN, use AN::FN to match the SID table of Node N's SR, execute the function corresponding to FN, and then process the payload of the message.

[0093] As can be seen, when the first message header matches the encrypted Locator field of the first SRv6 node, it can be determined that the first message header includes encrypted SID information. Therefore, the encrypted SID information can be obtained by decryption using the key of the first SRv6 node. Furthermore, the encrypted Locator field can be replaced with the unencrypted Locator field based on the association between the encrypted and unencrypted Locator fields. Thus, the embodiments of this application can achieve accurate decryption and restoration of SID information based on the encrypted Locator field and the association between the encrypted and unencrypted Locator fields.

[0094] In some embodiments of this application, the method further includes: if the first message header does not match the encrypted Locator field of the first SRv6 node, obtaining unencrypted information from the first message header, the unencrypted information including local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node. For example, the unencrypted information may be a portion of the unencrypted SID information.

[0095] Here, if the first message header does not match the encryption Locator field of the first SRv6 node, it can be assumed that the SID information of the first SRv6 node is not encrypted. In this way, the unencrypted SID information can be obtained directly from the first message header.

[0096] In some embodiments, encryption can be refined from the encryption of all SID information to the encryption of the function of a certain SID information. Thus, it can support the encryption of the function of all SID information while also supporting the encryption of the function of some SID information. That is, it can support the encryption of the function of some SID information through a hybrid orchestration method.

[0097] In some embodiments, when encrypting the function of part of the SID information using a hybrid orchestration method, it is necessary to publish LOC and SLOC on the SRv6 node, and orchestrate the nodes where the SID information with encrypted function fields is located, such as control nodes or head nodes. In addition to recognizing LOC, it is further supported to recognize SLOC. When encrypting the SID information, SLOC is used, while LOC is used for the unencrypted function fields. At the same time, the identifier of the next-hop node of the node where the SID information with unencrypted function fields is located is not encrypted.

[0098] In some embodiments, when processing SID information with encrypted function fields, it is necessary to first determine whether it is SLOC, and if so, decrypt it before querying the local SID table, which reduces packet forwarding efficiency. Therefore, when performing functional encryption of some SID information through a hybrid orchestration method, it is supported to encrypt key function fields (key function fields can be pre-set) to improve packet forwarding efficiency. In this embodiment, the coexistence of unencrypted and encrypted nodes is supported, and some SRv6 nodes can be deployed as encrypted nodes. Here, encrypted nodes refer to SRv6 nodes that need to process encrypted function fields, and unencrypted nodes refer to SRv6 nodes that can directly obtain unencrypted function fields from the first packet header. SRv6 nodes that support encryption also support partial traffic encryption (using SLOC) and partial traffic unencryption (using LOC).

[0099] Referring to Figure 9, the fourth process for forwarding packets via an SRv6 node in this embodiment includes:

[0100] Operation 91: Node 1 sends a message to Node 2. The message encapsulation strategy is (ANSYN, X4F4, A2S::Y2)SL=2. The meaning of the message encapsulation strategy is that the message first reaches Node 2, executes the function corresponding to Y2, then reaches Node 4, executes the function corresponding to F4, and finally reaches Node N, executes the function corresponding to YN. Y2 and YN represent the function fields obtained after encrypting F2 in Node 2 and FN in Node N, respectively.

[0101] Operation 92: Node 2 receives the message and determines that the Locator field of the current SID (i.e., the SID written in DA, and also the SID pointed to by SL) in the first message header matches the encrypted Locator field (i.e., SLOC) of Node 2, triggering the decryption of the first message header. Specifically, the decryption targets the Function field of the current SID and the Locator field of the next SID. At this time, the key of Node 2 can be used to decrypt, obtaining F2 and the identifier A4 of the next hop SRv6 node. SLOC is replaced with A2, and A2::F2 is used to match the SID table of SR. The function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::F4, and the message is sent to Node 4.

[0102] Operation 93: Node 4 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, which is also the SID pointed to by SL) matches the unencrypted Locator field and Function field of Node 4. That is, A4::F4 can be used to match the SID table of SR, execute the function corresponding to F4, decrement the value of SL by 1, update the destination address to ANS::YN, and send the message to Node N.

