WO2025001496A1 - 安全传输报文的方法及相关装置 - Google Patents

安全传输报文的方法及相关装置 Download PDF

Info

Publication number
WO2025001496A1
WO2025001496A1 PCT/CN2024/091039 CN2024091039W WO2025001496A1 WO 2025001496 A1 WO2025001496 A1 WO 2025001496A1 CN 2024091039 W CN2024091039 W CN 2024091039W WO 2025001496 A1 WO2025001496 A1 WO 2025001496A1
Authority
WO
WIPO (PCT)
Prior art keywords
site
tunnel
edge
route
message
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2024/091039
Other languages
English (en)
French (fr)
Inventor
骈志康
郭天萍
庞东磊
董甲甲
盛成
胡棣
金海燕
田涛
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Huawei Technologies Co Ltd
Original Assignee
Huawei Technologies Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by Huawei Technologies Co Ltd filed Critical Huawei Technologies Co Ltd
Priority to EP24830144.2A priority Critical patent/EP4708784A4/en
Publication of WO2025001496A1 publication Critical patent/WO2025001496A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/34—Source routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/52—Multiprotocol routers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/76—Routing in software-defined topologies, e.g. routing between virtual machines
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/08—Network architectures or network communication protocols for network security for authentication of entities
    • H04L63/083—Network architectures or network communication protocols for network security for authentication of entities using passwords
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the field of wide area network message transmission, and in particular to a method for securely transmitting messages and a method for negotiating IPsec SA and related devices.
  • an overlay network can be constructed by establishing tunnels between multiple network nodes.
  • the overlay network decouples the service from the underlying network, enabling end-to-end rapid delivery of service messages.
  • the tunnel since the tunnel is established based on the operator network, the network cannot guarantee the security of the service message. Therefore, the tunnel itself needs to have certain security capabilities to ensure the security of the service message.
  • the currently commonly used method is that when establishing a tunnel on the control plane, the ingress node and the egress node of the tunnel use the border gateway protocol (BGP) to negotiate the key based on the transport network port (TNP) granularity, where the key is bound to the port of the ingress node and the port of the egress node of the tunnel.
  • Border gateway protocol BGP
  • TNP transport network port
  • the ingress node After the tunnel is established, when the service message is transmitted in the tunnel, the ingress node encrypts the service message according to the key negotiated with the egress node, so that the service message is in an encrypted state when transmitted in the tunnel.
  • the egress node decrypts the service message according to the negotiated key, thereby ensuring the security of the service message transmission.
  • the above-mentioned method of encrypting and decrypting messages based on the TNP granularity of network nodes requires the negotiation of key information between the ingress node and the egress node for each tunnel segment.
  • the service message When the service message is transmitted in the tunnel segment, it is encrypted in the negotiated manner at the ingress node of the tunnel segment and decrypted in the negotiated manner at the egress node.
  • the keys between the tunnel segments are different. It is necessary to encrypt at the ingress node of each tunnel segment, decrypt at the egress node, encrypt again at the ingress node of the next tunnel segment, and decrypt again at the egress node...
  • the encryption and decryption operations are cumbersome and consume a large amount of computing resources of the device, increasing the forwarding delay of the service message.
  • This application provides a method for securely transmitting messages, a method for negotiating IPsec SA, and related devices. By using the methods described in this application, the message transmission efficiency can be improved and the transmission delay can be reduced.
  • the present application provides a method for securely transmitting a message, which is described from the sending side of a data forwarding plane, and the method includes:
  • the first site egress device edge in the wide area network receives the virtual private network VPN service message in the virtual routing forwarding VRF;
  • the first site edge performs security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message;
  • IPsecSA Internet Protocol Security Association
  • the first site edge encapsulates tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound endpoint of the overlay end-to-end tunnel, the second site edge is an outbound endpoint of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;
  • the first site edge sends the second message to the second site edge through the overlay end-to-end tunnel.
  • the edge of the first site and the edge of the second site have pre-negotiated an IPsecSA associated with the VRF.
  • the edge of the first site receives the VPN service message in the VRF
  • the edge of the first site performs security protection on the VPN service message according to the IPsecSA associated with the VRF negotiated with the edge of the second site to obtain a first message
  • the tunnel information of the upper-layer overlay end-to-end tunnel established between the edge of the first site and the edge of the second site is encapsulated in the outer layer of the first message to obtain a second message
  • the edge of the first site transmits the second message to the edge of the second site through the upper-layer overlay end-to-end tunnel, wherein each POP through which the overlay end-to-end tunnel passes does not need to decrypt or encrypt the second message, but only needs to forward it according to the tunnel information.
  • the present application provides a method for securely transmitting messages. This method only requires one security protection at the entry point of the overlay end-to-end tunnel established between the edges of the two sites.
  • each POP does not need to encrypt or decrypt the message, which saves computing resources, reduces transmission delays, and improves message transmission efficiency.
  • the security protection of the VPN service message includes: encrypting the VPN service message using the Encapsulating Security Payload (ESP) protocol; and/or encapsulating the VPN service message with an Authentication Header.
  • ESP Encapsulating Security Payload
  • the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.
  • the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6,
  • the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.
  • the overlay end-to-end tunnel can be an SRv6 tunnel.
  • the first site edge encapsulates the tunnel information of the SRv6 tunnel in the outer layer of the first message.
  • the tunnel information of the SRv6 tunnel includes an IPv6 header and a segment routing header SRH.
  • Each POP on the tunnel can forward the second message according to the IPv6 header and the segment routing header SRH.
  • the first information is the first endpoint segment identifier END.SID of the first POP
  • the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overlay SRv6 Policy from the first POP to the second POP according to the next hop SID of the END.SID.
  • the overlay end-to-end tunnel is a segmented routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy
  • the second message includes an MPLS label stack
  • the MPLS label stack includes the first information and the second information.
  • the first information is the first node SID of the first POP
  • the operation associated with the first node SID includes: matching the upper layer overlay SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation GRE protocol, and the second message is encapsulated using SRv6 over GRE.
  • the method before the first site edge receives the service message, the method further includes:
  • the first site edge receives a Border Gateway Protocol (BGP) route announced by the second site edge, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF matching the Export RT; according to the route type RT and the Export RT, the first site edge associates the IPsec SA with the VRF.
  • BGP Border Gateway Protocol
  • a new route type has been added to BGP routing, which carries IPsec SA and Export RT.
  • the newly added route type RT indicates that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for VPN service messages in the VRF that matches the Export RT.
  • the IPsecSA associated with the VRF is negotiated between the edge of the first site and the edge of the second site.
  • the IPsecSA is used to provide security protection for the VPN service messages in the VRF, especially when multiple tunnels are spanned between the edge of the first site and the edge of the second site, which lays the foundation for the secure and fast transmission of VPN service messages.
  • the implementation of the embodiment of the present application realizes the secure and fast transmission of VPN service messages, reduces transmission delays, and improves transmission efficiency.
  • the BGP route is a BGP software defined wide area network SD-WAN route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network EVPN route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and/or the node identifier Node ID of the second site edge.
  • the identifier of the second site edge may be the second site identifier site ID and the node identifier Node ID
  • the second site edge may be determined by the second site identifier site ID and the node identifier Node ID, and the first site edge and the second site edge perform security protection and transmission on the service message based on the negotiated IPsec SA.
  • the identifier of the second site edge may be the node identifier Node ID, and the node Node ID is globally unique in the wide area network, and the second site edge may be determined according to the Node ID.
  • the identifier of the edge of the second site may be the second site identifier site ID.
  • any edge in the first site receives a BGP route announced by any edge in the second site, wherein the BGP route carries the identifier of the second site and IPsec SA. This indicates that the key negotiated between the first site and the second site is IPsec SA, and service messages can be securely protected and transmitted between any edge in the first site and any edge in the second site through the negotiated IPsec SA.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes the route type RT and an identifier of the second site edge.
  • the BGP route includes a tunnel encapsulation attribute type length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.
  • the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software defined wide area network SD-WAN.
  • the present application provides a method for securely transmitting a message, which is described from the receiving side of a data forwarding plane, and the method includes:
  • a second site egress device edge in a wide area network receives a second message sent by a first site edge through an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge, the second message including the first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an entry point of the overlay end-to-end tunnel, the second site edge is an exit point of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network VPN service message through an Internet Protocol Security Alliance IPsec SA negotiated by the second site edge and the first site edge;
  • IPsec SA Internet Protocol Security Alliance
  • the second site edge decapsulates the second message to obtain the first message
  • the second site edge processes the first message according to the IPsecSA to obtain the VPN service message.
  • the second message After the second site edge receives the second message, the second message includes the first message and the tunnel information encapsulated in the outer layer of the first message.
  • the second site edge decapsulates the second message to obtain the first message, and then processes the first message according to the IPsecSA negotiated with the first site edge to obtain the VPN service message.
  • the second message does not need to be encrypted or decrypted by each POP on the overlay end-to-end tunnel, but only needs to be processed once at the second site edge, which improves transmission efficiency and reduces transmission delay.
  • the processing of the first message includes: decrypting the first message according to the IPsecSA using the Encapsulated Security Payload ESP protocol; and/or authenticating the first message according to the IPsec SA and the authentication data carried in the authentication header Authentication Header of the first message.
  • the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.
  • the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6,
  • the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information.
  • the first information is the first endpoint segment identifier END.SID of the first POP
  • the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overlay SRv6 Policy from the first POP to the second POP according to the next hop SID of the END.SID.
  • the overlay end-to-end tunnel is a segmented routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy
  • the second message includes an MPLS label stack
  • the MPLS label stack includes the first information and the second information.
  • the first information is a first node SID of the first POP
  • the operation associated with the first node SID includes:
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation GRE protocol, and the second message is encapsulated using SRv6 over GRE.
  • the method before the second-site export device edge in the wide area network receives the second message sent by the first-site edge through the upper-layer overlay end-to-end tunnel, the method also includes: the second-site export device edge generates a Border Gateway Protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second-site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF matching the Export RT; the second-site edge announces the BGP route to the first-site edge.
  • the BGP route includes a route type RT, the IPsec SA, an identifier of the second-site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF matching the Export RT
  • the BGP route is a BGP software-defined wide area network SD-WAN route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network EVPN route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and/or the node identifier Node ID of the second site edge.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes the route type RT and an identifier of the second site edge.
  • the BGP route includes a tunnel encapsulation attribute type length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.
  • the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software defined wide area network SD-WAN.
  • the present application provides a method for negotiating an Internet Protocol Security Alliance (IPsec) SA, described from the receiving side of the control plane, the method comprising:
  • IPsec Internet Protocol Security Alliance
  • the first site egress device edge in the wide area network receives a border gateway protocol BGP route announced by the second site edge, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT;
  • the first site edge associates the IPsec SA with the VRF.
  • This application scheme adds a new route type RT to BGP routing.
  • the BGP routing carries IPsec SA and export routing target ExportRT.
  • the newly added route type RT is used to indicate that the IPsec SA announced by the BGP routing is used for end-to-end security protection of the service messages in the VRF matched by ExportRT.
  • the end-to-end IPsec SA negotiation based on VRF granularity is realized between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service messages in the future, laying the foundation for the transmission of VPN service messages.
  • the BGP route is a BGP software-defined wide area network SD-WAN route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network EVPN route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and/or the node identifier Node ID of the second site edge.
  • the identifier of the second site edge can be the second site identifier site ID and the node identifier Node ID.
  • the second site edge can be determined by the second site identifier site ID and the node identifier Node ID, and the first site edge and the second site edge negotiate and agree on an IPsec SA.
  • the identifier of the second site edge can be the node identifier Node ID, which is globally unique in the wide area network.
  • the second site edge can be determined according to the Node ID, and the first site edge and the second site edge negotiate and agree on an IPsec SA.
  • the identifier of the second site edge can be the second site identifier site ID.
  • any edge in the first site receives a BGP route announced by any edge in the second site, wherein the BGP route carries the identifier and IPsec SA of the second site, indicating that the key negotiated between the first site and the second site is IPsec SA, and subsequently any edge in the first site and any edge in the second site can perform security protection and transmission on service messages through the negotiated key IPsec SA.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes the route type RT and an identifier of the second site edge.
  • the BGP route includes a tunnel encapsulation attribute type length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.
  • the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.
  • the present application provides a method for negotiating an Internet Protocol Security Alliance (IPsec) SA, described from the sending side of the control plane, the method comprising:
  • IPsec Internet Protocol Security Alliance
  • the second site egress device edge in the wide area network generates a border gateway protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, the identifier of the second site edge, and the export route target ExportRT, wherein the route type RT indicates that the IPsec SA of the BGP route announcement is used to perform end-to-end security protection on the service message in the virtual route forwarding VRF matching the Export RT;
  • the second site edge announces the BGP route to the first site edge.
  • This application scheme adds a new route type RT to BGP routing.
  • the BGP routing carries IPsec SA and export routing target ExportRT.
  • the newly added route type RT is used to indicate that the IPsec SA announced by the BGP routing is used for end-to-end security protection of the service messages in the VRF matched by ExportRT.
  • the end-to-end IPsec SA negotiation based on VRF granularity is realized between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service messages in the future, laying the foundation for the transmission of VPN service messages.
  • the BGP route is a BGP software defined wide area network SD-WAN route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network EVPN route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and/or the node identifier Node ID of the second site edge.
  • the identifier of the second site edge may be the second site identifier site ID and the node identifier Node ID, and the second site edge may be determined by the second site identifier site ID and the node identifier Node ID, and the first site edge and the second site edge negotiate and agree on an IPsec SA.
  • the identifier of the second site edge may be the node identifier Node ID, and the node Node ID is globally unique in the wide area network, and the second site edge may be determined according to the Node ID, and the first site edge and the second site edge negotiate and agree on an IPsec SA.
  • the identifier of the edge of the second site may be the second site identifier site ID. In this case, any edge in the first site receives a BGP route announced by any edge in the second site, wherein the BGP route carries the identifier of the second site and IPsec SA. This indicates that the key negotiated between the first site and the second site is IPsec SA. Subsequently, any edge in the first site and any edge in the second site may securely protect and transmit service messages through the negotiated key IPsec SA.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes the route type RT and an identifier of the second site edge.
  • the BGP route includes a tunnel encapsulation attribute type length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.
  • the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.
  • the present application provides a device for securely transmitting a message, the device being applied to a first site egress device edge in a wide area network, the device comprising:
  • a receiving module used for receiving a virtual private network VPN service message in a virtual routing forwarding VRF
  • a processing module configured to perform security protection on the VPN service message according to an Internet Protocol Security Alliance (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message;
  • IPsecSA Internet Protocol Security Alliance
  • the processing module is used to encapsulate tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound end point of the overlay end-to-end tunnel, the second site edge is an outbound end point of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;
  • a sending module is used to send the second message to the second site edge through the overlay end-to-end tunnel.
  • the processing module is used to: perform Encapsulation Security Payload ESP protocol encryption on the VPN service message; and/or, encapsulate Authentication Header on the VPN service message.
  • the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.
  • the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6,
  • the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes the first information and the second information.
  • the first information is the first endpoint segment identifier END.SID of the first POP
  • the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overly SRv6 Policy from the first POP to the second POP according to the next hop SID of the END.SID.
  • the overlay end-to-end tunnel is a segmented routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy
  • the second message includes an MPLS label stack
  • the MPLS label stack includes the first information and the second information.
  • the first information is the first node SID of the first POP
  • the operation associated with the first node SID includes: matching the upper layer overly SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation GRE protocol, and the second message is encapsulated using SRv6 over GRE.
  • the receiving module is also used to receive the Border Gateway Protocol BGP route announced by the second site edge, the BGP route including the route type RT, the IPsec SA, the identifier of the second site edge, and the export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual routing forwarding VRF matching the Export RT; the processing module is also used to associate the IPsec SA with the VRF according to the route type RT and the Export RT.
  • the BGP route is a BGP software defined wide area network SD-WAN route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network EVPN route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and/or the node identifier Node ID of the second site edge.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes the route type RT and an identifier of the second site edge.
  • the BGP route includes a tunnel encapsulation attribute type length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.
  • the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software defined wide area network SD-WAN.
  • Each functional module in the fifth aspect is used to implement the method described in the above-mentioned first aspect and any possible implementation method of the first aspect.
  • the present application provides a device for securely transmitting a message, the device being applied to a second site edge in a wide area network, characterized in that the device comprises:
  • a receiving module configured to receive a second message sent by a first site edge through an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge, wherein the second message includes a first message and tunnel information of the overlay end-to-end tunnel encapsulated in an outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of a first point of presence POP, the first site edge is an entry point of the overlay end-to-end tunnel, the second site edge is an exit point of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network VPN service message through an Internet Protocol Security Alliance IPsec SA negotiated by the second site edge and the first site edge;
  • IPsec SA Internet Protocol Security Alliance
  • a processing module used for decapsulating the second message to obtain a first message
  • the processing module is further configured to process the first message according to the IPsecSA to obtain the VPN service message.
  • the processing module is used to: decrypt the first message using the Encapsulated Security Payload ESP protocol according to the IPsecSA; and/or authenticate the first message according to the IPsec SA and the authentication data carried in the authentication header Authentication Header of the first message.
  • the tunnel information further includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the wide area network through the first POP, and the The second site edge accesses the wide area network through the second POP.
  • the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6,
  • the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes the first information and the second information.
  • the first information is the first endpoint segment identifier END.SID of the first POP
  • the operation associated with the first endpoint segment identifier END.SID includes: matching the upper layer overly SRv6 Policy from the first POP to the second POP according to the next hop SID of the END.SID.
  • the overlay end-to-end tunnel is a segmented routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy
  • the second message includes an MPLS label stack
  • the MPLS label stack includes the first information and the second information.
  • the first information is the first node SID of the first POP
  • the operation associated with the first node SID includes: matching the upper layer overly SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation GRE protocol, and the second message is encapsulated using SRv6 over GRE.
  • the processing module is also used to generate a Border Gateway Protocol BGP route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on the VPN service message in the virtual route forwarding VRF matching the Export RT;
  • a sending module is used to notify the BGP route to the first site edge.
  • the BGP route is a BGP software defined wide area network SD-WAN route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network EVPN route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and/or the node identifier Node ID of the second site edge.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes the route type RT and an identifier of the second site edge.
  • the BGP route includes a tunnel encapsulation attribute type length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.
  • the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.
  • Each functional module in the sixth aspect is used to implement the method described in the above-mentioned second aspect and any possible implementation method of the second aspect.
  • the present application provides a device for negotiating an Internet Protocol Security Alliance (IPsec) SA, the device being applied to a first site edge in a wide area network, the device comprising:
  • IPsec Internet Protocol Security Alliance
  • a receiving module configured to receive a Border Gateway Protocol (BGP) route announced by an edge of a second site, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the edge of the second site, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT;
  • BGP Border Gateway Protocol
  • a processing module is used to associate the IPsec SA with the VRF according to the routing type RT and the Export RT.
  • the BGP route is a BGP software defined wide area network SD-WAN route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network EVPN route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • the identifier of the second site edge includes a site to which the second site edge belongs. Identify the site ID and/or the node ID of the second site edge.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes the route type RT and an identifier of the second site edge.
  • the BGP route includes a tunnel encapsulation attribute type length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.
  • the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.
  • Each functional module in the seventh aspect is used to implement the method described in the third aspect and any possible implementation method of the third aspect.
  • the present application provides a device for negotiating an Internet Protocol Security Alliance (IPsec) SA, the device being applied to a second site edge in a wide area network, the device comprising:
  • IPsec Internet Protocol Security Alliance
  • a processing module configured to generate a Border Gateway Protocol (BGP) route, wherein the BGP route includes a route type RT, the IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on a service message in a virtual routing forwarding VRF matching the Export RT;
  • BGP Border Gateway Protocol
  • the sending module is used to notify the BGP route to the first site edge.
