WO2011082583A1

WO2011082583A1 - Implementation method, network, terminal and interworking node for data packets classification processing

Info

Publication number: WO2011082583A1
Application number: PCT/CN2010/075978
Authority: WO
Inventors: 张世伟; 符涛; 黄兵
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-01-11
Filing date: 2010-08-13
Publication date: 2011-07-14
Also published as: CN102123071B; CN102123071A

Abstract

An implementation method, a network, a terminal and an interworking node for data packets classification processing are disclosed in the present invention, and the method is implemented based on a data packet classification processing network which performs classification processing on the data packets. The implementation method includes the processing of a terminal on the data packets, and the processing includes that: the terminal receives a data packet, wherein the specific bit position in a packet source-end identifier of the data packet is a packet source-end category identifier, and the packet source-end identifier is used for indicating the source of the data packet; the terminal determines the category of the packet source-end according to the packet source-end category identifier in the packet source-end identifier of the data packet; and the terminal performs different processing on the data packet according to the category of the packet source-end. Using the present invention, it is convenient for the user of the terminal to perform classification processing on the data packets sent from the users of different credit grades, thereby the security of the network is improved.

Description

Method for realizing data message classification processing, network, terminal and interworking service node

Technical field

The present invention relates to the field of mobile communications, and in particular, to a method for processing data packets sent by users of different trust levels at a network boundary and a user terminal.

Background technique

The existing Internet ^ ^ built on Internet Protocol (IP) technology, the openness of the IP network has contributed to the prosperity of the Internet, but also brought a large number of security issues, the nodes in the Internet are managed by multiple agencies in multiple countries, Some nodes are trusted or untrustworthy. Users in the network may receive data packets from trusted nodes and may receive data packets from untrusted nodes. Under the prior art, IP users cannot distinguish between them. Which data packets are sent by trusted nodes, and which data packets are sent by untrusted nodes, cannot be distinguished, thus leaving an attack space for untrusted nodes to impersonate trusted nodes to access the network, which seriously reduces the attack space. Network security.

Summary of the invention

The technical problem to be solved by the present invention is to provide a method for implementing data packet classification processing, a network, a terminal, and an interworking service node, so as to implement classification processing of data packets to improve network security.

In order to solve the above technical problem, the present invention provides a method for implementing data packet classification processing, which is implemented based on a data packet classification processing network for classifying data packets, and the implementation method includes the terminal pair data packet. Processing, the processing includes:

The terminal receives the data packet, where the specific bit in the source end identifier of the data packet is the source end category identifier of the packet, and the source end identifier of the packet is used to indicate the source of the data packet.

Determining, by the terminal, the source type of the packet according to the source end category identifier of the packet in the source end identifier of the data packet;

The terminal performs different processing on the data packet according to the source end category of the packet.

The implementation method further includes processing, by the access device, the data packet, the processing method:

The access device receives a data packet sent by the terminal; The access device checks whether the source end class identifier of the packet in the source end identifier of the data packet is consistent with the category of the terminal, and if they are consistent, the packet is forwarded normally; if not, the packet is discarded or The class of the terminal modifies the source end identifier of the data packet, and then forwards the packet;

The category of the terminal is sent by the authentication server to the access device during the access authentication process of the terminal.

When the data packet classification processing network communicates with the external network, the implementation method further includes processing the data packet by the interworking service node (ISN), where the processing includes:

Receiving, by the ISN, a data packet sent by the external network to the data packet classification processing network;

Determining, according to the source of the data packet, the source identifier of the source of the data packet in the data packet classification processing network, and converting the data packet, including the determined report The source end category identifier modifies the source end identifier of the data packet;

The ISN routes the converted data packet in the data packet classification processing network.

The step of the terminal processing the received data packet by the terminal includes: determining, according to the source type of the packet, the confidentiality of the service application, and determining the processing manner of the data packet according to the terminal's own attribute .

The method is implemented by using an Internet network or an identity and location separation network (SILSN), where the source identifier of the packet is an IP address of the source of the data packet in an Internet network or an access identifier in the SILSN ( AID).

The source categories of the source include: trusted users in the domain, group users in the domain, users in the intranet, users of the same type that are trusted outside the domain, heterogeneous network users that are trusted outside the domain, or network users that are not trusted outside the domain.

In order to solve the above technical problem, the present invention further provides a terminal, where the terminal is implemented based on a communication network, and the terminal includes:

a receiving module, configured to: receive a data packet, where a specific bit in the source end identifier of the data packet is a source end class identifier, and the source end identifier is used to indicate a data packet Source

a message source class determining module, connected to the receiving module, configured to: according to the datagram The source end category identifier in the source end identifier of the text determines the source end category; the data packet processing module is connected to the packet source end category determining module, and is configured to: according to the source end of the packet The class distinguishes the data packet.

