CN102546387B - Method, device and system for processing data message - Google Patents

Abstract

The embodiment of the invention discloses a method, a device and a system for processing a data message, and the method, the device and the system are used for improving the safety of a VPN (virtual private network) data message. The method disclosed by the embodiment of the invention comprises the following steps that: a provider edge (PE) identifies an inner label in the received data message, judges whether the inner label is the same as the label stored in a forwarding table of the PE or not, and forwards the data message if the inner label is the same as the label stored in the forwarding table of the PE.

Description

Method, device and system for processing data message

technical field

The present invention relates to the communication field, in particular to a method, device and system for processing data messages.

Background technique

With the continuous development of Internet services, network security has increasingly become one of the most difficult problems for operators. How to protect the security of customer equipment has become a problem that must be carefully considered in network construction. Devices running on the live network are often attacked by Transmission Control Protocol/Internet Internet Protocol (TCP/IP, Transmission Control Protocol/Internet Protocol) attacks, time-to-live (TTL, TimeTo Live) timeout attacks, Internet Control Message Protocol (ICMP, Internet Control Message Protocol) attacks, Address Resolution Protocol (ARP, Address Resolution Protocol) attacks, etc. Among them, TCP/IP protocol attacks are more serious, how to prevent TCP/IP protocol attacks has become a key issue in network security. The Internet Protocol (IP, Internet Protocol) is connectionless. As long as an interface address on a customer edge device (CE, Customer Edge) is obtained, an attack can be launched against it, which will endanger the operation security of the customer edge device.

In the prior art, an access control list (ACL, Access Control List) rule is configured on an operator's edge device (PE, Provider Edge), and some restrictions are made on IP packets to control a virtual private network (VPN, Virtual Private Network) Traffic, so as to achieve the purpose of protecting user equipment.

However, in the above-mentioned prior art, ACL rules need to be manually configured for processes of different destination addresses, and ACL rules cannot be changed in real time in response to changes in network device planning.

Contents of the invention

The embodiment of the present invention provides a method, device and system for processing data messages, which are used to improve the security of VPN data messages and avoid attacks from illegal data messages.

The data message processing method provided by the embodiment of the present invention includes: the operator edge equipment PE identifies the inner label in the received data message; compares the inner label with the one stored in the forwarding entry of the PE Whether the labels are the same, the forwarding entry is a forwarding entry corresponding to the destination address of the data message; if they are the same, the data message is forwarded.

The data message processing device provided by the embodiment of the present invention includes: an identification unit, configured to identify the inner label in the received data message; a comparison unit, used to compare the inner label identified by the identification unit, with the Whether the labels stored in the forwarding table items of the PEs are the same, the forwarding table items are the forwarding table items corresponding to the destination address of the data message; the forwarding unit is used to forward the comparison results of the comparison unit if the same. datagram.

The data packet processing system provided by the embodiment of the present invention includes: an operator edge device PE, configured to identify the inner label in the received data packet; compare the identified inner label with the translation of the PE Whether the tags stored in the posting items are the same, the forwarding table item is the forwarding table item corresponding to the destination address of the data message; if they are the same, the data message is forwarded; the client side equipment CE is used to receive the PE sent datagrams.

It can be seen from the above technical solutions that the embodiments of the present invention have the following advantages: the PE identifies the inner label in the received data message, and compares it with the label stored in the forwarding entry of the PE. If the comparison results are the same, it means The inner label in the data packet was previously sent by the PE, so the received data packet is a secure data packet, forwarding the data packet to the destination CE can improve the security of the VPN data packet and avoid illegal packets s attack.

Description of drawings

Figure 1 is a schematic diagram of the connection of each device in the VPN network;

FIG. 2 is a schematic diagram of an embodiment of a data packet processing method in an embodiment of the present invention;

FIG. 3 is a schematic diagram of another embodiment of a data packet processing method in an embodiment of the present invention;

FIG. 4 is a schematic diagram of an embodiment of a device for processing data packets in an embodiment of the present invention;

FIG. 5 is a schematic diagram of another embodiment of a device for processing data packets in an embodiment of the present invention;

FIG. 6 is a schematic diagram of an embodiment of a data packet processing system in an embodiment of the present invention.

