Patent Description:
An Ethernet ring consists of a group of devices that are configured with a same virtual local area network (virtual local area network, VLAN), and neighbor devices in the Ethernet ring are connected. For example, refer to <FIG>. It is assumed that there are devices A, B, C, and D. Identifier information of a same VLAN is configured on the devices A, B, C, and D. A connection is established between the device A and the device B, a connection is established between the device B and the device C, a connection is established between the device C and the device D, and a connection is established between the device D and the device A. In this way, the devices A, B, C, and D form an Ethernet ring, and the Ethernet ring can be used to transmit packets of the VLAN.

Devices in a same Ethernet ring are in a same Ethernet. There may be two devices in the Ethernet ring that are not connected by a line, but the two devices may be connected to a third-party network outside the Ethernet. In this way, the two devices may establish a connection in the third-party network, and the two devices are edge devices of the Ethernet ring. For example, refer to <FIG>. A device A and a device D are not connected by a line. The device A and the device D are separately connected to a third-party network, and the device A and the device D establish a connection in the third-party network. In this way, devices A, B, C, and D can also form an Ethernet ring, and the device A and the device D are edge devices of the Ethernet ring.

However, because the connection between the two edge devices is established in the third-party network, a hacker may forge a packet of the Ethernet ring in the third-party network, send the packet to the Ethernet ring through the connection between the two edge devices, and attack the Ethernet ring by using the packet, which results in low security of the Ethernet ring. <CIT> discloses a method applied to a Rapid Ring Protection Protocol (RRPP) ring, wherein a node receiving an RRPP message reads the extended fields in said RRPP message, i.e. the authentication type field, the authentication length field and the authentication key field, and performs the authentication. The document, <NPL>, discloses integration of VLAN and VPN technologies. <CIT> discusses tunnel-based malware detection. <CIT> discusses G. <NUM> misconfiguration detection.

This application provides a packet processing method, apparatus, and system, to improve security of an Ethernet ring. Technical solutions are provided in accordance with the claims.

According to a first aspect, this application provides a packet processing method. In the method, a first device is an edge device of an Ethernet ring, and a second device is a device outside the Ethernet ring. The first device receives a first packet sent by the second device, where the first packet includes identifier information and first authentication information of the Ethernet ring. The first device verifies validity of the first packet based on the identifier information and the first authentication information, and processes the first packet when verifying that the first packet is valid.

Because the first packet includes the identifier information and the first authentication information of the Ethernet ring, the first device verifies the validity of the first packet based on the identifier information and the first authentication information. In a case in which the first packet is a packet that is forged by a hacker to attack the Ethernet ring, because the hacker cannot obtain real authentication information corresponding to the Ethernet ring, the first authentication information in the first packet is different from the real authentication information corresponding to the Ethernet ring. It can be verified that the first packet is invalid based on the identifier information and the first authentication information of the Ethernet ring in the first packet. Therefore, the forged packet used to attack the Ethernet ring is effectively verified, and security of the Ethernet ring is improved.

In a possible implementation, the first device obtains second authentication information of the Ethernet ring based on the identifier information; and verifies the validity of the first packet based on the first authentication information and the second authentication information. Because the second authentication information obtained based on the identifier information is the real authentication information corresponding to the Ethernet ring, the first packet can be accurately verified based on the second authentication information and the first authentication information of the first packet. Not only the verification of the validity of the first packet based on the identifier information and the first authentication information of the Ethernet ring is implemented, but also accuracy of the verification is improved.

In another possible implementation, the first device obtains ring configuration information of the Ethernet ring from a correspondence between identifier information and ring configuration information based on the identifier information. The first device encrypts the ring configuration information to obtain the second authentication information of the Ethernet ring. Because the ring configuration information is encrypted to obtain the second authentication information of the Ethernet ring, it is ensured that the first authentication information in the first packet is also encrypted. In this case, even when the first packet is intercepted by the hacker, the hacker cannot obtain the ring configuration information of the Ethernet, and cannot obtain the real authentication information corresponding to the Ethernet ring. In this way, the security of the Ethernet ring is improved. Further, the second authentication information of the Ethernet ring is obtained based on the identifier information.

In another possible implementation, the first device removes the first authentication information from the first packet, to obtain a second packet; and sends the second packet to a third device in the Ethernet ring. In this way, for the third device that does not have a verification function, the third device that does not have the verification function may not identify the first packet including the first authentication information, but may identify the second packet from which the first authentication information is removed, to ensure that the third device can identify and process the second packet when receiving the second packet. This improves compatibility of the Ethernet ring.

In another possible implementation, the first device obtains a third packet, where the third packet includes the identifier information of the Ethernet ring and the second authentication information of the Ethernet ring; and sends the third packet to a fourth device in the Ethernet ring. Because the third packet includes the identifier information of the Ethernet ring and the second authentication information of the Ethernet ring, it is ensured that the fourth device can perform validity verification on the third packet, to improve the security of the Ethernet ring.

In another possible implementation, the first device receives a fourth packet from a fifth device in the Ethernet ring, where the fourth packet includes the identifier information of the Ethernet ring; obtains the second authentication information of the Ethernet ring based on the identifier information; and adds the second authentication information to the fourth packet to obtain the third packet. Because the second authentication information obtained based on the identifier information is the real authentication information corresponding to the Ethernet ring, it is ensured that the third packet includes the real authentication information corresponding to the Ethernet, and it is ensured that the verification of third packet performed by the fourth device that receives the third packet succeeds.

In another possible implementation, the ring configuration information of the Ethernet ring includes at least one of the following: key information, a ring identifier of the Ethernet ring, a network identifier of a virtual local area network VLAN corresponding to the Ethernet ring, a device identifier of a device included in the Ethernet ring, a maintenance association end point MEP value of the Ethernet ring, and protocol version information corresponding to the Ethernet ring. Because configuration parameters such as key information, VLAN network identifiers, ring identifiers, and MEP values corresponding to different Ethernet rings are different, that is, ring configuration information of different Ethernet rings is different, it is ensured that real authentication information corresponding to different Ethernet rings is different. Therefore, it is ensured that verification of authentication information that is obtained based on the ring configuration information succeeds only for a packet that belongs to the Ethernet ring, which improves verification accuracy.

