# US 12,113,806 B2 · Packet processing method, apparatus, and system > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,113,806 B2 - Document ID: US12113806B2 - Status: Granted - Kind: B2 - Application number: 17/749,647 - Filed: 2022-05-20 - Published: 2022-09-08 - Granted: 2024-10-08 - Earliest claimed: 2019-11-22 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Wenfeng Zhou - Web page: https://patentgrep.com/patent/US12113806B2 ## CPC - H04L 12/437: Ring fault isolation or reconfiguration {(for SDH/SONET ring networks H04J3/085)} - H04L 12/4637: {Interconnected ring systems} - H04L 12/4641: {Virtual LANs, VLANs, e.g. virtual private networks [VPN] (LAN interconnection over a bridge based backbone H04L12/462; encapsulation techniques H04L12/4633; routing of packets H04L45/00; packet switches H04L49/00; virtual private networks for security H04L63/0272)} - H04L 12/4683: {characterized by the protocol used} - H04L 63/0876: {based on the identity of the terminal or configuration, e.g. MAC address, hardware or software configuration or device fingerprint} - H04L 63/126: {the source of the received data} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract This application discloses a packet processing method, apparatus, and system, and belongs to the communications field. In the packet processing method, a first device receives a first packet sent by a second device. The first packet includes identifier information and first authentication information of an Ethernet ring. The first device is an edge device of the Ethernet ring, and the second device is a device outside the Ethernet ring. The first device verifies the validity of the first packet based on the identifier information and the first authentication information. The first device processes the first packet after verifying that the first packet is valid. This method improves the security of Ethernet ring networks. ## Claims ### Claim 1 A packet processing method, comprising: receiving, by a first device, a first packet sent by a second device, wherein the first packet comprises identifier information and first authentication information of an Ethernet ring, the first device is an edge device of the Ethernet ring, and the second device is a device outside the Ethernet ring, wherein the first packet includes a type length value field which includes a type field, a length filed and a value field, and the type field includes an authentication indication, the length field includes a length of the value field, and the value field includes the first authentication information; verifying, by the first device, validity of the first packet based on the identifier information and the first authentication information; and processing, by the first device, the first packet after verifying that the first packet is valid. ### Claim 2 (depends on 1) The method according to claim 1, wherein the verifying, by the first device, validity of the first packet based on the identifier information and the first authentication information comprises: obtaining, by the first device, second authentication information of the Ethernet ring based on the identifier information; and verifying, by the first device, the validity of the first packet based on the first authentication information and the second authentication information. ### Claim 3 (depends on 2) The method according to claim 2, the obtaining, by the first device, second authentication information of the Ethernet ring based on the identifier information of the Ethernet ring comprises: obtaining, by the first device, ring configuration information of the Ethernet ring from a correspondence between identifier information and ring configuration information based on the identifier information; and encrypting, by the first device, the ring configuration information to obtain the second authentication information of the Ethernet ring. ### Claim 4 (depends on 1) The method according to claim 1, wherein the processing, by the first device, the first packet comprises: removing, by the first device, the first authentication information from the first packet to obtain a second packet; and sending, by the first device, the second packet to a third device in the Ethernet ring. ### Claim 5 (depends on 1) The method according to claim 1, wherein the method further comprises: obtaining, by the first device, a third packet, wherein the third packet comprises the identifier information of the Ethernet ring and second authentication information of the Ethernet ring; and sending, by the first device, the third packet to a fourth device in the Ethernet ring. ### Claim 6 (depends on 5) The method according to claim 5, wherein the obtaining, by the first device, a third packet comprises: receiving, by the first device, a fourth packet from a fifth device in the Ethernet ring, wherein the fourth packet comprises the identifier information of the Ethernet ring; obtaining, by the first device, the second authentication information of the Ethernet ring based on the identifier information; and adding, by the first device, the second authentication information in the fourth packet to obtain the third packet. ### Claim 7 (depends on 3) The method according to claim 3, wherein the ring configuration information of the Ethernet ring comprises at least one of the following: key information, a ring identifier of the Ethernet ring, a network identifier of a virtual local area network corresponding to the Ethernet ring, a device identifier of a device comprised in the Ethernet ring, a maintenance association end point value of the Ethernet ring, and protocol version information corresponding to the Ethernet ring. ### Claim 8 (depends on 1) The method according to claim 1, wherein the authentication indication is used to indicate that content included in the value