CN107547558B

CN107547558B - Access method and device for SMA networking

Info

Publication number: CN107547558B
Application number: CN201710840584.7A
Authority: CN
Inventors: 徐燕成
Original assignee: Hangzhou H3C Technologies Co Ltd
Current assignee: New H3C Information Technologies Co Ltd
Priority date: 2017-09-18
Filing date: 2017-09-18
Publication date: 2020-09-08
Anticipated expiration: 2037-09-18
Also published as: CN107547558A

Abstract

The application provides an access method and device for checking SMA networking based on a forged source address of a state machine, wherein an autonomous system AS boundary router AER in the SMA networking executes the following method: receiving a first message sent by a terminal outside the SMA networking; acquiring the designated position in the SMA message header of the first message; if the value of the designated bit is matched with a first preset value, the first message is confirmed to be an authentication message sent to an ACS (autonomous System control Server) in the SMA network by a terminal outside the SMA network; redirecting the authentication message to an ACS in the AS for authentication; receiving an authentication result returned by the ACS, and allowing the terminal to access the AS if the authentication result is passed; and if the authentication result is that the terminal does not pass, prohibiting the terminal from accessing the AS. Therefore, the process that the SMA networking external terminal is accessed to the SMA networking is completed, and the remote office of the SMA networking external terminal is realized.

Description

Access method and device for SMA networking

Technical Field

The present application relates to the field of communications technologies, and in particular, to an access method and an access device for SMA networking.

Background

The SMA (State Machine based Anti-spoofed source address inspection) network is an end-to-end source address verification scheme between IPv6(Internet Protocol Version 6, Version 6 Internet Protocol) autonomous systems, and is used to prevent the attack of spoofing source IPv6 addresses. The SMA network includes a trust federation formed of mutually trusted ASs (autonomous systems), which includes an ACS (AS Control Server) and an AER (AS Edge Router) connected to the ACS.

After the ACS registers to the REG (Registration Center, federation Registration Center) to become a member of the trust federation, the REG is responsible for notifying the Registration information of the ACS to other ACS members in the same trust federation, so that the ACS knows which ACS belong to the same trust federation, the ACS establishes connection with the ACS members, and sends information such AS an IPv6 address prefix and a message label learned by the local ACS and other ACS members in the trust federation to the AER of the AS, so that the AER forwards the received data message according to the information such AS the IPv6 address prefix and the message label.

For the message sent by the AS belonging to the non-trust alliance, the message can be identified by the AER and discarded when entering the AER, so AS to ensure that the AS in the trust alliance cannot be attacked by the non-trust alliance or an illegal host.

Disclosure of Invention

In view of this, the present application provides an access method and an access device for SMA networking, so as to solve the problem that an SMA networking external terminal cannot access SMA networking.

Specifically, the method is realized through the following technical scheme:

in a first aspect of the present application, an access method for SMA networking is provided, where the method is applied to an AER in an SMA networking, and includes:

receiving a first message sent by a terminal outside the SMA networking;

acquiring the designated position in the SMA message header of the first message;

if the value of the designated bit is matched with a first preset value, confirming that the first message is an authentication message sent to an ACS in the SMA network by a terminal outside the SMA network;

redirecting the authentication message to an ACS in the AS for authentication;

receiving an authentication result returned by the ACS, and allowing the terminal to access the AS if the authentication result is passed; and if the authentication result is that the terminal does not pass, prohibiting the terminal from accessing the AS.

In a second aspect of the present application, an access method for SMA networking is provided, where the method is applied to a terminal outside SMA networking, and includes:

generating a message and packaging an SMA (shape memory alloy) head for the generated message; the value of the designated bit in the SMA head is a first preset value, and the first preset value is used for representing that the message is an authentication message;

and sending the encapsulated message to an AER in the SMA networking so that the AER redirects the received message to an ACS for authentication according to the value of the designated bit.

In a third aspect of the present application, an AER is provided, having the functionality to implement the method of the first aspect. The functions can be realized by hardware, and the functions can also be realized by executing corresponding software by hardware. The hardware or software includes one or more modules or units corresponding to the above functions.

In one possible implementation, the AER includes:

the receiving unit is used for receiving a first message sent by a terminal outside the SMA networking;

an obtaining unit, configured to obtain a specified bit in an SMA packet header of the first packet;

the confirmation unit is used for confirming that the first message is an authentication message sent to an ACS (autonomous System control Server) in the SMA network by a terminal outside the SMA network when the value of the designated bit is matched with a first preset value;

a sending unit, configured to redirect the authentication packet to an ACS in the AS for authentication;

the receiving unit is further configured to receive an authentication result returned by the ACS; if the authentication result is passed, allowing the terminal to access the AS; and if the authentication result is that the terminal does not pass, prohibiting the terminal from accessing the AS.