In another possible implementation, the first packet is an Ethernet ring protection switching ERPS protocol packet. Because the first packet is the ERPS protocol packet, to be specific, the first device performs validity verification on the ERPS protocol packet, a possibility that the hacker attacks the Ethernet by using the ERPS protocol packet is avoided, and the security of the Ethernet ring is improved.

According to a second aspect, this application provides a packet processing apparatus, configured to perform the method according to any one of the first aspect or the possible implementations of the first aspect. Specifically, the apparatus includes units configured to perform the method according to any one of the first aspect or the possible implementations of the first aspect.

According to a third aspect, an embodiment of this application provides a packet processing apparatus, where the apparatus includes: a processor, a memory, and a communications interface. The processor, the memory, and the communications interface may be connected by a bus system. The memory is configured to store one or more programs, and the processor is configured to execute the one or more programs in the memory, to complete the method in any one of the first aspect or the possible implementations of the first aspect.

According to a fourth aspect, this application provides a computer-readable storage medium. The computer-readable storage medium stores a program. When the program is run on a computer, the computer is enabled to perform the method according to any one of the first aspect or the possible implementations of the first aspect.

According to a fifth aspect, this application provides a computer program product including a program. When the computer program product is run on a computer, the computer is enabled to perform the method according to any one of the first aspect or the possible implementations of the first aspect.

According to a sixth aspect, this application provides a packet processing system. The system includes: a first device and a second device, where the first device is an edge device of an Ethernet ring, and the second device is a device outside the Ethernet ring. The second device is configured to send a first packet to the first device, where the first packet includes identifier information and first authentication information of the Ethernet ring. The first device is configured to receive the first packet, verify validity of the first packet based on the identifier information and the first authentication information, and process the first packet when verifying that the first packet is valid. Because the first packet includes the identifier information and the first authentication information of the Ethernet ring, the first device verifies the validity of the first packet based on the identifier information and the first authentication information, to effectively verify a forged packet used to attack the Ethernet ring. The first device processes the first packet when verifying that the packet is valid, which improves security of the Ethernet ring.

The following further describes in detail embodiments of this application with reference to accompanying drawings.

An Ethernet is a computer local area network technology. The Ethernet has various topology structures, one of which is a ring topology. For an Ethernet of the ring structure, a connection may be established between any two neighbor devices in the Ethernet, to form an Ethernet ring. The Ethernet ring is a logical network. The Ethernet ring corresponds to a VLAN and can be used to transmit a packet of the VLAN.

Optionally, the foregoing device is a device configured to transmit a packet, for example, a router, a switch, or access to transmission network (access to transmission network, ATN).

Refer to an Ethernet of a ring structure shown in <FIG>. The Ethernet includes devices <NUM>, <NUM>, <NUM>, and <NUM>. In the Ethernet, two neighbor devices are connected by a physical line. In this way, a connection is established on a physical line between the device <NUM> and the device <NUM>, where the connection is used to connect a first port P <NUM> on the device <NUM> and a first port P21 on the device <NUM>. A connection is established on a physical line between the device <NUM> and the device <NUM>, where the connection is used to connect a second port P22 on the device <NUM> and a first port P31 on the device <NUM>. A connection is established on a physical line between the device <NUM> and the device <NUM>, where the connection is used to connect a second port P32 on the device <NUM> and a first port P41 on the device <NUM>. A connection is established on a physical line between the device <NUM> and the device <NUM>, where the connection is used to connect a second port P42 on the device <NUM> and a second port P12 on the device <NUM>. In this way, an Ethernet ring can be formed.

A same VLAN is configured on the first port P11 and the second port P12 of the device <NUM>, the first port P21 and the second port P22 of the device <NUM>, the first port P31 and the second port P32 of the device <NUM>, and the first port P41 and the second port P42 of the device <NUM>. In this way, the Ethernet ring can be used to transmit a packet of the VLAN.

To prevent a broadcast storm in the Ethernet ring caused by a loop formed by the Ethernet ring, currently, a port on a device in the Ethernet ring may be blocked. The blocked port is referred to as a ring protection link owner (ring protection link owner, RPL owner) port of the Ethernet ring.

For any device in the Ethernet ring, when the device needs to send a packet to another device in the Ethernet ring, the device sends a packet to the another device through a first port of the device, and sends a packet to the another device through a second port of the device. That is, the device sends two packets to the another device. However, because a port in the Ethernet ring is blocked, only one packet can be transmitted to the another device, and transmission of the other packet is interrupted by the port. For example, for the Ethernet ring shown in <FIG>, the second port P32 of the device <NUM> may be blocked. In this way, for any device that needs to send a packet in the Ethernet ring, it is assumed that the device <NUM> needs to send a packet to the device <NUM>, the device <NUM> sends a packet to the device <NUM> through the first port <NUM>, and sends a packet to the device <NUM> through the second port P42. Because the second port P32 of the device <NUM> is blocked, the packet sent from the first port P41 is blocked by the device <NUM>, and the packet sent from the second port P42 is transmitted to the device <NUM>. Therefore, formation of the loop is avoided.

For some Ethernets, there may be two devices in the Ethernet that are not connected by a physical line, but the two devices are connected to a third-party network outside the Ethernet. In this way, the two devices may establish a connection in the third-party network, and devices in the Ethernet may also form an Ethernet ring. The two devices are edge devices in the Ethernet ring. The third-party network can be a wide area network, a physical local area network, or another Ethernet ring.

For example, refer to an Ethernet shown in <FIG>. The Ethernet shown in <FIG> is compared with the Ethernet shown in <FIG>. A device <NUM> and a device <NUM> included in the Ethernet shown in <FIG> are not directly connected by a physical line, but both the device <NUM> and the device <NUM> are connected to a third-party network. In this way, in the third-party network, a connection may be established between the device <NUM> and the device <NUM>. The connection connects a first port P11 of the device <NUM> and a first port P21 of the device <NUM>. In this way, the device <NUM>, the device <NUM>, a device <NUM>, and a device <NUM> can also form an Ethernet ring. The device <NUM> and the device <NUM> are edge devices of the Ethernet ring.

