WO2021185314A1 - Data processing method and apparatus - Google Patents

Abstract

Disclosed are a data processing method and apparatus, which relate to the field of communications, and solve the problem of how to protect an IP address of a terminal to prevent the leakage of private information of the terminal. The method comprises: after receiving a first data packet, a network device encrypting an identifier of a terminal according to a key and a privacy variable, so as to obtain ciphertext, and replacing the identifier of the terminal with the ciphertext; and the network device sending a second data packet, wherein the second data packet comprises the ciphertext and does not comprise the identifier of the terminal.

Description

Data processing method and device

This application claims the priority of a Chinese patent application filed with the State Intellectual Property Office on March 20, 2020, the application number is 202010203158.4, and the application name is "Data Processing Method and Device", the entire content of which is incorporated into this application by reference.

Technical field

This application relates to the field of communications, and in particular to data processing methods and devices.

Background technique

At present, the network device can forward the data packet according to the Internet Protocol (IP) address of the terminal included in the data packet, so as to forward the data packet to the receiving end. The IP address of the terminal can indicate the location information of the terminal and the identity information of the terminal. Usually, the IP address of the terminal is located in the header of the data packet. In the process of transmitting data packets, untrusted devices or illegal eavesdroppers can easily obtain the terminal's IP address, use the terminal's IP address to identify the terminal, track the terminal, and analyze the private information of the terminal. The privacy information of the terminal includes the identity information and location information of the terminal. Therefore, the IP address of the terminal may cause a security problem of leaking the private information of the terminal.

In the traditional technology, the network address translation (NAT) technology can be used to protect the identity information of the terminal, but the network device needs to store the translation information, which results in a large storage resource overhead. Or, use the onion network to protect the private information of the terminal. However, each network device in the onion network encrypts the received data packet, which causes a large data transmission delay. Therefore, how to protect the IP address of the terminal and prevent the leakage of the private information of the terminal is an urgent problem to be solved.

Summary of the invention

The data processing method and device provided in this application solve the problem of how to protect the IP address of the terminal and prevent the leakage of the terminal's private information.

In order to achieve the above objectives, this application adopts the following technical solutions:

In the first aspect, this application provides a data processing method that can be applied to network equipment, or the method can be applied to a data processing device that can support network equipment to implement the method, for example, the data processing device includes a chip system, Including: the network device receives the first data packet, generates the first ciphertext according to the terminal’s identity, privacy variables and the key, then replaces the terminal’s identity with the first ciphertext, and sends the second data packet to the destination device. The data packet includes the first ciphertext. The second data packet does not include the identification of the terminal. Wherein, the first data packet includes the identification of the terminal, and the identification of the terminal is used to indicate the terminal; the identification of the terminal is set in the network layer protocol header included in the first data packet; the identification of the terminal is the identity identification of the terminal or the location identification of the terminal ; The first ciphertext is set in the network layer protocol header included in the second data packet.

In the data processing method provided by the embodiments of the present application, the network device conceals the terminal's identity by encrypting the terminal's identity, thereby preventing illegal attackers (such as untrusted devices or illegal eavesdroppers) from obtaining the terminal's identity.

In a possible implementation manner, after the network device generates the first ciphertext, the first ciphertext is used to replace the identification of the terminal included in the first data packet to obtain the second data packet, so that the second data packet does not include the terminal’s Logo.

For example, if the identity of the terminal is the identity of the terminal, replacing the identity of the terminal included in the first data packet with the first ciphertext includes: replacing the identity of the terminal included in the first data packet with the first ciphertext to obtain the second data The second data packet does not include the identity of the terminal; the privacy variable includes at least one of time information, information related to the device transmitting or receiving the first data packet, random numbers, and regularly changing parameters.

For another example, if the identifier of the terminal is the position identifier of the terminal, replacing the identifier of the terminal included in the first data packet with the first ciphertext includes: replacing the position identifier of the terminal included in the first data packet with the first ciphertext to obtain the second ciphertext. Data packet, the second data packet does not include the location identifier of the terminal; the privacy variable is the encrypted terminal identity or the terminal’s identity; or, the privacy variable includes time information and information related to the device transmitting or receiving the first data packet At least one of information, random numbers, and regularly changing parameters.

Wherein, the information related to the device that transmits or receives the first data packet is the destination IP address included in the first data packet.

For another example, if the identification of the terminal is the location identification of the terminal, replacing the identification of the terminal included in the first data packet with the first ciphertext includes: replacing the identification of the encrypted terminal included in the first data packet with the first ciphertext and The location identification of the terminal obtains the second data packet; the privacy variable is the encrypted terminal identification; or the first ciphertext replaces the terminal identification and the location identification of the terminal included in the first data packet to obtain the second data Package; the privacy variable is the identity of the terminal.

In a possible design, generating the first ciphertext according to the terminal's identity, privacy variables, and keys includes: generating a second ciphertext according to the key and privacy variables; and determining the first ciphertext according to the second ciphertext and the terminal's identity. Ciphertext. Wherein, determining the first ciphertext according to the second ciphertext and the identification of the terminal includes: performing an exclusive OR operation on the second ciphertext and the identification of the terminal to obtain the first ciphertext.

In another possible design, generating the first ciphertext according to the terminal’s identity, privacy variables, and key includes: generating the data to be encrypted according to the terminal’s identity and privacy variables; generating the first password according to the key and the data to be encrypted Arts.

For different destination devices, the network device can use different privacy variables to encrypt the identification of the terminal to obtain different ciphertexts. Therefore, the data packets received by different destination devices include different ciphertexts, and it is impossible to analyze the privacy information of the terminal, and avoid analyzing the traffic of the same terminal accessing different destination devices through collusion and association.

Optionally, the second data packet further includes a locator for addressing the network device.

Optionally, the first data packet further includes first indication information, and the first indication information is used to instruct to encrypt the identification of the terminal.

Further, after sending the second data packet, the method further includes: the network device receives a third data packet, the third data packet includes a first ciphertext, and the first ciphertext is determined according to the terminal's identity, privacy variable, and key , The terminal identifier is used to indicate the terminal; the first cipher text is set in the network layer protocol header included in the third data packet; then, the network device generates the terminal identifier according to the first cipher text, the privacy variable and the key; Four data packets, the fourth data packet includes the identification of the terminal, and the identification of the terminal is set in the network layer protocol header included in the fourth data packet.

In the data processing method provided by the embodiments of the present application, after the network device receives the third data packet containing the ciphertext, it obtains the identification of the terminal by decrypting the ciphertext, and sends the fourth data packet containing the identification of the terminal to the terminal so that the terminal can receive To the fourth packet.

In a possible implementation manner, after the network device generates the identification of the terminal, the first ciphertext included in the third data packet is replaced with the identification of the terminal to obtain a fourth data packet, and the fourth data packet does not include the first ciphertext .

For example, if the identity of the terminal is the identity of the terminal, replacing the first ciphertext included in the third data packet with the identity of the terminal includes: replacing the first ciphertext included in the third data packet with the identity of the terminal to obtain the fourth data Packet; privacy variables include at least one of time information, information related to the device that transmits or receives the third data packet, random numbers, and regularly changing parameters.

For another example, if the identifier of the terminal is the location identifier of the terminal, replacing the first cipher text included in the third data packet with the identifier of the terminal includes: replacing the first cipher text included in the third data packet with the location identifier of the terminal to obtain the fourth Data packet; the privacy variable is the encrypted terminal’s identity or the terminal’s identity; or, the privacy variable includes time information, information related to the device that transmits or receives the third data packet, random numbers, and regularly changing parameters at least one.

Wherein, the information related to the device that transmits or receives the third data packet is the source IP address included in the third data packet.

For another example, if the terminal's identifier is the terminal's location identifier, replacing the first ciphertext included in the third data packet with the terminal's identifier includes: replacing the third data packet with the terminal's location identifier and the encrypted terminal identifier The first ciphertext, the fourth data packet is obtained, the decryption result includes the terminal's location identifier and the encrypted terminal's identity, and the privacy variable is the encrypted terminal's identity; or, the terminal's location identifier and the terminal's identity are used Replace the first ciphertext included in the third data packet to obtain the fourth data packet. The decryption result includes the location identifier of the terminal and the identity identifier of the terminal, and the privacy variable is the identity identifier of the terminal.

In a possible design, generating the identification of the terminal according to the first ciphertext, the privacy variable and the key includes: generating the second ciphertext according to the key and the privacy variable; determining the terminal according to the second ciphertext and the first ciphertext Of the logo.

Wherein, determining the identity of the terminal according to the second ciphertext and the first ciphertext includes: performing an exclusive OR operation on the second ciphertext and the first ciphertext to obtain the identity of the terminal.

In another possible design, generating the identification of the terminal according to the first ciphertext, the privacy variable and the key includes: generating a decryption result according to the first ciphertext and the key; and determining the identification of the terminal according to the decryption result and the privacy variable.

Optionally, the third data packet further includes a locator for addressing the network device; before sending the fourth data packet, the method further includes: the network device replaces the locator for addressing the network device included in the third data packet with a padding value.

Optionally, the third data packet further includes second indication information, and the second indication information is used to indicate that the identity of the terminal has been encrypted.

In the second aspect, the embodiments of the present application also provide a data processing device, and the beneficial effects can be referred to the description of the first aspect and will not be repeated here. The data processing device has the function of realizing the behavior in the method example of the first aspect described above. The function can be realized by hardware, or by hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the above-mentioned functions. In a possible design, the data processing device includes: a receiving unit, a processing unit, and a sending unit. The receiving unit is configured to receive a first data packet, the first data packet includes an identification of the terminal, and the identification of the terminal is used to indicate the terminal; the identification of the terminal is set in the network layer protocol header included in the first data packet; The identifier is the identity identifier of the terminal or the location identifier of the terminal. The processing unit is used to generate the first ciphertext according to the terminal's identification, privacy variable and key. The sending unit is configured to send a second data packet, the second data packet includes a first ciphertext, and the first ciphertext is set in a network layer protocol header included in the second data packet.

In a possible implementation manner, after the network device generates the first ciphertext, the processing unit is further configured to replace the identification of the terminal included in the first data packet with the first ciphertext to obtain the second data packet so that the first ciphertext is The second data packet does not include the identification of the terminal.

For example, if the identity of the terminal is the identity of the terminal, the processing unit is configured to replace the identity of the terminal included in the first data packet with the first ciphertext to obtain a second data packet, and the second data packet does not include the identity of the terminal Identification; privacy variables include at least one of time information, information related to the device that transmits or receives the first data packet, random numbers, and regularly changing parameters.

For another example, if the identifier of the terminal is the location identifier of the terminal, the processing unit is configured to replace the location identifier of the terminal included in the first data packet with the first ciphertext to obtain a second data packet, and the second data packet does not include the terminal's location identifier. Location identification; the privacy variable is the encrypted terminal’s identity or the terminal’s identity; or, the privacy variable includes time information, information related to the device that transmits or receives the first data packet, random numbers, and regularly changing parameters at least one.

Wherein, the information related to the device that transmits or receives the first data packet is the destination IP address included in the first data packet.

For another example, if the identifier of the terminal is the location identifier of the terminal, the processing unit is configured to replace the encrypted terminal identification and the location identifier of the terminal included in the first data packet with the first ciphertext to obtain the second data packet; The privacy variable is the identity of the terminal after encryption; or, replacing the identity of the terminal and the location of the terminal included in the first data packet with the first ciphertext to obtain the second data packet; the privacy variable is the identity of the terminal.

In a possible design, the processing unit is configured to generate the second ciphertext according to the key and the privacy variable, and to determine the first ciphertext according to the second ciphertext and the identification of the terminal. Wherein, determining the first ciphertext according to the second ciphertext and the identification of the terminal includes: performing an exclusive OR operation on the second ciphertext and the identification of the terminal to obtain the first ciphertext.

In another possible design, the processing unit is configured to generate the data to be encrypted according to the identification of the terminal and the privacy variable; and generate the first ciphertext according to the key and the data to be encrypted.

For different destination devices, the network device can use different privacy variables to encrypt the identification of the terminal to obtain different ciphertexts. Therefore, the data packets received by different destination devices include different ciphertexts, and it is impossible to analyze the privacy information of the terminal, and avoid analyzing the traffic of the same terminal accessing different destination devices through collusion and association.

Optionally, the second data packet further includes a locator for addressing the network device.

Optionally, the first data packet further includes first indication information, and the first indication information is used to instruct to encrypt the identification of the terminal.

Further, the receiving unit is further configured to receive a third data packet, the third data packet includes a first ciphertext, the first ciphertext is determined according to the terminal's identity, privacy variables, and a key, and the terminal's identity is used to indicate The terminal, the terminal’s identifier is the terminal’s identity or the terminal’s location identifier; the first ciphertext is set in the network layer protocol header included in the third data packet; the processing unit is also used to And the identification of the key generation terminal; the sending unit is also used to send a fourth data packet, the fourth data packet includes an identification of the terminal, and the identification of the terminal is set in the network layer protocol header included in the fourth data packet.

In the embodiment of the present application, after receiving the third data packet containing the ciphertext, the network device obtains the identification of the terminal by decrypting the ciphertext, and sends the fourth data packet containing the identification of the terminal to the terminal so that the terminal can receive the fourth data packet. data pack.

In a possible implementation manner, after the network device generates the terminal identifier, the processing unit is further configured to replace the first ciphertext included in the third data packet with the terminal identifier to obtain the fourth data packet. The packet does not include the first ciphertext.

