Message passing method and apparatus, electronic device, storage medium and program product

Abstract

The embodiments of the present disclosure relate to the technical field of network communication and security. Provided are a message passing method and apparatus, an electronic device, a storage medium and a program product. The method comprises: a head-end router analyzes a segment routing policy sent by a controller so as to obtain a target segment list, the target segment list consisting of ordered segment identifiers, the segment identifiers in the target segment list being used for representing nodes in a network, and the target segment list being used for defining a forwarding path (S210); the head-end router generates a source address validation (SAV) message on the basis of the segment routing policy (S220); and the head-end router forwards the source address validation message on the basis of the forwarding path (S230). The method defines clear paths to guide SAV messages, ensuring that the source address validation messages are passed efficiently, securely and accurately.

Description

Message propagation method and device, electronic device, storage medium and program product

[0001] Cross-reference to Related Applications

[0002] This application claims priority to the Chinese Patent Application No. 202411237389.1, filed on September 04, 2024, and entitled “Message propagation method and device, electronic device, storage medium and program product”, the content of which is incorporated herein by reference in its entirety. TECHNICAL FIELD

[0003] The present disclosure relates to the field of network communication and security, and in particular, to a message propagation method, a message propagation device, an electronic device, a computer readable storage medium, and a computer program product. BACKGROUND

[0004] In modern network environments, Source Address Validation (SAV) mechanisms are crucial for ensuring that data packets have legitimate source addresses. Traditional SAV mechanisms usually rely on routing tables for control and policy generation, but this approach lacks flexibility and fine-grained control. Policy-Based Routing (PBR)-based SAV mechanisms provide some improvements, but still cannot solve the aforementioned SAV mechanism failure problem caused by data packets being forwarded based on Segment Routing Policy (SR-policy). Therefore, it is necessary to propose a SAV message propagation mechanism based on SR-policy.

[0005] It should be noted that the information disclosed in the above BACKGROUND section is only used to strengthen the understanding of the background of the present disclosure, and therefore can include information that does not constitute prior art known to those of ordinary skill in the art. SUMMARY

[0006] The present disclosure provides a message propagation method, a message propagation device, an electronic device, a computer readable storage medium, and a computer program product.

[0007] Other characteristics and advantages of the present disclosure will become apparent from the following detailed description, or will be learned by practice of the present disclosure.

[0008] According to an aspect of the present disclosure, a message propagation method is provided, which comprises: a head-end router obtaining a target segment list from a segment routing policy sent by a controller; the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used to represent nodes in a network, and the target segment list is used to define a forwarding path; the head-end router generating a source address verification message based on the segment routing policy; and the head-end router forwarding the source address verification message according to the forwarding path.

[0009] In some embodiments of the present disclosure, the method further comprises: the head-end router forwarding the source address verification message to other routers according to the forwarding path, so that the other routers create a source address verification rule at a receiving interface after receiving the source address verification message.

[0010] In some embodiments of the present disclosure, the source address verification message comprises: a message type field, a source router field, a neighbor router field, a source prefix field and a segment list field; the message type field is used to identify the type of the message; the source router field is used to identify the identifier of the source router; the neighbor router field is used to identify the identifier of the neighbor router; the source prefix field is used to identify the source prefix; and the segment list field is used to identify the segment list defined by the segment routing policy.

[0011] In some embodiments of the present disclosure, the source address verification message further comprises one or more of a security level field and a quality of service field; the security level field is used to indicate security requirements; and the quality of service field is used to indicate quality of service requirements.

[0012] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, comprising: if the segment routing policy contains a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to the source prefix in the segment routing policy; and the head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0013] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, comprising: if the segment routing policy does not contain a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to a default value according to a local traffic control policy; and the head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0014] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, including: the head-end router determines the value of the security level field in the source address verification message according to the security requirement in the segment routing policy; the head-end router determines the value of the quality of service field in the source address verification message according to the quality of service requirement in the segment routing policy.

[0015] In some embodiments of the present disclosure, the source address verification rule includes: a source prefix field and a valid interface list field; the source prefix field is used to identify a source prefix; the valid interface list is used to identify a router interface that can receive a data packet from a specified source prefix.

[0016] In some embodiments of the present disclosure, the source address verification rule further includes one or more of a security level field and a quality of service field; the security level field is used to identify a policy for processing a data packet that does not meet the rule; the quality of service field is used to identify a quality of service requirement related to data packet processing.

[0017] In some embodiments of the present disclosure, the segment routing policy includes an optional segment list, the optional segment list is used to define an alternative path; the method further includes: if the forwarding path is interrupted or an unreachable node appears, the head-end router updates the source address verification message according to the alternative path to obtain a new source address verification message; the head-end router propagates the new source address verification message according to the alternative path.

[0018] In some embodiments of the present disclosure, the method further includes: the head-end router identifies a specific node; the specific node includes a load balancing node and a traffic monitoring node; the head-end router inserts the specific node into the target segment list, and adjusts the order and number of nodes in the target segment list.

[0019] In some embodiments of the present disclosure, the target segment list includes a security node and a service node.

[0020] In some embodiments of the present disclosure, if the target segment list defines multiple forwarding paths, the method further includes: the head-end router obtains the multiple forwarding paths, and propagates messages on the multiple forwarding paths in parallel.

[0021] According to yet another aspect of the present disclosure, a message propagation method is provided, the method comprising: a forwarding router receiving a source address verification message, and performing a lookup matching of a segment list in the source address verification message with one or more locally configured segment identifiers; the source address verification message is generated based on a segment routing policy, and the one or more locally configured segment identifiers are used to identify a role of the forwarding router in a segment routing network; if the matching is successful, the forwarding router processes the source address verification message; if the matching is not successful, the forwarding router does not process the source address verification message and floods the source address verification message.

[0022] In some embodiments of the present disclosure, the forwarding router flooding the source address verification message comprises: if the forwarding router does not find a next hop node indicated by a neighbor router field in the source address verification message when forwarding the source address verification message, the forwarding router floods the source address verification message to all adjacent routers.

[0023] In some embodiments of the present disclosure, the forwarding router processing the source address verification message comprises: the forwarding router processing the source address verification message, identifying an interface receiving the source address verification message as a valid interface, creating a source address verification rule, and forwarding the source address verification message to a next hop node according to the segment list in the source address verification message.

[0024] In some embodiments of the present disclosure, the method further comprises: if the matching is successful, the forwarding router updating a value of a neighbor node field in the source address verification message as an identifier of a next hop node in a forwarding path defined by the segment routing policy.