  • the BGP route is a BGP software defined wide area network SD-WAN route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network EVPN route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and the node identifier Node ID of the second site edge.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes the route type RT and/or an identifier of the second site edge.
  • the BGP route includes a tunnel encapsulation attribute type length value Tunnel Encapsulation Attribute TLV, and the Tunnel Encapsulation Attribute TLV includes the IPsec SA.
  • the BGP route includes an extended community attribute, and the extended community attribute is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software defined wide area network SD-WAN.
  • the present application provides a network device, comprising a memory and a processor, the memory being used to store instructions, and the processor being used to execute the instructions stored in the memory to implement the method described in the first aspect and any possible implementation of the first aspect, or to implement the method described in the second aspect and any possible implementation of the second aspect, or to implement the method described in the third aspect and any possible implementation of the third aspect, or to implement the method described in the fourth aspect and any possible implementation of the fourth aspect.
  • the present application provides a system, including a first site exit device edge and a second site edge, the first site edge is used to execute the method described in the first aspect and any possible implementation of the first aspect, and the second site edge is used to execute the method described in the second aspect and any possible implementation of the second aspect; or, the first site edge is used to execute the method described in the third aspect and any possible implementation of the third aspect, and the second site edge is used to execute the method described in the fourth aspect and any possible implementation of the fourth aspect.
  • the present application provides a computer storage medium, characterized in that it includes program instructions, which, when executed on a processor, enable the processor to implement the method described in the first aspect and any possible implementation of the first aspect, or enable the processor to implement the method described in the second aspect and any possible implementation of the second aspect, or enable the processor to implement the method described in the third aspect and any possible implementation of the third aspect, or enable the processor to implement the method described in the fourth aspect and any possible implementation of the fourth aspect.
  • the present application provides a computer program product comprising program instructions, which, when executed on a processor, enables the processor to implement the method described in the first aspect and any possible implementation of the first aspect, or enables the The processor implements the method described in the second aspect and any possible implementation of the second aspect, or enables the processor to implement the method described in the third aspect and any possible implementation of the third aspect, or enables the processor to implement the method described in the fourth aspect and any possible implementation of the fourth aspect.
  • FIG1 is a schematic diagram of a scenario provided by the present application.
  • FIG2 is a flowchart of a method for negotiating an IPsec SA provided by the present application
  • FIG3 is a schematic diagram of a partial structure of a BGPSD-WAN routing message provided by the present application.
  • FIG4 is a schematic diagram of a partial structure of a BGP EVPN routing message provided by the present application.
  • FIG5 is a schematic diagram of a flow chart of a method for securely transmitting messages provided by the present application.
  • FIG6A is a schematic diagram of the structure of a VPN service message provided by the present application.
  • FIG6B is a schematic diagram of the structure of a first message provided by the present application.
  • FIG6C is a schematic diagram of the structure of a second message provided by the present application.
  • FIG7 is a schematic diagram of the structure of a second message provided by the present application.
  • FIG8 is a schematic diagram of the structure of another second message provided by the present application.
  • FIG9 is a schematic diagram of a flow chart of a method for securely transmitting messages provided by the present application.
  • FIG10 is a schematic diagram of the structure of a device for securely transmitting messages provided by the present application.
  • FIG11 is a schematic diagram of the structure of another device for securely transmitting messages provided by the present application.
  • FIG12 is a schematic diagram of the structure of a network device provided in the present application.
  • FIG. 1 is a schematic diagram of a scenario provided by the present application.
  • SD-WAN software-defined wide-area network
  • POPs points of presence
  • a tunnel 1 is established between customer premises equipment (CPE) 1 and edge point of presence (EPOP) 1
  • a tunnel 2 is established between EPOP1 and backbone point of presence (BPOP) 1
  • BPOP backbone point of presence
  • a tunnel 3 is established between BPOP1 and BPOP2
  • a tunnel 4 is established between BPOP2 and EPOP2
  • a tunnel 5 is established between EPOP2 and CPE2, wherein CPE1 is located at site 1 and CPE2 is located at site 2.
  • the ingress node and egress node of each tunnel are key negotiated based on the TNP granularity.
  • the business flow (business message) needs to go from CPE1 to CPE2, that is, the business message needs to be transmitted from CPE1 to CPE2 across multiple tunnels.
  • the CPE1 node encrypts the business message according to the key agreed upon between CPE1 and EPOP1 on tunnel 1.
  • the EPOP1 node decrypts the message according to the agreed key;
  • the business message reaches tunnel 2 the EPOP 1 node encrypts the business message according to the key agreed upon between EPOP1 and BPOP1 on tunnel 2.
  • the BPOP1 node decrypts the business message according to the agreed key; ...
  • the EPOP 2 node encrypts the business message according to the key agreed upon between EPOP2 and CPE2 on tunnel 5.
  • the CPE2 node decrypts the business message according to the agreed key, parses the message, and obtains the data.
  • IPsec SA Internet Protocol security
  • IPsec SA is a security protocol used to provide confidentiality, integrity and authentication of data on an IP network.
  • IPsec SA is a set of security parameters established between two network devices to protect the transmission of IP data packets. It includes encryption algorithms, authentication protocols, key lengths, key management and other security parameters. Before IPsec SA is established, the two devices must negotiate security parameters to ensure that they use the same security parameters. Once IPsec SA is established, data packets will be encrypted and authenticated using these security parameters to ensure the confidentiality and integrity of the data.
  • FIG 2 is a flow chart of a method for negotiating IPsec SA provided in this application, and the method includes but is not limited to the description of the following contents.
  • the second site egress device edge in the wide area network generates a BGP route, where the BGP route includes a route type RT, an IPsec SA, an identifier of the second site edge, and an export route target ExportRT.
  • BGP routes include Route Distinguisher (RD) and Export Route Target (RT).
  • Route Distinguisher RD is used to identify the virtual routing forwarding (VRF) of the second site edge
  • Export Route Target Export RT is used to match the VRF of the second site edge.
  • the BGP route also includes the identifier of the edge of the second site.
  • the identifier of the edge of the second site includes the site identifier site ID to which the edge of the second site belongs and the node identifier Node ID of the edge of the second site, that is, the edge can be determined by the site identifier and the node identifier.
  • the node identifier in the wide area network has global uniqueness. In this case, the identifier of the edge of the second site can only include the node identifier, that is, the edge can be uniquely determined by the node identifier. In another implementation, the identifier of the edge of the second site can be the second site identifier site ID.
  • any edge in the first site receives the BGP route announced by any edge in the second site, wherein the BGP route carries the identifier of the second site and the IPsec SA, indicating that the key negotiated between the first site and the second site is the IPsec SA, and subsequently any edge in the first site and any edge in the second site can perform security protection and transmission of service messages through the negotiated key IPsec SA.
  • BGP routing also includes route type (Route Type, RT) and IPsec SA.
  • Route type RT indicates that the IPsec SA announced by BGP routing is used to provide end-to-end security protection for service packets in the virtual routing forwarding VRF that matches the export routing target Export RT. For example, if the VRF that matches the export routing target Export RT is the VRF of the first site edge, then the route type RT indicates that the IPsec SA announced by BGP routing is used to provide end-to-end security protection for service packets between the second site edge and the first site edge.
  • the BGP route may be a BGP SD-WAN route, the sub-address family of which is the SD-WAN sub-address family, or a BGP Ethernet virtual private network (EVPN) route, the sub-address family of which is the EVPN sub-address family.
  • the BGP route may also be other routes, and its sub-address family may be other sub-address families, which is not limited in this application.
  • BGP routing includes network layer reachability information (NLRI), wherein the routing type RT, routing distinguisher RD and the identifier of the second site edge are all located in the NLRI.
  • NLRI network layer reachability information
  • FIG3 is a partial structural diagram of a BGP SD-WAN routing provided by the present application, in FIG3, Route Type represents the routing type RT, and its length can be 2 bytes. In the SD-WAN sub-address family, the routing type can be defined as 2, Route Distinguisher represents the routing distinguisher RD, and its length can be 8 bytes. SD-WAN-Color is used to represent the site identifier, and its length can be 4 bytes.
  • FIG4 is a partial structural diagram of a BGP EVPN routing provided by the present application, in FIG4, each field has the same meaning as each field in the schematic diagram of FIG3, except that in the EVPN sub-address family, the routing type RT is defined as 10. It should be noted that defining the route type RT as 2 here is only an example in the SD-WAN sub-address family. Other numerical values can be used in the SD-WAN address family to represent the newly added route types. Defining the route type RT as 10 is only an example of the EVPN sub-address family. Other numerical values can be used in the EVPN address family to represent the newly added route types. This application does not make specific limitations.
  • BGP routes also include type-length-value (TLV for short).
  • BGP routes include Tunnel Encapsulation Attribute (TEA) TLV, where TEA TLV includes IPsec SA, that is, IPsec SA is carried in the TEA TLV field of BGP routes.
  • IPsec SA is carried in the sub-TLV of TEA TLV.
  • BGP routes also include extended community attribute TLV, and the extended community attribute TLV includes export route target Export RT, that is, Export RT is carried in the extended community attribute TLV field of BGP routes.
  • the positions of IPsec SA and Export RT here are just examples. IPsec SA and Export RT can also be carried in other TLV fields of BGP routes, and this application does not make specific limitations.
  • the second site edge may be CPE1 or CPE2.
  • the second site edge announces the BGP route to the first site edge.
  • the second site edge announces the BGP route in the WAN.
  • the second site edge is CPE1
  • CPE1 after CPE1 generates the BGP route, it can reflect the BGP route to EPOP1 through the regional route reflector (RR)
  • EPOP1 reflects the BGP route to BPOP1, BPOP2 and EPOP2 through the managed service provider (MSP) RR
  • MSP managed service provider
  • EPOP2 then reflects the BGP route to CPE2 through the regional RR, thereby realizing the announcement of the BGP route.
  • the first site edge in the wide area network receives the BGP route announced by the second site edge.
  • the first site edge may be CPE2; if the second site edge is CPE2, the first site edge may be CPE1.
  • the first site edge associates the IPsec SA with the VRF.
  • the first site edge receives the BGP route announced by the second site edge, and associates the IPsec SA with the VRF according to the route type RT and the export route target Export RT in the BGP route.
  • Export RT is used to match the VRF of the second site edge
  • the route type RT indicates that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the service packets in the VRF that matches the Export RT. Therefore, after receiving the BGP route, the first site edge first determines whether the VRF of its own site matches the Export RT, and then associates the IPsec SA with the VRF. In this case, the first site edge associates the IPsec SA with the VRF of the first site edge.
  • the IPsec SA is also associated with the second site edge, it can be understood that the VRF of the first site edge and the VRF of the second site edge are both associated with the IPsec SA. In the case of mismatch, the first site edge is not associated with the IPsec SA.
  • the matching strategy can be set as follows.
  • Each edge in the wide area network can be set with an import route target and an export route target Export RT, wherein the import route target is stored locally on the edge, and the export route target is carried in the BGP route.
  • the BGP route sent by the second site edge carries the export route target.
  • the first site edge receives the BGP route sent by the second site, it compares the export route target in the BGP route with the import route target stored locally on the first site edge. If the two are consistent, the VRF of the first site edge matches the Export RT in the BGP route, and the first site edge associates the IPsec SA in the BGP route with the VRF of the first site edge.
  • the VRF of the first site edge does not match the Export RT in the BGP route, and the IPsec SA is not associated with the VRF of the first site edge.
  • the Export RT carried in the BGP route sent by the second site edge is 100
  • the local import route target of the first site edge is 100.
  • the first site edge compares the Export RT with the local import route target.
  • the first site edge associates the IPsec SA carried in the BGP route with the VRF of the first site edge.
  • the matching strategy can also be implemented in other ways, which is not limited in this application.
  • the method described in this application can be applied to a wide area network, such as a software defined wide area network SD-WAN, where the first site edge and the second site edge can be site edges in the SD-WAN.
  • the method described in this application can also be applied to other wide area networks, which is not limited in this application.
  • the first site edge and the second site edge can be determined according to actual business needs and business flows, and the import routing target and export routing target of the first site edge, as well as the import routing target and export routing target of the second site edge can be set according to actual business needs.
  • the VRF of the edge of the first site and the VRF of the edge of the second site are associated with the IPsec SA, that is, the IPsec SA used to transmit business messages has been negotiated between the edge of the first site and the edge of the second site.
  • the business messages can be securely protected based on the negotiated IPsec SA, and the VPN business messages can be transmitted through the virtual routing forwarding VRF, thereby realizing end-to-end tunnel transmission between the edge of the first site and the edge of the second site, which only requires one security protection and one decapsulation process, thereby reducing transmission delay.
  • this application provides a method for negotiating IPsec SA, adding a new route type in BGP routing, and carrying IPsec SA and export route targets in BGP routing.
  • the newly added route type is used to indicate that the IPsec SA announced by the BGP route is used to provide end-to-end security protection for the service messages in the VRF that matches the export target route.
  • the newly added route type implements IPsec SA negotiation based on VRF granularity.
  • an IPsec SA method is negotiated between the edge of the first site and the edge of the second site, so that when the service messages are subsequently transmitted between the edge of the first site and the edge of the second site, the service messages can be securely protected based on the negotiated IPsec SA method, and the VPN service messages can be transmitted by means of virtual routing forwarding VRF.
  • the present application also provides a method for securely transmitting messages. See Figure 5, which is a flow chart of a method for securely transmitting messages provided by the present application, the method is applied to a wide area network, and the method includes but is not limited to the following description.
  • a first site egress device edge in a wide area network receives a virtual private network VPN service message in a virtual routing forwarding VRF.
  • the first site egress device edge in the wide area network receives the VPN service message in the VRF, wherein the VPN service message may be sent to the first site edge by the controller, or may be sent to the first site edge by other network devices in the wide area network.
  • the first site edge may be CPE1 or CPE2.
  • the first site edge performs security protection on the VPN service message according to the Internet Protocol Security Alliance (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message.
  • IPsecSA Internet Protocol Security Alliance
  • IPsecSA is negotiated between the edge of the first site and the edge of the second site, and the VRF of the edge of the first site and the VRF of the edge of the second site are associated with IPsecSA.
  • IPsecSA is used to provide end-to-end protection for the service messages between the VRF of the edge of the first site and the VRF of the edge of the second site. Based on this, after the edge of the first site receives the VPN service message in the VRF, the edge of the first site performs security protection on the VPN service message according to the IPsecSA associated with the VRF negotiated with the edge of the second site, and obtains the first message.
  • the security protection of VPN service messages includes encrypting the VPN service messages using the encapsulate security payload (ESP) protocol.
  • the security protection of VPN service messages includes encapsulating the VPN service messages with an authentication header (AH).
  • AH authentication header
  • Full protection includes ESP protocol encryption of VPN service messages and VPN service message encapsulation of authentication header AH.
  • Security protection of VPN service messages can also be achieved in other ways, which are not limited in this application.
  • the first site edge encapsulates tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge outside the first message to obtain a second message.
  • the first site edge encapsulates the tunnel information of the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge outside the first message to obtain a second message.
  • the underlying underlay tunnel corresponding to the overlay end-to-end tunnel between the first site edge and the second site edge includes multiple tunnels.
  • the underlying underlay tunnel corresponding to the overlay end-to-end tunnel between the first site edge and the second site edge includes tunnel 1 (CPE1 to EPOP1), tunnel 2 (EPOP1 to BPOP1), tunnel 3 (BPOP1 to BPOP2), tunnel 4 (BPOP2 to EPOP2) and tunnel 5 (EPOP2 to CPE2).
  • the overlay end-to-end tunnel includes at least one entry point POP, and the tunnel information includes information about at least one entry point.
  • the overlay end-to-end tunnel includes a entry point POP, which is called the first entry point POP for ease of description, wherein the first site edge is the entry point of the overlay end-to-end tunnel, the second site edge is the exit point of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first entry point POP, which can be either an EPOP or a BPOP, which is not limited in this application.
  • the tunnel information of the overlay end-to-end tunnel includes first information about the first entry point.
  • the overlay end-to-end tunnel includes multiple access points POPs, and the multiple access points POPs include a first access point POP and a second access point POP, wherein the first site edge is the entry point of the overlay end-to-end tunnel, the second site edge is the exit point of the overlay end-to-end tunnel, the first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.
  • the overlay end-to-end tunnel between the first site edge and the second site edge includes multiple access points, the first site edge accesses the wide area network through EPOP1, and the second site edge accesses the wide area network through EPOP2, then EPOP1 is the first POP, and EPOP2 is the second POP.
  • the tunnel information of the overlay end-to-end tunnel includes first information of the first access point and second information of the second access point.
  • the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the Internet Protocol version 6 (internet protocol version 6, IPv6)
  • IPv6 Internet Protocol version 6
  • the first site edge encapsulates the tunnel information of the SRv6 tunnel outside the first message to obtain a second message.
  • the second message includes an IPv6 header and a segment routing header (segment routing header, SRH).
  • segment routing header segment routing header
  • the overlay end-to-end tunnel includes a first access point and a second access point
  • the destination address of the IPv6 header points to the first access point
  • the SRH includes the first information and the second information.
  • Figures 6A to 6C are example diagrams provided by the present application.
  • Figure 6A shows a VPN service message, including a message header Inner IP Hdr and a load Inner Payload.
  • Figure 6B shows a first message, which is obtained after the VPN service message is encrypted by the ESP protocol.
  • Figure 6C shows a second message, which is obtained after the tunnel information of the SRv6 tunnel between the first site edge and the second site edge is encapsulated outside the first message, wherein IPv6 Hdr (Src IP, Dst IP) represents the IPv6 message header, SRH (..., vpnsid) represents the segment routing header SRH, and the IPv6 message header and SRH constitute part of the tunnel information of the overlay end-to-end tunnel.
  • IPv6 Hdr Src IP, Dst IP
  • SRH ..., vpnsid
  • FIG. 1 is a schematic diagram provided by the present application.
  • IPv6 Hdr (cpe1, epop1-sid) is the IPv6 message header
  • SRH (vpnsid, epop2-sid, bpop2-sid, bpop1-sid, epop1-sid,) is the segment routing header SRH, wherein epop1-sid represents the first endpoint segment identifier END.SID of CPE1, bpop1-sid represents the first endpoint segment identifier END.SID of BPOP1, bpop2-sid represents the first endpoint segment identifier END.SID of BPOP2, epop2-sid represents the first endpoint segment identifier END.SID of EPOP2, vpnsid is generated by CPE2 during BGP route announcement, and vpnsid is associated with the VRF of CPE2.
  • EPOP1 is the first access point POP
  • the first endpoint segment identifier epop1-sid of EPOP1 is the first information of the first access point POP
  • EPOP2 is the second access point POP
  • the first endpoint segment identifier epop2-sid of EPOP2 is the second information of the second access point POP
  • the operation associated with the first endpoint segment identifier epop1-sid of EPOP1 includes: matching the upper layer overly SRv6 policy Policy from the first POP to the second POP according to the next hop SID of epop1-sid.
  • the operation associated with the segment identifier END.SID can be seen from the messages at each POP point shown in Figure 7.
  • the upper-layer overlay network is established on the basis of the underlying underlay network.
  • the second message is transmitted through the overlay end-to-end tunnel, it is actually transmitted on the underlying underlay network.
  • the upper-layer overlay network does not perceive how the message is transmitted on the underlying underlay network. Therefore, it is necessary to encapsulate the tunnel information of the underlay tunnel in the outer layer of the second message, and the message encapsulated with the tunnel information of the underlay tunnel is transmitted through the overlay end-to-end tunnel (the message actually encapsulated with the tunnel information of the underlay tunnel is transmitted on the underlying underlay tunnel.)
  • the wide area network is an SD-WAN wide area network
  • the message needs to pass through the operator network when it is transmitted.
  • the devices in the operator network cannot recognize the upper-layer overlying IPv6 address. Therefore, an outer layer is encapsulated.
  • the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engine (SR-MPLS TE) policy Policy
  • the second message includes an MPLS label stack
  • the MPLS label stack includes first information of the first POP and second information of the second POP.
  • the first information is the first node SID of the first POP
  • the operation of associating the first node SID includes: matching the upper layer overlay SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.
  • CPE1 is the edge of the first site
  • CPE2 is the edge of the second site
  • the overlay end-to-end tunnel between CPE1 and CPE2 is SR-MPLS TE Policy
  • CPE1 encapsulates the SR-MPLS TE Policy information between CPE1 and CPE2 outside the first message to obtain a second message.
  • FIG8 is a schematic diagram provided by the present application.
  • epop1-sid, bpop1-sid, bpop2-sid, epop2-sid, cpe2-sid represents the tunnel information of the overlay end-to-end tunnel, that is, the MPLS label stack, wherein epop1-sid represents the first node SID of EPOP1, bpop1-sid represents the first node SID of BPOP1, bpop2-sid represents the first node SID of BPOP2, epop2-sid represents the first node SID of EPOP2, and cpe2-sid represents the first node SID of CPE2.
  • EPOP1 is the first access point POP
  • the first node segment identifier epop1-sid of EPOP1 is the first information of the first access point POP
  • EPOP2 is the second access point POP
  • the first node segment identifier epop2-sid of EPOP2 is the second information of the second access point POP.
  • the operation associated with the first node SID includes: matching the upper layer overly SR MPLS tunnel between the first POP and the second POP according to the next hop SID of the first node SID in the label stack.
  • the operation associated with the node segment identifier SID can be seen from the messages at each POP point shown in Figure 8.
  • the underlay IP in the message of Figure 8 is the tunnel information of the underlay tunnel.
  • the overlay end-to-end tunnel is an SRv6 tunnel
  • the second message can be tunnel encapsulated based on the generic network virtualization encapsulation (GENEVE) protocol, and the second message is encapsulated using SRv6 in GENEVE.
  • the second message includes: an outer IP header, a user datagram protocol (UDP) header, a GENEVE encapsulation, an SRH, an ESP, and a payload, wherein the payload includes the aforementioned VPN service message; the GENEVE encapsulation includes a VPN identifier of the VPN service carried by the VPN service message.
  • a metadata field may also be included between the SRH and the ESP to carry service intent information.
  • the second message can also use SRv6 over GENEVE encapsulation.
  • the difference between SRv6 over GENEVE encapsulation and SRv6 in GENEVE encapsulation is that an IPv6 header is also included between the GENEVE encapsulation and the SRH.
  • the encapsulation overhead of SRv6 over GENEVE encapsulation is larger than that of SRv6 in GENEVE encapsulation, but SRv6 over GENEVE encapsulation complies with the standard encapsulation format of SRv6.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the generic routing encapsulation (GRE) protocol
  • the second message is encapsulated using SRv6 over GRE.
  • the second message includes: an outer IP header, a UDP header, an outer GRE encapsulation, an IPv6 header, an SRH, an inner GRE encapsulation, an ESP, and a payload, wherein the payload includes the aforementioned VPN service message
  • the inner GRE encapsulation includes a VPN identifier of the VPN service carried by the VPN service message. The VPN identifier is carried in the inner GRE encapsulation.
  • the intermediate nodes through which the overlay end-to-end tunnel passes do not resolve the VPN identifier (VPN identifier, VNI), that is, the intermediate nodes are not aware of the VPN.
  • VPN identifier VPN identifier
  • a metadata field may also be included between the SRH and the inner GRE encapsulation to carry service intent information.
  • the business intention information in the embodiment of the present application may include one or more information indicating the business intention.
  • the business intention information may include a quality of service parameter, and the quality of service parameter is not limited to one or more parameters such as latency, packet loss, jitter, bandwidth utilization, and bit error rate.
