WO2012097614A1 - 基于安全联盟的IPSec报文处理方法及装置 - Google Patents

基于安全联盟的IPSec报文处理方法及装置 Download PDF

Info

Publication number
WO2012097614A1
WO2012097614A1 PCT/CN2011/081039 CN2011081039W WO2012097614A1 WO 2012097614 A1 WO2012097614 A1 WO 2012097614A1 CN 2011081039 W CN2011081039 W CN 2011081039W WO 2012097614 A1 WO2012097614 A1 WO 2012097614A1
Authority
WO
WIPO (PCT)
Prior art keywords
ipsec
thread
unit
packet
same
Prior art date
Application number
PCT/CN2011/081039
Other languages
English (en)
French (fr)
Inventor
夏玮
彭小新
葛崇志
邵庆华
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2012097614A1 publication Critical patent/WO2012097614A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer

Definitions

  • the present invention relates to IPSec packet processing technology, and in particular, to an IPSec 4 ⁇ text processing method and apparatus based on a Security Association (SA). Background technique
  • Internet IPSec Internet Protocol Security
  • FIG. 1 is a schematic diagram of the processing principle of the existing multi-thread IPSec packet.
  • the IPSec packet receiving and distributing unit distributes the received IPSec packets to the thread 1 to the thread n for processing.
  • the IPSec packets are sent to the sequence-preserving thread for IPSec protection, and finally sent by the IPSec packet sending unit.
  • this method can easily cause the forwarding performance bottleneck because the order processing is unified to one thread.
  • the main purpose of the present invention is to provide an IPSec packet based on a security association.
  • the processing method and device can simplify the processing flow and improve the forwarding efficiency of IPSec packets.
  • a security association-based IPSec packet processing method including:
  • IPSec packets Distribute the IPSec packets to the threads according to the SA to which the IPSec packets belong.
  • the IPSec packets belonging to the same SA are distributed to the same thread.
  • the thread sets the serial number SN for the IPSec message and encrypts it, then sends it.
  • the method further includes:
  • the same thread can simultaneously process IPSec 4 files belonging to different SAs.
  • the thread setting the SN for the IPSec packet is specifically:
  • the thread After receiving the IPSec message, the thread sequentially numbers the IPSec packets that belong to the same SA.
  • the method further includes:
  • the IPSec message to be sent of at least one SA on the thread whose load exceeds the set threshold is distributed to the thread whose load does not reach the set second threshold.
  • a security association-based IPSec packet processing method including:
  • the IPSec packets that have been processed by the IPSec packet processing method are distributed to the threads according to the SA to which the IPSec packets belong.
  • the IPSec packets that belong to the same SA are distributed to the same thread.
  • the SAs to which the IPSec packets belong are set to cache queues, and the IPSec packets received in the SN cache of the IPSec packets are used to decrypt the IPSec packets in the cache queue.
  • a security association-based IPSec packet processing apparatus includes a distribution unit, one or more thread processing units, and a sending unit, where:
  • the distribution unit is configured to distribute the IPSec packets to the threads according to the SAs to which the IPSec packets belong; wherein the IPSec packets belonging to the same SA are distributed to the same thread; a thread processing unit, configured to set SN and encrypt the IPSec packet;
  • the sending unit is configured to send an IPSec packet processed by the processing unit.
  • the thread processing unit can simultaneously process IPSec messages belonging to different SAs.
  • the thread processing unit After receiving the IPSec packet, the thread processing unit sequentially numbers the IPSecs that belong to the same SA.
  • the device further includes:
  • a detecting unit configured to detect whether a thread processing unit having a load exceeding a set first threshold value and a thread processing unit whose load does not reach the set second threshold value, and simultaneously notifying the distribution unit to exceed the setting
  • the IPSec message to be sent of at least one SA of the threshold thread processing unit is distributed to a thread processing unit whose load does not reach the set second threshold.
