WO2022100153A1 - 一种报文处理方法及装置 - Google Patents

一种报文处理方法及装置 Download PDF

Info

Publication number
WO2022100153A1
WO2022100153A1 PCT/CN2021/109153 CN2021109153W WO2022100153A1 WO 2022100153 A1 WO2022100153 A1 WO 2022100153A1 CN 2021109153 W CN2021109153 W CN 2021109153W WO 2022100153 A1 WO2022100153 A1 WO 2022100153A1
Authority
WO
WIPO (PCT)
Prior art keywords
communication device
packet
signature
ipv6
message
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2021/109153
Other languages
English (en)
French (fr)
Inventor
许燕平
夏靓
佟晓惠
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP21890684.0A priority Critical patent/EP4221078A4/en
Publication of WO2022100153A1 publication Critical patent/WO2022100153A1/zh
Priority to US18/315,365 priority patent/US12224978B2/en
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L61/00—Network arrangements, protocols or services for addressing or naming
    • H04L61/50—Address allocation
    • H04L61/5007—Internet protocol [IP] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/126—Applying verification of the received information the source of the received data
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
    • H04L63/1416—Event detection, e.g. attack signature detection
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0643—Hash functions, e.g. MD5, SHA, HMAC or f9 MAC
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/32—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
    • H04L9/3247—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials involving digital signatures
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2101/00—Indexing scheme associated with group H04L61/00
    • H04L2101/60—Types of network addresses
    • H04L2101/618—Details of network addresses
    • H04L2101/659—Internet protocol version 6 [IPv6] addresses
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/121—Timestamp
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
    • H04L2463/146—Tracing the source of attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic
    • H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Definitions