When the third-party network is another Ethernet ring, an edge device of the Ethernet ring is connected to the another Ethernet ring, and a connection is established to the another Ethernet ring. In this case, the Ethernet ring intersects the another Ethernet ring.

The Ethernet ring shown in <FIG> is a closed ring. Any two neighbor devices in the Ethernet ring are connected by a physical line, and the entire Ethernet ring is in the Ethernet. The Ethernet ring shown in <FIG> is a non-closed ring. A part of the Ethernet ring is in the Ethernet, and another part is in the third-party network. In this case, a hacker may forge a packet of the Ethernet ring in the third-party network, send the packet to the Ethernet ring through the connection between the two edge devices, and attack the Ethernet ring by using the packet. To protect the Ethernet ring, when receiving a packet from the third-party network, a device in the Ethernet ring verifies validity of the packet. For a detailed implementation process, refer to a subsequent embodiment shown in <FIG> or <FIG>.

In addition, a plurality of Ethernet rings may be formed in one Ethernet, and different Ethernet rings correspond to different VLANs. That is, for any two neighbor devices in the Ethernet, a connection corresponding to each Ethernet ring is established between the two devices. For either of the two devices, the device includes a port corresponding to each Ethernet ring. The port corresponding to each Ethernet ring is connected to the connection corresponding to each Ethernet ring. A VLAN corresponding to each Ethernet ring is configured on the port corresponding to each Ethernet ring.

A technician may configure the VLAN corresponding to the Ethernet ring on the port of the device. Sometimes, the technician may configure a VLAN corresponding to another Ethernet ring on a port corresponding to an Ethernet ring of the device. In this case, when the device sends a packet in the Ethernet ring, the packet includes a network identifier of the VLAN corresponding to the another Ethernet ring. For other devices in the Ethernet ring, when receiving the packet from the Ethernet ring, the other devices detect that the network identifier of the VLAN in the packet is not a network identifier of the VLAN corresponding to the Ethernet ring, and broadcast the packet in the Ethernet ring. This may cause a broadcast storm in the Ethernet ring. In this case, the embodiment subsequently shown in <FIG> may also be implemented to avoid the broadcast storm in the Ethernet ring.

Before the embodiment subsequently shown in <FIG> or <FIG> is implemented, a correspondence between identifier information and ring configuration information needs to be stored in an edge device of the Ethernet ring, or the correspondence between identifier information and ring configuration information is stored in each device of the Ethernet ring. Any record in the correspondence stores identifier information of an Ethernet ring and ring configuration information of the Ethernet ring.

When the Ethernet ring is formed, for any edge device of the Ethernet ring, the any edge device obtains the identifier information and the ring configuration information of the Ethernet ring, and correspondingly stores the identifier information and the ring configuration information of the Ethernet ring in the correspondence between identifier information and ring configuration information. Alternatively, for any device in the Ethernet, the any device obtains the identifier information and the ring configuration information of the Ethernet ring, and correspondingly stores the identifier information and the ring configuration information of the Ethernet ring in the correspondence between identifier information and ring configuration information.

Optionally, the technician may configure the ring configuration information of the Ethernet ring on the either edge device or the any device, so that the either edge device or the any device obtains the ring configuration information configured by the technician.

Optionally, the identifier information of the Ethernet ring includes at least one of a ring identifier of the Ethernet ring, the network identifier of the VLAN corresponding to the Ethernet ring, and the like. To be specific, the identifier information of the Ethernet ring may be the ring identifier of the Ethernet ring, or the network identifier of the VLAN corresponding to the Ethernet ring, or the identifier information of the Ethernet ring may include the ring identifier of the Ethernet ring and the network identifier of the VLAN corresponding to the Ethernet ring.

A length of the ring identifier of the Ethernet ring may be one or more bytes, for example, may be one byte. A length of the network identifier of the VLAN may be a plurality of bytes, for example, may be two bytes.

The ring configuration information of the Ethernet ring includes at least one of key information, the ring identifier of the Ethernet ring, the network identifier of the VLAN corresponding to the Ethernet ring, and a maintenance association end point (maintenance association end point, MEP) value of the Ethernet ring, protocol version information corresponding to the Ethernet ring, device identifiers of devices included in the Ethernet ring, ring configuration information of the another Ethernet ring intersecting the Ethernet ring, and the like.

Optionally, when the identifier information of the Ethernet ring includes the ring identifier of the Ethernet ring, the ring configuration information corresponding to the identifier information may not include the ring identifier of the Ethernet ring. When the identifier information of the Ethernet ring includes the network identifier of the VLAN corresponding to the Ethernet ring, the ring configuration information corresponding to the identifier information may not include the network identifier of the VLAN corresponding to the Ethernet ring.

Optionally, there are two VLANs corresponding to the Ethernet ring. One VLAN is referred to as a control VLAN. The control VLAN is a VLAN used by a control plane packet in the Ethernet ring, and a packet header of the control plane packet includes a network identifier of the control VLAN. The other VLAN is referred to as a protected VLAN. The protected VLAN is a VLAN used by a data plane packet in the Ethernet ring, and a packet header of the data plane packet includes a network identifier of the protected VLAN. The network identifier of the VLAN includes the network identifier of the control VLAN or the network identifier of the protected VLAN.

The key information may be preset information, and length of the key information may be one or more bytes. For example, the length of the key information may be greater than or equal to <NUM> byte and less than or equal to <NUM> bytes. For example, the length of the key information may be <NUM>, <NUM>, or <NUM> bytes. In addition, key information preset for different Ethernet rings may be different. A length of the network identifier of the control VLAN may be a plurality of bytes, for example, may be two bytes. A length of the network identifier of the protected VLAN may be a plurality of bytes, for example, may be two bytes.

An embodiment of this application provides a packet processing method. The method can be applied to the non-closed Ethernet ring shown in <FIG>. In the method, a first device receives a packet in a third-party network, and verifies validity of the packet. The packet may be sent by a second device. The first device is an edge device of the Ethernet ring, and the second device is another edge device of the Ethernet ring. Refer to <FIG>.