  • a security association-based IPSec packet processing apparatus includes a receiving unit, a distribution unit, a setting unit, a storage unit, and a processing unit, where:
  • a receiving unit configured to receive an IPSec packet sent by the sending unit
  • the distribution unit is configured to distribute the IPSec packet received by the receiving unit to each thread according to the SA to which the IPSec packet belongs; wherein the IPSec packets belonging to the same SA are distributed to the same thread; the setting unit is set to be in each queue. Set the cache queue according to the SA to which the IPSec packet belongs.
  • the storage unit is configured to set a cache queue according to the SA to which the IPSec packet belongs, and the processing unit is configured to decrypt the cached IPSec packet.
  • the IPSec packets of the same SA are distributed to the same thread for processing, so that the IPSec packets of the same SA are not out of order, and the network delay and loss of the IPSec packets due to the order are avoided.
  • a series of problems such as packet, repeated coverage, low forwarding efficiency, and traffic jitter.
  • the present invention also dynamically allocates IPSec packets to the lightly loaded threads according to the busy state of the processing thread, so that the load of each thread is more balanced, and the processing efficiency of the multi-core processor is sufficiently improved. Therefore, the embodiment of the present invention can Realize anti-replay and order-preserving co-processing, avoiding the in-going Using a unified thread for order preservation simplifies the processing flow and improves forwarding efficiency.
  • FIG. 1 is a schematic diagram of a conventional multi-threaded IPSec 4 file processing principle
  • FIG. 2 is a schematic diagram of multi-thread processing of outgoing IPSec packets on a multi-core processor according to an embodiment of the present invention
  • FIG. 3 is a schematic diagram of multi-thread processing of incoming IPSec packets on a multi-core processor according to an embodiment of the present invention
  • FIG. 4 is a schematic diagram of anti-replay of an incoming IPSec packet processing module
  • FIG. 5 is a flowchart of processing an IPSec packet on a thread according to an embodiment of the present invention
  • FIG. 6 is a flowchart of processing an IPSec packet on a thread according to an embodiment of the present invention
  • FIG. 8 is a schematic structural diagram of another IPSec packet processing apparatus based on a security association according to an embodiment of the present invention.
  • the basic idea of the embodiment of the present invention is that the IPSec packet is distributed to each thread according to the SA to which the IPSec packet belongs.
  • the IPSec packets belonging to the same SA are distributed to the same thread, and the same thread can process more than one.
  • the IPSec packets of the same SA are actually processed by one thread. Therefore, the SNs of the IPSec packets are not interrupted. This prevents network delays caused by the IPSec packets. Packet loss, repeated coverage, and forwarding efficiency are low.
  • FIG. 2 is a schematic diagram of multi-thread processing of outgoing IPSec packets on a multi-core processor according to an embodiment of the present invention
  • the figure includes an outgoing IPSec packet receiving and distributing module 210, an outgoing IPSec packet processing module 220, and an outgoing IPSec packet sending module 230, wherein the outgoing IPSec packet receiving and distributing module 210 is configured.
  • the IPSec packet is sent to the corresponding IPSec packet processing thread according to the SA.
  • the IPSec packets belonging to the same SA are distributed to the same thread, and the same thread can process more than one SA.
  • the IPSec packet processing module 220 is configured to add an IPSec packet processing thread in parallel to the IPSec packet SN, and encrypt the IPSec packet.
  • the encryption in the embodiment of the present invention is mainly for processing confidentiality and integrity protection of the message.
  • the IPSec packets are sent to the corresponding IPSec packet processing thread.
  • the IPSec packets of the same SA are processed in the same thread. This prevents the same IPSec packets from being processed by multiple threads.
  • the embodiment of the present invention allows the IPSec packet in and out of different SAs to be in an inconsistent order, but this does not affect the anti-replay (ie, message sorting) function and other functions of the IPSec, and omits the same order processing module in the prior art. Overcome the bottleneck of IPSec packet forwarding and improve the efficiency of IPSec packet forwarding.