The data packet processing module is configured to: determine, according to the source type of the packet, the manner in which the data packet is processed according to the confidentiality of the service application.

The communication network is an Internet network or an identity and location separation network (SILSN), and the source identifier of the packet is an IP address of the source of the data packet in an Internet network or an access identifier in the SILSN ( AID).

In order to solve the above technical problem, the present invention further provides a network for processing data packet classification, wherein the system sets a specific bit in a source end identifier of a data packet as a source end category identifier of the packet, and the report The source end identifier is used to indicate the source of the data packet, and the network includes:

The terminal is configured to: send and receive a data packet, and perform differential processing on the received data packet according to the source type identifier of the packet in the data packet;

The access device is connected to the terminal, and is configured to: forward the data packet to the terminal, and receive the data packet sent by the terminal, and further verify the source of the packet in the data packet sent by the terminal. Whether the category identifier is consistent with the category of the terminal, and if they are consistent, the packet is forwarded normally; if not, the packet is discarded or the source identifier of the packet in the data packet is modified according to the type of the terminal, and then forwarded;

The authentication server is connected to the access server, and is configured to: perform user identification and authentication on the terminal, and notify the access device where the terminal is located in the authentication process.

The ISN includes:

a receiving module, configured to: receive a data packet sent by another network to a data packet classification processing network;

a message source class determining module, connected to the receiving module, configured to: according to the number Determining, according to the source of the message, the source identifier of the source of the data packet in the data packet classification processing network,

The data packet conversion module is connected to the packet source class determining module, and is configured to: convert the data packet from another network format to a data packet classification processing network format, including: determining the source class identifier according to the determined packet Modifying the source identifier of the packet of the data packet;

The data packet forwarding module is connected to the data packet conversion module, and is configured to: route the converted data packet in the data packet classification processing network.

The data packet conversion module of the ISN is further configured to save a correspondence relationship between the source end identifiers of the packets before and after the modification, and perform format conversion on the data packets sent to other networks according to the corresponding relationship.

When the terminal performs the difference processing on the received data packet, the method for processing the data packet is determined according to the source type of the packet and the confidentiality of the service application in combination with the attribute of the terminal itself.

The network is an Internet network or an identity and location separation network (SILSN), and the source identifier of the packet is an IP address of the source of the data packet in the Internet network or an access identifier (AID) in the SILSN. ).

The source end category includes at least one of the following: a trusted user in the domain, a group user in the domain, an Internet cafe user in the domain, a similar network user trusted outside the domain, a heterogeneous network user trusted outside the domain, and an untrusted network user outside the domain.

To solve the above technical problem, the present invention further provides an interworking service node, where the interworking service node (ISN) is used to implement interworking between two first networks and a second network, and the first network sets data packets. The specific bit in the source identifier of the packet is the source identifier of the packet, and the source identifier of the packet is used to indicate the source of the data packet. The ISN includes:

a receiving module, configured to: receive a data packet sent by the second network to the first network; a packet source class determining module, connected to the receiving module, configured to: determine, according to the source of the data packet The data packet source is identified in the source end category of the first network; the data packet conversion module is connected to the packet source end category determining module, and is configured to: send the data packet from the second network Converting the format to the first network format, including modifying the source identifier of the data packet according to the determined source source category identifier; The data packet forwarding module is connected to the data packet conversion module, and is configured to: forward the data packet converted by the packet format to the first network.

The data packet conversion module is further configured to: save a correspondence between the source end identifiers of the packets before and after the modification, and perform format conversion on the data packets sent to the second network according to the corresponding relationship.

The network is an Internet network or an identity and location separation network (SILSN), and the source identifier of the packet is an IP address of the source of the data packet in the Internet network or an access identifier (AID) in the SILSN. The second network is a homogeneous or heterogeneous network of the first network.

The present invention uses the specific bit in the source end identifier of the data packet to carry the packet source end class identifier, so that the terminal receiving the data packet can determine the data according to the source end category identifier of the packet in the source end identifier of the packet. The source of the packet, the credibility of the data packet is identified, and the data packet is differentiated according to different policies (trust level), so that the end user can classify the data packet sent by the user with different trust levels. Therefore, the security of the network can be improved. For example, for a highly confidential service, only trusted users can be accessed. For a low security level service, users with low trust levels such as an external network can be appropriately accessed.