For example, if the identity of the terminal is the identity of the terminal, the processing unit is used to replace the first ciphertext included in the third data packet with the identity of the terminal to obtain the fourth data packet; the privacy variables include time information, and transmission or At least one of information related to the device receiving the third data packet, a random number, and a parameter that changes according to the law.

For another example, if the identification of the terminal is the location identification of the terminal, the processing unit is configured to replace the first ciphertext included in the third data packet with the location identification of the terminal to obtain the fourth data packet; the privacy variable is the encrypted terminal's location identification The identity identifier or the identity identifier of the terminal; or, the privacy variable includes at least one of time information, information related to the device that transmits or receives the third data packet, a random number, and a parameter that changes according to law.

Wherein, the information related to the device that transmits or receives the third data packet is the source IP address included in the third data packet.

For another example, if the identifier of the terminal is the location identifier of the terminal, the processing unit is configured to replace the first ciphertext included in the third data packet with the location identifier of the terminal and the encrypted terminal identity to obtain the fourth data packet, The decryption result includes the terminal's location identifier and the encrypted terminal's identity, and the privacy variable is the encrypted terminal's identity; or, replace the first ciphertext included in the third data packet with the terminal's location identifier and the terminal's identity , Obtain the fourth data packet, the decryption result includes the terminal's location identifier and the terminal's identity, and the privacy variable is the terminal's identity.

In a possible design, the processing unit is configured to generate the second ciphertext according to the key and the privacy variable, and determine the identity of the terminal according to the second ciphertext and the first ciphertext. Wherein, determining the identity of the terminal according to the second ciphertext and the first ciphertext includes: performing an exclusive OR operation on the second ciphertext and the first ciphertext to obtain the identity of the terminal.

In another possible design, the processing unit is configured to generate a decryption result according to the first ciphertext and the key, and determine the identity of the terminal according to the decryption result and the privacy variable.

Optionally, the third data packet further includes a locator for addressing the network device; before sending the fourth data packet, the method further includes: the network device replaces the locator for addressing the network device included in the third data packet with a padding value.

Optionally, the third data packet further includes second indication information, and the second indication information is used to indicate that the identity of the terminal has been encrypted.

In a third aspect, a data processing device is provided. The data processing device may be the network device in the foregoing method embodiment, or a chip set in the network device. The data processing device includes a communication interface, a processor, and optionally, a memory. Wherein, the memory is used to store computer programs or instructions, and the processor is coupled with the memory and a communication interface. When the processor executes the computer programs or instructions, the data processing device is caused to execute the method executed by the network device in the above method embodiment. .

In a fourth aspect, a computer program product is provided. The computer program product includes: computer program code, which when the computer program code is running, causes the methods executed by the network device in the above aspects to be executed.

In a fifth aspect, the present application provides a chip system, the chip system includes a processor, and is configured to implement the functions of the network device in the methods of the foregoing aspects. In a possible design, the chip system further includes a memory for storing program instructions and/or data. The chip system can be composed of chips, and can also include chips and other discrete devices.

In a sixth aspect, the present application provides a computer-readable storage medium that stores a computer program, and when the computer program is executed, the method executed by the network device in the above aspects is implemented.

In this application, the names of the network equipment and the data processing device do not constitute a limitation on the equipment itself. In actual implementation, these equipment may appear under other names. As long as the function of each device is similar to that of this application, it falls within the scope of the claims of this application and its equivalent technologies.

Description of the drawings

FIG. 1 is a diagram of an example of the structure of an IPv6 data packet provided by an embodiment of this application;

FIG. 2 is a structural example diagram of a source IP address provided by an embodiment of this application;

FIG. 3 is a structural example diagram of a destination IP address provided by an embodiment of this application;

FIG. 4 is an example diagram of the architecture of a communication system provided by an embodiment of the application;

FIG. 5 is a flowchart of a data processing method provided by an embodiment of this application;

FIG. 6 is a structural example diagram of a source IP address provided by an embodiment of this application;

FIG. 7 is a flowchart of a data processing method provided by an embodiment of the application;

FIG. 8 is a schematic diagram of a source IP address encryption process provided by an embodiment of this application;

FIG. 9 is a schematic diagram of a source IP address encryption process provided by an embodiment of this application;

FIG. 10 is a flowchart of a data processing method provided by an embodiment of this application;

FIG. 11 is a structural example diagram of a destination IP address provided by an embodiment of this application;

FIG. 12 is a flowchart of a data processing method provided by an embodiment of the application;

FIG. 13 is a schematic diagram of the decryption process of the destination IP address provided by an embodiment of this application;

FIG. 14 is a schematic diagram of the decryption process of the destination IP address provided by an embodiment of this application;

FIG. 15 is a schematic diagram of a process of encryption of a source IP address and decryption of a destination IP address provided by an embodiment of this application;

FIG. 16 is a schematic diagram of an encryption process of a source IP address provided by an embodiment of this application;

FIG. 17 is a schematic diagram of the decryption process of the destination IP address provided by an embodiment of this application;

FIG. 18 is a diagram of an example of the architecture of a communication system provided by an embodiment of this application;

FIG. 19 is a flowchart of a data processing method provided by an embodiment of this application;

FIG. 20 is a flowchart of a data processing method provided by an embodiment of the application;

FIG. 21 is a schematic diagram of an encryption process of a source IP address provided by an embodiment of this application;

FIG. 22 is a schematic diagram of the decryption process of the destination IP address provided by an embodiment of this application;

FIG. 23 is a flowchart of a data processing method provided by an embodiment of this application;

FIG. 24 is a schematic structural diagram of a data processing device provided by an embodiment of the application;

FIG. 25 is a schematic structural diagram of a data processing device provided by an embodiment of the application.

Detailed ways

The terms "first", "second", and "third" in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to limit a specific order.

In the embodiments of the present application, words such as "exemplary" or "for example" are used as examples, illustrations, or illustrations. Any embodiment or design solution described as "exemplary" or "for example" in the embodiments of the present application should not be construed as being more preferable or advantageous than other embodiments or design solutions. To be precise, words such as "exemplary" or "for example" are used to present related concepts in a specific manner.

In order to make the description of the following embodiments clear and concise, first a brief introduction of related technologies is given:

The Internet Protocol (IP) is a set of rules for all computer networks in the Internet to communicate with each other. The IP address (Internet Protocol Address) may be the number of the host in the Internet. Common IP addresses include IPv4 addresses and IPv6 addresses. Usually, the IP address is located in the header of the data packet.

Illustratively, as shown in FIG. 1, it is a structural example diagram of an IPv6 data packet provided by an embodiment of this application. The IPv6 data packet includes a basic header, N extended headers and a data part. The N extension headers and data parts can be called payload or payload. Among them, the basic header includes version, traffic class, flow label, payload length, next header, hop limit, source Address (source address) and destination address (destination address).

Among them, the source address may also be referred to as the source IP address. The source address refers to the IP address of the sender that sends the data packet, and the length of the source address is 128 bits. The sender can be a server or a terminal. Illustratively, as shown in FIG. 2, it is a structural example diagram of a source IP address provided by an embodiment of this application. The source address includes external locator bits, internal locator bits, and host identifier bits.

The value of the external locator bit may be the address of the network device that forwards the data packet, so that the network device can receive the returned data packet. The external locator bit occupies x bits in the source address. For example, the external locator bit occupies 62 bits in the source address.

The internal locator bit is used to indicate the source location identifier, that is, the location identifier (source location, SrcLoc) of the sender. For example, if the sending end is a terminal, the source location identifier is the location identifier of the terminal. For another example, if the sending end is a server, the source location identifier is the location identifier of the server. The internal locator bit occupies y1 bit in the source address. For example, the internal locator bit occupies 32 bits in the source address.

The host identifier bit is used to indicate the source identity, that is, the source identification (SrcID) of the sender. For example, if the sending end is a terminal, the source identity is the identity of the terminal. For another example, if the sender is a server, the source identity is the identity of the server. The host identifier bit occupies y2 bits in the source address. For example, the host identifier bit occupies 32 bits in the source address.

For example, suppose the source address is an IPv6 address. Wherein, the source identity identifier may be an identifier that uniquely distinguishes the identity of the data packet sender in a local or global scope. The source identity can be the last 64-bit interface ID of the IPv6 address. The locator bit is used to instruct the network layer device to find the identifier of the smallest unit where the data packet sender is located. For example, the locator bit can be a 64-bit prefix of an IPv6 address. The locator position includes an external locator and an internal locator. The source location indicated by the internal locator bit that needs to be encrypted is the 16-bit subnet number in the prefix.

The destination address can also be called the destination IP address. The destination address refers to the IP address of the receiving end that receives the data packet, and the length of the destination address is 128 bits. The receiving end can be a server or a terminal. Illustratively, as shown in FIG. 3, a structural example diagram of a destination IP address provided by an embodiment of this application. The destination address includes external locator bits, internal locator bits, and host identifier bits.

The value of the external locator bit may be the address of the network device that forwards the data packet, so that the network device can receive the returned data packet. The external locator bit occupies x bits in the destination address. For example, the external locator bit occupies 62 bits in the destination address.

The internal locator bit is used to indicate the destination location identifier, that is, the location identifier (Destination location, DstLoc) of the receiving end. For example, if the receiving end is a terminal, the destination location identifier is the location identifier of the terminal. For another example, if the receiving end is a server, the destination location identifier is the location identifier of the server. The internal locator bit occupies y1 bit in the destination address. For example, the internal locator bit occupies 32 bits in the destination address.

The host identifier bit is used to indicate the destination identity, that is, the receiving end's identity (DstID). For example, if the receiving end is a terminal, the destination identity is the identity of the terminal. For another example, if the receiving end is a server, the destination identity is the identity of the server. The host identifier bit occupies y2 bits in the destination address. For example, the host identifier bit occupies 32 bits in the destination address.

For example, assume that the destination address is an IPv6 address. Among them, the destination identity identifier may be an identifier that uniquely distinguishes the identity of the data packet receiver in a local or global scope. The destination identity can be the last 64-bit interface ID of the IPv6 address. The locator bit is used to instruct the network layer device to find the identifier of the smallest unit where the data packet receiving end is located. For example, the locator bit can be a 64-bit prefix of an IPv6 address. The locator position includes an external locator and an internal locator. The destination location indicated by the internal locator bit that needs to be encrypted is the 16-bit subnet number in the prefix.

Regarding the specific explanation of each field of the IPv6 data packet, reference may be made to the explanation of the prior art, and the details are not repeated.

In order to solve the problem of how to protect the IP address of the terminal and prevent the leakage of the private information of the terminal, an embodiment of the present application provides a data processing method. The method includes: after receiving the first data packet, the network device encrypts the identification of the terminal according to the key and the privacy variable to obtain the ciphertext, and replaces the identification of the terminal with the ciphertext. The network device sends a second data packet again, and the second data packet includes the ciphertext but does not include the identification of the terminal. Wherein, the identification of the terminal may be the identity identification of the terminal or the location identification of the terminal. Therefore, the network device encrypts the terminal's identity to hide the terminal's IP address, preventing illegal attackers (such as untrusted devices or illegal eavesdroppers) from obtaining the terminal's IP address, and then analyzes the terminal's identity based on the terminal's IP address Information and location information of the terminal.

The identification of the terminal may be a piece of information that can uniquely identify the identity of an entity, or it may be a partial identification identifier that includes information such as identity attributes (such as age, role identification, department number, and rank). The location identifier of the terminal may be a locator that includes an IP address, or an identifier that includes geographic location information such as the Global Positioning System (GPS), or an identifier that includes other geographic location-related information.

The implementation of the embodiments of the present application will be described in detail below in conjunction with the accompanying drawings.

FIG. 4 shows an example diagram of the architecture of a communication system that can be applied to the embodiments of the present application. As shown in FIG. 4, the communication system includes at least one terminal 401, an internet network and a data center. The internetwork may include at least one network device (for example, network device 402 and network device 403). In this article, the network device can be a router. For example, the network device 402 may refer to a terminal-side router closer to the terminal. The network device 403 may refer to a border router or a near-destination router closer to the server. However, it is not limited to the network device being a router. The network device can also be a switch, an access gateway, etc., with a data packet forwarding function. The Internet may also include an identity management server 404, and the identity management server 404 is configured to assign the terminal 401 an identity of the terminal. The data center may include at least one application server 405. Multiple application servers can be independent and different physical devices, or they can integrate the functions of multiple application servers on the same physical device (such as multiple application servers within the jurisdiction of a cloud service provider), or Some application server functions are integrated on a physical device. Each application server can run one or more services (such as game services). Services can also be called applications. Each service can be deployed on multiple application servers and supported by multiple application servers. The terminal 401 is connected to the network device 402 in a wireless or wired manner. The network device 402 will be connected to other network devices in a wireless or wired manner. The network device 403 is connected to the application server 405 in a wireless or wired manner. The terminal can be a fixed location or movable. FIG. 4 is only a schematic diagram. The communication system may also include other devices, such as relay devices, which are not shown in FIG. 4. The embodiments of the present application do not limit the number of terminals, network devices, and application servers included in the communication system.

The terminal (Terminal) 401 may also be referred to as a terminal device, a user equipment (UE), a mobile station (mobile station, MS), a mobile terminal (mobile terminal, MT), and so on. The terminal 401 may be a mobile phone (mobile phone), a tablet computer (Pad), a computer with wireless transceiver function, a virtual reality (VR) terminal device, an augmented reality (Augmented Reality, AR) terminal device, an industrial control (industrial control) Wireless terminals in ), wireless terminals in self-driving, wireless terminals in remote medical surgery, wireless terminals in smart grid, and wireless terminals in transportation safety Terminals, wireless terminals in smart cities, wireless terminals in smart homes, and so on. The embodiments of the present application do not limit the specific technology and specific device form adopted by the terminal.