[0025] In some embodiments of the present disclosure, the method further comprises: if the matching is successful, the forwarding router updating the segment list in the source address verification message so that a segment identifier of a next hop node becomes a current segment identifier of the segment list.

[0026] According to yet another aspect of the present disclosure, a message propagation apparatus is provided, the apparatus comprising: a policy parsing unit configured to parse a segment routing policy sent by a controller and obtain a target segment list; the target segment list is composed of ordered segment identifiers, a segment identifier in the target segment list is used to represent a node in a network, and the target segment list is used to define a forwarding path; a message generating unit configured to generate a source address verification message based on the segment routing policy; and a forwarding unit configured to forward the source address verification message according to the forwarding path.

[0027] According to still another aspect of the present disclosure, a message propagation apparatus is provided, the apparatus comprising: a matching unit configured to receive a source address verification message, and to find a match of a segment list in the source address verification message with one or more segment lists configured locally, the source address verification message being generated based on a segment routing policy, the one or more segment lists configured locally being used to identify a role of the forwarding router in a segment routing network; a message processing unit configured to process the source address verification message if a match is found; and a message flooding unit configured to flood the source address verification message if no match is found.

[0028] According to still another aspect of the present disclosure, an electronic device is provided, comprising: one or more processors; a storage configured to store one or more programs, which when executed by the one or more processors, cause the one or more processors to implement a message propagation method as described in the above embodiments.

[0029] According to still another aspect of the present disclosure, a computer readable storage medium is provided, having stored thereon a computer program, which when executed by a processor, implements a message propagation method as described in the above embodiments.

[0030] According to still another aspect of the present disclosure, a computer program product is also provided, comprising a computer program, which when executed by a processor, implements a message propagation method as described in the above embodiments.

[0031] It should be understood that the general description above and the following detailed description are only exemplary and explanatory, and are not intended to limit the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0032] The accompanying drawings, which are incorporated in and constitute a part of the specification, illustrate embodiments consistent with the present disclosure and serve to explain the principles of the present disclosure, and are not intended to limit the present disclosure.

[0033] FIG. 1 shows a schematic diagram of a network scenario to which embodiments of the present disclosure are applicable;

[0034] FIG. 2 shows a flow chart of a message propagation method according to an embodiment of the present disclosure;

[0035] FIG. 3 shows a flow chart of a message propagation method according to still another embodiment of the present disclosure;

[0036] FIG. 4 shows a schematic diagram of a corporate network topology to which embodiments of the present disclosure are applicable;

[0037] FIG. 5 shows a schematic diagram of a structure of a message propagation apparatus according to an embodiment of the present disclosure;

[0038] Figure 6 shows a schematic diagram of the structure of a message transmission device according to yet another embodiment of the present disclosure;

[0039] Figure 7 shows a structural block diagram of an electronic device according to an embodiment of the present disclosure. Detailed Implementation

[0040] Exemplary embodiments will now be described more fully with reference to the accompanying drawings. However, these exemplary embodiments can be implemented in many forms and should not be construed as limited to the examples set forth herein; rather, they are provided so that this disclosure will be more comprehensive and complete, and will fully convey the concept of the exemplary embodiments to those skilled in the art. The described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments.

[0041] Furthermore, the accompanying drawings are merely illustrative of this disclosure and are not necessarily drawn to scale. The same reference numerals in the drawings denote the same or similar parts, and therefore repeated descriptions of them will be omitted. Some block diagrams shown in the drawings are functional entities and do not necessarily correspond to physically or logically independent entities. These functional entities may be implemented in software, in one or more hardware modules or integrated circuits, or in different network and / or processor devices and / or microcontroller devices.

[0042] It should be noted that the ordinal numbers such as "first" and "second" mentioned in the embodiments of this disclosure are used to distinguish multiple objects, and are not used to limit the order, timing, priority or importance of multiple objects. Furthermore, the descriptions of "first" and "second" do not limit the objects to necessarily being different.

[0043] Figure 1 illustrates a network scenario applicable to an embodiment of this disclosure. The network scenario shown in Figure 1 includes a source server S1, a destination server D1, routers R11, R12, R13, R14, R15, R16, and R17. Routers R11, R12, R13, R14, R15, R16, and R17 belong to the same network, which can be a segment routing (SR) network. These routers can be router devices, switches, or any other devices with routing capabilities. The devices can be physical devices or virtualized devices with routing capabilities; this disclosure does not impose specific limitations.

[0044] Those skilled in the art will understand that the number of routers in this network scenario can be more or less. For example, there could be dozens or hundreds, or even more, routers. This disclosure does not limit the number or type of routers.

[0045] Referring to FIG. 1, there are multiple forwarding paths between the source server S1 and the destination server D1, for example, one forwarding path is source server S1->router R11->router R12->router R13->router R15->router R17->destination server D1, and for example, one forwarding path is source server S1->router R11->router R12->router R14->router R16->router R17->destination server D1.

[0046] Optionally, the network scenario can further include a controller, which is connected to each router through a wireless network or a wired network, and is configured to set a corresponding forwarding path for different data packets. The controller can be at least one of a server, multiple servers, a cloud computing platform, and a virtualization center. When the controller is multiple, there can be at least two controllers for providing different services, and / or there can be at least two controllers for providing the same service, such as providing the same kind of service in a load balancing manner, which is not limited in the embodiments of the present disclosure.

[0047] FIG. 2 shows a flowchart of a message propagation method according to an embodiment of the present disclosure. The message propagation method provided by the embodiment of FIG. 2 can be executed by a head-end router, such as the router R11 in FIG. 1. Referring to FIG. 2, the message propagation method specifically includes the following steps S210 to S230.

[0048] In step S210, the head-end router parses a segment routing policy sent by the controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, and the segment identifiers in the target segment list are used to represent nodes in the network, and the target segment list is used to define a forwarding path.

[0049] In step S220, the head-end router generates a source address verification message based on the segment routing policy.

[0050] In step S230, the head-end router forwards the source address verification message according to the forwarding path.

[0051] The message transmission method provided by the embodiments of the present disclosure is an SAV message propagation method based on SR-policy, which is a policy-based message delivery method, and is similar to PBR to some extent. SR-policy allows the operator to define a clear path, and the data packet is delivered along the defined path, which can be specified by a series of segment identifiers (Segment Identifier, SID). Similar to PBR, the path defined by SR-policy can be defined based on various policies, such as traffic type, source address, destination address, etc.

