WO2008017275A1

WO2008017275A1 - A packet classification method and system, encryption node, classification node thereof

Info

Publication number: WO2008017275A1
Application number: PCT/CN2007/070412
Authority: WO
Inventors: Yong Xie; Jianjun Wu; Liang Gu; Wenliang Liang
Original assignee: Huawei Technologies Co., Ltd.
Priority date: 2006-08-04
Filing date: 2007-08-03
Publication date: 2008-02-14
Also published as: CN101119289A

Abstract

A packet classification method includes: the encryption node adds or configures classification parameters in the un-encrypted portion of the encrypted IP packets; the classification node classifies the encrypted IP packet according to said classification parameters. There are still a system, an encryption node and a classification node for packet classificating. The classification node is able to read the classification parameters of the un-encrypted portion after receiving the encrypted IP packets. There are still multiple methods for obtaining classification parameters, and so that the classfication flexibility is improved.

Description

Packet classification method and system thereof, encryption node, classification node

Cross-reference to related applications

The present application claims priority to Chinese Patent Application No. 200610103862.2, entitled "A Packet Classification Method and System", filed on August 4, 2006, the entire contents of . Technical field

The present invention relates to the field of wireless communication technologies, and in particular, to a packet classification technique. Background of the invention

Worldwide Interoperability for Microwave Access (WiMAX) technology is a wireless metropolitan area network technology based on the Institute of Electrical and Electronics Engineers (IEEE) 802.16 standard. Figure 1 is a prior art WiMAX network architecture diagram. Referring to Figure 1, the WiMAX network is mainly composed of three parts: terminal; access service network (ASN), including base station (BS) and access service network gateway (ASN-GW); (CSN), including logical entities such as Policy Server (PF), Authentication and Accounting Server (AAA Server), Application Server (AF), etc. Wireless Metropolitan Area Network Access Technology Based on IEEE 802.16d/e Standard on Wireless Side of WiMAX Network R1, R2, R3, etc. in Fig. 1 represent a reference point, that is, an interface.

In the WiMAX system, the ASN is a network function set that provides wireless access services for terminals, including the network element BS and the ASN-GW. The CSN provides an IP connection service for the terminal. The terminal is a mobile user equipment, and the user uses the terminal to access the WiMAX network.

In a WiMAX network, a classifier is used to classify various services carried by the network into specific service flows of the bearer network. The classifier of the uplink service is implemented on the terminal, and the downlink service is divided into The classifier is implemented on the BS or ASN-GW. The service flow is the minimum operational object guaranteed by the WiMAX bearer network quality of service (QoS). Different service flows can have different QoS guarantees. The classifier can allocate it to the corresponding service flow according to the different QoS requirements of the upper layer service. The classifier consists of a series of classification rules. The specific classification parameters are listed in the IEEE related standards. If the IP traffic is carried, one of the main classification parameters is the IP address. For example, for an IPv4 packet, a specific IP packet can be classified into a specific service flow based on the source/destination IP address, protocol type, and source/destination Transmission Control Protocol/User Data Protocol (TCP/UDP) port number.

After the mobile IPv6 protocol (ΜΙΡνό) is applied to the WiMAX network, the terminal and the home agent (HA) located at the CSN transmit data through the tunnel. However, in the wireless network, in order to make better use of the air interface resources, different QoS data needs to be classified into different data channels for transmission, and corresponding to the WiMAX network, the IP data packets are classified into different service flows for transmission.

Although the existing IEEE standard defines a series of classifier rules, there is one situation that cannot be handled after ΜΙΡνό is applied to a WiMAX network. When the data between the terminal and the HA is encrypted by IP security/encapsulated security load (IPSec/ESP), since the IP data packet between the terminal and the HA adopts the tunnel mode, the HA receives the encrypted data when it is encrypted. The entire IP packet is encrypted and added to the tunnel IP header in front of the encrypted IP packet. Therefore, if the classifier relies on the information in the subsequent IP packet to distinguish different service flows, this IP packet cannot be implemented. The classifier can only be unpacked on the terminal or the HA, but the classifier needs to classify the data packets on the ASN-GW, access router (AR) or BS classification nodes between the two physical transmission paths. Summary of the invention

In view of this, the embodiment of the present invention provides a data packet classification method, and a method for counting A packet classification system, an encryption node, and a classification node are used to classify the encrypted data packets.

An embodiment of the present invention provides a data packet classification method, where the method includes:

The encryption node adds or configures a classification parameter in the non-encrypted portion of the encrypted IP data packet, and sends the encrypted IP data packet to the classification node;

The classification node classifies the encrypted IP data packet according to the classification parameter.

