CN118803062A - Message processing method, device, node, storage medium and computer program product - Google Patents

Abstract

The present application discloses a message processing method, device, node, storage medium and computer program product. The method includes: a first node receives a first message, the first message includes a first application response network identifier, and the first node includes a boundary node of the first network; when the first information indicates that the first interface of the first node can use the application response network, the first interface performs forwarding-related processing associated with the application response network on the first message, or when the first information indicates that the first interface of the first node disables the application response network, the first interface performs forwarding-related processing not associated with the application response network on the first message.

Description

Message processing method, device, node, storage medium and computer program product

Technical Field

The present application relates to the field of network transmission, and in particular to a message processing method, device, node, storage medium and computer program product.

Background Art

Application Responsive Networking (ARN) is a new technology for collaboration between applications and networks. By carrying the ARN identifier (also known as the ARN tag) in the application message, the application can call the network path corresponding to the ARN identifier; accordingly, after receiving the message, the network edge device can identify the ARN identifier carried in the message and forward the message according to the network path corresponding to the ARN identifier.

However, there is currently no effective solution for how to forward messages carrying ARN identifiers between network domains with different trustworthiness.

Summary of the invention

To solve related technical problems, the embodiments of the present application provide a message processing method, device, node, storage medium and computer program product.

The technical solution of the embodiment of the present application is implemented as follows:

The present application provides a message processing method, including:

The first node receives a first message, where the first message includes a first ARN identifier, and the first node includes a border node of a first network;

When the first information indicates that the first interface of the first node can use the ARN, the first node performs forwarding-related processing associated with the ARN on the first message at the first interface; or, when the first information indicates that the first interface of the first node disables the ARN, the first node performs forwarding-related processing not associated with the ARN on the first interface.

In the above scheme, the first message also includes second information, and the second information represents the source of the first message; when the first information represents that the first interface of the first node can use ARN, the first node verifies the second information and the first ARN identifier; after the verification is successful, the first message is subjected to forwarding-related processing associated with the ARN at the first interface.

In the above scheme, the first message also includes second information, and the second information represents the source of the first message; when the first information represents that the first interface of the first node can use ARN, the first node verifies the second information and the first ARN identifier; after the verification fails, the first message is forwarded at the first interface without being associated with the ARN.

In the above solution, the verifying the second information and the first ARN identifier includes:

The first node verifies the second information and the first ARN identifier by using the third information, where the third information represents the correspondence between the source information of one or more messages and the ARN identifier.

In the above scheme, the method further includes:

The first node receives the third information sent by the control device;

or,

The first node determines the third information through routing learning.

In the above solution, the second information includes one or more of the following:

user information of the first message;

source address information of the first message;

The port information of the first message.

In the above solution, the performing forwarding-related processing associated with the ARN on the first message includes one of the following:

The first node sets the first field carrying the first ARN identifier in the first message to the second ARN identifier, obtains a processed first message, the second ARN identifier is associated with the second network, and forwards the processed first message to the second network;

The first node sets the first field carrying the first ARN identifier in the first message to a third ARN identifier, obtains a processed first message, the third ARN identifier is associated with the first network, and forwards the processed first message in the first network according to a first manner, the first manner is associated with the third ARN identifier;

The first node forwards the first message to the second network, where the second network can forward the message in a second manner, where the second manner is associated with a second ARN identifier corresponding to the first message;

The first node forwards the first message in the first network according to a third manner, where the third manner is associated with the first ARN identifier.

In the above scheme, the first node uses the fourth information to set the first field carrying the first ARN identifier in the first message to the second ARN identifier, or sets the first field carrying the first ARN identifier in the first message to the third ARN identifier, and the fourth information represents the correspondence between one or more ARN identifiers associated with the first network and the ARN identifier associated with the second network.

In the above scheme, the method further includes:

The first node receives the fourth information sent by the control device;

or,

The first node determines the fourth information through routing learning.

In the above solution, the performing forwarding-related processing on the first message that is not associated with the ARN includes one of the following:

The first node sets the first field carrying the first ARN identifier in the first message to fifth information, obtains a processed first message, and forwards the processed first message in a fourth manner within the first network, where the fourth manner is not associated with the ARN, and the fifth information indicates that the first message disables the ARN;

The first node sets the first field carrying the first ARN identifier in the first message as fifth information, obtains a processed first message, and forwards the processed first message to the second network, wherein the fifth information indicates that the first message disables the ARN;

The first node discards the first message.

The embodiment of the present application further provides a message processing device, which is arranged at a first node, wherein the first node includes a border node of a first network, including:

A receiving unit, configured to receive a first message, wherein the first message includes a first ARN identifier;

A processing unit is used to perform forwarding related processing associated with the ARN on the first message at the first interface when the first information indicates that the first interface of the first node can use the ARN, or to perform forwarding related processing not associated with the ARN on the first interface when the first information indicates that the first interface of the first node disables the ARN.

The embodiment of the present application further provides a node, characterized in that the node includes a border node of a first network, including:

A communication interface, configured to receive a first message, wherein the first message includes a first ARN identifier;

A processor is used to perform forwarding-related processing associated with the ARN on the first message at the first interface when the first information indicates that the first interface of the node can use the ARN, or to perform forwarding-related processing not associated with the ARN on the first interface when the first information indicates that the first interface of the node disables the ARN.

The embodiment of the present application further provides a node, comprising: a processor and a memory for storing a computer program that can be run on the processor,

Wherein, the processor is used to execute the steps of any of the above methods when running the computer program.

An embodiment of the present application further provides a storage medium having a computer program stored thereon, wherein the computer program implements the steps of any of the above methods when executed by a processor.

An embodiment of the present application also provides a computer program product, including a computer program, which implements the steps of any of the above methods when executed by a processor.

The message processing method, device, node, storage medium and computer program product provided in the embodiments of the present application, the first node receives a first message, the first message includes a first ARN identifier, and the first node includes a border node of a first network; when the first information represents that the first interface of the first node can use the ARN, the first interface performs forwarding-related processing associated with the ARN on the first message, or when the first information represents that the first interface of the first node disables the ARN, the first interface performs forwarding-related processing not associated with the ARN on the first message. The solution provided by the embodiment of the present application sets the first information in the first node at the first network boundary (which can also be understood as the network domain boundary of the first network) so that when the first node receives the first message transmitted across network domains (such as entering the first network or leaving the first network), it can determine whether to perform forwarding-related processing associated with the ARN on the first message based on the first information. In this way, when the first node receives the first message from a network with a different credibility from the first network, or when the first node forwards the first message to a network with a different credibility from the first network, it can be achieved by setting whether the interface related to the forwarding of the first message in the first node can use the ARN to forward the message carrying the ARN identifier between network domains with different credibility.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a schematic diagram of the structure of an Application-Aware Internet Protocol version 6 Networking (APN6) message header;

FIG2 is a schematic diagram of a network architecture using APN6 technology;

FIG3 is a schematic diagram of another network architecture using the APN6 technology;

FIG4 is a schematic diagram of the structure of a message header for configuring an ARN ID;

FIG5 is a flow chart of a message processing method according to an embodiment of the present application;

FIG6 is a schematic diagram of a network architecture using ARN technology in an application example of the present application;

FIG7 is a flow chart of an ARN ID access control method according to an example of the present application;

FIG8 is a schematic diagram of the structure of a message processing device according to an embodiment of the present application;

FIG9 is a schematic diagram of the first node structure of an embodiment of the present application.

DETAILED DESCRIPTION

The present application will be further described in detail below through the accompanying drawings and embodiments.

In related technologies, networks usually use a best-effort forwarding mode to forward messages (also known as providing forwarding services). However, with the increase in the types of services carried by the Internet, the best-effort forwarding mode has been unable to meet the diverse forwarding service requirements corresponding to different applications (APPs in English), becoming a major pain point in network development.

In order to meet the diverse needs of forwarding services, technologies such as IPv6 Segment Routing IPv6 (SRv6), Generalized SRv6 (G-SRv6) and network slicing have been developed. However, the above technologies fail to solve the problem of how to map different applications to corresponding network paths, that is, they fail to solve the problem of how to forward the messages of different applications according to the corresponding network paths. Here, the network path corresponding to the application can also be understood as a network path or tunnel path that meets the service level agreement (SLA) requirements of the application. The network path can specifically include a network tunnel and/or network slices.

In the related art, Multi-Protocol Label Switching (MPLS) technology enables the network to specify the forwarding network path according to the message characteristics of different applications (such as congestion or quality of service (QoS) requirements, etc.). However, MPLS technology can only be applied to a limited trusted domain (also called MPLS domain) (can also be understood as running in a limited domain). At this time, the nodes located at the boundary of the MPLS domain (such as routers, etc.) will discard all messages entering the MPLS domain from outside the MPLS domain. Therefore, the network within the MPLS domain (can also be understood as the network located inside the MPLS domain) is not visible to the outside (can also be understood as being regarded as a black box to the outside). In other words, MPLS technology can only realize the network's perception of messages of different applications (can also be understood as the network's ability to perceive applications), but cannot realize the application's ability to call the network (can also be understood as application-aware network capabilities or application-aware capabilities).