[0052] For ease of understanding, the following is an example of SAV message propagation based on SR-policy. The basic concept of SR-policy: Segment Identifier (SID), which is an identifier for each path segment, used to guide traffic in the network; Segment List, which is a list of a series of SIDs, defines the path of traffic from the source server to the destination server; SR-policy, which is a complete policy, contains one or more Segment Lists, each Segment List represents an alternative path. SAV message propagation: In a network configured with SR-policy, SAV messages propagate along the paths defined by SR-policy. Routers on each path propagate SAV messages hop by hop according to the Segment List specified by SR-policy.

[0053] In a network configured with SR-policy, the controller generates and issues SR-policy to nodes that need to perform specific traffic processing or forwarding operations. These nodes are usually key nodes in the network, such as gateways, core routers or edge routers. In the embodiments of the present disclosure, the controller will issue the SR-policy directly to the head-end router that establishes a neighbor with the controller. After receiving the SR-policy, the head-end router will parse it and extract the segment list and related policy.

[0054] After receiving the SR-policy from the controller, the head-end router will perform a series of parsing operations. First, it will parse and extract the Segment List in the SR-policy, which is an ordered list of SIDs, each representing a specific node or service in the network. Then, the head-end router will extract the policy information related to these SIDs, which may include the selection of forwarding paths, QoS (Quality of Service) parameters, etc. Further, the head-end router obtains the target segment list from the segment list according to the policy information. Among them, the SR-policy includes multiple segment lists, and the target segment list is selected from the multiple segment lists by the head-end router according to the policy information. The target segment list is composed of ordered segment identifiers, and the segment identifiers in the target segment list are used to represent nodes in the network. The target segment list is used to define the forwarding path, and the traffic is delivered from the source server to the destination server according to the defined forwarding path.

[0055] After the head-end router SR-policy, the SAV message can be generated based on the SR-policy, and the SAV message is propagated according to the forwarding path defined by the segment list, so as to ensure that the SAV message reaches all related routers according to the forwarding path, and to ensure that these related routers create corresponding SAV rules according to the SR-policy, and subsequent data packets can be guided by the SAV rules to guide the router to process the source address verification of the actual data packet.

[0056] Taking the network scenario shown in FIG. 1 as an example, in this scenario, the SR-policy path of the traffic from S1 to D1 is defined as passing through R11, R12, R13, R15, and finally R17, and the segment list of this SR policy path includes the segment identifiers of each router. For each router on the path: SID1 represents R11, SID2 represents R12, SID3 represents R13, SID5 represents R15, and SID7 represents R17. When the router R11 (head-end router) receives traffic from the source prefix 10.1.1.0 / 24, it generates a SAV message according to the SR policy for the target prefix 10.7.0.0 / 16. The SAV message includes the source router (R11), the neighbor router (R12), the source prefix (10.1.1.0 / 24), the target prefix (10.7.0.0 / 16), and the segment list [SID1, SID2, SID3, SID5, SID7]. The router R11 propagates the SAV message according to the segment list, so as to ensure that the SAV message reaches the routers R12, R13, R15 and R17, so that these routers can create corresponding SAV rules according to the SR-policy, and subsequent data packet source address verification can be performed according to the SAV rules.

[0057] In some embodiments of the present disclosure, the message propagation method further includes: the head-end router forwarding the source address verification message to other routers according to the forwarding path, so that the other routers create a source address verification rule at the receiving interface after receiving the source address verification message.

[0058] As a key node for traffic forwarding and processing, the head-end router, after receiving the SR-Policy, will perform a series of security and verification measures in addition to parsing it and extracting the segment list and related policies. One important step is to create a SAV rule based on the SR-Policy to ensure the accuracy and security of traffic forwarding.

[0059] The other routers refer to the routers on the forwarding path, and the other routers can also be referred to as key nodes, that is, key nodes of message propagation. After the head-end router generates the SAV message, the head-end router forwards the SAV message to the other routers according to the forwarding path. In this way, after the other routers receive the SAV message, the other routers create SAV rules at the receiving interfaces, and subsequent source address verification of data packets can be performed according to the SAV rules.

[0060] The SAV rules are mainly used to verify whether the source address of the data packet is legal and valid. In the SR-Policy environment, the router can encounter data packets from different source addresses, and these data packets can contain malicious or misleading information. Therefore, the router needs to verify the source address of the data packet to ensure that the data packet comes from a trusted source and meets the path specified in the SR-Policy.

[0061] In the embodiments of the present disclosure, after the head-end router generates the SAV message, the head-end router forwards the SAV message to the other routers according to the forwarding path. After the other routers receive the SAV message, the other routers create SAV rules at the receiving interfaces to verify whether the source address of the data packet is legal and valid according to the SAV rules.

[0062] In some embodiments of the present disclosure, the source address verification message includes a message type field, a source router field, a neighbor router field, a source prefix field, and a segment list field. The message type field is used to identify the type of the message. The source router field is used to identify the identifier of the source router. The neighbor router field is used to identify the identifier of the neighbor router. The source prefix field is used to identify the source prefix. The segment list field is used to identify the segment list defined by the segment routing policy.

[0063] In some embodiments of the present disclosure, the source address verification message further includes one or more of a security level field and a quality of service field. The security level field is used to indicate security requirements. The quality of service field is used to indicate quality of service requirements.

[0064] In the embodiments of the present disclosure, the SAV message generated based on the SR-policy includes the following fields:

[0065] Message type (MT): used to identify the type of the message. For example, it is indicated by the message type that the message is a SAV message, so that the receiving node triggers the corresponding processing logic according to the message type after receiving the message.

[0066] Source router (SR): used to identify the identifier of the source router.

[0067] Neighbor router (NR): used to identify the identifier of the neighbor router.

[0068] Source Prefix (SP): used to identify the source prefix, i.e. the prefix part of the IP address that needs to be verified for source address.

[0069] Segment List (SID_list): used to identify the segment list defined by the SR-policy, i.e. one of the key fields in the SAV message, which contains a series of ordered SIDs that define the forwarding path of the SAV message in the network. The information in the segment list is used to determine how to process (e.g. forward) the SAV message.

[0070] Security Level (SEC): an indication of security requirements, i.e. used to indicate the security level or policy that should be followed when processing the SAV message, which can include encryption requirements, authentication mechanisms, etc. to ensure the security of the message during transmission.

[0071] Quality of Service (QoS): an indication of service quality requirements, used to specify the QoS parameters that should be met when transmitting the SAV message in the network, such as bandwidth, delay, jitter, etc. to help ensure that the SAV message can be processed and forwarded in a timely manner according to network policies and service quality requirements.