BRIEF abstract

1 is a schematic diagram of a method for implementing data packet classification processing according to the present invention;

Figure 2 is a system architecture diagram of the SILSN network;

Figure 3 is a schematic diagram of the ASN obtaining an AID type from the authentication server and verifying it;

4 is a schematic diagram of ASN distinguishing and replacing data packets sent by intranet users;

FIG. 5 is a schematic diagram of a method for classifying a source end category identifier of a packet;

6 is a schematic diagram of the ISN replacing a source end identifier of a packet originating from an external network and an intranet data packet;

7 is a detailed flowchart of the ISN replacing the source type identifier of the packet originating from the external network data packet; FIG. 8 is a schematic diagram of the method for the ISN to identify the trusted external network user;

FIG. 9 is an example of a SILSN user classifying data packets received by different source class identifiers. Preferred embodiment of the invention

The main idea of the data packet classification processing method, the network, the terminal, and the interworking service node of the present invention is to use the specific bit in the source end identifier of the data packet to carry the packet source end category identifier, so that the datagram is received. The terminal can determine the source of the data packet according to the source type identifier of the packet in the source identifier of the packet, so that the data packet is processed differently according to different policies (trust levels).

The source end identifier of the packet is used to indicate the source of the data packet, and specifically may be the source IP address in the data packet of the existing Internet network, or the source end in the data packet of the specific private network. The identifier is generally indicated by a number of bits, and the present invention sets one or several bits of the packet as the source source class identifier. For example, the source end identifier is N bits, and the first n bits (n<N) are used as the source source class identifier.

The method of the present invention is based on a data packet classification processing network for classifying a data packet. The implementation method includes a method for processing a data packet by a terminal. As shown in FIG. 1, the processing method of the data file by the terminal includes:

Step 101: The terminal receives the data packet, where the specific bit in the source end identifier of the data packet is the source end category identifier of the packet, and the source end identifier of the packet is used to indicate the source of the data packet. 102: The terminal determines, according to the source end category identifier of the packet in the source identifier of the data packet, a source category of the ^^ text source;

Step 103: The terminal performs differential processing on the data packet according to the source type of the packet.

>3⁄4 The source source category can be divided into trusted users, group users, Internet cafe users, etc. The terminal determines that the "^ source source category can be processed separately according to the type of service performed.

Transmission Control Protocol/Internet Interconnection Protocol (Transmission) widely used on the Internet

The IP address in the Control Protocol/Internet Protocol (TCP/IP) has a dual function, which serves as both the location identifier of the network interface of the network layer host in the network topology and the identity of the host network interface of the transport layer. The TCP/IP protocol was not designed at the beginning of the host. But when When host mobility becomes more and more common, the semantic overload defects of such IP addresses become increasingly apparent. In order to solve the problem of semantic overload of IP address and serious routing load and security, a network architecture with multiple identity and location identifiers has been proposed.

An identity identification and location separation network architecture is shown in FIG. 2. The identity identification and location separation system includes an Access Service Node (ASN), a User Equipment (UE), and an Identity Location. Identification & Location Register (ILR), authentication server, Interworking Service Node (ISN), etc. The access service node is used to access the user terminal, is responsible for realizing the access of the user terminal, and is responsible for charging and switching functions; the ILR assumes the location registration function of the user, and the authentication server assumes the user identity identification and authentication function, and the ISN user Interconnect with external network users. Each user terminal has a unique identity identifier, which is an Access Identification (AID). In Figure 2, the access servers ASN1 and ASN2 are used to access the user terminal devices UE1, UE3, UE1 and UE3 respectively having unique identity identifiers AID 1 and AID3.

For convenience of description, the user identity and location separation network is simply referred to as SILSN (Subscriber Identifier & Locator Separation Network). The present invention will be specifically described based on the SILSN network.

During the construction of the SILSN network, the SILSN and the existing Internet need to communicate with each other. During the interworking, data packets sent by users in the SILSN network are forwarded to the ISN via the ASN, and then forwarded by the ISN to the Internet such as the Internet. Similarly, after the data packet sent by the external Internet is converted by the ISN, the IP address of the external network is converted into the corresponding AID identifier of the SILSN network and sent to the user in the SILSN.

In this way, the user of the SILSN can receive the data packet of the intranet user or the data packet of the untrusted user of the external network. The two data packets are identified by the AID in the SILSN network, if no specific The AID type rule makes it difficult for the intranet users to distinguish between the two types of data packets, and the user cannot perform separate processing, which greatly affects the traceability and security of the SILSN network.

In order to allow the SILSN intranet users to distinguish between the user's credentials from the intranet users and the external network users, the SILSN network node must make some changes to help the user distinguish the received data packets from the packets. The intranet can trust users, external network trusted users, or external network untrusted users, etc., to perform differentiated processing. The present invention is to implement a method for distinguishing users of different trust types in SILSN and performing separate processing.