In some embodiments, the terminal 401 may send a data packet to the application server 405. The data packet includes a source address, and the source address indicates the identity of the terminal 401 (for example, the identity of the terminal 401 and the location of the terminal 401). In other embodiments, the terminal 401 may also receive data packets from the application server 405. The data packet may include a destination address, and the destination address indicates the identity of the terminal 401.

When a network device (such as network device 402 or network device 403) receives a data packet from terminal 401, it can encrypt the identification of terminal 401 to obtain a cipher text, replace the identification of terminal 401 with the cipher text, and forward the cipher text to the application server 405. The data packet of the text. Thus, the privacy information of the terminal is prevented from being leaked. The network device can be configured with a commonly used encryption algorithm, and use the encryption algorithm to encrypt the identification of the terminal 401.

It should be noted that, in order to prevent the network device from being unable to transmit the data packet to the application server 405 after the identification of the terminal is encrypted. The identity of the terminal 401 can be encrypted in a network device (such as the network device 402) close to the terminal 401. The network device (network device 403) close to the application server 405 encrypts the location identification of the terminal 401.

When the network device receives the data packet from the application server 405, the ciphertext included in the data packet can be decrypted to obtain the identity of the terminal 401, the ciphertext is replaced with the identity of the terminal 401, and the data packet containing the identity of the terminal 401 is forwarded to the terminal 401 . Thus, it is convenient to forward the data packet to the terminal 401.

The application server 405 can receive a data packet containing a ciphertext from the terminal 401. Since the identification of the terminal is encrypted, the application server 405 cannot obtain the identification of the terminal to avoid leaking the private information of the terminal 401, thereby preventing illegal attackers from analyzing the terminal's identity information and the terminal's location information based on the terminal's IP address. In addition, the data packet sent by the application server 405 to the terminal 401 may also contain the ciphertext.

Because there are untrusted devices or illegal eavesdroppers on the link between the terminal 401 and the application server 405. When the terminal 401 sends a data packet to the application server 405, the data packet will be forwarded by multiple network devices, and the identification of the terminal 401 will be encrypted by the network device, thereby avoiding the leakage of the terminal's private information.

Next, the data processing method provided by this application will be described in detail. 5 is a flowchart of a data processing method provided by an embodiment of the application. Here, the terminal 401 sends data to the application server 405, and the network device 402 and the network device 403 encrypt the identification of the terminal 401 as an example. As shown in Figure 5, the method may include:

S501. The terminal 401 sends a first data packet to the network device 402.

The first data packet includes a basic header, N extended headers and a data part. The N extension headers and data parts can be called payload or payload. Among them, the basic header includes version, traffic class, flow label, payload length, next header, hop limit, source Address (source address) and destination address (destination address). For the specific data structure of the first data packet, reference may be made to the above-mentioned FIG. 1, which will not be repeated. Wherein, the source address indicates the IP address of the terminal 401. The destination address indicates the IP address of the application server 405.

In some embodiments, the terminal 401 may encrypt and transmit the first data packet to the network device 402. For example, the terminal 401 may establish a secure channel between the terminal 401 and the network device 402 by using the tunnel technology, and transmit the first data packet through the secure channel. For example, the terminal 401 uses Internet Protocol Security (IPsec) to establish a secure channel with the network device 402. For another example, a virtual local area network (Virtual Private Network, VPN) channel is established between the terminal 401 and the network device 402. Since the identification of the terminal 401 is hidden through the secure channel, it is avoided that untrusted devices or illegal eavesdroppers on the link between the terminal 401 and the network device 402 steal the identification of the terminal 401. For example, the identification of the terminal 401 may be the IP address of the terminal 401. For another example, the identity of the terminal 401 may be the identity of the terminal 401. For another example, the identifier of the terminal 401 may be the address identifier of the terminal 401.

S502: The network device 402 receives the first data packet from the terminal 401.

The network device 402 may receive the first data packet from the terminal 401 through the secure channel. The first data packet includes the identification of the terminal 401. The identifier of the terminal 401 is set in the network layer protocol header included in the first data packet. The identifier of the terminal 401 is used to indicate the terminal 401. If the identity of the terminal 401 is the identity of the terminal 401, the identity of the terminal 401 is used to indicate the identity information of the terminal 401. If the identification of the terminal 401 is the location identification of the terminal 401, the identification of the terminal 401 is used to indicate the location information of the terminal 401.

In some embodiments, after the network device 402 receives the first data packet from the terminal 401, it determines that the header of the first data packet includes the identification of the terminal 401, and then encrypts the identification of the terminal 401, and executes S503.

In other embodiments, if the first data packet includes the first indication information, the first indication information is used to instruct to encrypt the identification of the terminal 401. After receiving the first data packet from the terminal 401, the network device 402 determines to encrypt the identification of the terminal 401 according to the first instruction information, and executes S503.

In a possible design, as shown in FIG. 6, the source address included in the first data packet includes a flag bit, and the value of the flag bit is used to indicate that the identification of the terminal 401 is encrypted. The mark bit occupies z bits in the source address. For example, the tag bit occupies 2 bits in the source address. The identity of the terminal 401 includes the identity of the terminal 401 and the location of the terminal 401.

Optionally, when the value of the flag bit is 00, it indicates that the identification of the terminal 401 does not need to be encrypted. When the value of the flag bit is 01, it means that the identification of the terminal 401 is encrypted.

Optionally, when the value of the flag bit is 00, it indicates that the identification of the terminal 401 does not need to be encrypted. When the value of the flag bit is 01, it means that the identity of the terminal 401 is encrypted. When the value of the flag bit is 10, it means that the location identifier of the terminal 401 is encrypted.

Optionally, when the value of the flag bit is 00, it means that the identification of the terminal 401 is encrypted. When the value of the flag bit is 01, it indicates that there is no need to encrypt the identification of the terminal 401.

S503. The network device 402 generates a first ciphertext according to the identity of the terminal 401, the first privacy variable, and the first key.

The network device 402 can extract the identity of the terminal 401 from the IP address of the terminal 401 included in the first data packet, encrypt the identity of the terminal 401 to obtain the first ciphertext, and generate a second data packet. Including the first ciphertext.

Specifically, as shown in FIG. 7, the network device 402 encrypts the identification of the terminal 401 includes the following steps.

S5031. The network device 402 generates a second ciphertext according to the first key and the first privacy variable.

The network device 402 may extract the first privacy variable from the header of the first data packet, and use an encryption algorithm to perform an encryption operation according to the first privacy variable and the first key to obtain the second ciphertext. Wherein, the first privacy variable includes at least one of time information, information related to the device that transmits or receives the first data packet, a random number, and a parameter that changes according to law. The first privacy variable can be set at any position in the network layer protocol header included in the first data packet.

For example, the first privacy variable can be hidden in the host identifier bits. For example, the first privacy variable is time information, and when the terminal 401 generates the identity of the terminal 401 in the first data packet, the time information is added. The network device 402 may extract the first privacy variable from the host identifier bits in the network layer protocol header included in the first data packet.

For another example, the first privacy variable is exposed in the network layer protocol header included in the first data packet. The network device 402 may extract the first privacy variable from the network layer protocol header included in the first data packet. For example, the first privacy variable is the destination IP address. For example, the length of the first data packet is variable, and a field for setting the first privacy variable is added to the network layer protocol header included in the first data packet.

For example, if the first privacy variable is information related to the device that transmits or receives the first data packet, the information related to the device that transmits or receives the first data packet is the destination IP address included in the first data packet. The destination IP address may be the address of the application server 405. The network device 402 may extract the first privacy variable from the network layer protocol header included in the first data packet. The second ciphertext satisfies the following formula (1).

C=E _SK1 (DstIP) (1)

Among them, C represents the second ciphertext. E() represents a secure block encryption algorithm. For example, the advanced encryption standard (AES)-256, and the packet length of AES-256 is 128 bits. SK1 represents the encryption key of the network device 402, that is, the first key. Dst IP represents the destination IP address included in the first data packet.

Generally, the length of the second ciphertext is relatively long. For example, the length of the second ciphertext is 128 bits. Therefore, the network device 402 processes the second ciphertext according to the identifier of the terminal 401, and obtains a ciphertext of the same length as the identifier of the terminal 401. Perform S5032.

S5032. The network device 402 determines the first ciphertext according to the second ciphertext and the identity of the terminal 401.

The network device 402 may intercept the second ciphertext according to the length of the identity identifier of the terminal 401 to obtain the y2bit value, and determine the first ciphertext according to the intercepted y2bit value and the identity of the terminal 401.

For example, an exclusive OR operation is performed on the second ciphertext and the identity of the terminal 401 to obtain the first ciphertext. The first ciphertext satisfies the following formula (2).

EHID=(C _y2 )XOR(HID) (2)

Among them, EHID represents the first ciphertext. C _y2 represents the value of y2 bits in the second ciphertext that is intercepted. HID represents the identity of the terminal 401. XOR stands for exclusive OR algorithm.

Optionally, the length of the first ciphertext is equal to the length of the identity of the terminal 401. The length of the second ciphertext is greater than the length of the identity of the terminal 401.

For different destination devices, the network device 402 can use different privacy variables to encrypt the identity of the terminal to obtain different ciphertexts. Therefore, the data packets received by different destination devices include different ciphertexts, avoiding collusion and association analysis of the traffic of the same terminal accessing different destination devices.

Further, the network device 402 encrypts the identity of the terminal 401, and after obtaining the first ciphertext, replaces the identity of the terminal 401 included in the first data packet with the first ciphertext to generate a second data packet. The first ciphertext is set in the network layer protocol header included in the second data packet.

Optionally, if the first privacy variable is exposed in the network layer protocol header included in the first data packet, the first privacy variable is set in the network layer protocol header included in the second data packet. For example, if the first privacy variable is the destination IP address, the first privacy variable is set in the network layer protocol header included in the second data packet. The first privacy variable is set in the network layer protocol header included in the second data packet, so that when the network device 402 receives the data packet containing the first ciphertext, the network device 402 extracts the data packet containing the first ciphertext The first privacy variable can use the first key and the first privacy variable to decrypt the first ciphertext to obtain the identity of the terminal 401.

Optionally, if the first privacy variable is hidden in the network layer protocol header included in the first data packet. For example, if the first privacy variable is time information, the first privacy variable can be hidden in the host identifier bit. The network device 402 replaces the identity of the terminal 401 with the first ciphertext, and the first privacy variable cannot be seen in the network layer protocol header included in the second data packet. The first privacy variable is hidden in the network layer protocol header included in the second data packet. Understandably, the first privacy variable is hidden in the first ciphertext.

For example, as shown in Figure 8, it is a schematic diagram of the encryption process of the source IP address. Wherein, for the first data packet generated by the terminal 401, the value of the external locator bit is a padding value. The padding value can be a bit string agreed by the system, such as 00000. The value of the internal locator bit is the location identifier of the terminal 401. The value of the host identifier bit is the identity of the terminal 401. In the following, it is assumed that the identity of the terminal 401 is HID, and the first ciphertext is EHID. After the network device 402 encrypts the HID to obtain the EHID, it replaces the HID with the EHID. The value of the host identifier bit may be the encrypted identity of the terminal 401, that is, the value of the host identifier bit is EHID.

S504. The network device 402 forwards a second data packet, where the second data packet includes the first ciphertext.

The network device 402 may forward the second data packet according to a forwarding rule such as a routing table. For details, reference may be made to the prior art, and details are not repeated.

S505: The network device 403 receives the second data packet.

The network device 403 may receive the second data packet from the network device 402, or the network device 403 may receive the second data packet forwarded from other network devices.

In some embodiments, after the network device 402 receives the second data packet from the terminal 401, it determines that the header of the second data packet includes the location identifier of the terminal 401, then encrypts the location identifier of the terminal 401, and executes S506.

In other embodiments, if the second data packet includes the first indication information, the first indication information is used to instruct to encrypt the identification of the terminal 401. After receiving the second data packet from the terminal 401, the network device 402 determines to encrypt the location identifier of the terminal 401 according to the first indication information, and executes S506. The specific implementation of the first indication information may be as described in S502 above, and will not be described in detail.

S506: The network device 403 generates a third ciphertext according to the location identifier of the terminal 401, the second privacy variable, and the second key.

The network device 403 may extract the location identifier of the terminal 401 from the IP address of the terminal 401 included in the second data packet, encrypt the location identifier of the terminal 401 to obtain the third ciphertext, and generate the third data packet, the third data packet Including the third ciphertext.

Specifically, as shown in FIG. 7, the network device 403 encrypts the location identifier of the terminal 401 including the following steps.

S5061. The network device 403 generates data to be encrypted according to the location identifier of the terminal 401 and the second privacy variable.

The network device 402 may extract the second privacy variable from the network layer protocol header included in the second data packet, and compose the data to be encrypted according to the location identifier of the terminal 401 and the second privacy variable.

In some embodiments, the second privacy variable is the encrypted identity of the terminal 401, that is, the first ciphertext. The second data packet includes the first ciphertext. The length of the data to be encrypted may be equal to the sum of the length of the terminal 401's identity identifier and the length of the terminal 401's location identifier.