An embodiment of the present invention further provides a system for data packet classification, where the system includes: an encryption node, configured to add or configure a classification parameter in an unencrypted portion of an encrypted IP data packet, and add the encrypted IP data. The packet is sent to the classification node;

And a classifying node including a classifier, wherein the classifier is configured to classify the encrypted IP data packet according to the classification parameter in the encrypted IP data packet.

An embodiment of the present invention further provides an encryption node, including:

Add a configuration unit to add or configure a classification parameter in the non-encrypted portion of the encrypted IP packet;

And a sending unit, configured to send the encrypted IP data packet to the classification node.

The embodiment of the present invention further provides a classification node, including: a receiving unit, configured to receive an encrypted IP data packet carrying a classification parameter in a non-encrypted portion;

And a classifier, configured to classify the encrypted IP data packet according to the classification parameter in the encrypted IP data packet.

As can be seen from the foregoing solution, since the encryption node adds the classification parameter for classification in the non-encrypted part of the encrypted IP data packet in the embodiment of the present invention, after the classification node receives the data packet, the classifier can directly read The classification parameter of the non-encrypted part is taken, so that the data packet can be classified according to the classification parameter. Through the implementation of the present invention, even if the encrypted IP data packet can only be decrypted at the decryption node, the classification node can acquire the classification parameter without decrypting the data packet, and classify according to the classification parameter. Embodiments of the present invention provide multiple acquisitions The method of classifying parameters improves the flexibility of classification. BRIEF DESCRIPTION OF THE DRAWINGS

1 is a schematic diagram of a WiMAX network architecture in the prior art;

2 is a schematic flow chart of a first embodiment of the present invention;

3 is a schematic flow chart of a second embodiment of the present invention;

4 is a schematic flow chart of a third embodiment of the present invention;

FIG. 5 is a schematic flowchart of a fourth embodiment of the present invention; FIG.

6 is a schematic structural diagram of a system according to a first embodiment of the present invention;

7 is a schematic structural diagram of a system according to a second embodiment and a third embodiment of the present invention; and FIG. 8 is a schematic structural diagram of a system according to a fourth embodiment of the present invention. Mode for carrying out the invention

In order to make the objects, technical solutions and advantages of the present invention more comprehensible, the present invention will be further described in detail below.

In the embodiment of the present invention, the encryption node adds or configures a classification parameter in the non-encrypted part of the encrypted IP data packet, and the subsequent encrypted IP data packet carries the classification parameter, and the classification node encrypts the data according to the classification parameter. IP packets are classified. Wherein, adding the classification parameter means adding a new parameter to the non-encrypted part of the IP data packet after encryption, and adding the new parameter as the classification parameter; configuring the classification parameter means that the non-encrypted part of the encrypted IP data packet is already existing. The parameters are configured and the configured parameters are used as encryption parameters.

The following describes the structure of the pre-encrypted IP packet and the encrypted IP packet when transmitting in tunnel mode. Referring to Table 1, the IP packets before encryption include: tunnel IP header, tunnel IP extension header, original IP header, original IP extension header, upper layer protocol header, and data.

Table 1 Tunnel IP 4 Shantou tunnel IP extension header original IP header original IP extension header upper layer protocol 4 header data table 2

Referring to Table 2, when the IP data packet is encrypted and transmitted, for example, by IPSec/ESP encryption, the encrypted IP data packet includes: a tunnel IP header, a tunnel IP extension header, an ESP header, an encrypted data, and an ESP authentication (ESPAUTH). The encrypted part includes encrypted data, and the non-encrypted part includes a tunnel IP header, a tunnel IP extension header, an ESP header, and the like. The encrypted data is formed by encrypting the original IP header, the original IP extension header, the upper layer protocol header, and the data part in the IP packet before encryption; the tunnel IP header must be constructed according to the actual situation except the destination address and the source address, and other field contents. The corresponding field content of the original IP header may be constructed or copied by the encryption node according to the situation; the tunnel IP extension header is constructed by the encryption node itself, and the original IP extension header in the IP packet before encryption may not be copied. It can be seen from the structures shown in Table 1 and Table 2 that if the classification node between the encryption node and the decryption node needs to be classified by the information in the IP packet before encryption, since the information used is encrypted, the classification node The classifier on the top cannot directly classify the existing encrypted IP packets.