In another possible implementation, the AER includes a communication interface, a processor, a memory, and a bus, and the communication interface, the processor, and the memory are connected to each other through the bus; the processor executes the access method of the SMA networking according to the first aspect of the present application by reading the logic instructions stored in the memory.

In a fourth aspect of the present application, a terminal is provided, where the terminal is located outside an SMA networking and has a function of implementing the method of the second aspect. The functions can be realized by hardware, and the functions can also be realized by executing corresponding software by hardware. The hardware or software includes one or more modules or units corresponding to the above functions.

In a possible implementation manner, the terminal includes:

the message processing unit is used for generating a message and packaging an SMA (shape memory alloy) head for the generated message; the value of the designated bit in the SMA head is a first preset value, and the first preset value is used for representing that the message is an authentication message;

and the sending unit is used for sending the encapsulated message to an AER in the SMA networking so that the AER redirects the received message to an ACS for authentication according to the value of the designated bit.

In another possible implementation manner, the terminal includes a communication interface, a processor, a memory, and a bus, where the communication interface, the processor, and the memory are connected to each other through the bus; the processor executes the access method of the SMA networking according to the second aspect of the present application by reading the logic instructions stored in the memory.

The method and the device give new meanings to original fields of SMA message headers, when receiving a message sent by a terminal outside an SMA network, an AER does not immediately discard the message, but checks a value of a designated bit in the SMA message header of the message first, and if the value is matched with a first preset value configured in advance, the message is considered AS an authentication message, so that the message is redirected to an ACS in the AS for authentication, and if the authentication is passed, the terminal outside the SMA network can be added and accessed to the SMA network, so that the remote office is realized.

Drawings

FIG. 1 is a schematic diagram of an SMA networking provided herein;

FIG. 2 is a flow chart of a method provided herein;

fig. 3 is an interaction flowchart among the SMA networking external terminal, the AER, and the ASC provided in the present application;

FIG. 4 is a functional block diagram of an AER provided herein;

FIG. 5 is a hardware architecture diagram of the AER of FIG. 4 provided herein;

fig. 6 is a functional block diagram of a terminal provided in the present application;

fig. 7 is a diagram of the hardware architecture of the terminal shown in fig. 6 provided herein.

Detailed Description

Reference will now be made in detail to the exemplary embodiments, examples of which are illustrated in the accompanying drawings. When the following description refers to the accompanying drawings, like numbers in different drawings represent the same or similar elements unless otherwise indicated. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Rather, they are merely examples of apparatus and methods consistent with certain aspects of the present application, as detailed in the appended claims.

The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application. As used in this application and the appended claims, the singular forms "a", "an", and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It should also be understood that the term "and/or" as used herein refers to and encompasses any and all possible combinations of one or more of the associated listed items.

It is to be understood that although the terms first, second, third, etc. may be used herein to describe various information, such information should not be limited to these terms. These terms are only used to distinguish one type of information from another. For example, first information may also be referred to as second information, and similarly, second information may also be referred to as first information, without departing from the scope of the present application. The word "if" as used herein may be interpreted as "at … …" or "when … …" or "in response to a determination", depending on the context.

In the SMA networking shown in fig. 1, the SMA networking internally includes AS _ A, AS _ B, AS _ C, and REG, and the SMA networking externally includes AS _ D and AS _ E; after registration, the three ACS can learn the IPv6 address (or IPv6 address prefix) and the mutual negotiation message label configured in the opposite AS each other, and send the obtained IPv6 address (or IPv6 address prefix) and the message label to the AER of the local AS, so that the AER can forward the received data message according to the information such AS the IPv6 address prefix and the message label. In fig. 1, AS _ D and AS _ E belong to an untrusted alliance for an SMA network, and for messages originating from AS _ D and AS _ E, when entering the SMA networking, they are identified by an edge device AER in the SMA networking and discarded.

Due to the characteristics of SMA networking, in an actual environment, such as when an SMA networking mode is applied to an enterprise intranet and a campus network, a user can only work in the SMA networking and cannot work remotely.