In actual application, if the application cannot call the network capability, it will be difficult to adjust the priority of message forwarding on demand and reasonably allocate network resources. For example, in the data express service, after the network receives the data message of the application, when the network can perceive the application, but the application cannot call the network capability, the network can only perceive the transmission protocols corresponding to different applications, and cannot further identify the different priority requirements of applications with the same transmission protocol. In this case, the network may forward the messages of applications with high priority requirements at a lower priority according to the order of receipt (similar to ordinary file transfer). When the network can perceive the application and the application can call the network capability, applications of different priorities can call different network paths for message forwarding, thereby adjusting the priority of message forwarding on demand and reasonably allocating network resources.

In related technologies, in order to enable applications to call network capabilities, the network needs to open network capabilities to the outside world. Usually, network capabilities can be opened through the northbound interface of the controller (which can also be understood as a network controller or control device). At this time, the application needs to call the controller to call the network capabilities. However, direct calls to the controller by the application may affect network security. Based on the security mechanism requirements of the operator network, it is usually difficult to widely apply the above solution.

In the related technology, in the IPv6+ technology system of SRv6, APN6 technology is defined, and APN6 technology can be used for collaborative applications and network capabilities. In APN6 technology, a method for carrying application information in IPv6 messages is defined; specifically, an APN6 header can be added to the IPv6 message, and the application information can be carried in the APN6 header. As shown in Figure 1, the added APN6 header can specifically include an APN identifier (such as APN ID, which can specifically include an application-class ID (APP-Group-ID), a user-group ID (USER-Group-ID), a reserved (Reserved) field, etc.), an intent (Intent), an APN parameter (APN-Para) and other information. The APN6 header can be used to indicate the application (or application group (which can also be understood as the class to which the application belongs)) information corresponding to the message, the user (or user group) information using the application (or application group), the key flows in the application (such as action instructions in cloud games, etc.) and related parameters of SLA requirements or network performance requirements (such as bandwidth, latency, jitter, packet loss rate, etc.), etc. The above information can also be collectively referred to as APN6 application information or APN6 information. In actual application, multiple applications can be grouped based on grouping rules to obtain multiple application groups. Here, the grouping rules of the application group can be specifically set based on the five-tuple information contained in the IPv6 message, the QinQ information corresponding to the IPv6 message, etc.

In actual application, as shown in Figure 2, in a network that uses APN6 technology, the application on the end-side device (such as a terminal, etc.) or the cloud-side device (such as a server, etc.) (the end-side device and the cloud-side device can also be collectively referred to as a user device) generates an IPv6 message and sends the IPv6 message to the network. At this time, the end-side device or the cloud-side device can set the APN6 application information corresponding to the application in the APN6 header of the IPv6 message (it can also be understood as filling in the APN6 application information or encapsulating the application feature information); after the network receives the IPv6 message, it can identify the APN6 application information contained in the IPv6 message, thereby perceiving the application corresponding to the APN6 application information, and the network can then map the IPv6 message to the network path corresponding to the perceived application for forwarding (it can also be understood as forwarding the IPv6 message according to the network path corresponding to the perceived application). In this way, the application can call the network capability corresponding to the APN6 application information by filling in the APN6 application information in the message, and the network can also identify the corresponding application based on the APN6 application information carried in the message. At the same time, applications can call network capabilities without directly calling the controller, which can meet the operator's requirements for network security.

In actual application, as shown in FIG3 , the network architecture using the APN6 technology may specifically include:

1) Devices on the end side and cloud side: such as terminals and servers. Devices on the end side or cloud side can perceive the characteristic information of the application through the application perception program. Then, the perceived characteristic information is used as APN6 application information to generate an IPv6 message containing an APN6 header, and the generated IPv6 message is sent to the APN6 network domain (such as the SRv6 network domain using the APN6 technology).

2) Network edge devices: such as nodes at the border of the APN6 network domain (also understood as the edge). When the end-side device and the cloud-side device do not have application awareness capabilities (that is, they cannot perceive the APN6 application information of the application), the end-side device and the cloud-side device cannot generate an IPv6 message containing an APN6 header. At this time, the end-side device and the cloud-side device can send the IPv6 message that does not contain the APN6 header to the network edge device. After receiving the IPv6 message, the network edge device can parse the application feature information from the five-tuple information and service information contained in the IPv6 message (such as the mapping relationship of the dual virtual local area network (VLAN) tags (that is, the mapping relationship between the user VLAN (C-VLAN, Customer VLAN) and the service provider VLAN (S-VLAN, Service ProviderVLAN))), and use the parsed application feature information as the APN6 application information to generate an IPv6 message containing the APN6 header, and then forward the generated IPv6 message to the network policy execution device;

3) Network policy execution device: For example, the nodes included in the network path (also called the network service path) that provides message forwarding services in the SRv6 network, which may include:

Head node (also known as the head node of the perception application): the starting node of the network path. The head node is used to maintain the matching relationship between the message flow in the inbound direction (i.e., the direction entering the APN6 network domain) and the network path. After the head node receives the IPv6 message from the network edge device, the head node can determine the network policy corresponding to the IPv6 message according to the APN6 application information carried in the IPv6 message and the correspondence between the APN ID and the network policy (i.e., the routing policy for network forwarding service, which can also be called network service policy or routing policy), and select a network path for the IPv6 message according to the network policy (which can also be understood as matching the network path corresponding to the APN6 application information (i.e., the network path that meets the network performance requirements corresponding to the APN6 application information)), and forward the IPv6 message to the intermediate node corresponding to the matched network path (which can also be understood as introducing it to the path that meets the requirements); at the same time, the head node can also encapsulate the APN6 application information into the outer (also understood as the outer layer) IPv6 extension header (which can also be understood as path tunnel encapsulation), so that the intermediate node can obtain the APN6 application information from the outer IPv6 extension header, so as to further provide perception application services in the SRv6 network (which can also be understood as enabling other nodes in the network to perceive the application information);

Intermediate nodes (can also be understood as application-aware intermediate nodes): One or more (one or more can also be understood as at least one) nodes between the head node and the tail node in the network path can be called intermediate nodes. The intermediate node can obtain the network path that matches the IPv6 message from the head node, so that after receiving the IPv6 message from the head node, it can provide network forwarding services for the application's IPv6 message according to the matched network path; at the same time, the intermediate node can also provide other network value-added services based on the APN6 application information carried in the IPv6 message, such as application-aware service function chaining (SFC), application-aware in-situ flow information telemetry (IFIT), etc.

Tail node (also known as the tail node of the perception application): the end node of the network path. The tail node can delete (also known as release) the APN6 application information and path tunnel encapsulation information contained in the IPv6 message; at the same time, the tail node can also retain (i.e. not delete) the APN6 application information that already exists in the IPv6 message before the IPv6 message enters the path, and continue to transmit the retained APN6 application information with the IPv6 message;

4) Controller: The controller can be used to uniformly plan and maintain the mapping relationship between APN ID, APN ID and application (or application group), and network policy. When the network edge device generates an IPv6 message containing an APN6 header, the controller can send the APN ID and the mapping relationship to the network edge device and the network policy execution device. Specifically, the controller can send the mapping relationship between the application (or application group) and the APN ID to the network edge device; at the same time, the controller can send the mapping relationship between the APN ID and the network policy to the network policy execution device. In the case where the end-side device or cloud-side device generates an IPv6 message containing an APN6 header (which can also be understood as the case of the application-side solution), the controller can coordinate the APN ID corresponding to the application (or application group) through collaboration with the over-the-top (OTT) application management server, and distribute it to the end-side device or cloud-side device.

In actual application, APN6 technology can realize both the application's call to network capabilities and the network's recognition of applications. However, APN6 technology has a series of problems such as privacy, security, management, and capacity. Specifically, they include:

In terms of privacy, the APN6 header of the IPv6 message carries user information in plain text, which can easily leak user privacy;

In terms of security, APN6 application information is only associated with applications, and there may be problems such as forged APN6 application information and counterfeit APN6 application information in IPv6 messages. For example, after a user purchases an APN6 service, the controller assigns the user an APN ID corresponding to the application signed by the user. The APN ID is fixed and cannot be changed. At this time, if the APN ID is leaked (for example, intercepted by an illegal third party), in order to ensure network security, the APN IDs saved in all routers need to be fully updated, which has a heavy maintenance burden.

In terms of management, there are a large number of applications, and a large number of new applications are generated at any time. It is actually impossible to uniformly encode (also understood as allocate) the APN IDs corresponding to these applications, and manage (such as modify, delete, etc.) the APN IDs corresponding to these applications;

In terms of capacity, there are currently hundreds of millions of applications. The database that stores the APN IDs of all applications and the mapping relationship between the APN IDs and network policies occupies a large amount of capacity. When the APN IDs and mapping relationships are sent to network edge devices, there is a great challenge to the capacity of the network edge devices.

At the same time, the network has limited access control over APN6 application information, that is, the network can only control the access (also understood as access) behavior to APN6 application information in a limited way, which makes it difficult to meet the complex needs of the network. Specifically, the extension header of the IPv6 message carries the APN6 application information, and usually, the APN6 application information contained in the extension header (specifically, it can include extension headers other than the hop-by-hop (HBH) header) cannot be changed (for example, it cannot be inserted, modified, deleted, etc.) during the forwarding process. In this way, when the IPv6 message is transmitted between different network domains (also understood as management domains), since the APN6 application information in different network domains may be different, it may cause the node at the boundary of the network domain to discard the IPv6 message, violating the Internet's best-effort forwarding principle.

