CN105656791A - TLV (Type Length Value) sending method and system - Google Patents

Abstract

The invention discloses a TLV sending method, comprising: receiving an LLDP message sent by a directly connected device, and verifying the security of the directly connected device according to the LLDP message; if the verification is passed, then according to the LLDP The message determines the type of the directly connected device; according to the corresponding relationship between the type of the directly connected device and the device TLV, determine the sending TLV; encapsulate the sending TLV into a corresponding LLDP message and send it to the directly connected device; The method can send the corresponding TLV according to the security of the directly connected device, greatly reduces the possibility of device information leakage and saves the link cost, and ensures that the sent device message is more reasonable; the invention also discloses a TLV sending system.

Description

A TLV transmission method and system

technical field

The invention relates to the technical field of electronic information, in particular to a TLV sending method and system.

Background technique

LLDP (LinkLayerDiscoveryProtocol, Link Layer Discovery Protocol) is a protocol based on TLV (TypeLengthValue, Type Length Value), which organizes the information of the local device into different TLVs, and encapsulates them in LLDPDUs to publish to neighbors directly connected to itself. Neighbors receive the information and save it in the form of standard MIB for the network management system to query and judge the communication status of the link.

With the development of data center technology, LLDP is used more and more frequently, and the number of TLVs is also increasing. The original definition of LLDP stated that the maximum message that a single LLDP instance can send is 1522 bytes. However, at present, with the increase of the number of TLVs, it is difficult to compress all TLV information into 1522 bytes, so if LLDP carries too many TLVs, most of the TLV information will be lost. The TLV carries important information, and if the lost information is obtained by illegal organizations, it will be very dangerous. Therefore, how to transmit the TLV safely and efficiently is a technical problem to be solved by those skilled in the art.

Contents of the invention

The purpose of the present invention is to provide a TLV sending method and system, which can send corresponding TLVs according to the security of directly connected devices, which not only greatly reduces the possibility of device information leakage, but also saves link costs, and ensures that the sent device messages are more reasonable .

In order to solve the above technical problems, the present invention provides a TLV sending method, including:

receiving the LLDP message sent by the directly connected device, and verifying the security of the directly connected device according to the LLDP message;

If the verification is passed, then determine the type of the directly connected device according to the LLDP message;

Determine the sending TLV according to the correspondence between the type of the directly connected device and the device TLV;

Encapsulating the sending TLV into a corresponding LLDP packet and sending it to the directly connected device.

Wherein, verifying the security of the directly connected device according to the LLDP message includes:

Perform matching verification on the LLDP packet by using the authentication key and/or system security description, and judge the security of the directly connected device according to the matching verification result.

Wherein, after verifying the security of the directly connected device according to the LLDP message, it also includes:

If the verification fails, the TLV corresponding to the basic information of the device is encapsulated into an LLDP packet and sent to the directly connected device.

Wherein, determining the type of the directly connected device according to the LLDP message includes:

Judging whether the LLDP message includes a TLV corresponding to the system function;

If included, the type of the directly connected device is determined according to the TLV corresponding to the system function.

Wherein, after judging whether the TLV corresponding to the system function is included in the LLDP message, it also includes:

If not included, all TLVs of the device are encapsulated into LLDP packets and sent to the directly connected device.

The present invention provides a TLV transmission system, including:

A verification module, configured to receive the LLDP message sent by the directly connected device, and verify the security of the directly connected device according to the LLDP message;

A type determination module, configured to determine the type of the directly connected device according to the LLDP message if the verification is passed;

A TLV determination module, configured to determine the sending TLV according to the correspondence between the type of the directly connected device and the device TLV;

The first sending module is configured to encapsulate the sending TLV into a corresponding LLDP packet and send it to the directly connected device.

Wherein, the verification module includes:

The receiving unit is used to receive the LLDP message sent by the directly connected device;

The verification unit is configured to use the authentication key and/or the system security description to perform matching verification on the LLDP message, and judge the security of the directly connected device according to the matching verification result.

Among them, also include:

The second sending module is configured to encapsulate the TLV corresponding to the basic device information into an LLDP message and send it to the directly connected device if the verification fails.

Among them, the type determination module includes:

A judging unit, configured to judge whether the LLDP packet contains a TLV corresponding to the system function;

The type determining unit is configured to, if included, determine the type of the directly connected device according to the TLV corresponding to the system function.

Among them, the type determination module also includes:

A sending unit, configured to encapsulate all TLVs of the device into LLDP packets and send them to the directly connected device if not included.