  • the business intention parameter may include gateway constraint information that needs to be satisfied by the end-to-end path from site edge1 to site edge2, and the gateway constraint information includes but is not limited to the gateways that need to be passed through and/or the gateways that need to be detoured.
  • the first site edge sends a second message to the second site edge through the overlay end-to-end tunnel.
  • the first site edge sends the second message to the second site edge through the overlay end-to-end tunnel.
  • the first site edge sends the second message to the second site edge through the SRv6 tunnel or SR-MPLS TE Policy.
  • each access point POP between the first site edge and the second site edge does not perceive the second message, does not decrypt the second message, and only forwards it according to the tunnel information of the overlay end-to-end tunnel until the second message reaches the second site edge. Therefore, during the transmission of the service message, only one security protection needs to be performed at the edge of the first site, and no decryption is required at other access points POP, which reduces the consumption of computing resources, improves forwarding efficiency, and reduces transmission delay.
  • the method for securely transmitting messages provided in this embodiment can be applied to SD-WAN, and the first site edge and the second site edge are site edges in the SD-WAN.
  • the method can also be applied to other wide area networks, which is not limited in this application.
  • the present application scheme adds a new route type RT in BGP routing.
  • the BGP routing carries IPsec SA and export routing target ExportRT.
  • the newly added route type RT is used to indicate that the IPsec SA announced by the BGP routing is used for the business in the VRF matching ExportRT.
  • End-to-end security protection for VPN service messages By announcing BGP routes in the WAN, end-to-end IPsec SA negotiation based on VRF granularity is achieved between the edges of the two sites, so that the negotiated IPsec SA can be used to transmit VPN service messages in the future, laying the foundation for the transmission of VPN service messages.
  • each access point POP between the edge of the first site and the edge of the second site does not perceive the inner VPN service message.
  • end-to-end encryption and decryption between the edges of the two sites the consumption of computing resources is reduced, the forwarding efficiency is improved, and the transmission delay is reduced.
  • FIG9 is a flow chart of a secure message transmission method provided by the present application, and the method includes but is not limited to the following description.
  • the second site edge in the wide area network receives a second message sent by the first site edge through an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge.
  • the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in the outer layer of the first message.
  • the method for securely transmitting messages can be applied in SD-WAN, the first site edge and the second site edge are site edges in SD-WAN, and the method can also be applied to other wide area networks, which is not limited in this application.
  • the second site egress device edge receives the second message sent by the first site edge through the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge.
  • the underlying underlay tunnel corresponding to the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge includes multiple tunnels.
  • the first site edge may be CPE1
  • the second site edge may be CPE2
  • the first site edge may be CPE2
  • the second site edge may be CPE1.
  • the underlying underlay tunnel corresponding to the overlay end-to-end tunnel established between CPE1 and CPE2 includes multiple tunnels, specifically including: Tunnel 1 (CPE1 to EPOP1), Tunnel 2 (EPOP1 to BPOP1), Tunnel 3 (BPOP1 to BPOP2), Tunnel 4 (BPOP2 to EPOP2) and Tunnel 5 (EPOP2 to CPE2).
  • the overlay end-to-end tunnel includes at least one access point POP, and the tunnel information includes information about at least one access point.
  • the overlay end-to-end tunnel includes a first access point POP, and the tunnel information includes first information about the first access point.
  • the overlay end-to-end tunnel includes multiple access points POPs, and the multiple access points POPs include a first access point POP and a second access point POP, and the tunnel information includes first information about the first access point and second information about the second access point.
  • the first site edge is the entry point of the overlay end-to-end tunnel
  • the second site edge is the exit point of the overlay end-to-end tunnel. The first site edge accesses the wide area network through the first POP, and the second site edge accesses the wide area network through the second POP.
  • the overlay end-to-end tunnel is an SRv6 tunnel
  • the second site edge receives the second message sent by the first site edge through the SRv6 tunnel
  • the second message includes the first message and the tunnel information of the SRv6 tunnel encapsulated in the outer layer of the first message.
  • the first message is a message obtained by performing security protection on the VPN service message through the IPsecSA negotiated by the second site edge and the first site edge
  • the tunnel information of the SRv6 tunnel includes an IPv6 header and a segment routing header SRH
  • the destination address of the IPv6 header points to the first POP
  • the SRH header includes the first information and the second information.
  • the overlay end-to-end tunnel is an SR-MPLS TE Policy
  • the second message includes the first message and the SR-MPLS TE Policy information encapsulated in the outer layer of the first message.
  • the SR-MPLS TE Policy information includes an MPLS label stack, and the MPLS label stack includes first information of the first POP and second information of the second POP.
  • the format of the second message please refer to the description of the above method embodiment, and for the sake of brevity of the specification, it will not be repeated here.
  • the second message may also include a message header of the underlying underlay tunnel.
  • a message header underlay IP of the underlying underlay tunnel is encapsulated in the outer layer.
  • the second site edge decapsulates the second message to obtain the first message.
  • the second site edge decapsulates the second message to obtain the first message.
  • the overlay end-to-end tunnel is an SRv6 tunnel
  • the second message includes the first message and the tunnel information of the SRv6 tunnel.
  • the second site edge decapsulates the second message, removes the tunnel information of the SRv6 tunnel, and obtains the first message.
  • FIG6B A schematic diagram of the first message format is shown in FIG6B, which is not repeated here.
  • the overlay end-to-end tunnel is SR-MPLS TE Policy
  • the second message includes the first message and the SR-MPLS TE Policy information encapsulated in the outer layer of the first message.
  • the second site edge decapsulates the second message, removes the tunnel information of the MPLS SR-TE tunnel, and obtains the first message.
  • the schematic diagram of the first message format is shown in FIG6B, which is not repeated here.
  • the overlay end-to-end tunnel is a GENEVE protocol encapsulated tunnel
  • the second message is encapsulated using SRv6 in GENEVE.
  • the second site edge decapsulates the second message, removes the SRv6 in GENEVE encapsulated message header, and obtains the first message.
  • FIG6B A schematic diagram of the first message format is shown in FIG6B , which will not be described in detail here.
  • the overlay end-to-end tunnel is a tunnel based on GRE protocol encapsulation
  • the second message is encapsulated using SRv6 over GRE.
  • the second site edge decapsulates the second message, removes the SRv6 over GRE encapsulated message header, and obtains the first message.
  • FIG6B A schematic diagram of the first message format is shown in FIG6B , which is not described here.
  • the second site edge processes the first message according to the IPsecSA to obtain a virtual private network VPN service message.
  • the second site edge performs ESP protocol processing on the first message according to IPsecSA to obtain a VPN service message. In one implementation, the second site edge authenticates the first message according to IPsecSA and the authentication data carried in the authentication header AH of the first message to obtain a VPN service message. In one implementation, the second site edge performs ESP protocol decryption on the first message according to IPsecSA, and authenticates the first message according to the IPsecSA and the authentication data carried in the authentication header AH of the first message to obtain a VPN service message.
  • the first site edge can generate a BGP route and notify the second site edge of the BGP route, or the second site edge can generate a BGP route and notify the BGP route to the first site edge. Both methods can achieve the association of the VRF of the first site edge and the VRF of the second site edge with the IPsec SA. After the VRF of the first site edge and the VRF of the second site edge are associated with the IPsec SA in either of the two methods, the first site edge can perform security protection and encapsulation on the VPN service message based on the negotiated IPsec SA, and then send it to the second site edge, which decapsulates and decrypts the VPN service message according to the negotiated IPsec SA to obtain the VPN service message.
  • the present application provides a method for securely transmitting messages.
  • the IPsec SA is negotiated between the edge of the first site and the edge of the second site, and the IPsec SA is associated with the VRF of the edge of the first site and the VRF of the edge of the second site.
  • the implementation of the embodiment of the present application reduces the consumption of computing resources of network nodes, improves forwarding efficiency, and reduces transmission delay.
  • FIG. 10 is a schematic diagram of the structure of a device 600 for securely transmitting a message according to an embodiment of the present application.
  • the device 600 for securely transmitting a message may be configured as a first site edge in a wide area network.
  • the device 600 includes:
  • a receiving module 610 is used to receive a virtual private network VPN service message in a virtual routing forwarding VRF;
  • the processing module 620 is used to perform security protection on the VPN service message according to the Internet Protocol Security Association (IPsecSA) associated with the VRF negotiated with the second site edge to obtain a first message;
  • IPsecSA Internet Protocol Security Association
  • the processing module 620 is further configured to encapsulate tunnel information of an upper layer overlay end-to-end tunnel established between the first site edge and the second site edge in an outer layer of the first message to obtain a second message, wherein the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, and the tunnel information includes first information of a first point of presence POP, the first site edge is an inbound end point of the overlay end-to-end tunnel, the second site edge is an outbound end point of the overlay end-to-end tunnel, and the overlay end-to-end tunnel passes through the first POP;
  • the sending module 630 is used to send a second message to the second site edge through the overlay end-to-end tunnel.
  • the processing module 620 is used to: encrypt the VPN service message using the Encapsulation Security Payload (ESP) protocol; and/or encapsulate the VPN service message with an Authentication Header.
  • ESP Encapsulation Security Payload
  • the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP.
  • the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6,
  • the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH includes first information and second information.
  • the first information is the first endpoint segment identifier END.SID of the first POP
  • the operations associated with the first endpoint segment identifier END.SID include: matching the upper-layer overlay SRv6 Policy from the first POP to the second POP according to the next-hop SID of END.SID.
  • the overlay end-to-end tunnel is an SR-MPLS TE Policy
  • the second message includes an MPLS label stack
  • the MPLS label stack includes first information and second information.
  • the first information is a first node SID of the first POP
  • the operation associated with the first node SID includes: The next hop SID of the first node SID in the signature stack matches the upper layer overlay SR MPLS tunnel from the first POP to the second POP.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.
  • GRE Generic Routing Encapsulation
  • the receiving module 610 is also used to receive the Border Gateway Protocol BGP route announced by the edge of the second site, the BGP route including the route type RT, IPsec SA, the identifier of the edge of the second site, and the export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection for the VPN service packets in the virtual routing forwarding VRF matching the Export RT; the processing module 620 is used to associate the IPsec SA with the VRF according to the route type RT and the Export RT.
  • the BGP route is a BGP software defined wide area network (SD-WAN) route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network (EVPN) route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • SD-WAN software defined wide area network
  • EVPN BGP Ethernet virtual private network
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and/or the node identifier Node ID of the second site edge.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes a route type RT and an identifier of the second site edge.
  • a BGP route includes a Tunnel Encapsulation Attribute Type Length Value TLV, and the Tunnel Encapsulation Attribute TLV includes an IPsec SA.
  • BGP routes include an extended community attribute, which is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.
  • the apparatus 600 for securely transmitting messages can be used to implement the method embodiment corresponding to FIG. 5, that is, the method embodiment corresponding to the sending side of the data forwarding plane, and can also be used to implement the method steps performed by the first site edge in the method embodiment of FIG. 2, that is, the method embodiment corresponding to the receiving side of the control plane.
  • the apparatus 600 for securely transmitting messages can also be called a device for negotiating IPsec SA.
  • each functional module and the corresponding execution steps of each functional module in Figure 10 are merely an example.
  • the device 600 can also be divided into more or fewer functional modules according to specific execution steps.
  • FIG. 11 is a schematic diagram of the structure of another apparatus 700 for securely transmitting a message provided in an embodiment of the present application.
  • the apparatus 700 for securely transmitting a message may be configured as a second site edge in a wide area network.
  • the apparatus 700 includes:
  • the receiving module 710 is used to receive a second message sent by the first site edge through the upper layer overlay end-to-end tunnel established between the first site edge and the second site edge, the second message includes the first message and tunnel information of the overlay end-to-end tunnel encapsulated in the outer layer of the first message, the underlying underlay tunnel corresponding to the overlay end-to-end tunnel includes multiple tunnels, the tunnel information includes first information of the first point of presence POP, the first site edge is the ingress end point of the overlay end-to-end tunnel, the second site edge is the egress end point of the overlay end-to-end tunnel, the overlay end-to-end tunnel passes through the first POP, and the first message is a message obtained by performing security protection on a virtual private network VPN service message through an Internet Protocol Security Alliance IPsec SA negotiated by the second site edge and the first site edge;
  • IPsec SA Internet Protocol Security Alliance
  • the processing module 720 is used to decapsulate the second message to obtain the first message
  • the processing module 720 is used to process the first message according to the IPsecSA to obtain a VPN service message.
  • the processing module 720 is used to: decrypt the first message using the Encapsulated Security Payload (ESP) protocol according to the IPsecSA; and/or authenticate the first message according to the IPsec SA and the authentication data carried in the Authentication Header of the first message.
  • ESP Encapsulated Security Payload
  • the tunnel information also includes second information of the second POP, the overlay end-to-end tunnel passes through the first POP and the second POP, the first site edge accesses the WAN through the first POP, and the second site edge accesses the WAN through the second POP.
  • the overlay end-to-end tunnel is a segment routing SRv6 tunnel of the sixth version of the Internet Protocol IPv6,
  • the second message includes an IPv6 header and a segment routing header SRH, the destination address of the IPv6 header points to the first POP, and the SRH header includes first information and second information.
  • the first information is the first endpoint segment identifier END.SID of the first POP
  • the operations associated with the first endpoint segment identifier END.SID include: matching the upper-layer overlay SRv6 Policy from the first POP to the second POP according to the next-hop SID of END.SID.
  • the overlay end-to-end tunnel is a segment routing multi-protocol label switching traffic engineering policy SR-MPLS TE Policy
  • the second message includes an MPLS label stack
  • the MPLS label stack includes the first information and the second information.
  • the first information is the first node SID of the first POP
  • the operation associated with the first node SID includes: matching the upper layer overlay SR MPLS tunnel from the first POP to the second POP according to the next hop SID of the first node SID in the label stack.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the general network virtualization encapsulation GENEVE protocol, and the second message is encapsulated using SRv6 in GENEVE.
  • the overlay end-to-end tunnel is a tunnel encapsulated based on the Generic Routing Encapsulation (GRE) protocol, and the second message is encapsulated using SRv6 over GRE.
  • GRE Generic Routing Encapsulation
  • the processing module 720 is used to generate a border gateway protocol BGP route, wherein the BGP route includes a route type RT, an IPsec SA, an identifier of the second site edge, and an export route target ExportRT, wherein the route type RT indicates that the IPsec SA announced by the BGP route is used to perform end-to-end security protection on VPN service messages in a virtual route forwarding VRF matching the Export RT;
  • the sending module 730 is used for the second site edge to notify the BGP route to the first site edge.
  • the BGP route is a BGP software defined wide area network (SD-WAN) route
  • the sub-address family of the BGP SD-WAN route is the SD-WAN sub-address family
  • the BGP route is a BGP Ethernet virtual private network (EVPN) route
  • the sub-address family of the BGP EVPN route is the EVPN sub-address family.
  • SD-WAN software defined wide area network
  • EVPN BGP Ethernet virtual private network
  • the identifier of the second site edge includes the site identifier site ID to which the second site edge belongs and/or the node identifier Node ID of the second site edge.
  • the BGP route includes network layer reachability information NLRI
  • the NLRI includes a route type RT and an identifier of the second site edge.
  • a BGP route includes a Tunnel Encapsulation Attribute Type Length Value TLV, and the Tunnel Encapsulation Attribute TLV includes an IPsec SA.
  • BGP routes include an extended community attribute, which is used to carry the Export RT.
  • the first site edge and the second site edge are site edges in a software-defined wide area network SD-WAN.
  • the device 700 for securely transmitting messages can be used to implement the method embodiment corresponding to FIG. 9 , that is, the method embodiment corresponding to the data forwarding plane receiving side, and can also be used to implement the method steps performed by the second site edge in the method embodiment corresponding to FIG. 2 , that is, the method embodiment corresponding to the control plane sending side.
  • the device 700 for securely transmitting messages can also be called a device for negotiating IPsec SA.
  • each functional module in FIG. 11 and the corresponding execution steps of each functional module are merely an example.
  • the device 700 may be further divided into more or fewer functional modules according to specific execution steps.
  • Fig. 12 is a schematic diagram of the structure of a network device 800 provided by the present application, the network device 800 can be configured as a first site edge in a wide area network, or can be configured as a second site edge in a wide area network.
  • the network device 800 can be implemented by a general bus architecture.
  • the network device 800 includes at least one processor 801 , a memory 803 , and at least one communication interface 804 .
  • Processor 801 may be a general-purpose CPU, NP, microprocessor, or may be one or more integrated circuits for implementing the solution of the present application. For example, an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof.
  • ASIC application-specific integrated circuit
  • PLD programmable logic device
  • PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • CPLD complex programmable logic device
  • FPGA field-programmable gate array
  • GAL generic array logic
  • the network device 800 may also include a communication bus 802 for transmitting information between various components.
  • the communication bus 802 may be divided into an address bus, a data bus, a control bus, etc.
  • FIG. 12 is represented by only one thick line, but does not mean that there is only one bus or one type of bus.
  • the memory 803 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, or a random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or an electrically erasable programmable read-only memory (EEPROM), a compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical disc, laser disc, optical disc, digital versatile disc, Blu-ray disc, etc.), a magnetic disk storage medium or other magnetic storage device, or any other medium that can be used to carry or store program codes in the form of instructions or data structures and can be accessed by a computer, but is not limited thereto.
  • the memory 803 may exist independently and be connected to the processor 801 through the communication bus 802; the memory 803 may also be connected to the processor 801. Integrated together.
  • the communication interface 804 is used to communicate with other devices or communication networks.
  • the communication interface 804 may include a wired communication interface and may also include a wireless communication interface.
  • the wired communication interface may be, for example, an Ethernet interface, and the Ethernet interface may be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof, etc.
  • WLAN wireless local area network
  • the processor 801 may include one or more CPUs, for example, CPU0 and CPU1 shown in FIG. 12 .
  • the network device 800 may include multiple processors, such as the processor 801 and the processor 805 shown in Figure 12. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU).
  • the processor here may refer to one or more devices, circuits, and/or processing cores for processing data (such as computer program instructions).
  • the memory 803 is used to store the program code 810 of the present application solution
  • the processor 801 is used to execute the program code 810 stored in the memory 803. That is, the network device 800 can implement the method provided by the method embodiment of Figure 2 or Figure 5 or Figure 9 through the processor 801 and the program code 810 in the memory 803.
  • the network device 800 of the embodiment of the present application may correspond to the first site edge or the second site edge in the above-mentioned various method embodiments, and the processor 801, the communication interface 804, etc. in the network device 800 may implement the functions and/or various steps and methods implemented by the devices in the above-mentioned various method embodiments. For the sake of brevity, it will not be repeated here.
  • the receiving module 610 and the sending module 630 in the device 600 for securely transmitting messages can be located in the communication interface 804 in the network device 800; the processing module 620 can be located in the processor 801 or the processor 805 in the network device 800.
  • the receiving module 710 and the sending module 730 in the device 700 for securely transmitting messages can be located in the communication interface 804 in the network device 800; the processing module 720 can be located in the processor 801 or the processor 805 in the network device 800.
  • the hardware, modules and other operations and/or functions in the network device 800 are respectively various steps and methods implemented by the device 600 for securely transmitting messages or the device 700 for securely transmitting messages.
  • the specific details can be found in the above-mentioned method embodiments, and for the sake of brevity of the specification, they will not be repeated here.
  • each step of Figure 2 or Figure 5 or Figure 9 above is completed by an integrated logic circuit of hardware in the processor of the network device 800 or an instruction in the form of software.
  • the method and steps disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules (software units) in the processor for execution.
  • the software module can be located in one or more storage media mature in the art such as random access memory, flash read-only memory, programmable read-only memory, electrically erasable programmable memory and registers.
  • the storage medium is located in the memory, and the processor reads the information in the memory and executes the steps in the above method in conjunction with the hardware. For the simplicity of the specification, it is not described in detail here.
  • An embodiment of the present application also provides a system, which includes a first site edge and a second site edge.
  • the first site edge can be the above-mentioned device 600 or network device 800 for secure message transmission
  • the second site edge can be the above-mentioned device 700 or network device 800 for secure message transmission.
  • the first site edge can be used to implement the method embodiment described in Figures 2 or 5 above
  • the second site edge can be used to implement the method embodiment described in Figures 2 or 9 above.
  • An embodiment of the present application also provides a computer storage medium, including program instructions, which, when executed on a processor, enable the processor to implement each step in the method embodiment described in FIG. 2 or FIG. 5 or FIG. 9 above.
  • An embodiment of the present application further provides a computer program product including program instructions.
  • the program instructions When the program instructions are executed on a processor, the processor implements each step in the method embodiment described in FIG. 2 , FIG. 5 , or FIG. 9 .
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are merely illustrative.
  • the division of the unit is merely a logical function division. There may be other division methods in actual implementation.
  • multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interfaces, devices or units, or may be an electrical, mechanical or other form of connection.
  • the unit described as a separate component may or may not be physically separated, and the component displayed as a unit may or may not be a physical unit, that is, it may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the embodiment of the present application.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.
  • the above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.
  • the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server, or network device, etc.) to execute all or part of the steps of the method in each embodiment of the present application.
  • the aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM), random access memory (RAM), disk or optical disk and other media that can store program code.
  • the computer program product includes one or more computer program instructions.
  • the computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device.
  • the computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • the computer program instructions can be transmitted from one website site, computer, server or data center to another website site, computer, server or data center by wired or wireless means.
  • the computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media integrated.
  • the available medium can be a magnetic medium (such as a floppy disk, a hard disk, a tape), an optical medium (for example, a digital video disc (digital video disc, DVD), or a semiconductor medium (such as a solid state drive), etc.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请提供了安全传输报文的方法、协商IPsec SA的方法及相关装置，应用于广域网。在跨越多段隧道场景下，通过扩展BGP路由，基于VRF粒度，在第一站点edge与第二站点edge之间协商用于端到端安全保护的IPsec SA。第一站点edge基于IPsec SA对VPN业务报文进行安全保护后，将通过第一站点edge与第二站点edge之间的overlay端到端隧道发送所述报文，第二站点edge基于IPsec SA对报文进行处理，获得VPN业务报文。本申请中只需在第一站点edge进行一次安全保护，中间节点无需加解密处理，既保证报文的安全传输，又提高传输效率、降低传输延迟。