[0072] In some embodiments of the present disclosure, the head-end router generates a source address verification message based on the segment routing policy, including: if the segment routing policy contains a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to the source prefix in the segment routing policy; the head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0073] In embodiments of the present disclosure, the head-end router generates a SAV message according to the SR-policy, and sets the message type (MT), source router (SR), neighbor router (NR), source prefix (SP), segment list (SID_list), security level (SEC), and quality of service (QoS) in the SAV message.

[0074] If the SR-policy is <srcIP, other, SID_list>, it means that the SR-policy contains a source prefix. In this case, the head-end router directly sets the source prefix (SP) field in the SAV message to srcIP, which is the specific source IP address, i.e. the IP address from which the data packet originates. The head-end router sets the value of the segment list (SID_list) field in the SAV message to the target segment list defined in the SR-policy, which is the path segment list that the data packet needs to follow when forwarding in the network.

[0075] In some embodiments of the present disclosure, the head-end router generates the source address verification message based on the segment routing policy, including: if the segment routing policy does not contain the source prefix, the head-end router sets the value of the source prefix field in the source address verification message to a default value according to the local traffic control policy; and the head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0076] If the SR-policy is <*, other, SID_list>, it means that the source prefix is not contained in the SR-policy. In this case, the head-end router sets the source prefix (SP) field in the SAV message to a default value, which is determined by the local traffic control policy. The head-end router sets the value of the segment list (SID_list) field in the SAV message to the target segment list defined in the SR-policy, which is the path segment list that the data packet needs to follow when forwarding in the network.

[0077] In some embodiments of the present disclosure, the head-end router generates the source address verification message based on the segment routing policy, including: the head-end router determines the value of the security level field in the source address verification message according to the security requirement in the segment routing policy; and the head-end router determines the value of the quality of service field in the source address verification message according to the quality of service requirement in the segment routing policy.

[0078] In the embodiments of the present disclosure, the security level (SEC) in the SAV message is set according to the security requirement defined in the SR-policy, and the quality of service (QoS) is set according to the quality of service requirement defined in the SR-policy.

[0079] In some embodiments of the present disclosure, the source address verification rule includes: a source prefix field and a valid interface list field; the source prefix field is used to identify the source prefix; and the valid interface list is used to identify the router interface that can receive the data packet from the specified source prefix.

[0080] In some embodiments of the present disclosure, the source address verification rule further includes one or more of a security level field and a quality of service field; the security level field is used to identify the policy for processing the data packet that does not meet the rule; and the quality of service field is used to identify the quality of service requirement related to the data packet processing.

[0081] The SAV rule is a rule configured on the router for verifying the source address of the data packet, which is generated according to the received SAV message, and is used to ensure that the source address of the data packet entering the router is legal. The SAV rule is statically configured on the router, and guides the router how to process the source address verification of the actual data packet. The fields contained in the SAV rule are as follows:

[0082] Source Prefix (SP): used to identify the source prefix that needs to be verified.

[0083] Valid Interface List: used to identify which interfaces can receive packets from the specified source prefix.

[0084] Security Level (SEC): used to define how to handle packets that do not meet the rules.

[0085] Quality of Service (QoS): used to indicate the quality of service requirements related to packet processing.

[0086] In some embodiments of the present disclosure, the segment routing policy includes an optional segment list, and the optional segment list is used to define an alternative path; the message propagation method further includes: if the forwarding path is interrupted or an unreachable node appears, the head-end router updates the source address verification message according to the alternative path to obtain a new source address verification message; and the head-end router propagates the new source address verification message according to the alternative path.

[0087] In an embodiment of the present disclosure, the SR-policy contains one or more segment lists, wherein the head-end router parses the SR-policy to obtain one or more segment lists, determines a target segment list according to the related policy, and performs message forwarding according to the forwarding path defined by the target segment list. In addition to the target segment list, the segment list can be defined as an optional segment list, and the optional segment list is used to define an alternative path.

[0088] If the forwarding path defined by the SR-policy (which can be referred to as a main path, i.e., the path defined by the target segment list) is interrupted or an unreachable node appears, the head-end router can re-adjust the segment list according to the alternative path, update the SAV message according to the adjusted segment list to obtain a new SAV message, and then forward the new SAV message according to the alternative path. In addition, during the message forwarding process, the security (SEC) and quality of service (QoS) requirements defined in the SR-policy are ensured to be met, for example, priority processing or transmission through a security node.

[0089] In some embodiments of the present disclosure, the message propagation method further includes: the head-end router identifies a specific node, and the specific node includes a load balancing node and a traffic monitoring node; and the head-end router inserts the specific node into the target segment list and adjusts the node order and the number of nodes in the target segment list.

[0090] The head-end router dynamically identifies and inserts specific nodes such as load balancing nodes and traffic monitoring nodes on the path to further optimize message transmission. The head-end router inserts the specific nodes into the target segment list according to real-time network analysis results and dynamically adjusts the node order and the number of nodes in the target segment list.

[0091] In some embodiments of the present disclosure, the target segment list includes a security node and a service node.

[0092] In the embodiments of the present disclosure, specific security nodes and service nodes can be introduced in the target segment list to ensure that the propagation of the SAV message meets the security and quality of service requirements. The security node refers to an authenticated and protected node for protecting the transmission security of the message and preventing malicious attacks. The service node refers to a node with specific QoS guarantee capability to ensure that the message is processed preferentially in the transmission process and meets the quality of service requirements.

[0093] In some embodiments of the present disclosure, if the target segment list defines multiple forwarding paths, the message propagation method further includes that the head-end router obtains the multiple forwarding paths and propagates the message on the multiple forwarding paths in parallel.

[0094] Defining multiple optional paths in the target segment list allows the message to be transmitted in parallel on multiple paths to increase reliability and transmission efficiency. Specifically, the optimal path or distributed path can be selected for message transmission according to the network state, and messages sharing the same source prefix and pointing to the same destination address can be combined before being sent to reduce communication overhead.

[0095] FIG. 3 shows a flowchart of a message propagation method according to another embodiment of the present disclosure. The message propagation method provided by the embodiment of FIG. 3 can be executed by a forwarding router. The forwarding router refers to a router in the network other than the head-end router, for example, the router R12 in FIG. 1. Referring to FIG. 3, the message propagation method specifically includes the following steps S310 to S330.

[0096] In step S310, the forwarding router receives a source address verification message and performs lookup matching between a segment list in the source address verification message and one or more locally configured segment identifiers. The source address verification message is generated based on a segment routing policy, and the one or more locally configured segment identifiers are used to identify the role of the forwarding router in the segment routing network.

