Link discovery method and apparatus

Patent metadata

Field	Value
Publication number	US-2016014142-A1
Application number	US-201514864464-A
Country	US
Kind code	A1
Filing date	Sep 24, 2015
Priority date	Apr 3, 2013
Publication date	Jan 14, 2016
Grant date	—

Abstract

The present application discloses a link discovery method and apparatus. The method includes: when a network device receives a first LLDP packet sent by a directly connected device, determining a security level of the directly connected device according to an authentication TLV; if the security level of the directly connected device is secure, determining a device type of the directly connected device, and sending a second LLDP packet to the directly connected device according to a correspondence between the device type of the directly connected device and a TLV. In the present application, a corresponding TLV is selected according to the device type and sent, which avoids that all types of TLVs are sent to a directly connected device every time, and reduces a possibility of device information leakage. It is ensured that a sent LLDP packet is more proper, and a link overhead is reduced.

First claim

What is claimed is:

1 . A link discovery method, comprising:
in response to a network device receiving a first Link Layer Discovery Protocol (LLDP) packet sent by a directly connected device, determining a security level of the directly connected device according to an authentication type-length-value (TLV) in the first LLDP packet, the security level comprises either a secure security level or an insecure security level, wherein the first LLDP packet comprises the authentication TLV and a minimum security level TLV, and the minimum security level TLV comprises a Chassis ID TLV, a Port ID TLV, a Time to Live TLV, and an End of LLDP Data Unit TLV; and in response to determining that the security level of the directly connected device is the secure security level, determining a device type of the directly connected device according to the first LLDP packet, and sending a second LLDP packet to the directly connected device according to the device type of the directly connected device, wherein the second LLDP packet comprises a TLV corresponding to the device type of the directly connected device.

2 . The method according to claim 1 , further comprising:
in response to determining that the security level of the directly connected device is the insecure security level, sending the first LLDP packet to the directly connected device.

3 . The method according to claim 1 , wherein before the determining the security level of the directly connected device according to the authentication TLV in the first LLDP packet, the method further comprises:
receiving an LLDP packet sent by the directly connected device, and determining whether the received LLDP packet carries an authentication TLV, wherein if the LLDP packet carries an authentication TLV, then the LLDP packet is the first LLDP packet; and wherein if the LLDP packet does not carry an authentication TLV, then the method further comprises sending the first LLDP packet to the directly connected device.

4 . The method according to claim 1 , wherein the determining the security level of the directly connected device according to the authentication TLV in the first LLDP packet comprises:
obtaining a chassis identifier and a port identifier of the directly connected device according to the Chassis ID TLV and the Port ID TLV; calculating a determining TLV based on the chassis identifier and the port identifier; and determining, by comparing, whether the determining TLV and the authentication TLV are the same, wherein if the determining TLV and the authentication TLV are the same, determining that the security level of the directly connected device is the secure security level; and, if the determining TLV and the authentication TLV are different, determining that the security level of the directly connected device is the insecure security level.

5 . The method according to claim 1 , wherein the first LLDP packet further comprises a System Capabilities TLV, wherein the System Capabilities TLV comprises a system capabilities field used to describe a device function, and the determining the device type of the directly connected device according to the first LLDP packet comprises:
acquiring, according to the system capabilities field in the System Capabilities TLV, a function provided by the directly connected device; and determining the device type of the directly connected device according to the function provided by the directly connected device.

6 . The method according to claim 5 , wherein before the determining the device type of the directly connected device according to the first LLDP packet, the method further comprises:
determining whether the first LLDP packet carries a System Capabilities TLV; and if the first LLDP packet does not carry a System Capabilities TLV, sending the second LLDP packet to the directly connected device, wherein the TLV in the second LLDP packet comprises all types of TLVs; or if the first LLDP packet carries a System Capabilities TLV, determining the device type of the directly connected device according to the System Capabilities TLV.

7 . The method according to claim 1 , wherein the sending a second LLDP packet to the directly connected device according to the device type of the directly connected device comprises:
when the directly connected device is a repeater, sending the second LLDP packet to the directly connected device, wherein the TLV in the second LLDP packet comprises only the minimum security level TLV; or when the directly connected device is a bridge or a router, sending the second LLDP packet to the directly connected device, wherein the TLV in the second LLDP packet comprises all types of TLVs; or when the directly connected device is an Internet protocol telephone, sending the second LLDP packet to the directly connected device, wherein the TLV in the second LLDP packet comprises the minimum security level TLV, a Port Description TLV, a System Name TLV, a System Description TLV, a System Capabilities TLV, a port virtual local area network identifier TLV, and a device power supply capability TLV.

8 . The method according to claim 1 , wherein before the sending a second LLDP packet to the directly connected device according to the device type of the directly connected device, the method further comprises:
encrypting the TLV in the second LLDP packet by using a reversible algorithm.

9 . The method according to claim 1 , further comprising:
when a quantity of directly connected devices connected to one port of the network device reaches an upper limit, and a security level of a directly connected device that is newly accessed on the port is secure, deleting at least one directly connected device connected to the port, wherein a security level of the at least one directly connected device is insecure.

10 . A link discovery apparatus, comprising:
a first determining module, configured to: in response to a network device receiving a first Link Layer Discovery Protocol (LLDP) packet sent by a directly connected device, determine a security level of the directly connected device according to an authentication type-length-value (TLV) in the first LLDP packet, wherein the security level comprises either a secure security level or an insecure security level, wherein the first LLDP packet comprises the authentication TLV and a minimum security level TLV, and the minimum security level TLV comprises a Chassis ID TLV, a Port ID TLV, a Time to Live TLV, and an End of LLDP Data Unit TLV; a second determining module, configured to: in response to the first determining module determining that the security level of the directly connected device is the secure security level, determine a device type of the directly connected device according to the first LLDP packet; and a sending module, configured to send a second LLDP packet to the directly connected device according to the device type of the directly connected device, wherein the second LLDP packet comprises a TLV corresponding to the device type of the directly connected device.

11 . The apparatus according to claim 10 , wherein the sending module is further configured to send the first LLDP packet to the directly connected device when the security level of the directly connected device is the insecure security level.

12 . The apparatus according to claim 10 , further comprising:
a receiving module, configured to receive an LLDP packet sent by the directly connected device; and a third determining module, configured to determine whether the LLDP packet received by the receiving module carries an authentication TLV, wherein when the LLDP packet carries an authentication TLV, determine that the LLDP packet is

Assignees

• Huawei Tech Co Ltd

Inventors

• Wang Cheng
• Zi Kang

Classifications

• H04L63/105 Primary

  Multiple levels of security · CPC title

• H04L41/0806

  for initial configuration or provisioning, e.g. plug-and-play · CPC title

• H04L47/286

  Time to live · CPC title

• H04L45/26

  Route discovery packet · CPC title

• H04L12/4625

  Single bridge functionality, e.g. connection of two networks over a single bridge · CPC title