In order to solve the problem, the application provides an authentication scheme for the SMA networking external terminal, and after the ACS in the SMA networking passes the authentication of the SMA networking external terminal, the SMA networking external terminal can normally access the SMA networking.

Hereinafter, a part of the concept related to the present application will be explained first.

First to sixth preset values: in the application, if a terminal outside the SMA networking wants to access the SMA networking, the authentication of the ACS in the SMA networking needs to be obtained first. In order to realize the authentication process, the method gives a new meaning to the original field in the original SMA message header, and specifically comprises the following steps:

1) when the designated position in the SMA message header of the message is a first preset value, the message is an authentication message which is sent to an ACS in the SMA network by a terminal outside the SMA network, and the authentication message carries a user name and a password of the terminal, can be used for requesting the ACS to authenticate the legality of the terminal and can also be used for requesting the ACS to renew the authenticated terminal;

2) when the designated position in the SMA message header of the message is a second preset value, the message is an authentication response message sent to a terminal outside the SMA network by the ACS in the SMA network, and the authentication response message is used for informing whether the terminal passes authentication or not; if the authentication is passed, the authentication response message also carries a message label distributed by the ACS for the terminal;

3) when the designated position in the SMA message header of the message is a third preset value, the message is a discovery message sent to the ACS in the SMA network by the terminal outside the SMA network, and the terminal can send the discovery message before sending the authentication message to discover the ACS in the SMA network;

4) when the designated position in the SMA message header of the message is a fourth preset value, the message is a discovery response message which is sent to a terminal outside the SMA network by the ACS in the SMA network, the discovery response message is used for informing the terminal that the ACS in the AS can provide authentication service, and the terminal sends the authentication message to the ACS after receiving the discovery response message;

5) when the designated position in the SMA message header of the message is a fifth preset value, the message is a data message which is sent to equipment (including an ACS (auto-configuration server), a terminal and the like) in the SMA network by a terminal outside the SMA network;

6) and when the designated position in the SMA message header of the message is a sixth preset value, the message is a data message which is sent to a terminal outside the SMA network by the equipment in the SMA network.

Message labeling: in the same trust alliance, AS pairs are formed according to the transmission directions of data messages between the ases, and message labels corresponding to the AS pairs are set, for example, if AS1 is used AS a source AS for sending the data messages, and AS2 is used AS a destination AS for receiving the data messages, then AS1 and AS2 form an ordered AS pair, the AS pair corresponds to a message label, and the message label is a corresponding message label when AS1 sends the data messages to AS 2. The ACS of the local AS generates an SMA table item based on the learned IPv6 address (or IPv6 address prefix) configured in the opposite AS and the message label negotiated with the ACS of the opposite AS, and sends the SMA table item to the local AER, wherein the SMA table item records the corresponding relation between the IPv6 address (or IPv6 address prefix) and the message label. After receiving the data message, the local AER filters the data message according to the address information of the data message and the SMA entry received from the local ACS, specifically, if the address information and the message label of the data message are matched with the locally stored SMA entry, the data message is allowed to be forwarded, otherwise, the data message is discarded. In the application, after the authentication of the terminal outside the SMA networking is passed, the ACS also distributes the message label to the terminal outside the SMA networking, so that the communication between the terminal outside the SMA networking and the equipment in the SMA networking can be realized.

The technical scheme of the application is described in the following with the accompanying drawings and various embodiments of the specification.

Referring to fig. 2, in an embodiment, to enable a terminal outside an SMA networking to access the SMA networking, an AER in the SMA networking performs the following steps in an operation process:

step 201: and receiving a first message sent by a terminal outside the SMA networking.

Step 202: and acquiring the designated position in the SMA message header of the first message.

Step 203: and if the value of the designated bit is matched with the first preset value, confirming that the first message is an authentication message sent to the ACS in the SMA network by a terminal outside the SMA network.

Step 204: and redirecting the authentication message to the ACS in the AS for authentication.

Step 205: receiving the authentication result returned by the ACS, and allowing the terminal to access the AS if the authentication result is passed; and if the authentication result is that the terminal does not pass, the terminal is prohibited from accessing the AS.

It can be seen from steps 201 to 205 that, the present application assigns a new meaning to the original field of the SMA message header, and when the AER receives the message sent by the terminal outside the SMA networking, the AER does not immediately discard the message, but first checks the value of the specified location in the SMA message header of the message, and if the value matches with the first preset value configured in advance, the message is considered AS an authentication message, so AS to redirect the message to the ACS in the AS for authentication, and if the authentication passes, the terminal outside the SMA network can join and access the SMA network, thereby implementing the remote office.