In other words, since the APN ID is uniformly allocated for the entire network, the encoding method of the application information and user information contained in the APN6 application information may be different in different network domains. Therefore, when a message using the APN6 technology is transmitted from one network domain to another (i.e., when transmitted across network domains), if the encoding method of the application information and user information in the two network domains is the same, the boundary node of the network domain receiving the message can accurately identify the APN6 application information contained in the message, and the boundary node can thus receive the message and forward the message within the network domain according to the APN6 application information; if the encoding method of the application information and user information in the two network domains is different, the boundary node of the network domain receiving the message cannot accurately identify the APN6 application information contained in the message, and the boundary node can only choose to discard the message, but cannot ignore the APN6 application information contained in the message and forward the message within the network domain.

For example, suppose that the border node of the metropolitan area network connected to the user network of the home user is a Broadband Remote Access Server (BRAS). Server), BRAS can use the user information stored (also understood as configured) on BRAS to check the APN6 application information contained in the received message sent by the user. If the APN6 application information contained in the message sent by the user is inconsistent with the user information stored on BRAS (also understood as verification failure), BRAS will discard the message and no longer forward it. If the APN6 application information contained in the message sent by the user is consistent with the user information stored on BRAS (also understood as verification success), BRAS can forward the message in the metropolitan area network according to the APN6 application information and pass the message to the backbone network. However, when the message enters the network boundary of the backbone network (also understood as the backbone edge) from the metropolitan area network, the boundary node of the backbone network usually does not store any business information of the user, and it is impossible to effectively control and verify the APN6 application information contained in the message, which may cause the message to be discarded by the boundary node of the backbone network or make it difficult to select a suitable network path for the message in the backbone network. Here, in the relevant technology, cross-domain transmission can be achieved by building an end-to-end network tunnel. However, there are nearly 300 million users in the current fixed network. In the case of the diversity of the purpose of Internet access, it is necessary to build hundreds of millions of end-to-end network tunnels in the network to meet the cross-domain transmission needs of a large number of users. It is difficult to achieve cross-domain transmission by building an end-to-end network tunnel.

In the related technology, in order to avoid the privacy, security, management, capacity, access control and other issues existing in the APN6 technology, the ARN technology is proposed. The ARN technology generates the ARN information (which can also be understood as the application call interface information, such as ARN ID) applied to the forwarding plane based on the path calculation parameters of the control plane (such as the service type (which can be expressed as Color in English) parameters) to realize the network capability opening, that is, to realize the application calling the network capability. Specifically, when the application generates a message, the ARN ID can be included in the header of the message, so that the application can call the network capability corresponding to the ARN ID, which can also be understood as enabling the application's message to be forwarded in the network according to the routing policy corresponding to the ARN ID; at the same time, when the network receives the message, it can identify the corresponding application according to the ARN ID contained in the message header, and forward the message according to the routing policy matching the ARN ID. For example, when there are multiple network paths and/or multiple slices between the source address and the destination address corresponding to the message, the network can select (can also be understood as determining) one of the paths and/or slices for forwarding processing according to the ARN ID contained in the message. In other words, ARN ID can be understood as the middle layer between the application and the network. By introducing ARN ID, the network requirements of the application and the network capabilities of the network are bridged. ARN ID also represents the network capability information open to the outside world, as well as application information and user information. Among them, each ARN ID can be specifically represented by a number, which can include a randomly generated value or a value assigned in a preset order. The structure of ARN ID can be set according to actual needs. In other words, there is no limitation on the structure of ARN ID. Therefore, ARN ID can also be understood as an unstructured number.

In actual application, in IPv6 packets, since the flow label field of the IPv6 packet header is designed to be flexible and modifiable, the ARN ID can be set in the Flow Label field; or, the ARN ID can be set in the extended header of the IPv6 packet. Exemplarily, when the ARN ID is set in the Flow Label field of the IPv6 packet header, as shown in FIG4, the 20 bits of the Flow Label field can be reused to set the ARN ID, and the highest bit of the traffic type (TC, TrafficClass) field (specifically, the 7th bit) indicates whether the Flow Label field of the packet is escaped to the ARN ID. Exemplarily, when the highest bit of the TC field is set to 1, it indicates that the Flow Label field is escaped to the ARN ID; when the highest bit of the TC field is set to 0, it indicates that the Flow Label field is not escaped to the ARN ID. Of course, the highest bit of the TC field can also be set to 0, indicating that the Flow Label field is escaped to the ARN ID; when the highest bit of the TC field is set to 1, it indicates that the Flow Label field is not escaped to the ARN ID. Here, in the related art, the highest bit of the TC field can be set to represent explicit congestion notification (ECN), and in the case of a wide area network, since ECN is not enabled, the above-mentioned scheme of setting the highest bit of the TC field to indicate whether the Flow Label field of the message is converted to an ARN ID does not conflict with the scheme of setting the highest bit of the TC field to represent ECN in the related art.

In actual applications, using ARN technology for network transmission can achieve the following advantages:

1) Ensure network security: Network service providers can use different ARN IDs to represent different network capabilities open to the outside world, so as to provide differentiated network services to users (such as providing low-latency, high-bandwidth tunnels and/or slices according to application requirements), without directly opening up segment identifiers (SIDs) and/or binding SIDs (BSIDs), thereby effectively ensuring network security.

2) Protect user privacy: Since the ARN ID does not explicitly carry application information and user information, when the network receives a message containing the ARN ID, the network cannot directly obtain the application information and user information based on the ARN ID contained in the message. Therefore, the ARN technology can prevent the leakage of user privacy.

3) Ability to flexibly control and manage ARN ID: The controller can configure ARN ID for each network domain separately. In this way, when a message enters a network domain, the message can be carried in the message with the corresponding ARN ID under the network domain, so that the nodes in the network domain can forward the message within the network domain according to the ARN ID of the network domain carried in the message. In other words, the ARN ID of each network domain can be flexibly configured and managed according to actual needs; at the same time, the ARN ID contained in the message can be changed according to the network domain to realize the network capability of calling the corresponding network domain. For example, in the case of cross-domain transmission, assuming that the message is transmitted from domain A to domain B, the border node in domain A connected to domain B can replace the ARN ID corresponding to domain A contained in the message with the ARN ID corresponding to domain B, and send (can also be understood as transmission or delivery) the message to domain B, so that after receiving the message, the node in domain B can perform forwarding processing within domain B according to the ARN ID corresponding to domain B contained in the message; or, domain A directly sends the message to domain B, and after receiving the message, the border node in domain B connected to domain A can replace the ARN ID corresponding to domain A contained in the message with the ARN ID corresponding to domain B, and perform subsequent forwarding processing within domain B according to the replaced ARN ID. The above forwarding processing can also be called forwarding-related processing associated with ARN.

However, in the scenario of applying ARN technology, if messages are forwarded between two network domains with different trustworthiness, how the boundary nodes of the network domains set the ARN information (such as ARN ID) in the message and how to perform forwarding related processing are issues that need to be solved urgently.

Based on this, in various embodiments of the present application, by setting the first information in the first node at the boundary of the first network (which can also be understood as the boundary node), when the first node receives the first message, it can determine whether to perform forwarding-related processing associated with the ARN on the first message based on the first information. In this way, when the first node receives the first message from a network domain with a different credibility from that of the first network, or when the first node forwards the first message to a network domain with a different credibility from that of the first network, it is possible to forward messages carrying ARN identifiers between network domains with different credibility by setting whether the interface related to the forwarding of the first message in the first node can use the ARN.

An embodiment of the present application provides a message processing method, which is applied to a first node, where the first node includes a border node of a first network. As shown in FIG5 , the method includes:

Step 501: Receive a first message, where the first message includes a first ARN identifier;

Step 502: When the first information indicates that the first interface of the first node can use the ARN, forwarding-related processing associated with the ARN is performed on the first message at the first interface; or, when the first information indicates that the first interface of the first node disables the ARN, forwarding-related processing not associated with the ARN is performed on the first interface.

Here, in actual application, the first network may specifically include one of a user network, a metropolitan area network, a backbone network, etc., and the specific implementation of the first network is not limited in the embodiment of the present application. The user network can also be understood as a network used to connect a user gateway device (such as a customer premises equipment (CPE)) and a terminal, and the terminal can be called a UE, a terminal device, a device, or a user, etc., and the embodiment of the present application does not limit this.

The first node includes a border node of the first network, which may specifically include one of a CPE, a provider edge (PE) device (such as a virtual private network (VPN) edge router), a BRAS, a broadband network gateway (BNG), etc. The first node may be connected to the second network, that is, the first network and the second network may be connected through the first node. The second network may specifically include one of a user network, a metropolitan area network, a backbone network, etc. The embodiment of the present application does not limit the specific implementation of the second network; the credibility of the first network and the second network may be different, specifically, the credibility of the first network may be higher than, equal to, or lower than the credibility of the second network.

The first message may specifically include an IPv6 message, and the first ARN identifier included in the first message may specifically include an ARN ID. The first ARN identifier may specifically be set in the first field of the first message, that is, the first field of the first message carries the first ARN identifier. Specifically, the first field may specifically include a Flow Lable field in the message header of the first message.