The classification parameters described in the embodiments of the present invention are as shown in Table 3, but are not limited thereto. The classification node can be classified according to any one of these parameters or any combination thereof.

table 3

Type Packet Filtering Property Size (bits)

1 Source Address 128

2 Destination Address 128

3 Upper Layer Protocol 8

4 Destination Port 16

5 Source Port 16 6 Transport Class 8

7 Flow Label 20

8 Security Parameter Index (SPI) 8 First Embodiment:

Referring to Figure 2, the flow of the first embodiment of the present invention is as follows:

Step 101 to step 102, the encryption node extracts the classification information that may be used for classification before encrypting the IP data packet, and adds the classification parameters to the non-encrypted portion of the encrypted IP data packet.

Here, the non-encrypted part is used as a tunnel IP extension header as an example. The tunnel IP extension header of this embodiment can be defined as follows: The name is a Filter Header; the Type can be determined; the structure can be as shown in Table 4. Referring to Table 4, the first 8 bits of the new tunnel IP extension header are the Next Header field, indicating the start of the Filter Header; the second 8 bits are the extended header length (Hdr Ext Len) field, indicating the length of the Filter Header. The following bits are the Options section, which is used to indicate the specific classification parameters. The definitions of the Next Header and Hdr Ext Len fields can be the same as those of the usual IPv6 extension headers, and are not mentioned here. The format of the Options section can be as shown in Table 5. It is arranged in the order of Filter type and Filter value. The Filter type is the type in Table 3. The Filter value is the value of the packet filter attribute in Table 3. For example, the classification parameter is the destination port. When the Filter type is 4, the Filter value is 8E. In addition, when the total length of the extended header does not satisfy an integer multiple of 8 bytes, the padding bit can be padded at the end to be an integer multiple of 8 bytes.

Table 4

0 1 2 3 4 8 9 0 1 2 3 4 8 9 0 1 2 3 4

Next Header Hdr Ext Len Options table 5

The tunnel IP extension header described above is merely an example of an embodiment of the present invention, and the present invention is obviously not limited thereto.

Further, if the encryption node knows in advance which classification information is needed for the classification node to classify and transmit the data packet, the encryption node may select the classification information to be added to the tunnel IP extension header of the encrypted IP data packet; if the encryption node does not know which classification node needs The information is classified and transmitted, and the encryption node can add all the classification information in Table 3 to the tunnel IP extension header of the encrypted IP data packet.

In addition to adding classification parameters to the tunnel IP extension header, classification parameters such as SPI can be added to the ESP header.

Step 103: The encryption node sends the encrypted IP data packet with the classification parameter to the classifier in the classification node.

Step 104: The classifier in the classification node receives the foregoing IP data packet from the encryption node, classifies according to the classification parameter in the tunnel IP extension header, allocates it to the corresponding service flow, and transmits the data to the corresponding data channel. Decrypt the node.

Further, if the classification node knows that the subsequent node no longer needs some or all of the classification parameters in the Filter Header, the unnecessary partial or all classification parameters may be deleted.

Step 105: The classification node sends the classified IP data packet to the decryption node through the corresponding data channel. If the decryption node receives a packet with a Filter Header extension header, it can ignore the tunnel IP extension header without any processing.

In addition, since there are two fields, Traffic Class and Flow Label, in the tunnel IP header, if the two fields in the tunnel IP header are consistent with the original IP header, they can be carried in the tunnel IP extension header. . Therefore, you can also enter one before step 101. The step includes querying the content that the classification parameter and the tunnel IP header of the encrypted IP data packet overlap, and in step 101, the non-coincident content of the classification parameter is formed into a tunnel IP extension header, and the tunnel of the encrypted IP data packet is filled in. The IP extension header portion; or, before step 101, further comprising querying that the classification parameter does not overlap with the tunnel IP header of the encrypted IP data packet, then in step 101, the classification parameter is formed into a tunnel IP extension header, and Fill in the tunnel IP extension header of the encrypted IP packet. Correspondingly, in step 104, the classification node classifies according to the classification parameters in the tunnel IP header and the tunnel IP extension header.

The above method of the embodiment can be realized by the system shown in Fig. 6. The system includes an encryption node and a classification node, and may further include a decryption node.

The encryption node adds a classification parameter to the non-encrypted portion of the encrypted IP data packet, and sends the encrypted IP data packet. The encryption node includes at least an adding configuration unit and a sending unit, wherein the adding configuration unit adds or configures a classification parameter in the non-encrypted portion of the encrypted IP data packet, and the sending unit sends the encrypted IP data packet to the classification node.