Description

安全传输报文的方法及相关装置
本申请要求于2023年06月30日提交中国专利局、申请号为202310803215.6、申请名称为“安全传输报文的方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及广域网报文传输领域，尤其涉及安全传输报文的方法和协商IPsec SA的方法及相关装置。
背景技术
在底层(underlay)网络的基础上，通过在多个网络节点之间建立隧道，可以构建上层(overlay)网络。overlay网络实现了业务与底层网络的解耦，使得业务报文能够实现端到端的快速交付。
但由于隧道是基于运营商网络建立的，该网络无法保障业务报文的安全性，因此，隧道自身需要具备一定的安全能力，以保证业务报文的安全性。当前普遍采用的方法是，在控制面上建立隧道时，在隧道的入节点与出节点之间通过边界网关协议(border gateway protocol，BGP)基于传输网络端口(transport network port，TNP)粒度进行密钥协商，其中，密钥是与隧道的入节点的端口和出节点的端口绑定的。在隧道建立完成后，当业务报文在隧道中传输时，入节点根据与出节点协商的密钥对业务报文进行加密，使得业务报文在隧道中传输时处于加密状态，当业务报文到达隧道的出节点时，出节点再根据协商的密钥对业务报文进行解密，从而保证业务报文传输的安全性。
上述基于网络节点的TNP粒度来对报文进行加解密传输报文的方法，对于每一段隧道都需要入节点与出节点之间协商密钥信息，当业务报文在该段隧道中传输时，在该段隧道的入节点按照协商的方式进行加密，在出节点按照协商的方式进行解密。当业务流需要跨越多段隧道时，各段隧道之间的密钥是不同的，需要在每段隧道的入节点上进行加密，出节点上进行解密，在下一段隧道的入节点上再加密，出节点上再解密…加解密操作繁琐，且消耗设备大量的计算资源，增加了业务报文的转发延迟。
发明内容
本申请提供了安全传输报文的方法、协商IPsec SA的方法及相关装置，采用本申请所述的方法，可以提高报文传输效率，降低传输延时。
第一方面，本申请提供了一种安全传输报文的方法，从数据转发面的发送侧来描述，所述方法包括：
广域网中的第一站点出口设备edge接收虚拟路由转发VRF中的虚拟专用网络VPN业务报文；
所述第一站点edge根据与第二站点edge协商的与所述VRF关联的因特网协议安全协议安全联盟IPsecSA对所述VPN业务报文进行安全保护，以得到第一报文；
所述第一站点edge在所述第一报文外层封装在所述第一站点edge到所述第二站点edge之间建立的上层overlay端到端隧道的隧道信息，以获得第二报文，其中，所述overlay端到端隧道对应的底层underlay隧道包括多段隧道，所述隧道信息包括第一入网点POP的第一信息，所述第一站点edge为所述overlay端到端隧道的入端点，所述第二站点edge为所述overlay端到端隧道的出端点，所述overlay端到端隧道经过所述第一POP；
所述第一站点edge通过所述overlay端到端隧道，向所述第二站点edge发送所述第二报文。
本申请方案中，在第一站点edge与第二站点edge之间跨越多段隧道的场景下，第一站点edge与第二站点edge预先协商好了与VRF关联的IPsecSA，在第一站点edge接收到VRF中的VPN业务报文后，根据与第二站点edge协商好的与VRF关联的IPsecSA对VPN业务报文进行安全保护，得到第一报文；再在第一报文的外层封装上第一站点edge至第二站点edge之间建立的上层overlay端到端隧道的隧道信息，获得第二报文；然后，第一站点edge将第二报文通过上层overlay端到端隧道传输至第二站点edge，其中，overlay端到端隧道经过的各个POP无需对第二报文进行解密或者加密，只需按照隧道信息进行转发即可。
在第一站点edge与第二站点edge之间跨越多段隧道的场景下，本申请提供了一种安全传输报文的方法，该方法只需在两个站点edge之间建立的overlay端到端隧道的入端点进行一次安全保护，在传输过程中无需各个POP对报文进行加密或解密，节省了算力资源，降低了传输延迟，提高了报文传输效率。
基于第一方面，在可能的实现方式中，所述对所述VPN业务报文进行安全保护包括：对所述VPN业务报文进行封装安全载荷ESP协议加密；和/或，对所述VPN业务报文封装认证头Authentication Header。
基于第一方面，在可能的实现方式中，所述隧道信息还包括第二POP的第二信息，所述overlay端到端隧道经过所述第一POP和所述第二POP，所述第一站点edge通过所述第一POP接入所述广域网，所述第二站点edge通过所述第二POP接入所述广域网。
基于第一方面，在可能的实现方式中，所述overlay端到端隧道为互联网协议第六版本IPv6的段路由SRv6隧道，所述第二报文包括IPv6头和分段路由头SRH，所述IPv6头的目的地址指向所述第一POP，所述SRH包括所述第一信息和所述第二信息。
overlay端到端隧道可以为SRv6隧道，第一站点edge在第一报文的外层封装上SRv6隧道的隧道信息，SRv6隧道的隧道信息包括IPv6头和分段路由头SRH，隧道上的各个POP可以根据IPv6头和分段路由头SRH对第二报文进行转发。
基于第一方面，在可能的实现方式中，所述第一信息为所述第一POP的第一端点段标识END.SID，所述第一端点段标识END.SID关联的操作包括：根据所述END.SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overlay SRv6 Policy。
基于第一方面，在可能的实现方式中，所述overlay端到端隧道为分段路由多协议标签交换流量工程策略SR-MPLS TE Policy，所述第二报文包括MPLS标签栈，所述MPLS标签栈包括所述第一信息和所述第二信息。
基于第一方面，在可能的实现方式中，所述第一信息为所述第一POP的第一节点SID，所述第一节点SID关联的操作包括：根据所述标签栈中所述第一节点SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overlay SR MPLS隧道。
基于第一方面，在可能的实现方式中，所述overlay端到端隧道为基于通用网络虚拟化封装GENEVE协议封装的隧道，所述第二报文采用SRv6 in GENEVE封装。
基于第一方面，在可能的实现方式中，所述overlay端到端隧道为基于通用路由封装GRE协议封装的隧道，所述第二报文采用SRv6 over GRE封装。
基于第一方面，在可能的实现方式中，在所述第一站点edge接收所述业务报文之前，所述方法还包括：
所述第一站点edge接收所述第二站点edge通告的边界网关协议BGP路由，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的所述虚拟路由转发VRF中的所述VPN业务报文进行端到端安全保护；根据所述路由类型RT和所述Export RT，所述第一站点edge将所述IPsec SA与所述VRF关联。
BGP路由中新增了一种路由类型，BGP路由中携带了IPsec SA和Export RT，新增的路由类型RT指示BGP路由通告的IPsec SA用于对与Export RT匹配的VRF中的VPN业务报文进行端到端安全保护。通过BGP路由通告，使得第一站点edge与第二站点edge之间协商好了与VRF关联的IPsecSA，该IPsecSA用于对VRF中的VPN业务报文进行安全保护，尤其在第一站点edge与第二站点edge之间跨越多段隧道的情况下，为VPN业务报文的安全、快速传输奠定了基础。实施本申请实施例，实现了VPN业务报文的安全、快速传输，降低了传输延时，提高了传输效率。
基于第一方面，在可能的实现方式中，所述BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
基于第一方面，在可能的实现方式中，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和/或所述第二站点edge的节点标识Node ID。在一种实现方式中，第二站点edge的标识可以是第二站点标识site ID和节点标识Node ID，通过第二站点标识site ID和节点标识Node ID可以确定第二站点edge，第一站点edge与第二站点edge之间基于协商的IPsec SA对业务报文进行安全保护和传输。在又一种实现方式中，第二站点edge的标识可以是节点标识Node ID，节点Node ID在广域网中是全局唯一的，根据Node ID可以确定第二站点edge。在又一种实现方式中，第二站点edge的标识可以是第二站点标识site ID，这种情况下，第一站点中的任意一个edge接收到第二站点中的任意一个edge通告的BGP路由，其中BGP路由中携带的包括第二站点的标识和IPsec SA，则表示第一站点与第二站点协商的秘钥为IPsec SA，第一站点中的任意一个edge与第二站点中的任意一个edge之间均可以通过协商的IPsec SA对业务报文进行安全保护和传输。
基于第一方面，在可能的实现方式中，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
基于第一方面，在可能的实现方式中，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
基于第一方面，在可能的实现方式中，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
基于第一方面，在可能的实现方式中，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
第二方面，本申请提供了一种安全传输报文的方法，从数据转发面的接收侧来描述，所述方法包括：
广域网中的第二站点出口设备edge接收第一站点edge通过在所述第一站点edge和所述第二站点edge之间建立的上层overlay端到端隧道发送的第二报文，所述第二报文中包括第一报文以及在所述第一报文外层封装的所述overlay端到端隧道的隧道信息，所述overlay端到端隧道对应的底层underlay隧道包括多段隧道，所述隧道信息包括第一入网点POP的第一信息，所述第一站点edge为所述overlay端到端隧道的入端点，所述第二站点edge为所述overlay端到端隧道的出端点，所述overlay端到端隧道经过所述第一POP，所述第一报文为通过所述第二站点edge与所述第一站点edge协商的因特网协议安全协议安全联盟IPsec SA对虚拟专用网络VPN业务报文进行安全保护所得到的报文；
所述第二站点edge对所述第二报文进行解封装，获得第一报文；
所述第二站点edge根据所述IPsecSA对所述第一报文进行处理，以获得所述VPN业务报文。
第二站点edge接收到第二报文后，第二报文中包括第一报文和封装在第一报文外层的隧道信息，第二站点edge对第二报文进行解封装，获得第一报文，然后根据与第一站点edge协商好的IPsecSA对第一报文进行处理，获得VPN业务报文。第二报文在整个传输过程中，无需overlay端到端隧道上的各个POP进行加密或解密，只需在第二站点edge处进行一次处理即可，提高了传输效率，降低传输延时。
基于第二方面，在可能的实现方式中，所述对所述第一报文进行处理包括：根据所述IPsecSA，对所述第一报文进行封装安全载荷ESP协议解密；和/或，根据所述IPsec SA和所述第一报文的认证头Authentication Header中携带的认证数据对所述第一报文进行认证。
基于第二方面，在可能的实现方式中，所述隧道信息还包括第二POP的第二信息，所述overlay端到端隧道经过所述第一POP和所述第二POP，所述第一站点edge通过所述第一POP接入所述广域网，所述第二站点edge通过所述第二POP接入所述广域网。
基于第二方面，在可能的实现方式中，所述overlay端到端隧道为互联网协议第六版本IPv6的段路由SRv6隧道，所述第二报文包括IPv6头和分段路由头SRH，所述IPv6头的目的地址指向所述第一POP，所述SRH头包括所述第一信息和所述第二信息。
基于第二方面，在可能的实现方式中，所述第一信息为第一POP的第一端点段标识END.SID，所述第一端点段标识END.SID关联的操作包括：根据所述END.SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overlay SRv6 Policy。
基于第二方面，在可能的实现方式中，所述overlay端到端隧道为分段路由多协议标签交换流量工程策略SR-MPLS TE Policy，所述第二报文包括MPLS标签栈，所述MPLS标签栈包括所述第一信息和所述第二信息。
基于第二方面，在可能的实现方式中，所述第一信息为所述第一POP的第一节点SID，所述第一节点SID关联的操作包括：
根据所述标签栈中所述第一节点SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overlay SR MPLS隧道。
基于第二方面，在可能的实现方式中，所述overlay端到端隧道为基于通用网络虚拟化封装GENEVE协议封装的隧道，所述第二报文采用SRv6 in GENEVE封装。
基于第二方面，在可能的实现方式中，所述overlay端到端隧道为基于通用路由封装GRE协议封装的隧道，所述第二报文采用SRv6 over GRE封装。
基于第二方面，在可能的实现方式中，在所述广域网中的第二站点出口设备edge接收第一站点edge通过上层overlay端到端隧道发送的第二报文之前，所述方法还包括：所述第二站点出口设备edge生成边界网关协议BGP路由，其中，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的所述VPN业务报文进行端到端安全保护；所述第二站点edge向所述第一站点edge通告所述BGP路由。
基于第二方面，在可能的实现方式中，所述BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
基于第二方面，在可能的实现方式中，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和/或所述第二站点edge的节点标识Node ID。
基于第二方面，在可能的实现方式中，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
基于第二方面，在可能的实现方式中，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
基于第二方面，在可能的实现方式中，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
基于第二方面，在可能的实现方式中，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
第三方面，本申请提供了一种协商因特网协议安全协议安全联盟IPsec SA的方法，从控制面的接收侧来描述，所述方法包括：
广域网中的第一站点出口设备edge接收第二站点edge通告的边界网关协议BGP路由，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的业务报文进行端到端安全保护；
根据所述路由类型RT和所述Export RT，所述第一站点edge将所述IPsec SA与所述VRF关联。
本申请方案在BGP路由中新增了一种路由类型RT，BGP路由中携带了IPsec SA和导出路由目标ExportRT，新增的路由类型RT用于指示BGP路由通告的IPsec SA用于对于ExportRT匹配的VRF中的业务报文进行端到端的安全保护。通过将BGP路由在广域网中进行通告，实现了两个站点edge之间基于VRF粒度的端到端的IPsec SA协商，以便后续采用协商好的IPsec SA进行VPN业务报文的传输，为VPN业务报文的传输奠定了基础。
基于第三方面，在可能的实现方式中，所述BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
基于第三方面，在可能的实现方式中，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和/或所述第二站点edge的节点标识Node ID。
可以理解，第二站点edge的标识可以是第二站点标识site ID和节点标识Node ID，通过第二站点标识site ID和节点标识Node ID可以确定第二站点edge，第一站点edge与第二站点edge之间协商约定IPsec SA。在又一种实现方式中，第二站点edge的标识可以是节点标识Node ID，节点Node ID在广域网中是全局唯一的，根据Node ID可以确定第二站点edge，第一站点edge与第二站点edge之间协商约定IPsec SA。在又一种实现方式中，第二站点edge的标识可以是第二站点标识site ID，这种情况下，第一站点中的任意一个edge接收到第二站点中的任意一个edge通告的BGP路由，其中BGP路由中携带的包括第二站点的标识和IPsec SA，则表示第一站点与第二站点协商的秘钥为IPsec SA，后续第一站点中的任意一个edge与第二站点中的任意一个edge之间均可以通过协商的秘钥IPsec SA对业务报文进行安全保护和传输。
基于第三方面，在可能的实现方式中，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
基于第三方面，在可能的实现方式中，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
基于第三方面，在可能的实现方式中，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
基于第三方面，在可能的实现方式中，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
第四方面，本申请提供了一种协商因特网协议安全协议安全联盟IPsec SA的方法，从控制面的发送侧来描述，所述方法包括：
广域网中的第二站点出口设备edge生成边界网关协议BGP路由，其中，所述BGP路由包括路由类型 RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的业务报文进行端到端安全保护；
所述第二站点edge向第一站点edge通告所述BGP路由。
本申请方案在BGP路由中新增了一种路由类型RT，BGP路由中携带了IPsec SA和导出路由目标ExportRT，新增的路由类型RT用于指示BGP路由通告的IPsec SA用于对于ExportRT匹配的VRF中的业务报文进行端到端的安全保护。通过将BGP路由在广域网中进行通告，实现了两个站点edge之间基于VRF粒度的端到端的IPsec SA协商，以便后续采用协商好的IPsec SA进行VPN业务报文的传输，为VPN业务报文的传输奠定了基础。
基于第四方面，在可能的实现方式中，所述BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
基于第四方面，在可能的实现方式中，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和/或所述第二站点edge的节点标识Node ID。第二站点edge的标识可以是第二站点标识site ID和节点标识Node ID，通过第二站点标识site ID和节点标识Node ID可以确定第二站点edge，第一站点edge与第二站点edge之间协商约定IPsec SA。在又一种实现方式中，第二站点edge的标识可以是节点标识Node ID，节点Node ID在广域网中是全局唯一的，根据Node ID可以确定第二站点edge，第一站点edge与第二站点edge之间协商约定IPsec SA。在又一种实现方式中，第二站点edge的标识可以是第二站点标识site ID，这种情况下，第一站点中的任意一个edge接收到第二站点中的任意一个edge通告的BGP路由，其中BGP路由中携带的包括第二站点的标识和IPsec SA，则表示第一站点与第二站点协商的秘钥为IPsec SA，后续第一站点中的任意一个edge与第二站点中的任意一个edge之间均可以通过协商的秘钥IPsec SA对业务报文进行安全保护和传输。
基于第四方面，在可能的实现方式中，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
基于第四方面，在可能的实现方式中，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
基于第四方面，在可能的实现方式中，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
基于第四方面，在可能的实现方式中，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
第五方面，本申请提供了一种安全传输报文的装置，所述装置应用于广域网中的第一站点出口设备edge，所述装置包括：
接收模块，用于接收虚拟路由转发VRF中的虚拟专用网络VPN业务报文；
处理模块，用于根据与第二站点edge协商的与所述VRF关联的因特网协议安全协议安全联盟IPsecSA对所述VPN业务报文进行安全保护，以得到第一报文；
所述处理模块，用于在所述第一报文外层封装在所述第一站点edge到所述第二站点edge之间建立的上层overlay端到端隧道的隧道信息，以获得第二报文，其中，所述overlay端到端隧道对应的底层underlay隧道包括多段隧道，所述隧道信息包括第一入网点POP的第一信息，所述第一站点edge为所述overlay端到端隧道的入端点，所述第二站点edge为所述overlay端到端隧道的出端点，所述overlay端到端隧道经过所述第一POP；
发送模块，用于通过所述overlay端到端隧道，向所述第二站点edge发送所述第二报文。
基于第五方面，在可能的实现方式中，所述处理模块用于：对所述VPN业务报文进行封装安全载荷ESP协议加密；和/或，对所述VPN业务报文封装认证头Authentication Header。