  • the present application relates to the field of communications, and in particular, to a message processing method and device.
  • IPv6 Internet Protocol Version 6
  • IPv6 packets are required to pass through specific key nodes, such as firewall nodes, during the forwarding process.
  • the IPv6 may be maliciously tampered with, so that the IPv6 packet bypasses the aforementioned key nodes and is forwarded, which brings certain security risks. How to determine whether the IPv6 packet passes through the aforementioned key nodes in the forwarding process is a problem to be solved at present.
  • the embodiments of the present application provide a packet processing method and device, which can determine whether an IPv6 packet passes through a specific key node during the forwarding process.
  • an embodiment of the present application provides a packet processing method, and the method can be executed by a first communication device.
  • the first communication device may obtain a first IPv6 packet, a header of the first IPv6 packet includes a first signature, and by verifying the first signature, the first IPv6 packet may be determined Whether the second communication device is passed during the forwarding process.
  • the second communication device mentioned here is a key node that the first IPv6 packet needs to pass through during the forwarding process.
  • the first communication device may forward the first IPv6 packet.
  • the communication device that receives the first IPv6 packet can use the first signature of the first IPv6 packet.
  • the signature determines whether the first IPv6 packet passes through a key node during the forwarding process. It can be seen that, with this solution, it can be determined whether the first IPv6 packet has passed through a key node during the forwarding process.
  • the first IPv6 packet is an SRv6 packet.
  • this solution can also be used to determine whether the first IPv6 packet passes through the second communication device during the forwarding process, and then effectively Identify attack packets that bypass key nodes
  • the first signature may be carried in the SRH of the first IPv6 packet.
  • the SRH includes an extended TLV field, and the first signature may be carried in the extended TLV field.
  • a hash calculation is performed according to the first content in the first IPv6 packet, and the calculation result is compared with the first signature.
  • the first signature may be obtained by the second communication device performing hash calculation on the above-mentioned first content, that is, When forwarding the first IPv6 packet, the second communication device adds the first signature to the first IPv6 packet, so that the downstream node can perform calculation according to the same content, and compare the calculation result with the first signature, Thereby, it is verified whether the first IPv6 packet passes through the key node during the forwarding process.
  • the packet is discarded.
  • the first content may include fixed-length data in the payload of the first IPv6 packet. Because different IPv6 packets have different data corresponding to the packet payloads, the use of fixed-length data in the packet payload to calculate the signature can make the signatures carried by different IPv6 packets different, thereby reducing the number of IPv6 packets. The possibility of the signature carried in the text being cracked.
  • the first content may further include anti-replay attack verification information.
  • the first content may further include fixed-length data in the payload of the first IPv6 packet and anti-replay attack check information.
  • the first IPv6 packet in order for the communication device that receives the first IPv6 packet to verify the first signature, the first IPv6 packet
  • the header of the message may also include the anti-replay attack verification information.
  • the anti-replay attack verification information carried in the message header can be used, on the one hand, to make the communication device that receives the first IPv6 message verify the first signature, and on the other hand, can be used to make the first The device for communicating the IPv6 message verifies whether the first IPv6 message is a replay message.
  • the header of the first IPv6 packet may further include first indication information, where the first indication information is used to indicate at least one type of anti-replay attack check information included in the first content
  • the anti-replay attack verification information may include the packet sequence number, timestamp and One or more of random numbers.
  • the message sequence number may be a message sequence number allocated by the second communication device for the first IPv6 message
  • the timestamp may be a local time stamp of the second communication device when the second communication device obtains the first IPv6 message, a random
  • the number may be a random number generated by the second communication device.
  • the number of IPv6 packets forwarded by the device is large.
  • the key nodes that some of the packets need to pass through during the forwarding process are firewall devices, and the other key nodes that the other IPv6 packets need to pass through are other types of devices.
  • the key and/or hash algorithm used by the communication device 2 to verify the signature in the IPv6 message may be different.
  • the communication device 2 may determine the key and/or the hash algorithm used for verifying the signature carried in the IPv6 packet according to the type of the key node.
  • the header of the first IPv6 packet may further include second indication information, where the second indication information is used to indicate the type of the second communication apparatus that needs to be passed through in the forwarding process of the first IPv6 packet.
  • the first communication device and the second communication device are the same device, that is, the first communication device is a key node.
  • the first IPv6 packet may be generated by the first communication device, in other words, the key node generates the first signature, and obtains the first IPv6 packet including the first signature.
  • the first communication device may generate the first signature according to a first private key of the second communication device and a first hash algorithm. Further, a first IPv6 packet including the first signature is generated.
  • the first communication device is a downstream device of the second communication device on the forwarding path of the first IPv6 packet.
  • the first communication device is forwarding the first IPv6 packet.
  • the first signature may be verified according to the first public key and the first hash algorithm of the second communication device.
  • the first communication apparatus may forward the first IPv6 packet when the first signature is verified, thereby preventing illegal packets from continuing to be transmitted in the network.
  • the verification of the first signature fails, the first IPv6 packet is discarded to prevent possible attack packets from continuing to be transmitted in the network and occupying network resources.
  • the first communication device may use a first public key and a first hash algorithm to verify the first signature, wherein the first public key and/or the first hash algorithm may be Sent by the control management entity to the first communication device.
  • the first communication device may also receive the first public key and/or the first hash algorithm sent by the control management entity.
  • an embodiment of the present application provides a packet processing method, and the method can be executed by a first communication device.
  • the first communication device may receive the first IPv6 packet, verify the received first IPv6 packet, and determine whether the first IPv6 packet includes the first signature of the second communication device, It is verified according to the verification result whether the first IPv6 packet has passed through the second communication device during the forwarding process.
  • the header of the first IPv6 packet includes the first signature, and the first signature may be used to verify whether the first IPv6 packet passes through the second communication device during the forwarding process.
  • the second communication device mentioned here may be a key node that the first IPv6 packet needs to pass through during the forwarding process.
  • the first communication device may verify the first signature, and the verification result of the first signature is used to determine whether the first IPv6 packet passes through the second communication device during the forwarding process. It can be seen that, by using this solution, the first communication device can determine whether the first IPv6 packet has passed through a key node during the forwarding process.
  • the first communication device may discard the first IPv6 packet, thereby preventing illegal packets from being sent to the network. continue transmission.
  • the first IPv6 packet is an Internet Protocol Version 6 Segment Routing SRv6 packet.
  • the first signature is included in the segment routing header SRH.
  • the SRH includes an extended type length value TLV field, and the extended TLV field includes the first signature.
  • the first signature is obtained by performing hash calculation according to the first content in the first IPv6 packet.
  • the first content includes any one or more of the following: fixed-length data in the payload and anti-replay attack verification information.
  • the packet header further includes anti-replay attack verification information.
  • the packet header further includes first indication information, where the first indication information is used to indicate at least one type of anti-replay attack verification information included in the first content.
  • the anti-replay attack verification information includes one or more of the following: a packet sequence number, a timestamp, and a random number.
  • the packet header further includes second indication information, where the second indication information is used to indicate the type of the second communication apparatus.
  • the first communication device may determine at least one type of anti-duplication included in the first content according to the first indication information Put attack verification information. Further, according to the at least one anti-replay attack verification information, perform anti-replay attack verification, that is, verify whether the first IPv6 packet is a replay packet.
  • the first communication device may obtain the sequence number 1 from the packet header of the first IPv6 packet, and determine that the first content includes the sequence number 1 at a certain time. Whether the first communication device has received other IPv6 packets whose packet sequence number is sequence number 1 within the time period. If the first communication device does not receive another IPv6 packet with a packet sequence number of sequence number 1 within a certain period of time, it indicates that the first IPv6 packet is not a replayed packet. If the first communication device has received other IPv6 packets with a packet sequence number of sequence number 1 within a certain period of time, it means that the first IPv6 packet is a replayed packet. If the first Pv6 message is a replay message, the first communication apparatus may not need to verify the first signature, thereby saving resource overhead for verifying the first signature.
  • the first communication device may obtain time stamp 1 from the header of the first IPv6 packet, and determine the first communication device Timestamp 2 of the first IPv6 packet is received, and then the difference between timestamp 2 and timestamp 1 is calculated. Considering that if the first IPv6 packet is not a replay packet, the difference between timestamp 2 and timestamp 1 should be less than or equal to the first threshold, that is, the first IPv6 packet is transmitted between the key node 1 and the first communication device. The transmission delay between them is less than or equal to the first threshold.
  • the first IPv6 packet is a replay packet
  • the difference between timestamp 2 and timestamp 1 may be greater than the first threshold. Therefore, if the difference between timestamp 2 and timestamp 1 is less than or equal to the first threshold, the first communication device may determine that the first IPv6 packet is not a replay packet, and if the difference between timestamp 2 and timestamp 1 If the difference is greater than the first threshold, the first communication apparatus may determine that the first IPv6 packet is a replay packet. If the first Pv6 message is a replay message, the first communication apparatus may not need to verify the first signature, thereby saving resource overhead for verifying the first signature.
  • the first communication device may obtain the random number 1 from the packet header of the first IPv6 packet, and determine that the first content includes a random number within a certain period of time. Whether the first communication device has received other IPv6 packets carrying the random number 1. If the first communication device does not receive another IPv6 packet carrying the random number 1 within a certain period of time, it indicates that the first IPv6 packet is not a replayed packet. If the first communication device has received other IPv6 packets carrying the random number 1 within a certain period of time, it indicates that the first IPv6 packet is a replayed packet. If the first Pv6 message is a replay message, the first communication apparatus may not need to verify the first signature, thereby saving resource overhead for verifying the first signature.
  • the first signature is generated using a first private key of the second communication device and a first hash algorithm.
  • the first communication device when the first communication device verifies the first signature, it can verify the first signature according to the first public key and the first hash algorithm of the second communication device. .
  • the method further includes: receiving the first public key and/or the first hash algorithm sent by the control management entity.
  • the first communication apparatus may verify the first signature based on the indication of the control management entity.
  • the first communication apparatus may also receive third indication information sent by the control management entity, where the third indication information is used to instruct the first communication apparatus to verify the first signature.
  • the first communication device is a downstream device of the second communication device on the forwarding path of the first IPv6 packet.
  • the first communication device is the tail node indicated by the SID list in the SRH of the first IPv6 packet.
  • the present application provides a first communication device, including: a transceiver unit and a processing unit.
  • the transceiving unit is configured to perform the transceiving operation performed by the first communication device according to any one of the above first aspect and the first aspect
  • the processing unit is configured to perform the above first aspect and any one of the first aspect. other operations performed by the first communication device in addition to the transceiving operation.
  • the present application provides a first communication device, the first communication device includes a memory and a processor; the memory is used for storing program codes; the processor is used for running the program code in the , causing the first communication device to execute the first aspect and the method described in any one of the first aspect.
  • the present application provides a first communication device, where the first communication device includes a communication interface and a processor, and the communication interface is configured to execute the first aspect and the first aspect described in any one of the first aspects.
  • the processor is configured to perform other operations other than the transceiving operation performed by the first communication device according to any one of the above first aspect and the first aspect.
  • the present application provides a first communication device, comprising: a transceiver unit and a processing unit.
  • the transceiving unit is configured to perform the transceiving operation performed by the first communication device according to any one of the above second aspect and the second aspect
  • the processing unit is configured to perform the above second aspect and any one of the second aspect. other operations performed by the first communication device in addition to the transceiving operation.
  • the present application provides a first communication device, the first communication device includes a memory and a processor; the memory is used to store a program code; the processor is used to run the program code in the The instruction causes the first communication device to execute the second aspect and the method described in any one of the second aspect.
  • the present application provides a first communication device, the first communication device includes a communication interface and a processor, and the communication interface is configured to execute the second aspect and any one of the second aspect.
  • the processor is configured to perform other operations other than the transceiving operation performed by the first communication device according to any one of the above second aspect and the second aspect.
  • the present application provides a computer-readable storage medium, characterized in that, the computer-readable storage medium stores instructions that, when executed on a computer, cause the computer to execute the above first aspect and The method described in any one of the first aspect, or the computer is caused to execute the method described in any one of the second aspect and the second aspect.
  • the present application provides a communication system, where the communication system includes the first communication device described in the third aspect or the fourth aspect or the fifth aspect, and the sixth aspect or the seventh aspect or the eighth aspect. the first communication device.
  • FIG. 1 is a schematic diagram of an exemplary application scenario
  • FIG. 2 is a signaling interaction diagram of a message processing method provided by an embodiment of the present application
  • FIG. 3 is a schematic diagram of an extended TLV field provided by an embodiment of the present application.
  • FIG. 4 is a schematic flowchart of a message processing method provided by an embodiment of the present application.
  • FIG. 5 is a schematic flowchart of a message processing method provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a communication apparatus according to an embodiment of the present application.
  • the embodiments of the present application provide a packet processing method and device, which can determine whether an IPv6 packet passes through a key node during the forwarding process.
  • Segment Routing Internet Protocol Version 6 (SRv6) technology, which can apply segment routing (SR) technology to the forwarding of Internet Protocol version 6 (IPv6) packets .
  • IPv6 Internet Protocol version 6
  • the packets forwarded by using the SRv6 technology may be called SRv6 packets.
  • the header of the SRv6 message includes a segment routing header (SRH).
  • the SRH includes a segment identifier list (segment identifier list, SID list), and the SID list is used to indicate the forwarding path of the SRv6 message. Therefore, for an SRv6 packet, it can be determined whether it has passed a key node during the forwarding process through the SID list in the SRH.
  • SRv6 packets may be tampered with during forwarding.
  • the SID list of SRv6 packets may also be tampered with during forwarding. If the SID list is tampered with, based on the SID list, it cannot be accurately determined whether the SRv6 packet has passed through key nodes during the forwarding process.
  • the inventor of the present application found that, at present, it is possible to determine whether the SRH of the SRv6 message has been tampered with by checking the hashed-based message authentication code (HMAC) associated with the key.
  • HMAC hashed-based message authentication code
  • HMAC verification you can refer to the relevant description in the draft RFC8754 formulated by the Internet Engineering Task Framework (IETF), which will not be described in detail here.
  • FIG. 1 is a schematic diagram of an exemplary application scenario.
  • the forwarding path of the SRv6 message is the communication device R1 - the communication device R2 - the firewall FW1 - the communication device R3 - the communication device R4 - the server S1 .
  • the firewall FW1 is a key node that needs to pass through the SRv6 packet forwarding process.
  • the communication device R2 is configured to perform HMAC check to verify whether the SID list of the SRv6 message has been tampered with. However, if the network hacker modifies the SID list of the SRv6 message, and deletes the SID of the communication device R2 from the SID list, then the tampered SRv6 message is no longer forwarded through the communication device R2.
  • the communication device R2 also cannot perform HMAC check on the SRv6 packet. Therefore, it is impossible to judge whether the SID list of the SRv6 packet has been tampered with. Correspondingly, other communication devices cannot determine whether the SRv6 message has passed the key node in the forwarding process according to the SID list.
  • the network hacker in addition to deleting the SID of the communication device R2 from the SID list, the network hacker can also delete the SID of the firewall FW1 from the SID list, so that the message bypasses the key node (firewall). FW1) forwarding.
  • an embodiment of the present application provides a packet processing method, which is described below with reference to the accompanying drawings.
  • FIG. 1 is only shown for the convenience of understanding, and does not constitute a limitation on the embodiment of the present application.
  • the node configured to perform the HMAC check may be the communication device R3, the communication device R4, or the communication device R5 in addition to the communication device R2.
  • the key nodes that must be passed through in the forwarding process of SRv6 packets can also be other types of devices, such as servers that prevent denial of service (DoS) attacks.
  • DoS denial of service