The classification node includes a receiving unit and a classifier, and the receiving unit receives the encrypted IP data packet that is sent by the encryption node and carries the classification parameter in the non-encrypted portion, and the classifier classifies the encrypted IP data packet according to the classification parameter, and The classified packet is sent to the decryption node.

The decryption node decrypts and processes the received encrypted IP packet.

As shown in FIG. 6, the encryption node may further include an extracting unit and/or a query unit. The extracting unit is configured to extract the classification parameter from the pre-encrypted IP data packet; the query unit is configured to obtain the non-coincident content in the tunnel IP header of the encrypted IP data packet in the classification parameter, so as to fill in the encrypted IP data packet. Tunnel IP extension header section.

The classification node shown in Fig. 6 may further include a deletion unit for deleting some or all of the classification parameters of the encrypted IP packet.

The encryption node in this embodiment may be an HA in a WiMAX system, and the classification node may For a base station or ASN-GW or AR in a WiMAX system, the decryption node can be a terminal in a WiMAX system. However, the present invention is not limited to this. Second embodiment:

In the second embodiment, the encryption node assigns different classification parameters to different traffic flows in advance through interaction with the decryption node or the classification node. For the sake of simplicity, the present embodiment is described by taking a flow label as an example. First, a brief introduction to Flow Label. In the basic header of IPv6, there is a How Label field, which is used to uniquely identify a service flow from the source address to the destination address. This value is generally assigned by the source, that is, it is allocated at the encryption node. .

Step 201: The encryption node and the decryption node exchange the classifier information of the classification node before the encryption, and assign different Flow Labels to different service flows. This process can be performed when the encryption node and the decryption node generate a security association (SA), or at other times.

Here, the decryption node has obtained the classifier information before the encryption of the classification node, for example, the decryption node acquires the classifier information by interacting with the classification node.

Step 202: The encryption node notifies the classification node of the service flow classifier information and the corresponding Flow Label before encryption. Since the decryption node also has the traffic classifier information before encryption and the corresponding Flow Label, in this step, the decryption node may also notify the classification node of the traffic classifier information before encryption and the corresponding Flow Label.

Step 203: The encryption node configures a Flow Label in the tunnel IP extension header of the encrypted IP data packet, and configures the flow label to be newly allocated in step 201 corresponding to the service flow to which the data packet belongs. In this way, the encryption node does not have to extract the original Flow Label from the pre-encrypted IP packet.

Step 204: The encrypted node sends the encrypted IP data packet configured with the Flow Label. go with.

Step 205: The classifier in the classification node receives the foregoing IP data packet from the encryption node, performs classification according to the Flow Label and other classification parameters in the tunnel IP extension header, and allocates the same to the corresponding service flow, thereby passing Different data channels are transmitted to the decryption node.

Step 206: The classification node sends the classified IP data packet to the decryption node through the corresponding data channel. Third embodiment:

Different from the second embodiment, in the third embodiment, the encryption node and the classification node directly allocate different Flow Labds for different service flows by interaction. Referring to Figure 4, the third embodiment includes the following steps:

Step 301: The encryption node and the decryption node generate an SA, and exchange the pre-encryption classifier signal. Step 302: The encryption node and the classification node allocate different Flow Labels for different service flows by interaction.

Step 303: The encryption node configures a Flow Label in the tunnel IP extension header of the encrypted IP data packet, and configures the Flow Label in step 302 corresponding to the service flow to which the data packet belongs. In this way, the encryption node does not have to extract the original Flow Label from the pre-encrypted IP packet.

Step 304: The encryption node sends the encrypted IP data packet configured with the Flow Label allocated in step 302.

Step 305: The classifier in the classification node receives the foregoing IP data packet from the encryption node, performs classification according to the Flow Label and other classification parameters in the tunnel IP extension header, and assigns it to the corresponding service flow, thereby passing Different data channels are transmitted to the decryption node.

Step 306, the classification node sends the classified IP data packet through the corresponding data channel. Give the decryption node. After decrypting the IP packet received by the node, the tunnel IP extension header can be ignored without any processing.

The methods of the second embodiment and the third embodiment of the present invention can be realized by the system shown in Fig. 7. The system includes an encryption node and a classification node, and may further include a decryption node.

The encryption node configures the classification parameter in the non-encrypted portion of the encrypted IP data packet, and sends the classification parameter to the classification node. The encryption node includes at least an adding configuration unit and a sending unit, wherein the adding configuration unit adds or configures a classification parameter in the non-encrypted portion of the encrypted IP data packet, and the sending unit sends the encrypted IP data packet to the classification node.