Referring to fig. 3, a specific implementation process of the present application is described below through interaction between an SMA networking external terminal and AER and ACS in SMA networking.

Step 301: and the SMA networking external terminal sends a discovery message with the value of the designated position in the SMA message header as a third preset value to the AER.

Because the AS outside the SMA networking belongs to the untrusted alliance, when accessing the SMA networking, the terminal outside the SMA networking actively initiates connection and adds an SMA message header into a sent message.

Here, the source IP address of the discovery packet sent by the terminal is a terminal IP address, and the destination IP address is an HTTP (hypertext Transfer Protocol) server address of a website accessed by the terminal.

Step 302: after receiving the message, the AER acquires the designated bit in the SMA message header of the message, and if the value of the designated bit is found to be matched with the third preset value, the AER confirms that the message is a discovery message sent to the ACS by the SMA networking external terminal, so that the discovery message is redirected to the ACS in the AS.

The process of redirecting the discovery message to the ACS specifically comprises the following steps: and modifying the destination IP address of the discovery message into the IP address of the ACS in the AS, and then forwarding the modified discovery message to the ACS.

As an embodiment of the present application, here, the AER may further establish a temporary entry for the terminal, where a correspondence between the IP address of the terminal and the address of the HTTP server accessed by the terminal is recorded in the temporary entry.

The temporary table entry may have the following two purposes:

first, when the subsequent AER receives the message sent by the ACS to the SMA networking external terminal, the address conversion can be performed on the message responded by the ACS by using the temporary table entry, so that the SMA networking external terminal cannot sense the real address of the ACS, and the ACS is effectively protected.

Secondly, in step 302, if the AER determines to receive the discovery packet sent by a certain terminal, it may first search whether a temporary entry matching the IP address of the terminal exists locally, if so, discard the discovery packet, and if not, redirect the discovery packet to the ACS in the local AS. The reason for this is that the terminal outside the SMA networking may send multiple discovery messages before receiving the response of the ACS, and if the AER has a temporary entry matching the IP address of a certain terminal, it indicates that the AER has forwarded the discovery message of the terminal to the ACS, so the discovery message sent repeatedly may be discarded to reduce the impact on the ACS.

Step 303: and after the ACS receives the message with the value of the designated bit in the SMA message header as the third preset value and determines that the message is a discovery message, the ACS modifies the value of the designated bit into the fourth preset value, exchanges the source IP address and the destination IP address of the message, and then sends the modified message to the AER.

The message sent by ACS to AER is the discovery response message, the source IP address of the message is the IP address of ACS, the destination IP address is the IP address of the terminal outside SMA networking, and the message content is the same as the discovery message.

As an embodiment, the ACS may also start a timer while (or after) sending the discovery response message to the AER, and wait for the terminal to initiate authentication. If the timer is overtime and still does not receive the authentication message sent by the terminal, or the authentication error of the terminal reaches the set times (if the authentication fails to reach 5 times) in the period of validity of the timer, the ACS can issue a silent table item aiming at the terminal to the AER, and after the AER receives the silent table item, the AER can not forward the message from the terminal to the ACS within the preset time (such as 30 minutes), so that the ACS can be prevented from being impacted to a certain extent.

Step 304: and after receiving the discovery response message with the designated bit value of the fourth preset value in the SMA message header sent by the ACS, the AER forwards the discovery response message to the SMA networking external terminal.

When the AER forwards the discovery response message to the terminal, the source IP address of the discovery response message can be modified from the IP address of the ACS to the HTTP server address corresponding to the destination IP address of the discovery response message recorded in the temporary table entry by using the established temporary table entry, and then the modified discovery response message is forwarded to the SMA networking external terminal. In the forwarding process, the AER does not modify the message content of the discovery response message.

Step 305: and after the terminal receives the message with the value of the designated position in the SMA message header as the fourth preset value and determines that the message is a discovery response message, the terminal sends an authentication message with the value of the designated position in the SMA message header as the first preset value to the AER.

Here, the source IP address and the destination IP address of the authentication packet sent by the terminal are the same as the source IP address and the destination IP address of the discovery packet sent by the terminal in step 301. In addition, the authentication message also carries the user name and the password of the terminal.

Step 306: after receiving the message, the AER acquires the designated bit in the SMA message header of the message, and if the value of the designated bit is matched with the first preset value, the AER confirms that the message is an authentication message sent to the ACS by the SMA networking external terminal, so that the authentication message is redirected to the ACS in the AS.