The first interface includes an interface connecting the first node and the second network, and may specifically include an Internet Protocol (IP) interface. When the first node needs to send the first message to the second network, the message of the first node may be forwarded to the second network through the first interface, and in this case, the first interface may also be understood as an outbound interface or an outbound interface; when the first node receives the first message from the second network, the first node may receive the first message from the second network through the first interface, and in this case, the first interface may also be understood as an inbound interface or an inbound interface.

In actual application, in step 501, the first node can receive a first message from other nodes in the first network, and needs to forward the first message to the second network through the first interface; or, the first node can receive a first message from the second network through the first interface, and needs to forward the first message within the first network.

After receiving the first message, the first node needs to determine how to forward the first message, which can also be understood as determining the service type of the forwarding service for the first message. The service type of the forwarding service can be determined by one or more (one or more can also be understood as at least one) of a network path, a routing strategy (which can also be understood as a routing strategy, which can specifically include a segment routing strategy (SRPolicy), etc.), a network tunnel, and/or a network slice.

Specifically, the first node can determine how to forward the first message according to the first information associated with the first interface. In actual application, the first information can be named trust_arn, and of course it can also be named other as needed; since the first information is associated with the first interface, the first information can also be understood as interface-level attribute information; the first information can represent whether the first interface can use ARN, and whether the first interface can use ARN and the feasibility of the second network associated with the first interface. Specifically, when the second network is a trusted domain (it can also be understood that the trustworthiness of the second network is greater than or equal to the trustworthiness threshold), the first interface can use ARN, at which point the first node can forward the first message in a manner associated with ARN; when the second network is a non-trustworthy domain (it can also be understood that the trustworthiness of the second network is less than the trustworthiness threshold), the first interface is prohibited from using ARN, at which point the first node can forward the first message in a manner not associated with ARN.

Based on this, the value of the first information can be determined by whether the second network is a trusted domain. For example, assuming that the value of the first information is correct (true) or wrong (false), when the second network is a trusted domain, the value of the first information is true, which is used to indicate that the first interface can use ARN; when the second network is an untrusted domain, the value of the first information is false, which indicates that the first interface of the first node is disabled for ARN. Of course, when the second network is a trusted domain, the value of the first information can also be false, which is used to indicate that the first interface of the first node can use ARN; when the second network is an untrusted domain, the value of the first information is true, which indicates that the first interface of the first node is disabled for ARN.

In actual application, after determining the value of the first information according to whether the second network is a trusted domain, the value of the first information can be configured (also understood as setting) in the first node. Specifically, the specific implementation method of configuring the value of the first information in the first node can be selected according to actual needs, such as configuring the value of the first information in the first node manually (such as manually typing a command line), configuring the value of the first information in the first node through a control device, etc., which is not limited in this embodiment of the present application. Here, the control device may also be referred to as a controller or a network controller, which is at least used to generate an ARN identifier and to configure an ARN identifier for nodes in the network.

When the value configuration of the first information is completed, after the first node receives the message including the ARN identifier, in step 502, the first node can determine how to perform forwarding-related processing on the message according to the configured value of the first information.

Specifically, when the first information indicates that the first interface of the first node disables the ARN, the first node performs forwarding-related processing on the message that is not associated with the ARN, which may include the following two methods:

In the first manner, the first node directly discards the first message. Based on this, in one embodiment, the performing forwarding-related processing on the first message that is not associated with the ARN includes:

The first node discards the first message.

In the second method, the first node regards the first message as (can also be understood as) a message that does not contain an ARN identifier, and performs forwarding-related processing on the first message according to the forwarding method of the message that does not contain an ARN identifier (can also be understood as the default forwarding method).

More specifically, in one embodiment, the performing forwarding-related processing on the first message that is not associated with the ARN includes:

When the first interface is an inbound interface, the first field carrying the first ARN identifier in the first message is set to the fifth information to obtain a processed first message, and the processed first message is forwarded in the first network in a fourth manner, where the fourth manner is not associated with the ARN, and the fifth information indicates that the first message disables the ARN; wherein the value of the fifth information may specifically include 0 or an invalid value, and the specific value of the fifth information may be set according to actual needs, and the embodiment of the present application is not limited to this.

Here, if the first field is set to the fifth information, the first node forwards the first message in the first network according to the default forwarding mode (that is, the fourth mode), which can also be understood as providing a default network service for the first message;

When the first interface is an outgoing interface, the first field carrying the first ARN identifier in the first message is set to fifth information to obtain a processed first message, and the processed first message is forwarded to the second network, and the fifth information indicates that the first message disables ARN;

Here, if the first field is set to the fifth information, the first node does not perform any processing and directly forwards the first message to the second network.

From the above description, it can be seen that when the first information represents that the first interface of the first node disables ARN, that is, when the first network is a non-trusted domain, the first node can discard the first message when the second network associated with the first interface is a non-trusted domain, or modify the first ARN identifier contained in the first message to an invalid value, thereby avoiding leakage of the first ARN identifier to the non-trusted domain and ensuring network security.

Accordingly, when the first information indicates that the first interface of the first node can use the ARN, the first node performs forwarding-related processing associated with the ARN on the message. At the same time, in order to avoid network security issues caused by counterfeiting the ARN identifier, before step 502, the first node may also verify the ARN identifier contained in the first message and the source of the first message, and determine whether to perform forwarding-related processing associated with the ARN based on the verification result.

Based on this, in one embodiment, the first message further includes second information, wherein the second information represents the source of the first message; when the first information represents that the first interface of the first node can use the ARN, the second information and the first ARN identifier are verified; after successful verification, the first message is subjected to forwarding-related processing associated with the ARN at the first interface; correspondingly, after failed verification, the first message is subjected to forwarding-related processing not associated with the ARN at the first interface.

In one embodiment, the second information may include one or more of the following (one or more may also be understood as at least one):

user information of the first message;

source address information of the first message;

The port information of the first message.

Here, in actual application, when the first message comes from the user network, the second information may include the user information of the first message, that is, the second information may indicate which user the first message comes from. At this time, the user information may specifically include the user identifier, the access link information of the first message, etc. Among them, when the user information includes the access link information of the first message, the first node may determine through which access link the first message is sent to the first node according to the access link information of the first message, and then determine which user the first message of the user comes from according to the corresponding relationship between the access link and the user. Here, the first node may know the corresponding relationship between the access link and the user in advance; when the first message comes from the metropolitan area network or the backbone network, the second information may include the source address information of the first message (such as the source IP address information) and/or the port information of the first message (such as the source port information).

In actual application, the first node can obtain the correspondence between the source information of one or more messages and the ARN identifier, and match the second information contained in the first message and the first ARN identifier in the obtained correspondence. When there is a match, it is determined that the verification is successful; when there is no match, it is determined that the verification has failed.

Based on this, in one embodiment, the verifying the second information and the first ARN identifier includes:

The second information and the first ARN identifier are verified using the third information, wherein the third information represents a correspondence between source information of one or more messages and the ARN identifier.

The third information can be specifically presented in the form of a mapping table, in which case the third information can also be referred to as a verification table. The third information is associated with the first interface, that is, when the first node is connected to multiple networks through multiple interfaces, each interface corresponds to a third information, and the third information is used to verify the second information and ARN identifier contained in the message associated with the interface.

In one embodiment, the first node may obtain the third information in a manner that includes: the first node receives the third information sent by the control device, manually configures the third information at the first node, the first node uses all received messages containing the ARN identifier to perform routing learning corresponding to the routing protocol, thereby determining the third information (i.e., determining the third information through routing learning), and using the access control list (ACL) corresponding to the first node as the third information, etc. Among them, the routing protocol may specifically include the Border Gateway Protocol (BGP), or the Interior Gateway Protocol (IGP), etc., and the IGP may further include the Open Shortest Path First (OSPF) protocol, or the Intermediate System to Intermediate System (ISIS) protocol, etc.; the routing protocol may be configured by any node that transmits the first message before the first node.

In actual application, if the verification fails, in step 502, the first node may perform forwarding-related processing not associated with the ARN on the first message. The specific implementation method of the forwarding-related processing not associated with the ARN has been described in detail above and will not be repeated here; if the verification succeeds, in step 502, the first node may perform forwarding-related processing associated with the ARN on the first message. At this time, the forwarding-related processing associated with the ARN may be discussed in the following four cases according to whether the first interface is an inbound interface or an outbound interface, and whether the first node needs to reset the ARN identifier contained in the first message (which can also be understood as ARN ID mapping):

In the first case, when the first interface is an outbound interface and the first node needs to reset the ARN identifier contained in the first message, after receiving the first message, the first node can map (also understood as resetting or replacing) the first ARN identifier associated with the first network contained in the first message to the ARN identifier associated with the second network, and forward the mapped first message to the second network, so that the second network can forward the first message within the second network according to the mapped ARN identifier (which can also be understood as providing the first message with a network service corresponding to the mapped ARN identifier within the second network).

Based on this, in one embodiment, the performing forwarding-related processing associated with the ARN on the first message includes:

Setting the first field carrying the first ARN identifier in the first message to the second ARN identifier to obtain a processed first message, wherein the second ARN identifier is associated with the second network, and forwarding the processed first message to the second network;

Among them, the first node can obtain the correspondence between one or more first ARN identifiers and the second ARN identifier, so that the first node can use the correspondence and the first ARN identifier contained in the first message to determine the second ARN identifier corresponding to the first message, and then implement the second ARN identifier determined in the first field setting.