[0103] Operation 94: Node N receives the message and determines that the Locator field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) in the first message header matches the encrypted Locator field of Node N, triggering the decryption of the first message header. Specifically, the object to be decrypted is the Function field of the current SID. At this time, the key of Node N can be used to decrypt and obtain FN. SLOC is replaced with AN, and AN::FN is used to match the SID table of SR. The function corresponding to FN is executed, and then the payload of the message is processed.

[0104] As can be seen, in this embodiment, it is not necessary to determine whether a message header containing encrypted information has been received by occupying a flag bit. Instead, it can determine whether encrypted SID information has been received by matching the Locator field of the current SID (i.e., the SID written in DA, which is also the SID pointed to by SL) with the encrypted Locator field. This allows for accurate determination of how the SID information is obtained and is beneficial in scenarios where some nodes have encrypted SID information. It also enables the acquisition of SID information and accurate determination of local operation instructions and the acquisition method of the Locator field of the next-hop node.

[0105] In some embodiments of this application, the encrypted local operation instructions of the first SRv6 node are located in the Function field of the SID information or in the arg field of the parameter.

[0106] The method further includes: if the current SID in the first packet header (i.e., the SID written in DA, which is also the SID pointed to by SL) matches the decryption function of the first SRv6 node (the local SID table stores all local function fields, and the matching of these function fields is performed according to the longest matching principle, similar to the longest matching in IP forwarding), determining that the first packet header of the service packet includes SID information encrypted using the key of the first SRv6 node; the decryption function is a predefined function.

[0107] When the first message header is decrypted using the key of the first SRv6 node, the specific objects to be decrypted are the arg field of the current SID and the Locator field, which may include the next SID. After obtaining the SID information, the decryption Function field and the parameter arg field are replaced with the Function field in the SID information.

[0108] In the aforementioned embodiments, SRv6 nodes need to advertise the following two prefixes: SLOC and LOC. However, since the SID list orchestration node, such as the controller or head node, cannot directly determine which prefix in the advertised information is SLOC, it needs to determine whether the received LOC is the original LOC or SLOC according to the convention. Simultaneously, it needs to associate the SLOC with the corresponding LOC to achieve correct SID list orchestration. To address this issue, in some embodiments, if it is deemed unnecessary to encrypt each SID, it can be identified at the granularity of the SID information. In this case, it is no longer necessary to occupy a one-bit flag b1 flag, but a special Function space needs to be defined; that is, the SRv6 node can advertise only the LOC, but a special decryption Function needs to be defined. For example, the LOC is B:0:0:AAA0:: / 64, and the last 64 bits of the Segment ID are programming space used by the Function field. When the decryption Function in the Function field occupies 1 bit, the last 63 bits of the Function field can be used for network programming, and the programming space becomes B:0:0:AAA0:0000:: / 65. The prefix of all encrypted function fields is B:0:0:AAA0:8000:: / 65. At this time, the SID information includes the LOC, a 1-bit decryption Function field, and an arg field.

[0109] Referring to Figure 10, the fifth process for forwarding packets via an SRv6 node in this embodiment of the application includes:

[0110] Operation 101: Node 1 sends a message to Node 2 with a message encapsulation strategy of (XN1YN, X41Y4, A2::1Y2)SL = 2. This strategy means that the message first reaches Node 2, where the function corresponding to Y2 is executed; then it reaches Node 4, where the function corresponding to Y4 is executed; and finally, it reaches Node N, where the function corresponding to YN is executed. Y2, Y4, and YN represent the parameter arg obtained after encrypting the last 63 bits of F2 in Node 2, the last 63 bits of F4 in Node 4, and the last 63 bits of FN in Node N, respectively. Y2 can be decrypted as the last 63 bits of F2, Y4 as the last 63 bits of F4, and YN as the last 63 bits of FN. At this point, Y2, Y4, and YN are all 63 bits, and F2, F4, and FN are all 64 bits, but the first bit of F2, F4, and FN is always 0.