Optionally, the length of the data to be encrypted may not be equal to the sum of the length of the identity identifier of the terminal 401 and the length of the location identifier of the terminal 401.

S5062. The network device 403 generates a third ciphertext according to the second key and the data to be encrypted.

The network device 403 uses an encryption algorithm to perform an encryption operation according to the second key and the data to be encrypted to obtain the third ciphertext. For example, the third ciphertext satisfies the following formula (3).

EIP=F _sk2 (SrcLoc||EHID) (3)

Among them, EIP represents the third ciphertext. F() represents a lightweight symmetric encryption algorithm, and the packet length of the encryption algorithm is the sum of y1 bits and y2 bits. SK2 represents the encryption key of the network device 403, that is, the second key. || represents the connector. EHID represents the first ciphertext. SrcLoc represents the location identifier of the terminal 401.

Further, the network device 403 encrypts the location identifier of the terminal 401, and after obtaining the third ciphertext, replaces the location identifier of the terminal 401 included in the second data packet with the third ciphertext to generate a third data packet. The third ciphertext is set in the network layer protocol header included in the third data packet.

In some embodiments, if the second privacy variable is the first ciphertext, it is understandable that both the identity identifier of the terminal 401 and the location identifier of the terminal 401 have been encrypted. The network device 403 replaces the first ciphertext and the location identifier of the terminal 401 with the third ciphertext. The second privacy variable is hidden in the network layer protocol header included in the third data packet. Understandably, the second privacy variable is hidden in the third ciphertext.

Optionally, the length of the third ciphertext is equal to the sum of the length of the identity identifier of the terminal 401 and the length of the location identifier of the terminal 401. Optionally, the length of the third ciphertext is not equal to the sum of the length of the identity identifier of the terminal 401 and the length of the location identifier of the terminal 401.

For example, as shown in Figure 9, it is a schematic diagram of the encryption process of the source IP address. Wherein, for the first data packet generated by the terminal 401, the value of the external locator bit is the filling value. The value of the internal locator bit is the location identifier of the terminal 401. The value of the host identifier bit is the identity of the terminal 401. The second data packet generated by the network device 402 is different from the first data packet in that the value of the host identifier bit is EHID. In the following, it is assumed that the third ciphertext is EIP. After the network device 403 encrypts the location identifier of the terminal 401 to obtain the EIP, it replaces the value of the internal locator bit and the value of the host identifier bit with EIP, that is, replaces the location identifier and EHID of the terminal 401 with EIP.

For different destination devices, the network device 402 can use different privacy variables to encrypt the location identifier of the terminal to obtain different ciphertexts. Therefore, data packets received by different destination devices include different ciphertexts, so as to avoid leaking the location identifier of the terminal 401.

In addition, the network device 403 may replace the value filling value of the external locator bit with the locator addressing the network device. For example, the value filling value of the external locator bit is replaced with the location identifier of the network device 403. In order to forward the third data packet to the application server 405. In addition, using the location identifier of the network device 403 as a new externally visible locator can prevent an untrusted destination device from analyzing the location identifier of the terminal 401.

S507. The network device 403 forwards the third data packet, where the third data packet includes the third ciphertext.

The network device 403 may forward the third data packet according to a forwarding rule such as a routing table. For details, reference may be made to the prior art, and details are not repeated.

S508. The application server 405 receives the third data packet.

The application server 405 may receive the third data packet from the network device 403, or the application server 405 may receive the third data packet forwarded by other network devices. After receiving the third data packet, the application server 405 parses the third data packet to obtain the data sent by the terminal 401 to the application server 405.

When the terminal 401 is not shut down, the terminal 401 can use a fixed IP address to communicate with the external network. Currently, in the webpage accessed by the terminal 401 through the browser, in addition to the visited main webpage, multiple third-party links are usually embedded, and multiple servers can extract the IP address of the terminal 401 from the data packet for correlation analysis. For example, user A uses an IP address to visit the W1 website at a certain time and uses the same IP address to visit the W2 website at the same time. If W1 and W2 are operated by the same parent company or the providers of W1 and W2 are partners that share data, Then the user's behavior in W1 and W2 can be correlated. If the user has registered the real-name identity information in W1, then W2 can associate the user’s real identity information based on the IP address, which will cause privacy leakage. Moreover, in the case of large-scale use of IPv6 in the future, IPv6 prefix information may reveal more specific location information. Only user behavior can be associated with a certain ID. For example, a user uses an application-layer user account to log in to a server, even if the user does not tell The server's specific location information, but the server can still trace the user's location and whereabouts based on the IP address.

In the embodiment of this application, the network device 402 and the network device 403 encrypt the terminal 401's identity to hide the terminal’s IP address to prevent illegal attackers (such as untrusted devices or illegal eavesdroppers) from obtaining the terminal’s IP address. According to the IP address of the terminal 401, the identity identifier of the terminal 401 and the location identifier of the terminal 401 are analyzed. Since the addresses of the same source host obtained by different destination hosts are not the same, it is impossible to analyze the traffic from the same source host to different destination hosts through collusion and correlation. The destination host or an illegal attacker can't analyze the IP address of the host that has fallen on the same LAN to find that the two hosts are from the same LAN.

After the application server 405 receives the data packet identified as the cipher text of the terminal 401, the application server 405 may also use the cipher text to send the data packet to the terminal 401. The specific transmission process of the data packet is described in the following embodiment.

Next, the data processing method provided by this application will be described in detail. 10 is a flowchart of a data processing method provided by an embodiment of the application. Here, the application server 405 sends data to the terminal 401, and the network device 402 and the network device 403 decrypt the identification of the terminal 401 as an example. As shown in Figure 10, the method may include:

S1001. The application server 405 sends a fourth data packet to the network device 403.

The fourth data packet includes a basic header, N extended headers and a data part. Among them, the basic header includes a source address (source address) and a destination address (destination address). For the specific data structure of the fourth data packet, reference may be made to the above-mentioned FIG. 1, which will not be repeated. The source address indicates the address of the application server 405. Since the source address contained in the third data packet sent by the terminal 401 received by the application server 405 is the third cipher text, the value of the destination address contained in the fourth data packet contains the third cipher text. The third ciphertext is set in the network layer protocol header included in the fourth data packet. The third ciphertext is determined according to the location identifier of the terminal 401, the second privacy variable, and the second key.

S1002. The network device 403 receives the fourth data packet from the application server 405.

The network device 403 may receive the fourth data packet from the application server 405, or the network device 403 may receive the fourth data packet forwarded by other network devices.

In some embodiments, after receiving the fourth data packet from the application server 405, the network device 403 determines that the header of the fourth data packet includes the third ciphertext, then decrypts the third ciphertext, and executes S1003.

In other embodiments, if the fourth data packet includes the second indication information, the second indication information is used to indicate that the identity of the terminal 401 has been encrypted. After receiving the fourth data packet from the application server 405, the network device 403 determines to decrypt the location identifier of the terminal 401 according to the second indication information, and executes S1003.

In a possible design, as shown in FIG. 11, the destination address included in the fourth data packet includes a flag bit, and the value of the flag bit is used to indicate that the identification of the terminal 401 has been encrypted. The mark bit occupies the z bit in the destination address. For example, the tag bit occupies 2 bits in the destination address. The identity of the terminal 401 includes the identity of the terminal 401 and the location of the terminal 401.

Optionally, when the value of the flag bit is 00, it means that the identification of the terminal 401 is not encrypted. When the value of the flag bit is 01, it indicates that the identification of the terminal 401 has been encrypted.

Optionally, when the value of the flag bit is 00, it means that the identification of the terminal 401 is not encrypted. When the value of the flag bit is 01, it indicates that the identity of the terminal 401 has been encrypted. When the value of the flag bit is 10, it indicates that the location identifier of the terminal 401 has been encrypted.

Optionally, when the value of the flag bit is 00, it indicates that the identification of the terminal 401 has been encrypted. When the value of the flag bit is 01, it means that the identification of the terminal 401 is not encrypted.

S1003. The network device 403 generates a location identifier of the terminal 401 according to the third ciphertext, the second privacy variable, and the second key.

The network device 403 may extract the third ciphertext from the destination address, decrypt the third ciphertext, obtain the location identifier of the terminal 401, and generate a fifth data packet, where the fifth data packet includes the location identifier of the terminal 401.

Specifically, as shown in FIG. 12, the network device 403 decrypts the third ciphertext including the following steps.

S1003a. The network device 403 generates a decryption result according to the third ciphertext and the second key.

The network device 403 uses a decryption algorithm to perform a decryption operation according to the second key and the third ciphertext to obtain the decryption result. For example, the decryption result satisfies the following formula (4).

P=D _sk2 (EIP) (4)

Among them, P represents the decryption result. D() is the decryption algorithm. SK2 represents the encryption key of the network device 403, that is, the second key. EIP stands for the third ciphertext.

S1003b. The network device 403 determines the location identifier of the terminal 401 according to the decryption result and the second privacy variable.

The network device 403 may obtain the second privacy variable from the network layer protocol header included in the fourth data packet, and determine the location identifier of the terminal 401 according to the decryption result and the second privacy variable. Optionally, the length of the decryption result may be equal to the sum of the length of the identity identifier of the terminal 401 and the length of the location identifier of the terminal 401. Optionally, the length of the decryption result may not be equal to the sum of the length of the identity identifier of the terminal 401 and the length of the location identifier of the terminal 401.

In some embodiments, if the second privacy variable is the encrypted identity of the terminal 401, that is, the first ciphertext. It is understandable that both the identity identifier of the terminal 401 and the location identifier of the terminal 401 have been encrypted. The length of the third ciphertext is equal to the sum of the length of the identity identifier of the terminal 401 and the length of the location identifier of the terminal 401. The decryption result includes the first ciphertext and the location identifier of the terminal 401. Understandably, the second privacy variable is hidden in the network layer protocol header included in the fourth data packet. The network device 403 can obtain the second privacy variable from the decryption result.

After the network device 403 decrypts the third ciphertext to obtain the decryption result, it can replace the third ciphertext included in the fourth data packet with the location identifier of the terminal 401 and the first ciphertext to generate the fifth data packet. The location identifier of the terminal 401 and the first ciphertext are set in the network layer protocol header included in the fifth data packet.

For example, as shown in Figure 13, it is a schematic diagram of the decryption process of the destination IP address. Wherein, for the fourth data packet generated by the application server 405, the value of the external locator bit is the location identifier of the network device 403. The value of the internal locator bit and the value of the host identifier bit may be the third ciphertext. After the network device 403 decrypts the third ciphertext to obtain the location identifier of the terminal 401 and the first ciphertext, it replaces the value EIP of the internal locator bit with the location identifier of the terminal 401, and replaces the value of the host identifier bit with The first ciphertext (SrcID=EHID).

The network device 403 decrypts the third ciphertext to obtain the location identifier of the terminal 401, and after replacing the third ciphertext, generates a fifth data packet, and the fifth data packet includes the location identifier of the terminal 401. Thereby, it is convenient to transmit the fifth data packet to the terminal 401.

In addition, the fourth data packet also includes a locator for addressing the network device. The network device 403 may replace the value of the external locator bit to the locator of the addressing network device with the padding value. For example, replace the location identifier of the network device 403 with the value of the external locator bit with the padding value. In order to forward the fifth data packet to the terminal 401.

S1004. The network device 403 forwards a fifth data packet, where the fifth data packet includes the location identifier of the terminal 401 and the first ciphertext.

The network device 403 may forward the fifth data packet according to a forwarding rule such as a routing table. For details, reference may be made to the prior art, and details are not repeated. The identifier of the terminal 401 is set in the network layer protocol header included in the fifth data packet.

S1005. The network device 402 receives the fifth data packet.

The network device 402 may receive the fifth data packet from the network device 403, or the network device 402 may receive the fifth data packet forwarded from other network devices.

In some embodiments, after the network device 402 receives the fifth data packet from the network device 403, it determines that the network layer protocol header contained in the fifth data packet includes the first ciphertext, and then decrypts the first ciphertext, and executes S1006.

In other embodiments, if the fifth data packet includes the second indication information, the second indication information is used to indicate that the identity of the terminal 401 has been encrypted. After the network device 402 receives the fifth data packet from the network device 403, it determines to decrypt the first ciphertext according to the second instruction information, and executes S1006. The specific implementation of the second indication information can be as described in S1002 above, and will not be described in detail.

S1006. The network device 402 generates the identity of the terminal 401 according to the first ciphertext, the first privacy variable, and the first key.

The network device 402 may extract the first ciphertext from the destination address, decrypt the first ciphertext, obtain the identity of the terminal 401, and generate a sixth data packet, where the sixth data packet includes the identity of the terminal 401.

Specifically, as shown in FIG. 12, the network device 402 decrypting the first ciphertext includes the following steps.

S1006a. The network device 402 generates a second ciphertext according to the first privacy variable and the first key.

The network device 402 may extract the first privacy variable from the network layer protocol header included in the fifth data packet, and use an encryption algorithm to perform an encryption operation according to the first privacy variable and the first key to obtain the second ciphertext. The length of the second ciphertext is greater than the length of the identity of the terminal 401. For the specific method of obtaining the second ciphertext, please refer to the description of S5031, which will not be repeated.

Wherein, the first privacy variable includes at least one of time information, information related to the device that transmits or receives the fifth data packet, a random number, and a parameter that changes according to law. For example, the information related to the device that transmits or receives the fifth data packet is the source IP address included in the fifth data packet. The source IP address may be the address of the application server 405. The first privacy variable is set in the network layer protocol header included in the fifth data packet. The fifth data packet also includes the location identifier of the terminal 401.