Step <NUM>: The second device obtains a first packet. The first packet includes identifier information and first authentication information of the Ethernet ring, and the second device is another edge device in the Ethernet ring other than the first device.

The second device includes a first port and a second port. The second device is connected to the third-party network through the first port, and is connected to another device in the Ethernet ring through the second port. For example, it is assumed that the second device is a device <NUM> in the Ethernet ring shown in <FIG>. The device <NUM> includes a first port P21 and a second port P22. The device <NUM> is connected to the third-party network through the first port P21, and is connected to a device <NUM> in the Ethernet ring through the second port P22.

Optionally, the first packet may be a control plane packet or a data plane packet of the Ethernet ring. The control plane packet may be an Ethernet ring protection switching (ethernet ring protection switching, ERPS) protocol packet or the like.

The second device obtains the first packet in the following two cases.

In a first case, when the second device needs to send a packet to a device in the Ethernet ring, the second device may obtain the identifier information and the first authentication information of the Ethernet ring, and generate the first packet including the identifier information and the first authentication information of the Ethernet ring.

In the first case, the second device may obtain the identifier information of the Ethernet ring; obtain ring configuration information of the Ethernet ring from a correspondence between identifier information and ring configuration information based on the identifier information of the Ethernet ring; encrypt the ring configuration information by using an encryption algorithm to obtain the first authentication information of the Ethernet ring; and generate the first packet including the identifier information and the first authentication information of the Ethernet ring.

For example, refer to <FIG>. It is assumed that the device <NUM> needs to send a packet to a device <NUM>. The device <NUM> obtains the ring configuration information of the Ethernet ring from the correspondence between identifier information and ring configuration information based on the identifier information of the Ethernet ring; encrypts the ring configuration information by using the encryption algorithm to obtain the first authentication information of the Ethernet ring; and generates the first packet including the identifier information and the first authentication information of the Ethernet ring.

In a second case, the second device receives a second packet from an Ethernet corresponding to the Ethernet ring, where the second packet includes the identifier information of the Ethernet ring; obtains the first authentication information of the Ethernet ring based on the identifier information of the Ethernet ring; and generates the first packet including the identifier information and the first authentication information of the Ethernet ring.

In the second case, the second packet may be sent by another device in the Ethernet ring other than the second device, and the second device may receive the second packet through a second port. The second device may obtain the identifier information of the Ethernet ring from the second packet; obtain the ring configuration information of the Ethernet ring from the correspondence between identifier information and ring configuration information based on the identifier information of the Ethernet ring; encrypt the ring configuration information by using the encryption algorithm to obtain the first authentication information of the Ethernet ring; and generate the first packet including the identifier information and the first authentication information of the Ethernet ring.

Optionally, the second packet may include a VLAN tag (VLAN TAG) field, and the VLAN TAG field includes a network identifier of a VLAN corresponding to the Ethernet ring. After receiving the second packet, the second device obtains, from the VLAN TAG field of the second packet, the network identifier of the VLAN corresponding to the Ethernet ring as the identifier information of the Ethernet ring.

Optionally, the foregoing encryption algorithm may be a message-digest algorithm <NUM> (message-digest algorithm <NUM>, MD5), message authentication code (message authentication code, HMAC) <NUM>, HMAC <NUM>, or the like.

For example, refer to <FIG>. It is assumed that the device <NUM> needs to send the second packet including the identifier information of the Ethernet ring to the device <NUM>. The device <NUM> sends the second packet through a first port P31, and sends the second packet through a second port P32. Because the second port P32 is blocked, the second packet cannot be successfully sent from the second port P32. However, the second packet sent from the first port P31 is transmitted to the device <NUM>, and the device <NUM> receives the second packet through the second port P22. Then the device <NUM> obtains the ring configuration information of the Ethernet ring from the correspondence between identifier information and ring configuration information based on the identifier information of the Ethernet ring included in the second packet; encrypts the ring configuration information by using the encryption algorithm to obtain the first authentication information of the Ethernet ring; and generates the first packet including the identifier information and the first authentication information of the Ethernet ring.

Optionally, the encryption performed by the second device on the ring configuration information by using the encryption algorithm may be:
The second device may select at least one configuration parameter from the ring configuration information to form digest information, and encrypt the digest information by using the encryption algorithm to obtain the first authentication information of the Ethernet ring.

Optionally, the digest information formed by the second device may include two types. A first type of the digest information includes a ring identifier of the Ethernet ring, a network identifier of a control VLAN, and key information.

Optionally, the second device may further obtain a device identifier of a source device of the first packet, and add the device identifier of the source device to the first type of digest information to obtain a second type of the digest information. That is, the device identifier, the ring identifier of the Ethernet ring, the network identifier of the control VLAN, and the key information form the second type of the digest information. The second type of the digest information includes more information than the first type of the digest information, which further improves security of the Ethernet ring.

Optionally, the device identifier may be a media access control (media access control, MAC) address, an Internet protocol (internet protocol, IP) address, or the like.

In the foregoing first case, the source device of the first packet is the second device, and the device identifier that is of the source device of the first packet and that is obtained by the second device is a device identifier of the second device. In the foregoing second case, the second packet includes the device identifier of the source device, and the second device may extract the device identifier of the source device from the second packet.

The second device may further select at least one of a network identifier of a protected VLAN of the Ethernet ring, an MEP value of the Ethernet ring, protocol version information corresponding to the Ethernet ring, and the like. The second type of the digest information may further include at least one of the network identifier of the protected VLAN of the Ethernet ring, the MEP value of the Ethernet ring, the protocol version information corresponding to the Ethernet ring, and the like.

Optionally, refer to a structure of the first packet shown in <FIG>. The first packet includes a maintenance entity group level (maintenance entity group level, MEL) field, a version (Version) field, an operate code (operation code, OpCode) field, a flag (Flag) field, a type length value (type length value, TLVOffset) field, a ring auto protection switching specific information (ring auto protection switching specific information, R-APS specific information) field, an optional TLV (optional TLV) field, and an end TLV (end TLV) field.