[0111] Operation 102: Node 2 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, and also the SID pointed to by SL) matches Node 2's decryption function, and triggers the decryption of the first message header. Specifically, the objects to be decrypted are the arg field of the current SID and the Locator field of the next SID. At this time, Node 2's key can be used to decrypt, obtaining F2 and the identifier A4 of the next-hop SRv6 node. The decryption function and arg field are replaced with F2. A2::F2 is used to match the SID table of Node 2's SR, the function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::1Y4, and the message is sent to Node 4.

[0112] Operation 103: Node 4 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, and also the SID pointed to by SL) matches Node 4's decryption function, and triggers the decryption of the first message header. Specifically, the objects to be decrypted are the arg field of the current SID and the LOC field of the next SID. At this time, the key of Node 4 can be used to decrypt, obtaining F4 and the identifier AN of the next hop SRv6 node. The decryption function and arg field are replaced with F4. A4::F4 is used to match the SID table of Node 4's SR, the function corresponding to F4 is executed, the value of SL is decremented by 1, the destination address is updated to AN::1YN, and the message is sent to Node N.

[0113] Operation 104: Node N receives the message and determines that the current SID in the first message header (i.e., the SID written in DA, and also the SID pointed to by SL) matches the decryption Function field of Node N, triggering the decryption of the first message header. Specifically, the object to be decrypted is the arg field of the current SID. At this time, SL = 0, and there is no next SID. At this point, the key of Node N can be used to decrypt and obtain FN. The decryption Function and arg fields are replaced with FN, and AN::FN is used to match the SID table of SR. The function corresponding to FN is executed, and then the payload of the message is processed.

[0114] It can be seen that when the current SID in the first message header matches the decryption function of the first SRv6 node (this matching includes the LOC portion and the decryption function; for example, the current SID in the first message header can match B:0:0:AAA0:8000:: / 65, and the arg field does not need to be matched), it can be determined that the first message header contains encrypted SID information. Therefore, it can be decrypted using the key of the first SRv6 node, and the SID information can be accurately decrypted.

[0115] In some embodiments of this application, the method further includes: when the first message header does not match the decryption function of the first SRv6 node, but can directly match a normal function, unencrypted information can be obtained from the first message header. The unencrypted information includes local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node. For example, the unencrypted information may be a portion of the unencrypted SID information.

[0116] In some embodiments, in schemes that define a specific programming space, partial SID information can also be encrypted using a hybrid orchestration approach.

[0117] Referring to Figure 11, the sixth process for forwarding packets via an SRv6 node in this embodiment of the application includes:

[0118] Operation 111: Node 1 sends a message to Node 2. The message encapsulation strategy is (AN1YN, X4F4, A2::1Y2)SL = 2. This strategy means that the message first reaches Node 2, where the function corresponding to Y2 is executed; then it reaches Node 4, where the function corresponding to F4 is executed; and finally, it reaches Node N, where the function corresponding to YN is executed. Y2 and YN represent the parameter arg obtained after encryption using F2 at Node 2 and FN at Node N, respectively. Y2, after decryption, can be the last 63 bits of F2, and YN, after decryption, can be the last 63 bits of FN. At this point, Y2 and YN are both 63 bits, and F2 and FN are both 64 bits, but the first bit of both F2 and FN is 0.

[0119] Operation 112: Node 2 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, and also the SID pointed to by SL) matches Node 2's decryption function, triggering the decryption of the first message header. Specifically, the decryption targets are the arg field of the current SID and the Locator field of the next SID. At this time, Node 2's key can be used for decryption to obtain F2 and the identifier A4 of the next hop SRv6 node. The decryption function and arg field are replaced with F2. A2::F2 is used to match the SID table of SR, the function corresponding to F2 is executed, the value of SL is decremented by 1, the destination address is updated to A4::F4, and the message is sent to Node 4.