[0097] In step S320, if the matching is successful, the forwarding router processes the source address verification message.

[0098] In step S330, if the matching is unsuccessful, the forwarding router does not process the source address verification message and performs flooding on the source address verification message.

[0099] After receiving the SAV message, the forwarding router determines whether it is a key node of message propagation. Specifically, after receiving the SAV message, the forwarding router performs a lookup matching through one or more segment identifiers locally configured by the segment list in the SAV message. If there is a current segment identifier of the segment list in the SAV message in the one or more segment identifiers locally configured, it is confirmed that the matching is successful, indicating that the forwarding router is located on the forwarding path and should process the SAV message. If it is confirmed that the matching is not successful, the forwarding router does not process the SAV message and floods the SAV message.

[0100] In some embodiments of the present disclosure, the forwarding router floods the source address verification message, including: if the forwarding router does not find the next hop node indicated by the neighbor router field in the source address verification message when forwarding the source address verification message, the forwarding router floods the source address verification message to all adjacent routers.

[0101] If the matching is not successful, it indicates that the forwarding router is not a key node, and the forwarding router forwards the SAV message to the node indicated by the neighbor router field (NR) in the SAV message. The neighbor router field (NR) is used to identify the identifier of the neighbor router, and in the embodiments of the present disclosure, the neighbor router field (NR) can be used to indicate the next hop node that should receive the SAV message. For example, after a certain forwarding router receives the SAV message, it updates the neighbor router field (NR) in the SAV message and sets it as the next hop node that should receive the SAV message, i.e., the next key node.

[0102] If the forwarding router is not a key node and the forwarding router does not find the node indicated by the neighbor router field (NR) in the SAV message, the forwarding router sends the received SAV information to all adjacent routers by using a flooding mechanism.

[0103] In addition, if the forwarding router is not a key node, the forwarding router does not need to add a SAV rule on the receiving interface according to the SR-Policy, so that the simplicity and security of the interface policy can be maintained.

[0104] In some embodiments of the present disclosure, the forwarding router processes the source address verification message, including: the forwarding router processes the source address verification message, identifies the interface receiving the source address verification message as a valid interface, creates a source address verification rule, and forwards the source address verification message to the next hop node according to the segment list in the source address verification message.

[0105] If the matching is successful, it indicates that the forwarding router is a key node, and the forwarding router processes the SAV message, identifies the interface receiving the SAV message as a valid interface, and creates a SAV rule.

[0106] In the embodiments of the present disclosure, the next hop node refers to the next key node. After the SAV message is propagated to the forwarding router, if the forwarding router is a key node, it means that the forwarding router is located on the forwarding path, i.e., the segment identifier of the forwarding router is in the segment list in the SAV message, and the segment identifier after the segment identifier of the forwarding router in the segment list is the segment identifier of the next hop node. The forwarding router can forward the SAV message to the next hop node according to the segment list in the SAV message.

[0107] If the next hop node is a neighboring node of the forwarding router, the forwarding router forwards the SAV message to the next hop node; if the next hop node is not included in the neighboring nodes of the forwarding router, it can be further determined to which node the SAV message is forwarded.

[0108] Taking the network scenario shown in FIG. 1 as an example, in this scenario, the SR-policy path of the traffic from S1 to D1 is defined as passing through R11, R12, R13, R15, and finally R17. The router R11 propagates the SAV message according to the segment list, propagates the SAV message to the router R12, and specifies that the interface pair thereof to R12 is valid for the traffic incoming from 10.1.1.0 / 24. The router R12 judges that it is a key node of the message propagation, determines that the neighboring nodes thereof include R13 and R14, determines the next hop node as R13 according to the segment list in the SAV message, and thus the router R12 determines to forward the SAV message to the router R13.

[0109] In some embodiments of the present disclosure, the message propagation method further includes: if the matching is met, the forwarding router updates the value of the neighbor node field in the source address verification message to the identifier of the next hop node in the forwarding path defined by the segment routing policy.

[0110] In some embodiments of the present disclosure, the message propagation method further includes: if the matching is met, the forwarding router updates the segment list in the source address verification message, so that the segment identifier of the next hop node becomes the current segment identifier of the segment list.

[0111] Each time the traffic passes through the node matched with the segment list in the SAV message, i.e., the forwarding router receiving the SAV message is a key node, the current segment identifier in the SAV message will be "consumed" (deleted or skipped from the segment list), the forwarding router will update the segment list in the SAV message, so that the segment identifier of the next hop node becomes the current segment identifier, and the forwarding router will also update the value of the neighbor router field (NR) in the SAV message to the segment identifier of the next hop node, so that the neighbor router field (NR) indicates the next hop node. In this way, it can be ensured that the SAV message propagates along the forwarding path defined by the SR-Policy.

[0112] Take the network scenario shown in FIG. 1 as an example for illustration, in which the SR-policy path of the traffic from S1 to D1 is defined as passing through R11, R12, R13, R15, and finally R17. Router R11 propagates the SAV message according to the segment list, propagates the SAV message to router R12, and specifies its interface to R12 as valid for the traffic incoming from 10.1.1.0 / 24. Router R12 determines to forward the SAV message to router R13, and router R12 specifies its interface to R13 as valid for the same source prefix. Subsequently, router R13 forwards the SAV message to router R15, and specifies its interface to R15 as valid. When router R15 receives the SAV message, it forwards the message to router R17, and specifies its interface to R17 as valid. Finally, router R17 identifies itself as the target router, processes the SAV message, creates a source address verification rule, specifies the traffic incoming from 10.1.1.0 / 24 as valid, and transmits the traffic to 10.7.0.0 / 16. In this way, the SAV message reaches routers R12, R13, R15, and R17, which can create corresponding SAV rules according to the SR-policy, and subsequently perform source address verification on the packets according to the SAV rules.

[0113] The following specific embodiments are listed to illustrate the message propagation method provided in the embodiments of the present disclosure. It is assumed that an enterprise network topology is shown in FIG. 4, which includes routers R41, R42, R43, R44, R45, and R46, and uses SR-policy rules to define the message transmission path and interface strategy.

[0114] The SR-policy rules are as follows:

[0115] The SR-policy of head-end router R41 is: <10.1.1.0 / 24, other, [R41, R43, R45]>

[0116] The SR-policy of head-end router R42 is: <*, other, [R42, R45, R46]>

[0117] According to the enterprise network topology shown in FIG. 4, the message propagation method of the embodiments of the present disclosure includes the following steps.

[0118] (1) Message generation and forwarding process.