Optionally, the end TLV field may include the first authentication information of the Ethernet ring.

Optionally, refer to an end TLV field shown in <FIG>. The end TLV field includes a Type field, a Length field, and a Value field. The Type field may include an authentication indication. The Length field includes a length of the Value field. The Value field includes the first authentication information of the Ethernet ring. The authentication indication is used to indicate that content included in the Value field is first authentication information.

Optionally, the authentication indication may be a value such as 0xFFF0 or 0xFFF1.

Step <NUM>: The second device sends the first packet to the third-party network.

The second device sends the first packet to the third-party network through the first port.

A connection is established between the first port of the second device and a first port of another edge device in the Ethernet ring. For ease of description, the another edge device is referred to as the first device, that is, the connection is established between the first port of the second device and the first port of the first device in the third-party network. After the second device sends the first packet to the third-party network through the first port, the first packet is transmitted to the first port of the first device through the connection.

In the foregoing first case, in addition to sending the first packet to the third-party network through the first port, the second device may further send the first packet to the Ethernet through the second port. The first packet that is sent to the Ethernet may not include the first authentication information of the Ethernet ring.

For example, refer to <FIG>. A connection is established in the third-party network between the first port P21 of the device <NUM> and a first port P11 of a device <NUM>. The device <NUM> sends the first packet to the third-party network through the first port P21, and the first packet is transmitted to the first port P11 of the device <NUM> through the connection. If the first packet is a packet generated by the device <NUM>, that is, in the foregoing first case, the device <NUM> further sends the first packet to the Ethernet through the second port P22. In this case, the device <NUM> in the Ethernet receives the first packet. Because the second port P32 of the device <NUM> is blocked, the device <NUM> stops forwarding the first packet.

Step <NUM>: The first device receives the first packet from the third-party network, and obtains second authentication information of the Ethernet ring based on the identifier information of the Ethernet ring included in the first packet.

The first device includes the first port and a second port. The first device is connected to the third-party network through the first port, and is connected to another device in the Ethernet ring through the second port. For example, it is assumed that the first device is the device <NUM> in the Ethernet ring shown in <FIG>. The device <NUM> includes the first port P11 and the second port P12. The device <NUM> is connected to the third-party network through the first port P11, and is connected to the device <NUM> in the Ethernet ring through the second port P12.

The first device may receive the first packet through the first port; obtain the identifier information of the Ethernet ring from the first packet; obtain the ring configuration information of the Ethernet ring from the correspondence between identifier information and ring configuration information based on the identifier information of the Ethernet ring; and encrypt the ring configuration information by using the encryption algorithm to obtain the second authentication information of the Ethernet ring.

Optionally, the first device may select at least one configuration parameter from the ring configuration information to form digest information, and encrypt the digest information by using the encryption algorithm to obtain the second authentication information of the Ethernet ring.

Optionally, the first device and the second device may agree in advance to select, from the ring configuration information of the Ethernet ring, the configuration parameter that constitutes the digest information. Therefore, in this step, the configuration parameter selected by the first device from the ring configuration information of the Ethernet ring is the same as the configuration parameter selected by the second device from the ring configuration information of the Ethernet ring. In this way, it is ensured that the digest information formed by the first device is the same as the digest information formed by the second device. It is also ensured that the second authentication information obtained through encrypting, by the first device, the digest information formed by the first device is the same as the first authentication information obtained through encrypting, by the second device, the digest information formed by the second device.

Step <NUM>: The first device verifies validity of the first packet based on the first authentication information included in the first packet and the second authentication information of the Ethernet ring.

The first device may obtain the first authentication information from the first packet, and compare the first authentication information with the second authentication information. If the first authentication information and the second authentication information are the same, the first device verifies that the first packet is valid. If the first authentication information and the second authentication information are different, the first device verifies that the first packet is invalid.

When the first device verifies that the first packet is invalid, the first device directly discards the first packet. When the first device verifies that the first packet is valid, the first device performs the following operation in Step <NUM>.

Optionally, refer to <FIG>. The first packet includes the end TLV field, and reads content included in the Type field that is in the end TLV field. If the read content is the authentication indication, the first device determines, based on the authentication indication, that the content included in the Value field that is in the end TLV field is the first authentication information, and reads the first authentication information from the Value field.

Step <NUM>: The first device processes the first packet when the first device verifies that the first packet is valid, or discards the first packet when the first device verifies that the first packet is invalid.

When a destination device of the first packet is the first device, the first device removes the first authentication information from the first packet to obtain the second packet, and a processor of the first device processes the second packet. When the destination device of the first packet is not the first device, the first device removes the first authentication information from the first packet to obtain the second packet, and the first device sends the second packet to the Ethernet through the second port.

The first packet includes a device identifier of the destination device. The first device obtains the device identifier of the destination device from the first packet, and determines whether the destination device is the first device based on the device identifier of the destination device.

For example, it is assumed that the device <NUM> determines that the first packet is valid. Because the first packet is the packet sent by the device <NUM> to the device <NUM> and the device identifier of the destination device included in the first packet is a device identifier of the device <NUM>, the device <NUM> removes the first authentication information from the first packet to obtain the second packet, and sends the second packet to the device <NUM> through the second port P21.

Optionally, the first device may also receive a packet sent by a device outside the Ethernet ring. The packet may be a packet forged by the device outside the Ethernet ring. Because the device cannot obtain real authentication information of the Ethernet ring, when the first device verifies the packet based on the identifier information and the authentication information of the Ethernet ring in the packet, the first device definitely verifies that the packet is invalid, and discards the packet. This prevents the packet from attacking the Ethernet ring.