Embodiment 1

1.1 Domain end source identification method

In the SILSN, the source end identifier of the message refers to the source end of the data packet.

The unique access identifier (AID) in the SILSN. Therefore, the source class of the message can be referred to as the source AID class.

In the following, the SILSN network is regarded as a domain, and the corresponding users in the SILSN network are called intra-domain users, and users not in the SILSN network are called extra-domain users.

The data packets received by the SILSN user exist in the following sources:

1. A trusted user in the domain.

2. Group users in the domain

3, i or intranet users.

In order to distinguish the data packets of these several sources, the present invention divides the source AID space. Considering that a certain space is reserved for other types of AIDs in the future, three binary bits are taken out from the AID addressing space, respectively, as follows. , divided as follows:

000 trusted users within the domain.

Group users within the 001 domain.

010 Internet cafe users in the domain.

011 reserved

1.2 AS processing method

In order to ensure the implementation and application of the above AID type in the SILSN network, the ASN needs to be processed as follows:

The ASN verifies the AID type sent by the user of the local network. For different types of users, the audit uses the corresponding type of AID. For example, if the user is a trusted individual user in the SILSN network, the corresponding identifier in the AID must be 000; if the group user in the SILSN network, the corresponding target The identification must be 001. If the Internet cafe user in the SILSN network, the corresponding identification bit must be 010. If the type of the AID in the data packet sent by the user is different from the specified type, the ASN can discard the data packet.

The ASN obtains the AID type of the user from the authentication server. When the ASN requests the authentication server to authenticate the user and passes the authentication, the ASN is sent by the authentication server to the corresponding ASN. Then, when the user sends the data packet, the ASN will Verify that the AID type of the data message sent by the user is the specified type.

FIG. 3 is a schematic diagram of the ASN obtaining an AID type from an authentication server and performing AID type verification on a data packet sent by the user. When the user UE accesses the network, the ASN first authenticates to the authentication server, and after the authentication server passes the authentication, the type of the AID is returned. The ASN saves the type of the user. When the subsequent user sends a data packet, the ASN verifies the packet. If the packet does not match the type of the user, the packet is discarded or the AID type in the packet is replaced with the correct type.

Step 301: The user terminal UE initiates an access request to the ASN.

Step 302: The ASN initiates an authentication process for the UE to the authentication server. 301 and 302 may have multiple message interactions to authenticate each other.

Step 303: After the authentication is passed, the authentication server returns the AID type of the user to the ASN. Step 304: The ASN saves the AID type of the user for subsequent check and use.

Step 305: The ASN notifies the UE that the authentication passes, and allows access.

Step 306, the UE starts to send a data message.

Step 307: The ASN checks whether the type of the AID carried in the packet sent by the UE is the correct type. If yes, forward normally, if not, or discard, or switch to the correct AID type and forward again.

Figure 4 is a step of the ASN distinguishing and replacing the data packets sent by the intranet users. The ASN checks and replaces the data packets sent by the user according to the saved AID type.

The ASN determines whether the user is an ordinary user, a group user, or an Internet cafe user, and sets the AID identifiers of the data sent by these users to 000, 001, and 010, respectively. In practice, you can replace only 3 bits in the AID or replace the entire AID.

Embodiment 2

When building a SILSN network, there is bound to be a situation where SILSN coexists with the existing Internet, and interworking between the SILSN network and the Internet is inevitable. The following describes the architecture of SILSN and Internet interworking.

Figure 2 is a system architecture diagram of the SILSN network, where UE1 and UE3 are SILSN intranet users, UE2 is an extranet user, ASN1 and ASN2 are access devices, and ISN1 is used to process data packets from outside the network, to the SILSN. The network data format and the external network data format are converted. The ILR is a register of identity and location identifiers used to hold the location where the user is roaming. The authentication server is used to authenticate users to access. In FIG. 2, UE3 can receive the data message from UE1 of the intranet of the SILSN and the data message of UE2 from the external network. This application example can implement intra-network user UE3 to distinguish these packets with different sources and different trust levels, and process them separately.

2.1 Method for dividing the source end identifier between domains

When the SILSN and the external network user communicate with each other, the data message received by the SILSN user exists in the following sources:

1. A trusted user in the domain.

2. Group users in the domain

3. Internet cafe users in the domain.

4. Similar network users that are trusted outside the domain.

5. Heterogeneous network users that are trusted outside the domain (such as IPV6 source address authentication users)

6. Untrusted network users outside the domain.

In order to distinguish the data packets of these several sources, the present invention divides the source AID space, and considers that for the future, other types of AIDs reserve a certain space, and three binary bits are taken out from the AID addressing space, and there are 8 kinds of bits. Type, as the AID type identifier, this method defines six types, and two types are reserved for future expansion, as shown in Figure 5: 000 trusted users within the domain.

