# US 12,224,978 B2 · Packet processing method and apparatus > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,224,978 B2 - Document ID: US12224978B2 - Status: Granted - Kind: B2 - Application number: 18/315,365 - Filed: 2023-05-10 - Published: 2023-09-07 - Granted: 2025-02-11 - Earliest claimed: 2020-11-11 - Assignees: Huawei Technologies Co., Ltd. - Applicants: Huawei Technologies Co., Ltd. - Inventors: Yanping Xu; Liang Xia; Xiaohui Tong - Web page: https://patentgrep.com/patent/US12224978B2 ## CPC - H04L 61/5007: Internet protocol [IP] addresses - H04L 63/123: {received data contents, e.g. message integrity} - H04L 9/3247: {involving digital signatures} - H04L 63/0227: {Filtering policies (mail message filtering H04L51/212)} - H04L 63/126: {the source of the received data} - H04L 63/1416: {Event detection, e.g. attack signature detection} - H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)} - H04L 63/0442: {wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption (cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30)} - H04L 63/1466: {Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks} - H04L 69/16: Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP] - H04L 2101/659: Internet protocol version 6 [IPv6] addresses - H04L 2463/121: Timestamp - H04L 2463/146: Tracing the source of attacks - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) ## Abstract A packet processing method and apparatus are provided. The method includes: on a forwarding path of an IPv6 packet, a key node (for example, a firewall) signs a packet, and a downstream apparatus of the key node verifies the signature, to determine whether the packet passes through the key node in a forwarding process. According to this application, the key node performs checking, to effectively prevent a packet which packet header is modified by attackers from bypassing the key node. ## Claims ### Claim 1 A packet processing method, performed by a first communication apparatus, and the method comprising: obtaining a first internet protocol version 6 (IPv6) packet, wherein a packet header of the first IPV6 packet comprises a first signature, and the first signature is for verifying whether the first IPv6 packet passes through a second communication apparatus in a forwarding process; forwarding the first IPV6 packet; wherein the first signature which is determined by fixed-length data in payloads of the first IPv6 packet uniquely identifies the first IPV6 packet, and is different from signatures of other IPv6 packets; and wherein the first signature is obtained by performing hash calculation based on first content in the first IPV6 packet, and the first content comprises the fixed-length data in the payload and anti-replay attack check information. ### Claim 2 (depends on 1) The method according to claim 1, wherein the first IPV6 packet is a segment routing internet protocol version 6 (SRv6) packet. ### Claim 3 (depends on 2) The method according to claim 2, wherein the first signature is comprised in a segment routing header (SRH). ### Claim 4 (depends on 3) The method according to claim 3, wherein the SRH comprises an extended type length value (TLV) field, and the extended TLV field comprises the first signature. ### Claim 5 (depends on 1) The method according to claim 1, wherein the packet header further comprises the anti-replay attack check information. ### Claim 6 (depends on 1) The method according to claim 1, wherein the packet header further comprises first indication information, and the first indication information indicates at least one type of the anti-replay attack check information comprised in the first content. ### Claim 7 (depends on 5) The method according to claim 5, wherein the anti-replay attack check information comprises one or more of the following: a packet sequence number, a timestamp, and a random number. ### Claim 8 (depends on 1) The method according to claim 1, wherein the packet header further comprises second indication information, and the second indication information indicates a type of the second communication apparatus. ### Claim 9 (depends on 1) The method according to claim 1, wherein the first communication apparatus and the second communication apparatus are a same apparatus, and the obtaining the first IPv6 packet comprises: generating the first signature based on a first private key of the second communication apparatus. ### Claim 10 (depends on 1) The method according to claim 1, wherein the first communication apparatus is a downstream apparatus of the second communication apparatus on a forwarding path of the first IPV6 packet, and before the forwarding the first IPV6 packet, the method further comprises: verifying the first signature based on a first public key of the second communication apparatus. ### Claim 11 (depends on 10) The method according to claim 10, further comprising: receiving the first public key sent by a control management entity. ### Claim 12 A packet processing method, performed by a first communication apparatus, and the method comprising: receiving a first internet protocol version 6 (IPv6) packet, wherein the first IPv6 packet comprises a first signature, and the first signature is for verifying whether a forwarding path of the first IPV6 packet passes through a second communication apparatus; verifying the first signature, and processing the first IPV6 packet based on a verification result; wherein the first signature which is determined by fixed-length data in payloads of the first IPv6 packet uniquely identifies the first IPv6 packet and is different from signatures of other IPv6 packets; and wherein the first signature is obtained by performing hash calculation based on first content in the first IPV6 packet, and the first content comprises the fixed-length data in the payload and anti-replay attack check information. ### Claim 13 (depends on 12) The method according to claim 12, further comprising: discarding the first IPV6 packet in response to a failure of the verification. ### Claim 14 (depends on 12) The method according to claim 12, wherein the first IPV6 packet is a segment routing internet protocol version 6 (SRv6) packet. ### Claim 15 (depends on 14) The method according to claim 14, wherein the first signature is comprised in a segment routing header (SRH). ### Claim 16 (depends on 15) The method according to claim 15, wherein the SRH comprises an extended type length value (TLV) field, and the extended TLV field comprises the first signature. ### Claim 17 (depends on 12) The method according to claim 12, wherein the packet header further comprises the anti-replay attack check information. ### Claim 18 (depends on 12) The method according to claim 12, wherein the packet header further comprises first indication information, and the first indication information indicates at least one type of the anti-replay attack check information comprised in the first content. ### Claim 19 (depends on 17) The method according to claim 17, wherein the anti-replay attack check information comprises one or more of the following: a packet sequence number, a timestamp, and a random number. ### Claim 20 (depends on 12) The method according to claim 12, wherein the packet header further comprises second indication information, and the second indication information indicates a type of the second communication apparatus.