  • the communication device mentioned in the embodiment of this application may be a network device such as a switch and a router, or may be a part of the components on the network device, such as a single board and a line card on the network device, and may also be a network device on the network device.
  • the functional modules are not specifically limited in the embodiments of the present application.
  • the communication devices can be directly connected by an Ethernet cable or an optical cable.
  • FIG. 2 is a signaling interaction diagram of a packet processing method provided by an embodiment of the present application.
  • the packet processing method 100 shown in FIG. 2 may, for example, include the following S101-S104.
  • the communication device 1 obtains the message 1, the message 1 is an IPv6 message, and the message header of the message 1 includes a signature 1, and the signature 1 is used to verify whether the message 1 passes through the key node 1 during the forwarding process.
  • the communication device 1 mentioned here may be, for example, the firewall FW1, the communication device R3, the communication device R4 or the server S1 shown in FIG. 1 .
  • the key node 1 mentioned here can be, for example, the firewall FW1 shown in FIG. 1 .
  • the communication device 1 can receive the packet 1 sent by the upstream device.
  • the upstream device mentioned here can be, for example, the key node 1 .
  • the communication device 1 may be the key node 1, that is, the communication device 1 and the key node 1 are the same communication device. For this case, the communication device 1 can generate the message 1 .
  • the communication device 1 may receive the message 2 sent by other communication devices, and re-encapsulate the message 2 to obtain the message 1 including the signature 1 .
  • the key node 1 signs the message 2 to indicate that the message 2 passes through the key node 1 in the forwarding process.
  • a message 1 including the signature 1 is obtained, and the signature 1 in the message 1 can be used to determine whether the message 1 passes through the key node 1 during the forwarding process.
  • the packet 2 mentioned here may also be an IPv6 packet.
  • the signature 1 may be carried in an extended type length value (type length value, TLV) field of the message of the message 1.
  • the signature 1 may be obtained by the key node 1 performing a hash calculation on the first content in the message 1 .
  • the key node 1 may calculate the first content by using the key node 1's own first private key and the first hash algorithm, so as to obtain the signature 1 .
  • the key node 1 can use the first hash algorithm to calculate the first content to obtain the digest 1, and then use the first private key to encrypt the digest 1 to obtain the signature 1.
  • the first content may include fixed-length data in the payload of the packet 1 . Because different IPv6 packets have different data corresponding to the packet payloads, the use of fixed-length data in the packet payload to calculate the signature can make the signatures carried by different IPv6 packets different, thereby reducing the number of IPv6 packets. The possibility of the signature carried in the text being cracked.
  • the first content may further include anti-replay attack verification information.
  • the first content may further include fixed-length data in the payload of the packet 1 and anti-replay attack verification information.
  • the anti-replay attack verification information may include one or more of the packet sequence number, timestamp, and random number.
  • the message sequence number may be the message sequence number assigned by the key node 1 to the message 1
  • the timestamp may be the local time stamp of the key node 1 when the key node 1 obtains the message 1
  • the random number may be generated by the key node 1. of random numbers.
  • the message 1 may also include the anti-replay attack verification information.
  • the anti-replay attack verification information carried in the packet header can be used, on the one hand, to enable the communication device that received the packet 1 to verify the signature 1, and on the other hand, can be used to enable the communication device that received the packet 1 to verify the signature 1.
  • the device verifies whether the message 1 is a replay message.
  • the anti-replay attack verification information and the signature 1 may be carried in the same extended TLV field.
  • the anti-replay attack verification information may be carried in a separate extended TLV field.
  • the packet header of the packet 1 may further include indication information 1, where the indication information 1 is used to indicate at least one type of anti-replay attack verification information included in the first content.
  • the packet header of packet 1 includes a first indicator bit, a second indicator bit and a third indicator bit, and the first indicator bit, the second indicator bit and the third indicator bit are used to carry the indicator information 1.
  • the first indication bit is used to indicate whether the anti-replay attack verification information included in the first content includes a packet sequence number
  • the second indicator bit is used to indicate whether the anti-replay attack verification information included in the first content includes time
  • the third indication bit is used to indicate whether the anti-replay attack verification information included in the first content includes a random number.
  • the first indicator bit, the second indicator bit, and the third indicator bit each occupy 1 bit.
  • the value of the first indicator bit is 1, it indicates that the anti-replay attack check information included in the first content includes the packet sequence number.
  • the value of the first indicator bit is 0, it indicates that the anti-replay attack check information included in the first content includes the packet sequence number.
  • the attack check information does not include the packet sequence number; when the value of the second indication bit is 1, it means that the anti-replay attack check information included in the first content includes a timestamp, and when the value of the second indication bit is 0,
  • the anti-replay attack check information included in the first content does not include the packet timestamp; when the value of the third indicator bit is 1, it indicates that the anti-replay attack check information included in the first content includes a random number, and when the third indicator bit is 1
  • the value of the three indication bits it means that the anti-replay attack verification information included in the first content does not include the random number of the packet.
  • the anti-replay attack check information and the indication information 1 may be carried in the same extended TLV field.
  • the indication information 1 may be carried in a separate extended TLV field.
  • the number of IPv6 packets forwarded by the device is large.
  • some of the key nodes that the packets need to pass through during the forwarding process are firewall devices, and other key nodes that the IPv6 packets need to pass through are other types of devices, such as servers that prevent DoS attacks.
  • the key and/or hash algorithm used by the communication device 2 to verify the signature in the IPv6 message may be different.
  • the communication device 2 may determine the key and/or the hash algorithm used for verifying the signature carried in the IPv6 packet according to the type of the key node.
  • the packet header of the packet 1 may further include indication information 2, where the indication information 2 is used to indicate the type of the key node 1 that needs to be passed through during the forwarding process of the packet 1.
  • the indication information 2 and the signature 1 may be carried in the same extended TLV field.
  • the indication information 2 may be carried in a separate extended TLV field.
  • the packet header of the packet 1 includes an SRH, in other words, the packet 1 may be an SRv6 packet.
  • the packet 1 when the packet 1 is an SRv6 packet, the aforementioned signature 1 may be carried in the SRH of the packet 1.
  • the SRH of the message 1 may include an extended TLV field, and the signature 1 may be carried in the extended TLV field.
  • the aforementioned signature 1, replay attack verification information, indication information 1 and indication information 2 may be carried in the same extended TLV field. It can be understood with reference to FIG. 3 , which is a schematic diagram of an extended TLV field provided by an embodiment of the present application. in:
  • the node type field is used to carry indication information 2 indicating the type of the key node 1 .
  • the S (sequence) indicator bit may be equivalent to the first indicator bit mentioned above, and is used to indicate whether the anti-replay attack check information included in the first content includes the packet sequence number; the T (timestamp) indicator bit may be equivalent to The second indication bit mentioned above is used to indicate whether the anti-replay attack check information included in the first content includes a timestamp; the N (nounce) indication bit can be equivalent to the third indication bit mentioned above, with for indicating whether the anti-replay attack verification information included in the first content includes a random number.
  • the sequence field is used to carry the sequence number.
  • the sequence field is valid when the S indication bit indicates that the anti-replay attack check information included in the first content includes a packet sequence number. In an example, if the S indication bit indicates that the anti-replay attack check information included in the first content does not include a packet sequence number, the TLV field may not include the sequence field.
  • the timestamp field is used to carry the timestamp.
  • the timestamp field is valid when the S indication bit indicates that the anti-replay attack verification information included in the first content includes a timestamp. In an example, if the S indication bit indicates that the anti-replay attack check information included in the first content does not include a timestamp, the TLV field may not include the timestamp field.
  • the bounce field is used to carry random numbers.
  • the nonce field is valid when the N indication bit indicates that the anti-replay attack verification information included in the first content includes a random number. In an example, if the N indication bit indicates that the anti-replay attack check information included in the first content does not include a random number, the TLV field may not include the noounce field.
  • the signature field is used to carry signature 1.
  • the extended TLV field shown in FIG. 3 may be located in the SRH, for example, the extended TLV field may be located after the SID list.
  • the communication device 1 After the communication device 1 can obtain the message 1, it can forward the message 1, and the communication device 2, as a downstream device of the communication device 1 on the forwarding path of the message 1, can receive the message sent by the communication device 1.
  • the communication device 2 mentioned here may be the communication device R3, the communication device R4 or the server S1 shown in FIG. 1 .
  • the communication device 2 when the packet 1 is an SRv6 packet, the communication device 2 may be the tail node indicated by the SID list in the SRH of the packet 1, for example, the communication device 2 is the server shown in FIG. 1 S1.
  • S104 The communication device 2 verifies the signature 1 in the message 1, and the verification result of the signature 1 is used to determine whether the message 1 passes through the key node 1 in the forwarding process.
  • the communication device 2 may verify the signature 1 in the message 1 to determine whether the message 1 passes through the key node 1 during the forwarding process.
  • the signature 1 may be generated by the key node 1 using the first private key of the key node 1 and the first hash algorithm. Therefore, the communication device 2 can use the first public key of the key node 1 and the first hash algorithm to verify the signature 1 .
  • the first public key and the first private key constitute a set of public-private key pairs.
  • the communication device 2 can decrypt the signature 1 by using the first public key to obtain the digest 2, and use the first hash algorithm to perform a hash calculation on the first content to obtain the digest 3, and then perform a hash calculation on the digest 2 and the digest. 3 for matching verification. In one example, if the digest 2 and the digest 3 are the same, it is determined that the signature 1 passes the verification, and if the digest 2 and the digest 3 are different, it is determined that the signature 1 fails the verification.
  • the communication device 2 can determine that the message 1 passes through the key node 1 during the forwarding process. In this case, the communication device 1 can, for example, continue to forward the message 1 . If the signature 1 fails to pass the verification, it means that the message 1 has been tampered with during the forwarding process. In this case, the communication device 2 can discard the message 1.
  • the communication apparatus 2 may verify the signature 1 based on the instruction of the control management entity.
  • the communication device 2 may also receive the indication information 3 sent by the control management entity, and verify the signature 1 according to the indication information 3, wherein the indication information 3 is used to instruct the communication device 1 to Signature 1 for verification.
  • the first public key and/or the first hash algorithm used by the communication device 2 to verify the signature 1 may also be sent to the communication device 2 by the control management entity. In other words, before the communication device 2 verifies the signature 1, it may also receive the first public key and/or the first hash algorithm sent by the control management entity.
  • the control management entity mentioned in the embodiments of the present application may be, for example, a device running network management software (network management system, NMS), or may be a controller.
  • the control management entity can be a functional module that implements control and/or management functions, or a physical entity that runs relevant functional modules.
  • the above-mentioned physical entity can be, for example, a server with relevant software installed, and the relevant software is used to implement the control management entity. function.
  • the embodiments of the present application do not make specific limitations.
  • the first content may include anti-replay attack verification information.
  • the packet header of packet 1 may include the anti-replay attack verification information.
  • the communication device 2 may also verify whether the message 1 is a replayed message according to the anti-replay attack verification information. If the message 1 is a replayed message, the communication device 1 may directly discard the message 1 without performing the step of verifying the signature 1; if the message 1 is not a replayed message, the communication device 2 may perform the verification of the signature 1 Steps to verify.
  • the communication apparatus 2 may determine at least one type of anti-replay attack verification information included in the first content according to the indication information 1. Further, according to the at least one anti-replay attack verification information, it is verified whether the message 1 is a replayed message.
  • the communication device 2 can obtain the sequence number 1 from the header of the message 1, and determine that the communication device 2 is within a certain period of time. Whether other IPv6 packets with the packet sequence number of sequence number 1 are received. If the communication device 2 does not receive another IPv6 packet with the packet sequence number of the sequence number 1 within a certain period of time, it means that the packet 1 is not a replayed packet. If the communication device 2 has received another IPv6 packet with the packet sequence number of the sequence number 1 within a certain period of time, it means that the packet 1 is a replayed packet.
  • the communication device 2 may locally store the message sequence numbers of the IPv6 messages received within a certain period of time, and compare the sequence number 1 with the pre-stored message sequence numbers. If the pre-stored message sequence number includes the sequence number 1, it means that the communication device 2 has received other IPv6 messages with the message sequence number of sequence number 1 within a certain period of time; if the pre-stored message sequence number is 1 If the sequence number 1 is not included in the number, it means that the communication device 2 has not received other IPv6 packets whose packet sequence number is the sequence number 1 within a certain period of time.
  • the communication device 2 can obtain the timestamp 1 from the packet header of the packet 1, and determine the timestamp at which the communication device 2 receives the packet 1 2, and then calculate the difference between timestamp 2 and timestamp 1. Considering that if packet 1 is not a replayed packet, the difference between timestamp 2 and timestamp 1 should be less than the first threshold, that is, the transmission delay of packet 1 between key node 1 and communication device 2 is less than first threshold. However, if the packet 1 is a replay packet, the difference between the timestamp 2 and the timestamp 1 may be greater than or equal to the first threshold.
  • the communication device 2 may determine that the message 1 is not a replayed message, if the difference between the timestamp 2 and the timestamp 1 is greater than or equal to For the first threshold, the communication device 2 can determine that the message 1 is a replayed message.
  • the time stamp 2 is the local time stamp of the communication device 2 when the communication device 2 receives the message 1 .
  • the communication device 2 may obtain the random number 1 from the packet header of the packet 1, and determine whether the communication device 2 receives the random number within a certain period of time. to other IPv6 packets carrying the random number 1. If the communication device 2 does not receive other IPv6 packets carrying the random number 1 within a certain period of time, it means that the packet 1 is not a replayed packet. If the communication device 2 has received other IPv6 packets carrying the random number 1 within a certain period of time, it means that the packet 1 is a replayed packet.
  • the communication device 2 may locally store the random number carried by the IPv6 packet received within a certain period of time, and compare the random number 1 with the pre-stored random number. If the pre-stored random number includes the random number 1, it means that the communication device 2 has received other IPv6 packets carrying the random number 1 within a certain period of time; if the pre-stored random number does not include the random number 1 If the random number is 1, it means that the communication device 2 has not received other IPv6 packets carrying the random number 1 within a certain period of time.
  • the communication device 1 and the key node 1 may be the same device or different devices.
  • the communication device 1 may be a downstream device of the key node 1 in the forwarding path of the packet 1 .
  • the communication device 1 may also verify the signature 1 before forwarding the message 1, and forward the message 1 when the signature 1 passes the verification.
  • the verification of the signature 1 by the communication device 1 reference may be made to the description of the verification of the signature 1 by the communication device 2 in the above S104, and the description will not be repeated here.
  • the downstream device of the key node 1 in the forwarding path of the message 1 can verify the signature 1, thereby determining whether the message 1 passes through the key node 1 during the forwarding process.
  • the packet 1 is an SRv6 packet
  • the method 100 can overcome the fact that the node configured for HMAC check is deleted from the SID list of the SRH by network hackers as mentioned in the description part of FIG. 1 , resulting in failure to pass the SID list determines whether the message 1 passes through the key node 1 during the forwarding process.
  • FIG. 4 is a schematic flowchart of a packet processing method provided by an embodiment of the present application.
  • the packet processing method 200 shown in FIG. 4 may be executed by the first communication device.
  • the first communication device may be the communication device 1 in the above embodiment. It is used to perform the steps performed by the communication device 1 in the above method 100 .
  • the method 200 may include the following S201-S202.
  • S201 Acquire a first IPv6 packet, where a packet header of the first IPv6 packet includes a first signature, and the first signature is used to verify whether the first IPv6 packet has passed the second communication device.
  • the first IPv6 packet mentioned here can correspond to the packet 1 in the method 100
  • the first signature mentioned here can correspond to the signature 1 in the method 100
  • the second communication device mentioned here can be Corresponds to the key node 1 in the method 100 .
  • the first IPv6 packet is an Internet Protocol Version 6 Segment Routing SRv6 packet.
  • the first signature is included in the segment routing header SRH.
  • the SRH includes an extended type length value TLV field, and the extended TLV field includes the first signature.
  • the first signature is obtained by performing hash calculation according to the first content in the first IPv6 packet.
  • the first content includes one or more of the following:
  • the packet header further includes anti-replay attack verification information.
  • the packet header further includes first indication information, where the first indication information is used to indicate at least one type of anti-replay attack verification information included in the first content.
  • the first indication information mentioned here may correspond to the indication information 1 in the method 100 .
  • the anti-replay attack verification information includes one or more of the following:
  • the packet header further includes second indication information, where the second indication information is used to indicate the type of the second communication apparatus.
  • the second indication information mentioned here may correspond to the indication information 2 in the method 100 .
  • the first communication device and the second communication device are the same device, and the acquiring the first IPv6 packet includes:
  • the first signature is generated based on the first private key of the second communication device.
  • the first communication device is a downstream device of the second communication device on the forwarding path of the first IPv6 packet, and before forwarding the first IPv6 packet, the Methods also include:
  • the first signature is verified according to the first public key of the second communication device.
  • the first public key and/or the first hash algorithm required for calculating the signature sent by the control management entity is received.
  • FIG. 5 is a schematic flowchart of a packet processing method provided by an embodiment of the present application.
  • the packet processing method 300 shown in FIG. 5 may be executed by the first communication apparatus.
  • the first communication device may be the communication device 2 in the above embodiment.
  • the method 300 may include the following S301-S302.
  • S301 Receive a first IPv6 packet, where the first IPv6 packet includes a first signature, where the first signature is used to verify whether the forwarding path of the first IPv6 packet passes through the second communication device.
  • S302 Verify the first signature, and a verification result is used to determine whether the first IPv6 packet passes through the second communication device during the forwarding process.
  • the first IPv6 packet mentioned here can correspond to the packet 1 in the method 100
  • the first signature mentioned here can correspond to the signature 1 in the method 100
  • the second communication device mentioned here can be Corresponds to the key node 1 in the method 100 .
  • the method further includes:
  • the first IPv6 packet is discarded.
  • the first IPv6 packet is an Internet Protocol Version 6 Segment Routing SRv6 packet.
  • the first signature is included in the segment routing header SRH.
  • the SRH includes an extended type length value TLV field, and the extended TLV field includes the first signature.
  • the first signature is obtained by performing hash calculation according to the first content in the first IPv6 packet.
  • the first content includes any one or more of the following:
  • the packet header further includes anti-replay attack verification information.
  • the packet header further includes first indication information, where the first indication information is used to indicate at least one type of anti-replay attack verification information included in the first content.
  • the first indication information mentioned here may correspond to the indication information 1 in the method 100 .
  • the anti-replay attack verification information includes one or more of the following:
  • the packet header further includes second indication information, where the second indication information is used to indicate the type of the second communication apparatus.
  • the second indication information mentioned here may correspond to the indication information 2 in the method 100 .
  • the method further includes:
  • the first communication apparatus has not received other IPv6 packets with the same sequence number as the sequence number carried in the first IPv6 packet within a certain period of time.
  • the method further includes:
  • the method further includes:
  • the first communication apparatus has not received other IPv6 packets carrying the same random number as the random number carried in the first IPv6 packet.
  • the first signature is generated using a first private key of the second communication device.
  • the verifying the first signature includes:
  • the first signature is verified according to the first public key of the second communication device.
  • the method further includes:
  • the first public key and/or the first hash algorithm required for calculating the signature sent by the control management entity is received.
  • the method further includes:
  • the third indication information mentioned here may correspond to the indication information 3 in the method 100 .
  • the first communication device is a downstream device of the second communication device on the forwarding path of the first IPv6 packet.
  • the first communication device is the tail node indicated by the SID list in the SRH of the first IPv6 packet.
  • FIG. 6 is a schematic structural diagram of a communication device according to an embodiment of the present application.
  • the communication device 600 includes a transceiver unit 601 and a processing unit 602 .
  • the communication apparatus 600 may be used to execute the method 100, the method 200 or the method 300 in the above embodiments.
  • the communication apparatus 600 may execute the method 100 in the above embodiments.
  • the communication apparatus 600 is equivalent to the communication apparatus 1 in the method 100 .
  • the transceiving unit 601 is configured to perform the transceiving operation performed by the communication device 1 in the method 100 .
  • the processing unit 602 is configured to perform operations other than the transceiving operations performed by the communication device 1 in the method 100 .
  • the processing unit 602 is used to obtain the packet 1, the packet 1 is an IPv6 packet, the packet header of the packet 1 includes the signature 1, and the signature 1 is used to verify whether the packet 1 passes through the key node 1 during the forwarding process. ;
  • the transceiver unit 601 is used to forward the message 1.
  • the communication apparatus 600 can execute the method 100 in the above embodiments.
  • the communication apparatus 600 is equivalent to the communication apparatus 2 in the method 100 .
  • the transceiving unit 601 is configured to perform the transceiving operation performed by the communication device 2 in the method 100 .
  • the processing unit 602 is configured to perform operations other than the transceiving operations performed by the communication device 2 in the method 100 .
  • the transceiver unit 601 is used to receive the packet 1, the packet 1 is an IPv6 packet, the packet header of the packet 1 includes the signature 1, and the signature 1 is used to verify whether the packet 1 passes through the key node 1 during the forwarding process. ;
  • the processing unit 602 is used to verify the signature 1 in the message 1, and the verification result of the signature 1 is used to determine whether the message 1 has passed through the key node 1 in the forwarding process.
  • the communication apparatus 600 may execute the method 200 in the above embodiments.
  • the communication apparatus 600 is equivalent to the first communication apparatus in the method 200 .
  • the transceiving unit 601 is configured to perform the transceiving operation performed by the first communication apparatus in the method 200 .
  • the processing unit 602 is configured to perform operations other than the transceiving operation performed by the first communication device in the method 200 .
  • the processing unit 602 is configured to obtain a first Internet Protocol version 6 IPv6 packet, the header of the first IPv6 packet includes a first signature, and the first signature is used to verify the first IPv6 packet Whether the message passes through the second communication device during the forwarding process; the transceiver unit 601 is configured to forward the first IPv6 message.
  • the communication apparatus 600 may execute the method 300 in the above embodiments.
  • the communication apparatus 600 is equivalent to the first communication apparatus in the method 300 .
  • the transceiving unit 601 is configured to perform the transceiving operation performed by the first communication apparatus in the method 300 .
  • the processing unit 602 is configured to perform operations other than the transceiving operation performed by the first communication device in the method 300 .
  • the transceiver unit 601 is configured to receive a first IPv6 packet, where the first IPv6 packet includes a first signature, and the first signature is used to verify whether the forwarding path of the first IPv6 packet passes through the second communication
  • the processing unit 602 is configured to verify the first signature, and the verification result is used to determine whether the first IPv6 packet has passed through the second communication device during the forwarding process.
  • FIG. 7 is a schematic structural diagram of a communication apparatus provided by an embodiment of the present application.
  • the communication device 700 includes a communication interface 701 and a processor 702 connected to the communication interface 701 .
  • the communication apparatus 700 can be used to execute the method 100, the method 200 or the method 300 in the above embodiments.
  • the communication apparatus 700 can execute the method 100 in the above embodiments.
  • the communication apparatus 700 is equivalent to the communication apparatus 1 in the method 100 .
  • the communication interface 701 is used to perform the transceiving operation performed by the communication device 1 in the method 100 .
  • the processor 702 is configured to perform operations other than the transceiving operations performed by the communication device 1 in the method 100 .
  • the processor 702 is used to obtain the packet 1, the packet 1 is an IPv6 packet, the packet header of the packet 1 includes the signature 1, and the signature 1 is used to verify whether the packet 1 passes through the key node 1 during the forwarding process ;
  • the communication interface 701 is used for forwarding the message 1.
  • the communication apparatus 700 may execute the method 100 in the above embodiments.
  • the communication apparatus 700 is equivalent to the communication apparatus 2 in the method 100 .
  • the communication interface 701 is used to perform the transceiving operation performed by the communication device 2 in the method 100 .
  • the processor 702 is configured to perform operations other than the transceiving operations performed by the communication device 2 in the method 100 .
  • the communication interface 701 is used to receive the packet 1, the packet 1 is an IPv6 packet, the packet header of the packet 1 includes the signature 1, and the signature 1 is used to verify whether the packet 1 passes through the key node 1 during the forwarding process. ;
  • the processor 702 is used to verify the signature 1 in the message 1, and the verification result of the signature 1 is used to determine whether the message 1 has passed through the key node 1 in the forwarding process.
  • the communication apparatus 700 may execute the method 200 in the above embodiments.
  • the communication apparatus 700 is equivalent to the first communication apparatus in the method 200 .
  • the communication interface 701 is used for performing the transceiving operation performed by the first communication device in the method 200 .
  • the processor 702 is configured to perform operations other than the transceiving operations performed by the first communication device in the method 200 .
  • the processor 702 is configured to obtain a first Internet Protocol version 6 IPv6 packet, a packet header of the first IPv6 packet includes a first signature, and the first signature is used to verify the first IPv6 packet Whether the message passes through the second communication device during the forwarding process; the communication interface 701 is used for forwarding the first IPv6 message.
  • the communication apparatus 700 may execute the method 300 in the above embodiments.
  • the communication apparatus 700 is equivalent to the first communication apparatus in the method 300 .
  • the communication interface 701 is used for performing the transceiving operation performed by the first communication device in the method 300 .
  • the processor 702 is configured to perform operations other than the transceiving operation performed by the first communication device in the method 300 .
  • the communication interface 701 is configured to receive a first IPv6 packet, the first IPv6 packet includes a first signature, and the first signature is used to verify whether the forwarding path of the first IPv6 packet passes through the second communication
  • the processor 702 is configured to verify the first signature, and the verification result is used to determine whether the first IPv6 packet has passed through the second communication device during the forwarding process.
  • FIG. 8 is a schematic structural diagram of a communication apparatus provided by an embodiment of the present application.
  • the communication apparatus 800 can be used to execute the method 100, the method 200, or the method 300 in the above embodiments.
  • the communication apparatus 800 may include a processor 810 , a memory 820 coupled to the processor 810 , and a transceiver 830 .
  • the transceiver 830 may be, for example, a communication interface, an optical module, or the like.
  • the processor 810 may be a central processing unit (English: central processing unit, abbreviation: CPU), a network processor (English: network processor, abbreviation: NP), or a combination of CPU and NP.
  • the processor may also be an application-specific integrated circuit (English: application-specific integrated circuit, abbreviation: ASIC), a programmable logic device (English: programmable logic device, abbreviation: PLD) or a combination thereof.
  • the above-mentioned PLD can be a complex programmable logic device (English: complex programmable logic device, abbreviation: CPLD), field programmable logic gate array (English: field-programmable gate array, abbreviation: FPGA), general-purpose array logic (English: generic array logic, abbreviation: GAL) or any combination thereof.
  • the processor 810 may refer to one processor, or may include multiple processors.
  • the memory 820 may include volatile memory (English: volatile memory), such as random-access memory (English: random-access memory, abbreviation: RAM); the memory may also include non-volatile memory (English: non-volatile memory) , such as read-only memory (English: read-only memory, abbreviation: ROM), flash memory (English: flash memory), hard disk (English: hard disk drive, abbreviation: HDD) or solid-state drive (English: solid-state drive , abbreviation: SSD); the memory 820 may also include a combination of the above-mentioned types of memory.
  • the memory 820 may refer to one memory, or may include multiple memories.
  • computer-readable instructions are stored in the memory 820 , and the computer-readable instructions include a plurality of software modules, such as a sending module 821 , a processing module 822 and a receiving module 823 .
  • the processor 810 can perform corresponding operations according to the instructions of each software module.
  • an operation performed by a software module actually refers to an operation performed by the processor 810 according to the instruction of the software module.
  • the communication apparatus 800 may execute the method 100 in the above embodiments.
  • the communication apparatus 800 is equivalent to the communication apparatus 1 in the method 100 .
  • the transceiver 830 is configured to perform the transceiving operation performed by the communication device 1 in the method 100 .
  • the processor 810 is configured to perform operations other than the transceiving operations performed by the communication device 1 in the method 100 .
  • the processor 810 is used to obtain the packet 1, the packet 1 is an IPv6 packet, the packet header of the packet 1 includes the signature 1, and the signature 1 is used to verify whether the packet 1 passes through the key node 1 during the forwarding process. ;
  • the transceiver 830 is used to forward the message 1.
  • the communication apparatus 800 may execute the method 100 in the above embodiments.
  • the communication apparatus 800 is equivalent to the communication apparatus 2 in the method 100 .
  • the transceiver 830 is configured to perform the transceiving operation performed by the communication device 2 in the method 100 .
  • the processor 810 is configured to perform operations other than the transceiving operations performed by the communication device 2 in the method 100 .
  • the transceiver 830 is used to receive the packet 1, the packet 1 is an IPv6 packet, the packet header of the packet 1 includes the signature 1, and the signature 1 is used to verify whether the packet 1 passes through the key node 1 during the forwarding process. ;
  • the processor 810 is used to verify the signature 1 in the message 1, and the verification result of the signature 1 is used to determine whether the message 1 passes through the key node 1 during the forwarding process.
  • the communication apparatus 800 may execute the method 200 in the above embodiments.
  • the communication apparatus 800 is equivalent to the first communication apparatus in the method 200 .
  • the transceiver 830 is configured to perform the transceiving operation performed by the first communication device in the method 200 .
  • the processor 810 is configured to perform operations other than the transceiving operation performed by the first communication device in the method 200 .
  • the processor 810 is configured to obtain a first Internet Protocol version 6 IPv6 packet, a header of the first IPv6 packet includes a first signature, and the first signature is used to verify the first IPv6 packet Whether the message passes through the second communication device during the forwarding process; the transceiver 830 is configured to forward the first IPv6 message.
  • the communication apparatus 800 may execute the method 300 in the above embodiments.
  • the communication apparatus 800 is equivalent to the first communication apparatus in the method 300 .
  • the transceiver 830 is configured to perform the transceiving operation performed by the first communication device in the method 300 .
  • the processor 810 is configured to perform operations other than the transceiving operation performed by the first communication device in the method 300 .
  • the transceiver 830 is configured to receive a first IPv6 packet, where the first IPv6 packet includes a first signature, and the first signature is used to verify whether the forwarding path of the first IPv6 packet passes through the second communication
  • the processor 810 is configured to verify the first signature, and the verification result is used to determine whether the first IPv6 packet has passed through the second communication device during the forwarding process.
  • the present application also provides a computer-readable storage medium, where instructions are stored in the computer-readable storage medium, when the computer-readable storage medium runs on a computer, the computer causes the computer to perform the method described in any one of the foregoing embodiments. (eg, method 100, method 200, and method 300) any one or more operations.
  • the present application also provides a computer program product, including a computer program, which, when run on a computer, causes the computer to perform the method described in any one of the preceding embodiments (eg, method 100, method 200, and method). 300) any one or more operations.
  • the present application also provides a communication system, including any one of the first communication apparatuses for executing the method 200 and any one of the first communication apparatuses for executing the method 300 mentioned in the above embodiments.
  • the communication system may further include the aforementioned control management entity, which is used to implement the operations performed by the control management entity in the foregoing embodiment.
  • the present application also provides a communication system, comprising at least one memory and at least one processor, where the at least one memory stores instructions, and the at least one processor executes the instructions, so that the communication system performs the above-mentioned embodiments of the present application. Any one or more of the methods described in any of the embodiments (eg, method 100, method 200, and method 300) operate.
  • the disclosed system, apparatus and method may be implemented in other manners.
  • the apparatus embodiments described above are only illustrative.
  • the division of units is only a logical business division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or integrated. to another system, or some features can be ignored, or not implemented.
  • the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of devices or units, and may be in electrical, mechanical or other forms.
  • Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.
  • each service unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware, or may be implemented in the form of a software business unit.
  • the integrated unit if implemented as a software business unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium.
  • the technical solutions of the present application can be embodied in the form of software products in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, and the computer software products are stored in a storage medium , including several instructions to cause a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods in the various embodiments of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, Read-Only Memory (ROM, Read-Only Memory), Random Access Memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes .
  • the services described in the present invention may be implemented by hardware, software, firmware or any combination thereof.
  • the services may be stored on or transmitted over as one or more instructions or code on a computer-readable medium.
  • Computer-readable media includes both computer storage media and communication media including any medium that facilitates transfer of a computer program from one place to another.
  • a storage medium can be any available medium that can be accessed by a general purpose or special purpose computer.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Power Engineering (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例公开了一种报文处理方法。该方法包括：在IPv6报文的转发路径上，关键节点(例如防火墙)对报文进行签名，关键节点下游的装置通过对所述签名进行验证，从而确定报文在转发过程中是否经过了该关键节点。由此可见，利用本方案，可以执行关键节点校验，从而有效避免攻击者通过修改报文头使得报文绕过关键节点。