[0120] Operation 113: Node 4 receives the message, determines that the current SID in the first message header (i.e., the SID written in DA, which is also the SID pointed to by SL) matches Node 4's F4. That is, A4::F4 can be used to match the SID table of SR, execute the function corresponding to F4, decrement the value of SL by 1, update the destination address to AN::1YN, and send the message to Node N.

[0121] Operation 114: Node N receives the message, determines that the current SID in the first message header (i.e., the SID written in DA) matches the decryption function of node N, and triggers the decryption of the first message header. Specifically, the object to be decrypted is the arg field of the current SID. At this time, the key of node N can be used to decrypt and obtain FN. The decryption function and arg field are replaced with FN. AN::FN is used to match the SID table of SR, and the function corresponding to FN is executed to process the payload of the message.

[0122] As can be seen, in this embodiment, it is not necessary to determine whether a message header containing encrypted information has been received by occupying a flag bit. Instead, it can determine whether encrypted SID information has been received by matching the current SID of the message header with the decryption function of the SRv6 node. This allows for accurate determination of the method of obtaining SID information and is beneficial in scenarios where some nodes have encrypted SID information. It also helps to obtain SID information and accurately determine the method of obtaining local operation instructions and the Locator field of the next-hop node.

[0123] This application's embodiments can be applied to fields such as transmission and bearer. In the technical solutions of this application's embodiments, the head node or other network nodes encrypt or decrypt the SID information, exposing only information similar to the SRH extension header (e.g., SA, DA, etc.). In some embodiments, the SID information can be given an identifier indicating that it is ESRv6 SID information; the SID information can be encrypted by: using the target SRv6 node's key to encrypt the Function field of the target SRv6 node's SID and the Locator field of the target SRv6 node's next hop, or by using the target SRv6 node's key to encrypt the function field of the target SRv6 node's SID information and the second header. In some embodiments, a special SLOC or decryption function can be defined to indicate whether encryption is required.

[0124] The technical solution adopted in this application embodiment can encrypt the specific information of the SID list, which is beneficial to the encryption protection of policy information in computing power networks and the confidentiality of policies in application-aware networks. Network attackers cannot determine what network capabilities a user used (because the SID information is encrypted) or what services they accessed by analyzing packets. The mechanism for encrypting SID information in this application embodiment can be used between network ingress and egress nodes, and also between Broadband Network Gateway (BNG) and Headend, to protect the user's true DA. Compared with the SID information encryption mechanism in related technologies, this application embodiment can also encrypt the Function field, resulting in better confidentiality.

[0125] This application provides a message forwarding method applied to the head node.

[0126] Figure 12 is a flowchart of a packet forwarding method applied to a head node according to an embodiment of this application. As shown in Figure 12, the process may include:

[0127] Operation 121: Obtain the service message to be sent. The first header of the service message includes SID information encrypted by the header node using the key of the target node. The target node includes at least one SRv6 node that receives the service message. The SID information encrypted using the key of the target node includes at least the local operation instructions of the target node.

[0128] Operation 122: Send the service message to the target node. The target node receives the service message, decrypts the first message header using its key to obtain the decrypted SID information, and executes local operation instructions.

[0129] Here, when the target node is the next-hop SRv6 node of the head node, the service message can be sent to the target node according to the identifier of the next-hop SRv6 node of the head node carried in the first message header; when the target node is not the next-hop SRv6 node of the head node, the service message can be sent to the target node through routing node forwarding.

[0130] As can be seen, since the first header of the business message includes SID information encrypted with the target node's key, and policies such as SR-Policy are usually encapsulated in the SID information, it is impossible to analyze the relevant policies in the header through network attack methods. This reduces the risk of policy information leakage and improves the confidentiality and security of the business message transmission process.

[0131] Those skilled in the art will understand that, in the methods described in the specific implementation, the order in which each operation is written does not imply a strict execution order and does not constitute any limitation on the implementation process. The specific execution order of each operation should be determined by its function and possible internal logic.

[0132] Figure 13 is a schematic diagram of the packet forwarding device applied to the first SRv6 node according to an embodiment of this application. As shown in Figure 13, the device includes:

[0133] The receiving module 131 is used to receive a service message sent by the previous SRv6 node of the first SRv6 node; the first header of the service message includes SID information encrypted using the key of the first SRv6 node.