The decryption node decrypts and processes the received encrypted IP packet.

As shown in FIG. 7, the encryption node further includes a first interaction unit, the classification node further includes a second interaction unit, and the decryption node further includes a third interaction unit. Corresponding to the third embodiment, the first interaction unit and the second interaction unit allocate different encrypted classification parameters for different service flows by interaction; corresponding to the second embodiment, the first interaction unit and the third interaction unit pass The interaction allocates different encrypted classification parameters for different service flows, and notifies the classification node of the service flow and the corresponding encrypted classification parameters.

Similarly, the encryption nodes in the second embodiment and the third embodiment may be HAs in the WiMAX system, the classification nodes may be base stations in the WiMAX system or ASN-GWs or ARs, and the decryption nodes may be terminals in the WiMAX system. However, the invention is not limited thereto. Fourth embodiment:

Unlike the previous embodiments, the fourth embodiment of the present invention is in encrypting nodes and classifications. The node directly sets different classification parameters for different service flows. Referring to FIG. 5, a fourth embodiment of the present invention includes the following steps:

Step 401: Set different encrypted classification parameters, such as manual setting or automatic setting, for the different service flows in the encryption node and the classification node.

Step 402: The encryption node adds or configures an encrypted classification parameter corresponding to the service flow to which the data packet belongs in the non-encrypted portion of the encrypted IP data packet.

Step 403: The encryption node sends the encrypted IP data packet with the encrypted classification parameter added or configured.

Step 404: The classification node receives the foregoing IP data packet from the encryption node, classifies the classification parameter according to the non-encrypted part and the service flow information corresponding thereto, and allocates the same to the corresponding service flow, thereby transmitting through different data channels. Give the decryption node.

Step 405: The classification node sends the classified encrypted IP data packet to the decryption node through the corresponding data channel. When the decryption node receives the IP packet, it can ignore the classification parameters of the non-encrypted part without any processing.

The above method of the embodiment can be realized by the system shown in Fig. 8. The system includes a decryption node and a classification node, and may further include a decryption node.

The encryption node adds or configures a classification parameter in the non-encrypted portion of the encrypted IP data packet, and sends the encrypted IP data packet. The encryption node includes at least an adding configuration unit and a sending unit, wherein the adding configuration unit adds or configures a classification parameter in the non-encrypted portion of the encrypted IP data packet, and the sending unit sends the encrypted IP data packet to the classification node.

The decryption node decrypts and processes the received encrypted IP data packet. As shown in FIG. 8, the encryption node further includes a first configuration unit, and the classification node further includes a second configuration unit. The first configuration unit and the second configuration unit are configured to set different encrypted classification parameters for different service flows.

Similarly, the encryption node in the fourth embodiment may be HA in the WiMAX system, the classification node may be a base station in the WiMAX system or an ASN-GW or an AR, and the decryption node may be a terminal in the WiMAX system. However, the invention is not limited thereto.

The above is only the preferred embodiment of the present invention, and is not intended to limit the present invention. Any modifications, equivalents, improvements, etc., which are included in the spirit and scope of the present invention, should be included in the present invention. Within the scope of protection.

Claims

Claim

A packet classification method, the method comprising:

The method according to claim 1, wherein the classification parameter comprises: one of a source address, a destination address, an upper layer protocol, a destination port, a source port, a transmission class, a flow label, and a security parameter index SPI. Any combination of them.

The method according to claim 1, wherein the non-encrypted portion comprises: one of a tunnel IP header, a tunnel IP extension header, an encapsulated security load ESP header, or any combination thereof.

4. The method according to claim 1, wherein the method further comprises: the encryption node extracting the classification parameter from the pre-encrypted IP data packet.

5. The method according to claim 4, wherein the step of adding a classification parameter to the non-encrypted portion of the encrypted IP data packet comprises:

The classification parameters are formed into a tunnel IP extension header, and the tunnel IP extension header portion of the encrypted IP data packet is filled in.

The method according to claim 4, wherein the step of adding a classification parameter to the non-encrypted portion of the encrypted IP data packet comprises:

Querying the content of the classification parameter and the tunnel IP header of the encrypted IP data packet, the non-coincident content of the classification parameter is formed into a tunnel IP extension header, and is filled in the tunnel IP extension header part of the encrypted IP data packet. Or,

After querying that the classification parameter and the tunnel IP header of the encrypted IP data packet do not overlap, the classification parameter is formed into a tunnel IP extension header, and the encrypted IP data packet is filled in. The tunnel IP extension header part.

