Segment Routing Packet Handling for Secure Path-Based Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In segment routing, the dynamic change of destination addresses in an IPv6 protocol leads to uncertainty in the final destination of data packets, increasing the risk of failure in establishing session flows due to unpredictable path segments, especially in scenarios requiring secure access control.
Innovation Solution
A packet processing method that obtains a path segment identifier from the segment routing header and sends the data packet to a service node based on an access control policy, enabling secure processing and transmission, thereby ensuring secure services and avoiding network risks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If segment routing is used to guide data packets through specific paths, then traffic engineering is realized, but the final destination becomes uncertain and session flow establishment fails
Solution Approach 1:
The patent applies preliminary action by performing access control checking before the data packet reaches its final destination. The network device checks whether the data packet needs to be forwarded to an access control server based on the segment routing header information, and establishes session flows in advance. This preliminary intervention ensures that even though the destination address dynamically changes, the access control policy can be enforced at an intermediate node, thereby maintaining session flow establishment reliability while preserving traffic engineering capabilities.
2Adaptability or versatility
If the destination address is dynamically changed based on the segment list, then path flexibility is improved, but the risk of secure processing failure increases
Solution Approach 1:
The patent introduces an intermediary mechanism by using the segment routing header as a mediator between the dynamic destination address and the access control policy. The network device extracts path segment identifier information from the segment routing header and uses it to determine whether forwarding to an access control server is needed. This intermediary approach allows the system to maintain path flexibility through dynamic destination addresses while mitigating secure processing risks by enabling intermediate access control checks.
3Productivity
If access control is not performed on data packets with dynamic destinations, then network throughput is maintained, but network security vulnerabilities increase
Solution Approach 1:
The patent applies local quality by implementing access control checking selectively at specific network nodes rather than universally across all nodes. The network device determines whether a data packet needs access control processing based on local evaluation of the segment routing header and configured policies. This localized approach ensures that access control is performed only where necessary, maintaining network throughput by avoiding unnecessary forwarding to access control servers while still addressing security vulnerabilities at critical points in the network.
Data Source
Figure 1~2
Figure 3A
Figure 3B
AI summary
The present disclosure provides a packet processing method, apparatus, and device. The method includes: obtaining a data packet, wherein the data packet comprises a segment routing header; obtaining a path segment identifier from the segment routing header; if there is an access control policy corresponding to the path segment identifier, and the access control policy comprises path information which is configured to send the data packet to a service node, sending the data packet to the service node based on the access control policy, so that the service node performs secure processing on the data packet; if the data packet returned by the service node is received, sending the data packet based on the segment routing header of the data packet. Through the application solution, access control of the data packet can be realized based on the path segment identifier.