[0134] The first processing module 132 is used to decrypt the first message header using the key of the first SRv6 node to obtain the decrypted SID information, wherein the decrypted SID information includes at least the local operation instructions of the first SRv6 node.

[0135] The second processing module 133 is used to execute the local operation instruction, and when the decrypted SID information includes the identifier of the next-hop SRv6 node of the first SRv6 node, to send the service message to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

[0136] In some embodiments, the first processing module 132 is further configured to determine that the first message header includes SID information encrypted using the key of the first SRv6 node, if the first message header includes a preset encryption flag.

[0137] In some embodiments, the first processing module 132 is further configured to decrypt the second header of the service message using the key of the first SRv6 node when the decrypted SID information does not include the identifier of the next-hop SRv6 node of the first SRv6 node; the second header carries the destination address actually accessed by the user.

[0138] In some embodiments, the first processing module 132 is further configured to determine, when the first message header matches a predefined field of the first SRv6 node, that the first message header includes SID information encrypted using the key of the first SRv6 node; after decrypting the first message header using the key of the first SRv6 node to obtain the decrypted SID information, replace the predefined field with a specific field, wherein the specific field is an unencrypted field in the SID information.

[0139] In some embodiments, the predefined field is an encrypted location Locator field, and the specific field is an unencrypted Locator field. The first SRv6 node has a pre-established association relationship between the encrypted Locator field and the unencrypted Locator field. The first processing module 132 is used to replace the predefined field with the specific field by replacing the encrypted Locator field with the unencrypted Locator field according to the association relationship.

[0140] In some embodiments, the first processing module 132 is further configured to obtain unencrypted information from the first message header if the first message header does not match the encrypted Locator field of the first SRv6 node. The unencrypted information includes the local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node.

[0141] In some embodiments, the predefined field includes a decrypted Function, which represents a predefined function and includes a parameter arg field; the specific field is a Function field; the first processing module 132 replaces the predefined field with the specific field, including: replacing the decrypted Function and the parameter arg field with the Function field in the decrypted SID information.

[0142] In some embodiments, the first processing module 132 is further configured to obtain unencrypted information from the first message header if the first message header does not match the decryption Function field of the first SRv6 node. The unencrypted information includes the local operation instructions of the first SRv6 node and the Locator field of the next-hop node of the first SRv6 node.

[0143] In practical applications, the receiving module 131, the first processing module 132, and the second processing module 133 can be implemented based on a processor and a communication device.

[0144] Figure 14 is a schematic diagram of the structure of a message forwarding device applied to a header node according to an embodiment of this application. As shown in Figure 14, the device includes:

[0145] The acquisition module 141 is used to acquire a service message to be sent. The first header of the service message includes SID information encrypted by the header node using the key of the target node. The target node includes at least one SRv6 node that receives the service message. The SID information encrypted by the key of the target node includes at least the local operation instructions of the target node.

[0146] The third processing module 142 is used to send the service message to the target node. The target node is used to receive the service message, decrypt the first message header using the target node's key to obtain the decrypted SID information, and execute the local operation instruction.

[0147] In practical applications, the acquisition module 141 and the third processing module 142 can be implemented based on a processor and a communication device.

[0148] It should be noted that the description of the above device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects. For technical details not disclosed in the device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

[0149] It should be noted that, in the embodiments of this application, if the above methods are implemented as software functional modules and sold or used as independent products, they can also be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the embodiments of this application, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a terminal, server, etc.) to execute all or part of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), magnetic disks, or optical disks. Thus, the embodiments of this application are not limited to any specific hardware and software combination.

[0150] Correspondingly, this application embodiment further provides a computer program product, the computer program product including computer executable instructions, which are used to implement any of the message forwarding methods provided in this application embodiment.

[0151] Accordingly, this application embodiment further provides a computer storage medium storing computer-executable instructions, which are used to implement any of the message forwarding methods provided in the above embodiments.