Description

一种报文处理方法及装置
本申请要求于2020年11月11日递交中国国家知识产权局、申请号为202011256559.2，发明名称为“一种报文处理方法及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，尤其涉及一种报文处理方法及装置。
背景技术
在因特网协议第六版(internet protocol version 6，IPv6)网络中传输的报文，可以被称为IPv6报文。在一些场景中，为保证网络安全，要求IPv6报文在转发的过程中经过特定的关键节点，例如防火墙节点。
IPv6在转发的过程中有可能被恶意篡改，使得该IPv6报文绕过前述关键节点转发，从而带来一定的安全隐患。如何确定IPv6报文在转发过程中是否经过了前述关键节点，是目前尚待解决的问题。
发明内容
本申请实施例提供了一种报文处理方法及装置，可以确定IPv6报文在转发过程中是否经过了特定的关键节点。
第一方面，本申请实施例提供了一种报文处理方法，该方法可以由第一通信装置执行。在一个示例中，第一通信装置可以获取第一IPv6报文，该第一IPv6报文的报文头中包括第一签名，通过对第一签名进行验证，可以确定所述第一IPv6报文在转发过程中是否经过了第二通信装置。此处提及的第二通信装置是第一IPv6报文在转发过程中需要经过的关键节点。第一通信装置获取第一IPv6报文之后，可以转发所述第一IPv6报文。由于第一IPv6报文中包括能够验证该第一IPv6报文在转发过程中是否经过了关键节点的第一签名，因此，接收到所述第一IPv6报文的通信装置即可利用该第一签名确定第一IPv6报文在转发过程中是否经过了关键节点。由此可见，利用本方案，可以确定第一IPv6报文在转发过程中是否经过了关键节点。
在一种实现方式中，所述第一IPv6报文是SRv6报文。对于这种情况，即使被配置进行HMAC校验的节点被网络黑客从SRH的SID list中删除，利用本方案也可以确定第一IPv6报文在转发过程中是否经过了第二通信装置，进而有效识别绕过关键节点的攻击报文
在一种实现方式中，当第一IPv6报文为SRv6报文时，第一签名可以携带在第一IPv6报文的SRH中。
在一种实现方式中，所述SRH包括可以包括扩展的TLV字段，所述第一签名可以携带在所述扩展的TLV字段中。
在一种实现方式中，根据所述第一IPv6报文中的第一内容进行哈希计算，将计算结果与第一签名进行比较。在一个示例中，当第一签名是第二通信装置计算的合法签名时，所 述第一签名可以是所述第二通信装置对上文中所述的第一内容进行哈希计算得到的，即第二通信装置在转发第一IPv6报文时，将第一签名添加到第一IPv6报文中，从而使得下游节点可以根据同样的内容进行计算，将计算结果与所述第一签名进行比较，从而验证所述第一IPv6报文在转发过程中是否经过了关键节点。一种示例中，当第一签名的内容和计算结果不一致时，将报文丢弃。
在一种实现方式中，为了降低第一签名被破解的可能性，所述第一内容可以包括所述第一IPv6报文的净荷中固定长度的数据。因为不同的IPv6报文，其报文净荷对应的数据也不同，因此，利用报文的净荷中固定长度的数据计算签名，可以使得不同IPv6报文所携带的签名不同，从而降低IPv6报文中携带的签名被破解的可能性。另外，为了防止重放攻击，所述第一内容还可以包括防重放攻击校验信息。在又一个示例中，第一内容还可以既包括第一IPv6报文的净荷中固定长度的数据，又包括防重放攻击校验信息。
在一种实现方式中，若所述第一内容包括所述防重放攻击校验信息，为了使得接收到第一IPv6报文的通信装置对第一签名进行验证，所述第一IPv6报文的报文头中还可以包括所述防重放攻击校验信息。所述报文头中携带的防重放攻击校验信息，一方面可以用于使得接收到第一IPv6报文的通信装置对第一签名进行验证，另一方面可以用于使得接收到第一IPv6报文的通信装置验证第一IPv6报文是否为重放报文。
在一种实现方式中，为了使得接收到第一IPv6报文的通信装置确定第一内容所包括的防重放攻击校验信息的具体类型，以便于接收到第一IPv6报文的通信装置验证第一IPv6报文是否为重放报文。所述第一IPv6报文的报文头中还可以包括第一指示信息，第一指示信息用于指示所述第一内容所包括的至少一种防重放攻击校验信息
在一种实现方式中，考虑到报文序列号、时间戳以及随机数均可以达到防止重放攻击的效果，因此，所述防重放攻击校验信息可以包括报文序列号、时间戳以及随机数中的其中一种或者多种。其中，报文序列号可以是第二通信装置为第一IPv6报文分配的报文序列号，时间戳可以是第二通信装置获取第一IPv6报文时第二通信装置本地的时间戳，随机数可以是第二通信装置生成的随机数。
在一种实现方式中，考虑到对于一个通信装置例如通信装置2而言，其转发的IPv6报文的数量有很多。对于其转发的IPv6报文，其中一些报文在转发过程中需要经过的关键节点为防火墙设备，另外一些IPv6报文需要经过的关键节点为其它类型的设备。对于不同类型的关键节点，通信装置2对IPv6报文中的签名进行验证所使用的密钥和/或哈希算法可能各不相同。在一个示例中，通信装置2可以根据关键节点的类型，确定对IPv6报文中携带的签名进行验证所使用的密钥和/或哈希算法。对于这种情况，所述第一IPv6报文的报文头中还可以包括第二指示信息，第二指示信息用于指示第一IPv6报文转发过程中需要经过的第二通信装置的类型。
在一种实现方式中，所述第一通信装置和所述第二通信装置是同一个装置，即第一通信装置是关键节点。此时，所述第一IPv6报文可以是第一通信装置生成的，换言之，关键节点生成所述第一签名，获得包括有所述第一签名的所述第一IPv6报文。在一个示例中，第一通信装置可以根据所述第二通信装置的第一私钥和第一哈希算法，生成所述第一签名。进一步地，生成包括所述第一签名的第一IPv6报文。
在一种实现方式中，所述第一通信装置为所述第二通信装置在所述第一IPv6报文的转发路径上的下游装置，对于这种情况，第一通信装置在转发所述第一IPv6报文之前，可以根据所述第二通信装置的第一公钥和第一哈希算法，对所述第一签名进行验证。在一个示例中，第一通信装置可以在第一签名通过验证的情况下，转发所述第一IPv6报文，从而避免非法报文在网络中继续传输。在另一个示例中，当对所述第一签名验证失败时，丢弃所述第一IPv6报文，避免可能的攻击报文在网络中继续传输，占用网络资源。
在一种实现方式中，第一通信装置可以利用第一公钥和第一哈希算法对第一签名进行验证，其中，所述第一公钥和/或所述第一哈希算法可以是控制管理实体发送给第一通信装置的。对于这种情况，第一通信装置在对第一签名进行验证之前，还可以接收控制管理实体发送的所述第一公钥和/或所述第一哈希算法。
第二方面，本申请实施例提供了一种报文处理方法，该方法可以由第一通信装置执行。在一个示例中，第一通信装置可以接收第一IPv6报文，对所述接收到的第一IPv6报文进行验证，确定所述第一IPv6报文是否包括第二通信装置的第一签名，根据验证结果验证所述第一IPv6报文在转发过程中是否经过了第二通信装置。一个示例中，该第一IPv6报文的报文头中包括所述第一签名，该第一签名可以用于验证所述第一IPv6报文在转发过程中是否经过了第二通信装置。此处提及的第二通信装置，可以是第一IPv6报文在转发过程中需要经过的关键节点。第一通信装置接收第一IPv6报文之后，可以验证所述第一签名，对第一签名的验证结果用于确定所述第一IPv6报文在转发过程中是否经过了第二通信装置。由此可见，利用本方案，第一通信装置可以确定第一IPv6报文在转发过程中是否经过了关键节点。
在一种实现方式中，若第一通信装置对第一签名进行验证之后，确定第一签名未通过验证，则第一通信装置可以丢弃所述第一IPv6报文，从而避免非法报文在网络中继续传输。
在一种实现方式中，所述第一IPv6报文是因特网协议第6版分段路由SRv6报文。
在一种实现方式中，所述第一签名包含在分段路由头SRH中。
在一种实现方式中，所述SRH包括扩展的类型长度值TLV字段，所述扩展的TLV字段包括所述第一签名。
在一种实现方式中，所述第一签名是根据所述第一IPv6报文中的第一内容进行哈希计算所得。
在一种实现方式中，所述第一内容包括以下任意一项或者多项：净荷中固定长度的数据和防重放攻击校验信息。
在一种实现方式中，所述报文头中还包括防重放攻击校验信息。
在一种实现方式中，所述报文头中还包括第一指示信息，所述第一指示信息用于指示所述第一内容包括的至少一种防重放攻击校验信息。
在一种实现方式中，所述防重放攻击校验信息包括以下一种或多种：报文序列号，时间戳以及随机数。
在一种实现方式中，所述报文头还包括第二指示信息，所述第二指示信息用于指示所述第二通信装置的类型。
在一种实现方式中，若第一IPv6报文的报文头中包括第一指示信息，则第一通信装置 可以根据该第一指示信息确定所述第一内容所包括的至少一种防重放攻击校验信息。进一步地，根据所述至少一种防重放攻击校验信息，进行防重放攻击校验，即验证第一IPv6报文是否为重放报文。
在一种实现方式中，若第一指示信息指示所述第一内容包括报文序列号，则第一通信装置可以从第一IPv6报文的报文头中获取序列号1，并确定在一定时间段内第一通信装置是否接收到报文序列号为序列号1的其它IPv6报文。若第一通信装置在一定时间段内未接收到报文序列号为序列号1的其它IPv6报文，则说明第一IPv6报文不是重放报文。若第一通信装置在一定时间段内曾接收到报文序列号为序列号1的其它IPv6报文，则说明第一IPv6报文为重放报文。若第一Pv6报文为重放报文，则第一通信装置可以不必第一签名进行验证，从而节省对第一签名进行验证的资源开销。
在一种实现方式中，若第一指示信息指示所述第一内容包括时间戳，则第一通信装置可以从第一IPv6报文的报文头中获取时间戳1，并确定第一通信装置接收第一IPv6报文的时间戳2，而后计算时间戳2和时间戳1之间的差值。考虑到若第一IPv6报文不是重放报文，则时间戳2和时间戳1之间的差值应当小于或者等于第一阈值，即第一IPv6报文在关键节点1和第一通信装置之间的传输时延小于或者等于第一阈值。而若第一IPv6报文是重放报文，则时间戳2和时间戳1之间的差值则可能大于第一阈值。因此，若所述时间戳2和时间戳1的差值小于或者等于第一阈值，第一通信装置可以确定第一IPv6报文不是重放报文，若所述时间戳2和时间戳1的差值大于第一阈值，第一通信装置可以确定第一IPv6报文为重放报文。若第一Pv6报文为重放报文，则第一通信装置可以不必第一签名进行验证，从而节省对第一签名进行验证的资源开销。
在一种实现方式中，若第一指示信息指示所述第一内容包括随机数，则第一通信装置可以从第一IPv6报文的报文头中获取随机数1，并确定在一定时间段内第一通信装置是否接收到携带随机数为随机数1的其它IPv6报文。若第一通信装置在一定时间段内未接收到携带随机数为随机数1的其它IPv6报文，则说明第一IPv6报文不是重放报文。若第一通信装置在一定时间段内曾接收到携带随机数为随机数1的其它IPv6报文，则说明第一IPv6报文为重放报文。若第一Pv6报文为重放报文，则第一通信装置可以不必第一签名进行验证，从而节省对第一签名进行验证的资源开销。
在一种实现方式中，所述第一签名是利用所述第二通信装置的第一私钥和第一哈希算法生成的。
在一种实现方式中，第一通信装置验证所述第一签名在具体实现时，可以根据所述第二通信装置的第一公钥和第一哈希算法，对所述第一签名进行验证。
在一种实现方式中，所述方法还包括：接收控制管理实体发送的所述第一公钥和/或所述第一哈希算法。
在一种实现方式中，第一通信装置可以基于控制管理实体的指示，对第一签名进行验证。对于这种情况，第一通信装置还可以接收控制管理实体发送的第三指示信息，所述第三指示信息用于指示所述第一通信装置对所述第一签名进行验证。
在一种实现方式中，所述第一通信装置为所述第二通信装置在所述第一IPv6报文的转发路径上的下游装置。
在一种实现方式中，所述第一通信装置是所述第一IPv6报文的SRH中的SID list所指示的尾节点。
第三方面，本申请提供了一种第一通信装置，包括：收发单元和处理单元。所述收发单元用于执行以上第一方面以及第一方面任意一项所述的第一通信装置执行的收发操作，所述处理单元用于执行以上第一方面以及第一方面任意一项所述的第一通信装置执行的除收发操作之外的其它操作。
第四方面，本申请提供了一种第一通信装置，所述第一通信装置包括存储器和处理器；所述存储器，用于存储程序代码；所述处理器，用于运行所述程序代码中的指令，使得所述第一通信装置执行以上第一方面以及第一方面任意一项所述的方法。
第五方面，本申请提供了一种第一通信装置，所述第一通信装置包括通信接口和处理器，所述通信接口用于执行以上第一方面以及第一方面任意一项所述的第一通信装置执行的收发操作，所述处理器用于执行以上第一方面以及第一方面任意一项所述的第一通信装置执行的除收发操作之外的其它操作。
第六方面，本申请提供了一种第一通信装置，包括：收发单元和处理单元。所述收发单元用于执行以上第二方面以及第二方面任意一项所述的第一通信装置执行的收发操作，所述处理单元用于执行以上第二方面以及第二方面任意一项所述的第一通信装置执行的除收发操作之外的其它操作。
第七方面，本申请提供了一种第一通信装置，所述第一通信装置包括存储器和处理器；所述存储器，用于存储程序代码；所述处理器，用于运行所述程序代码中的指令，使得所述第一通信装置执行以上第二方面以及第二方面任意一项所述的方法。
第八方面，本申请提供了一种第一通信装置，所述第一通信装置包括通信接口和处理器，所述通信接口用于执行以上第二方面以及第二方面任意一项所述的第一通信装置执行的收发操作，所述处理器用于执行以上第二方面以及第二方面任意一项所述的第一通信装置执行的除收发操作之外的其它操作。
第九方面，本申请提供了一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得所述计算机执行以上第一方面以及第一方面任意一项所述的方法，或者，使得所述计算机执行以上第二方面以及第二方面任意一项所述的方法。
第十方面，本申请提供了一种通信系统，该通信系统包括以上第三方面或者第四方面或者第五方面所述的第一通信装置，以及以上第六方面或者第七方面或者第八方面所述的第一通信装置。
附图说明
为了更清楚地说明本申请实施例或现有技术中的技术方案，下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，在不付出创造性劳动的前提下，还可以根据这些附图获得其他的附图。
图1为一种示例性应用场景示意图；
图2为本申请实施例提供的一种报文处理方法的信令交互图；
图3为本申请实施例提供的一种扩展的TLV字段的示意图；
图4为本申请实施例提供的一种报文处理方法的流程示意图；
图5为本申请实施例提供的一种报文处理方法的流程示意图；
图6为本申请实施例提供的一种通信装置的结构示意图；
图7为本申请实施例提供的一种通信装置的结构示意图；
图8为本申请实施例提供的一种通信装置的结构示意图。
具体实施方式
本申请实施例提供了一种报文处理方法及装置，可以确定IPv6报文在转发过程中是否经过了关键节点。
为方便理解，首先对本申请实施例可能的应用场景进行介绍。
因特网协议第6版段路由(Segment Routing Internet Protocol Version 6，SRv6)技术，可以将分段路由(segment routing，SR)技术应用于因特网协议第六版(internet protocol version 6，IPv6)报文的转发。其中，利用SRv6技术转发的报文，可以称为SRv6报文。
SRv6报文的报文头包括分段路由头(segment routing header，SRH)。SRH包括段标识列表(segment identifier list，SID list)，该SID list用于指示SRv6报文的转发路径。因此，对于SRv6报文而言，可以通过SRH中的SID list确定其在转发过程中是否经过了关键节点。
但是，SRv6报文在转发过程中可能被篡改，换言之，SRv6报文的SID list在转发过程中也可能会被篡改。若SID list被篡改，则根据该SID list则不能准确的确定SRv6报文在转发过程中是否经过了关键节点。
本申请的发明人发现，目前，可以通过密钥相关的哈希运算消息认证码(hashed-based message authentication code，HMAC)校验，来确定SRv6报文的SRH是否被篡改。相应的，在SRH没有被篡改的情况下，根据SRH中的SID list确定其在转发过程中是否经过了关键节点。关于HMAC校验，可以参考因特网工程任务组(internet engineering task framework，IETF)制定的征求意见稿RFC8754中的相关描述，此处不做详细描述。
但是，这种方式也会存在一些问题。例如，网络黑客将被配置进行HMAC校验的节点从该SRv6报文的SID list删除，则该SRv6报文在转发过程中不再经过该被配置进行HMAC校验的节点。相应的，该被配置进行HMAC校验的节点也不能再对该SRv6报文进行HMAC校验。这就导致该SRv6报文的SID list的合法性无法确定，进一步的也无法根据该SID list确定该SRv6报文在转发过程中是否经过了关键节点。
现结合图1所示的场景进行介绍。图1为一种示例性应用场景示意图。
如图1所示，正常情况下，SRv6报文的转发路径为通信装置R1-通信装置R2-防火墙FW1-通信装置R3-通信装置R4-服务器S1。其中，防火墙FW1为SRv6报文转发过程中需要经过的关键节点。通信装置R2被配置进行HMAC校验，以验证该SRv6报文的SID list是否被篡改。但是，若网络黑客对该SRv6报文的SID list进行了修改，将通信装置R2的SID从该SID list中删除，则篡改后的SRv6报文的不再经过通信装置R2转发，因此，通信装置R2也不能对该SRv6报文进行HMAC校验。从而无法判断该SRv6报文的SID list是否被篡改。相应的，其它 通信装置也无法根据该SID list确定SRv6报文在转发过程中是否经过了关键节点。另外，在一些示例中，网络黑客除了将通信装置R2的SID从该SID list中删除之外，还可以将防火墙FW1的SID从该SID list中删除，从而使得该报文绕过关键节点(防火墙FW1)转发。