[0119] Head-end router R41 generates a SAV message, with the following fields:

[0120] MT: SRP (based on SR-policy);

[0121] SR: R41;

[0122] NR: R43;

[0123] SP: 10.1.1.0 / 24;

[0124] SID_list: [R41, R43, R45];

[0125] SEC and QoS: set according to SR-policy.

[0126] (2) Message forwarding.

[0127] Router R43 receives the SAV message forwarded by head-end router R41, checks the forwarding path defined by SR-policy, determines that it is a key node, updates NR to R45, updates SID_list to [R45], and forwards the SAV message to router R45.

[0128] Router R45 receives the SAV message, checks the forwarding path defined by SR-policy, determines that it is a key node, and forwards the SAV message to the next hop.

[0129] If the message is forwarded from R41 to R43, which is not a direct neighbor of R41, then the message is forwarded from R41 to R42. Since R42 does not match the SID_list in the SAV message, R42 neither processes the message nor creates a SAV rule on the router receiving node according to SR-policy, but floods the message to find the next hop node specified by the SR-policy path, that is, the next key node. Similarly, in the SID_list path with R42 as the head-end node, R41, R43, and R44, when receiving the SAV message forwarded by R42, will not process the message and create a SAV rule according to SR-policy.

[0130] (3) Interface policy.

[0131] Routers R43 and R45, when receiving the SAV message, create a SAV rule on the corresponding receiving node according to the SR-policy received by R41. Since R42, R44, and R46 are not in the path, there is no need to create a SAV rule according to the SR-policy received by R41.

[0132] The message propagation method provided by the embodiments of the present disclosure provides a source address verification message propagation mechanism based on a segment routing strategy. A head-end router parses an SR-policy issued by a controller, and obtains a target segment list. The target segment list is composed of ordered segment identifiers, and is used to define a forwarding path. The head-end router generates a SAV message based on the SR-policy, and propagates the SAV message according to the forwarding path defined by the target segment list. It can be seen that the method can guide the SAV message through a defined path, and determine that the SAV message is propagated efficiently, safely and accurately. Therefore, the routers on the forwarding path can create corresponding SAV rules according to the SR-policy, and the routers can guide the source address verification of data packets according to the SAV rules subsequently.

[0133] In addition, the head-end router can dynamically adjust the segment list according to the network state and traffic, so as to optimize the propagation path of the message and improve the robustness and adaptability of the network. Through flexible definition of the segment list, the propagation path of the message can be controlled more finely, so as to ensure that the message reaches all related nodes along the optimal path, and ensure that corresponding SAV rules are created on all receiving nodes of the routers along the path, thereby avoiding the one-sidedness of creating SAV rules based on RIB and PBR. The use of the SR-policy can realize policy-based security and quality of service control, and by introducing specific security nodes and service nodes in the segment list, it can be ensured that the propagation of the message meets the security and quality of service requirements of the network.

[0134] FIG. 5 shows a structural schematic diagram of a message propagation apparatus according to an embodiment of the present disclosure. As shown in FIG. 5, the message propagation apparatus 500 includes a policy parsing unit 510, a message generating unit 520 and a forwarding unit 530.

[0135] The policy parsing unit 510 is configured to parse a segment routing policy sent by a controller, and obtain a target segment list. The target segment list is composed of ordered segment identifiers. The segment identifiers in the target segment list are used to represent nodes in a network, and the target segment list is used to define a forwarding path. The message generating unit 520 is configured to generate a source address verification message based on the segment routing policy. The forwarding unit 530 is configured to forward the source address verification message according to the forwarding path.

[0136] In some embodiments of the present disclosure, the forwarding unit 530 is further configured to forward the source address verification message to other routers according to the forwarding path, so that the other routers create a source address verification rule at a receiving interface after receiving the source address verification message.

[0137] In some embodiments of the present disclosure, the source address verification message comprises: a message type field, a source router field, a neighbor router field, a source prefix field and a segment list field; the message type field is used to identify the type of the message; the source router field is used to identify the identifier of the source router; the neighbor router field is used to identify the identifier of the neighbor router; the source prefix field is used to identify the source prefix; and the segment list field is used to identify the segment list defined by the segment routing policy.

[0138] In some embodiments of the present disclosure, the source address verification message further comprises one or more of a security level field and a quality of service field; the security level field is used to indicate the security requirement; and the quality of service field is used to indicate the quality of service requirement.

[0139] In some embodiments of the present disclosure, the message generating unit 520 is further configured to: if the segment routing policy contains the source prefix, set the value of the source prefix field in the source address verification message to the source prefix in the segment routing policy; and set the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0140] In some embodiments of the present disclosure, the message generating unit 520 is further configured to: if the segment routing policy does not contain the source prefix, set the value of the source prefix field in the source address verification message to a default value according to the local traffic control policy; and set the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

[0141] In some embodiments of the present disclosure, the message generating unit 520 is further configured to: determine the value of the security level field in the source address verification message according to the security requirement in the segment routing policy; and determine the value of the quality of service field in the source address verification message according to the quality of service requirement in the segment routing policy.

[0142] In some embodiments of the present disclosure, the source address verification rule comprises: a source prefix field and a valid interface list field; the source prefix field is used to identify the source prefix; and the valid interface list is used to identify the router interface that can receive the data packet from the specified source prefix.

[0143] In some embodiments of the present disclosure, the source address verification rule further comprises one or more of a security level field and a quality of service field; the security level field is used to identify the policy for processing the data packet that does not meet the rule; and the quality of service field is used to identify the quality of service requirement related to the data packet processing.

[0144] In some embodiments of the present disclosure, the segment routing policy comprises an optional segment list used to define an alternative path; the message generation unit 520 is further configured to update the source address verification message according to the alternative path to obtain a new source address verification message if the forwarding path is interrupted or an unreachable node appears; and the forwarding unit 530 is further configured to propagate the new source address verification message according to the alternative path.

[0145] In some embodiments of the present disclosure, the policy analysis unit 510 is further configured to identify a specific node, wherein the specific node comprises a load balancing node and a traffic monitoring node; and insert the specific node into the target segment list and adjust the order and number of nodes in the target segment list.

[0146] In some embodiments of the present disclosure, the target segment list comprises a security node and a service node.

[0147] In some embodiments of the present disclosure, if the target segment list defines multiple forwarding paths, the first forwarding unit 530 is further configured to obtain the multiple forwarding paths and propagate the message on the multiple forwarding paths in parallel.