Detailed ways

The embodiment of the present invention provides a data message processing method, device and system, which are used to quickly detect data messages in a virtual private network and ensure the security of VPN data messages.

For ease of understanding, the following briefly introduces the process of illegal attacks in the VPN network. Please refer to Figure 1. CE1 is the client-side device of PE1, CE2 is the client-side device of PE2, and PE1 and PE2 are connected through the backbone network core device P (Provider) .

When CE1 is going to access the client-side device of remote PE2, for example, when CE1 accesses CE2, PE1 needs to send CE1’s VPN routing information to PE2. The VPN routing information is uniformly distributed by the service provider. In the VPN routing information Carry the routing label. After receiving the VPN routing information, PE2 adds the inner layer label of the data packet according to the routing label carried in the VPN routing information, and then sends the data packet to PE1, and PE1 forwards it to CE1.

If CE1 only accesses other client-side devices directly connected to PE1, PE1 does not need to send CE1’s VPN routing information to PE2. After the data packet is forwarded to CE1 according to the VPN routing information in it, but the VPN routing information is not sent from PE1 to PE2, so this illegal data packet will cause attacks on both PE1 and CE1.

The following describes the processing method of the data message provided by the embodiment of the present invention. In the embodiment of the present invention, the PE can be a router or a switch. The principles of the two are similar. For the convenience of description, this embodiment takes the PE as a router as an example. Note that it can be understood that the type of PE does not constitute a limitation to the present invention.

Referring to Fig. 2, an embodiment of the processing method of the data message in the embodiment of the present invention comprises:

201. The PE identifies the inner label in the received data packet;

After receiving the data packet, the PE identifies the inner label in the data packet.

For a specific example, refer to FIG. 1 , assuming that PE1 receives the data packet sent by PE2, and identifies the inner label in the data packet.

202. Compare whether the identified inner label is the same as the label stored in the forwarding entry of the PE;

The PE compares and identifies whether the inner layer label is the same as the label stored in the forwarding table entry of the PE, wherein the forwarding table entry is a forwarding table entry corresponding to the destination address of the data message.

In the network, the service provider assigns an inner label to each virtual private network (VPN, Virtual Private Network), which is used to distinguish different routes. PE includes the control plane and the forwarding plane. Inside the PE, the inner label is assigned by the control plane. Send it to the forwarding plane, and carry the inner label in the forwarding table of the forwarding plane.

If the identified inner label is the same as the label stored in the forwarding entry of the PE, step 203 is executed.

203. If they are the same, forward the data packet.

If the identified inner layer label is the same as the label stored in the forwarding entry of the PE, the PE forwards the data packet.

Referring to Figure 1, if PE1 receives the data packet sent by PE2, identifies the inner layer label in the data packet, and compares it with the label stored in the forwarding entry of PE1, and the comparison result is the same, it means that the data packet contains The inner layer label of PE1 was previously sent to PE2, then the received data packet is a security data packet, and the data packet is forwarded to the destination user edge device CE1.

In this embodiment, the PE identifies the inner label in the received data message, and compares it with the label stored in the forwarding entry of the PE. If the comparison results are the same, it means that the inner label in the data message is the previous one. If it is sent by the PE, the received data packet is a secure data packet, and forwarding the data packet to the destination CE can ensure the security of the VPN data packet and avoid the attack of illegal packets.

For ease of understanding, the following describes in detail the processing method of the data message in the embodiment of the present invention in another embodiment. Please refer to FIG. 3. Another embodiment of the processing method of the data message in the implementation of the present invention includes:

301. The PE identifies the inner label in the received data packet;

After receiving the data packet, the PE identifies the inner label in it.

For a specific example, continue to refer to FIG. 1 , assuming that PE1 receives the data packet sent by PE2, and identifies the inner label in the data packet.

302. Compare whether the identified inner label is the same as the label stored in the forwarding entry of the PE;

The PE compares and identifies whether the internal label is the same as the label stored in the forwarding entry of the PE. If they are the same, the data packet is forwarded to the destination CE. If not, step 303 is performed.