Based on this, in one embodiment, the first field carrying the first ARN identifier in the first message is set to the second ARN identifier using the fourth information, or the first field carrying the first ARN identifier in the first message is set to the third ARN identifier, and the fourth information represents the correspondence between one or more ARN identifiers associated with the first network and the ARN identifier associated with the second network.

Among them, in one embodiment, the way in which the first node obtains the fourth information may include: the first node receives the fourth information sent by the control device, the fourth information is configured at the first node manually, the first node uses all received messages containing the ARN identifier to perform routing learning corresponding to the routing protocol to thereby determine the fourth information (i.e., determining the fourth information through routing learning), etc.

In the second case, when the first interface is an outbound interface and the first node does not need to reset the ARN identifier contained in the first message, the first node can directly forward the received first message to the second network. After the boundary node of the second network receives the first message, it can map the first ARN identifier associated with the first network contained in the first message to an ARN identifier associated with the second network, so that the boundary node of the second network can forward the first message within the second network according to the mapped ARN identifier.

Based on this, in one embodiment, the performing forwarding-related processing associated with the ARN on the first message includes:

Forwarding the first message to the second network, where the second network can forward the message in a second manner, where the second manner is associated with a second ARN identifier corresponding to the first message;

In the third case, when the first interface is an inbound interface and the first node needs to reset the ARN identifier contained in the first message, after receiving the first message from the second network, the first node can map the first ARN identifier associated with the second network contained in the first message to the ARN identifier associated with the first network, and forward the first message within the first network according to the mapped ARN identifier.

Based on this, in one embodiment, the performing forwarding-related processing associated with the ARN on the first message includes:

Setting the first field carrying the first ARN identifier in the first message to a third ARN identifier to obtain a processed first message, wherein the third ARN identifier is associated with a first network, and forwarding the processed first message in the first network according to a first manner, wherein the first manner is associated with the third ARN identifier;

In the fourth case, when the first interface is an inbound interface and the first node does not need to reset the ARN identifier contained in the first message, after receiving the first message from the second network, the first node can directly forward the first message within the first network according to the first ARN identifier associated with the first network contained in the first message. Before the boundary node of the second network sends the first message to the first node, the ARN identifier associated with the second network contained in the first message has been mapped to the first ARN identifier associated with the first network.

Based on this, in one embodiment, the performing forwarding-related processing associated with the ARN on the first message includes:

The first message is forwarded in the first network according to a third manner, where the third manner is associated with the first ARN identifier.

It can be seen from the above description that the first node can use the third information to verify the source of the first message and the first ARN identifier, and perform forwarding-related processing on the first message according to the verification result.

In actual application, the third information and the fourth information can be merged, and the merged information can realize the functions of the third information and the fourth information. Based on this, when the third information and the fourth information are configured for the first node at the same time, the first node can only store the merged information, and use the merged information to realize the functions of the third information and the fourth information. Since the merged information occupies a small storage space, storage resources can be saved; at the same time, if the first node is configured with ACL and the third information at the same time, the first node can give priority to using ACL to verify the source of the first message and the first ARN identifier when performing verification, that is, ACL verification has the highest priority. Exemplarily, when the verification result obtained by using ACL verification is inconsistent with the verification result obtained by using the third information verification, the verification result corresponding to the ACL can be used as the basis.

The message processing method provided in the embodiment of the present application, the first node receives the first message, the first message includes the first ARN identifier, and the first node includes the border node of the first network; when the first information indicates that the first interface of the first node can use the ARN, the first interface performs forwarding-related processing associated with the ARN on the first message, or, when the first information indicates that the first interface of the first node disables the ARN, the first interface performs forwarding-related processing not associated with the ARN on the first message. The scheme provided in the embodiment of the present application, by setting the first information in the first node at the first network boundary (which can also be understood as the network domain boundary of the first network), when the first node receives the first message transmitted across the network domain (such as entering the first network or leaving the first network), it can determine whether to perform forwarding-related processing associated with the ARN on the first message according to the first information, so that when the first node receives the first message from a network with a different credibility from the first network, or when the first node forwards the first message to a network with a different credibility from the first network, it can be realized by whether the interface related to the forwarding of the first message in the first node can use the ARN to forward the message carrying the ARN identifier between network domains with different credibility.

The present application is described in further detail below in conjunction with application examples.

This application example provides a network architecture that applies ARN technology, as shown in Figure 6, the network architecture includes a controller (i.e., the above-mentioned control device), a user network, a metropolitan area network, and a backbone network. Among them, the user network is connected to the metropolitan area network, and the metropolitan area network is connected to the backbone network. Exemplarily, the CPE of the user network is connected to the BRAS of the metropolitan area network, and the metropolitan area boundary node of the metropolitan area network (which can also be understood as a metropolitan area boundary device) is connected to the PE of the backbone network. Among them, the user network, the metropolitan area network, and the backbone network can also be understood as different network domains, and the credibility between different network domains may be different.

In actual application, ARN ID (i.e. the above-mentioned ARN identifier) is mainly used in network border nodes (which can also be understood as network border service access points, such as PE, BRAS, or BNG, etc.). When the controller receives the order information of the user subscribing to the ARN service (which can also be understood as the subscription demand for the network service), one or more service types corresponding to the order information can be set according to the received order information; for each service type, the controller can select a route for the service type in the metropolitan area network connected to the user network corresponding to the user according to the SR Policy, that is, determine the routing strategy for forwarding the message corresponding to the service type in the metropolitan area network (the routing strategy is associated with the network path for forwarding the message, and the network path can specifically include network slices and/or network tunnels, etc.). After determining the routing strategy corresponding to the service type, for the routing strategy, if the routing strategy already has a corresponding ARN ID, the controller can directly determine the correspondence between the service type and the ARN ID (which can also be expressed in the form of a two-tuple, such as <service type, ARN ID>) and the correspondence between the ARN ID and the routing strategy (which can also be expressed in the form of a two-tuple, such as <ARN ID, routing strategy>); if the routing strategy does not yet have a corresponding ARN ID, the controller can generate an ARNID corresponding to the routing strategy according to a preset strategy (such as negotiation with an application management server, etc.), and then determine the correspondence between the service type and the ARN ID and the correspondence between the ARN ID and the routing strategy; after determining the two correspondences, the controller can send the correspondence between the service type and the ARN ID to the user device (such as a terminal, server, CPE, etc.), so that when the user device generates a message, it can determine the ARN ID corresponding to the message according to the service type and the correspondence corresponding to the message, and carry the determined ARN ID in the message; at the same time, the controller can The correspondence between the ID and the routing strategy is sent to the border node (such as BRAS) connected to the user network corresponding to the user in the metropolitan area network, so that when the user's message enters the metropolitan area network, the BRAS can determine the routing strategy for forwarding the message based on the ARN ID contained in the message and the correspondence (it can also be understood as determining the network forwarding service provided for the message). The process of the controller sending the correspondence to the border node can also be understood as network-side configuration.

Exemplarily, assuming that the controller sends the correspondence between the service type and the ARN ID to the terminal and/or server, the application on the terminal and/or server can carry the ARN ID corresponding to the service type required by the application in the message when generating the message corresponding to the application based on the service type required by the application and the correspondence. In this way, when the CPE of the user network receives the message sent by the terminal and/or server, the message already carries the ARN ID and can be directly forwarded to the metropolitan area network; assuming that the controller sends the correspondence between the service type and the ARN ID to the CPE, the message generated by the terminal and/or server may not carry the ARN ID. After the CPE receives the message sent by the terminal and/or server, it can classify the message by using ACL or other methods (which can also be understood as flow allocation), thereby determining the service type required for the message, and carrying the ARN ID corresponding to the service type required for the message in the message based on the service type required for insulation and the correspondence, and then forwarding the message to the metropolitan area network.

Based on the above network architecture, this application example provides an ARN ID access control method, as shown in Figure 7, including the following steps:

Step 701: a network edge device (ie, the first node) receives a message (ie, the first message) including an ARN ID (ie, the first ARN identifier);

In actual application, the network edge device may specifically include one of a CPE of a user network, a metropolitan area edge device of a metropolitan area network, a BRAS of a metropolitan area network, a PE of a backbone network, and the like.

Step 702: The network edge device forwards the message according to the ARN trust attribute (trust_arn) corresponding to the interface (i.e., the first interface, which may specifically include an IP interface) connected to the neighboring network (i.e., the second network); wherein the forwarding process includes:

When the value of trust_arn is false, the ARN service is disabled during packet forwarding;

When the value of trust_arn is true, execute step 703;

Here, the neighboring network refers to a network adjacent to the network to which the network edge device belongs. For example, as shown in Figure 6, the neighboring network of the metropolitan area network includes a user network and a backbone network. When the network edge device needs to forward the received message to the neighboring network, the interface can also be called an outbound interface; when the network edge device receives the message from the neighboring network and needs to forward it within the network to which the network edge device belongs, the interface can also be called an inbound interface.