基于第五方面，在可能的实现方式中，所述隧道信息还包括第二POP的第二信息，所述overlay端到端隧道经过所述第一POP和所述第二POP，所述第一站点edge通过所述第一POP接入所述广域网，所述第二站点edge通过所述第二POP接入所述广域网。
基于第五方面，在可能的实现方式中，所述overlay端到端隧道为互联网协议第六版本IPv6的段路由SRv6隧道，所述第二报文包括IPv6头和分段路由头SRH，所述IPv6头的目的地址指向所述第一POP，所述SRH包括所述第一信息和所述第二信息。
基于第五方面，在可能的实现方式中，所述第一信息为所述第一POP的第一端点段标识END.SID，所述第一端点段标识END.SID关联的操作包括：根据所述END.SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overly SRv6 Policy。
基于第五方面，在可能的实现方式中，所述overlay端到端隧道为分段路由多协议标签交换流量工程策略SR-MPLS TE Policy，所述第二报文包括MPLS标签栈，所述MPLS标签栈包括所述第一信息和所述第二信息。
基于第五方面，在可能的实现方式中，所述第一信息为所述第一POP的第一节点SID，所述第一节点SID关联的操作包括：根据所述标签栈中所述第一节点SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overly SR MPLS隧道。
基于第五方面，在可能的实现方式中，所述overlay端到端隧道为基于通用网络虚拟化封装GENEVE协议封装的隧道，所述第二报文采用SRv6 in GENEVE封装。
基于第五方面，在可能的实现方式中，所述overlay端到端隧道为基于通用路由封装GRE协议封装的隧道，所述第二报文采用SRv6 over GRE封装。
基于第五方面，在可能的实现方式中，所述接收模块还用于，接收所述第二站点edge通告的边界网关协议BGP路由，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的所述虚拟路由转发VRF中的所述VPN业务报文进行端到端安全保护；所述处理模块还用于，根据所述路由类型RT和所述Export RT，将所述IPsec SA与所述VRF关联。
基于第五方面，在可能的实现方式中，所述BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
基于第五方面，在可能的实现方式中，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和/或所述第二站点edge的节点标识Node ID。
基于第五方面，在可能的实现方式中，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
基于第五方面，在可能的实现方式中，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
基于第五方面，在可能的实现方式中，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
基于第五方面，在可能的实现方式中，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
第五方面中的各个功能模块用于实现上述第一方面以及第一方面的任意一种可能的实现方式所述的方法。
第六方面，本申请提供了一种安全传输报文的装置，所述装置应用于广域网中的第二站点edge，其特征在于，所述装置包括：
接收模块，用于接收第一站点edge通过在所述第一站点edge和所述第二站点edge之间建立的上层overlay端到端隧道发送的第二报文，所述第二报文中包括第一报文以及在所述第一报文外层封装的所述overlay端到端隧道的隧道信息，所述overlay端到端隧道对应的底层underlay隧道包括多段隧道，所述隧道信息包括第一入网点POP的第一信息，所述第一站点edge为所述overlay端到端隧道的入端点，所述第二站点edge为所述overlay端到端隧道的出端点，所述overlay端到端隧道经过所述第一POP，所述第一报文为通过所述第二站点edge与所述第一站点edge协商的因特网协议安全协议安全联盟IPsec SA对虚拟专用网络VPN业务报文进行安全保护所得到的报文；
处理模块，用于对所述第二报文进行解封装，获得第一报文；
所述处理模块还用于，根据所述IPsecSA对所述第一报文进行处理，以获得所述VPN业务报文。
基于第六方面，在可能的实现方式中，所述处理模块用于：根据所述IPsecSA，对所述第一报文进行封装安全载荷ESP协议解密；和/或，根据所述IPsec SA和所述第一报文的认证头Authentication Header中携带的认证数据对所述第一报文进行认证。
基于第六方面，在可能的实现方式中，所述隧道信息还包括第二POP的第二信息，所述overlay端到端隧道经过所述第一POP和所述第二POP，所述第一站点edge通过所述第一POP接入所述广域网，所述 第二站点edge通过所述第二POP接入所述广域网。
基于第六方面，在可能的实现方式中，所述overlay端到端隧道为互联网协议第六版本IPv6的段路由SRv6隧道，所述第二报文包括IPv6头和分段路由头SRH，所述IPv6头的目的地址指向所述第一POP，所述SRH头包括所述第一信息和所述第二信息。
基于第六方面，在可能的实现方式中，所述第一信息为第一POP的第一端点段标识END.SID，所述第一端点段标识END.SID关联的操作包括：根据所述END.SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overly SRv6 Policy。
基于第六方面，在可能的实现方式中，所述overlay端到端隧道为分段路由多协议标签交换流量工程策略SR-MPLS TE Policy，所述第二报文包括MPLS标签栈，所述MPLS标签栈包括所述第一信息和所述第二信息。
基于第六方面，在可能的实现方式中，所述第一信息为所述第一POP的第一节点SID，所述第一节点SID关联的操作包括：根据所述标签栈中所述第一节点SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overly SR MPLS隧道。
基于第六方面，在可能的实现方式中，所述overlay端到端隧道为基于通用网络虚拟化封装GENEVE协议封装的隧道，所述第二报文采用SRv6 in GENEVE封装。
基于第六方面，在可能的实现方式中，所述overlay端到端隧道为基于通用路由封装GRE协议封装的隧道，所述第二报文采用SRv6 over GRE封装。
基于第六方面，在可能的实现方式中，
所述处理模块还用于，生成边界网关协议BGP路由，其中，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的所述VPN业务报文进行端到端安全保护；
发送模块，用于向所述第一站点edge通告所述BGP路由。
基于第六方面，在可能的实现方式中，所述BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
基于第六方面，在可能的实现方式中，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和/或所述第二站点edge的节点标识Node ID。
基于第六方面，在可能的实现方式中，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
基于第六方面，在可能的实现方式中，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
基于第六方面，在可能的实现方式中，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
基于第六方面，在可能的实现方式中，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
第六方面中的各个功能模块用于实现上述第二方面以及第二方面的任意一种可能的实现方式所述的方法。
第七方面，本申请提供了一种协商因特网协议安全协议安全联盟IPsec SA的装置，所述装置应用于广域网中的第一站点edge，所述装置包括：
接收模块，用于接收第二站点edge通告的边界网关协议BGP路由，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的业务报文进行端到端安全保护；
处理模块，用于根据所述路由类型RT和所述Export RT，将所述IPsec SA与所述VRF关联。
基于第七方面，在可能的实现方式中，所述BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
基于第七方面，在可能的实现方式中，所述第二站点edge的标识包括所述第二站点edge所属的站点 标识site ID和/或所述第二站点edge的节点标识Node ID。
基于第七方面，在可能的实现方式中，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
基于第七方面，在可能的实现方式中，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
基于第七方面，在可能的实现方式中，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
基于第七方面，在可能的实现方式中，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
第七方面中的各个功能模块用于实现上述第三方面以及第三方面的任意一种可能的实现方式所述的方法。
第八方面，本申请提供了一种协商因特网协议安全协议安全联盟IPsec SA的装置，所述装置应用于广域网中的第二站点edge，所述装置包括：
处理模块，用于生成边界网关协议BGP路由，其中，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的业务报文进行端到端安全保护；
发送模块，用于向第一站点edge通告所述BGP路由。
基于第八方面，在可能的实现方式中，所述BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
基于第八方面，在可能的实现方式中，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和所述第二站点edge的节点标识Node ID。
基于第八方面，在可能的实现方式中，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和/或所述第二站点edge的标识。
基于第八方面，在可能的实现方式中，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
基于第八方面，在可能的实现方式中，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
基于第八方面，在可能的实现方式中，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
第八方面中的各个功能模块用于实现上述第四方面以及第四方面的任意一种可能的实现方式所述的方法。
第九方面，本申请提供了一种网络设备，包括存储器和处理器，所述存储器用于存储指令，所述处理器用于执行所述存储器中存储的所述指令，以实现上述第一方面以及第一方面的任意一种可能的实现方式所述的方法，或者，以实现上述第二方面以及第二方面的任意一种可能的实现方式所述的方法，或者，以实现上述第三方面以及第三方面的任意一种可能的实现方式所述的方法，或者，以实现上述第四方面以及第四方面的任意一种可能的实现方式所述的方法。
第十方面，本申请提供了一种系统，包括第一站点出口设备edge和第二站点edge，所述第一站点edge用于执行上述第一方面以及第一方面的任意一种可能的实现方式所述的方法，所述第二站点edge用于执行上述第二方面以及第二方面的任意一种可能的实现方式所述的方法；或者，所述第一站点edge用于执行上述第三方面以及第三方面的任意一种可能的实现方式所述的方法，所述第二站点edge用于执行上述第四方面以及第四方面的任意一种可能的实现方式所述的方法。
第十一方面，本申请提供了一种计算机存储介质，其特征在于，包括程序指令，当所述程序指令在处理器上执行时，使得所述处理器实现上述第一方面以及第一方面的任意一种可能的实现方式所述的方法，或者，使得所述处理器实现上述第二方面以及第二方面的任意一种可能的实现方式所述的方法，或者，使得所述处理器实现上述第三方面以及第三方面的任意一种可能的实现方式所述的方法，或者，使得所述处理器实现上述第四方面以及第四方面的任意一种可能的实现方式所述的方法。
第十二方面，本申请提供了一种包括程序指令的计算机程序产品，当所述程序指令在处理器上执行时，使得所述处理器实现上述第一方面以及第一方面的任意一种可能的实现方式所述的方法，或者，使得所述 处理器实现上述第二方面以及第二方面的任意一种可能的实现方式所述的方法，或者，使得所述处理器实现上述第三方面以及第三方面的任意一种可能的实现方式所述的方法，或者，使得所述处理器实现上述第四方面以及第四方面的任意一种可能的实现方式所述的方法。
附图说明
图1为本申请提供的一种场景示意图；
图2为本申请提供的一种协商IPsec SA的方法的流程示意图；
图3为本申请提供的一种BGPSD-WAN路由报文的部分结构示意图；
图4为本申请提供的一种BGP EVPN路由报文的部分结构示意图；
图5为本申请提供的一种安全传输报文的方法的流程示意图；
图6A为本申请提供的一种VPN业务报文的结构示意图；
图6B为本申请提供的第一报文的结构示意图；
图6C为本申请提供的第二报文的结构示意图；
图7为本申请提供的一种第二报文的结构示意图；
图8为本申请提供的又一种第二报文的结构示意图；
图9为本申请提供的一种安全传输报文的方法的流程示意图；
图10为本申请提供的一种安全传输报文的装置的结构示意图；
图11为本申请提供的又一种安全传输报文的装置的结构示意图；
图12为本申请提供的一种网络设备的结构示意图。
具体实施方式
下面将结合本申请实施例中的附图，对本申请实施例中的技术方案进行清楚、完整地描述。
参见图1，图1为本申请提供的一种场景示意图。在图1所示的软件定义的广域网(software-defined wide-area network，SD-WAN)中，在underlay网络中入网点(point of presence，POP)之间建立SD-WAN隧道，客户终端设备(customer premises equipment，CPE)1与边缘入网点(edge point of presence，EPOP)1之间建立有隧道1，EPOP1与骨干入网点(backbone point of presence，BPOP)1之间建立有隧道2，BPOP1与BPOP2之间建立有隧道3，BPOP2与EPOP2之间建立有隧道4，EPOP2与CPE2之间建立有隧道5，其中，CPE1位于站点1，CPE2位于站点2。每一段隧道的入节点与出节点均基于TNP粒度进行了密钥协商。
在一种应用场景中，根据实际业务需求，业务流(业务报文)需要从CPE1至CPE2，即，业务报文需要跨越多个隧道从CPE1传输至CPE2。首先，CPE1节点按照隧道1上CPE1与EPOP1协商好的密钥对业务报文进行加密，当业务报文传输至EPOP1节点时，EPOP1节点再按照协商好的密钥对报文进行解密；当业务报文到达隧道2时，EPOP 1节点按照隧道2上EPOP1与BPOP1协商好的密钥对业务报文进行加密，当业务报文传输至BPOP1节点时，BPOP1节点再按照协商好的密钥对业务报文进行解密；…直至报文传输至隧道5，EPOP 2节点按照隧道5上EPOP2与CPE2协商好的密钥对业务报文进行加密，当业务报文传输至CPE2节点时，CPE2节点再按照协商好的密钥对业务报文进行解密，解析报文，获得数据。
对于这种需要跨越多段隧道进行传输的应用场景，需要经过多次加解密，操作繁琐，且消耗了网络设备的计算资源，增加了业务报文的转发延迟。
本申请提供了一种协商因特网协议安全协议(internet protocol security，简称IPsec)安全联盟(securityassociation，SA)的方法，所述方法应用于广域网。IPsec SA是一种安全协议，用于在IP网络上提供数据的机密性、完整性和身份验证。IPsec SA是在两个网络设备之间建立的一组安全参数，用于保护IP数据包的传输。它包括加密算法、身份验证协议、密钥长度、密钥管理和其他安全参数。在IPsec SA建立之前，两个设备必须协商安全参数，以确保它们使用相同的安全参数。一旦建立了IPsec SA，数据包将使用这些安全参数进行加密和身份验证，以确保数据的机密性和完整性。
参见图2所示，图2为本申请提供的一种协商IPsec SA的方法的流程示意图，所述方法包括但不限于以下内容的描述。
S101、广域网中的第二站点出口设备edge生成BGP路由，BGP路由包括路由类型RT、IPsec SA、第二站点edge的标识、以及导出路由目标ExportRT。
BGP路由中包括路由区分符(Route Distinguisher，RD)和导出路由目标(Export Route Target，简称Export RT)。路由区分符RD用于标识第二站点edge的虚拟路由转发(virtual routing forwarding，VRF)，导出路由目标Export RT用于进行第二站点edge的VRF匹配。
BGP路由中还包括第二站点edge的标识。在一种实现方式中，第二站点edge的标识包括第二站点edge所属的站点标识site ID和第二站点edge的节点标识Node ID，即，可以通过站点标识和节点标识来确定edge。在又一种实现方式中，广域网中的节点标识具有全局唯一性，这种情况下，第二站点edge的标识可以只包括节点标识，即，通过节点标识可以唯一确定edge。在又一种实现方式中，第二站点edge的标识可以是第二站点标识site ID，这种情况下，第一站点中的任意一个edge接收到第二站点中的任意一个edge通告的BGP路由，其中BGP路由中携带的包括第二站点的标识和IPsec SA，则表示第一站点与第二站点之间协商的秘钥为IPsec SA，后续第一站点中的任意一个edge与第二站点中的任意一个edge之间均可以通过协商的秘钥IPsec SA对业务报文进行安全保护和传输。
BGP路由中还包括路由类型(Route Type，RT)和IPsec SA，路由类型RT指示BGP路由通告的IPsec SA用于对与导出路由目标Export RT匹配的虚拟路由转发VRF中的业务报文进行端到端安全保护。比如，若与导出路由目标Export RT匹配的VRF是第一站点edge的VRF，则路由类型RT指示BGP路由通告的IPsec SA用于对第二站点edge与第一站点edge之间的业务报文进行端到端的安全保护。
可选的，BGP路由可以为BGPSD-WAN路由，该BGP路由的子地址族为SD-WAN子地址族，BGP路由也可以为BGP以太网虚拟专用网络(ethernet virtual private network，EVPN)路由，该BGP路由的子地址族为EVPN子地址族。BGP路由还可以是其他路由，其子地址族可以为其他子地址族，本申请不做限定。
BGP路由中包括网络层可达信息(network layer reachability information，NLRI)，其中，路由类型RT、路由区分符RD和第二站点edge的标识均位于NLRI中。例如，参见图3，图3为本申请提供的一种BGP SD-WAN路由的部分结构示意图，图3中，Route Type表示路由类型RT，其长度可以为2个字节，在SD-WAN子地址族中，可以定义路由类型为2，Route Distinguisher表示路由区分符RD，其长度可以为8个字节，使用SD-WAN-Color来表示站点标识，长度可以为4个字节，使用SD-WAN-Node-ID来表示节点标识，长度可以为4个字节或16个字节。又例如，参见图4，图4为本申请提供的一种BGP EVPN路由的部分结构示意图，图4中，各个字段与图3示意图中的各个字段含义均相同，所不同的是，在EVPN子地址族中，定义路由类型RT为10。需要说明的是，这里定义路由类型RT为2仅仅是SD-WAN子地址族中的一个示例，在SD-WAN地址族中还可以使用其他数值来表示新增的路由类型，定义路由类型RT为10仅仅是EVPN子地址族的一种举例，在EVPN地址族中还可以使用其他数值来表示新增的路由类型，本申请不做具体限定。
BGP路由中还包括类型长度值(type-length-value，简称TLV)，具体的，BGP路由中包括隧道封装属性(Tunnel Encapsulation Attribute，TEA)TLV，其中，TEA TLV中包括IPsec SA，即IPsec SA携带在了BGP路由的TEA TLV字段中，具体的，IPsec SA携带在了TEA TLV的子TLV中。BGP路由中还包括扩展团体属性TLV，扩展团体属性TLV中包括导出路由目标Export RT，即Export RT携带在了BGP路由的扩展团体属性TLV字段中。需要说明的是，这里IPsec SA和Export RT的位置是一种举例，IPsec SA和Export RT还可以携带在BGP路由的其他TLV字段中，本申请不做具体限定。
例如，在图1所示的广域网场景示意图中，第二站点edge可以是CPE1或者CPE2。
S102、第二站点edge向第一站点edge通告BGP路由。
第二站点edge在广域网中通告BGP路由。例如，在图1所示的广域网中，假设第二站点edge为CPE1，CPE1生成BGP路由后，可以通过区域路由反射器(route reflector，RR)将BGP路由反射至EPOP1，EPOP1通过管理服务提供商(managed service provider，MSP)RR将BGP路由反射至BPOP1、BPOP2和EPOP2，EPOP2再通过区域RR将BGP路由反射至CPE2，从而实现BGP路由的通告。