Group users within the 001 domain.

010 Internet cafe users in the domain.

On is reserved for future use.

100 Similar network users that are trusted outside the domain.

101 A heterogeneous network user that is trusted outside the domain.

110 reserved for future use

111 Untrusted network users outside the domain.

After the above-mentioned division, when the SILSN communicates with other networks, when users in the SILSN network receive data packets sent by other users, they can distinguish whether the source of the packets can be trusted and trusted according to the AID identifier. How much is done, then differentiate it.

It should be noted that the above example is only a method for dividing the AIDs of different user types. The AID trust types in the actual network are not necessarily arranged in strict accordance with the above order. The order of these AID types is also within the scope of protection of the present invention.

2.2 AS processing method

The ASN processing method in this embodiment is not different from Embodiment 1, and details are not described herein again.

2.3 ISN processing method

In the AID type distinction, the ISN needs to assume a very important role, including the following functions:

1. Differentiate the source user identifier type in the data packets from the external network, and assign different types of AIDs to the SILSN users trusted by the external network, other trusted network users on the external network, and untrusted users on the external network.

For example, when the ISN receives the data packet of the SILSN network user that the external network can trust, the corresponding identifier is set to 100. If the ISN receives the data packet sent by the untrusted user of the external network, Set the corresponding flag to 110.

2. The data of the user outside the network is sent to the user in the network. The destination address of the ^^ text is converted to the original address of the user outside the network.

Since the ISN distinguishes and replaces the source AIDs from the external network users, the source AIDs carried in the data packets received by the users in the SILSN network and the sources in the original data packets are received after the data packets are received by the users in the SILSN network. The AID is different. When the intranet user replies to the message to the out-of-network user, the destination AID type in the sent data is the type modified by the ISN. Therefore, the destination AID is not the original identifier of the external network user. As the original identifier, the external network intermediate routing device cannot forward data packets to the original user. To this end, the ISN should maintain a copy of the source address modification table. When receiving the data message sent by the intranet user to the external network, the AID type of the corresponding destination address is modified to the original AID type or the original address.

Figure 6 is a schematic diagram of the ISN replacing the AID type of the data packets originating from the external network and the internal network. After receiving the packet from the external network, the ISN replaces the type bit of the source AID identifier in the packet according to the trustworthiness of the external network. After receiving the packet from the intranet, the ISN also needs to replace the type identifier of the destination AID in the text according to the trustworthiness of the external network.

Step 601: The external network user sends a data packet to the ISN.

Step 602: The ISN determines, according to the source of the data packet, whether the user is from a trusted SILSN network, another trusted network, or an untrusted network, and replaces the AID with the corresponding AID type for each case. In addition, the ISN may also need to convert the packet format, such as converting the IPv4 packet format of the external network into the packet format of the SILSN network.

Step 603: The ISN sends the converted data packet to the ASN, and the ASN forwards the packet to the actual intranet user.

Step 605: The ISN performs a restoration process on the AID type according to the trusted condition of the network where the destination AID address is located. The type of the destination AID sent by the intranet user is restored to the type recognized by the external network user. Here, the ISN may also need to additionally convert the intranet data format to the external network data format. Step 606: The ISN sends the converted data packet to the external network.

FIG. 7 is a detailed flowchart of the ASN type replacement of the data packet originating from the external network by the ISN. After receiving the data packet from the external network, the ISN determines whether the source network is a trusted SILSN network, or is trustworthy. The network, or the untrusted network, sets the AID type in the data packets of these sources to 100, 101, 111, and so on.

2.4 User Processing Method

After the ASN and the ISN use the above method to verify and distinguish the AID type, the user terminal in the SILSN can perform classification processing according to the status of the identifier when receiving the data packets of the above types of identifiers, for example, for relatively confidential A server-type terminal can deny access to users with an AID of 111 (untrusted external network users) to avoid leakage of confidential information. In addition, for some sensitive BBS forum servers, you can perform some functional restrictions on those Internet cafe users who are not easy to trace, such as only allowing browsing forums, not allowing postings, etc., thus ensuring the order of BBS forums, and avoiding malicious elements from posting malicious messages on BBS forums. information.