为了解决上述问题，本申请实施例提供了一种报文处理方法，以下结合附图介绍该方法。
在介绍本申请实施例提供的报文处理方法之前，需要说明的是，图1只是为了方便理解而示出，其并不构成对本申请实施例的限定。而且，被配置进行HMAC校验的节点除了是通信装置R2之外，还可以是通信装置R3、通信装置R4或者通信装置R5。SRv6报文转发过程中必须经过的关键节点，除了可以是图1所示的防火墙之外，还可以是其它类型设备，例如可以是防止拒绝服务(denial of service，DoS)攻击的服务器。
本申请实施例中提及的通信装置，可以是交换机、路由器等网络设备，也可以是网络设备上的一部分组件，例如是网络设备上的单板，线卡，还可以是网络设备上的一个功能模块，本申请实施例不做具体限定。通信装置之间例如可以通过以太网线或光缆直接连接。
图2为本申请实施例提供的一种报文处理方法的信令交互图。图2所示的报文处理方法100，例如可以包括如下S101-S104。
S101：通信装置1获取报文1，报文1为IPv6报文，报文1的报文头中包括签名1，签名1用于验证报文1在转发过程中是否经过了关键节点1。
此处提及的通信装置1，例如可以是图1所示的防火墙FW1、通信装置R3、通信装置R4或者服务器S1。此处提及的关键节点1，例如可以是图1所示的防火墙FW1。
在本申请实施例中，通信装置1获取报文1在具体实现时，可以有多种实现方式。
在一个示例中，通信装置1作为报文1的转发路径上、所述关键节点1的下游装置，则通信装置1可以接收上游装置发送的报文1。此处提及的上游装置，例如可以是所述关键节点1。
在一个示例中，通信装置1可以为所述关键节点1，即通信装置1和所述关键节点1是同一个通信装置。对于这种情况，通信装置1可以生成报文1。在一个示例中，通信装置1可以接收其它通信装置发送的报文2，对报文2进行重新封装，得到包括签名1的报文1。换言之，关键节点1接收到报文2之后，对报文2进行签名，以说明报文2在转发过程中经过了所述关键节点1。关键节点1对报文2进行签名之后得到包括签名1的报文1，报文1中的签名1可以用于确定报文1在转发过程中是否经过了所述关键节点1。此处提及的报文2，也可以是IPv6报文。在一些实施例中，所述签名1可以携带在报文1的报文的扩展的类型长度值(type length value，TLV)字段中。
在本申请实施例的一种实现方式中，签名1可以是关键节点1对报文1中的第一内容进行哈希计算得到的。在一个示例中，关键节点1可以对利用关键节点1自身的第一私钥和第一哈希算法对第一内容进行计算，从而得到所述签名1。例如，关键节点1可以利用第一哈希算法对第一内容进行计算，得到摘要1，而后利用第一私钥对所述摘要1进行加密，得到所述签名1。
本申请实施例不具体限定所述第一内容，在一个示例中，为了降低签名1被破解的可能性，所述第一内容可以包括所述报文1的净荷中固定长度的数据。因为不同的IPv6报文，其报文净荷对应的数据也不同，因此，利用报文的净荷中固定长度的数据计算签名，可以使 得不同IPv6报文所携带的签名不同，从而降低IPv6报文中携带的签名被破解的可能性。在另一个示例中，为了防止重放攻击，所述第一内容还可以包括防重放攻击校验信息。在又一个示例中，第一内容还可以既包括报文1的净荷中固定长度的数据，又包括防重放攻击校验信息。
本申请实施例不具体限定所述防重放攻击校验信息，考虑到报文序列号、时间戳以及随机数均可以达到防止重放攻击的效果，因此，所述防重放攻击校验信息可以包括报文序列号、时间戳以及随机数中的其中一种或者多种。其中，报文序列号可以是关键节点1为报文1分配的报文序列号，时间戳可以是关键节点1获取报文1时关键节点1本地的时间戳，随机数可以是关键节点1生成的随机数。
在本申请实施例的一种实现方式中，若所述第一内容包括所述防重放攻击校验信息，为了使得接收到报文1的通信装置对签名1进行验证，所述报文1的报文头中还可以包括所述防重放攻击校验信息。所述报文头中携带的防重放攻击校验信息，一方面可以用于使得接收到报文1的通信装置对签名1进行验证，另一方面可以用于使得接收到报文1的通信装置验证报文1是否为重放报文。在一个示例中，所述防重放攻击校验信息和所述签名1可以携带在同一个扩展的TLV字段中。在又一个示例中，所述防重放攻击校验信息可以携带在一个单独的扩展的TLV字段中。
在本申请实施例的一种实现方式中，为了使得接收到报文1的通信装置确定第一内容所包括的防重放攻击校验信息具体是哪一种或者哪几种防重放攻击校验信息，以便于接收到报文1的通信装置验证报文1是否为重放报文。所述报文1的报文头中还可以包括指示信息1，指示信息1用于指示所述第一内容所包括的至少一种防重放攻击校验信息。在一个示例中，报文1的报文头中包括第一指示位，第二指示位和第三指示位，第一指示位，第二指示位和第三指示位用于携带所述指示信息1。其中，第一指示位用于指示第一内容包括的防重放攻击校验信息是否包括报文序列号，第二指示位用于指示第一内容包括的防重放攻击校验信息是否包括时间戳，第三指示位用于指示第一内容包括的防重放攻击校验信息是否包括随机数。
举例说明，第一指示位、第二指示位和第三指示位各占1比特。当第一指示位的值为1时，说明第一内容包括的防重放攻击校验信息包括报文序列号，当第一指示位的值为0时，说明第一内容包括的防重放攻击校验信息不包括报文序列号；当第二指示位的值为1时，说明第一内容包括的防重放攻击校验信息包括时间戳，当第二指示位的值为0时，说明第一内容包括的防重放攻击校验信息不包括报文时间戳；当第三指示位的值为1时，说明第一内容包括的防重放攻击校验信息包括随机数，当第三指示位的值为0时，说明第一内容包括的防重放攻击校验信息不包括报文随机数。
在一个示例中，所述防重放攻击校验信息和所述指示信息1可以携带在同一个扩展的TLV字段中。在又一个示例中，所述指示信息1可以携带在一个单独的扩展的TLV字段中。
在一种实现方式中，考虑到对于一个通信装置例如通信装置2而言，其转发的IPv6报文的数量有很多。对于其转发的IPv6报文，其中一些报文在转发过程中需要经过的关键节点为防火墙设备，另外一些IPv6报文需要经过的关键节点为其它类型的设备，例如防止DoS攻击的服务器。对于不同类型的关键节点，通信装置2对IPv6报文中的签名进行验证所使用 的密钥和/或哈希算法可能各不相同。在一个示例中，通信装置2可以根据关键节点的类型，确定对IPv6报文中携带的签名进行验证所使用的密钥和/或哈希算法。对于这种情况，所述报文1的报文头中还可以包括指示信息2，指示信息2用于指示报文1转发过程中需要经过的关键节点1的类型。在一个示例中，所述指示信息2和所述签名1可以携带在同一个扩展的TLV字段中。在又一个示例中，所述指示信息2可以携带在一个单独的扩展的TLV字段中。
在本申请实施例的一种实现方式中，所述报文1的报文头包括SRH，换言之，报文1可以是SRv6报文。在一种实现方式中，当报文1是SRv6报文时，前述签名1可以携带在报文1的SRH中。在一个示例中，报文1的SRH可以包括扩展的TLV字段，所述签名1可以携带在所述扩展的TLV字段中。
在一个示例中，前述签名1、放重放攻击校验信息、指示信息1和指示信息2，可以携带在同一个扩展的TLV字段中。可结合图3进行理解，图3为本申请实施例提供的一种扩展的TLV字段的示意图。其中：
节点类型字段用于携带指示关键节点1的类型的指示信息2。
S(sequence)指示位可以相当于上文提及的第一指示位，用于指示第一内容包括的防重放攻击校验信息是否包括报文序列号；T(timestamp)指示位可以相当于上文提及的第二指示位，用于指示第一内容包括的防重放攻击校验信息是否包括时间戳；N(nounce)指示位可以相当于上文提及的第三指示位，用于指示第一内容包括的防重放攻击校验信息是否包括随机数。
sequence字段用于携带序列号。sequence字段在所述S指示位指示第一内容包括的防重放攻击校验信息包括报文序列号时有效。在一个示例中，若S指示位指示第一内容包括的防重放攻击校验信息不包括报文序列号，则所述TLV字段可以不包括所述sequence字段。
timestamp字段用于携带时间戳。timestamp字段在S指示位指示第一内容包括的防重放攻击校验信息包括时间戳时有效。在一个示例中，若S指示位指示第一内容包括的防重放攻击校验信息不包括时间戳，则所述TLV字段可以不包括所述timestamp字段。
nounce字段用于携带随机数。nounce字段在N指示位指示第一内容包括的防重放攻击校验信息包括随机数时有效。在一个示例中，若N指示位指示第一内容包括的防重放攻击校验信息不包括随机数，则所述TLV字段可以不包括所述nounce字段。
signature字段用于携带签名1。
在一个示例中，图3所示的扩展的TLV字段，可以位于SRH中，例如所述扩展的TLV字段可以位于SID list之后。
S102：通信装置1转发报文1。
S103：通信装置2接收报文1。
通信装置1可以获取报文1之后，可以转发所述报文1，通信装置2作为报文1的转发路径上、所述通信装置1的下游装置，可以接收所述通信装置1发送的所述报文1。此处提及的通信装置2，可以是图1所示通信装置R3、通信装置R4或者服务器S1。在一个示例中，当所述报文1为SRv6报文时，所述通信装置2可以是报文1的SRH中的SID list所指示的尾节点，例如通信装置2是图1所示的服务器S1。
S104：通信装置2验证报文1中的签名1，对签名1的验证结果用于确定报文1在转发过程 中是否经过了关键节点1。
通信装置2接收到报文1之后，可以对报文1中的签名1进行验证，以确定报文1在转发过程中是否经过了关键节点1。
如前S101中所述，在一个示例中，签名1可以是所述关键节点1利用关键节点1的第一私钥和第一哈希算法生成的。因此，通信装置2可以利用关键节点1的第一公钥和第一哈希算法，对所述签名1进行验证。其中，所述第一公钥和第一私钥构成一组公私钥对。在一个示例中，通信装置2可以利用第一公钥对签名1进行解密，得到摘要2，并利用第一哈希算法对第一内容进行哈希计算，得到摘要3，然后对摘要2和摘要3进行匹配验证。在一个示例中，若摘要2和摘要3相同，则确定签名1通过验证，若摘要2和摘要3不同，则确定签名1未通过验证。
若签名1通过验证，则通信装置2可以确定报文1在转发过程中经过了关键节点1。对于这种情况，通信装置1例如可以继续转发报文1。若签名1未通过验证，说明报文1在转发过程中被篡改了，对于这种情况，通信装置2可以丢弃报文1。
在本申请实施例的一种实现方式中，通信装置2可以基于控制管理实体的指示，对签名1进行验证。换言之，通信装置2在对签名1进行验证之前，还可以接收控制管理实体发送的指示信息3，并根据所述指示信息3对签名1进行验证，其中，指示信息3用于指示通信装置1对签名1进行验证。
在本申请实施例的一种实现方式中，通信装置2对签名1进行验证的第一公钥和/或第一哈希算法，也可以是控制管理实体发送给通信装置2的。换言之，在通信装置2对签名1进行验证之前，还可以接收控制管理实体发送的所述第一公钥和/或第一哈希算法。
本申请实施例中提及的控制管理实体例如可以为运行了网络管理软件(network manage system，NMS)的设备，又如可以为控制器。控制管理实体，可以是实现控制和/或管理功能的功能模块，也可以是运行了相关功能模块的物理实体，上述物理实体例如可以是安装了相关软件的服务器，相关软件用于实现控制管理实体的功能。本申请实施例不做具体限定。
如前文，所述第一内容可以包括防重放攻击校验信息。当所述第一内容可以包括防重放攻击校验信息时，报文1的报文头中可以包括所述防重放攻击校验信息。对于这种情况，通信装置2在对签名1进行验证之前，还可以根据该防重放攻击校验信息验证报文1是否为重放报文。若报文1为重放报文，则通信装置1可以不执行对签名1进行校验的步骤，直接丢弃报文1；若报文1不是重放报文，通信装置2可以执行对签名1进行验证的步骤。
在一个示例中，若报文1的报文头中包括指示信息1，则通信装置2可以根据该指示信息1确定所述第一内容所包括的至少一种防重放攻击校验信息。进一步地，根据所述至少一种防重放攻击校验信息，验证报文1是否为重放报文。
在一个示例中，若指示信息1指示所述第一内容包括报文序列号，则通信装置2可以从报文1的报文头中获取序列号1，并确定在一定时间段内通信装置2是否接收到报文序列号为序列号1的其它IPv6报文。若通信装置2在一定时间段内未接收到报文序列号为序列号1的其它IPv6报文，则说明报文1不是重放报文。若通信装置2在一定时间段内曾接收到报文序列号为序列号1的其它IPv6报文，则说明报文1为重放报文。
在一种实现方式中，通信装置2本地可以存储有一定时间段内接收到的IPv6报文的报文序列号，并将所述序列号1与预先存储的报文序列号进行比对。若预先存储的报文序列号中包括所述序列号1，则说明在一定时间段内通信装置2曾经接收到报文序列号为序列号1的其它IPv6报文；若预先存储的报文序列号中不包括所述序列号1，则说明在一定时间段内通信装置2未接收到报文序列号为序列号1的其它IPv6报文。
在一个示例中，若指示信息1指示所述第一内容包括时间戳，则通信装置2可以从报文1的报文头中获取时间戳1，并确定通信装置2接收报文1的时间戳2，而后计算时间戳2和时间戳1之间的差值。考虑到若报文1不是重放报文，则时间戳2和时间戳1之间的差值应当小于第一阈值，即报文1在关键节点1和通信装置2之间的传输时延小于第一阈值。而若报文1是重放报文，则时间戳2和时间戳1之间的差值则可能大于或者等于第一阈值。因此，若所述时间戳2和时间戳1的差值小于第一阈值，通信装置2可以确定报文1不是重放报文，若所述时间戳2和时间戳1的差值大于或者等于第一阈值，通信装置2可以确定报文1为重放报文。其中，时间戳2为通信装置2接收到报文1时，通信装置2的本地时间戳。
在一个示例中，若指示信息1指示所述第一内容包括随机数，则通信装置2可以从报文1的报文头中获取随机数1，并确定在一定时间段内通信装置2是否接收到携带随机数为随机数1的其它IPv6报文。若通信装置2在一定时间段内未接收到携带随机数为随机数1的其它IPv6报文，则说明报文1不是重放报文。若通信装置2在一定时间段内曾接收到携带随机数为随机数1的其它IPv6报文，则说明报文1为重放报文。
在一种实现方式中，通信装置2本地可以存储有一定时间段内接收到的IPv6报文所携带的随机数，并将所述随机数1与预先存储的随机数进行比对。若预先存储的随机数中包括所述随机数1，则说明在一定时间段内通信装置2曾经接收到携带随机数为随机数1的其它IPv6报文；若预先存储的随机数中不包括所述随机数1，则说明在一定时间段内通信装置2未接收到携带随机数为所述随机数1的其它IPv6报文。
如前所述，通信装置1和所述关键节点1可以是同一个装置，也可以是不同的装置。当通信装置1和所述关键节点是不同的装置时，通信装置1可以是报文1的转发路径中、所述关键结点1的下游装置。对于这种情况，通信装置1在转发报文1之前，还可以对签名1进行验证，并在签名1通过验证的情况下，转发报文1。关于通信装置1对签名1进行验证的具体实现，可以参考上文S104通信装置2对签名1进行验证的描述部分，此处不再重复描述。
通过以上描述可知，利用方法100，报文1的转发路径中所述关键节点1的下游装置，可以通过对签名1进行验证，从而确定报文1在转发过程中是否经过了所述关键节点1。当报文1是SRv6报文时，方法100可以克服上文对于图1的描述部分提及的由于被配置进行HMAC校验的节点被网络黑客从SRH的SID list中删除，从而导致无法通过SID list确定报文1在转发过程中是否经过了关键节点1的问题。
图4为本申请实施例提供的一种报文处理方法的流程示意图。图4所示的报文处理方法200，可以由第一通信装置执行。第一通信装置可以为以上实施例中的通信装置1。用于执行以上方法100中通信装置1执行的步骤。所述方法200例如可以包括如下S201-S202。
S201：获取第一IPv6报文，所述第一IPv6报文的报文头中包括第一签名，所述第一签名用于验证所述第一IPv6报文在转发过程中是否经过了第二通信装置。
S202：转发所述第一IPv6报文。
此处提及的第一IPv6报文，可以对应方法100中的报文1，此处提及的第一签名，可以对应方法100中的签名1，此处提及的第二通信装置，可以对应方法100中的关键节点1。
在一种实现方式中，所述第一IPv6报文是因特网协议第6版分段路由SRv6报文。
在一种实现方式中，所述第一签名包含在分段路由头SRH中。
在一种实现方式中，所述SRH包括扩展的类型长度值TLV字段，所述扩展的TLV字段包括所述第一签名。
在一种实现方式中，所述第一签名是根据所述第一IPv6报文中的第一内容进行哈希计算所得。
在一种实现方式中，所述第一内容包括以下一项或多项：
净荷中固定长度的数据和防重放攻击校验信息。
在一种实现方式中，所述报文头中还包括防重放攻击校验信息。
在一种实现方式中，所述报文头中还包括第一指示信息，所述第一指示信息用于指示所述第一内容包括的至少一种防重放攻击校验信息。
此处提及的第一指示信息，可以对应方法100中的指示信息1。
在一种实现方式中，所述防重放攻击校验信息包括以下一种或多种：
报文序列号，时间戳以及随机数。
在一种实现方式中，所述报文头还包括第二指示信息，所述第二指示信息用于指示所述第二通信装置的类型。
此处提及的第二指示信息，可以对应方法100中的指示信息2。
在一种实现方式中，所述第一通信装置和所述第二通信装置是同一个装置，所述获取所述第一IPv6报文包括：
根据所述第二通信装置的第一私钥，生成所述第一签名。
在一种实现方式中，所述第一通信装置为所述第二通信装置在所述第一IPv6报文的转发路径上的下游装置，所述转发所述第一IPv6报文之前，所述方法还包括：
