SRv6 Packet Forwarding with SID-Based Security Authentication
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
The SRv6 packet forwarding is compromised by unreliable network nodes or links, leading to security vulnerabilities.
Innovation Solution
Implement security authentication processing on SRv6 packets based on instructions within the segment identifier (SID) of the packet header, including IPsec and HMAC, to enhance security by performing encapsulation or decapsulation as necessary.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If security authentication processing is performed on SRv6 packets, then security is improved, but device complexity increases
Solution Approach 1:
The patent applies preliminary action by embedding security authentication instructions and arguments directly into the SID (Segment Identifier) structure before packet transmission. The authentication mechanism is pre-configured in the segment list, allowing network nodes to perform authentication processing without requiring external security configurations or additional authentication handshakes, thus improving security while managing device complexity
Solution Approach 2:
The patent implements universality by designing the SID structure to serve multiple functions: routing guidance and security authentication. The function field within SID can indicate different operations including security authentication instructions, allowing the same data structure to handle both forwarding and security functions, thereby improving security without proportionally increasing device complexity
2Reliability
If security authentication processing is performed on SRv6 packets, then security is improved, but processing time increases
Solution Approach 1:
Authentication arguments are pre-computed and embedded in the SID structure before packet transmission. This eliminates the need for real-time authentication key retrieval and computation, allowing network nodes to perform rapid authentication by simply comparing pre-computed values, thus improving security while minimizing additional processing time
Solution Approach 2:
The patent replaces complex cryptographic authentication mechanisms with simplified comparison operations. By using pre-computed authentication arguments stored in the packet, nodes can verify authenticity through straightforward data comparison rather than performing computationally intensive cryptographic operations, reducing processing time while maintaining security
Data Source
Figure 1~4
Figure 5~6
Figure 7~8
AI summary
Disclosed is a method and an apparatus for packet forwarding, which relate to the network technology field and are applied to a network node. The method comprises: obtaining an SRV6 packet; if a function field in a target SID contains a security authentication instruction, obtaining a target argument based on an operation indicated by the security authentication instruction, and performing security authentication processing on the SRv6 packet based on the target argument; wherein, the target SID is an SID, corresponding to the network node, in a segment list carried by a header of the SRv6 packet, and the target argument is: an argument for the security authentication instruction recorded in the header; and forwarding the processed SRv6 packet to a next-hop device. By applying the solution for packet forwarding according to examples of the present disclosure, the security in forwarding the SRv6 packet along the SRv6 forwarding path can be improved.