广域网中的第一站点edge接收到第二站点edge通告的BGP路由。例如，图1中，若第二站点edge为CPE1，则第一站点edge可以为CPE2；若第二站点edge为CPE2，则第一站点edge可以为CPE1。
S103、根据路由类型RT和Export RT，第一站点edge将IPsec SA与VRF关联。
第一站点edge接收到第二站点edge通告的BGP路由，根据BGP路由中的路由类型RT和导出路由目标Export RT，将IPsec SA与VRF关联。具体的，Export RT用于进行第二站点edge的VRF匹配，路由类型RT指示BGP路由通告的IPsec SA是用于对与Export RT匹配的VRF中的业务报文进行端到端的安全保护，因此，第一站点edge接收到BGP路由后，先确定自身站点的VRF与Export RT是否匹配，在匹配 的情况下，第一站点edge将IPsec SA与第一站点edge的VRF关联，因为IPsec SA与第二站点edge也是关联的，因此可以理解为，第一站点edge的VRF、第二站点edge的VRF均是与IPsec SA关联的，在不匹配的情况下，第一站点edge与IPsec SA不进行关联。
在一种实现方式中，可以设置匹配策略如下。广域网中的各个edge中可以设置有导入路由目标和导出路由目标Export RT，其中，导入路由目标是存储在edge本地的，导出路由目标是携带在BGP路由中的。第二站点edge发送的BGP路由中携带的是导出路由目标，第一站点edge接收到第二站点发送的BGP路由后，将BGP路由中的导出路由目标与第一站点edge本地存储的导入路由目标做比较，若两者一致，则第一站点edge的VRF与BGP路由中的Export RT相匹配，则第一站点edge将BGP路由中的IPsec SA与第一站点edge的VRF进行关联。若两者不一致，则第一站点edge的VRF与BGP路由中的Export RT不匹配，IPsec SA与第一站点edge的VRF不进行关联。例如，第二站点edge发送的BGP路由中携带的Export RT为100，第一站点edge本地的导入路由目标为100，第一站点edge接收到BGP路由后，将Export RT与本地的导入路由目标作比较，经比较，两者一致，则第一站点edge将BGP路由中携带的IPsec SA与第一站点edge的VRF进行关联。关于匹配策略这里仅仅是其中一种可能的实现方式，匹配策略还可以是其他实现方式，本申请不做限定。
本申请所述方法可以应用于广域网，比如可以应用于软件定义的广域网SD-WAN，第一站点edge和第二站点edge可以为SD-WAN中的站点edge。本申请所述方法还可以应用于其他广域网，本申请不做限定。
实际应用中，第一站点edge和第二站点edge可以根据实际业务需求和业务流来确定，第一站点edge的导入路由目标和导出路由目标、以及第二站点edge的导入路由目标和导出路由目标均可以按照实际业务需求来设置。
可以理解，经过BGP路由的通告，第一站点edge的VRF、第二站点edge的VRF均与IPsec SA进行了关联，即，第一站点edge与第二站点edge之间协商好了传输业务报文所使用的IPsec SA，则后续第一站点edge与第二站点edge之间传输业务报文时，可以基于协商好的IPsec SA来对业务报文进行安全保护，通过虚拟路由转发VRF来传输VPN业务报文，从而实现第一站点edge与第二站点edge之间端到端的隧道传输，只需一次安全保护和一次解封装处理即可，降低传输延时。
可以看到，本申请提供了一种协商IPsec SA的方法，在BGP路由中新增一种路由类型，并在BGP路由中携带IPsec SA和导出路由目标，新增的路由类型用于指示BGP路由通告的IPsec SA用于对与导出目标路由匹配的VRF中的业务报文进行端到端的安全保护，新增的路由类型实现了基于VRF粒度的IPsec SA协商。通过BGP路由的通告，使得第一站点edge与第二站点edge之间协商好了一种IPsec SA方法，以便后续第一站点edge与第二站点edge之间传输业务报文时，可以基于协商好的IPsec SA方法对业务报文进行安全保护，并通过虚拟路由转发VRF的方式传输VPN业务报文。
在上述提供的协商IPsec SA方法的基础上，本申请还提供了一种安全传输报文的方法。参见图5，图5为本申请提供的一种安全传输报文的方法的流程示意图，所述方法应用于广域网，所述方法包括但不限于以下内容的描述。
S201、广域网中的第一站点出口设备edge接收虚拟路由转发VRF中的虚拟专用网络VPN业务报文。
广域网中的第一站点出口设备edge接收到VRF中的VPN业务报文，其中，VPN业务报文可以是由控制器下发至第一站点edge的，也可以是由广域网中的其他网络设备发送至第一站点edge的。
在图1所示的场景示意图中，第一站点edge可以是CPE1或者CPE2。
S202、第一站点edge根据与第二站点edge协商的与VRF关联的因特网协议安全协议安全联盟IPsecSA对VPN业务报文进行安全保护，得到第一报文。
通过BGP路由通告，第一站点edge与第二站点edge之间协商好了IPsecSA，且第一站点edge的VRF、第二站点edge的VRF均与IPsecSA进行了关联，IPsecSA用于对第一站点edge的VRF与第二站点edge的VRF之间的业务报文进行端到端保护。基于此，第一站点edge接收到VRF中的VPN业务报文之后，第一站点edge根据与第二站点edge协商好的与VRF关联的IPsecSA对VPN业务报文进行安全保护，获得第一报文。
在一种实现方式中，对VPN业务报文进行安全保护包括对VPN业务报文进行封装安全载荷(encapsulate security payload，ESP)协议加密。在一种实现方式中，对VPN业务报文进行安全保护包括对VPN业务报文封装认证头(Authentication Header，AH)。在一种实现方式中，对VPN业务报文进行安 全保护包括对VPN业务报文进行ESP协议加密和对VPN业务报文封装认证头AH。对VPN业务报文进行安全保护还可以通过其他方式实现，本申请不做限定。
S203、第一站点edge在第一报文外部封装在第一站点edge到第二站点edge之间建立的上层overlay端到端隧道的隧道信息，获得第二报文。
第一站点edge在第一报文外部封装由第一站点edge到第二站点edge之间建立的上层overlay端到端隧道的隧道信息，获得第二报文。其中，第一站点edge到第二站点edge之间的overlay端到端隧道对应的底层underlay隧道包括多段隧道。例如，图1所示的场景示意图中，若第一站点edge为CPE1，第二站点edge为CPE2，则第一站点edge到第二站点edge之间的overlay端到端隧道对应的底层underlay隧道包括隧道1(CPE1至EPOP1)、隧道2(EPOP1至BPOP1)、隧道3(BPOP1至BPOP2)、隧道4(BPOP2至EPOP2)和隧道5(EPOP2至CPE2)。
overlay端到端隧道上包括至少一个入网点POP，隧道信息中包括至少一个入网点的信息。在一种示例中，overlay端到端隧道上包括一个入网点POP，为了便于描述，称为第一入网点POP，其中，第一站点edge为overlay端到端隧道的入端点，第二站点edge为overlay端到端隧道的出端点，overlay端到端隧道经过第一入网点POP，第一入网点POP可以为EPOP，也可以为BPOP，本申请不做限定。overlay端到端隧道的隧道信息中包括第一入网点的第一信息。
在又一种示例中，overlay端到端隧道上包括多个入网点POP，多个入网点POP包括第一入网点POP和第二入网点POP，其中，第一站点edge为overlay端到端隧道的入端点，第二站点edge为overlay端到端隧道的出端点，第一站点edge通过第一POP接入广域网，第二站点edge通过第二POP接入广域网。例如，在图1所示的场景示意图中，若第一站点edge为CPE1，第二站点edge为CPE2，则第一站点edge到第二站点edge之间的overlay端到端隧道上包括多个入网点，第一站点edge通过EPOP1接入广域网，第二站点edge通过EPOP2接入广域网，则EPOP1为第一POP，EPOP2为第二POP。overlay端到端隧道的隧道信息中包括第一入网点的第一信息和第二入网点的第二信息。
在一种实现方式中，overlay端到端隧道为互联网协议第六版本(internet protocol version 6，IPv6)的段路由SRv6隧道，则第一站点edge在第一报文外部封装SRv6隧道的隧道信息，获得第二报文。第二报文中包括IPv6头和分段路由头(segment routing header，SRH)，在overlay端到端隧道包括第一入网点和第二入网点的情况下，IPv6头的目的地址指向第一入网点，SRH中包括第一信息和第二信息。
例如，参见图6A至图6C所示，图6A至图6C为本申请提供的一种示例图。图6A表示的是VPN业务报文，包括报文头Inner IP Hdr和负荷Inner Payload。图6B表示的是第一报文，第一报文是对VPN业务报文进行ESP协议加密后获得的。图6C表示的是第二报文，第二报文是在第一报文外部封装第一站点edge到第二站点edge之间的SRv6隧道的隧道信息后获得的，其中，IPv6 Hdr(Src IP，Dst IP)表示IPv6报文头，SRH(…,vpnsid)表示分段路由头SRH，IPv6报文头和SRH组成为部分为overlay端到端隧道的隧道信息。
又例如，在图1所示的场景示意图中，假设CPE1为第一站点edge，CPE2为第二站点edge，CPE1至CPE2之间的overlay端到端隧道为SRv6隧道，则CPE1在第一报文外部封装CPE1至CPE2之间的SRv6隧道的隧道信息，获得第二报文。如图7所示，图7为本申请提供的一种示意图。在CPE1处时，第二报文中，IPv6 Hdr(cpe1，epop1-sid)为IPv6报文头，SRH(vpnsid，epop2-sid,bpop2-sid,bpop1-sid,epop1-sid,)为分段路由头SRH，其中，epop1-sid表示CPE1的第一端点段标识END.SID，bpop1-sid表示BPOP1的第一端点段标识END.SID，bpop2-sid表示BPOP2的第一端点段标识END.SID，epop2-sid表示EPOP2的第一端点段标识END.SID，vpnsid是在BGP路由通告时由CPE2生成的，vpnsid与CPE2的VRF是关联的。其中，EPOP1为第一入网点POP，EPOP1的第一端点段标识epop1-sid为第一入网点POP的第一信息，EPOP2为第二入网点POP，EPOP2的第一端点段标识epop2-sid为第二入网点POP的第二信息，EPOP1的第一端点段标识epop1-sid关联的操作包括：根据epop1-sid的下一跳SID匹配从第一POP到第二POP之间的上层overly SRv6策略Policy。从图7所示出的各个POP点处的报文可以看出段标识END.SID关联的操作。
上层overlay网络是在底层underlay网络的基础上建立的，第二报文通过overlay端到端隧道进行传输时，实际是在底层underlay网络上进行传输的，只是上层overlay网络不感知报文在底层underlay网络是怎样传输的。因此，需要在第二报文的外层再封装上underlay隧道的隧道信息，封装了underlay隧道的隧道信息的报文通过overlay端到端隧道进行传输(实际封装了underlay隧道的隧道信息的报文是在底层underlay隧道上传输的。)例如，在图1所示的场景中，由于广域网为SD-WAN广域网，报文在进行传输时，需要穿越运营商网络，运营商网络中的设备无法识别上层overly IPv6地址，因此，在外层又封装了一 层底层underlay隧道的报文头underlay IP。
在一种实现方式中，overlay端到端隧道为分段路由多协议标签交换流量工程(segment routing multi-protocol label switching traffic engine，SR-MPLS TE)策略Policy，则第二报文中包括MPLS标签栈，MPLS标签栈包括第一POP的第一信息和第二POP的第二信息。其中，第一信息为第一POP的第一节点SID，第一节点SID关联的操作包括：根据标签栈中第一节点SID的下一跳SID匹配从第一POP到第二POP之间的上层overlay SR MPLS隧道。
例如，在图1所示的场景示意图中，假设CPE1为第一站点edge，CPE2为第二站点edge，CPE1至CPE2之间的overlay端到端隧道为SR-MPLS TE Policy，则CPE1在第一报文外部封装CPE1至CPE2之间的SR-MPLS TE Policy信息，获得第二报文。参见图8所示，图8为本申请提供的一种示意图。在CPE1处时，第二报文中，(epop1-sid，bpop1-sid，bpop2-sid,epop2-sid,cpe2-sid)表示overlay端到端隧道的隧道信息，也即MPLS标签栈，其中，epop1-sid表示EPOP1的第一节点SID，bpop1-sid表示BPOP1的第一节点SID，bpop2-sid表示BPOP2的第一节点SID，epop2-sid表示EPOP2的第一节点SID，cpe2-sid表示CPE2的第一节点SID。EPOP1为第一入网点POP，EPOP1的第一节点段标识epop1-sid为第一入网点POP的第一信息，EPOP2为第二入网点POP，EPOP2的第一节点段标识epop2-sid为第二入网点POP的第二信息。第一节点SID关联的操作包括：根据标签栈中第一节点SID的下一跳SID匹配从第一POP到第二POP之间的上层overly SR MPLS隧道，从图8所示出的各个POP点处的报文可以看出节点段标识SID所关联的操作。图8报文中的underlay IP为underlay隧道的隧道信息。
在又一种实现方式中，overlay端到端隧道为SRv6隧道，则第二报文可以基于通用网络虚拟化封装(generic network virtualization encapsulation，GENEVE)协议进行隧道封装，则第二报文采用SRv6 in GENEVE封装。示例性的，第二报文包括：外层IP头、用户数据报协议(user datagram protocol，UDP)头、GENEVE封装、SRH、ESP和净荷，其中，所述净荷包括前述VPN业务报文；所述GENEVE封装中包括所述VPN业务报文所承载的VPN业务的VPN标识。在一个示例中，所述SRH和ESP之间还可以包括metadata字段，用于承载业务意图信息。当然，第二报文也可以采用SRv6 over GENEVE封装，SRv6 over GENEVE封装相对于SRv6 in GENEVE封装而言，区别在于在GENEVE封装和SRH之间还包括IPv6头，SRv6 over GENEVE封装相对于SRv6 in GENEVE封装的封装开销大，但是SRv6 over GENEVE封装符合SRv6的标准封装格式。
在又一种实现方式中，overlay端到端隧道为基于通用路由封装(generic routing encapsulation，GRE)协议封装的隧道，则第二报文采用SRv6 over GRE封装。在一个示例中，所述第二报文包括：外层IP头、UDP头、外层GRE封装、IPv6头、SRH、内层GRE封装、ESP和净荷，其中，所述净荷包括前述VPN业务报文；所述内层GRE封装中包括所述VPN业务报文所承载的VPN业务的VPN标识。VPN标识携带在内层GRE封装中，第二报文在网络中传输时，overlay端到端隧道所经过的中间节点不解析所述VPN标识(VPN identifier，VNI)，即中间节点不感知VPN。在一个示例中，所述SRH和内层GRE封装之间还可以包括metadata字段，用于承载业务意图信息。
本申请实施例中的业务意图信息，可以包括指示业务意图的一种或者多种信息。在一个示例中，所述业务意图信息可以包括服务质量参数，所述服务质量参数包括但不限于时延、丢包、抖动、带宽利用率以及误码率等其中一个或者多个参数。在又一个示例中，所述业务意图参数可以包括由站点edge1到达站点edge2的端到端路径所需满足的网关约束信息，网关约束信息包括但不限于需要经过的网关和/或需要绕行的网关。
S204、第一站点edge通过overlay端到端隧道向第二站点edge发送第二报文。
第一站点edge通过overlay端到端隧道向第二站点edge发送第二报文。在可能的实现方式中，第一站点edge通过SRv6隧道或者SR-MPLS TE Policy，向第二站点edge发送第二报文。
需要说明的是，第一站点edge与第二站点edge之间的各个入网点POP不感知第二报文，不对第二报文进行解密，只按照overlay端到端隧道的隧道信息进行转发，直至第二报文到达第二站点edge。因此，业务报文在传输过程中，只需在第一站点edge处进行一次安全保护，其他各个入网点pop无需进行解密，降低了计算资源的消耗，提高了转发效率，降低了传输延时。
本实施例提供的安全传输报文的方法可以应用于SD-WAN中，第一站点edge和第二站点edge为SD-WAN中的站点edge，所述方法也可以应用于其他广域网中，本申请不做限定。
本申请方案在BGP路由中新增了一种路由类型RT，BGP路由中携带了IPsec SA和导出路由目标ExportRT，新增的路由类型RT用于指示BGP路由通告的IPsec SA用于对于ExportRT匹配的VRF中的业 务报文进行端到端的安全保护。通过将BGP路由在广域网中进行通告，实现了两个站点edge之间基于VRF粒度的端到端的IPsec SA协商，以便后续采用协商好的IPsec SA进行VPN业务报文的传输，为VPN业务报文的传输奠定了基础。相对于现有基于TNP粒度的IPsec SA协商而言，第一站点edge与第二站点edge之间的各个入网点POP不感知内层VPN业务报文，通过两个站点edges之间的端到端一次加解密，降低了计算资源的消耗，提高了转发效率，降低了传输延时。
在上述协商IPsecSA方法与安全传输报文的方法的基础上，本申请还提供了一种安全传输报文的方法。参见图9，图9为本申请提供的一种安全传输报文的方法的流程示意图，所述方法包括但不限于以下内容的描述。
S301、广域网中的第二站点edge接收第一站点edge通过在第一站点edge和第二站点edge之间建立的上层overlay端到端隧道发送的第二报文，第二报文中包括第一报文以及在第一报文外层封装的overlay端到端隧道的隧道信息。
本实施例提供中，安全传输报文的方法可以应用于SD-WAN中，第一站点edge和第二站点edge为SD-WAN中的站点edge，所述方法也可以应用于其他广域网中，本申请不做限定。
第二站点出口设备edge接收第一站点edge通过在第一站点edge和第二站点edge之间建立的上层overlay端到端隧道发送的第二报文。其中，第一站点edge和第二站点edge之间建立的上层overlay端到端隧道对应的底层underlay隧道包括多段隧道。例如，参见图1所示的场景示意图，第一站点edge可以是CPE1，第二站点edge可以是CPE2；或者，第一站点edge可以是CPE2，第二站点edge可以是CPE1。CPE1与CPE2之间建立的overlay端到端隧道对应的底层underlay隧道包括多段隧道，具体包括：隧道1(CPE1至EPOP1)、隧道2(EPOP1至BPOP1)、隧道3(BPOP1至BPOP2)、隧道4(BPOP2至EPOP2)和隧道5(EPOP2至CPE2)。
overlay端到端隧道上包括至少一个入网点POP，隧道信息中包括至少一个入网点的信息。在一种示例中，overlay端到端隧道上包括一个第一入网点POP，则隧道信息中包括第一入网点的第一信息。在又一种示例中，overlay端到端隧道上包括多个入网点POP，多个入网点POP包括第一入网点POP和第二入网点POP，则隧道信息中包括第一入网点的第一信息和第二入网点的第二信息。其中，第一站点edge为overlay端到端隧道的入端点，第二站点edge为overlay端到端隧道的出端点，第一站点edge通过第一POP接入广域网，第二站点edge通过第二POP接入广域网。
在一种实现方式中，overlay端到端隧道为SRv6隧道，第二站点edge接收第一站点edge通过SRv6隧道发送的第二报文，第二报文中包括第一报文以及在第一报文外层封装的SRv6隧道的隧道信息。其中，第一报文为通过第二站点edge与第一站点edge协商好的IPsecSA对VPN业务报文进行安全保护所得到的报文，SRv6隧道的隧道信息包括IPv6头和分段路由头SRH，IPv6头的目的地址指向第一POP，SRH头包括第一信息和第二信息。关于业务报文、第一报文以及第二报文的格式，可以参考图6A至图6C所示的示意图，为了说明书的简洁，在此不再赘述。
在一种实现方式中，overlay端到端隧道为SR-MPLS TE Policy，第二报文中包括第一报文以及在第一报文外层封装的SR-MPLS TE Policy信息。其中，SR-MPLS TE Policy信息包括MPLS标签栈，MPLS标签栈包括第一POP的第一信息和第二POP的第二信息。关于第二报文的格式，可以参见上述方法实施例的描述，为了说明书的简洁，在此不再赘述。
在可能的实现方式中，第二报文中还可以包括底层underlay隧道的报文头。例如，上述图1所示的SD-WAN场景中，由于报文在进行传输时需要穿越运营商网络，运营商网络中的设备无法识别上层overly IPv6地址，因此，在外层又封装了一层底层underlay隧道的报文头underlay IP。
S302、第二站点edge对第二报文进行解封装，获得第一报文。
第二站点edge对第二报文进行解封装，获得第一报文。在一种实现方式中，overlay端到端隧道为SRv6隧道，第二报文中包括第一报文和SRv6隧道的隧道信息，则第二站点edge对第二报文进行解封装，去掉了SRv6隧道的隧道信息，获得第一报文。第一报文格式的示意图如图6B所示，这里不再赘述。
在一种实现方式中，overlay端到端隧道为SR-MPLS TE Policy，第二报文中包括第一报文以及在第一报文外层封装的SR-MPLS TE Policy信息，则第二站点edge对第二报文进行解封装，去掉了MPLS SR-TE隧道的隧道信息，获得第一报文。第一报文格式的示意图如图6B所示，这里不再赘述。