S1006b. The network device 402 determines the identity of the terminal 401 according to the second ciphertext and the first ciphertext.

The network device 402 may intercept the second ciphertext according to the length of the identity of the terminal 401 to obtain the y2 bit value, and determine the identity of the terminal 401 according to the intercepted y2 bit value and the first ciphertext. Optionally, the length of the first ciphertext is equal to the length of the terminal 401's identity. The length of the second ciphertext is greater than the length of the identity of the terminal 401.

For example, an exclusive OR operation is performed on the second ciphertext and the first ciphertext to obtain the identity of the terminal 401. The identity of the terminal 401 satisfies the following formula (5).

HID=(C _y2 )XOR(EHID) (5)

Among them, EHID represents the first ciphertext. C _y2 represents the value of y2 bits in the second ciphertext that is intercepted. HID represents the identity of the terminal 401. XOR stands for exclusive OR algorithm.

Further, after the network device 402 decrypts the first ciphertext to obtain the identity of the terminal 401, it replaces the first ciphertext included in the fifth data packet with the identity of the terminal 401 to generate a sixth data packet. The identity of the terminal 401 is set in the network layer protocol header included in the sixth data packet.

For example, as shown in FIG. 14, it is a schematic diagram of the decryption process of the destination IP address. Wherein, for the fourth data packet generated by the application server 405, the value of the external locator bit is the location identifier of the network device 403. The value of the internal locator bit and the value of the host identifier bit may be the third ciphertext. For the fifth data packet generated by the network device 403, the value of the external locator bit is the filling value. The value of the internal locator bit is the location identifier of the terminal 401. The value of the host identifier bit may be the first ciphertext. After the network device 402 decrypts the first ciphertext to obtain the identity of the terminal 401, it replaces the first ciphertext (SrcID=EHID) of the host identifier bit with the identity of the terminal 401 (SrcID=HID).

S1007. The network device 402 forwards a sixth data packet, where the sixth data packet includes the identity of the terminal 401.

The network device 402 may forward the sixth data packet according to a forwarding rule such as a routing table. For details, reference may be made to the prior art, and details are not repeated.

S1008. The terminal 401 receives the sixth data packet.

The terminal 401 may receive the sixth data packet from the network device 402, or the terminal 401 may receive the sixth data packet forwarded by other network devices. After receiving the sixth data packet, the terminal 401 parses the sixth data packet to obtain the data sent by the application server 405 to the terminal 401.

Therefore, the network device 402 and the network device 403 decrypt the ciphertext so as to transmit the data of the application server 405 to the terminal 401.

In other embodiments, if the second privacy variable is the identity of the terminal 401. It is understandable that after the network device 402 receives the first data packet from the terminal 401, S503 is not executed, that is, the identity identifier of the terminal 401 is not encrypted, and the first data packet is forwarded. The network device 403 receives the first data packet, and the first data packet includes the identity of the terminal 401. The network device 403 can encrypt the identity of the terminal 401 and the location of the terminal 401 according to the second key to obtain the third ciphertext, and replace the identity of the terminal 401 and the location of the terminal 401 with the third ciphertext. The second privacy variable may be the identity of the terminal 401. The length of the third ciphertext is equal to the sum of the length of the identity identifier of the terminal 401 and the length of the location identifier of the terminal 401. For the encryption process, please refer to the description of S506, which will not be repeated.

As an example, as shown in (a) of FIG. 15, it is a schematic diagram of the encryption process of the source IP address. Wherein, for the first data packet generated by the terminal 401, the value of the external locator bit is the filling value. The value of the internal locator bit may be the location identifier of the terminal 401. The value of the host identifier bit may be the identity of the terminal 401. The network device 403 encrypts the identity of the terminal 401 and the location of the terminal 401 to obtain the third ciphertext (EIP), and replaces the value of the internal locator bit and the value of the host identifier bit with EIP, that is, replaces the terminal with EIP The location identifier of 401 and the identity identifier of the terminal 401.

The third ciphertext is decrypted at the network device 403 to obtain a decryption result. The decryption result includes the identity of the terminal 401 and the location of the terminal 401. Understandably, the second privacy variable is hidden in the network layer protocol header included in the fourth data packet. The second privacy variable may be the identity of the terminal 401. The decryption result includes the identity of the terminal 401, and the network device 403 can obtain the second privacy variable from the decryption result. The location identifier of the terminal 401 and the identity identifier of the terminal 401 may be used to replace the third ciphertext.

Illustratively, as shown in (b) of FIG. 15, it is a schematic diagram of the decryption process of the destination IP address. The network device 403 replaces the value of the host identifier bit with the identity identifier of the terminal 401 (SrcID=HID), and replaces the value of the internal locator bit with the location identifier of the terminal 401.

In some other embodiments, the first privacy variable includes at least one of time information, information related to a device that transmits or receives the first data packet, a random number, and a parameter that changes regularly. Wherein, the information related to the device that transmits or receives the first data packet is the destination IP address included in the first data packet. The destination IP address may be the address of the application server 405. The network device 402 may use the first key and the first privacy variable to encrypt the identity of the terminal 401 to obtain the first ciphertext, and then replace the identity of the terminal 401 with the first ciphertext to obtain the second data packet. The first ciphertext may be set in the network layer protocol header included in the second data packet. Optionally, the length of the first ciphertext is equal to the length of the identity of the terminal 401. Optionally, the length of the source address is variable. The length of the first ciphertext may not be equal to the length of the identity of the terminal 401.

Wherein, the first privacy variable can be set at any position in the network layer protocol header included in the second data packet.

For example, the first privacy variable can be hidden in the host identifier. For example, the first privacy variable is time information, and the terminal 401 adds the time information when generating the host identifier of the host identifier bit in the first data packet. The network device 402 may extract the first privacy variable from the host identifier bits in the network layer protocol header included in the first data packet.

For another example, the first privacy variable is exposed in the network layer protocol header included in the first data packet. The network device 402 may extract the first privacy variable from the network layer protocol header included in the first data packet. For example, the first privacy variable is the destination IP address. For example, the length of the first data packet is variable, and a field for setting the first privacy variable is added to the network layer protocol header included in the first data packet. The network device 402 may extract the first privacy variable from the network layer protocol header included in the first data packet.

The network device 402 can use the encryption method of S506 or S503 to encrypt the identity of the terminal 401. For the detailed encryption process, please refer to the description of S506 or S503, which will not be repeated.

If the first privacy variable is exposed in the network layer protocol header included in the first data packet, the network device 402 uses the encryption method of S503 to encrypt the identity of the terminal 401. The first privacy variable is set in the network layer protocol header included in the second data packet, so that when the network device 402 receives the data packet containing the first ciphertext, the network device 402 extracts the data packet containing the first ciphertext The first privacy variable can use the first key and the first privacy variable to decrypt the first ciphertext to obtain the identity of the terminal 401.

If the first privacy variable is hidden in the network layer protocol header included in the first data packet, the network device 402 uses the encryption method of S506 to encrypt the identity of the terminal 401. The first privacy variable is hidden in the network layer protocol header included in the second data packet. The network device 402 may decrypt the first ciphertext to obtain a decryption result, and the decryption result includes the first privacy variable. The network device 402 obtains the first privacy variable from the decryption result.

The second privacy variable includes at least one of time information, information related to the device that transmits or receives the second data packet, a random number, and a parameter that changes regularly. The information related to the device that transmits or receives the second data packet is the destination IP address contained in the second data packet, that is, the IP address of the application server 405. The network device 403 may use the second key and the second privacy variable to encrypt the location identifier of the terminal 401 to obtain the third ciphertext, and replace the location identifier of the terminal 401 with the third ciphertext to obtain the third data packet. The third ciphertext may be set in the network layer protocol header included in the third data packet. Optionally, the length of the third ciphertext is equal to the length of the location identifier of the terminal 401. Optionally, the length of the source address is variable. The length of the third ciphertext may not be equal to the length of the location identifier of the terminal 401.

Among them, the second privacy variable can be set anywhere in the second data packet.

For example, the second privacy variable is hidden in the network layer protocol header included in the second data packet. For example, the second privacy variable can be hidden in the internal locator. The second privacy variable is time information. When the terminal 401 generates the internal locator of the internal locator in the first data packet, the time information is added. The network device 403 may extract the second privacy variable from the internal locator bit in the network layer protocol header included in the second data packet.

For another example, the second privacy variable is exposed in the network layer protocol header included in the second data packet. The network device 403 may extract the second privacy variable from the network layer protocol header included in the second data packet. For example, the second privacy variable is the destination IP address. For example, the length of the second data packet is variable, and a field for setting the second privacy variable is added to the network layer protocol header included in the second data packet.

The network device 403 can use the encryption method of S506 or S503 to encrypt the location identifier of the terminal 401. For the detailed encryption process, please refer to the description of S506 or S503, which will not be repeated.

If the second privacy variable is exposed in the network layer protocol header included in the second data packet, the network device 403 uses the encryption method of S503 to encrypt the location identifier of the terminal 401. The second privacy variable is set in the network layer protocol header included in the third data packet, so that when the network device 403 receives the data packet containing the third cipher text, the network device 403 extracts the data packet containing the third cipher text The second privacy variable can use the second key and the second privacy variable to decrypt the third ciphertext to obtain the location identifier of the terminal 401.

If the second privacy variable is hidden in the network layer protocol header included in the second data packet, the network device 403 uses the encryption method of S506 to encrypt the location identifier of the terminal 401. The second privacy variable is hidden in the network layer protocol header included in the third data packet. The network device 403 may decrypt the third ciphertext to obtain a decryption result, and the decryption result includes the second privacy variable. The network device 403 obtains the second privacy variable from the decryption result.

Optionally, the first privacy variable and the second privacy variable may be the same. For example, the first privacy variable and the second privacy variable are both the same time information.

Optionally, the first privacy variable and the second privacy variable may be different.

For example, as shown in Figure 16, it is a schematic diagram of the encryption process of the source IP address. Among them, for the first data packet generated by the terminal 401, the value of the external locator bit can be the padding value, the value of the internal locator bit can be the location identifier of the terminal 401, and the value of the host identifier bit can be the value of the terminal 401 Identification. For the second data packet generated by the network device 402, the value of the external locator bit may be a padding value, the value of the internal locator bit may be the location identifier of the terminal 401, and the value of the host identifier bit may be EHID. After the network device 402 encrypts the identity of the terminal 401 to obtain the EHID, it replaces the identity of the terminal 401 with the EHID. For the third data packet generated by the network device 403, the value of the external locator bit can be the locator of the network device 403, the value of the internal locator bit can be EIP, and the value of the host identifier bit can be EHID. After the network device 403 encrypts the location identifier of the terminal 401 to obtain the EIP, it replaces the value of the internal locator bit with EIP, that is, replaces the location identifier of the terminal 401 with EIP.

The method for encrypting the location identifier of the terminal 401 and the identity identifier of the terminal 401 is not limited.

For example, the network device 402 may use the encryption method of S503 to encrypt the identity of the terminal 401. The network device 403 may use the encryption method of S503 to encrypt the location identifier of the terminal 401.

For another example, the network device 402 may use the encryption method of S506 to encrypt the identity of the terminal 401. The network device 403 may use the encryption method of S506 to encrypt the location identifier of the terminal 401.

For another example, the network device 402 may use the encryption method of S503 to encrypt the identity of the terminal 401. The network device 403 may use the encryption method of S506 to encrypt the location identifier of the terminal 401.

For another example, the network device 402 may use the encryption method of S506 to encrypt the identity of the terminal 401. The network device 403 may use the encryption method of S503 to encrypt the location identifier of the terminal 401.

Correspondingly, the network device 403 may use the second key and the second privacy variable to decrypt the third ciphertext to obtain the location identifier of the terminal 401, and then replace the third ciphertext with the location identifier of the terminal 401 to obtain the fifth data packet. The third ciphertext may be set in the network layer protocol header included in the fourth data packet. Optionally, the length of the third ciphertext is equal to the length of the location identifier of the terminal 401. Optionally, the length of the destination address is variable. The length of the third ciphertext may not be equal to the length of the location identifier of the terminal 401.

Among them, the second privacy variable can be set anywhere in the fourth data packet. For example, the second privacy variable is exposed in the network layer protocol header included in the fourth data packet, and the network device 403 extracts the second privacy variable from the network layer protocol header included in the fourth data packet. For another example, the second privacy variable is hidden in the network layer protocol header included in the second data packet. The network device 403 may decrypt the third ciphertext to obtain a decryption result, and the decryption result includes the second privacy variable. The network device 403 obtains the second privacy variable from the decryption result. For specific explanation, please refer to the explanation of the encryption process of the network device 403 above. Therefore, when the network device 403 receives the fourth data packet containing the third ciphertext, it can use the second key and the second privacy variable to decrypt the third ciphertext to obtain the location identifier of the terminal 401. The second privacy variable includes at least one of time information, information related to the device that transmits or receives the fourth data packet, a random number, and a parameter that changes regularly. Wherein, the information related to the device that transmits or receives the fourth data packet is the source IP address included in the fourth data packet, that is, the IP address of the application server 405.

The network device 403 can use the decryption method of S1006 or S1003 to decrypt the location identifier of the terminal 401. For the detailed decryption process, please refer to the description of S1006 or S1003, which will not be repeated. The fourth data packet also includes the first ciphertext. The first ciphertext may be set in the network layer protocol header included in the fourth data packet.