In the embodiment of this application, the second device is the edge device in the Ethernet ring. When sending the first packet to the third-party network, the second device adds the first authentication information of the Ethernet ring to the first packet. The first device is another edge device in the Ethernet ring. The first device receives the first packet from the third-party network, and obtains the second authentication information of the Ethernet ring based on the identifier information of the Ethernet ring included in the first packet. The first device verifies the validity of the first packet based on the second authentication information of the Ethernet ring and the first authentication information included in the first packet. When the first device verifies that the first packet is valid, the first device processes the first packet. This can effectively prevent a hacker from attacking the Ethernet ring through the third-party network, thereby improving security of the Ethernet ring. When the first device is not the destination device of the first packet, the first device removes the first authentication information from the first packet to obtain the second packet, and sends the second packet to the Ethernet. In this way, when another device that does not support an authentication function in the Ethernet ring receives the second packet, the second packet can be processed, which ensures compatibility with devices that do not support authentication.

An embodiment of this application provides a packet processing method. The method can be applied to a closed Ethernet ring shown in <FIG> or a non-closed Ethernet ring shown in <FIG>. In the method, a first device receives a packet sent to the first device, and verifies validity of the packet. The packet may be a packet sent by a second device. The first device is any device of the Ethernet ring, and the second device is another device of the Ethernet ring. Refer to <FIG>.

Step <NUM>: The second device generates the first packet to be sent to the first device. The first packet includes identifier information and first authentication information of the Ethernet ring, and the second device is any device in the Ethernet ring other than the first device.

Optionally, the first packet may be an Ethernet ring protection switching ERPS protocol packet or the like.

Optionally, when the second device needs to send a packet to the first device, the second device may obtain the identifier information and the first authentication information of the Ethernet ring, and generate the first packet including the identifier information and the first authentication information of the Ethernet ring.

Optionally, the second device may obtain the identifier information of the Ethernet ring; obtain ring configuration information of the Ethernet ring from a correspondence between identifier information and ring configuration information based on the identifier information of the Ethernet ring; encrypt the ring configuration information by using an encryption algorithm to obtain the first authentication information of the Ethernet ring; and generate the first packet including the identifier information and the first authentication information of the Ethernet ring.

Optionally, the encryption performed by the second device on the ring configuration information by using the encryption algorithm may be:.

The second device may select at least one configuration parameter from the ring configuration information to form digest information, and encrypt the digest information by using the encryption algorithm to obtain the first authentication information of the Ethernet ring.

An implementation in which the first device forms digest information is the same as an implementation in which the second device forms the digest information in the embodiment shown in <FIG>.

Optionally, when the identifier information corresponding to the Ethernet ring is a network identifier of a VLAN corresponding to the Ethernet ring, if a technician configures the VLAN corresponding to the Ethernet ring as a VLAN of another Ethernet ring in the second device, ring configuration information that is corresponding to the network identifier of the VLAN and that is stored in the second device is the ring configuration information corresponding to the Ethernet ring. Ring configuration information that is corresponding to the network identifier of the VLAN and that is stored in another device of the Ethernet ring is ring configuration information of the another Ethernet ring.

Optionally, the first packet generated by the second device includes an end TLV field, and the end TLV field may include the first authentication information of the Ethernet ring.

Step <NUM>: The second device sends the first packet to the first device.

In the Ethernet ring, a first port of the second device is connected to one side of the Ethernet ring, and a second port of the second device is connected to the other side of the Ethernet ring. The second device sends the first packet to the first device through the first port, and sends the first packet to the first device through the second port. Because a port of a device in the Ethernet ring is blocked, in the two first packets sent by the second device from the two ports, only one first packet can be successfully transmitted to the first device.

The first packet sent by the second device includes a device identifier of a source device and a device identifier of a destination device.

For another device between the second device and the first device, the another device receives the first packet from one port, determines, based on the device identifier of the destination device included in the first packet, that the first packet is not a packet sent to the another device, and sends the first packet through the other port.

For example, refer to <FIG>. A connection is established in a third-party network between a first port P21 of the device <NUM> and a first port P11 of a device <NUM>. The device <NUM> sends the first packet to the third-party network through the first port P <NUM>, and the first packet is transmitted to the first port P11 of the device <NUM> through the connection. A connection is established between a second port P22 of the device <NUM> and a first port P31 of a device <NUM>. The device <NUM> further sends the first packet to the device <NUM> through the second port P21. The device identifier of the source device included in the first packet sent by the device <NUM> is a device identifier of the device <NUM>, and the device identifier of the destination device included in the first packet sent by the device <NUM> is a device identifier of the device <NUM>.

The device <NUM> receives the first packet through the first port P11, determines, based on the device identifier of the destination device included in the first packet, that the first packet is not a packet sent to the device <NUM>, and sends the first packet to the device <NUM> through the second port P12. Similarly, the device <NUM> receives the first packet through the first port P31, and determines, based on the device identifier of the destination device included in the first packet, that the first packet is not a packet sent to the device <NUM>. Because a second port P32 of the device <NUM> is blocked, the device <NUM> stops sending the first packet.

Step <NUM>: The first device receives the first packet, and obtains second authentication information of the Ethernet ring based on the identifier information of the Ethernet ring included in the first packet.

In this step, the first device receives the first packet; obtains the identifier information of the Ethernet ring from the first packet; obtains the ring configuration information of the Ethernet ring from the correspondence between identifier information and ring configuration information based on the identifier information of the Ethernet ring; and encrypts the ring configuration information by using the encryption algorithm to obtain the second authentication information of the Ethernet ring.

Optionally, the first device may select at least one configuration parameter from the ring configuration information to form the digest information, and encrypt the digest information by using the encryption algorithm to obtain the second authentication information of the Ethernet ring.

Optionally, the devices in the Ethernet ring may agree in advance to select, from the ring configuration information of the Ethernet ring, the configuration parameter that constitutes the digest information. Therefore, in this step, the configuration parameter selected by the first device from the ring configuration information of the Ethernet ring is the same as the configuration parameter selected by the second device from the ring configuration information of the Ethernet ring. In this way, it is ensured that the digest information formed by the first device is the same as the digest information formed by the second device. It is also ensured that the second authentication information obtained through encrypting, by the first device, the digest information formed by the first device is the same as the first authentication information obtained through encrypting, by the second device, the digest information formed by the second device.

The implementation in which the first device forms the digest information is the same as the implementation in which the second device forms the digest information.