field is the first authentication information. ### Claim 9 A packet processing apparatus, wherein the apparatus comprises: a memory storing instructions; and a processor coupled to the memory to execute the instructions to: receive a first packet sent by a second device, wherein the first packet comprises identifier information and first authentication information of an Ethernet ring, the packet processing apparatus is an edge device of the Ethernet ring, and the second device is a device outside the Ethernet ring, wherein the first packet includes a type length value field which includes a type field, a length filed and a value field, and the type field includes an authentication indication, the length field includes a length of the value field, and the value field includes the first authentication information; verify validity of the first packet based on the identifier information and the first authentication information; and process the first packet after verifying that the first packet is valid. ### Claim 10 (depends on 9) The apparatus according to claim 9, wherein the processor is coupled to the memory to further execute the instructions to: obtain second authentication information of the Ethernet ring based on the identifier information; and verify the validity of the first packet based on the first authentication information and the second authentication information. ### Claim 11 (depends on 10) The apparatus according to claim 10, wherein the processor is coupled to the memory to further execute the instructions to: obtain ring configuration information of the Ethernet ring from a correspondence between identifier information and ring configuration information based on the identifier information; and encrypt the ring configuration information to obtain the second authentication information of the Ethernet ring. ### Claim 12 (depends on 9) The apparatus according to claim 9, wherein the processor is coupled to the memory to further execute the instructions to: remove the first authentication information from the first packet to obtain a second packet; and send the second packet to a third device in the Ethernet ring. ### Claim 13 (depends on 9) The apparatus according to claim 9, wherein the processor is coupled to the memory to further execute the instructions to: obtain a third packet, wherein the third packet comprises the identifier information of the Ethernet ring and second authentication information of the Ethernet ring; and send the third packet to a fourth device in the Ethernet ring. ### Claim 14 (depends on 13) The apparatus according to claim 13, wherein the processor is coupled to the memory to execute the instructions to: receive a fourth packet from a fifth device in the Ethernet ring, wherein the fourth packet comprises the identifier information of the Ethernet ring; and obtain the second authentication information of the Ethernet ring based on the identifier information, and add the second authentication information to the fourth packet to obtain the third packet. ### Claim 15 (depends on 11) The apparatus according to claim 11, wherein the ring configuration information of the Ethernet ring comprises at least one of the following: key information, a ring identifier of the Ethernet ring, a network identifier of a virtual local area network corresponding to the Ethernet ring, a device identifier of a device comprised in the Ethernet ring, a maintenance association end point value of the Ethernet ring, and protocol version information corresponding to the Ethernet ring. ### Claim 16 (depends on 9) The apparatus according to claim 9, wherein the authentication indication is used to indicate that content included in the value field is the first authentication information. ### Claim 17 A packet processing system, comprising a first device and a second device, wherein the first device is an edge device in an Ethernet ring, the second device is a device outside the Ethernet ring, the second device is configured to send a first packet to the first device, and the first packet comprises identifier information and first authentication information of the Ethernet ring, wherein the first packet includes a type length value field which includes a type field, a length filed and a value field, and the type field includes an authentication indication, the length field includes a length of the value field, and the value field includes the first authentication information; and the first device is configured to receive the first packet, and verify validity of the first packet based on the identifier information and the first authentication information, and process the first packet after verifying that the first packet is valid. ### Claim 18 (depends on 17) The packet processing system of claim 17, wherein the first device is further configured to: obtain ring configuration information of the Ethernet ring from a correspondence between identifier information and ring configuration information based on the identifier information; encrypt the ring configuration information to obtain second authentication information of the Ethernet ring; and verify the validity of the first packet based on the first authentication information and the second authentication information. ### Claim 19 (depends on 18) The packet processing system of claim 18, wherein the first device is further configured to: obtain a third packet, wherein the third packet comprises the identifier information of the Ethernet ring and the second authentication information of the Ethernet ring; and send the third packet to a fourth device in the Ethernet ring. ### Claim 20 (depends on 17) The packet processing system of claim 17, wherein the authentication indication is used to indicate that content included in the value field is the first authentication information.