In actual application, trust_arn is an interface-level attribute that can be set in advance in the network edge device by one of the following methods: manual or controller-issued, based on the trust relationship between the network to which the network edge device belongs and the neighboring network (it can also be understood as whether the neighboring network is a trusted domain relative to the network to which the network edge device belongs). The value of trust_arn can be set to true or false.

In actual application, the disabling of ARN service means that the network edge device forwards the message as a message that does not carry the ARN ID, such as discarding the message, or forwarding the message according to the default routing policy. Specifically, when the value of trust_arn is false, after the network edge device receives a message containing an ARN ID (which can also be understood as a message carrying ARN information), the value of the field carrying the ARN ID in the message (such as the Flow Lable field, etc.) can be set to 0 (which can also be understood as being erased to 0) or set to an invalid value (specifically, it can be selected according to actual needs). In this way, the network edge device can forward the message containing an ARN ID of 0 or an invalid value as a message that does not contain an ARN ID.

Step 703: The network edge device performs a validity check on the user information and ARN ID contained in the message;

If the verification is successful, execute step 704;

If the verification fails, disable the ARN service;

Here, when the interface is an outbound interface, the legality check may also be referred to as an ARN outbound check or an outbound check; when the interface is an inbound interface, the legality check may also be referred to as an ARN inbound check or an inbound check.

In actual application, in order to prevent a third party (such as a user who has not subscribed to the ARN service) from counterfeiting the ARN ID in the sent message, the network edge device can obtain a verification table (i.e., the third information mentioned above) for verifying the user's identity. In this way, when the network edge device receives the user's message, it can use the verification table to verify the ARN ID contained in the message and the user information corresponding to the message, thereby avoiding counterfeiting. Among them, the verification table can be used for outbound verification and/or inbound verification. The verification table used for outbound verification can also be called an outbound verification table; the verification table used for inbound verification can also be called an inbound verification table.

In actual application, the network edge device can obtain the verification table by one of the following methods: manual configuration, controller distribution, routing learning, etc. Exemplarily, when the network edge device obtains the verification table by means of controller distribution, the specific implementation may include: the controller determines the user's source address information (such as source IP) and/or link information based on the user's subscription information, and uses the user's source address information and/or link information as user information (which can also be understood as the user's identification information, i.e., the above-mentioned source information), so that the controller can determine the correspondence between the user information of the user and the ARN ID corresponding to the service type subscribed by the user for each user, which can also be understood as which ARN IDs can be contained in the user's message (which can also be expressed in the form of a binary, such as <user information, ARN ID>); the controller can then determine the verification table based on the correspondence between the user information and ARN ID of all users, and distribute the verification table to the network edge device.

Exemplarily, assuming that the network boundary device is a boundary device of a user network (such as CPE, etc.) or a boundary device of a neighboring network connected to the user network (such as BRAS, BNG, etc.), the network boundary device can determine the user information based on the received message, such as determining the user information based on the access link information corresponding to the message; at the same time, the network boundary device can determine the ARN ID contained in the message based on the received message. In this case, the network boundary device can also be called a user gateway device. Alternatively, assuming that the network boundary device is a boundary device connecting a metropolitan area network and a backbone network (such as a metropolitan area boundary device, PE, etc.), the network boundary device can determine the user information based on the source IP information or port information contained in the message, and determine the ARN ID contained in the message. In this case, the network boundary device can also be called a network gateway device. In this way, after determining the user information and ARN ID, the network boundary device can perform a legitimacy check on the message based on the determined user information, ARN ID, and the check table issued by the controller.

In actual application, when performing inbound verification, the ARN ID contained in the message received by the network boundary device may be associated with the neighboring network. At this time, the network boundary device needs to map the ARN ID contained in the message (which can also be understood as replacement, rewriting, updating, etc.) so that the mapped ARN ID is associated with the network to which the network boundary device belongs. In this way, the network boundary device can forward the message within the network to which the network boundary device belongs according to the ARN ID contained in the message; accordingly, when performing outbound verification, the ARN ID contained in the message received by the network boundary device is associated with the network to which the network boundary device belongs. The network boundary device can map the ARN ID contained in the message so that the mapped ARN ID is associated with the neighboring network. In this way, after the network boundary device forwards the message to the neighboring network, the neighboring network can directly forward the message within the neighboring network according to the ARNID contained in the message.

In actual application, since the controller allocates ARN IDs to the network and neighboring network to which the network boundary device belongs respectively, the network boundary device can obtain the correspondence between the ARN ID of the network to which the network boundary device belongs and the ARNID of the neighboring network (which can also be understood as a mapping relationship, that is, the fourth information mentioned above) to achieve the mapping of the ARNID contained in the message. Among them, the corresponding relationship can be specifically presented in the form of a mapping table, and the mapping table can be used for outbound verification and/or inbound verification. The mapping table used for outbound verification can also be called an outbound mapping table; the mapping table used for inbound verification can also be called an inbound mapping table.

In actual application, the network edge device can obtain the mapping table by one of the following methods: manual configuration, controller distribution, routing learning, etc. Exemplarily, assuming that the neighboring network is a backbone network, and the network to which the network edge device belongs is a metropolitan area network, when the network edge device obtains the mapping table by means of a controller distribution, the specific implementation may include: the controller determines the correspondence between the ARN ID assigned by the controller to the metropolitan area network and the ARN ID assigned to the backbone network according to the correspondence between the routing strategy in the metropolitan area network and the routing strategy in the backbone network (it can also be understood as which routing strategy should be used in the backbone network to provide network forwarding services for the messages forwarded through each routing strategy in the metropolitan area network); the controller can then determine the mapping table according to the correspondence between all ARN IDs, and distribute the mapping table to the edge device. In this way, flexible access control of the ARN ID contained in the message can be achieved in the process of forwarding messages between different networks.

In actual application, the verification table and mapping table obtained by the network boundary device can be merged (here, when the verification table and the mapping table are sent down by the controller, they can be merged in the controller) to obtain a merged table. At this time, the network boundary device can perform a legitimacy check on the message based on the determined user information, ARN ID, and the merged table, and map the ARN ID contained in the message to the ARN ID associated with the network to which the network boundary device belongs (that is, the destination ARN ID). Among them, the merged table can be expressed in the form of a triple, such as <user information, ARN ID, destination ARN ID>, the ARN ID is associated with the network to which the network boundary device belongs, and the destination ARN ID is associated with the neighboring network.

Exemplarily, the inbound check table and the inbound mapping table obtained by the network edge device can be merged, and the outbound check table and the outbound mapping table can also be merged. As shown in Figure 6, the inbound check table of the user-facing interface of the CPE (which can also be understood as an interface facing the terminal and/or server) can be expressed as <user information, ARN ID>, and the outbound check table can be expressed as <source IP, ARN ID>; the inbound check table and the outbound check table of other interfaces of the CPE and other network edge devices (including BRAS, PE, metropolitan area network edge devices, etc.) can both be expressed as <source IP, ARN ID>; the inbound mapping table of the user-facing interface of the CPE can be expressed as <user, ARN ID, destination ARN ID>, and the outbound mapping table can be expressed as <source IP, ARN ID, destination ARN ID>; the inbound mapping table and the outbound mapping table of other interfaces of the CPE and other network edge devices can both be expressed as <source IP, ARNID, destination ARN ID>.

In actual application, when the ACL, check table, and mapping table all have the same ARN ID (that is, the relevant information of an ARN ID exists in the ACL, check table, and mapping table at the same time), the network boundary device will give priority to using the ACL to verify the legitimacy of the ARN ID; when the ACL does not contain the relevant information of the ARN ID, the network boundary device can use the check table to verify the legitimacy of the ARN ID; when the ACL and the check table do not contain the relevant information of the ARN ID, the network boundary device can use the mapping table to verify the legitimacy of the ARN ID. In other words, the network boundary device can verify the legitimacy of the ARN ID in the order of priority of ACL>check table>mapping table.

Step 704: The network edge device performs forwarding processing associated with the ARN, where the forwarding processing associated with the ARN includes one of the following:

If the interface is an inbound interface, the network edge device determines the routing strategy according to the ARN ID contained in the message and the correspondence between the ARN ID issued by the controller and the routing strategy, and forwards the message according to the determined routing strategy; or, the network edge device maps the ARN ID contained in the message to an ARN ID associated with the network to which the network edge device belongs according to the ARN ID contained in the message and the mapping table, and determines the routing strategy according to the mapped ARN ID and the correspondence between the ARN ID issued by the controller and the routing strategy, and forwards the message according to the determined routing strategy; wherein forwarding the message according to the determined routing strategy includes: mapping the message to the network tunnel and/or network slice corresponding to the routing strategy;

If the interface is an outbound interface, the network edge device maps the ARN ID contained in the message to an ARN ID associated with the neighboring network according to the ARN ID contained in the message and the mapping table, and forwards the message to the neighboring network; or, the network edge device directly forwards the message to the neighboring network.

In actual application, when the network edge device directly forwards the message to the neighboring network, the edge device of the neighboring network can map the ARN ID contained in the message to the ARN ID associated with the neighboring network based on the ARN ID contained in the message and the mapping table, so that the edge device of the neighboring network can forward the message within the neighboring network according to the ARN ID associated with the neighboring network.