7. The method according to claim 1, wherein the method further comprises: the encryption node and the decryption node assign different classification parameters to different service flows by interaction; the encryption node or the decryption node notifies the classification node of the service flow And corresponding classification parameters.

8. The method of claim 7, wherein the method further comprises: the encryption node and the decryption node exchanging classifier information.

9. The method according to claim 1, wherein the method further comprises: the encryption node and the classification node assign different classification parameters to different service flows by interaction.

10. Method according to claim 7, 8 or 9, characterized in that said classification parameter comprises a flow label.

The method according to claim 1, wherein the method further comprises: setting different classification parameters for different service flows at the encryption node;

The encryption node adds or configures the classification parameter in the non-encrypted part of the encrypted IP data packet: the encryption node adds or configures the classified parameter set for the service flow to which the data packet belongs in the encrypted IP data packet.

The method according to claim 1, wherein the method further comprises: the classification node deleting some or all of the classification parameters of the encrypted IP data packet.

13. A system for packet classification, the system comprising: an encryption node, configured to add or configure a classification parameter in an unencrypted portion of an encrypted IP data packet, and to encrypt the encrypted IP data packet Send to the classification node;

The system according to claim 13, wherein said encryption node is further Steps include: extracting units and/or query units,

The extracting unit is configured to extract the classification parameter from the pre-encrypted IP data packet, and the query unit is configured to obtain, as the classification parameter to be added, the content of the classification parameter that does not coincide with the tunnel IP header of the encrypted IP data packet.

The system according to claim 13, wherein the classification node further comprises: a deleting unit, configured to delete some or all of the classification parameters of the encrypted IP data packet.

The system according to claim 13, wherein the encryption node further comprises a first interaction unit, the classification node further comprises a second interaction unit; the first interaction unit and the second interaction unit are used Different classification parameters are assigned to different service flows through interaction.

The system according to claim 13, wherein the encryption node further comprises a first configuration unit, the classification node further comprises a second configuration unit; the first configuration unit and the second configuration unit are used for Set different classification parameters for different business flows.

18. The system according to any one of claims 13 to 17, wherein the encryption node is a home agent in a global access microwave interoperability WiMAX system;

The classification node is a base station or an access service network gateway in a WiMAX system.

The system according to claim 13, wherein the encryption node further comprises a first interaction unit; the system further comprising a decryption node, the decryption node comprising a third interaction unit;

The first interaction unit and the third interaction unit are configured to allocate different classification parameters for different service flows by interaction, and notify the classification node of the service flow and corresponding classification parameters.

The system according to claim 19, wherein said encryption node is a home agent in a globally connected 4 chop interoperability WiMAX system;

The classification node is a base station or an access service network gateway or an access router in a WiMAX system; The decryption node is a terminal in a WiMAX system.

21. An encryption node, wherein the encryption node comprises:

The encryption node according to claim 21, wherein the encryption node further comprises: an extracting unit and/or a query unit,

The extracting unit is configured to extract the classification parameter from the pre-encryption IP data packet, and the query unit is configured to obtain, as the classification parameter to be added, the content that is not coincident with the tunnel IP header of the encrypted IP data packet in the classification parameter, and provides Add a hive.

The encryption node according to claim 21, wherein the encryption node further comprises a first interaction unit, configured to allocate different classification parameters for different service flows by interacting with the classification node, or

It is used to allocate different classification parameters for different service flows by interacting with the decryption node, and notify the classification node of the service flow and corresponding classification parameters.

The encryption node according to claim 21, wherein the encryption node further comprises a first configuration unit, configured to set different classification parameters for different service flows together with the classification node.

The encryption node according to any one of claims 21 to 24, wherein the encryption node is a home agent in a WiMAX system.

26. A classification node, wherein the classification node comprises:

a receiving unit, configured to receive an encrypted IP data packet carrying a classification parameter in a non-encrypted portion;

The classification node according to claim 26, wherein the classification node further comprises: a deletion unit, configured to delete some or all of the classification parameters of the encrypted IP data packet.

The classification node according to claim 26, wherein the classification node further comprises a second interaction unit, configured to allocate different classification parameters for different service flows by interacting with the encryption node.

29. A classification node according to claim 26, said classification node further comprising a second configuration unit for setting different classification parameters for different traffic flows together with the encryption node.

The classification node according to any one of claims 26 to 29, wherein the classification node is a base station, an access service network gateway or an access router in a WiMAX system.