The TLV sending method provided by the present invention includes: receiving the LLDP message sent by the directly connected device, and verifying the security of the directly connected device according to the LLDP message; if the verification is passed, then according to the LLDP message Determine the type of the directly connected device; determine the sending TLV according to the corresponding relationship between the type of the directly connected device and the device TLV; encapsulate the sending TLV into a corresponding LLDP message and send it to the directly connected device; The invention also provides a TLV sending system;

This method verifies the security of the directly connected device according to the received LLDP message, which can ensure the security of the device to send TLV data, that is, greatly reduce the possibility of device information leakage; TLV information can reduce the number of TLV information carried by LLDP packets, which saves link costs and prevents the loss of some TLVs caused by too many TLVs; It greatly reduces the possibility of device information leakage and saves link costs, ensuring that the sent device messages are more reasonable.

Description of drawings

In order to more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the following will briefly introduce the drawings that need to be used in the description of the embodiments or the prior art. Obviously, the accompanying drawings in the following description are only It is an embodiment of the present invention, and those skilled in the art can also obtain other drawings according to the provided drawings without creative work.

FIG. 1 is a flowchart of a TLV sending method provided by an embodiment of the present invention;

FIG. 2 is a structural block diagram of a TLV sending system provided by an embodiment of the present invention.

detailed description

The core of the present invention is to provide a TLV sending method and system, which can send corresponding TLVs according to the security of directly connected devices, which not only greatly reduces the possibility of device information leakage, but also saves link costs, and ensures that the sent device messages are more reasonable .

In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments It is a part of embodiments of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without making creative efforts belong to the protection scope of the present invention.

Please refer to FIG. 1. FIG. 1 is a flowchart of a TLV sending method provided by an embodiment of the present invention; the method may include:

S100. Receive the LLDP packet sent by the directly connected device, and verify the security of the directly connected device according to the LLDP packet;

Among them, this step is to verify the security of the directly connected device connected to the local device, thereby fundamentally reducing the possibility of information leakage of the local device. Since LLDP packets contain basic information such as the chassis IDTLV, port IDTLV, and TTLTLV of the directly connected device, you can use this information to judge the security of the directly connected device.

Optionally, the verification method may include: performing matching verification on the LLDP packet by using the authentication key and/or system security description, and judging the security of the directly connected device according to the matching verification result.

Wherein, the specific way of using the authentication key may include using the system MAC address and key value. According to the port ID and other valid information, the device can calculate the authentication key. The neighbor device, that is, the directly connected device, compares the local authentication key through the same port ID or other information in the TLV. If they are the same, the device is considered safe and starts exchanging LLDPDUs.

The accrual method for verifying by using the system security description may include pre-listing some keywords used to describe the security of the device. When a device receives an LLDP packet, it checks the system description field in the packet, and if it contains these keywords, it considers the neighboring device to be safe.

S110. If the verification is passed, determine the type of the directly connected device according to the LLDP message;

Among them, if the verification is passed, it is considered that the directly connected device is safe, and the device type can be judged. Since the system function TLV in the LLDP message is usually 16 bits, it is used to describe the function of the device, including the TLV type and TLV information. Information such as strings, system functions, and achievable functions. Through the system function, you can judge whether the neighbor device is a router or a repeater. The specific process is:

Judging whether the LLDP message includes a TLV corresponding to the system function;

If included, the type of the directly connected device is determined according to the TLV corresponding to the system function.

Optionally, after judging whether the LLDP message contains the TLV corresponding to the system function, it also includes:

If not included, all TLVs of the device are encapsulated into LLDP packets and sent to the directly connected device.

Among them, it can be determined that the directly connected device is a security device first, so in order to enable the directly connected device to obtain sufficient information, if the type of the directly connected device cannot be obtained, all TLVs of the device are encapsulated into LLDP packets and sent to the Directly connected devices: It can ensure that accurate and useful TLV information can be obtained from packets regardless of the type of directly connected devices. Therefore, the reliability and rationality of the sent TLV information can be improved.

S120. Determine the sending TLV according to the correspondence between the type of the directly connected device and the device TLV;

S130. Encapsulate the sending TLV into a corresponding LLDP packet and send it to the directly connected device.

Wherein, according to the type of the directly connected device, the content of the TLV in the LLDP message to be sent is determined; that is, the type of the directly connected device is used to improve the accuracy and rationality of the sent TLV. That is, the amount of TLV information carried in the LLDP message is reduced, thereby avoiding that in the prior art, all TLV information is compressed into 1522 bytes, and LLDP carries too many TLVs, resulting in loss of most TLV information. The TLV carries important information, and if the lost information is obtained by illegal organizations, it will be very dangerous.

Among them, the TLV transmission mechanism in the LLDP protocol in the prior art is mainly when a single LLDP instance allows a certain maximum amount of information to be sent and there are security issues; this method can optimize the TLV transmission mechanism and exchange device information safely and efficiently.