Optionally, refer to <FIG>. The first packet includes the end TLV field. The first device reads content included in the Type field that is in the end TLV field. If the read content is the authentication indication, the first device determines, based on the authentication indication, that the content included in the Value field that is in the end TLV field is the first authentication information, and reads the first authentication information from the Value field.

The first device removes the first authentication information from the first packet to obtain a second packet, and a processor of the first device processes the second packet.

For example, it is assumed that the device <NUM> verifies that the first packet is valid. The device <NUM> removes the first authentication information from the first packet to obtain the second packet, and a processor of the device <NUM> processes the second packet.

Optionally, the first device may also receive a packet sent by a device outside the Ethernet ring. The packet may be a packet forged by the device outside the Ethernet ring. Because the device cannot obtain real authentication information of the Ethernet ring, when the first device verifies the packet based on the identifier information and the authentication information of the Ethernet ring in the packet, the first device absolutely determines that the packet is invalid, and discards the packet. This prevents the packet from attacking the Ethernet ring.

Optionally, when the identifier information corresponding to the Ethernet ring is the network identifier of the VLAN corresponding to the Ethernet ring, if a technician configures the VLAN corresponding to the Ethernet ring as a VLAN of another Ethernet ring in the second device, ring configuration information obtained by the first device based on the network identifier of the VLAN is ring configuration information of the another Ethernet ring, and second authentication information of the another Ethernet ring is obtained based on the ring configuration information of the another Ethernet ring. In this case, the second authentication information is different from the first authentication information in the first packet. The first device verifies that the first packet is invalid, and discards the first packet. In this way, broadcasting of the first packet cannot continue in the Ethernet ring, and a broadcast storm is avoided.

In this embodiment of this application, when the second device needs to send the packet to the first device in the Ethernet ring, the second device generates the first packet including the first authentication information of the Ethernet ring, and sends the first packet to the first device in the Ethernet ring. The first device receives the first packet, and obtains the second authentication information of the Ethernet ring based on the identifier information of the Ethernet ring included in the first packet. The first device verifies the validity of the first packet based on the second authentication information of the Ethernet ring and the first authentication information included in the first packet. When the first device verifies that the first packet is valid, the first device processes the first packet. This can effectively prevent a hacker from attacking the Ethernet ring through the third-party network, which improves security of the Ethernet ring.

Refer to <FIG>. An embodiment of this application provides a packet processing apparatus <NUM>. The apparatus <NUM> is an edge device of an Ethernet ring. The apparatus <NUM> may be deployed on the first device in any one of the foregoing embodiments, for example, may be deployed on the first device in the embodiment shown in <FIG> or <FIG>. The apparatus <NUM> includes a receiving unit <NUM> and a processing unit <NUM>.

A second device may generate a first packet including identifier information and first authentication information of the Ethernet ring. The second device is a device outside the Ethernet ring, and sends the first packet to a device in the Ethernet ring.

Because the apparatus <NUM> is the edge device of the Ethernet ring, the receiving unit <NUM> of the apparatus <NUM> receives the first packet.

Then the processing unit <NUM> verifies validity of the first packet based on the identifier information and the first authentication information, and processes the first packet when verifying that the first packet is valid.

Optionally, for a detailed implementation process in which the processing unit <NUM> verifies the validity of the first packet, refer to related content in Step <NUM> in the embodiment shown in <FIG> or Step <NUM> in the embodiment shown in <FIG>.

Optionally, the process in which the processing unit <NUM> verifies the first packet may be: obtaining, based on the identifier information, real authentication information corresponding to the Ethernet ring; using the obtained authentication information as second authentication information; and verifying the validity of the first packet based on the first authentication information and the second authentication information.

Optionally, for a detailed implementation process in which the processing unit <NUM> obtains the second authentication information, refer to related content in Step <NUM> in the embodiment shown in <FIG> or Step <NUM> in the embodiment shown in <FIG>.

For a detailed implementation process in which the processing unit <NUM> verifies the validity of the first packet based on the first authentication information and the second authentication information, refer to related content in Step <NUM> in the embodiment shown in <FIG> or Step <NUM> in the embodiment shown in <FIG>.

Optionally, a process in which the processing unit <NUM> obtains the second authentication information may be: obtaining ring configuration information of the Ethernet ring from a correspondence between identifier information and ring configuration information based on the identifier information; and encrypting some or all configuration parameters included in the ring configuration information, to obtain the real authentication information corresponding to the Ethernet ring, that is, to obtain the second authentication information.

Optionally, for a detailed implementation process in which the processing unit <NUM> encrypts the ring configuration information, refer to related content of encrypting the ring configuration information by the second device in Step <NUM> in the embodiment shown in <FIG> or Step <NUM> in the embodiment shown in <FIG>.

Optionally, the apparatus <NUM> further includes a sending unit <NUM>. When a destination device corresponding to the first packet is a third device on the Ethernet, the processing unit <NUM> removes the first authentication information from the first packet, to obtain a second packet.

The sending unit <NUM> sends the second packet to the third device on the Ethernet.

Optionally, when the apparatus <NUM> needs to send a packet to a fourth device on the Ethernet, the processing unit <NUM> obtains a third packet, where the third packet includes identifier information of the Ethernet ring and the second authentication information of the Ethernet ring.

The sending unit <NUM> sends the third packet to the fourth device on the Ethernet.

Optionally, for a detailed implementation process in which the processing unit <NUM> obtains the third packet, refer to related content of obtaining the first packet by the second device in Step <NUM> in the embodiment shown in <FIG> or Step <NUM> in the embodiment shown in <FIG>.

Optionally, the receiving unit <NUM> receives a fourth packet from a fifth device in the Ethernet ring, where the fourth packet includes the identifier information of the Ethernet ring.

The processing unit <NUM> obtains the second authentication information of the Ethernet ring based on the identifier information; and adds the second authentication information to the fourth packet to obtain the third packet.

Optionally, for the detailed implementation process in which the processing unit <NUM> obtains the second authentication information of the Ethernet ring, refer to related content of obtaining the first authentication information by the second device in Step <NUM> in the embodiment shown in <FIG> or Step <NUM> in the embodiment shown in <FIG>.