[0152] This application also provides an electronic device. Figure 15 is a schematic diagram of the composition structure of an electronic device provided in this application embodiment. As shown in Figure 15, the electronic device 150 may include:

[0153] Memory 151 is used to store executable instructions;

[0154] The processor 152 is used to implement any of the above-described message forwarding methods when executing the executable instructions stored in the memory 151.

[0155] The processor 152 mentioned above can be at least one of ASIC, DSP, DSPD, PLD, FPGA, CPU, controller, microcontroller, and microprocessor.

[0156] The aforementioned computer-readable storage medium and memory 151 may be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM), etc.; or it may be various terminals including one or any combination of the above-mentioned memories, such as mobile phones, computers, tablet devices, personal digital assistants, etc.

[0157] In some embodiments, the functions or modules of the apparatus provided in this application can be used to perform the methods described in the above method embodiments. The specific implementation can be referred to the description of the above method embodiments, and for the sake of brevity, it will not be repeated here.

[0158] The description of the various embodiments above tends to emphasize the differences between the various embodiments. The similarities or similarities between them can be referred to, and for the sake of brevity, they will not be repeated here.

[0159] The methods disclosed in the various method embodiments provided in this application can be arbitrarily combined to obtain new method embodiments without conflict.

[0160] The features disclosed in the various product embodiments provided in this application can be arbitrarily combined without conflict to obtain new product embodiments.

[0161] The features disclosed in the various method or device embodiments provided in this application can be arbitrarily combined without conflict to obtain new method or device embodiments.

[0162] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0163] The embodiments of this application have been described above with reference to the accompanying drawings. However, this application is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of this application without departing from the spirit and scope of the claims. All of these forms are within the protection scope of this application.

Claims

1. A packet forwarding method applied to a first Segment Routing over Internet Protocol version 6 (SRv6) node, the method comprising: receiving a service packet sent by a previous hop SRv6 node of the first SRv6 node; a first packet header of the service packet comprising Segment Identifier (SID) information encrypted using a key of the first SRv6 node; decrypting the first packet header using the key of the first SRv6 node to obtain decrypted SID information, the decrypted SID information comprising at least a local operation instruction of the first SRv6 node; performing the local operation instruction, and in a case where the decrypted SID information comprises an identifier of a next hop SRv6 node of the first SRv6 node, sending the service packet to the next hop SRv6 node of the first SRv6 node according to the identifier of the next hop SRv6 node of the first SRv6 node.

2. The method of claim 1, wherein, The method further comprises, in a case where the first packet header comprises a preset encryption flag, determining that the first packet header comprises the SID information encrypted using the key of the first SRv6 node.

3. The method of claim 1 or 2, wherein, The method further comprises, in a case where the decrypted SID information does not comprise the identifier of the next hop SRv6 node of the first SRv6 node, decrypting a second packet header of the service packet using the key of the first SRv6 node, the second packet header carrying a destination address actually accessed by a user.

4. The method of claim 1, wherein, The method further comprises, in a case where the first packet header matches a predefined field of the first SRv6 node, determining that the first packet header of the service packet comprises the SID information encrypted using the key of the first SRv6 node. After decrypting the first packet header using the key of the first SRv6 node to obtain the decrypted SID information, the predefined field is replaced with a specific field, the specific field being an unencrypted field in the SID information.

5. The method of claim 4, wherein, The predefined field is an encrypted Locator field, and the specific field is an unencrypted Locator field, and the first SRv6 node has a predefined association between the encrypted Locator field and the unencrypted Locator field. The predefined field is replaced with the specific field comprises replacing the encrypted Locator field with the unencrypted Locator field according to the association.

6. The method of claim 5, wherein, The method further comprises, in a case where the first packet header does not match the encrypted Locator field of the first SRv6 node, obtaining unencrypted information from the first packet header, the unencrypted information comprising the local operation instruction and the Locator field of a next hop node of the first SRv6 node.

7. The method of claim 4, wherein, The predefined field comprises a decryption function (Function), the decryption Function being used to represent a predefined function, the decryption Function comprising a parameter (arg) field, and the specific field is a Function field. The replacing the predefined field with a specific field includes replacing the decrypted Function and parameter arg field with a Function field in the decrypted SID information.