[0148] FIG. 6 shows a structural schematic diagram of a message propagation apparatus according to another embodiment of the present disclosure. As shown in FIG. 6, the message propagation apparatus 600 comprises a matching unit 610, a message processing unit 620 and a message flooding unit 630.

[0149] The matching unit 610 is configured to receive a source address verification message and find a match between a segment list in the source address verification message and one or more locally configured segment lists; the source address verification message is generated based on a segment routing policy, and the one or more locally configured segment lists are used to identify a role of a forwarding router in a segment routing network. The message processing unit 620 is configured to process the source address verification message if a match is found. The message flooding unit 630 is configured to flood the source address verification message if a match is not found.

[0150] In some embodiments of the present disclosure, the message flooding unit 630 is further configured to flood the source address verification message to all adjacent routers if the forwarding router does not find a next hop node indicated by a neighbor router field in the source address verification message when forwarding the source address verification message.

[0151] In some embodiments of the present disclosure, the message processing unit 620 is further configured to process the source address verification message, identify an interface receiving the source address verification message as a valid interface, create a source address verification rule, and forward the source address verification message to a next hop node according to a segment list in the source address verification message.

[0152] In some embodiments of the present disclosure, the message processing unit 620 is further configured to update, if the match is found, a value of a neighbor node field in the source address verification message to an identifier of the next hop node in the forwarding path defined by the segment routing policy.

[0153] In some embodiments of the present disclosure, the message processing unit 620 is further configured to update, if the match is found, a segment list in the source address verification message so that the segment identifier of the next hop node becomes a current segment identifier of the segment list.

[0154] Since the message propagation apparatus embodiment solves problems by the similar principle as the above-mentioned method embodiments, the implementation of the message propagation apparatus embodiment can be referred to the implementation of the above-mentioned method embodiments, and the repeated parts will not be described herein.

[0155] FIG. 7 shows a structural block diagram of an electronic device in an embodiment of the present disclosure. It is noted that the electronic device shown in FIG. 7 is merely an example, and should not bring any limitation to the functions and usage range of the embodiments of the present disclosure.

[0156] As shown in FIG. 7, the electronic device 700 includes a central processing unit (CPU) 701, which can perform various appropriate actions and processes according to programs stored in a read-only memory (ROM) 702 or loaded from a storage portion 708 into a random access memory (RAM) 703. In the RAM 703, various programs and data required for the operation of the electronic device 700 are also stored. The CPU 701, the ROM 702, and the RAM 703 are connected to each other through a bus 704. An input / output (I / O) interface 705 is also connected to the bus 704.

[0157] The following components are connected to the I / O interface 705: an input portion 706 including a keyboard, a mouse, and the like; an output portion 707 including a cathode ray tube (CRT), a liquid crystal display (LCD), and the like, and a speaker, and the like; a storage portion 708 including a hard disk, and the like; and a communication portion 709 including a network interface card such as a LAN card, a modem, and the like. The communication portion 709 performs communication processing via a network such as the Internet. A drive 710 is also connected to the I / O interface 705 as necessary. A removable medium 711 such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, and the like is attached to the drive 710 as necessary, so that a computer program read therefrom is installed into the storage portion 708 as necessary.

[0158] In particular, the processes described above with reference to the flowcharts can be implemented as a computer software program in accordance with embodiments of the present disclosure. For example, embodiments of the present disclosure include a computer program product comprising a computer program carried on a computer readable medium, the computer program comprising program code for executing the methods illustrated by the flowcharts. In such embodiments, the computer program can be downloaded and installed from a network via the communication section 709, and / or installed from the removable medium 711. When the computer program is executed by the central processing unit (CPU) 701, the above-described functions defined in the system of the present disclosure are executed.

[0159] It should be noted that the computer readable medium shown in the present disclosure can be a computer readable signal medium or a computer readable storage medium or any combination of the two. The computer readable storage medium may, for example, but is not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, terminal device or device, or any combination of the above. More specific examples of computer readable storage media can include, but are not limited to, an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present disclosure, the computer readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, terminal device or device. In the present disclosure, the computer readable signal medium can include a data signal carried in a baseband or as part of a carrier wave, which carries computer readable program code. Such a propagated data signal can take many forms, including but not limited to electromagnetic signals, optical signals or any suitable combination thereof. The computer readable signal medium can also be any computer readable medium other than the computer readable storage medium, which can send, propagate or transmit programs for use by or in conjunction with an instruction execution system, terminal device or device. The program code contained on the computer readable medium can be transmitted by any suitable medium, including but not limited to wireless, wire, optical cable, RF, etc., or any suitable combination thereof.

[0160] The flow and block diagrams in the drawings represent possible architectural, functional, and operational architectures of systems, methods, and computer program products according to various embodiments of the present disclosure. In this regard, each block in the flow or block diagrams can represent a module, a segment, or a portion of code that comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that in some alternative implementations, the functions noted in the blocks can occur out of the order noted in the figures. For example, two blocks shown in succession may, in fact, be executed substantially concurrently or the blocks may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams and / or flowchart illustrations, and combinations thereof, can be implemented by special purpose hardware-based systems that perform the specified functions or operations, or combinations of special purpose hardware and computer instructions.

[0161] The units described in the embodiments of the present disclosure can be implemented by software, or by hardware. The units described can be arranged in a processor, for example, a processor can be described as including a policy analysis unit, a message generation unit, and a forwarding unit. In some cases, the names of the units do not constitute a limitation on the units themselves, for example, the policy analysis unit can also be described as a unit that analyzes a segment routing policy sent by a controller and obtains a target segment list.

[0162] As another aspect, the present disclosure also provides a computer-readable storage medium, which can be included in the electronic device described in the above embodiments, or can exist separately without being assembled into the electronic device. The computer-readable storage medium carries one or more programs, which, when executed by the electronic device, cause the electronic device to implement the method described in the above embodiments. For example, the electronic device can implement the steps shown in FIG. 2.

[0163] According to an aspect of the present disclosure, a computer program product or computer program is provided, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the method provided in various optional implementations of the above embodiments.

[0164] It should be understood that the number of any elements in the present disclosure is used by way of example only and not limitation, and any naming is only for distinction and does not have any limiting meaning.