Optionally, the ring configuration information of the Ethernet ring includes at least one of the following: key information, a ring identifier of the Ethernet ring, a network identifier of a virtual local area network VLAN corresponding to the Ethernet ring, a device identifier of a device included in the Ethernet ring, a maintenance association end point MEP value of the Ethernet ring, and protocol version information corresponding to the Ethernet ring.

In this embodiment of this application, the receiving unit receives the first packet sent by the second device, where the first packet includes the identifier information and the first authentication information of the Ethernet ring. Then the processing unit verifies the validity of the first packet based on the identifier information and the first authentication information, and processes the first packet when verifying that the first packet is valid. Because the first packet includes the identifier information and the first authentication information of the Ethernet ring, the processing unit verifies the validity of the first packet based on the identifier information and the first authentication information, to effectively verify a forged packet used to attack the Ethernet ring. The processing unit processes the first packet when verifying that the packet is valid. This improves security of the Ethernet ring.

<FIG> is a schematic diagram of a packet processing apparatus <NUM> according to an embodiment of this application. The apparatus <NUM> may be the first device in any one of the foregoing embodiments, for example, may be the first device in the embodiment shown in <FIG> or <FIG>. The apparatus <NUM> includes at least one processor <NUM>, a bus system <NUM>, a memory <NUM>, and at least one communications interface <NUM>.

The apparatus <NUM> is an apparatus of a hardware structure, and may be configured to implement functional modules in the apparatus <NUM> shown in <FIG>. For example, a person skilled in the art may figure out that the processing unit <NUM> in the apparatus <NUM> shown in <FIG> may be implemented by the at least one processor <NUM> by invoking code in the memory <NUM>, and the receiving unit <NUM> and the sending unit <NUM> in the apparatus <NUM> shown in <FIG> may be implemented by the communications interface <NUM>.

Optionally, the processor <NUM> is configured to perform the operation performed by the second device in Step <NUM> and the operations performed by the first device in Step <NUM> to Step <NUM> in the embodiment shown in <FIG>; or perform the operation performed by the second device in Step <NUM> and the operations performed by the first device in Step <NUM> to Step <NUM> in the embodiment shown in <FIG>.

Optionally, the apparatus <NUM> may further be configured to implement a function of the collection analysis device in any one of the foregoing embodiments.

Optionally, the processor <NUM> may be a general-purpose central processing unit (central processing unit, CPU), a network processor (network processor, NP), a microprocessor, an application-specific integrated circuit (application-specific integrated circuit, ASIC), or one or more integrated circuits configured to control program execution of the solutions of this application.

The bus system <NUM> may include a path for transmitting information between the foregoing components.

The communications interface <NUM> is configured to communicate with another device or a communications network.

The memory <NUM> may be a read-only memory (read-only memory, ROM) or another type of static storage device that can store static information and instructions, or a random access memory (random access memory, RAM) or another type of dynamic storage device that can store information and instructions; or may be an electrically erasable programmable read-only memory (electrically erasable programmable read-only memory, EEPROM), a compact disc read-only memory (compact disc read-only memory, CD-ROM) or another optical disc storage, an optical disc storage (including a compressed optical disc, a laser disc, an optical disc, a digital versatile disc, a Bluray disc, or the like), a magnetic disk storage medium or another magnetic storage device, or any other medium that can be configured to carry or store expected program code in a form of an instruction or a data structure and that can be accessed by a computer, but is not limited thereto. The memory may exist independently, and is connected to the processor through a bus. Alternatively, the memory may be integrated with the processor.

The memory <NUM> is configured to store application program code for performing the solutions of this application, and the processor <NUM> controls the execution. The processor <NUM> is configured to execute the application program code stored in the memory <NUM>, to implement functions in the method in this patent.

During specific implementation, in an embodiment, the apparatus <NUM> may include a plurality of processors, for example, the processor <NUM> and a processor <NUM> shown in <FIG>. Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor. Herein, the processor may be one or more devices, circuits, and/or processing cores configured to process data (for example, computer program instructions).

Refer to <FIG>. An embodiment of this application provides a packet processing system <NUM>. The system <NUM> includes:
a first device <NUM> and a second device <NUM>, where the first device <NUM> is an edge device of an Ethernet ring, and the second device <NUM> is a device outside the Ethernet ring.

The second device <NUM> is configured to send a first packet to the first device <NUM>, where the first packet includes identifier information and first authentication information of the Ethernet ring.

The first device <NUM> is configured to receive the first packet, verify validity of the first packet based on the identifier information and the first authentication information, and process the first packet when verifying that the first packet is valid.

In this embodiment of this application, the first device receives the first packet sent by the second device, where the first packet includes the identifier information and the first authentication information of the Ethernet ring. The first device verifies the validity of the first packet based on the identifier information and the first authentication information, and processes the first packet when verifying that the first packet is valid. Because the first packet includes the identifier information and the first authentication information of the Ethernet ring, the first device verifies the validity of the first packet based on the identifier information and the first authentication information, to effectively verify a forged packet used to attack the Ethernet ring. The first device processes the first packet when verifying that the packet is valid, which improves security of the Ethernet ring.

Claim 1:
A packet processing method, wherein the method comprises:
receiving, by a first device, a first packet sent by a second device, wherein the first packet comprises identifier information and first authentication information of an Ethernet ring, the first device is an edge device of the Ethernet ring, and the second device is a device outside the Ethernet ring;
verifying, by the first device, validity of the first packet based on the identifier information and the first authentication information; and
processing, by the first device, the first packet when verifying that the first packet is valid,
wherein the verifying, by the first device, validity of the first packet based on the identifier information and the first authentication information comprises:
obtaining, by the first device, second authentication information of the Ethernet ring based on the identifier information; and
verifying, by the first device, the validity of the first packet based on the first authentication information and the second authentication information,
wherein the obtaining, by the first device, second authentication information of the Ethernet ring based on the identifier information of the Ethernet ring comprises:
obtaining, by the first device, ring configuration information of the Ethernet ring from a correspondence between identifier information and ring configuration information based on the identifier information; and
encrypting, by the first device, the ring configuration information to obtain the second authentication information of the Ethernet ring.