8. The method of claim 7, wherein, The method further includes: in a case where the first packet header does not match a decrypted Function field of the first SRv6 node, obtaining unencrypted information from the first packet header, the unencrypted information including a local operation instruction of the first SRv6 node and a Locator field of a next-hop node of the first SRv6 node.

9. The method of claim 6 or 8, wherein, The unencrypted information is part of unencrypted SID information.

10. The method of claim 1, wherein, The method further includes: encrypting a Function field of the part of SID information.

11. The method of claim 10, wherein, An identifier of a next-hop node of a node where the unencrypted SID information is located remains in a non-encrypted state.

12. The method of claim 10, wherein, The method is applied to a network supporting SRv6, and the network includes a plurality of SRv6 nodes, and the plurality of SRv6 nodes include: an encryption node configured to encrypt the Function field of the part of SID information; and a non-encryption node configured to directly obtain the Function field of the unencrypted SID information from the first packet header.

13. The method of claim 1, wherein, The method is applied to a network supporting SRv6, and the network includes a plurality of SRv6 nodes, and the method further includes: each of the SRv6 nodes advertises its own LOC and SLOC to the network for matching of a SID table.

14. A packet forwarding method applied to a head node, the method comprising: obtaining a service packet to be sent, a first packet header of the service packet including segment identifier (SID) information encrypted by a key of a target node of the head node, the target node including at least one segment routing (SR) node based on an Internet Protocol version 6 (IPv6) forwarding plane (SRv6 node) receiving the service packet, the SID information encrypted by the key of the target node including at least a local operation instruction of the target node; sending the service packet to the target node, the target node being configured to receive the service packet, decrypt the first packet header using the key of the target node to obtain decrypted SID information, and execute the local operation instruction.

15. A packet forwarding apparatus applied to a first segment routing (SR) node based on an Internet Protocol version 6 (IPv6) forwarding plane (SRv6 node), the apparatus comprising: a receiving module configured to receive a service packet sent by a previous-hop SRv6 node of the first SRv6 node; a first processing module configured to decrypt a first packet header of the service packet using a key of the first SRv6 node to obtain decrypted SID information, the decrypted SID information including at least a local operation instruction of the first SRv6 node. ​ The second processing module is configured to execute the local operation instruction, and in a case where the decrypted SID information comprises an identifier of a next-hop SRv6 node of the first SRv6 node, send the service packet to the next-hop SRv6 node of the first SRv6 node according to the identifier of the next-hop SRv6 node of the first SRv6 node.

16. A packet forwarding apparatus applied to a head node, the apparatus comprising: an obtaining module configured to obtain a service packet to be sent, a first packet header of the service packet comprising segment identifier (SID) information encrypted by a key of a target node, the target node comprising at least one segment routing (SR) over Internet Protocol version 6 (IPv6) (SRv6) node receiving the service packet, the SID information encrypted by the key of the target node comprising at least a local operation instruction of the target node; a third processing module configured to send the service packet to the target node according to an identifier of a next-hop SRv6 node of the head node carried in the first packet header, the target node being configured to receive the service packet, decrypt the first packet header using the key of the target node to obtain decrypted SID information, and execute the local operation instruction.

17. An electronic device applied to a first SRv6 node, the electronic device comprising a processor and a memory storing a computer program capable of running on the processor; wherein the processor is configured to run the computer program to perform the method of any one of claims 1 to 13.

18. An electronic device applied to a head node, the electronic device comprising a processor and a memory storing a computer program capable of running on the processor; wherein the processor is configured to run the computer program to perform the method of claim 14.

19. A computer storage medium having stored thereon a computer program, wherein, the computer program, when executed by the processor, implements the method of any one of claims 1 to 14.

20. A computer program product comprising a computer program, wherein, the computer program, when executed by the processor, implements the method of any one of claims 1 to 14. the computer program, when executed by the processor, implements the method of any one of claims 1 to 14.

Images