Security authentication method and bidirectional forwarding detection BFD device

1. A security authentication method, comprising:

receiving, by a control plane of a local bidirectional forwarding detection (BFD) device, a first BFD packet that is sent by a control plane of a peer BFD device, wherein the first BFD packet carries a random nonce generated by the peer BFD device;

generating, by the control plane of the local BFD device, a first token value according to the random nonce;

sending, by the control plane of the local BFD device, the first token value to a data plane of the local BFD device;

receiving, by the data plane of the local BFD device, a second BFD packet that is sent by a data plane of the peer BFD device, wherein the second BFD packet carries authentication information, and the authentication information comprises a random nonce;

generating, by the data plane of the local BFD device, a second token value according to the random nonce comprised in the authentication information and by using a calculation method that is the same as a calculation method of the control plane of the local BFD device; and

successfully authenticating, by the data plane of the local BFD device, the second BFD packet when the second token value is the same as the first token value.

2. The method according to claim 1 , wherein the generating, by the control plane of the local BFD device, the first token value according to the random nonce comprises:

generating, by the control plane of the local BFD device, the first token value according to the random nonce carried in the first BFD packet and a source internet protocol (IP) address and a destination IP address that are comprised in the first BFD packet; and

wherein the generating, by the data plane of the local BFD device, the second token value according to the random nonce comprised in the authentication information and by using a calculation method that is the same as the calculation method of the control plane of the local BFD device comprises:

generating, by the data plane of the local BFD device, the second token value according to the random nonce comprised in the authentication information and a source IP address and a destination IP address that are comprised in the second BFD packet and by using a calculation method that is the same as the calculation method of the control plane of the local BFD device.

3. The method according to claim 1 , wherein the authentication information further comprises a token value; and

wherein the successfully authenticating, by the data plane of the local BFD device, the second BFD packet when the second token value is the same as the first token value comprises successfully authenticating, by the data plane of the local BFD device, the second BFD packet when the second token value is the same as the first token value, and the token value comprised in the authentication information is the same as the first token value.

4. A security authentication method, comprising:

receiving, by a control plane of a local bidirectional forwarding detection (BFD) device, a first BFD packet that is sent by a control plane of a peer BFD device, wherein the first BFD packet carries a random nonce generated by the peer BFD device;

generating, by the control plane of the local BFD device, a first token value according to the random nonce;

sending, by the control plane of the local BFD device, the first token value to a data plane of the local BFD device;

receiving, by the data plane of the local BFD device, a second BFD packet that is sent by a data plane of the peer BFD device, wherein the second BFD packet carries authentication information, and the authentication information comprises a second token value; and

successfully authenticating, by the data plane of the local BFD device, the second BFD packet when the second token value is the same as the first token value.

5. The method according to claim 4 , wherein the method further comprises sending, by the control plane of the local BFD device after the generating the first token value, and before the receiving the second BFD packet, a response packet of the first BFD packet to the control plane of the peer BFD device, wherein the response packet carries the first token value; and

wherein the second token value is the first token value encapsulated in the second BFD packet.

6. The method according to claim 4 , wherein the first BFD packet further comprises standard authentication request information, wherein the standard authentication request information comprises at least one of authentication request information based on Message Digest Algorithm 5 (MD5) and authentication request information based on Security Hash Algorithm 1 (SHA1), and wherein the standard authentication request information comprises a password; and

wherein the generating, by the control plane of the local BFD device, the first token value according to the random nonce comprises generating, by the control plane of the local BFD device, the first token value according to the random nonce carried in the first BFD packet and the password.

7. The method according to claim 4 , wherein the generating, by the control plane of the local BFD device, the first token value according to the random nonce comprises generating, by the control plane of the local BFD device, the first token value according to the random nonce carried in the first BFD packet and a source IP address and a destination IP address that are comprised in the first BFD packet.

8. A bidirectional forwarding detection (BFD) device, comprising:

a control plane, wherein the control plane comprises a general central processing unit (CPU) processor; and

a data plane, wherein the data plane comprises a network processor (NP);

wherein the control plane is configured to:

receive a first BFD packet that is sent by a control plane of a peer BFD device, wherein the first BFD packet carries a random nonce generated by the peer BFD device;

generate a first token value according to the random nonce; and

send the first token value to the data plane; and

wherein the data plane is configured to:

receive a second BFD packet that is sent by a data plane of the peer BFD device, wherein the second BFD packet carries authentication information, and wherein the authentication information comprises a random nonce;

generate a second token value according to the random nonce comprised in the authentication information and by using a calculation method that is the same as a calculation method of the control plane; and

successfully authenticate the second BFD packet when the second token value is the same as the first token value.

9. The BFD device according to claim 8 , wherein the control plane is configured to generate the first token value according to the random nonce carried in the first BFD packet and a source IP address and a destination IP address that are comprised in the first BFD packet; and

wherein the data plane is configured to generate the second token value according to the random nonce comprised in the authentication information and a source IP address and a destination IP address that are comprised in the second BFD packet and by using a calculation method that is the same as the calculation method of the control plane of the BFD device.

10. The BFD device according to claim 8 , wherein the authentication information further comprises a token value; and

wherein the data plane is further configured to successfully authenticate the second BFD packet when the second token value is the same as the first token value and the token value comprised in the authentication information is the same as the first token value.

11. A bidirectional forwarding detection (BFD) device, comprising:

a control plane, wherein the control plane comprises a general central processing unit (CPU) processor; and

a data plane, wherein the data plane comprises a network processor (NP);

wherein the control plane is configured to:

receive a first BFD packet that is sent by a control plane of a peer BFD device, wherein the first BFD packet carries a random nonce generated by the peer BFD device; generate a first token value according to the random nonce; and

send the first token value to the data plane; and

wherein the data plane is configured to:

receive a second BFD packet that is sent by a data plane of the peer BFD device, wherein the second BFD packet carries authentication information, and wherein the authentication information comprises a second token value; and

successfully authenticate the second BFD packet when the second token value is the same as the first token value.

12. The BFD device according to claim 11 , wherein the control plane is further configured to, send a response packet of the first BFD packet to the control plane of the peer BFD device after the first token value is generated, and before the data plane receives the second BFD packet that is sent by the data plane of the peer BFD device, wherein the response packet carries the first token value, and wherein the second token value is the first token value encapsulated in the second BFD packet.

13. The BFD device according to claim 11 , wherein the first BFD packet further comprises standard authentication request information, wherein the standard authentication request information comprises at least one of authentication request information based on Message Digest Algorithm 5 (MD5) and authentication request information based on Security Hash Algorithm 1 (SHA1), and wherein the standard authentication request information comprises a password; and

wherein the control plane is configured to generate the first token value according to the random nonce carried in the first BFD packet and the password.

14. The BFD device according to claim 11 , wherein the control plane is configured to generate the first token value according to the random nonce carried in the first BFD packet and a source Internet protocol (IP) address and a destination IP address that are comprised in the first BFD packet.