It can be seen that after the foregoing classification of the AID, the means for distinguishing the users of the network from the network and the users of the network and the trusted users and the untrusted users are provided technically, and the security of the user and the upper layer services can be distinguished according to the type of the user AID. The SILSN can realize the interconnection and intercommunication between the SILSN and the network, and meet the common service requirements of the user. The SILSN user can also identify the untrusted user for corresponding processing, thereby improving the SILSN networking and deployment flexibility. The security of the SILSN network is well guaranteed.

Figure 8 shows how the ISN analyzes whether external network data packets come from a trusted network. How the ISN identifies the source of the external network data message is not the focus of the invention. In order to ensure that the solution is implementable, the description is hereby made.

If there is a trust relationship between the SILSN and other SILSN networks, a secure tunnel such as IPSec can be established to contact. As shown in (a) of Figure 8, the data packets sent by SILSN B to SILSN A are trusted. Data packets sent by network users. ISN in SILSN A After receiving these >3⁄4 texts, set the corresponding AID type to 100.

Similarly, the SILSN of this network can also establish mutual trust relationship with other types of networks, and can also send data packets through a secure tunnel. As shown in (b) of Figure 8, other trusted networks can pass through a secure tunnel. SILSN A sends a data packet. After receiving the packet, the ISN in SILSN A sets the corresponding AID type to 101.

Applications

FIG. 9 is a specific application scenario of the present invention, which is an example of classifying processing when different types of AIDs are received by SILSN users. Since the SILSN network has classified the AIDs from different sources in detail, users in the SILSN network can clearly know which users are external network users, which users are internal network users, which are trusted, and which are untrustworthy. . Then, according to the type of business performed, separate processing is performed.

Step 901: The SILSN user receives a data packet, and according to the attributes of the user and the confidentiality of the service application, analyzes which users are allowed to use in the current service type, and according to the confidentiality of the service type, the query policy database is correspondingly obtained. Processing methods, 902 ~ 904 are examples of corresponding policy implementations.

Step 902: When the user of the local network is a private network user such as the public security network, the user of the local network may be restricted from processing any data packet of the external network user, and therefore only the data packets with the AID type of 000, 001 and the like may be accepted. As a group user, it can only receive data packets with AID type 001. Other Internet cafe users (010) and data packets from external users will be blocked.

Step 903: When the user of the network is a server of the group user, only the data packet with the AID type of 001 (group user) can be accepted, and the packets of other sources are not accepted.

Step 904: When the user of the local network is a BBS server that involves political sensitivity, the user of the Internet cafe 010 and the user of the external network are only allowed to browse the BBS information, and the BBS information is not allowed to be modified and released, thereby effectively avoiding users from the external network. s attack.

Although the above description is based on the SILSN, the present invention is also applicable to the existing Internet network. Correspondingly, the source end identifier of the packet is an IP address, and the base station in the Internet network is used to implement the ASN in the SILSN network of the present invention. Processing power, ASN and Internet network in SILSN network The base stations in the network can be collectively referred to as access devices for implementing terminal access; and the interworking service node ISN can also implement interworking between the first network (such as an Internet network) and the second network (such as other networks).

In order to implement the above method, the present invention further provides a terminal, where the terminal is implemented based on a communication network, where the terminal includes:

a receiving module, configured to receive a data packet, where a specific bit in the source end identifier of the data packet is a source end category identifier, and the source end identifier is used to indicate a source of the data packet; a packet source end category determining module, configured to be connected to the receiving module, configured to determine, according to the >3⁄4 source source category identifier in the source identifier of the data packet, the source end category;

The data packet processing module is connected to the packet source class determining module, and configured to perform different processing on the data packet according to the source class of the packet.

When the data packet processing module performs the difference processing on the received data packet, determining the data packet according to the source type of the packet and the confidentiality of the service application according to the terminal's own attribute. Approach.

The communication network is an Internet network or an identity and location separation network (SILSN), and the source identifier of the packet is an IP address of the data packet at an IP address of the Internet network or an access identifier (AID) in the SILSN. ).

In addition, the present invention further provides a network for classifying a data packet, wherein the system sets a specific bit in the source end identifier of the data packet as the source end class identifier of the packet, and the source end identifier of the packet Used to indicate the source of the data message, the network includes:

The terminal is configured to send and receive a data packet, and perform differential processing on the received data packet according to the source type identifier of the packet in the data packet;

When the terminal performs the difference processing on the received data packet, the terminal determines the location of the data packet according to the source type of the packet and the confidentiality of the service application in combination with the terminal's own attribute. Method.