根据所述第二通信装置的第一公钥，对所述第一签名进行验证。
在一种实现方式中：接收控制管理实体发送的所述第一公钥和/或计算签名所需的第一哈希算法。
图5为本申请实施例提供的一种报文处理方法的流程示意图。图5所示的报文处理方法300，可以由第一通信装置执行。第一通信装置可以为以上实施例中的通信装置2。用于执行以上方法100中通信装置2执行的步骤。所述方法300例如可以包括如下S301-S302。
S301：接收第一IPv6报文，所述第一IPv6报文包括第一签名，所述第一签名用于验证所述第一IPv6报文的转发路径是否经过了第二通信装置。
S302：验证所述第一签名，验证结果用于确定所述第一IPv6报文在转发过程中是否经过了所述第二通信装置。
此处提及的第一IPv6报文，可以对应方法100中的报文1，此处提及的第一签名，可以对应方法100中的签名1，此处提及的第二通信装置，可以对应方法100中的关键节点1。
在一种实现方式中，所述方法还包括：
若验证不通过，则丢弃所述第一IPv6报文。
在一种实现方式中，所述第一IPv6报文是因特网协议第6版分段路由SRv6报文。
在一种实现方式中，所述第一签名包含在分段路由头SRH中。
在一种实现方式中，所述SRH包括扩展的类型长度值TLV字段，所述扩展的TLV字段包括所述第一签名。
在一种实现方式中，所述第一签名是根据所述第一IPv6报文中的第一内容进行哈希计算所得。
在一种实现方式中，所述第一内容包括以下任意一项或者多项：
净荷中固定长度的数据和防重放攻击校验信息。
在一种实现方式中，所述报文头中还包括防重放攻击校验信息。
在一种实现方式中，所述报文头中还包括第一指示信息，所述第一指示信息用于指示所述第一内容包括的至少一种防重放攻击校验信息。
此处提及的第一指示信息，可以对应方法100中的指示信息1。
在一种实现方式中，所述防重放攻击校验信息包括以下一种或多种：
报文序列号，时间戳以及随机数。
在一种实现方式中，所述报文头还包括第二指示信息，所述第二指示信息用于指示所述第二通信装置的类型。
此处提及的第二指示信息，可以对应方法100中的指示信息2。
在一种实现方式中，若所述第一指示信息指示所述第一内容包括报文序列号，在验证所述第一签名之前，所述方法还包括：
确定在一定时间段内所述第一通信装置未接收到序列号与所述第一IPv6报文中携带的所述序列号相同的其它IPv6报文。
在一种实现方式中，若所述第一指示信息指示所述第一内容包括时间戳，在验证所述第一签名之前，所述方法还包括：
获取所述第一通信装置接收所述第一IPv6报文时的第一时间戳；
确定第一时间戳与所述第一IPv6报文中携带的所述时间戳之间的差值小于第一阈值。
在一种实现方式中，若所述第一指示信息指示所述第一内容包括随机数，在验证所述第一签名之前，所述方法还包括：
确定在一定时间段内所述第一通信装置未接收到携带随机数与所述第一IPv6报文中携带的所述随机数相同的其它IPv6报文。
在一种实现方式中，所述第一签名是利用所述第二通信装置的第一私钥生成的。
在一种实现方式中，所述验证所述第一签名，包括：
根据所述第二通信装置的第一公钥，对所述第一签名进行验证。
在一种实现方式中，所述方法还包括：
接收控制管理实体发送的所述第一公钥和/或计算签名所需的第一哈希算法。
在一种实现方式中，所述方法还包括：
接收控制管理实体发送的第三指示信息，所述第三指示信息用于指示所述第一通信装置对所述第一签名进行验证。
此处提及的第三指示信息，可以对应方法100中的指示信息3。
在一种实现方式中，所述第一通信装置为所述第二通信装置在所述第一IPv6报文的转发路径上的下游装置。
在一种实现方式中，所述第一通信装置是所述第一IPv6报文的SRH中的SID list所指示的尾节点。
关于以上方法200以及方法300的具体实现，可以参考上文对于方法100的描述部分，此处不做详述。
此外，本申请实施例还提供了一种通信装置600，参见图6所示。图6为本申请实施例提供的一种通信装置的结构示意图。该通信装置600包括收发单元601和处理单元602。该通信装置600可以用于执行以上实施例中的方法100、方法200或者方法300。
在一个示例中，所述通信装置600可以执行以上实施例中的方法100，当通信装置600用于执行以上实施例中的方法100时，通信装置600相当于方法100中的通信装置1。收发单元601用于执行方法100中通信装置1执行的收发操作。处理单元602用于执行方法100中通信装置1执行的除收发操作之外的操作。例如：处理单元602用于获取报文1，报文1为IPv6报文，报文1的报文头中包括签名1，签名1用于验证报文1在转发过程中是否经过了关键节点1；收发单元601用于转发报文1。
在一个示例中，所述通信装置600可以执行以上实施例中的方法100，当通信装置600用于执行以上实施例中的方法100时，通信装置600相当于方法100中的通信装置2。收发单元601用于执行方法100中通信装置2执行的收发操作。处理单元602用于执行方法100中通信装置2执行的除收发操作之外的操作。例如：收发单元601用于接收报文1，报文1为IPv6报文，报文1的报文头中包括签名1，签名1用于验证报文1在转发过程中是否经过了关键节点1；处理单元602用于验证报文1中的签名1，对签名1的验证结果用于确定报文1在转发过程中是否经过了关键节点1。
在一个示例中，所述通信装置600可以执行以上实施例中的方法200，当通信装置600用于执行以上实施例中的方法200时，通信装置600相当于方法200中的第一通信装置。收发单元601用于执行方法200中第一通信装置执行的收发操作。处理单元602用于执行方法200中第一通信装置执行的除收发操作之外的操作。例如：处理单元602用于获取第一因特网协议第6版IPv6报文，所述第一IPv6报文的报文头中包括第一签名，所述第一签名用于验证所述第一IPv6报文在转发过程中是否经过了第二通信装置；收发单元601用于转发所述第一IPv6报文。
在一个示例中，所述通信装置600可以执行以上实施例中的方法300，当通信装置600用于执行以上实施例中的方法300时，通信装置600相当于方法300中的第一通信装置。收发单元601用于执行方法300中第一通信装置执行的收发操作。处理单元602用于执行方法300中第一通信装置执行的除收发操作之外的操作。例如：收发单元601用于接收第一IPv6报文，所述第一IPv6报文包括第一签名，所述第一签名用于验证所述第一IPv6报文的转发路径是否经过了第二通信装置；处理单元602用于验证所述第一签名，验证结果用于确定所述第一IPv6报文在转发过程中是否经过了所述第二通信装置。
此外，本申请实施例还提供了一种通信装置700，参见图7所示，图7为本申请实施例提 供的一种通信装置的结构示意图。该通信装置700包括通信接口701和与通信接口701连接的处理器702。该通信装置700可以用于执行以上实施例中的方法100、方法200或者方法300。
在一个示例中，所述通信装置700可以执行以上实施例中的方法100，当通信装置700用于执行以上实施例中的方法100时，通信装置700相当于方法100中的通信装置1。通信接口701用于执行方法100中通信装置1执行的收发操作。处理器702用于执行方法100中通信装置1执行的除收发操作之外的操作。例如：处理器702用于获取报文1，报文1为IPv6报文，报文1的报文头中包括签名1，签名1用于验证报文1在转发过程中是否经过了关键节点1；通信接口701用于转发报文1。
在一个示例中，所述通信装置700可以执行以上实施例中的方法100，当通信装置700用于执行以上实施例中的方法100时，通信装置700相当于方法100中的通信装置2。通信接口701用于执行方法100中通信装置2执行的收发操作。处理器702用于执行方法100中通信装置2执行的除收发操作之外的操作。例如：通信接口701用于接收报文1，报文1为IPv6报文，报文1的报文头中包括签名1，签名1用于验证报文1在转发过程中是否经过了关键节点1；处理器702用于验证报文1中的签名1，对签名1的验证结果用于确定报文1在转发过程中是否经过了关键节点1。
在一个示例中，所述通信装置700可以执行以上实施例中的方法200，当通信装置700用于执行以上实施例中的方法200时，通信装置700相当于方法200中的第一通信装置。通信接口701用于执行方法200中第一通信装置执行的收发操作。处理器702用于执行方法200中第一通信装置执行的除收发操作之外的操作。例如：处理器702用于获取第一因特网协议第6版IPv6报文，所述第一IPv6报文的报文头中包括第一签名，所述第一签名用于验证所述第一IPv6报文在转发过程中是否经过了第二通信装置；通信接口701用于转发所述第一IPv6报文。
在一个示例中，所述通信装置700可以执行以上实施例中的方法300，当通信装置700用于执行以上实施例中的方法300时，通信装置700相当于方法300中的第一通信装置。通信接口701用于执行方法300中第一通信装置执行的收发操作。处理器702用于执行方法300中第一通信装置执行的除收发操作之外的操作。例如：通信接口701用于接收第一IPv6报文，所述第一IPv6报文包括第一签名，所述第一签名用于验证所述第一IPv6报文的转发路径是否经过了第二通信装置；处理器702用于验证所述第一签名，验证结果用于确定所述第一IPv6报文在转发过程中是否经过了所述第二通信装置。
此外，本申请实施例还提供了一种通信装置800，参见图8所示，图8为本申请实施例提供的一种通信装置的结构示意图。
该通信装置800可以用于执行以上实施例中的方法100、方法200、或者方法300。
如图8所示，通信装置800可以包括处理器810，与所述处理器810耦合连接的存储器820，收发器830。收发器830例如可以是通信接口，光模块等。处理器810可以是中央处理器(英文：central processing unit，缩写：CPU)，网络处理器(英文：network processor，缩写：NP)或者CPU和NP的组合。处理器还可以是专用集成电路(英文：application-specific integrated circuit，缩写：ASIC)，可编程逻辑器件(英文：programmable logic device，缩写：PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(英文：complex programmable logic  device，缩写：CPLD)，现场可编程逻辑门阵列(英文：field-programmable gate array，缩写：FPGA)，通用阵列逻辑(英文：generic array logic,缩写：GAL)或其任意组合。处理器810可以是指一个处理器，也可以包括多个处理器。存储器820可以包括易失性存储器(英文：volatile memory)，例如随机存取存储器(英文：random-access memory，缩写：RAM)；存储器也可以包括非易失性存储器(英文：non-volatile memory)，例如只读存储器(英文：read-only memory，缩写：ROM)，快闪存储器(英文：flash memory)，硬盘(英文：hard disk drive，缩写：HDD)或固态硬盘(英文：solid-state drive，缩写：SSD)；存储器820还可以包括上述种类的存储器的组合。存储器820可以是指一个存储器，也可以包括多个存储器。在一个实施方式中，存储器820中存储有计算机可读指令，所述计算机可读指令包括多个软件模块，例如发送模块821，处理模块822和接收模块823。处理器810执行各个软件模块后可以按照各个软件模块的指示进行相应的操作。在本实施例中，一个软件模块所执行的操作实际上是指处理器810根据所述软件模块的指示而执行的操作。
在一个示例中，所述通信装置800可以执行以上实施例中的方法100，当通信装置800用于执行以上实施例中的方法100时，通信装置800相当于方法100中的通信装置1。收发器830用于执行方法100中通信装置1执行的收发操作。处理器810用于执行方法100中通信装置1执行的除收发操作之外的操作。例如：处理器810用于获取报文1，报文1为IPv6报文，报文1的报文头中包括签名1，签名1用于验证报文1在转发过程中是否经过了关键节点1；收发器830用于转发报文1。
在一个示例中，所述通信装置800可以执行以上实施例中的方法100，当通信装置800用于执行以上实施例中的方法100时，通信装置800相当于方法100中的通信装置2。收发器830用于执行方法100中通信装置2执行的收发操作。处理器810用于执行方法100中通信装置2执行的除收发操作之外的操作。例如：收发器830用于接收报文1，报文1为IPv6报文，报文1的报文头中包括签名1，签名1用于验证报文1在转发过程中是否经过了关键节点1；处理器810用于验证报文1中的签名1，对签名1的验证结果用于确定报文1在转发过程中是否经过了关键节点1。
在一个示例中，所述通信装置800可以执行以上实施例中的方法200，当通信装置800用于执行以上实施例中的方法200时，通信装置800相当于方法200中的第一通信装置。收发器830用于执行方法200中第一通信装置执行的收发操作。处理器810用于执行方法200中第一通信装置执行的除收发操作之外的操作。例如：处理器810用于获取第一因特网协议第6版IPv6报文，所述第一IPv6报文的报文头中包括第一签名，所述第一签名用于验证所述第一IPv6报文在转发过程中是否经过了第二通信装置；收发器830用于转发所述第一IPv6报文。
在一个示例中，所述通信装置800可以执行以上实施例中的方法300，当通信装置800用于执行以上实施例中的方法300时，通信装置800相当于方法300中的第一通信装置。收发器830用于执行方法300中第一通信装置执行的收发操作。处理器810用于执行方法300中第一通信装置执行的除收发操作之外的操作。例如：收发器830用于接收第一IPv6报文，所述第一IPv6报文包括第一签名，所述第一签名用于验证所述第一IPv6报文的转发路径是否经过了第二通信装置；处理器810用于验证所述第一签名，验证结果用于确定所述第一IPv6报 文在转发过程中是否经过了所述第二通信装置。
本申请还提供了一种计算机可读存储介质，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得所述计算机执行前述实施例中任一实施例所述的方法(例如，方法100，方法200和方法300)中任意一个或多个操作。
本申请还提供了一种计算机程序产品，包括计算机程序，当其在计算机上运行时，使得所述计算机执行前述实施例中任一实施例所述的方法(例如，方法100，方法200和方法300)中任意一个或多个操作。
本申请还提供了一种通信系统，包括以上实施例提及的任一种执行方法200的第一通信装置和任一种执行方法300的第一通信装置。通信系统还可以包括前文所述的控制管理实体，用于实现上述实施例有控制管理实体所执行的操作。
本申请还提供了一种通信系统，包括至少一个存储器和至少一个处理器，该至少一个存储器存储有指令，该至少一个处理器执行所述指令，使得所述通信系统执行本申请前述实施例中任一实施例所述的方法(例如，方法100，方法200和方法300)中任意一个或多个操作。
本申请的说明书和权利要求书及上述附图中的术语“第一”、“第二”、“第三”、“第四”等(如果存在)是用于区别类似的对象，而不必用于描述特定的顺序或先后次序。应该理解这样使用的数据在适当情况下可以互换，以便这里描述的实施例能够以除了在这里图示或描述的内容以外的顺序实施。此外，术语“包括”和“具有”以及他们的任何变形，意图在于覆盖不排他的包含，例如，包含了一系列步骤或单元的过程、方法、系统、产品或设备不必限于清楚地列出的那些步骤或单元，而是可包括没有清楚地列出的或对于这些过程、方法、产品或设备固有的其它步骤或单元。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统，装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统，装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，单元的划分，仅仅为一种逻辑业务划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各业务单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件业务单元的形式实现。
集成的单元如果以软件业务单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的全部或部分可以以软件产品的形式体现出来， 该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域技术人员应该可以意识到，在上述一个或多个示例中，本发明所描述的业务可以用硬件、软件、固件或它们的任意组合来实现。当使用软件实现时，可以将这些业务存储在计算机可读介质中或者作为计算机可读介质上的一个或多个指令或代码进行传输。计算机可读介质包括计算机存储介质和通信介质，其中通信介质包括便于从一个地方向另一个地方传送计算机程序的任何介质。存储介质可以是通用或专用计算机能够存取的任何可用介质。
以上的具体实施方式，对本发明的目的、技术方案和有益效果进行了进一步详细说明，所应理解的是，以上仅为本发明的具体实施方式而已。
以上，以上实施例仅用以说明本申请的技术方案，而非对其限制；尽管参照前述实施例对本申请进行了详细的说明，本领域的普通技术人员应当理解：其依然可以对前述各实施例所记载的技术方案进行修改，或者对其中部分技术特征进行等同替换；而这些修改或者替换，并不使相应技术方案的本质脱离本申请各实施例技术方案的范围。