The process of redirecting the authentication message to the ACS specifically comprises the following steps: and modifying the destination IP address of the authentication message into the IP address of the ACS in the AS, and then forwarding the modified authentication message to the ACS.

Step 307: and after receiving the message with the specified position value in the SMA message header as the first preset value and determining that the message is an authentication message, the ACS authenticates the user name and the password carried by the authentication message and sends an authentication response message with the specified position value of the SMA message header as the second preset value to the AER based on the authentication result.

And whether the authentication is passed or not, the SMA message type value of the authentication response message is a second preset value. If the authentication is passed, the message label distributed to the terminal by the ACS is carried in the SMA message header of the authentication response message, and the message label is used for carrying data messages coming and going between the terminal and the AS; and if the authentication is not passed, the message label is not carried in the SMA message header of the authentication response message.

Step 308: and after receiving the authentication response message with the specified position value of the second preset value in the SMA message header sent by the ACS, the AER forwards the authentication response message to the SMA networking external terminal.

When the AER forwards the authentication response message to the terminal, the source IP address of the authentication response message can be modified from the IP address of the ACS to the HTTP server address corresponding to the destination IP address of the authentication response message recorded in the temporary table entry by using the temporary table entry established above, and then the modified authentication response message is forwarded to the SMA networking external terminal.

As an embodiment, in a scenario that the authentication passes, the AER also locally stores an SMA entry corresponding to the terminal, where the SMA entry records a correspondence between a packet tag allocated by the ACS to the terminal and an IP address of the terminal. The SMA table entry may be generated by the ACS and sent to the AER, or the AER may generate itself according to the destination IP address of the received authentication response message and the message label carried by the authentication response message.

After the AER stores the SMA entry, the temporary entry may be deleted, and the aging time of the SMA entry may be set. Before the aging time of the SMA table entry is over, the SMA networking external terminal can continue the contract by sending the authentication message again, and the ACS can inform the contract continuing result by responding the authentication response message. If the agreement is successful, the authentication response message carries a new message label, and the data message sent to the ACS by the subsequent terminal also uses the new message label. The message label is modified once every other time, so that the safety and the timeliness of the message label are ensured. When the agreement continuation is successful, the aging time of the SMA table entry stored in the AER is also updated, and the message label recorded in the SMA table entry is also updated to a new message label.

When the aging time of the SMA table entry is reached, the AER can actively disconnect the connection between the SMA networking external terminal and the ACS by deleting the SMA table entry.

Step 309: the SMA networking external terminal receives the message with the value of the designated position in the SMA message header as a second preset value, and reads a message label from the authentication response message after determining that the message is the authentication response message; and if so, determining that the authentication is passed, and carrying the message label in a data message sent to the AS in the subsequent process.

The AS in step 309 refers to the AS where the ACS passes the authentication of the terminal, and if the terminal wants to access another AS in the SMA network, it needs to initiate an authentication request to the other AS, and the terminal can access the AS after the authentication passes.

The process of the SMA networking external terminal accessing the equipment in the AS specifically comprises the following steps:

1) the SMA networking external terminal sends a data message with the value of the designated position in the SMA message header being a fifth preset value to the AER; the data packet carries the packet tag read from the authentication response packet in step 309.

2) After receiving the message, the AER finds that the value of the designated position of the SMA message header of the message is matched with a fifth preset value, thereby confirming that the message is a data message sent to the equipment in the AS by the SMA networking external terminal, and further searching an SMA table item matched with the source IP address of the data message and a message label carried by the data message; if the data message is found, removing the message label in the data message, and then forwarding the data message to the AS equipment corresponding to the destination IP address of the data message; if not, the data message is discarded.

3) Assuming that the AS-in device receives the message with the value of the designated bit in the SMA message header being the fifth preset value and determines that the message is a data message, the AS-in device analyzes the data message, and sends the data message with the value of the designated bit in the SMA message header being the sixth preset value to the AER based on the processing result.

4) And after receiving the data message with the specified position value of the sixth preset value in the SMA message header sent by the ACS, the AER forwards the data message to the SMA networking external terminal.

Therefore, the equipment in the SMA network can be remotely accessed by the external terminal of the SMA network.

In an embodiment of the present application, the designated bit in the SMA header may be located in a DATA field or a reserved field of the SMA header.

The DATA field of the SMA header has 32 bits and is generally used to carry identification information such as a key in the prior art. The reserved field has 5 bits and is an unused reserved field.