The access device is connected to the terminal, and is configured to forward the data packet to the terminal, and receive the data packet sent by the terminal, and is also used to verify the source identifier of the packet in the data packet sent by the terminal. Whether it is consistent with the category of the terminal, if it is consistent, it is forwarded normally; otherwise, it is discarded or the source identifier of the packet in the data packet is modified according to the type of the terminal, and then forwarded;

The authentication server is connected to the access server, and is configured to perform user identification and authentication on the terminal, and notify the access device where the terminal is located in the authentication process.

When the network is an Internet network or an identity and location separation network (SILSN), the source identifier of the packet is an IP address of the data packet at the source end of the Internet network or an access identifier (AID) in the SILSN. ).

( ISN ) , the ISN includes:

a receiving module, configured to receive a data packet sent by the other network to the data packet classification processing network; the packet source end category determining module is connected to the receiving module, and configured to determine the data according to the source of the data packet The source end of the packet is classified in the source end of the packet of the data packet classification processing network.

The data packet conversion module is connected to the packet source class determining module, and is configured to convert the data packet from another network format into a data packet classification processing network format, including modifying the identifier according to the determined source source category identifier. The source end identifier of the data packet is also used to save the correspondence between the source end identifiers of the packets before and after the modification, and format the data to be sent to other networks according to the correspondence relationship;

The data packet forwarding module is configured to be connected to the data packet conversion module, and configured to route the converted data packet in a network processed by the data packet classification process.

The present invention also provides an interworking service node, where the interworking service node is configured to implement interworking between two first networks and a second network, and the first network sets a specific bit in the source end identifier of the data packet. The bit is the source end class identifier of the packet, and the source end identifier of the packet is used to indicate the data packet. Source, the interworking service node (ISN) includes:

a receiving module, configured to receive a data packet sent by the second network to the first network;

And a packet source end category determining module, configured to be connected to the receiving module, configured to determine, according to the source of the data packet, a source identifier of the source end of the data packet in the first network,

The data packet conversion module is connected to the packet source class determining module, and is configured to convert the data packet from the second network format to the first network format, including modifying the data according to the determined packet source class identifier. The source end identifier of the packet is also used to save the correspondence between the source end identifiers of the packets before and after the modification, and format the data packets sent to the second network according to the corresponding relationship; the data packet forwarding module, The data packet conversion module is connected to the data packet that is converted by the packet format and forwarded to the first network.

The first network is an Internet network or an identity and location separation network (SILSN), and the source identifier of the packet is an IP address of the source of the data packet on the Internet network or an access identifier in the SILSN. (AID), the second network is a homogeneous or heterogeneous network of the first network.

While the preferred embodiments of the present invention have been disclosed for purposes of illustration, those skilled in the art will recognize that various modifications, additions and substitutions are possible, and the scope of the invention should not be limited to the embodiments described above.

One of ordinary skill in the art will appreciate that all or a portion of the steps above may be accomplished by a program to instruct the associated hardware, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

Industrial applicability

The present invention uses the specific bit in the source end identifier of the data packet to carry the packet source end class identifier, so that the terminal receiving the data packet can determine the data according to the source end category identifier of the packet in the source end identifier of the packet. The source of the packet, the credibility of the data packet is identified, and the data packet is differentiated according to different policies (trust level), so that the terminal user can send the user with different trust levels. The data packets are classified and processed to improve the security of the network. For example, for highly confidential services, only trusted users can be allowed to access. For services with low security levels, users with low trust levels such as external networks can be appropriately accessed. .

Claims

Claim

A method for implementing data packet classification processing, wherein the method is implemented by a data packet classification processing network for classifying a data packet, where the implementation method comprises: processing, by the terminal, the data packet, Processing includes:

Determining, by the terminal, the source end category according to the source end category identifier of the packet in the source end identifier of the data packet;

The implementation method of claim 1, further comprising processing the data message by the access device, the process comprising:

Receiving, by the access device, a data packet sent by the terminal;

The access device checks whether the source end class identifier of the packet in the source end identifier of the data packet is consistent with the category of the terminal, and if they are consistent, the packet is forwarded normally; if not, the packet is discarded or The class of the terminal modifies the source end identifier of the data packet, and then forwards the packet;

The implementation method of claim 1, wherein, when the data packet classification processing network communicates with the external network, the implementation method further includes processing, by the interworking service node (ISN), the data packet, where the processing includes :

Determining, according to the source of the data packet, the source identifier of the source of the data packet in the data packet classification processing network, and converting the data packet, including the determined report The source end category identifier modifies the source end identifier of the data packet; and

The method according to any one of claims 1 to 3, wherein the step of performing differentiating processing on the received data packet by the terminal comprises: according to the source type of the packet, combined with the The terminal's own attribute determines the processing method of the data packet based on the confidentiality of the service application.