The process of the above steps is that when the network device, that is, the local device, receives the first LLDP packet, it will check the security authentication type to ensure the security of the directly connected device, that is, the directly connected device. After confirming the security of the directly connected device, in order to send accurate and useful information as much as possible under the only LLDP data length, here the TLV information sent is precisely checked by detecting the type of the directly connected device, and the type of the directly connected device is checked. According to the device type and TLV correspondence, the local device sends the second LLDP packet. Through this process, the possibility of device information leakage can be greatly reduced and link costs can be saved, ensuring that the sent device messages are more reasonable.

Based on the above technical solution, the TLV sending method proposed in the embodiment of the present invention verifies the security of the directly connected device according to the received LLDP message, which can ensure the security of the device sending TLV data, that is, greatly reduce the risk of device information leakage Possibility; according to the type of the directly connected device, the corresponding TLV information can be sent, which can reduce the number of TLV information carried by the LLDP message, save the link cost and prevent the loss of some TLVs caused by too many TLVs; therefore, this method can be based on The security of directly connected devices sends corresponding TLVs, which not only greatly reduces the possibility of device information leakage, but also saves link costs, ensuring that the sent device messages are more reasonable.

Based on the above embodiment, after verifying the security of the directly connected device according to the LLDP message, it further includes:

If the verification fails, the TLV corresponding to the basic information of the device is encapsulated into an LLDP packet and sent to the directly connected device.

Wherein, if the verification fails, only the TLV corresponding to the basic information of the device may be encapsulated into an LLDP packet and sent to the directly connected device. For example, sending includes basic information such as chassis IDTLV, port IDTLV, TTLTLV, etc. This information only informs the directly connected device of the basic information of the local device, so that the directly connected device can know the local device without seriously affecting the security of the local device. Of course, when the verification fails, you can also refuse to send any information to the directly connected device.

Based on any of the above embodiments, a specific implementation process may be:

The two devices are connected and can exchange LLDP packets. Once device A receives the LLDP packet sent by neighboring device B, device A will check whether the LLDP data packet is safe through the authentication key or system security description. If the neighboring device B at the judging end is a non-secure packet, the TLV sent by the device only includes basic information such as chassis IDTLV, port IDTLV, and TTLTLV. If it is judged that the neighboring device B is a security package, the device type is further checked according to the system function.

Since the System Capability TLV is not a public attribute, when checking the device type, it should be checked whether the packet contains the LLDP System Capability TLV. If not included, device A sends all TLVs to device B. If it has been included, device A judges the type of device B through the system function TLV, and then device A sends the corresponding TLV to the device type of B.

Based on the above technical solution, the TLV sending method proposed in the embodiment of the present invention verifies the security of the directly connected device according to the received LLDP message, which can ensure the security of the device sending TLV data, that is, greatly reduce the risk of device information leakage Possibility; according to the type of the directly connected device, the corresponding TLV information can be sent, which can reduce the number of TLV information carried by the LLDP message, save the link cost and prevent the loss of some TLVs caused by too many TLVs; therefore, this method can be based on The security of directly connected devices sends corresponding TLVs, which not only greatly reduces the possibility of device information leakage, but also saves link costs, ensuring that the sent device messages are more reasonable. And in the case of not knowing the type of the directly connected device, enough TLV information can be given to the secure directly connected device as much as possible, so as to improve the reliability and availability of the TLV information.

The embodiment of the present invention provides a TLV sending method, which can send a corresponding TLV according to the security of directly connected devices, which not only greatly reduces the possibility of device information leakage, but also saves link costs.

The TLV sending system provided by the embodiment of the present invention is introduced below, and the TLV sending system described below and the TLV sending method described above can be referred to in correspondence.

Please refer to FIG. 2, which is a structural block diagram of a TLV sending system provided by an embodiment of the present invention; the system may include:

The verification module 100 is configured to receive the LLDP message sent by the directly connected device, and verify the security of the directly connected device according to the LLDP message;

A type determination module 200, configured to determine the type of the directly connected device according to the LLDP message if the verification is passed;

The TLV determination module 300 is configured to determine the sending TLV according to the correspondence between the type of the directly connected device and the device TLV;

The first sending module 400 is configured to encapsulate the sending TLV into a corresponding LLDP packet and send it to the directly connected device.

Optionally, the verification module 100 includes:

The receiving unit is used to receive the LLDP message sent by the directly connected device;

The verification unit is configured to use the authentication key and/or the system security description to perform matching verification on the LLDP message, and judge the security of the directly connected device according to the matching verification result.