在一种实现方式中，overlay端到端隧道为GENEVE协议封装的隧道，第二报文采用SRv6 in GENEVE封装，则第二站点edge对第二报文进行解封装，去掉了SRv6 in GENEVE封装的报文头，获得第一报文。 第一报文格式的示意图如图6B所示，这里不再赘述。
在又一种实现方式中，overlay端到端隧道为基于GRE协议封装的隧道，第二报文采用SRv6 over GRE封装，则第二站点edge对第二报文进行解封装，去掉了SRv6over GRE封装的报文头，获得第一报文。第一报文格式的示意图如图6B所示，这里不再赘述。
S303、第二站点edge根据IPsecSA对第一报文进行处理，以获得虚拟专用网络VPN业务报文。
在一种实现方式中，第二站点edge根据IPsecSA对第一报文进行ESP协议处理，获得VPN业务报文。在一种实现方式中，第二站点edge根据IPsecSA和第一报文的认证头AH中携带的认证数据对第一报文进行认证，获得VPN业务报文。在一种实现方式中，第二站点edge根据IPsecSA对第一报文进行ESP协议解密，以及根据IPsecSA和第一报文的认证头AH中携带的认证数据对第一报文进行认证，获得VPN业务报文。
需要说明的是，可以是第一站点edge生成BGP路由，将BGP路由通告知第二站点edge，也可以是第二站点edge生成BGP路由，将BGP路由通告至第一站点edge，两种方式都可以实现将第一站点edge的VRF、第二站点edge的VRF均与IPsec SA关联。对于两种方式中的任意一种方式实现第一站点edge的VRF、第二站点edge的VRF与IPsec SA关联后，第一站点edge可以对VPN业务报文基于协商好的IPsec SA进行安全保护和封装，然后发送至第二站点edge，由第二站点edge根据协商好的IPsec SA进行解封装和解密，获得VPN业务报文。
可以看到，本申请提供了一种安全传输报文的方法，通过BGP路由通告，使得第一站点edge与第二站点edge之间协商好了IPsec SA，并将IPsec SA与第一站点edge的VRF、第二站点edge的VRF进行了关联。在进行跨越多个隧道场景的VPN业务报文传输时，只需在第一站点edge处根据协商好的IPsec SA对VPN业务报文进行安全保护，得到第一报文，然后在第一报文外部封装上第一站点edge与第二站点edge之间建立的overlay端到端隧道的隧道信息，获得第二报文，将第二报文通过overlay端到端隧道发送至第二站点edge。
在整个跨越多个underlay隧道传输的场景中，只需在第一站点edge处进行一次IPsec SA安全保护，在第二站点edge处进行一次IPsec SA处理，中间经过的各个入网点无需对报文进行加密或解密，只需按照隧道信息转发即可。因此，实施本申请实施例，降低了网络节点的计算资源的消耗，提高了转发效率，降低了传输延时。
上述为本申请提供的方法实施例的描述，下面为本申请实施例提供的与方法实施例对应的装置实施例。
参见图10，图10为本申请提供实施例的一种安全传输报文的装置600的结构示意图，安全传输报文的装置600可以配置为广域网中的第一站点edge，所述装置600包括：
接收模块610，用于接收虚拟路由转发VRF中的虚拟专用网络VPN业务报文；
处理模块620，用于根据与第二站点edge协商的与VRF关联的因特网协议安全协议安全联盟IPsecSA对VPN业务报文进行安全保护，以得到第一报文；
处理模块620，还用于在第一报文外层封装在第一站点edge到第二站点edge之间建立的上层overlay端到端隧道的隧道信息，以获得第二报文，其中，overlay端到端隧道对应的底层underlay隧道包括多段隧道，隧道信息包括第一入网点POP的第一信息，第一站点edge为overlay端到端隧道的入端点，第二站点edge为overlay端到端隧道的出端点，overlay端到端隧道经过第一POP；
发送模块630，用于通过overlay端到端隧道，向第二站点edge发送第二报文。
在可能的实现方式中，处理模块620用于：对VPN业务报文进行封装安全载荷ESP协议加密；和/或，对VPN业务报文封装认证头Authentication Header。
在可能的实现方式中，隧道信息还包括第二POP的第二信息，overlay端到端隧道经过第一POP和第二POP，第一站点edge通过第一POP接入广域网，第二站点edge通过第二POP接入广域网。
在可能的实现方式中，overlay端到端隧道为互联网协议第六版本IPv6的段路由SRv6隧道，第二报文包括IPv6头和分段路由头SRH，IPv6头的目的地址指向第一POP，SRH包括第一信息和第二信息。
在可能的实现方式中，第一信息为第一POP的第一端点段标识END.SID，第一端点段标识END.SID关联的操作包括：根据END.SID的下一跳SID匹配从第一POP到第二POP之间的上层overlay SRv6 Policy。
在可能的实现方式中，overlay端到端隧道为SR-MPLS TE Policy，第二报文包括MPLS标签栈，MPLS标签栈包括第一信息和第二信息。
在可能的实现方式中，第一信息为第一POP的第一节点SID，第一节点SID关联的操作包括：根据标 签栈中第一节点SID的下一跳SID匹配从第一POP到第二POP之间的上层overlay SR MPLS隧道。
在可能的实现方式中，overlay端到端隧道为基于通用网络虚拟化封装GENEVE协议封装的隧道，第二报文采用SRv6 in GENEVE封装。
在可能的实现方式中，overlay端到端隧道为基于通用路由封装GRE协议封装的隧道，第二报文采用SRv6 over GRE封装。
在可能的实现方式中，接收模块610还用于，接收第二站点edge通告的边界网关协议BGP路由，BGP路由包括路由类型RT、IPsec SA、第二站点edge的标识、以及导出路由目标ExportRT，其中，路由类型RT指示BGP路由通告的IPsec SA用于对与Export RT匹配的虚拟路由转发VRF中的VPN业务报文进行端到端安全保护；处理模块620，用于根据路由类型RT和Export RT，将IPsec SA与VRF关联。
在可能的实现方式中，BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
在可能的实现方式中，第二站点edge的标识包括第二站点edge所属的站点标识site ID和/或第二站点edge的节点标识Node ID。
在可能的实现方式中，BGP路由包括网络层可达信息NLRI，NLRI包括路由类型RT和第二站点edge的标识。
在可能的实现方式中，BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，Tunnel Encapsulation Attribute TLV包括IPsec SA。
在可能的实现方式中，BGP路由包括扩展团体属性，扩展团体属性用于携带Export RT。
在可能的实现方式中，第一站点edge和第二站点edge为软件定义的广域网SD-WAN中站点edge。
安全传输报文的装置600可以用于实现图5对应的方法实施例，即数据转发面发送侧对应的方法实施例，还可以用于实现图2方法实施例中第一站点edge所执行的方法步骤，即控制面接收侧对应的方法实施例，具体可参考图2或图5中方法实施例具体内容的描述，为了说明书的简洁，在此不再赘述。当安全传输报文的装置600用于实现控制面接收侧对应的方法实施例时，安全传输报文的装置600又可称为协商IPsec SA的装置。
可以理解，图10中各个功能模块的划分及各个功能模块对应执行的步骤仅仅是一种示例，在其他实施例中，装置600还可以根据具体执行步骤划分为更多或更少的功能模块。
参见图11，图11为本申请实施例提供的又一种安全传输报文的装置700的结构示意图，安全传输报文的装置700可以配置为广域网中的第二站点edge，所述装置700包括：
接收模块710，用于接收第一站点edge通过在第一站点edge和第二站点edge之间建立的上层overlay端到端隧道发送的第二报文，第二报文中包括第一报文以及在第一报文外层封装的overlay端到端隧道的隧道信息，overlay端到端隧道对应的底层underlay隧道包括多段隧道，隧道信息包括第一入网点POP的第一信息，第一站点edge为overlay端到端隧道的入端点，第二站点edge为overlay端到端隧道的出端点，overlay端到端隧道经过第一POP，第一报文为通过第二站点edge与第一站点edge协商的因特网协议安全协议安全联盟IPsec SA对虚拟专用网络VPN业务报文进行安全保护所得到的报文；
处理模块720，用于对第二报文进行解封装，获得第一报文；
处理模块720，用于根据IPsecSA对第一报文进行处理，以获得VPN业务报文。
在可能的实现方式中，处理模块720用于：根据IPsecSA，对第一报文进行封装安全载荷ESP协议解密；和/或，根据IPsec SA和第一报文的认证头Authentication Header中携带的认证数据对第一报文进行认证。
在可能的实现方式中，隧道信息还包括第二POP的第二信息，overlay端到端隧道经过第一POP和第二POP，第一站点edge通过第一POP接入广域网，第二站点edge通过第二POP接入广域网。
在可能的实现方式中，overlay端到端隧道为互联网协议第六版本IPv6的段路由SRv6隧道，第二报文包括IPv6头和分段路由头SRH，IPv6头的目的地址指向第一POP，SRH头包括第一信息和第二信息。
在可能的实现方式中，第一信息为第一POP的第一端点段标识END.SID，第一端点段标识END.SID关联的操作包括：根据END.SID的下一跳SID匹配从第一POP到第二POP之间的上层overlay SRv6 Policy。
在可能的实现方式中，overlay端到端隧道为分段路由多协议标签交换流量工程策略SR-MPLS TE Policy，第二报文包括MPLS标签栈，MPLS标签栈包括第一信息和第二信息。
在可能的实现方式中，第一信息为第一POP的第一节点SID，第一节点SID关联的操作包括：根据标签栈中第一节点SID的下一跳SID匹配从第一POP到第二POP之间的上层overlay SR MPLS隧道。
在可能的实现方式中，overlay端到端隧道为基于通用网络虚拟化封装GENEVE协议封装的隧道，第二报文采用SRv6 in GENEVE封装。
在可能的实现方式中，overlay端到端隧道为基于通用路由封装GRE协议封装的隧道，第二报文采用SRv6 over GRE封装。
在可能的实现方式中，
处理模块720，用于生成边界网关协议BGP路由，其中，BGP路由包括路由类型RT、IPsec SA、第二站点edge的标识、以及导出路由目标ExportRT，其中，路由类型RT指示BGP路由通告的IPsec SA用于对与Export RT匹配的虚拟路由转发VRF中的VPN业务报文进行端到端安全保护；
发送模块730，用于第二站点edge向第一站点edge通告BGP路由。
在可能的实现方式中，BGP路由为BGP软件定义的广域网SD-WAN路由，该BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，BGP路由为BGP以太网虚拟专用网络EVPN路由，该BGP EVPN路由的子地址族为EVPN子地址族。
在可能的实现方式中，第二站点edge的标识包括第二站点edge所属的站点标识site ID和/或第二站点edge的节点标识Node ID。
在可能的实现方式中，BGP路由包括网络层可达信息NLRI，NLRI包括路由类型RT和第二站点edge的标识。
在可能的实现方式中，BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，Tunnel Encapsulation Attribute TLV包括IPsec SA。
在可能的实现方式中，BGP路由包括扩展团体属性，扩展团体属性用于携带Export RT。
在可能的实现方式中，第一站点edge和第二站点edge为软件定义的广域网SD-WAN中站点edge。
安全传输报文的装置700可以用于实现图9对应的方法实施例，即数据转发面接收侧对应的方法实施例，还可以用于实现图2对应的方法实施例中第二站点edge所执行的方法步骤，即控制面发送侧对应的方法实施例。具体可参考图2或图9中方法实施例具体内容的描述，为了说明书的简洁，在此不再赘述。当安全传输报文的装置700用于实现控制面发送侧对应的方法实施例时，安全传输报文的装置700又可称为协商IPsec SA的装置。
可以理解，图11中各个功能模块的划分及各个功能模块对应执行的步骤仅仅是一种示例，在其他实施例中，装置700还可以根据具体执行步骤划分为更多或更少的功能模块。
参见图12，图12为本申请提供的一种网络设备800的结构示意图，该网络设备800可以配置为广域网中的第一站点edge，也可以配置为广域网中的第二站点edge。网络设备800可以由一般性的总线体系结构来实现。
网络设备800包括至少一个处理器801、存储器803以及至少一个通信接口804。
处理器801可以是一个通用CPU、NP、微处理器，或者也可以是一个或多个用于实现本申请方案的集成电路。例如，专用集成电路(application-specific integrated circuit，ASIC)、可编程逻辑器件(programmable logic device，PLD)或其组合。其中，PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)、现场可编程逻辑门阵列(field-programmable gate array，FPGA)、通用阵列逻辑(generic array logic，GAL)或其任意组合。
网络设备800还可以包括通信总线802，用于在各个组件之间传送信息。通信总线802可以分为地址总线、数据总线、控制总线等。为便于表示，图12中仅用一条粗线表示，但并不表示仅有一根总线或一种类型的总线。
存储器803可以是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其它类型的静态存储设备，也可以是随机存取存储器(random access memory，RAM)或者可存储信息和指令的其它类型的动态存储设备，也可以是电可擦可编程只读存储器(electrically erasable programmable read-only Memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其它光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其它磁存储设备，也可以是能够用于携带或存储具有指令或数据结构形式的程序代码且能够由计算机存取的任何其它介质，但不限于此。存储器803可以是独立存在，并通过通信总线802与处理器801相连接；存储器803也可以和处理器801 集成在一起。
通信接口804用于与其它设备或通信网络进行通信。通信接口804可以包括有线通信接口，还可以包括无线通信接口。其中，有线通信接口例如可以为以太网接口，以太网接口可以是光接口、电接口或其组合。无线通信接口可以为无线局域网(wireless local area networks，WLAN)接口、蜂窝网络通信接口或其组合等。
在具体实现中，作为一种实施例，处理器801可以包括一个或多个CPU，例如，图12中所示的CPU0和CPU1。
在具体实现中，作为一种实施例，网络设备800可以包括多个处理器，如图12中所示的处理器801和处理器805。这些处理器中的每一个可以是一个单核处理器(single-CPU)，也可以是一个多核处理器(multi-CPU)。这里的处理器可以指一个或多个设备、电路、和/或用于处理数据(如计算机程序指令)的处理核。
在一些实施例中，存储器803用于存储本申请方案的程序代码810，处理器801用于执行存储器803中存储的程序代码810。也即是，网络设备800可以通过处理器801以及存储器803中的程序代码810，来实现图2或图5或图9方法实施例提供的方法。
本申请实施例的网络设备800可对应于上述各个方法实施例中的第一站点edge或第二站点edge，并且，该网络设备800中的处理器801、通信接口804等可以实现上述各个方法实施例中的设备所具有的功能和/或所实施的各种步骤和方法。为了简洁，在此不再赘述。
当网络设备800配置为第一站点edge时，对应于上述安全传输报文的装置600，则安全传输报文的装置600中的接收模块610、发送模块630可以位于网络设备800中的通信接口804中；处理模块620可以位于网络设备800中的处理器801或处理器805中。
当网络设备800配置为第二站点edge时，对应于上述安全传输报文的装置700，则安全传输报文的装置700中的接收模块710、发送模块730可以位于网络设备800中的通信接口804中；处理模块720可以位于网络设备800中的处理器801或处理器805中。
网络设备800中的各硬件、模块和上述其他操作和/或功能分别为了实现安全传输报文的装置600或安全传输报文的装置700所实施的各种步骤和方法，关于网络设备800如何实现报文处理等详细流程，具体细节可参见上述方法实施例，为了说明书的简洁，在此不再赘述。
其中，上文图2或图5或图9的各步骤通过网络设备800的处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法和步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块(软件单元)组合执行完成。软件模块可以位于随机存储器、闪存只读存储器、可编程只读存储器、电可擦写可编程存储器和寄存器等本领域成熟的一种或多种存储介质中。存储介质位于存储器中，处理器读取存储器中的信息，结合硬件执行上述方法中的步骤。为了说明书的简洁，这里不再详细描述。
本申请实施例还提供了一种系统，所述系统包括第一站点edge和第二站点edge，第一站点edge可以为上述的安全报文传输的装置600或网络设备800，第二站点edge可以为上述的安全报文传输的装置700或网络设备800，第一站点edge可用于实现上述图2或图5所述的方法实施例，第二站点edge可用于实现上述图2或图9所述的方法实施例，具体可参考上述图2或图5或图9方法实施例的描述，在此不再赘述。
本申请实施例还提供了一种计算机存储介质，包括程序指令，当所述程序指令在处理器上执行时，使得所述处理器实现上述图2或图5或图9所述的方法实施例中的各个步骤。
本申请实施例还提供了一种包括程序指令的计算机程序产品，当所述程序指令在处理器上执行时，使得所述处理器实现上述图2或图5或图9所述的方法实施例中的各个步骤。
本领域普通技术人员可以意识到，结合本文中所公开的实施例中描述的各方法步骤和单元，能够以电子硬件、计算机软件或者二者的结合来实现，为了清楚地说明硬件和软件的可互换性，在上述说明中已经按照功能一般性地描述了各实施例的步骤及组成。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。本领域普通技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为了描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参见前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以 上所描述的装置实施例仅仅是示意性的，例如，该单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另外，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口、装置或单元的间接耦合或通信连接，也可以是电的，机械的或其它的形式连接。
该作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本申请实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以是两个或两个以上单元集成在一个单元中。上述集成的单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。
该集成的单元如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分，或者该技术方案的全部或部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例中方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(read-only memory，ROM)、随机存取存储器(random access memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。该计算机程序产品包括一个或多个计算机程序指令。在计算机上加载和执行该计算机程序指令时，全部或部分地产生按照本申请实施例中的流程或功能。该计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。该计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，该计算机程序指令可以从一个网站站点、计算机、服务器或数据中心通过有线或无线方式向另一个网站站点、计算机、服务器或数据中心进行传输。该计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。该可用介质可以是磁性介质(例如软盘、硬盘、磁带)、光介质(例如，数字视频光盘(digital video disc，DVD)、或者半导体介质(例如固态硬盘)等。
以上描述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到各种等效的修改或替换，这些修改或替换都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以权利要求的保护范围为准。