The solution provided by the application example of this application deploys an IP interface-level attribute trust_arn on the network edge device to identify the neighboring network connected to the network edge device as a trusted domain or an untrusted domain, so that the network edge device can forward and process the message containing the ARN ID according to the value of trust_arn. In other words, even if the network edge device is connected to an untrusted domain, the message can be forwarded accordingly, which realizes the basic security framework for building the network capability of calling the trusted domain from the untrusted domain.

At the same time, when the trust_arn value of the IP interface is false, the network edge device can disable the ARN service as a whole. At this time, if the message entering or leaving the interface carries ARN information, the network edge device can erase the ARN ID to 0 or set it to an invalid value and process the message as a message without ARN information.

When the trust_arn value of the IP interface is true, if the network edge device receives a message with an invalid ARN ID, such as 0 or an invalid value, the network edge device processes the message as a message without ARN information (that is, the ARN service is disabled);

When the trust_arn of the IP interface is true, and the network boundary device is a user gateway device and the IP interface is an inbound interface, the user gateway device can match the <user, ARN ID> two-tuple in the check table and/or mapping table according to the user information and ARN ID contained in the message (which can also be understood as a query). If there is a match, the user gateway device can map the message to a network tunnel and/or network slice and forward the message, or first map the ARN ID contained in the message to the destination ARN ID, and then map the message to a network tunnel and/or network slice and forward the message; if there is no match, the user gateway device can erase the ARN ID contained in the message to 0 or set it to an invalid value, and process the message as a message that does not carry ARN information;

When the trust_arn of the IP interface is true, and the network boundary device is a network gateway device and the IP interface is an inbound interface, if the ARN ID of the message is valid, the network gateway device matches the two-tuple of <user information (such as user or source IP), ARN ID> in the check table and/or mapping table. If there is a match, the network gateway device can directly map the message to the network tunnel and/or network slice and forward the message, or first map the ARN ID contained in the message to the destination ARN ID, and then map the message to the network tunnel and/or network slice and forward the message; if there is no match, the network gateway device erases the ARN ID contained in the message to 0 or sets it to an invalid value, or retains the ARN ID (that is, does not change the ARN ID contained in the message), and then maps the message to the network tunnel and/or network slice and forwards the message.

When the trust_arn of the IP interface is true and the IP interface is an outbound interface, if the ARN ID of the message is valid, the network edge device matches the two-tuple of <user information (such as user or source IP), ARN ID> in the check table and/or mapping table. If there is a match, the network edge device can directly forward the message to the neighboring network, or first map the ARN ID contained in the message to the destination ARN ID, and then forward the message to the neighboring network; if there is no match, the network edge device can erase the ARN ID contained in the message to 0 or set it to an invalid value, or retain the ARN ID (that is, do not change the ARN ID contained in the message), and then forward the message to the neighboring network.

Thus, the solution provided by the application example of this application has the following advantages:

In terms of application privacy, since the ARN ID is a random value, it does not carry application privacy information and can be mapped to network slices and/or tunnels, which can ensure application security. At the same time, ARN can encapsulate internal network privacy information to avoid the problem of internal network information leakage caused by users directly using SRv6 Policy or BSID.

In terms of business functions, by defining trusted domains and non-trusted domains at the network edge device interface, when access control is performed on the ARNID, when the network connected to the interface is a non-trusted domain, the network edge device can completely ignore the ARN (that is, disable the ARN service); when the network connected to the interface is a trusted domain, the network edge device can not discard the message when there is no match for the ARN ID contained in the message (it can also be understood that the network edge device does not recognize the ARN ID contained in the message), and map the message to the default tunnel and/or slice (that is, provide the default network forwarding service for the message);

In terms of device capacity, since the network edge device only needs to store the network to which the network edge device belongs and the ARN-related information of the neighboring network (such as ARN ID, verification table, mapping table, etc.), and does not need to store the global network information, the storage space occupied is small and the device capacity requirement is low.

In order to implement the method of the embodiment of the present application, the embodiment of the present application further provides a message processing device, which is arranged on the first node. As shown in FIG8 , the device includes:

The receiving unit 801 is configured to receive a first message, where the first message includes a first ARN identifier;

Processing unit 802 is used to perform forwarding related processing associated with the ARN on the first message at the first interface when the first information indicates that the first interface of the first node can use the ARN, or to perform forwarding related processing not associated with the ARN on the first interface when the first information indicates that the first interface of the first node disables the ARN.

In one embodiment, the first message further includes second information, and the second information represents the source of the first message; the processing unit 802 is specifically configured to:

When the first information indicates that the first interface of the first node can use the ARN, the second information and the first ARN identifier are verified; after successful verification, the first message is forwarded in accordance with the ARN at the first interface.

In one embodiment, the first message further includes second information, where the second information represents a source of the first message; the processing unit 802 is specifically configured to:

When the first information indicates that the first interface of the first node can use the ARN, verify the second information and the first ARN identifier; if the verification fails, perform forwarding-related processing on the first message that is not associated with the ARN on the first interface.

In one embodiment, the processing unit 802 is specifically configured to:

The second information and the first ARN identifier are verified using the third information, wherein the third information represents a correspondence between source information of one or more messages and the ARN identifier.

In one embodiment, the receiving unit 801 is further configured to receive the third information sent by the control device;

or,

The processing unit 802 is further configured to determine the third information through routing learning.

In one embodiment, the processing unit 802 is specifically configured to perform one of the following:

Setting the first field carrying the first ARN identifier in the first message to the second ARN identifier to obtain a processed first message, wherein the second ARN identifier is associated with the second network, and forwarding the processed first message to the second network;

Setting the first field carrying the first ARN identifier in the first message to a third ARN identifier to obtain a processed first message, wherein the third ARN identifier is associated with a first network, and forwarding the processed first message in the first network according to a first manner, wherein the first manner is associated with the third ARN identifier;

Forwarding the first message to the second network, where the second network can forward the message in a second manner, where the second manner is associated with a second ARN identifier corresponding to the first message;

The first message is forwarded in the first network according to a third manner, where the third manner is associated with the first ARN identifier.

In one embodiment, the processing unit 802 is specifically configured to:

Using the fourth information, the first field carrying the first ARN identifier in the first message is set to the second ARN identifier, or the first field carrying the first ARN identifier in the first message is set to the third ARN identifier, and the fourth information represents the correspondence between one or more ARN identifiers associated with the first network and the ARN identifier associated with the second network.

In one embodiment, the receiving unit 801 is further configured to receive the fourth information sent by the control device;

or,

The processing unit 802 is further configured to determine the fourth information through routing learning.

In one embodiment, the processing unit 802 is specifically configured to perform one of the following:

Setting the first field carrying the first ARN identifier in the first message to fifth information to obtain a processed first message, and forwarding the processed first message in a fourth manner within the first network, where the fourth manner is not associated with the ARN, and the fifth information indicates that the first message disables the ARN;

Setting the first field carrying the first ARN identifier in the first message to fifth information to obtain a processed first message, and forwarding the processed first message to the second network, wherein the fifth information indicates that the first message disables the ARN;

The first message is discarded.

In actual application, the receiving unit 801 can be implemented by a communication interface in a message processing device, and the processing unit 802 can be implemented by a processor in the message processing device.

It should be noted that: when the message processing device provided in the above embodiment performs message processing, only the division of the above program units is used as an example. In actual applications, the above processing can be assigned to different program units as needed, that is, the internal structure of the device is divided into different program units to complete all or part of the processing described above. In addition, the message processing device provided in the above embodiment and the message processing method embodiment belong to the same concept, and the specific implementation process is detailed in the method embodiment, which will not be repeated here.

Based on the hardware implementation of the above program modules, and in order to implement the method of the embodiment of the present application, the embodiment of the present application further provides a node, as shown in FIG9 , the node 900 includes:

Communication interface 901, capable of exchanging information with other devices (such as control devices, etc.);

A processor 902, connected to the communication interface 901 to implement information interaction with other devices, and used to execute the method provided by one or more of the above technical solutions when running a computer program;

A memory 903 , on which the computer program is stored.

Specifically, the communication interface 901 is used to:

Receive a first message, where the first message includes a first ARN identifier;

The processor 902 is configured to:

When the first information indicates that the first interface of the node can use the ARN, forwarding-related processing associated with the ARN is performed on the first message at the first interface; or, when the first information indicates that the first interface of the node disables the ARN, forwarding-related processing not associated with the ARN is performed on the first interface.

In one embodiment, the first message further includes second information, where the second information represents a source of the first message; the processor 902 is specifically configured to:

When the first information indicates that the first interface of the node can use the ARN, the second information and the first ARN identifier are verified; after successful verification, the first message is forwarded in accordance with the ARN at the first interface.

In one embodiment, the first message further includes second information, where the second information represents a source of the first message; the processor 902 is specifically configured to:

When the first information indicates that the first interface of the node can use the ARN, verify the second information and the first ARN identifier; if the verification fails, perform forwarding-related processing on the first message not associated with the ARN at the first interface.

In one embodiment, the processor 902 is specifically configured to:

The second information and the first ARN identifier are verified using the third information, wherein the third information represents a correspondence between source information of one or more messages and the ARN identifier.

In one embodiment, the communication interface 901 is further used to receive the third information sent by the control device;

or,

The processor 902 is further configured to determine the third information through routing learning.