303. If different, count and sample the data packets, and report the sampled information;

If the PE compares the identified inner label with the label stored in the PE forwarding entry, if the inner label is different from the label stored in the PE forwarding entry, the data packet is determined to be an illegal data packet, Count the data packets, and record the number of received illegal data packets. The recorded illegal data packets are sampled and reported to the upper management device for alarming.

Please continue to refer to Figure 1. PE1 receives the data packet sent by PE2, identifies the inner label in the data packet, and compares it with the label stored in the forwarding entry of PE1. If the comparison result is different, it means that the data packet If the inner label in the label is not sent from PE1 to PE2, if the received data packet is an illegal data packet, there is no need to continue forwarding. At this time, count the data packet and record the number of illegal data packets received. The number of times, and the data packet is sampled and reported to the upper management device for alarm.

304. Discard the data packet.

Determine the data message as an illegal data message, count the data message, record the number of times the illegal data message is received, sample the recorded illegal data message, and report it to the upper management device for alarm , discarding the data packet.

It should be noted that, in this embodiment, counting and sampling data packets, and reporting the sampled information to the upper management device may be performed before discarding illegal data packets or after discarding illegal data packets. The order in which the steps are executed does not affect the implementation of the technical solution of the present invention.

In the embodiment of the present invention, if the inner layer label of the received data message identified by the PE is different from the label stored in the forwarding entry of the PE, it means that the data message is an illegal data message, which does not need to be forwarded and can be Discard the data message, count the data message before discarding the data message, record the number of times the illegal data message is received, and sample the data message and report it to the upper management device for alarming, thereby Intercept attacks of illegal data packets to ensure the security of data packets in the VPN.

The above is the processing method of the data message provided by the embodiment of the present invention. The following describes the processing device of the data message in the embodiment of the present invention. Please refer to FIG. 4, the processing device of the data message in the embodiment of the present invention One embodiment includes:

An identification unit 401, a comparison unit 402, and a forwarding unit 403;

Wherein, the identification unit 401 is used to identify the inner label in the received data message;

A comparison unit 402, configured to compare whether the inner label identified by the identification unit is the same as the label stored in the forwarding entry of the PE;

The forwarding unit 403 is configured to forward the data message if the comparison results of the comparing unit are the same.

In this embodiment, after the PE receives the data message, the identification unit 401 identifies the inner layer label in the data message, and the comparison unit 402 compares whether the inner layer label identified by the identification unit is the same as the label stored in the forwarding entry of the PE. , if the comparison results are the same, it means that the inner label in the received data packet was sent by the PE before, then the received data packet is a secure data packet, and the forwarding unit forwards the data packet to the destination CE. Ensure the security of VPN data packets and avoid illegal packet attacks.

For ease of understanding, the following describes in detail the processing device of the data message in the embodiment of the present invention in another embodiment. Please refer to FIG. 5. Another embodiment of the processing device of the data message in the implementation of the present invention includes:

Identification unit 401, comparison unit 402, processing unit 503, counting unit 504, reporting unit 505;

Wherein, the identification unit 401 is used to identify the inner label in the received data message;

A comparison unit 402, configured to compare whether the inner label identified by the identification unit is the same as the label stored in the forwarding entry of the PE;

The processing unit 503 is configured to discard the data packet if the inner label identified by the identification unit 401 is different from the label stored in the forwarding entry of the PE.

It should be noted that, in this embodiment, the processing unit 503 may further include:

A counting unit 5031, configured to count the data packets;

The reporting unit 5032 is configured to sample the data message and report the sampled information;

The discarding unit 5033 is configured to discard the data packet.

It should be noted that, in this embodiment, the counting unit 5031 counts the data packets, the reporting unit 5032 samples the data packets, and reports the sampled information to the upper management device, and discards the illegal data packets at the discarding unit 5033 before the packet, or after the discarding unit 5033 discards the illegal data packet.

In this embodiment, the identification unit 401 identifies the inner label in the data packet received by the PE, and the comparison unit 402 is used to compare whether the inner label identified by the identification unit is the same as the label stored in the forwarding entry of the PE, if If they are not the same, it means that the inner layer label in the data message was not sent by the PE before, and the received data message is an illegal data message, so there is no need to continue forwarding, and the data message will be discarded by the processing unit 503. Before discarding the data message, the counting unit 504 counts the data message, and records the number of times the illegal data message is received, and the reporting unit 505 samples the data message to be discarded, and reports it to the upper management device for Alarms are issued to block attacks from illegal data packets and ensure the security of data packets in the VPN.