Claims (38)

  1. 一种报文处理方法，其特征在于，由第一通信装置执行，所述方法包括：
    获取第一因特网协议第6版IPv6报文，所述第一IPv6报文的报文头中包括第一签名，所述第一签名用于验证所述第一IPv6报文在转发过程中是否经过了第二通信装置；
    转发所述第一IPv6报文。
  2. 根据权利要求1所述的方法，其特征在于，所述第一IPv6报文是因特网协议第6版分段路由SRv6报文。
  3. 根据权利要求2所述的方法，其特征在于，所述第一签名包含在分段路由头SRH中。
  4. 根据权利要求3所述的方法，其特征在于，所述SRH包括扩展的类型长度值TLV字段，所述扩展的TLV字段包括所述第一签名。
  5. 根据权利要求1-4任意一项所述的方法，其特征在于，所述第一签名是根据所述第一IPv6报文中的第一内容进行哈希计算所得。
  6. 根据权利要求5所述的方法，其特征在于，所述第一内容包括以下一项或多项：
    净荷中固定长度的数据和防重放攻击校验信息。
  7. 根据权利要求1-6任一项所述的方法，其特征在于，所述报文头中还包括防重放攻击校验信息。
  8. 根据权利要求5或6所述的方法，其特征在于，所述报文头中还包括第一指示信息，所述第一指示信息用于指示所述第一内容包括的至少一种防重放攻击校验信息。
  9. 根据权利要求7或8所述的方法，其特征在于，所述防重放攻击校验信息包括以下一种或多种：
    报文序列号，时间戳以及随机数。
  10. 根据权利要求1-9任意一项所述的方法，其特征在于，所述报文头还包括第二指示信息，所述第二指示信息用于指示所述第二通信装置的类型。
  11. 根据权利要求1-10任意一项所述的方法，其特征在于，所述第一通信装置和所述第二通信装置是同一个装置，所述获取所述第一IPv6报文包括：
    根据所述第二通信装置的第一私钥，生成所述第一签名。
  12. 根据权利要求1-10任一项所述的方法，其特征在于，所述第一通信装置为所述第二通信装置在所述第一IPv6报文的转发路径上的下游装置，所述转发所述第一IPv6报文之前，所述方法还包括：
    根据所述第二通信装置的第一公钥，对所述第一签名进行验证。
  13. 根据权利要求12所述的方法，其特征在于，所述方法还包括：接收控制管理实体发送的所述第一公钥。
  14. 一种报文处理方法，其特征在于，由第一通信装置执行，所述方法包括：
    接收第一因特网协议第6版IPv6报文，所述第一IPv6报文包括第一签名，所述第一签名用于验证所述第一IPv6报文的转发路径是否经过了第二通信装置；
    验证所述第一签名，根据验证结果处理所述第一IPv6报文。
  15. 根据权利要求14所述的方法，其特征在于，所述方法还包括：
    若验证不通过，则丢弃所述第一IPv6报文。
  16. 根据权利要求14或15所述的方法，其特征在于，所述第一IPv6报文是因特网协议第6版分段路由SRv6报文。
  17. 根据权利要求16所述的方法，其特征在于，所述第一签名包含在分段路由头SRH中。
  18. 根据权利要求17所述的方法，其特征在于，所述SRH包括扩展的类型长度值TLV字段，所述扩展的TLV字段包括所述第一签名。
  19. 根据权利要求14-17任意一项所述的方法，其特征在于，所述验证所述第一签名，包括：
    根据所述第一IPv6报文中的第一内容进行哈希计算，将计算结果与所述第一签名进行比较。
  20. 根据权利要求14-18任意一项所述的方法，其特征在于，所述第一内容包括以下任意一项或者多项：
    报文净荷中固定长度的数据和防重放攻击校验信息。
  21. 根据权利要求14-20任一项所述的方法，其特征在于，所述报文头中还包括防重放攻击校验信息。
  22. 根据权利要求19或20所述的方法，其特征在于，所述报文头中还包括第一指示信息，所述第一指示信息用于指示所述第一内容包括的至少一种防重放攻击校验信息。
  23. 根据权利要求21或22所述的方法，其特征在于，所述防重放攻击校验信息包括以下一种或多种：
    报文序列号，时间戳以及随机数。
  24. 根据权利要求14-23任意一项所述的方法，其特征在于，所述报文头还包括第二指示信息，所述第二指示信息用于指示所述第二通信装置的类型。
  25. 根据权利要求22或23所述的方法，其特征在于，若所述第一指示信息指示所述第一内容包括报文序列号，在验证所述第一签名之前，所述方法还包括：
    验证所述报文序列号的合法性。
  26. 根据权利要求22或23所述的方法，其特征在于，若所述第一指示信息指示所述第一内容包括时间戳，在验证所述第一签名之前，所述方法还包括：确定所述第一通信装置当前时间与所述第一IPv6报文中携带的所述时间戳之间的差值小于等于第一阈值。
  27. 根据权利要求22或23所述的方法，其特征在于，若所述第一指示信息指示所述第一内容包括随机数，在验证所述第一签名之前，所述方法还包括：
    验证所述随机数的合法性。
  28. 根据权利要求14-27任意一项所述的方法，其特征在于，所述第一签名是利用所述第二通信装置的第一私钥生成的。
  29. 根据权利要求14-28任一项所述的方法，其特征在于，所述验证所述第一签名，包括：
    根据所述第二通信装置的第一公钥，对所述第一签名进行验证。
  30. 根据权利要求29所述的方法，其特征在于，所述方法还包括：
    接收控制管理实体发送的所述第一公钥。
  31. 根据权利要求14-30任意一项所述的方法，其特征在于，所述方法还包括：
    接收控制管理实体发送的第三指示信息，所述第三指示信息用于指示所述第一通信装 置对所述第一签名进行验证。
  32. 根据权利要求14-31任意一项所述的方法，其特征在于，所述第一通信装置为所述第二通信装置在所述第一IPv6报文的转发路径上的下游装置。
  33. 根据权利要求32所述的方法，其特征在于，所述第一通信装置是所述第一IPv6报文的SRH中的SID list所指示的尾节点。
  34. 一种通信装置，其特征在于，所述通信装置包括存储器和处理器；
    所述存储器，用于存储程序代码；
    所述处理器，用于运行所述程序代码中的指令，使得所述通信装置执行以上权利要求1-13任意一项所述的方法。
  35. 一种通信装置，其特征在于，所述通信装置包括存储器和处理器；
    所述存储器，用于存储程序代码；
    所述处理器，用于运行所述程序代码中的指令，使得所述通信装置执行以上权利要求14-33任意一项所述的方法。
  36. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质中存储有指令，当其在计算机上运行时，使得所述计算机执行以上权利要求1-33任意一项所述的方法。
  37. 一种通信系统，其特征在于，包括权利要求34所述的通信装置以及权利要求35所述的通信装置。
  38. 根据权利要求37所述的通信系统，其特征在于，还包括控制管理实体，用于向通信装置发送用于计算签名和/或验证签名所需的公钥。
PCT/CN2021/109153 2020-11-11 2021-07-29 一种报文处理方法及装置 Ceased WO2022100153A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP21890684.0A EP4221078A4 (en) 2020-11-11 2021-07-29 Packet processing method and apparatus
US18/315,365 US12224978B2 (en) 2020-11-11 2023-05-10 Packet processing method and apparatus

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202011256559.2 2020-11-11
CN202011256559.2A CN114499904A (zh) 2020-11-11 2020-11-11 一种报文处理方法及装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US18/315,365 Continuation US12224978B2 (en) 2020-11-11 2023-05-10 Packet processing method and apparatus

Publications (1)

Publication Number Publication Date
WO2022100153A1 true WO2022100153A1 (zh) 2022-05-19

Family

ID=81490218

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2021/109153 Ceased WO2022100153A1 (zh) 2020-11-11 2021-07-29 一种报文处理方法及装置

Country Status (4)

Country Link
US (1) US12224978B2 (zh)
EP (1) EP4221078A4 (zh)
CN (1) CN114499904A (zh)
WO (1) WO2022100153A1 (zh)

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN113615134B (zh) * 2021-06-29 2025-07-18 新华三技术有限公司 一种报文转发方法、装置、网络节点及存储介质
US12034637B1 (en) * 2021-12-10 2024-07-09 Amazon Technologies, Inc. Network devices for stateful transmission of network traffic
US20250030630A1 (en) * 2022-06-28 2025-01-23 New H3C Technologies Co., Ltd. Packet processing
CN121644116A (zh) * 2024-09-10 2026-03-10 华为技术有限公司 一种转发路径的验证方法、转发路径的验证装置及系统

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101640631A (zh) * 2008-07-28 2010-02-03 成都市华为赛门铁克科技有限公司 一种数据包处理的方法和装置
CN102196423A (zh) * 2010-03-04 2011-09-21 腾讯科技（深圳）有限公司 一种安全数据中转方法及系统
US20190182051A1 (en) * 2015-01-19 2019-06-13 InAuth, Inc. Systems and methods for trusted path secure communication
CN109981458A (zh) * 2019-03-08 2019-07-05 华为技术有限公司 一种确定报文转发路径的方法、网络节点及系统

Family Cites Families (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
EP1397014A1 (en) * 2002-09-04 2004-03-10 SCHLUMBERGER Systèmes WIM (WAP Identification module) Primitives for handling the secure socket layer protocol (SSL)
US8228896B2 (en) * 2006-09-22 2012-07-24 Avaya Inc. Method and apparatus for verification of at least a portion of a datagram's header information
CN103686661A (zh) * 2012-09-26 2014-03-26 三亚中兴软件有限责任公司 计费方法、装置及系统
CN103701700B (zh) * 2013-12-24 2017-01-04 中国科学院信息工程研究所 一种通信网络中的节点发现方法及系统
US10237068B2 (en) * 2015-04-27 2019-03-19 Cisco Technology, Inc. Network path proof of transit using in-band metadata
US10003466B1 (en) * 2015-09-15 2018-06-19 Amazon Technologies, Inc. Network traffic with credential signatures
US10263881B2 (en) * 2016-05-26 2019-04-16 Cisco Technology, Inc. Enforcing strict shortest path forwarding using strict segment identifiers
US20180054417A1 (en) * 2016-08-17 2018-02-22 lnfersight LLC Packet tracking
US10498529B1 (en) * 2016-12-05 2019-12-03 Amazon Technologies, Inc. Scalable node for secure tunnel communications
CN108512848A (zh) * 2018-03-31 2018-09-07 深圳大普微电子科技有限公司 防重放攻击的方法以及相关装置
CN108809759A (zh) * 2018-05-29 2018-11-13 新华三技术有限公司 检测链路状态的方法、装置和路由器
CN111510386B (zh) * 2019-01-30 2023-06-20 华为技术有限公司 用于处理报文的方法和装置
US11240150B2 (en) * 2019-04-04 2022-02-01 Cisco Technology, Inc. Applying attestation to segment routing
EP3949326A1 (en) * 2019-04-05 2022-02-09 Cisco Technology, Inc. Discovering trustworthy devices using attestation and mutual attestation
CN111865810B (zh) * 2019-04-30 2022-08-09 华为技术有限公司 一种拥塞信息采集方法、系统、相关设备及计算机存储介质
CN111585890B (zh) * 2020-04-10 2021-07-16 清华大学 基于SRv6的网络路径验证方法及系统
CN111556075B (zh) * 2020-05-14 2022-05-03 中国人民解放军国防科技大学 基于无交互密钥协商的数据传输路径还原方法及系统

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101640631A (zh) * 2008-07-28 2010-02-03 成都市华为赛门铁克科技有限公司 一种数据包处理的方法和装置
CN102196423A (zh) * 2010-03-04 2011-09-21 腾讯科技（深圳）有限公司 一种安全数据中转方法及系统
US20190182051A1 (en) * 2015-01-19 2019-06-13 InAuth, Inc. Systems and methods for trusted path secure communication
CN109981458A (zh) * 2019-03-08 2019-07-05 华为技术有限公司 一种确定报文转发路径的方法、网络节点及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4221078A4

Also Published As

Publication number Publication date
CN114499904A (zh) 2022-05-13
EP4221078A4 (en) 2024-04-17
EP4221078A1 (en) 2023-08-02
US12224978B2 (en) 2025-02-11
US20230283588A1 (en) 2023-09-07

Similar Documents

Publication Publication Date Title
CN113691490B (zh) 一种校验SRv6报文的方法及装置
CN107682284B (zh) 发送报文的方法和网络设备
WO2022100153A1 (zh) 一种报文处理方法及装置
US20230007022A1 (en) Method and Device for Preventing Replay Attack on Srv6 HMAC Verification
US7877601B2 (en) Method and system for including security information with a packet
US10911581B2 (en) Packet parsing method and device
WO2019137554A1 (zh) 一种保证环网协议运行安全的方法及装置
CN114362985B (zh) 一种报文处理方法及装置
WO2023040653A1 (zh) 通信方法及装置
WO2023221742A1 (zh) 一种路由选择方法、网络设备及系统
CN113810173B (zh) 一种校验应用信息的方法、报文处理方法及装置
EP4156622A1 (en) Method for checking application information, message processing method and device
CN105743863A (zh) 一种对报文进行处理的方法及装置
CN113810290B (zh) 一种报文处理方法及装置
US20160094380A1 (en) Notification Technique for Network Reconfiguration
WO2024001987A1 (zh) 一种生成验证规则的方法以及相关装置
CN111917746B (zh) 一种路由协议接入认证方法、设备及介质
CN114567450A (zh) 一种协议报文处理方法及装置
US10499249B1 (en) Data link layer trust signaling in communication network
CN108243099A (zh) 一种路径选择的方法、装置和系统
CN117134933A (zh) 加密通信方法、装置、电子设备和存储介质
CN119544580A (zh) 通信方法及装置
CN102271085A (zh) 报文交互方法及装置
CN111327394A (zh) 一种报文发送方法及装置

Legal Events

Date Code Title Description
ENP Entry into the national phase

Ref document number: 2021890684

Country of ref document: EP

Effective date: 20230425

NENP Non-entry into the national phase

Ref country code: DE