Claims (54)

  1. 一种安全传输报文的方法，其特征在于，所述方法包括：
    广域网中的第一站点出口设备edge接收虚拟路由转发VRF中的虚拟专用网络VPN业务报文；
    所述第一站点edge根据与第二站点edge协商的与所述VRF关联的因特网协议安全协议安全联盟IPsecSA对所述VPN业务报文进行安全保护，以得到第一报文；
    所述第一站点edge在所述第一报文外层封装所述第一站点edge与所述第二站点edge之间建立的上层overlay端到端隧道的隧道信息，以获得第二报文，其中，所述overlay端到端隧道对应的底层underlay隧道包括多段隧道，所述隧道信息包括第一入网点POP的第一信息，所述第一站点edge为所述overlay端到端隧道的入端点，所述第二站点edge为所述overlay端到端隧道的出端点，所述overlay端到端隧道经过所述第一POP；
    所述第一站点edge通过所述overlay端到端隧道，向所述第二站点edge发送所述第二报文。
  2. 根据权利要求1所述的方法，其特征在于，所述对所述VPN业务报文进行安全保护包括：
    对所述VPN业务报文进行封装安全载荷ESP协议加密；和/或，
    对所述VPN业务报文封装认证头Authentication Header。
  3. 根据权利要求1或2所述的方法，其特征在于，所述隧道信息还包括第二POP的第二信息，所述overlay端到端隧道经过所述第一POP和所述第二POP，所述第一站点edge通过所述第一POP接入所述广域网，所述第二站点edge通过所述第二POP接入所述广域网。
  4. 根据权利要求3所述的方法，其特征在于，所述overlay端到端隧道为互联网协议第六版本IPv6的段路由SRv6隧道，所述第二报文包括IPv6头和分段路由头SRH，所述IPv6头的目的地址指向所述第一POP，所述SRH包括所述第一信息和所述第二信息。
  5. 根据权利要求4所述的方法，其特征在于，所述第一信息为所述第一POP的第一端点段标识END.SID，所述第一端点段标识END.SID关联的操作包括：根据所述END.SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overlay SRv6 Policy。
  6. 根据权利要求3所述的方法，其特征在于，所述overlay端到端隧道为分段路由多协议标签交换流量工程策略SR-MPLS TE Policy，所述第二报文包括MPLS标签栈，所述MPLS标签栈包括所述第一信息和所述第二信息。
  7. 根据权利要求6所述的方法，其特征在于，所述第一信息为所述第一POP的第一节点SID，所述第一节点SID关联的操作包括：
    根据所述标签栈中所述第一节点SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overlay SR MPLS隧道。
  8. 根据权利要求3所述的方法，其特征在于，所述overlay端到端隧道为基于通用网络虚拟化封装GENEVE协议封装的隧道，所述第二报文采用SRv6 in GENEVE封装。
  9. 根据权利要求3所述的方法，其特征在于，所述overlay端到端隧道为基于通用路由封装GRE协议封装的隧道，所述第二报文采用SRv6 over GRE封装。
  10. 根据权利要求1至9任一项所述的方法，其特征在于，在所述第一站点edge接收所述业务报文之前，所述方法还包括：
    所述第一站点edge接收所述第二站点edge通告的边界网关协议BGP路由，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的所述虚拟路由转发VRF中的所述VPN业务报文进行端到端安全保护；
    根据所述路由类型RT和所述Export RT，所述第一站点edge将所述IPsec SA与所述VRF关联。
  11. 根据权利要求10所述的方法，其特征在于，所述BGP路由为BGP软件定义的广域网SD-WAN路由，所述BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，所述BGP EVPN路由的子地址族为EVPN子地址族。
  12. 根据权利要求10或11所述的方法，其特征在于，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和所述第二站点edge的节点标识Node ID。
  13. 根据权利要求10-12任一项所述的方法，其特征在于，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
  14. 根据权利要求10-13任一项所述的方法，其特征在于，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
  15. 根据权利要求10至14任一项所述的方法，其特征在于，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
  16. 根据权利要求10-15任一项所述的方法，其特征在于，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
  17. 一种安全传输报文的方法，其特征在于，所述方法包括：
    广域网中的第二站点出口设备edge接收第一站点edge通过在所述第一站点edge和所述第二站点edge之间建立的上层overlay端到端隧道发送的第二报文，所述第二报文中包括第一报文以及在所述第一报文外层封装的所述overlay端到端隧道的隧道信息，所述overlay端到端隧道对应的底层underlay隧道包括多段隧道，所述隧道信息包括第一入网点POP的第一信息，所述第一站点edge为所述overlay端到端隧道的入端点，所述第二站点edge为所述overlay端到端隧道的出端点，所述overlay端到端隧道经过所述第一POP，所述第一报文为通过所述第二站点edge与所述第一站点edge协商的因特网协议安全协议安全联盟IPsec SA对虚拟专用网络VPN业务报文进行安全保护所得到的报文；所述第二站点edge对所述第二报文进行解封装，获得第一报文；
    所述第二站点edge根据所述IPsecSA对所述第一报文进行处理，以获得所述VPN业务报文。
  18. 根据权利要求17所述的方法，其特征在于，所述对所述第一报文进行处理包括：
    根据所述IPsecSA，对所述第一报文进行封装安全载荷ESP协议解密；和/或，
    根据所述IPsec SA和所述第一报文的认证头Authentication Header中携带的认证数据对所述第一报文进行认证。
  19. 根据权利要求17或18所述的方法，其特征在于，所述隧道信息还包括第二POP的第二信息，所述overlay端到端隧道经过所述第一POP和所述第二POP，所述第一站点edge通过所述第一POP接入所述广域网，所述第二站点edge通过所述第二POP接入所述广域网。
  20. 根据权利要求19所述的方法，其特征在于，所述overlay端到端隧道为互联网协议第六版本IPv6的段路由SRv6隧道，所述第二报文包括IPv6头和分段路由头SRH，所述IPv6头的目的地址指向所述第一POP，所述SRH头包括所述第一信息和所述第二信息。
  21. 根据权利要求20所述的方法，其特征在于，所述第一信息为第一POP的第一端点段标识END.SID，所述第一端点段标识END.SID关联的操作包括：根据所述END.SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overlay SRv6 Policy。
  22. 根据权利要求19所述的方法，其特征在于，所述overlay端到端隧道为分段路由多协议标签交换流量工程策略SR-MPLS TE Policy，所述第二报文包括MPLS标签栈，所述MPLS标签栈包括所述第一信息和所述第二信息。
  23. 根据权利要求22所述的方法，其特征在于，所述第一信息为所述第一POP的第一节点SID，所述第一节点SID关联的操作包括：
    根据所述标签栈中所述第一节点SID的下一跳SID匹配从所述第一POP到所述第二POP之间的上层overlay SR MPLS隧道。
  24. 根据权利要求19所述的方法，其特征在于，所述overlay端到端隧道为基于通用网络虚拟化封装GENEVE协议封装的隧道，所述第二报文采用SRv6 in GENEVE封装。
  25. 根据权利要求19所述的方法，其特征在于，所述overlay端到端隧道为基于通用路由封装GRE协议封装的隧道，所述第二报文采用SRv6 over GRE封装。
  26. 根据权利要求17至25任一项所述的方法，其特征在于，在所述广域网中的第二站点出口设备edge接收第一站点edge通过上层overlay端到端隧道发送的第二报文之前，所述方法还包括：
    所述第二站点出口设备edge生成边界网关协议BGP路由，其中，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的所述VPN业务报文进行端到端安全保护；
    所述第二站点edge向所述第一站点edge通告所述BGP路由。
  27. 根据权利要求26所述的方法，其特征在于，所述BGP路由为BGP软件定义的广域网SD-WAN路 由，所述BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，所述BGP EVPN路由的子地址族为EVPN子地址族。
  28. 根据权利要求26或27所述的方法，其特征在于，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和所述第二站点edge的节点标识Node ID。
  29. 根据权利要求26至28任一项所述的方法，其特征在于，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
  30. 根据权利要求26至29任一项所述的方法，其特征在于，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
  31. 根据权利要求26至30任一项所述的方法，其特征在于，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
  32. 根据权利要求26至31任一项所述的方法，其特征在于，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
  33. 一种协商因特网协议安全协议安全联盟IPsec SA的方法，其特征在于，所述方法包括：
    广域网中的第一站点出口设备edge接收第二站点edge通告的边界网关协议BGP路由，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的业务报文进行端到端安全保护；
    根据所述路由类型RT和所述Export RT，所述第一站点edge将所述IPsec SA与所述VRF关联。
  34. 根据权利要求33所述的方法，其特征在于，所述BGP路由为BGP软件定义的广域网SD-WAN路由，所述BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，所述BGP EVPN路由的子地址族为EVPN子地址族。
  35. 根据权利要求33或34所述的方法，其特征在于，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和所述第二站点edge的节点标识Node ID。
  36. 根据权利要求33至35任一项所述的方法，其特征在于，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
  37. 根据权利要求33至36任一项所述的方法，其特征在于，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
  38. 根据权利要求33至37任一项所述的方法，其特征在于，所述BGP路由包括扩展团体属性，所述扩展团体属性用于携带所述Export RT。
  39. 根据权利要求33至38任一项所述的方法，其特征在于，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
  40. 一种协商因特网协议安全协议安全联盟IPsec SA的方法，其特征在于，所述方法包括：
    广域网中的第二站点出口设备edge生成边界网关协议BGP路由，其中，所述BGP路由包括路由类型RT、所述IPsec SA、所述第二站点edge的标识、以及导出路由目标ExportRT，其中，所述路由类型RT指示所述BGP路由通告的所述IPsec SA用于对与所述Export RT匹配的虚拟路由转发VRF中的业务报文进行端到端安全保护；
    所述第二站点edge向第一站点edge通告所述BGP路由。
  41. 根据权利要求40所述的方法，其特征在于，所述BGP路由为BGP软件定义的广域网SD-WAN路由，所述BGPSD-WAN路由的子地址族为SD-WAN子地址族，或者，所述BGP路由为BGP以太网虚拟专用网络EVPN路由，所述BGP EVPN路由的子地址族为EVPN子地址族。
  42. 根据权利要求40或41所述的方法，其特征在于，所述第二站点edge的标识包括所述第二站点edge所属的站点标识site ID和所述第二站点edge的节点标识Node ID。
  43. 根据权利要求40至42任一项所述的方法，其特征在于，所述BGP路由包括网络层可达信息NLRI，所述NLRI包括所述路由类型RT和所述第二站点edge的标识。
  44. 根据权利要求40至43任一项所述的方法，其特征在于，所述BGP路由包括隧道封装属性类型长度值Tunnel Encapsulation Attribute TLV，所述Tunnel Encapsulation Attribute TLV包括所述IPsec SA。
  45. 根据权利要求40至44任一项所述的方法，其特征在于，所述BGP路由包括扩展团体属性，所述 扩展团体属性用于携带所述Export RT。
  46. 根据权利要求40至45任一项所述的方法，其特征在于，所述第一站点edge和所述第二站点edge为软件定义的广域网SD-WAN中站点edge。
  47. 一种安全传输报文的装置，其特征在于，所述装置包括用于实现如权利要求1-16任一项所述方法的模块。
  48. 一种安全传输报文的装置，其特征在于，所述装置包括用于实现如权利要求17-32任一项所述方法的模块。
  49. 一种协商因特网协议安全协议安全联盟IPsec SA的装置，其特征在于，所述装置包括用于实现如权利要求33-39任一项所述方法的模块。
  50. 一种协商因特网协议安全协议安全联盟IPsec SA的装置，其特征在于，所述装置包括用于实现如权利要求40-46任一项所述方法的模块。
  51. 一种网络设备，其特征在于，包括存储器和处理器，所述存储器用于存储指令，所述处理器用于执行所述存储器中存储的所述指令，以实现如权利要求1至16任一项所述的方法，或者，以实现如权利要求17至32任一项所述的方法，或者，以实现如权利要求33至39任一项所述的方法，或者，以实现如权利要求40至46任一项所述的方法。
  52. 一种系统，其特征在于，包括第一站点出口设备edge和第二站点edge，所述第一站点edge用于执行如权利要求1至16任一项所述的方法，所述第二站点edge用于执行如权利要求17至32任一项所述的方法；或者，所述第一站点edge用于执行如权利要求33至39任一项所述的方法，所述第二站点edge用于执行如权利要求40至46任一项所述的方法。
  53. 一种计算机存储介质，其特征在于，包括程序指令，当所述程序指令在处理器上执行时，使得所述处理器实现如权利要求1至16任一项所述的方法，或者，使得所述处理器实现如权利要求17至32任一项所述的方法，或者，使得所述处理器实现如权利要求33至39任一项所述的方法，或者，使得所述处理器实现如权利要求40至46任一项所述的方法。
  54. 一种包括程序指令的计算机程序产品，其特征在于，当所述程序指令在处理器上执行时，使得所述处理器实现如权利要求1至16任一项所述的方法，或者，使得所述处理器实现如权利要求17至32任一项所述的方法，或者，使得所述处理器实现如权利要求33至39任一项所述的方法，或者，使得所述处理器实现如权利要求40至46任一项所述的方法。
PCT/CN2024/091039 2023-06-30 2024-04-30 安全传输报文的方法及相关装置 Ceased WO2025001496A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP24830144.2A EP4708784A4 (en) 2023-06-30 2024-04-30 SECURE PACKET TRANSMISSION METHOD, AND ASSOCIATED DEVICE

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202310803215.6 2023-06-30
CN202310803215.6A CN119232523B (zh) 2023-06-30 2023-06-30 安全传输报文的方法及相关装置

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US19/435,608 Continuation US20260135888A1 (en) 2023-06-30 2025-12-29 Secure packet transmission method and related apparatus

Publications (1)

Publication Number Publication Date
WO2025001496A1 true WO2025001496A1 (zh) 2025-01-02

Family

ID=93937177

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/091039 Ceased WO2025001496A1 (zh) 2023-06-30 2024-04-30 安全传输报文的方法及相关装置

Country Status (3)

Country Link
EP (1) EP4708784A4 (zh)
CN (1) CN119232523B (zh)
WO (1) WO2025001496A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120074898A (zh) * 2025-02-17 2025-05-30 新华三技术有限公司 通信方法及装置

Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110023090A1 (en) * 2009-07-22 2011-01-27 Cisco Technology, Inc Integrating service insertion architecture and virtual private network
CN113472622A (zh) * 2020-03-30 2021-10-01 华为技术有限公司 一种网络中传输业务的方法和设备
CN114338116A (zh) * 2021-12-21 2022-04-12 迈普通信技术股份有限公司 加密传输方法、装置及sd-wan网络系统

Family Cites Families (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1323522C (zh) * 2003-01-22 2007-06-27 华为技术有限公司 一种确定客户边缘路由器与虚拟专用网络间关系的方法
US7643488B2 (en) * 2006-09-29 2010-01-05 Nortel Networks Limited Method and apparatus for supporting multiple customer provisioned IPSec VPNs
US20090106449A1 (en) * 2007-10-19 2009-04-23 Michael Satterlee Method and apparatus for providing dynamic route advertisement
CN108574589B (zh) * 2017-03-10 2021-09-14 华为技术有限公司 一种互联网协议安全性隧道的维护方法、装置及系统
CN113261248B (zh) * 2018-10-19 2022-09-16 华为技术有限公司 安全sd-wan端口信息分发
CN115606154A (zh) * 2020-05-15 2023-01-13 华为技术有限公司（Cn） 边界网关协议(BGP)控制的软件定义广域网(SD-WAN)中的互联网协议安全(IPsec)简化

Patent Citations (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20110023090A1 (en) * 2009-07-22 2011-01-27 Cisco Technology, Inc Integrating service insertion architecture and virtual private network
CN113472622A (zh) * 2020-03-30 2021-10-01 华为技术有限公司 一种网络中传输业务的方法和设备
CN114338116A (zh) * 2021-12-21 2022-04-12 迈普通信技术股份有限公司 加密传输方法、装置及sd-wan网络系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4708784A4

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN120074898A (zh) * 2025-02-17 2025-05-30 新华三技术有限公司 通信方法及装置

Also Published As

Publication number Publication date
CN119232523A (zh) 2024-12-31
EP4708784A4 (en) 2026-05-06
CN119232523B (zh) 2025-12-02
EP4708784A1 (en) 2026-03-11

Similar Documents

Publication Publication Date Title
EP4145790B1 (en) Method and device for verifying srv6 packet
US9992310B2 (en) Multi-hop Wan MACsec over IP
EP3771170B1 (en) Method for sending message, method for receiving message, and network device
CN102882789A (zh) 一种数据报文处理方法、系统及设备
US20240114013A1 (en) Packet processing method, client end device, server end device, and computer-readable medium
WO2021196987A1 (zh) 一种网络中传输业务的方法和设备
US20250350669A1 (en) Parameter advertisement method and apparatus, device, and system
CN119232523B (zh) 安全传输报文的方法及相关装置
CN111614538A (zh) 一种基于IPsec封装协议的报文转发方法
CN113300998A (zh) 实现数据加密传输的方法及装置、通信系统
US20250193296A1 (en) QUIC Packet Transmission Method and Related Device
EP4436109B1 (en) Key distribution over ip/udp
US20260135888A1 (en) Secure packet transmission method and related apparatus
CN116980150A (zh) 一种报文传输方法以及相关设备
US20250211576A1 (en) End-to-end mac-security path setup in level 3 virtual private networks
WO2025201100A1 (zh) 一种报文传输方法以及相关装置
EP4175227B1 (en) Security for communication protocols
US20260058906A1 (en) Multi-segments sd-wan via cloud dcs transit nodes
US20260081849A1 (en) Sd-wan traffic engineering
CN121418118A (zh) 一种检测方法、装置、设备及存储介质
CN117640555A (zh) Quic报文的传输方法及相关设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24830144

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 2024830144

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2024830144

Country of ref document: EP

Effective date: 20251204

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2024830144

Country of ref document: EP

Effective date: 20251204

WWP Wipo information: published in national office

Ref document number: 2024830144

Country of ref document: EP