[0165] Other embodiments of the disclosure will be apparent to those skilled in the art from consideration of the specification and practice of the features disclosed herein. It is intended that the disclosure be construed as including any patents, patent applications, publications, publications, aspects, sub-combinations, variations, modifications, and equivalent arrangements or adaptations that are within the scope of the disclosure. While specific embodiments of the disclosure have been described above, one skilled in the art will recognize that unintended embodiments and adaptations of this disclosure are possible. It is intended that the disclosure be construed as including any such unintended embodiments and adaptations that fall within the scope of the disclosure. Therefore, the specification and examples should be regarded as illustrative rather than restrictive, and all changes which come within the meaning and range of equivalency of the claims are to be embraced within the scope of the disclosure. Industrial applicability

[0166] The present disclosure is applicable to the field of network communication and security technology, and can guide the source address verification message through a defined path, determine that the source address verification message is efficiently, safely and accurately propagated, and enable the routers on the forwarding path to create corresponding source address verification rules as needed according to the segment routing policy, and then guide the routers to perform source address verification of data packets according to the source address verification rules.

[0167] It should be understood that the present disclosure is not limited to the precise structures described above and illustrated in the drawings and that various modifications and changes can be made without departing from the scope thereof. The scope of the present disclosure is limited only by the claims that follow.

Claims

1. A message propagation method, wherein, The method comprises: The head-end router parses the segment routing policy sent by the controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, the segment identifiers in the target segment list are used to represent nodes in the network, and the target segment list is used to define a forwarding path; The head-end router generates a source address verification message based on the segment routing policy; The head-end router forwards the source address verification message according to the forwarding path.

2. The method of claim 1, wherein, The method further comprises: The head-end router forwards the source address verification message to other routers according to the forwarding path, so that the other routers create a source address verification rule at a receiving interface after receiving the source address verification message.

3. The method of claim 1, wherein, The source address verification message comprises a message type field, a source router field, a neighbor router field, a source prefix field and a segment list field; The message type field is used to identify the type of the message; The source router field is used to identify the identifier of the source router; The neighbor router field is used to identify the identifier of the neighbor router; The source prefix field is used to identify the source prefix; The segment list field is used to identify the segment list defined by the segment routing policy.

4. The method of claim 3, wherein, The source address verification message further comprises one or more of a security level field and a quality of service field; The security level field is used to indicate security requirements; The quality of service field is used to indicate quality of service requirements.

5. The method of claim 3, wherein, The head-end router generates a source address verification message based on the segment routing policy, comprising: If the segment routing policy contains a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to the source prefix in the segment routing policy; The head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

6. The method of claim 3, wherein, The head-end router generates a source address verification message based on the segment routing policy, comprising: If the segment routing policy does not contain a source prefix, the head-end router sets the value of the source prefix field in the source address verification message to a default value according to a local traffic control policy; The head-end router sets the value of the segment list field in the source address verification message to the target segment list defined in the segment routing policy.

7. The method of claim 4, wherein, The head-end router generates a source address verification message based on the segment routing policy, comprising: The head-end router determines the value of the security level field in the source address verification message according to security requirements in the segment routing policy; The head-end router determines the value of the quality of service field in the source address verification message according to quality of service requirements in the segment routing policy.

8. The method of claim 2, wherein, The source address verification rule comprises a source prefix field and a valid interface list field; The source prefix field is used to identify the source prefix; The valid interface list is used to identify the router interfaces that can receive data packets from the specified source prefix.

9. The method of claim 8, wherein, The source address verification rule further comprises one or more of a security level field and a quality of service field; The security level field is used to identify the policy for processing data packets that do not meet the rule; The service quality field is used to identify quality of service requirements related to data packet processing.

10. The method of claim 1, wherein, The segment routing policy includes an optional segment list, which is used to define an alternative path; The method further includes: If the forwarding path is interrupted or an unreachable node appears, the head-end router updates the source address verification message according to the alternative path to obtain a new source address verification message; The head-end router propagates the new source address verification message according to the alternative path.

11. The method of claim 1, wherein, If the target segment list defines multiple forwarding paths, the method further includes: The head-end router obtains the multiple forwarding paths and propagates messages on the multiple forwarding paths in parallel.

12. A message propagation method, wherein, The method includes: A forwarding router receives a source address verification message, and performs lookup matching between a segment list in the source address verification message and one or more locally configured segment identifiers; the source address verification message is generated based on a segment routing policy, and the one or more locally configured segment identifiers are used to identify a role of the forwarding router in a segment routing network; If matching, the forwarding router processes the source address verification message; If not matching, the forwarding router does not process the source address verification message and floods the source address verification message.

13. The method of claim 12, wherein, The forwarding router floods the source address verification message, including: If the forwarding router does not find a next hop node indicated by a neighbor router field in the source address verification message when forwarding the source address verification message, the forwarding router floods the source address verification message to all adjacent routers.

14. The method of claim 12, wherein, The forwarding router processes the source address verification message, including: The forwarding router processes the source address verification message, identifies an interface receiving the source address verification message as a valid interface, creates a source address verification rule, and forwards the source address verification message to a next hop node according to a segment list in the source address verification message.

15. The method of claim 14, wherein, The method further includes: If matching, the forwarding router updates a value of a neighbor node field in the source address verification message to an identifier of a next hop node in a forwarding path defined by the segment routing policy.

16. The method of claim 14, wherein, The method further includes: If matching, the forwarding router updates a segment list in the source address verification message so that a segment identifier of the next hop node becomes a current segment identifier of the segment list.

17. A message propagation apparatus, wherein, The apparatus includes: A policy analysis unit configured to analyze a segment routing policy sent by a controller to obtain a target segment list; the target segment list is composed of ordered segment identifiers, a segment identifier in the target segment list is used to represent a node in a network, and the target segment list is used to define a forwarding path; A message generation unit configured to generate a source address verification message based on the segment routing policy; A forwarding unit configured to forward the source address verification message according to the forwarding path.

18. A message propagation apparatus, wherein, The apparatus includes: A matching unit configured to receive a source address verification message, and to find a match of a segment list in the source address verification message with one or more locally configured segment lists, the source address verification message being generated based on a segment routing policy, the one or more locally configured segment lists being used to identify a role of the forwarding router in a segment routing network; A message processing unit configured to process the source address verification message if a match is found; A message flooding unit configured to flood the source address verification message if no match is found.

19. An electronic device, comprising: Comprising: one or more processors; a memory configured to store one or more programs that, when executed by the one or more processors, cause the one or more processors to implement the message propagation method of any of claims 1-11, or to implement the message propagation method of any of claims 12-16.

20. A computer-readable storage medium storing a computer program, wherein, The computer program that, when executed by the processor, implements the message propagation method of any of claims 1-11, or to implement the message propagation method of any of claims 12-16.

21. A computer program product comprising a computer program that, when executed by the processor, implements the message propagation method of any of claims 1-11, or to implement the message propagation method of any of claims 12-16.

Images