The network device 402 can use the first key and the first privacy variable to decrypt the first ciphertext to obtain the identity of the terminal 401, and then replace the first ciphertext with the identity of the terminal 401 to obtain the sixth data packet. The first ciphertext may be set in the network layer protocol header included in the fifth data packet. Optionally, the length of the first ciphertext is equal to the length of the identity of the terminal 401. Optionally, the length of the destination address is variable. The length of the first ciphertext may not be equal to the length of the identity of the terminal 401.

Among them, the first privacy variable can be set anywhere in the fifth data packet. For example, the first privacy variable is exposed in the network layer protocol header included in the fifth data packet, and the network device 402 extracts the first privacy variable from the network layer protocol header included in the fifth data packet. For another example, the first privacy variable is hidden in the network layer protocol header included in the fifth data packet. The network device 402 may decrypt the first ciphertext to obtain a decryption result, and the decryption result includes the first privacy variable. The network device 402 obtains the first privacy variable from the decryption result. For specific explanation, refer to the explanation of the encryption process of the network device 402 described above. Therefore, when the network device 402 receives the fifth data packet containing the first ciphertext, it can use the first key and the first privacy variable to decrypt the first ciphertext to obtain the identity of the terminal 401. The first privacy variable includes at least one of time information, information related to the device transmitting or receiving the fifth data packet, a random number, and a parameter that changes regularly. Wherein, the information related to the device that transmits or receives the fifth data packet is the source IP address included in the fifth data packet, that is, the IP address of the application server 405.

The network device 402 can use the decryption method of S1006 or S1003 to decrypt the identity of the terminal 401. For the detailed decryption process, please refer to the description of S1006 or S1003, which will not be repeated.

For example, as shown in FIG. 17, it is a schematic diagram of the decryption process of the destination IP address. For the fourth data packet generated by the application server 405, the value of the external locator bit is the location identifier of the network device 403. The value of the internal locator bit is EIP. The value of the host identifier bit can be EHID. For the fifth data packet generated by the network device 403, the value of the external locator bit is the filling value. The value of the internal locator bit is the location identifier of the terminal 401. The value of the host identifier bit can be EHID. After the network device 403 decrypts the EIP to obtain the location identifier of the terminal 401, it replaces the EIP with the location identifier of the terminal 401. Optionally, the value of the host identifier bit may also be the identity of the terminal 401. For the fifth data packet generated by the network device 402, the value of the external locator bit is the filling value. The value of the internal locator bit is the location identifier of the terminal 401. The value of the host identifier bit may be the identity identifier (HID) of the terminal 401. After the network device 402 decrypts the EHID to obtain the identity of the terminal 401, it replaces the EHID with the identity of the terminal 401.

The method for decrypting the third ciphertext to obtain the location identifier of the terminal 401 is not limited. The method for decrypting the identity of the terminal 401 obtained by decrypting the first ciphertext is not limited.

For example, the network device 402 may use the decryption method of S1003 to decrypt the first ciphertext to obtain the identity of the terminal 401. The network device 403 may use the decryption method of S1003 to decrypt the third ciphertext to obtain the location identifier of the terminal 401.

For another example, the network device 402 may use the decryption method of S1006 to decrypt the first ciphertext to obtain the identity of the terminal 401. The network device 403 may use the decryption method of S1006 to decrypt the third ciphertext to obtain the location identifier of the terminal 401.

For another example, the network device 402 may use the decryption method of S1003 to decrypt the first ciphertext to obtain the identity of the terminal 401. The network device 403 may use the decryption method of S1006 to decrypt the third ciphertext to obtain the location identifier of the terminal 401.

For another example, the network device 402 may use the decryption method of S1006 to decrypt the first ciphertext to obtain the identity of the terminal 401. The network device 403 may use the decryption method of S1003 to decrypt the third ciphertext to obtain the location identifier of the terminal 401.

Optionally, after the network device 402 receives the first data packet from the terminal 401, S503 is not executed, that is, the identity identifier of the terminal 401 is not encrypted, and the first data packet is forwarded. The network device 403 receives the first data packet, and the first data packet includes the identity of the terminal 401. The network device 403 may encrypt the location identifier of the terminal 401 according to the second key and the second privacy variable to obtain the third ciphertext, and replace the location identifier of the terminal 401 with the third ciphertext. Optionally, the length of the third cipher text is equal to the length of the location identifier of the terminal 401; or, the length of the third cipher text is not equal to the length of the location identifier of the terminal 401. For the encryption process, please refer to the description of S506 or S503, which will not be repeated.

Optionally, the second privacy variable may be the first ciphertext (EHID). After the network device 402 encrypts the identity of the terminal 401 to obtain the EHID, the identity of the terminal 401 is replaced with the EHID. After the network device 403 encrypts the location identifier of the terminal 401 to obtain the EIP, it replaces the value of the internal locator bit with EIP, that is, replaces the location identifier of the terminal 401 with EIP. The network device 403 may generate a fourth ciphertext according to the second key and the first ciphertext, and then determine the third ciphertext (EIP) according to the fourth ciphertext and the location identifier of the terminal 401. For the specific encryption method, please refer to the description of S503, which will not be repeated. The network device 403 replaces the value of the internal locator bit with EIP, that is, replaces the location identifier of the terminal 401 with EIP. The value of the host identifier bit may be the encrypted identity of the terminal 401, that is, the first cipher text (EHID).

When the network device 403 decrypts the third ciphertext, the network device 403 generates a fourth ciphertext according to the second key and the first ciphertext, and determines the location identifier of the terminal 401 according to the fourth ciphertext and the third ciphertext. The network device 403 may replace the value EIP of the host identifier bit with the location identifier of the terminal 401.

The data processing method provided in this application can be applied in a cloud environment, enabling cloud service providers that have deployed a large number of edge nodes to provide users with privacy protection capabilities. Users can choose the cloud service that provides the privacy protection capabilities of IPv6 addresses for forwarding data packets. For example, multiple application servers 405 in FIG. 4 may be application servers within the jurisdiction of a cloud service provider. Cloud service providers can deploy a large number of edge nodes to provide users with data transmission services. Among them, the edge node close to the terminal may be referred to as a near-source end node, for example, the network device 402 in FIG. 4. The edge node close to the website server (such as the application server 405) may be called the near-destination node, for example, the network device 403 in FIG. 4. When the terminal 401 sends data to the application server 405, the edge node of the cloud service provider can be selected to provide services for the terminal 401.

As an example, as shown in FIG. 18, it is a schematic diagram of the architecture of a communication system based on cloud services. The communication system includes at least one terminal 401, an internet network, and at least one application server. The internetwork may include at least one network device (for example, network device 402 and network device 403). Among them, it is assumed that the IP address of the terminal 401 is IP _UE , and the identity of the terminal 401 is HID _UE . The IP address of the network device 402 is IP0. The IP address of the network device 403 is IP1. The IP address of the application server 405 is IP _s1 . For other explanations of the communication system, reference may be made to the explanation of FIG. 4, which will not be repeated. Next, in conjunction with FIG. 19 and FIG. 20, a cloud service-based communication system will describe data processing. As shown in FIG. 19, the data processing method described in the embodiment of the present application includes the following steps.

S1901. The terminal 401 sends a first data packet to the network device 402.

The terminal 401 selects the cloud service provider node closest to the terminal 401, that is, the network device 402. The terminal 401 establishes a secure channel with the network device 402, and sends the first data packet sent by the terminal 401 to the network device 402 through the secure channel. Wherein, the inner IP header of the first data packet contains the source address and the destination address. Wherein, the source address includes the identification bit and the identity of the terminal 401 is HID _UE . The destination address includes the IP address of the application server 405 as IP _s1 . The outer IP header of the first data packet contains the source address and the destination address. The source address is the IP address of the terminal 401 is IP _UE , and the destination address is the IP address of the network device 402 is IP0.

S1902. The network device 402 receives the first data packet from the terminal 401.

The network device 402 receives the first data packet, and first decapsulates the first data packet to obtain the destination address of the inner IP header, that is, the IP address IP _{s1 of the} application server 405. The cloud provider node closest to the application server 405, that is, the network device 403, is selected according to the IP address IP _{s1 of the application server 405.}

S1903. The network device 402 forwards the second data packet to the network device 403.

The network device 402 establishes a secure channel with the network device 403, and sends the second data packet sent by the network device 402 to the network device 403 through the secure channel. Wherein, the inner IP header of the second data packet contains the source address and the destination address. Wherein, the source address includes the identification bit and the identity identifier HID _{UE of the} terminal 401. The destination address includes the IP address IP _{s1 of the} application server 405. The outer IP header of the second data packet contains the source address and the destination address. The source address is the IP address IP0 of the network device 402, and the destination address is the IP address IP1 of the network device 403.

S1904. The network device 403 receives the second data packet from the network device 402.

The network device 403 receives the second data packet, and first decapsulates the second data packet to obtain the source address and the destination address of the inner IP header. Wherein, the source address is the terminal 401 and the identity is HID _UE . The destination address is the IP address IP _s1 of the application server 405.

S1905. The network device 403 generates a first ciphertext according to the identity of the terminal 401, the first privacy variable, and the first key.

The network device 403 encrypts and protects the _{HID UE of the terminal 401.} For example, the network device 403 generates the second ciphertext according to the first key and the first privacy variable, and determines the first ciphertext according to the second ciphertext and the HID _{UE of the} terminal 401. The first privacy variable may be the IP address IP _s1 of the application server 405. The network device 403 replaces the identity (HID _UE ) of the terminal 401 with the first cipher text (EHID). For details, please refer to the description of S503, which will not be repeated.

S1906: The network device 403 generates a third ciphertext according to the location identifier of the network device 402, the second privacy variable, and the second key.

The network device 403 encrypts and protects the location identifier of the network device 402. For example, the network device 403 generates the data to be encrypted according to the location identifier of the network device 402 and the second privacy variable, and generates the third ciphertext (EIP) according to the second key and the data to be encrypted. The network device 403 replaces the location identifier and EHID of the network device 402 with the third ciphertext. For details, please refer to the description of S506, which will not be repeated.

Among them, the second privacy variable may be the first ciphertext. The location identifier of the network device 402 may be an index of the network device 402. Optionally, the network device 403 may query the locator index mapping table according to the IP address IP0 of the network device 402 to obtain the index of the network device 402.

The difference from the foregoing embodiment is that the encryption of the location identifier of the terminal 401 in the foregoing embodiment is replaced by the encryption and protection of the location identifier of the network device 402.

S1907. The network device 403 forwards the third data packet to the application server 405.

The network device 403 forwards the third data packet to the application server 405. The third data packet includes the third ciphertext and the IP address of the network device 403 is IP1.

S1908. The application server 405 receives the third data packet from the network device 403.

Further, after the application server 405 receives the data packet identified as the cipher text of the terminal 401, that is, after S1901 to S1908, the application server 405 may also use the cipher text to send the data packet to the terminal 401. As shown in FIG. 20, the data processing method described in the embodiment of the present application further includes the following steps.

S1909. The application server 405 sends a fourth data packet to the network device 403.

The value of the destination address included in the fourth data packet includes the third ciphertext. The third ciphertext is set in the network layer protocol header included in the fourth data packet.

S1910. The network device 403 receives the fourth data packet from the application server 405.

S1911. The network device 403 generates the first ciphertext according to the third ciphertext, the second privacy variable, and the second key.

The network device 403 decrypts the third ciphertext, that is, generates a decryption result according to the third ciphertext and the second key, and determines the location identifier of the network device 402 according to the decryption result and the second privacy variable, that is, according to the decryption result and the first ciphertext The location identifier of the network device 402 is determined. For details, please refer to the description of S1103, which will not be repeated.

After the network device 403 decrypts the third ciphertext to obtain the decryption result, the location identifier of the network device 402 and the first ciphertext may be used to replace the third ciphertext included in the fourth data packet to generate the fifth data packet. The location identifier of the network device 402 and the first ciphertext are set in the network layer protocol header included in the fifth data packet.

S1912. The network device 403 generates the identity of the terminal 401 according to the first ciphertext, the first privacy variable, and the first key.

The network device 403 decrypts the first ciphertext to obtain the identity of the terminal 401, and replaces the first ciphertext included in the fourth data packet with the identity of the terminal 401 to generate a fifth data packet. The identity of the terminal 401 is set in the network layer protocol header included in the fifth data packet.

For example, the network device 402 generates a second ciphertext according to the first privacy variable and the first key, and determines the identity of the terminal 401 according to the second ciphertext and the first ciphertext. The first privacy variable may be the IP address IP _s1 of the application server 405. For details, please refer to the description of S1106, which will not be repeated.

S1913. The network device 403 forwards the fifth data packet to the network device 402.

The network device 403 forwards the fifth data packet to the network device 402 through the secure channel according to the location identifier of the network device 402. Wherein, the inner IP header of the fifth data packet contains the source address and the destination address. Wherein, the source address includes the IP address IP _{s1 of the} application server 405. The destination address includes the location identifier of the network device 402 and the identity identifier of the terminal 401 (HID _UE ). The outer IP header of the fifth data packet contains the source address and the destination address. The source address is the IP address IP1 of the network device 403. The destination address is the IP address IP0 of the network device 402.

S1914. The network device 402 receives the fifth data packet from the network device 403.

S1915. The network device 402 forwards the sixth data packet to the terminal 401.

The network device 402 forwards the sixth data packet to the terminal 401 through the secure channel.