  • the SNec and the encrypted IPSec packet are sent to the IPSec packet sending module 230.
  • FIG. 3 is a schematic diagram of multi-thread processing of incoming IPSec packets on a multi-core processor according to an embodiment of the present invention.
  • the figure includes: an inbound IPSec packet receiving and distributing module 310 and an incoming IPSec packet processing.
  • the module 320 wherein the function of the incoming IPSec packet receiving and distributing module 310 is the same as the outgoing IPSec packet receiving and distributing module 210 in FIG. 2; the incoming IPSec packet processing module 320, which also includes several IPSec running in parallel.
  • the packet processing thread is configured to perform anti-replay processing on the IPSec encrypted IPSec packet and decrypt the IPSec packet.
  • FIG. 4 is a schematic diagram of the anti-replay of the incoming IPSec packet processing module. As shown in Figure 4, each cache is assigned a cache queue for each SA to cache the IPSec packets in the playback window. During the anti-replay process, as the anti-replay window moves, the cached IPSec messages that are out of the window (ie, have been subjected to anti-replay) are sent to the inbound IPSec message sending module 330 in the SN order.
  • the anti-replay in the present invention is mainly to achieve the sorting of the received packets, mainly because the receiving side receives the received IPSec packets processed according to FIG. 2, and the IPSec packets are in a certain period of time.
  • the SN does not necessarily contiguous. It needs to wait for some SN non-contiguous IPSec packets (such as the delay caused by the transmission path, etc., that is, the necessary waiting time needs to be set to determine the SN contact of the received IPSec packet. ).
  • the process corresponds to the sequence-preserving process, that is, the SN of the IPSec message after the sequence is guaranteed to be received continuously.
  • FIG. 5 is a flowchart of processing an IPSec packet on a certain thread according to an embodiment of the present invention. As shown in FIG. 5, the processing of the IPSec packet on a certain thread in the embodiment of the present invention mainly includes the following steps:
  • Step S501 The IPSec packet receiving and distributing unit receives the IPSec packet and distributes it to each thread according to the SA to which the IPSec packet belongs.
  • the distribution of the IPSec packet follows the principle that the same SA is distributed to the same thread.
  • Step S502 The IPSec packet processing unit adds one to each SN of each IPSec packet.
  • the IPSec packet processing unit performs other processing such as IPSec packet encryption.
  • the IPSec packet sending unit does not need to perform the order-preserving processing on the IPSec packet to directly send the IPSec packet.
  • FIG. 6 is a flowchart of processing an incoming IPSec packet on a certain thread according to an embodiment of the present invention. As shown in FIG. 6, the processing of the incoming IPSec packet on a certain thread in the embodiment of the present invention mainly includes the following steps:
  • Step S601 the same step S501;
  • step S602 the inbound IPSec packet processing unit performs anti-replay processing on each IPSec packet, and allocates a buffer queue for each SA to cache the IPSec packet in the playback window, and the packet outside the window is sent to be sent.
  • step S603 the IPSec packet processing unit performs other processing such as IPSec decryption; and step S604, determining whether the buffer queue has a pending message;
  • Step S605 During the anti-replay process, the processing unit gradually sends the buffered IPSec packets outside the window to the IPSec packet sending unit or discards the processing according to the SN sequence.
  • the security association-based IPSec packet processing method of the embodiment of the present invention mainly includes the process of sending an IPSec packet and how to implement the IPSec packet after receiving the IPSec packet processed by the present invention.
  • the IPSec packet is sent.
  • the IPSec packet is distributed to the threads according to the SA to which the IPSec packet belongs.
  • the IPSec packets belonging to the same SA are distributed to the same thread. That is, the present invention does not belong to the same SA.
  • IPSec packets are advertised to more than two threads to prevent SNs from being sent to IPSec packets after two or more threads are configured with SNs.