For the specific process of realizing the functions of all the devices in the above embodiments, please refer to the specific description content of the embodiments shown in FIG. 2 and FIG. 3 , which will not be repeated here.

The following describes the processing system of the data message in the embodiment of the present invention, please refer to FIG. 6, an embodiment of the processing system of the data message in the embodiment of the present invention includes:

Operator edge equipment PE601, customer side equipment CE602;

Among them, PE601 is used to identify the inner layer label in the received data message; compare whether the identified inner layer label is the same as the label stored in the forwarding table item of PE601, and the forwarding table item is the forwarding table corresponding to the destination address of the data message items; if they are the same, forward the data message;

It should be noted that PE601 is also used to discard the data packet if the inner layer label is different from the label stored in the forwarding entry of PE601.

Specifically, PE601 is used to count the data packets if the inner layer label is different from the label stored in the forwarding entry of PE601; sample the data packets and report the sampled information; discard the data packets arts;

CE602 is used to receive data packets sent by PE601.

Those skilled in the art can understand that all or part of the steps in the method of the above-mentioned embodiments can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, the above-mentioned storage medium It can be read-only memory, disk or CD-ROM, etc.

The method, device and system for processing a data message provided by the present invention have been introduced in detail above. For those skilled in the art, according to the idea of the embodiment of the present invention, there will be changes in the specific implementation and application scope. In summary, the content of this specification should not be construed as limiting the present invention.

Claims (6)

1. a processing method for data message, is characterized in that, comprising:

Provider edge equipment PE identifies the vpn label in the data message received;

Whether more described vpn label is identical with the label preserved in the forwarding-table item of described PE, and described forwarding-table item is the forwarding-table item that described data message destination address is corresponding;

If identical, then represent that described vpn label is that described PE sends, forward described data message;

Described method also comprises:

If described vpn label is different from the label preserved in the forwarding-table item of described PE, then represents that described vpn label is not that described PE sends, abandon described data message.

2. method according to claim 1, is characterized in that, if described vpn label is different from the label preserved in the forwarding-table item of described PE, then abandons described data message and comprises:

If described vpn label is different from the label preserved in the forwarding-table item of described PE, then described data message is counted;

Described data message is sampled, and reports the information after sampling;

Abandon described data message.

3. a processing unit for data message, is characterized in that, comprising:

Recognition unit, for identifying the vpn label in the data message that receives;

Comparing unit, whether for the described vpn label of relative discern unit identification, identical with the label preserved in the forwarding-table item of described PE, described forwarding-table item is the forwarding-table item that described data message destination address is corresponding;

Retransmission unit, if identical for the comparative result of comparing unit, then represent that described vpn label is that described PE sends, forwards described data message;

Described device also comprises:

Processing unit, if different from the label preserved in the forwarding-table item of described PE for described vpn label, then represent that described vpn label is not that described PE sends, abandons described data message.

4. device according to claim 3, is characterized in that, described processing unit comprises:

Counting unit, for counting described data message;

Reporting unit, for being sampled by described data message, and reporting the information after sampling;

Discarding unit, for abandoning described data message.

5. a treatment system for data message, is characterized in that, comprising:

Provider edge equipment PE, for identifying the vpn label in the data message that receives; Whether the described vpn label of relative discern is identical with the label preserved in the forwarding-table item of described PE, and described forwarding-table item is the forwarding-table item that described data message destination address is corresponding; If identical, then represent that described vpn label is that described PE sends, forward described data message;

Client-side device CE, for receiving the data message that described PE sends;

Described PE also for, if described vpn label is different from the label preserved in the forwarding-table item of described PE, then represents that described vpn label is not that described PE sends, abandon described data message.

6. system according to claim 5, is characterized in that,

Described PE also for, if described vpn label is different from the label preserved in the forwarding-table item of described PE, then described data message is counted; Described data message is sampled, and reports the information after sampling; Abandon described data message.