Among them, the inner IP header of the sixth data packet contains the source address and the destination address. Wherein, the source address includes the IP address IP _{s1 of the} application server 405. The destination address includes the location identifier of the network device 402 and the identity identifier of the terminal 401 (HID _UE ). The outer IP header of the sixth data packet contains the source address and the destination address. The source address is the IP address IP0 of the network device 402. The destination address is the IP address IP _UE of the terminal 401.

S1916. The terminal 401 receives the sixth data packet from the network device 402.

In the embodiment of this application, the network device 402 and the network device 403 encrypt the terminal 401's identity to hide the terminal’s IP address to prevent illegal attackers (such as untrusted devices or illegal eavesdroppers) from obtaining the terminal’s IP address. According to the IP address of the terminal 401, the identity identifier of the terminal 401 and the location identifier of the terminal 401 are analyzed. Since the addresses of the same source host obtained by different destination hosts are not the same, it is impossible to analyze the traffic from the same source host to different destination hosts through collusion and correlation. The destination host or an illegal attacker can't analyze the IP address of the host that has fallen on the same LAN to find that the two hosts are from the same LAN.

For example, as shown in Figure 21, it is a schematic diagram of the encryption process of the source IP address. Among them, for the data packet generated by the terminal 401, the value of the external locator bit is the filling value. The value of the internal locator bit may be the index of the network device 402. The value of the host identifier bit may be the identity identifier HID _UE of the terminal 401. The network device 403 first _{encrypts the HID UE} of the terminal 401 to obtain the EHID, and replaces the value of the host identifier bit with the EHID. The network device 403 then encrypts the EHID and the index of the network device 402 to generate EIP, and replaces the value of the internal locator bit with the index and EHID of the network device 402. For the specific encryption method, please refer to the description of the above-mentioned embodiment, which will not be repeated.

Among them, the external locator bit occupies x bits in the source address. For example, the external locator bit occupies 62 bits in the destination address. The internal locator bit occupies y1 bit in the source address. For example, the internal locator bit occupies 48 bits in the source address. The host identifier bit occupies y2 bits in the source address. For example, the host identifier bit occupies 16 bits in the source address. The tag bit occupies z bits in the source address. For example, the tag bit occupies 2 bits in the source address.

As shown in Figure 22, it is a schematic diagram of the decryption process of the destination IP address. Wherein, the data packet generated by the application server 405 includes EIP. The network device 403 first decrypts the EIP to obtain the index and EHID of the network device 402, which are used to replace the EIP with the index and EHID of the network device 402. The network device 403 decrypts the EHID to obtain the HID _UE , and replaces the EHID with the HID _UE. For the specific decryption method, please refer to the description of the above-mentioned embodiment, which will not be repeated.

For other achievable manners of the encryption process in the embodiment of the present application, reference may be made to the description of the foregoing embodiment, which will not be repeated.

The foregoing embodiments describe the process of encrypting the identification of the terminal for different scenarios. In summary, the network device encrypts the terminal's identity according to the key and privacy variables to obtain the ciphertext, and replace the terminal's identity with the ciphertext. The network device sends the second data packet again, and the second data packet includes the ciphertext. Therefore, the network device encrypts the terminal's identity to hide the terminal's IP address, preventing illegal attackers (such as untrusted devices or illegal eavesdroppers) from obtaining the terminal's IP address, and analyzes the terminal's identity based on the terminal's IP address And the location identification of the terminal.

Next, as shown in FIG. 23, a flowchart of a data processing method provided by an embodiment of the present application. The method can include the following steps:

S2301. The terminal sends a first data packet to a network device, where the first data packet includes an identifier of the terminal.

The terminal identifier is used to indicate the terminal; the terminal identifier is set in the network layer protocol header included in the first data packet.

S2302. The network device receives the first data packet.

S2303. The network device generates a first ciphertext according to the terminal's identity, privacy variable, and key.

The identity of the terminal may be the identity of the terminal or the location of the terminal. If the network device and key for encrypting the terminal's identity identifier and the terminal's location identifier can be different or the same, it is not limited. For details, please refer to the descriptions of S503, S506, S1905, and S1906, which will not be repeated.

S2304. The network device sends a second data packet, where the second data packet includes the first ciphertext.

The first ciphertext is set in the network layer protocol header included in the second data packet.

S2305. The application server receives the second data packet.

S2306. The application server sends a third data packet to the network device, where the third data packet includes the first ciphertext.

The first ciphertext is determined according to the terminal's identity, privacy variables, and keys. The identifier of the terminal is used to indicate the terminal, and the first ciphertext is set in the network layer protocol header included in the third data packet.

S2307. The network device receives the third data packet.

S2308. The network device generates an identification of the terminal according to the first ciphertext, the privacy variable, and the key.

For the corresponding decryption process, please refer to the description of S1003, S1006, S1911 and S1912, which will not be repeated.

S2309. The network device sends a fourth data packet, where the fourth data packet includes the identifier of the terminal.

The identification of the terminal is set in the network layer protocol header included in the fourth data packet.

S2310. The terminal receives the fourth data packet.

It can be understood that, in order to implement the functions in the foregoing embodiments, the network device includes hardware structures and/or software modules corresponding to each function. Those skilled in the art should easily realize that, in combination with the units and method steps of the examples described in the embodiments disclosed in the present application, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software-driven hardware depends on the specific application scenarios and design constraints of the technical solution.

24 and FIG. 25 are schematic structural diagrams of possible data processing apparatuses provided by embodiments of this application. These data processing apparatuses can be used to implement the functions of the network equipment in the foregoing method embodiments, and therefore can also achieve the beneficial effects of the foregoing method embodiments. In the embodiment of the present application, the data processing apparatus may be a network device 402 or a network device 403 as shown in FIG. 4, and may also be a module (such as a chip) applied to a network device.

As shown in FIG. 24, the data processing device 2400 includes a receiving unit 2410, a processing unit 2420, and a sending unit 2430. The data processing apparatus 2400 is used to implement the functions of the network device in the method embodiment shown in FIG. 5, FIG. 7, FIG. 10, FIG. 12, FIG. 19, FIG. 20, or FIG. 23.

When the data processing apparatus 2400 is used to implement the function of the network device 402 in the method embodiment shown in FIG. 5: the receiving unit 2410 is used to perform S502; the processing unit 2420 is used to perform S503; and the sending unit 2430 is used to perform S504.

When the data processing device 2400 is used to implement the function of the network device 403 in the method embodiment shown in FIG. 5: the receiving unit 2410 is used to perform S505; the processing unit 2420 is used to perform S506; and the sending unit 2430 is used to perform S507.

When the data processing apparatus 2400 is used to implement the function of the network device 402 in the method embodiment shown in FIG. 7: the receiving unit 2410 is used to perform S502; the processing unit 2420 is used to perform S5031 and S5032; and the sending unit 2430 is used to perform S504.

When the data processing device 2400 is used to implement the function of the network device 403 in the method embodiment shown in FIG. 7: the receiving unit 2410 is used to perform S505; the processing unit 2420 is used to perform S5061 and S5062; and the sending unit 2430 is used to perform S507.

When the data processing apparatus 2400 is used to implement the function of the network device 402 in the method embodiment shown in FIG. 10: the receiving unit 2410 is used to perform S1005; the processing unit 2420 is used to perform S1006; and the sending unit 2430 is used to perform S1007.

When the data processing device 2400 is used to implement the function of the network device 403 in the method embodiment shown in FIG. 10: the receiving unit 2410 is used to perform S1002; the processing unit 2420 is used to perform S1003; and the sending unit 2430 is used to perform S1004.

When the data processing device 2400 is used to implement the function of the network device 402 in the method embodiment shown in FIG. 12: the receiving unit 2410 is used to perform S1005; the processing unit 2420 is used to perform S1006a and S1006b; and the sending unit 2430 is used to perform S1007.

When the data processing device 2400 is used to implement the function of the network device 403 in the method embodiment shown in FIG. 12: the receiving unit 2410 is used to perform S1002; the processing unit 2420 is used to perform S1003a and S1003b; and the sending unit 2430 is used to perform S1004.

When the data processing apparatus 2400 is used to implement the function of the network device 402 in the method embodiment shown in FIG. 19: the receiving unit 2410 is used to perform S1902; the sending unit 2430 is used to perform S1903.

When the data processing device 2400 is used to implement the function of the network device 403 in the method embodiment shown in FIG. 19: the receiving unit 2410 is used to perform S1904; the processing unit 2420 is used to perform S1905 and S1906; and the sending unit 2430 is used to perform S1907.

When the data processing apparatus 2400 is used to implement the function of the network device 402 in the method embodiment shown in FIG. 20: the receiving unit 2410 is used to perform S1914; the sending unit 2430 is used to perform S1915.

When the data processing device 2400 is used to implement the function of the network device 403 in the method embodiment shown in FIG. 20: the receiving unit 2410 is used to perform S1910; the processing unit 2420 is used to perform S1911 and S1912; and the sending unit 2430 is used to perform S1913.

When the data processing device 2400 is used to implement the function of the network device in the method embodiment shown in FIG. 23: the receiving unit 2410 is used to perform S2302 and S2307; the processing unit 2420 is used to perform S2303 and S2308; the sending unit 2430 is used to perform S2304 And S2309.

For more detailed descriptions of the foregoing receiving unit 2410, processing unit 2420, and sending unit 2430, you can directly refer to the relevant description in the method embodiment shown in FIG. 5, FIG. 7, FIG. 10, FIG. 12, FIG. 19, FIG. 20, or FIG. 23. Get it, I won’t repeat it here.

As shown in FIG. 25, the data processing device 2500 includes a processor 2510 and an interface circuit 2520. The processor 2510 and the interface circuit 2520 are coupled with each other. It can be understood that the interface circuit 2520 may be a transceiver or an input/output interface. Optionally, the data processing apparatus 2500 may further include a memory 2530 for storing instructions executed by the processor 2510 or storing input data required by the processor 2510 to run the instructions or storing data generated after the processor 2510 runs the instructions.

When the data processing device 2500 is used to implement the method shown in FIG. 5, FIG. 7, FIG. 10, FIG. 12, FIG. 19, FIG. 20, or FIG. It is used to perform the functions of the receiving unit 2410 and the sending unit 2430 described above.

It is understandable that the processor in the embodiment of the present application may be a central processing unit (Central

Processing Unit, CPU), it can also be other general processors, Digital Signal Processor (DSP), Application Specific Integrated Circuit (ASIC), Field Programmable Gate Array, FPGA ) Or other programmable logic devices, transistor logic devices, hardware components or any combination thereof. The general-purpose processor may be a microprocessor or any conventional processor.

The method steps in the embodiments of the present application can be implemented by hardware, and can also be implemented by a processor executing software instructions. Software instructions can be composed of corresponding software modules, which can be stored in random access memory (Random Access Memory, RAM), flash memory, read-only memory (Read-Only Memory, ROM), and programmable read-only memory (Programmable ROM) , PROM), erasable programmable read-only memory (Erasable PROM, EPROM), electrically erasable programmable read-only memory (Electrically EPROM, EEPROM), register, hard disk, mobile hard disk, CD-ROM or well-known in the art Any other form of storage medium. An exemplary storage medium is coupled to the processor, so that the processor can read information from the storage medium and write information to the storage medium. Of course, the storage medium may also be an integral part of the processor. The processor and the storage medium may be located in the ASIC. In addition, the ASIC can be located in a network device or a terminal device. Of course, the processor and the storage medium may also exist as discrete components in the network device or the terminal device.

In the above-mentioned embodiments, it may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. When implemented by software, it can be implemented in the form of a computer program product in whole or in part. The computer program product includes one or more computer programs or instructions. When the computer program or instruction is loaded and executed on the computer, the process or function described in the embodiment of the present application is executed in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, network equipment, user equipment, or other programmable devices. The computer program or instruction may be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer program or instruction may be downloaded from a website, computer, The server or data center transmits to another website site, computer, server or data center through wired or wireless means. The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that integrates one or more available media. The usable medium may be a magnetic medium, such as a floppy disk, a hard disk, and a magnetic tape; it may also be an optical medium, such as a digital video disc (digital video disc, DVD); and it may also be a semiconductor medium, such as a solid state drive (solid state drive). , SSD).

In the various embodiments of this application, if there are no special instructions and logical conflicts, the terms and/or descriptions between different embodiments are consistent and can be mutually cited. The technical features in different embodiments are based on their inherent Logical relationships can be combined to form new embodiments.

In this application, "at least one" refers to one or more, and "multiple" refers to two or more. "And/or" describes the association relationship of the associated objects, indicating that there can be three relationships, for example, A and/or B, which can mean: A alone exists, A and B exist at the same time, and B exists alone, where A, B can be singular or plural. In the text description of this application, the character "/" generally indicates that the associated object before and after is an "or" relationship; in the formula of this application, the character "/" indicates that the associated object before and after is a kind of "division" Relationship.

It can be understood that the various numerical numbers involved in the embodiments of the present application are only for easy distinction for description, and are not used to limit the scope of the embodiments of the present application. The size of the sequence number of the above processes does not mean the order of execution, and the execution order of each process should be determined by its function and internal logic.

