Packet processing method and apparatus
AssigneeHuawei Technologies Co., Ltd.
InventorsYanping Xu, Liang Xia, Xiaohui Tong
Life of this patent
Estimating the term…
Abstract
A packet processing method and apparatus are provided. The method includes: on a forwarding path of an IPv6 packet, a key node (for example, a firewall) signs a packet, and a downstream apparatus of the key node verifies the signature, to determine whether the packet passes through the key node in a forwarding process. According to this application, the key node performs checking, to effectively prevent a packet which packet header is modified by attackers from bypassing the key node.
Claims20
A packet processing method, performed by a first communication apparatus, and the method comprising:
- obtaining a first internet protocol version 6 (IPv6) packet, wherein a packet header of the first IPV6 packet comprises a first signature, and the first signature is for verifying whether the first IPv6 packet passes through a second communication apparatus in a forwarding process;
- forwarding the first IPV6 packet;
- wherein the first signature which is determined by fixed-length data in payloads of the first IPv6 packet uniquely identifies the first IPV6 packet, and is different from signatures of other IPv6 packets;
- and
- wherein the first signature is obtained by performing hash calculation based on first content in the first IPV6 packet, and the first content comprises the fixed-length data in the payload and anti-replay attack check information.
A packet processing method, performed by a first communication apparatus, and the method comprising:
- receiving a first internet protocol version 6 (IPv6) packet, wherein the first IPv6 packet comprises a first signature, and the first signature is for verifying whether a forwarding path of the first IPV6 packet passes through a second communication apparatus;
- verifying the first signature, and processing the first IPV6 packet based on a verification result;
- wherein the first signature which is determined by fixed-length data in payloads of the first IPv6 packet uniquely identifies the first IPv6 packet and is different from signatures of other IPv6 packets;
- and
- wherein the first signature is obtained by performing hash calculation based on first content in the first IPV6 packet, and the first content comprises the fixed-length data in the payload and anti-replay attack check information.
Dependencies are inferred from the claim text.