Based on the foregoing embodiments, the system also includes:

The second sending module is configured to encapsulate the TLV corresponding to the basic device information into an LLDP message and send it to the directly connected device if the verification fails.

Optionally, the type determination module 200 includes:

A judging unit, configured to judge whether the LLDP packet contains a TLV corresponding to the system function;

The type determining unit is configured to, if included, determine the type of the directly connected device according to the TLV corresponding to the system function.

Optionally, the type determination module 200 also includes:

A sending unit, configured to encapsulate all TLVs of the device into LLDP packets and send them to the directly connected device if not included.

Each embodiment in the description is described in a progressive manner, each embodiment focuses on the difference from other embodiments, and the same and similar parts of each embodiment can be referred to each other. As for the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and for the related information, please refer to the description of the method part.

Professionals can further realize that the units and algorithm steps of the examples described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software or a combination of the two. In order to clearly illustrate the possible For interchangeability, in the above description, the composition and steps of each example have been generally described according to their functions. Whether these functions are executed by hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present invention.

The steps of the methods or algorithms described in connection with the embodiments disclosed herein may be directly implemented by hardware, software modules executed by a processor, or a combination of both. Software modules can be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other Any other known storage medium.

The TLV sending method and system provided by the present invention have been introduced in detail above. In this paper, specific examples are used to illustrate the principle and implementation of the present invention, and the descriptions of the above embodiments are only used to help understand the method and core idea of the present invention. It should be pointed out that for those skilled in the art, without departing from the principle of the present invention, some improvements and modifications can be made to the present invention, and these improvements and modifications also fall within the protection scope of the claims of the present invention.

Claims (10)

1. a TLV sending method, it is characterised in that including:

Receive the LLDP message that direct-connected device sends, and according to described LLDP message, the safety of described direct-connected device is verified;

If being verified, then determine the type of described direct-connected device according to described LLDP message;

The corresponding relation of the type according to described direct-connected device and equipment TLV, it is determined that send TLV;

The LLDP message that described transmission TLV is encapsulated as correspondence is sent to described direct-connected device.

2. TLV sending method as claimed in claim 1, it is characterised in that the safety of described direct-connected device is verified according to described LLDP message, including:

Utilize certification key and/or security of system to describe and described LLDP message is carried out coupling checking, and judge the safety of described direct-connected device according to coupling the result.

3. TLV sending method as claimed in claim 1, it is characterised in that after according to described LLDP message the safety of described direct-connected device being verified, also include:

If checking does not pass through, then TLV corresponding for equipment essential information is encapsulated as LLDP message and is sent to described direct-connected device.

4. the TLV sending method as described in any one of claims 1 to 3, it is characterised in that determine the type of described direct-connected device according to described LLDP message, including:

Judge whether described LLDP message comprises the TLV that systemic-function is corresponding;

If comprising, then determine the type of described direct-connected device according to the TLV that systemic-function is corresponding.

5. TLV sending method as claimed in claim 4, it is characterised in that judge according to, after whether comprising, in described LLDP message, the TLV that systemic-function is corresponding, also including:

If not comprising, then all of for equipment TLV is encapsulated as LLDP message and is sent to described direct-connected device.

6. a TLV sends system, it is characterised in that including:

Authentication module, for receiving the LLDP message that direct-connected device sends, and is verified the safety of described direct-connected device according to described LLDP message;

Determination type module, if for being verified, then determining the type of described direct-connected device according to described LLDP message;

TLV determines module, for the corresponding relation of the type according to described direct-connected device with equipment TLV, it is determined that send TLV;

First sending module, for being sent to described direct-connected device by the LLDP message that described transmission TLV is encapsulated as correspondence.

7. TLV as claimed in claim 6 sends system, it is characterised in that described authentication module includes:

Receive unit, for receiving the LLDP message that direct-connected device sends;

Authentication unit, is used for utilizing certification key and/or security of system to describe and described LLDP message carries out coupling checking, and judge the safety of described direct-connected device according to coupling the result.

8. TLV as claimed in claim 6 sends system, it is characterised in that also include:

Second sending module, if not passing through for checking, is then encapsulated as LLDP message by TLV corresponding for equipment essential information and is sent to described direct-connected device.

9. the TLV as described in any one of claim 6 to 8 sends system, it is characterised in that determination type module includes:

Judging unit, for judging whether comprise, in described LLDP message, the TLV that systemic-function is corresponding;

Type determining units, if for comprising, then determining the type of described direct-connected device according to the TLV that systemic-function is corresponding.

10. TLV as claimed in claim 9 sends system, it is characterised in that determination type module also includes:

Transmitting element, if for not comprising, being then encapsulated as LLDP message by all of for equipment TLV and be sent to described direct-connected device.