When the value of the designated bit in the SMA head is the first preset value, that is, the message is an authentication message, the message may also include a user name and a password, and the user name and the password may also be carried in the DATA field or the reserved field. Similarly, when the value of the designated bit in the SMA message header is the second preset value, that is, the message is an authentication response message, the message may also include a message tag, and the message tag may also be carried in the DATA field or the reserved field.

The methods provided herein are described above. The apparatus provided in the present application is described below.

Referring to fig. 4, an AER provided for the present application may include:

the receiving unit 401 is configured to receive a first message sent by a terminal outside the SMA networking.

An obtaining unit 402, configured to obtain the specified bit in the SMA packet header of the first packet.

A confirming unit 403, configured to, when the value of the designated bit matches the first preset value, confirm that the first message is an authentication message sent to the ACS in the SMA network by a terminal outside the SMA network.

A sending unit 404, configured to redirect the authentication packet to an ACS in the AS for authentication.

The receiving unit 401 is further configured to receive an authentication result returned by the ACS; if the authentication result is passed, allowing the terminal to access the AS; and if the authentication result is that the terminal does not pass, prohibiting the terminal from accessing the AS.

In one embodiment, the receiving unit 401 is further configured to receive a second message returned by the ACS, where a value of the specified bit in an SMA message header of the second message is a second preset value, and the second preset value is used to represent that the second message is an authentication response message;

the sending unit 404 is further configured to forward the authentication response packet to the terminal;

when the message label is carried in the SMA message header of the authentication response message, the authentication result is represented AS passing, and the AER allows the terminal to access the AS; when the SMA message header of the authentication response message does not carry a message label, the authentication result is represented AS not passing, and the AER prohibits the terminal from accessing the AS; the message label is used for carrying data messages coming and going between the terminal and the AS.

In one embodiment, the AER may further comprise:

an SMA entry establishing unit, configured to store an SMA entry corresponding to the terminal when the AER allows the terminal to access the AS, where the SMA entry records a correspondence between the message tag and the IP address of the terminal;

the sending unit 404 and the receiving unit 401 are further configured to transmit a data packet between the terminal and the local AS based on the SMA entry.

In one embodiment, the determining unit 403 is further configured to determine that the first message is a discovery message sent to an ACS in an SMA network by a terminal outside the SMA network when a value of a designated bit in an SMA message header of the first message matches a third preset value; the discovery message is used for discovering ACS in the SMA networking;

the sending unit 404 is further configured to redirect the discovery packet to an ACS in the local AS;

the receiving unit 401 is further configured to receive a third message returned by the ACS, where a value of the designated bit in an SMA message header of the third message is a fourth preset value, and the fourth preset value is used to represent that the third message is a discovery response message;

the sending unit 404 is further configured to forward the discovery response packet to the terminal, where the discovery response packet is used to inform an ACS in the terminal AS that the ACS can provide an authentication service, so that the terminal sends an authentication packet to the ACS.

In one embodiment, the destination IP addresses of the discovery message and the authentication message are HTTP server addresses;

the AER may further comprise:

a temporary table entry establishing unit, configured to establish a temporary table entry for the terminal, where a correspondence between the HTTP server address and the IP address of the terminal is recorded in the temporary table entry;

the sending unit 404, when redirecting the discovery packet and the authentication packet to the ACS in the local AS, is configured to modify the destination IP addresses of the discovery packet and the authentication packet into the IP address of the ACS, and forward the modified discovery packet and the modified authentication packet to the ACS; and when forwarding the discovery response message and the authentication response message to the terminal, the server is configured to modify the source IP addresses of the discovery response message and the authentication response message into the HTTP server address recorded in the temporary table entry, and forward the modified discovery response message and the modified authentication response message to the terminal.

In one embodiment, the receiving unit 401 is further configured to receive a silence entry for the terminal sent by the ACS, where the silence entry is used to indicate that the authentication of the terminal is overtime or has an authentication error for a set number of times;

the sending unit 404 is further configured to prohibit, within a preset time duration, forwarding the message from the terminal to the ACS after the receiving unit 401 receives the silence entry.

In one embodiment, the designated bit is located in a DATA field or a reserved field of the SMA header.

So far, the functional module description of the AER shown in fig. 4 is completed.