The implementation method according to any one of claims 1 to 3, wherein the method is implemented based on an Internet network or an identity identification and location separation network (SILSN), and the source identifier of the packet is the datagram. IP address of the source text in the Internet or in the access identification of SILSN (AID) ₀

The implementation method according to any one of claims 1 to 3, wherein the source category of the packet includes: a trusted user in the domain, a group user in the domain, an intranet user, and a network user trusted by the domain, A heterogeneous network user that is trusted outside the domain or an untrusted network user outside the domain.

A terminal, wherein the terminal is implemented based on a communication network, the terminal includes: a receiving module, configured to: receive a data packet, and select a specific bit in a source end identifier of the data packet The source identifier is the source identifier of the packet, and the source identifier of the packet is used to indicate the source of the data packet.

a packet source end category determining module, configured to be connected to the receiving module, configured to: determine, according to the source end category identifier in the source end identifier of the data packet, a source end category;

The data packet processing module is configured to be connected to the packet source class determining module, and configured to: perform differential processing on the data packet according to the source class of the packet.

The terminal according to claim 7, wherein the data packet processing module is configured to: determine, according to the source type of the packet, combined with the attribute of the terminal, the confidentiality of the service application, How data packets are processed.

The terminal according to claim 7 or 8, wherein the communication network is an Internet network or an identity and location separation network (SILSN), and the source end identifier is the source of the data packet on the Internet. The IP address of the network or the access identifier (AID) in the SILSN.

The terminal according to claim 7 or 8, wherein the source category of the packet includes: a trusted user in the domain, a group user in the domain, an Internet cafe user in the domain, and a similar network user trusted outside the domain, A heterogeneous network user that is trusted outside the domain or an untrusted network user outside the domain.

A network for processing data packet classification, wherein: the system sets a specific bit in a source end identifier of a data packet as a source end category identifier, and the source end identifier of the packet is used. For indicating the source of the data message, the network includes:

12. The network of claim 11, the network further comprising an Interworking Service Node (ISN) for interworking with other networks, the ISN comprising:

a packet source end category determining module, configured to be connected to the receiving module, configured to: determine, according to a source of the data packet, a source end of the data packet source processing network in the data packet classification processing network Logo,

The data packet conversion module is connected to the packet source class determining module, and is configured to: convert the data packet from another network format to a data packet classification processing network format, including: determining the source class identifier according to the determined packet Modifying the source identifier of the data packet; and

The network of claim 12, wherein the data packet conversion module of the ISN is further configured to: save a correspondence between the source end identifiers of the packets before and after the modification, and according to the correspondence relationship Data packets sent to other networks are formatted.

The network according to claim 11 or 12, wherein the terminal is configured to perform the difference processing on the received data packet in the following manner: according to the source type of the packet, combined with the terminal's own attribute The processing of the data packet is determined by the confidentiality of the service application.

The network according to claim 11 or 12, wherein the network is an Internet network or an identity and location separation network (SILSN), and the source identifier of the packet is the source of the data packet on an Internet network. IP address or access identifier (AID) in the SILSN.

The network according to claim 11 or 12, wherein the source class of the message comprises: a trusted user in the domain, a group user in the domain, an Internet cafe user in the domain, a trusted network user in the extra-domain, and an alien trust in the domain. A network user or an untrusted network user outside the domain.

An interworking service node (ISN), wherein: the ISN is used to implement interworking between two first networks and a second network, and the first network sets the source end identifier of the data packet. The specific bit is the packet source class identifier, and the source identifier of the packet is used to indicate the source of the data packet, and the ISN includes:

a receiving module, configured to: receive a data packet sent by the second network to the first network; a packet source class determining module, connected to the receiving module, configured to: determine, according to the source of the data packet The data packet source is identified in the source end category of the first network; the data packet conversion module is connected to the packet source end category determining module, and is configured to: send the data packet from the second network Translating the format into the first network format, including modifying the source identifier of the data according to the determined source source category identifier;

The data packet forwarding module is connected to the data packet conversion module, and is configured to: forward the data packet converted by the packet format to the first network.

The interworking service node according to claim 17, wherein the data packet conversion module is further configured to: save a correspondence between the source end identifiers of the packets before and after the modification, and send the packets to the second network according to the correspondence relationship. The data message is formatted.

19. The interworking service node according to claim 17, wherein the network is an Internet network a network or identity and location separation network (SILSN), the source identifier of the packet is an IP address of the source of the data packet on the Internet network or an access identifier (AID) in the SILSN, where The second network is a homogeneous or heterogeneous network of the first network.