Claims (46)

1. A data processing method, characterized in that it comprises:

   Receive a first data packet, where the first data packet includes an identification of the terminal, the identification of the terminal is used to indicate the terminal; the identification of the terminal is set in the network layer protocol header included in the first data packet The identifier of the terminal is the identity identifier of the terminal or the location identifier of the terminal;

   Generating a first ciphertext according to the terminal's identification, privacy variable, and key;

   A second data packet is sent, the second data packet includes the first ciphertext, and the first ciphertext is set in a network layer protocol header included in the second data packet.
2. The method according to claim 1, characterized in that, before the sending the second data packet, the method further comprises:

   Substituting the first ciphertext for the identification of the terminal included in the first data packet to obtain the second data packet, and the second data packet does not include the identification of the terminal.
3. The method according to claim 2, wherein if the terminal identifier is the terminal identifier, the replacing the terminal identifier included in the first data packet with the first ciphertext comprises:

   Replacing the identity of the terminal included in the first data packet with the first ciphertext to obtain the second data packet, where the second data packet does not include the identity of the terminal;

   The privacy variable includes at least one of time information, information related to a device that transmits or receives the first data packet, a random number, and a parameter that changes regularly.
4. The method according to claim 2, wherein if the identifier of the terminal is the location identifier of the terminal, the replacing the identifier of the terminal included in the first data packet with the first ciphertext comprises:

   Replacing the location identifier of the terminal included in the first data packet with the first ciphertext to obtain the second data packet, and the second data packet does not include the location identifier of the terminal;

   The privacy variable is the encrypted identity of the terminal or the identity of the terminal; or, the privacy variable includes time information, information related to the device that transmits or receives the first data packet, and a random number And at least one of the parameters that change regularly.
5. The method according to claim 3 or 4, wherein the information related to the device that transmits or receives the first data packet is a destination Internet Protocol IP address included in the first data packet.
6. The method according to claim 2, wherein if the identifier of the terminal is the location identifier of the terminal, the replacing the identifier of the terminal included in the first data packet with the first ciphertext comprises:

   Use the first ciphertext to replace the encrypted terminal identification and the location identification of the terminal included in the first data packet to obtain the second data packet; the privacy variable is the encrypted all The identity of the terminal;

   Or, replace the identity of the terminal and the location of the terminal included in the first data packet with the first ciphertext to obtain the second data packet; the privacy variable is the identity of the terminal Logo.
7. The method according to any one of claims 1-5, wherein generating the first ciphertext according to the terminal's identity, privacy variable, and key comprises:

   Generating a second ciphertext according to the key and the privacy variable;

   The first ciphertext is determined according to the second ciphertext and the identifier of the terminal.
8. The method according to claim 7, wherein determining the first ciphertext according to the second ciphertext and the identification of the terminal comprises:

   Perform an exclusive OR operation on the second ciphertext and the terminal identifier to obtain the first ciphertext.
9. The method according to any one of claims 1-3 and 6, wherein generating the first ciphertext according to the terminal's identity, privacy variable, and key, comprises:

   Generating the data to be encrypted according to the identification of the terminal and the privacy variable;

   The first ciphertext is generated according to the key and the data to be encrypted.
10. The method according to any one of claims 4-6, wherein the second data packet further includes a locator for addressing a network device.
11. The method according to any one of claims 1-10, wherein the first data packet further includes first indication information, and the first indication information is used to instruct to encrypt the identity of the terminal.
12. The method according to any one of claims 1-11, wherein after the sending the second data packet, the method further comprises:

    Receiving a third data packet, the third data packet including a first ciphertext, the first ciphertext being determined according to the terminal's identity, privacy variables, and a key, and the terminal's identity is used to indicate the terminal, The identifier of the terminal is the identity identifier of the terminal or the location identifier of the terminal; the first ciphertext is set in the network layer protocol header included in the third data packet;

    Generating an identifier of the terminal according to the first ciphertext, the privacy variable, and the key;

    A fourth data packet is sent, the fourth data packet includes an identification of the terminal, and the identification of the terminal is set in a network layer protocol header included in the fourth data packet.
13. The method according to claim 12, characterized in that, before the sending the fourth data packet, the method further comprises:

    Replace the first ciphertext included in the third data packet with the identifier of the terminal to obtain the fourth data packet, and the fourth data packet does not include the first ciphertext.
14. The method according to claim 13, wherein if the identifier of the terminal is the identity of the terminal, the replacing the first ciphertext included in the third data packet with the identifier of the terminal comprises:

    Replacing the first ciphertext included in the third data packet with the identity of the terminal to obtain the fourth data packet;

    The privacy variable includes at least one of time information, information related to a device that transmits or receives the third data packet, a random number, and a parameter that changes regularly.
15. The method according to claim 13, wherein if the identifier of the terminal is the location identifier of the terminal, the replacing the first ciphertext included in the third data packet with the identifier of the terminal comprises:

    Replacing the first ciphertext included in the third data packet with the location identifier of the terminal to obtain the fourth data packet;

    The privacy variable is the encrypted identity of the terminal or the identity of the terminal; or, the privacy variable includes time information, information related to the device that transmits or receives the third data packet, and a random number And at least one of the parameters that change regularly.
16. The method according to claim 14 or 15, wherein the information related to the device that transmits or receives the third data packet is a source IP address included in the third data packet.
17. The method according to claim 13, wherein if the identifier of the terminal is a location identifier of the terminal, the replacing the first ciphertext included in the third data packet with the identifier of the terminal comprises:

    Replace the first ciphertext included in the third data packet with the location identifier of the terminal and the encrypted identity of the terminal to obtain the fourth data packet, and the decryption result includes the location identifier and encryption of the terminal The identity of the terminal, and the privacy variable is the encrypted identity of the terminal;

    Or, replace the first ciphertext included in the third data packet with the location identifier of the terminal and the identity of the terminal to obtain the fourth data packet, and the decryption result includes the location identifier of the terminal and the The identity of the terminal, and the privacy variable is the identity of the terminal.
18. The method according to any one of claims 12-16, wherein generating the terminal identifier according to the first ciphertext, the privacy variable, and the key comprises:

    Generating a second ciphertext according to the key and the privacy variable;

    Determine the identity of the terminal according to the second ciphertext and the first ciphertext.
19. The method according to claim 18, wherein determining the identity of the terminal according to the second ciphertext and the first ciphertext comprises:

    Performing an exclusive OR operation on the second ciphertext and the first ciphertext to obtain the identity of the terminal.
20. The method according to any one of claims 12-14, 17, wherein generating the terminal identifier according to the first ciphertext, the privacy variable, and the key comprises:

    Generating a decryption result according to the first ciphertext and the key;

    The identification of the terminal is determined according to the decryption result and the privacy variable.
21. The method according to any one of claims 15-17, wherein the third data packet further includes a locator for addressing a network device; before the fourth data packet is sent, the method further includes :

    The locator that addresses the network device included in the third data packet is replaced with a padding value.
22. The method according to any one of claims 12-21, wherein the third data packet further includes second indication information, and the second indication information is used to indicate that the identity of the terminal is encrypted.
23. A data processing device, characterized in that it comprises:

    The receiving unit is configured to receive a first data packet, where the first data packet includes an identification of the terminal, and the identification of the terminal is used to indicate the terminal; the identification of the terminal is set in the network included in the first data packet In the layer protocol header; the identifier of the terminal is the identity identifier of the terminal or the location identifier of the terminal;

    A processing unit, configured to generate a first ciphertext according to the terminal's identification, privacy variable, and key;

    The sending unit is configured to send a second data packet, the second data packet including the first ciphertext, and the first ciphertext is set in a network layer protocol header included in the second data packet.
24. The device according to claim 23, wherein the processing unit is further configured to:

    Substituting the first ciphertext for the identification of the terminal included in the first data packet to obtain the second data packet, and the second data packet does not include the identification of the terminal.
25. The apparatus according to claim 24, wherein, if the identifier of the terminal is an identity identifier of the terminal, the processing unit is configured to:

    Replacing the identity of the terminal included in the first data packet with the first ciphertext to obtain the second data packet, where the second data packet does not include the identity of the terminal;

    The privacy variable includes at least one of time information, information related to a device that transmits or receives the first data packet, a random number, and a parameter that changes regularly.
26. The apparatus according to claim 24, wherein if the identifier of the terminal is a location identifier of the terminal, the processing unit is configured to:

    Replacing the location identifier of the terminal included in the first data packet with the first ciphertext to obtain the second data packet, and the second data packet does not include the location identifier of the terminal;

    The privacy variable is the encrypted identity of the terminal or the identity of the terminal; or, the privacy variable includes time information, information related to the device that transmits or receives the first data packet, and a random number And at least one of the parameters that change regularly.
27. The apparatus according to claim 25 or 26, wherein the information related to a device that transmits or receives the first data packet is a destination Internet Protocol IP address included in the first data packet.
28. The apparatus according to claim 24, wherein if the identifier of the terminal is a location identifier of the terminal, the processing unit is configured to:

    Use the first ciphertext to replace the encrypted terminal identification and the location identification of the terminal included in the first data packet to obtain the second data packet; the privacy variable is the encrypted all The identity of the terminal;

    Or, replace the identity of the terminal and the location of the terminal included in the first data packet with the first ciphertext to obtain the second data packet; the privacy variable is the identity of the terminal Logo.
29. The device according to any one of claims 23-27, wherein the processing unit is configured to:

    Generating a second ciphertext according to the key and the privacy variable;

    The first ciphertext is determined according to the second ciphertext and the identifier of the terminal.
30. The device according to claim 29, wherein the processing unit is configured to:

    Perform an exclusive OR operation on the second ciphertext and the terminal identifier to obtain the first ciphertext.
31. The device according to any one of claims 23-25, 28, wherein the processing unit is configured to:

    Generating the data to be encrypted according to the identification of the terminal and the privacy variable;

    The first ciphertext is generated according to the key and the data to be encrypted.
32. The apparatus according to any one of claims 26-28, wherein the second data packet further includes a locator for addressing a network device.
33. The apparatus according to any one of claims 23-32, wherein the first data packet further comprises first indication information, and the first indication information is used to indicate to encrypt the identification of the terminal.
34. The device according to any one of claims 23-33, wherein:

    The receiving unit is further configured to receive a third data packet, the third data packet including a first ciphertext, the first ciphertext is determined according to the terminal's identity, privacy variables, and a key, and the terminal's identity For indicating the terminal, the terminal identifier is the identity identifier of the terminal or the location identifier of the terminal; the first ciphertext is set in the network layer protocol header included in the third data packet;

    The processing unit is further configured to generate an identification of the terminal according to the first ciphertext, the privacy variable, and the key;

    The sending unit is further configured to send a fourth data packet, where the fourth data packet includes the identifier of the terminal.
35. The device according to claim 34, wherein the processing unit is further configured to:

    Replace the first ciphertext included in the third data packet with the identifier of the terminal to obtain the fourth data packet, and the fourth data packet does not include the first ciphertext.
36. The apparatus according to claim 35, wherein, if the identifier of the terminal is an identity identifier of the terminal, the processing unit is configured to:

    Replacing the first ciphertext included in the third data packet with the identity of the terminal to obtain the fourth data packet;

    The privacy variable includes at least one of time information, information related to a device that transmits or receives the third data packet, a random number, and a parameter that changes regularly.
37. The apparatus according to claim 35, wherein if the identifier of the terminal is a location identifier of the terminal, the processing unit is configured to:

    Replacing the first ciphertext included in the third data packet with the location identifier of the terminal to obtain the fourth data packet;

    The privacy variable is the encrypted identity of the terminal or the identity of the terminal; or, the privacy variable includes time information, information related to the device that transmits or receives the third data packet, and a random number And at least one of the parameters that change according to the law, the privacy variable is set in the network layer protocol header included in the fourth data packet.
38. The apparatus according to claim 36 or 37, wherein the information related to a device that transmits or receives the third data packet is a source IP address included in the third data packet.
39. The apparatus according to claim 35, wherein if the identifier of the terminal is a location identifier of the terminal, the processing unit is configured to:

    Replace the first ciphertext included in the third data packet with the location identifier of the terminal and the encrypted identity of the terminal to obtain the fourth data packet, and the decryption result includes the location identifier and encryption of the terminal The identity of the terminal, and the privacy variable is the encrypted identity of the terminal;

    Or, replace the first ciphertext included in the third data packet with the location identifier of the terminal and the identity of the terminal to obtain the fourth data packet, and the decryption result includes the location identifier of the terminal and the The identity of the terminal, and the privacy variable is the identity of the terminal.
40. The device according to any one of claims 34-38, wherein the processing unit is configured to:

    Generating a second ciphertext according to the key and the privacy variable;

    Determine the identity of the terminal according to the second ciphertext and the first ciphertext.
41. The device according to claim 40, wherein the processing unit is configured to:

    Performing an exclusive OR operation on the second ciphertext and the first ciphertext to obtain the identity of the terminal.
42. The device according to any one of claims 34-36 and 39, wherein the processing unit is configured to:

    Generating a decryption result according to the first ciphertext and the key;

    The identification of the terminal is determined according to the decryption result and the privacy variable.
43. The apparatus according to any one of claims 37-39, wherein the third data packet further includes a locator for addressing a network device; and the processing unit is further configured to: replace the first data packet with a padding value The locator that addresses the network device included in the three data packets.
44. The apparatus according to any one of claims 34-43, wherein the third data packet further comprises second indication information, and the second indication information is used to indicate that the identity of the terminal has been encrypted.
45. A data processing device, characterized by comprising: at least one processor, a memory, and a bus, wherein the memory is used to store a computer program, so that when the computer program is executed by the at least one processor, the implementation is as claimed in the claims. The data processing method described in any one of 1-22.
46. A computer-readable storage medium, characterized by comprising: computer software instructions;

    When the computer software instruction runs in a computer device or a chip built in the computer device, the computer device is caused to execute the data processing method according to any one of claims 1-22.

Images