Correspondingly, the application also provides a hardware structure of the AER shown in fig. 4. Referring to fig. 5, fig. 5 is a schematic diagram of a hardware structure of the apparatus shown in fig. 4 provided in the present application, where the apparatus includes: a communication interface 501, a processor 502, a memory 503, and a bus 504; the communication interface 501, the processor 502, and the memory 503 are configured to communicate with each other via a bus 504.

The communication interface 501 is used for sending and receiving messages. The processor 502 may be a CPU, the memory 503 may be a non-volatile memory (non-volatile memory), and the memory 503 stores therein access logic instructions of the SMA networking, and the processor 502 may execute the access logic instructions of the SMA networking stored in the memory 503 to implement the function of the AER in the flow illustrated in fig. 3.

To this end, the description of the hardware structure of the AER shown in fig. 5 is completed.

Referring to fig. 6, for a terminal provided in the present application, the terminal is located outside the SMA networking, and the terminal may include:

a message processing unit 601, configured to generate a message and encapsulate an SMA header for the generated message; and the value of the designated bit in the SMA head is a first preset value, and the first preset value is used for representing that the message is an authentication message.

A sending unit 602, configured to send the encapsulated packet to an AER in the SMA networking, so that the AER redirects the received packet to an ACS for authentication according to the value of the specified bit.

So far, the description of the functional modules of the terminal shown in fig. 6 is completed.

Correspondingly, the application also provides a hardware structure of the terminal shown in fig. 6. Referring to fig. 7, fig. 7 is a schematic diagram of a hardware structure of the apparatus shown in fig. 6 provided in the present application, where the apparatus includes: a communication interface 701, a processor 702, a memory 703, and a bus 704; the communication interface 701, the processor 702, and the memory 703 complete communication with each other through the bus 704.

The communication interface 701 is used for sending and receiving messages. The processor 702 may be a CPU, the memory 703 may be a non-volatile memory, and the memory 703 may store access logic instructions of the SMA networking, and the processor 702 may execute the access logic instructions of the SMA networking stored in the memory 703, so as to implement the functions of the terminal in the flow illustrated in fig. 3.

So far, the description of the hardware structure of the terminal shown in fig. 7 is completed.

The above description is only exemplary of the present application and should not be taken as limiting the present application, as any modification, equivalent replacement, or improvement made within the spirit and principle of the present application should be included in the scope of protection of the present application.

Claims

1. An access method for checking SMA networking based on a forged source address of a state machine is characterized in that the method is applied to an autonomous system AS boundary router AER in the SMA networking and comprises the following steps:

receiving a first message sent by a terminal outside an SMA (shape memory access) network, wherein the terminal belongs to an untrusted alliance;

if the value of the designated bit is matched with a first preset value, the first message is confirmed to be an authentication message sent to an ACS (autonomous System control Server) in the SMA network by a terminal outside the SMA network;

redirecting the authentication message to an ACS in the AS for authentication;

2. The method according to claim 1, wherein the receiving the authentication result returned by the ACS, if the authentication result is passed, the terminal is allowed to access the local AS; if the authentication result is not passed, the terminal is prohibited from accessing the AS, and the method comprises the following steps:

receiving a second message returned by the ACS, wherein the value of the designated bit in the SMA message header of the second message is a second preset value, and the second preset value is used for representing that the second message is an authentication response message;

forwarding the authentication response message to the terminal;

3. The method of claim 2, wherein the AER allows the terminal to access the AS, comprising:

saving an SMA table entry corresponding to the terminal, wherein the SMA table entry records the corresponding relation between the message label and the IP address of the terminal;

and transmitting the data message between the terminal and the AS based on the SMA table item.

4. The method of claim 2, wherein the method further comprises:

if the value of the designated bit in the SMA message header of the first message is matched with a third preset value, confirming that the first message is a discovery message sent to an ACS in the SMA network by a terminal outside the SMA network; the discovery message is used for discovering ACS in the SMA networking;

redirecting the discovery message to an ACS in the AS;

receiving a third message returned by the ACS, wherein the value of the designated bit in the SMA message header of the third message is a fourth preset value, and the fourth preset value is used for representing that the third message is a discovery response message;

and forwarding the discovery response message to the terminal, wherein the discovery response message is used for informing the ACS in the AS of the terminal that the ACS can provide authentication service so that the terminal sends the authentication message to the ACS.