In one embodiment, the processor 902 is specifically configured to perform one of the following:

Setting the first field carrying the first ARN identifier in the first message to the second ARN identifier to obtain a processed first message, wherein the second ARN identifier is associated with the second network, and forwarding the processed first message to the second network;

Setting the first field carrying the first ARN identifier in the first message to a third ARN identifier to obtain a processed first message, wherein the third ARN identifier is associated with a first network, and forwarding the processed first message in the first network according to a first manner, wherein the first manner is associated with the third ARN identifier;

Forwarding the first message to the second network, where the second network can forward the message in a second manner, where the second manner is associated with a second ARN identifier corresponding to the first message;

The first message is forwarded in the first network according to a third manner, where the third manner is associated with the first ARN identifier.

In one embodiment, the processor 902 is specifically configured to:

Using the fourth information, the first field carrying the first ARN identifier in the first message is set to the second ARN identifier, or the first field carrying the first ARN identifier in the first message is set to the third ARN identifier, and the fourth information represents the correspondence between one or more ARN identifiers associated with the first network and the ARN identifier associated with the second network.

In one embodiment, the communication interface 901 is further used to receive the fourth information sent by the control device;

or,

The processor 902 is further configured to determine the fourth information through routing learning.

In one embodiment, the processor 902 is specifically configured to perform one of the following:

Setting the first field carrying the first ARN identifier in the first message to fifth information to obtain a processed first message, and forwarding the processed first message in a fourth manner within the first network, where the fourth manner is not associated with the ARN, and the fifth information indicates that the first message disables the ARN;

Setting the first field carrying the first ARN identifier in the first message to fifth information to obtain a processed first message, and forwarding the processed first message to the second network, wherein the fifth information indicates that the first message disables the ARN;

The first message is discarded.

It should be noted that the specific processing process of the processor 902 and the communication interface 901 can be understood by referring to the above method.

Of course, in actual application, the various components in the node 900 are coupled together through the bus system 904. It can be understood that the bus system 904 is used to realize the connection and communication between these components. In addition to the data bus, the bus system 904 also includes a power bus, a control bus and a status signal bus. However, for the sake of clarity, various buses are marked as the bus system 904 in FIG. 9.

The memory 903 in the embodiment of the present application is used to store various types of data to support the operation of the node 900. Examples of such data include: any computer program used to operate on the node 900.

The method disclosed in the above embodiment of the present application can be applied to the processor 902, or implemented by the processor 902. The processor 902 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method can be completed by an integrated logic circuit of the hardware in the processor 902 or an instruction in the form of software. The above-mentioned processor 902 may be a general-purpose processor, a digital signal processor (DSP, Digital Signal Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The processor 902 can implement or execute the various methods, steps and logic block diagrams disclosed in the embodiments of the present application. A general-purpose processor may be a microprocessor or any conventional processor, etc. In combination with the steps of the method disclosed in the embodiment of the present application, it can be directly embodied as a hardware decoding processor to execute, or it can be executed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, which is located in the memory 903, and the processor 902 reads the information in the memory 903 and completes the steps of the above method in combination with its hardware.

In an exemplary embodiment, the node 900 may be implemented by one or more application specific integrated circuits (ASICs), DSPs, programmable logic devices (PLDs), complex programmable logic devices (CPLDs), field programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers (MCUs), microprocessors, or other electronic components to execute the aforementioned method.

It can be understood that the memory (memory 903) of the embodiment of the present application can be a volatile memory or a non-volatile memory, and can also include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a magnetic random access memory (FRAM), a ferromagnetic random access memory, a flash memory, a magnetic surface memory, an optical disc, or a compact disc read-only memory (CD-ROM); the magnetic surface memory can be a disk memory or a tape memory. The volatile memory can be a random access memory (RAM), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), synchronous static random access memory (SSRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDRSDRAM), enhanced synchronous dynamic random access memory (ESDRAM), synchronous link dynamic random access memory (SLDRAM), direct memory bus random access memory (DRRAM). The memory described in the embodiments of the present application is intended to include but is not limited to these and any other suitable types of memory.

In an exemplary embodiment, the present application also provides a storage medium, namely a computer storage medium, specifically a computer-readable storage medium, for example, a memory 903 storing a computer program, and the computer program can be executed by the processor 902 of the node 900 to complete the steps of the aforementioned method. The computer-readable storage medium can be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface storage, optical disk, or CD-ROM.

In an exemplary embodiment, the embodiment of the present application further provides a computer program product, including a computer program, and the computer program can be executed by the processor 902 of the node 900 to complete the steps of the aforementioned method.

It should be noted that: "first", "second", etc. are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

In addition, the technical solutions described in the embodiments of the present application can be combined arbitrarily without conflict.

The above description is only a preferred embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims (15)

1. A message processing method, characterized in that it includes: The first node receives a first message, wherein the first message includes a first application response network identifier, and the first node includes a border node of the first network; When the first information indicates that the first interface of the first node can use the application response network, the first node performs forwarding-related processing associated with the application response network on the first message at the first interface; or, when the first information indicates that the first interface of the first node disables the application response network, the first node performs forwarding-related processing not associated with the application response network on the first message at the first interface. 2. The method according to claim 1 is characterized in that the first message also includes second information, and the second information represents the source of the first message; when the first information represents that the first interface of the first node can use the application response network, the first node verifies the second information and the first application response network identifier; after the verification is successful, the first interface performs forwarding-related processing associated with the application response network on the first message. 3. The method according to claim 1 is characterized in that the first message also includes second information, and the second information represents the source of the first message; when the first information represents that the first interface of the first node can use the application response network, the first node verifies the second information and the first application response network identifier; after the verification fails, the first interface performs forwarding-related processing on the first message that is not associated with the application response network. 4. The method according to claim 2 or 3, characterized in that the verifying the second information and the first application response network identifier comprises: The first node verifies the second information and the first application response network identifier by using the third information, wherein the third information represents the correspondence between the source information of one or more messages and the application response network identifier. 5. The method according to claim 4, characterized in that the method further comprises: The first node receives the third information sent by the control device; or, The first node determines the third information through routing learning. 6. The method according to claim 2 or 3, characterized in that the second information includes one or more of the following: user information of the first message; source address information of the first message; The port information of the first message. 7. The method according to any one of claims 1 to 3, characterized in that the performing forwarding-related processing associated with the application response network on the first message comprises one of the following: The first node sets the first field carrying the first application response network identifier in the first message to the second application response network identifier, obtains a processed first message, the second application response network identifier is associated with the second network, and forwards the processed first message to the second network; The first node sets the first field carrying the first application response network identifier in the first message to a third application response network identifier, obtains a processed first message, the third application response network identifier is associated with the first network, and forwards the processed first message in the first network according to a first manner, the first manner is associated with the third application response network identifier; The first node forwards the first message to the second network, where the second network can forward the message in a second manner, where the second manner is associated with a second application response network identifier corresponding to the first message; The first node forwards the first message in the first network according to a third manner, where the third manner is associated with the first application response network identifier. 8. The method according to claim 7, characterized in that The first node uses the fourth information to set the first field carrying the first application response network identifier in the first message to the second application response network identifier, or to set the first field carrying the first application response network identifier in the first message to the third application response network identifier, wherein the fourth information represents a correspondence between one or more application response network identifiers associated with the first network and an application response network identifier associated with the second network. 9. The method according to claim 8, characterized in that the method further comprises: The first node receives the fourth information sent by the control device; or, The first node determines the fourth information through routing learning. 10. The method according to any one of claims 1 to 3, characterized in that the performing forwarding-related processing on the first message that is not associated with an application response network comprises one of the following: The first node sets the first field carrying the first application response network identifier in the first message to fifth information to obtain a processed first message, and forwards the processed first message in the first network in a fourth manner, wherein the fourth manner is not associated with the application response network, and the fifth information indicates that the first message disables the application response network; The first node sets the first field carrying the first application response network identifier in the first message to fifth information, obtains a processed first message, and forwards the processed first message to the second network, wherein the fifth information indicates that the first message disables the application response network; The first node discards the first message. 11. A message processing device, characterized in that it is arranged at a first node, wherein the first node comprises a border node of a first network, comprising: A receiving unit, configured to receive a first message, wherein the first message includes a first application response network identifier; A processing unit is used to perform forwarding related processing associated with the application response network on the first message at the first interface when the first information indicates that the first interface of the first node can use the application response network, or to perform forwarding related processing not associated with the application response network on the first interface when the first information indicates that the first interface of the first node disables the application response network. 12. A node, characterized in that the node comprises a border node of a first network, comprising: A communication interface, configured to receive a first message, wherein the first message includes a first application response network identifier; A processor is configured to perform forwarding-related processing associated with the application response network on the first message at the first interface when the first information indicates that the first interface of the node can use the application response network, or to perform forwarding-related processing not associated with the application response network on the first interface when the first information indicates that the first interface of the node disables the application response network. 13. A node, comprising: a processor and a memory for storing a computer program that can be run on the processor, Wherein, when the processor is used to run the computer program, it executes the steps of the method described in any one of claims 1 to 10. 14. A storage medium having a computer program stored thereon, wherein the computer program implements the steps of the method according to any one of claims 1 to 10 when executed by a processor. 15. A computer program product, comprising a computer program, characterized in that when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.