5. The method of claim 4, wherein the destination IP addresses of the discovery message and the authentication message are HyperText transfer protocol (HTTP) server addresses;

the method further comprises the following steps:

establishing a temporary table entry aiming at the terminal, wherein the temporary table entry records the corresponding relation between the HTTP server address and the IP address of the terminal;

modifying the destination IP addresses of the discovery message and the authentication message into the IP address of the ACS when the discovery message and the authentication message are redirected to the ACS in the AS, and forwarding the modified discovery message and the modified authentication message to the ACS; and

and when the discovery response message and the authentication response message are forwarded to the terminal, modifying the source IP addresses of the discovery response message and the authentication response message into the HTTP server address recorded in the temporary table entry, and forwarding the modified discovery response message and the modified authentication response message to the terminal.

6. The method of claim 1, wherein the method further comprises:

receiving a silent table entry aiming at the terminal and sent by the ACS, wherein the silent table entry is used for indicating that the authentication timeout or the authentication error of the terminal reaches a set number of times;

and forbidding to forward the message from the terminal to the ACS within a preset time length.

7. The method of any one of claims 1-4, wherein the designated bit is located in a DATA field or a reserved field of an SMA header.

8. An access method for checking SMA networking based on a forged source address of a state machine is characterized in that the method is applied to a terminal outside the SMA networking, the terminal belongs to an untrusted alliance, and the method comprises the following steps:

and sending the encapsulated message to an autonomous system AS border router AER in the SMA networking so that the AER redirects the received message to an autonomous system control server ACS for authentication according to the value of the designated bit.

9. An Autonomous System (AS) border router (AER), comprising:

the system comprises a receiving unit, a sending unit and a receiving unit, wherein the receiving unit is used for receiving a first message sent by a terminal outside an SMA (shape memory access) network, and the terminal belongs to an untrusted alliance;

10. The AER of claim 9, in which the receiving the authentication result returned by the ACS, if the authentication result is a pass, allowing the terminal to access the local AS; if the authentication result is not passed, the terminal is prohibited from accessing the AS, and the method comprises the following steps:

the receiving unit is further configured to receive a second message returned by the ACS, where a value of the designated bit in an SMA message header of the second message is a second preset value, and the second preset value is used to represent that the second message is an authentication response message;

the sending unit is further configured to forward the authentication response packet to the terminal;

11. The AER of claim 10, further comprising:

the sending unit and the receiving unit are also used for transmitting data messages between the terminal and the AS based on the SMA table item.

12. The AER of claim 10,

the confirmation unit is further configured to confirm that the first message is a discovery message sent to the ACS in the SMA network by a terminal outside the SMA network when the value of the designated bit in the SMA message header of the first message matches a third preset value; the discovery message is used for discovering ACS in the SMA networking;

the sending unit is further configured to redirect the discovery packet to an ACS in the local AS;

the receiving unit is further configured to receive a third message returned by the ACS, where a value of the designated bit in an SMA message header of the third message is a fourth preset value, and the fourth preset value is used to represent that the third message is a discovery response message;

the sending unit is further configured to forward the discovery response packet to the terminal, where the discovery response packet is used to inform an ACS in the terminal that authentication service can be provided, so that the terminal sends an authentication packet to the ACS.

13. The AER of claim 12, in which the destination IP addresses of the discovery message and the authentication message are hypertext transfer protocol, HTTP, server addresses;

the AER further comprises:

the sending unit is used for modifying the destination IP addresses of the discovery message and the authentication message into the IP address of the ACS when the discovery message and the authentication message are redirected to the ACS in the AS, and forwarding the modified discovery message and the modified authentication message to the ACS; and when forwarding the discovery response message and the authentication response message to the terminal, the server is configured to modify the source IP addresses of the discovery response message and the authentication response message into the HTTP server address recorded in the temporary table entry, and forward the modified discovery response message and the modified authentication response message to the terminal.

14. The AER of claim 9,

the receiving unit is further configured to receive a silence entry for the terminal sent by the ACS, where the silence entry is used to indicate that the authentication timeout or the authentication error of the terminal reaches a set number of times;

the sending unit is further configured to prohibit, within a preset time duration, forwarding of the message from the terminal to the ACS after the receiving unit receives the silence entry.

15. The AER of any of claims 9-12, wherein the specified bit is located in a DATA field or a reserved field of an SMA header.

16. A terminal, wherein the terminal is located outside a state machine based counterfeit source address checking SMA networking, the terminal belonging to an untrusted federation, the terminal comprising:

and the sending unit is used for sending the encapsulated message to an autonomous system AS border router AER in the SMA networking so that the AER redirects the received message to an autonomous system control server ACS for authentication according to the value of the specified bit.