  • SNs of subsequent IPSec packets are discontinuous, resulting in packet loss.
  • the IPSec packet processing need not be performed, so that the processing efficiency of the IPSec packet is greatly improved.
  • Each thread sets the serial number SN for the IPSec packet and encrypts it, and then sends it.
  • the same thread can simultaneously process IPSec 4 files belonging to different SAs. That is to say, each thread can process more than two IPSec packets belonging to different SAs at the same time.
  • the thread After receiving the IPSec 4 message, the thread sequentially numbers the IPSec 4 files belonging to the same SA.
  • the above methods also include:
  • the IPSec message to be sent of at least one SA on the thread whose load exceeds the set threshold is distributed to the thread whose load does not reach the set second threshold.
  • the first threshold and the second threshold are preferably not the same value, and the value of the second threshold is far limited to the first threshold.
  • the foregoing threshold may be a specific value set by the operator according to the system operation requirements. The present invention does not limit the specific value of the above threshold. Those skilled in the art should immediately set the above thresholds to be easily implemented.
  • the processing method of receiving the IPSec packet processed by the foregoing method includes:
  • the IPSec packets that have been processed by the IPSec packet processing method are distributed to the threads according to the SA to which the IPSec packets belong.
  • the IPSec packets that belong to the same SA are distributed to the same thread.
  • the SAs to which the IPSec packets belong are set to cache queues, and the IPSec packets received in the SN cache of the IPSec packets are used to decrypt the IPSec packets in the cache queue.
  • FIG. 7 is a schematic structural diagram of a security association-based IPSec packet processing apparatus according to an embodiment of the present invention.
  • the security association-based IPSec packet processing apparatus includes a distribution unit 70 and more than one thread. Processing unit 71 and transmitting unit 72, wherein:
  • the distribution unit 70 is configured to distribute the IPSec packets to the threads according to the SAs to which the IPSec packets belong; wherein the IPSec packets belonging to the same SA are distributed to the same thread;
  • the thread processing unit 71 is configured to set the SN and encrypt the IPSec packet, and the sending unit 72 is configured to send the IPSec packet processed by the processing unit.
  • the thread processing unit 71 can simultaneously process IPSec messages belonging to different SAs.
  • the thread processing unit 71 After receiving the IPSec packet, the thread processing unit 71 sequentially numbers the IPSecs that belong to the same SA.
  • a detecting unit (not shown) configured to detect whether a thread processing unit having a load exceeding a set first threshold value and a thread processing unit whose load does not reach the set second threshold value are simultaneously present, and simultaneously notify the distribution unit
  • the IPSec message to be sent of the at least one SA in the thread processing unit whose load exceeds the set threshold is distributed to the thread processing unit whose load does not reach the set second threshold.
  • FIG. 8 is a schematic structural diagram of another IPSec packet processing apparatus based on a security association according to an embodiment of the present invention.
  • the security association-based IPSec packet processing apparatus includes a receiving unit 80 and a distribution unit. 81.
  • the receiving unit 80 is configured to receive the IPSec packet sent by the sending unit 72.
  • the distribution unit 81 is configured to distribute the IPSec packet received by the receiving unit to each thread according to the SA to which the IPSec packet belongs; wherein the IPSec packets belonging to the same SA are distributed to the same thread;
  • the setting unit 82 is configured to set a cache queue according to the SA to which the IPSec packet belongs in each queue;
  • the storage unit 83 is configured to set a cache queue according to the SA to which the IPSec packet belongs, and the processing unit 84 is configured to decrypt the cached IPSec packet.
  • the security association-based IPSec packet processing apparatus shown in FIG. 7 and FIG. 8 is implemented to implement the foregoing security association-based IPSec packet processing method.
  • the implementation functions of the foregoing processing units can be understood by referring to the related description of the foregoing methods. For details, refer to the description of the foregoing embodiments.
  • the functions of the various processing units in the figures may be implemented by a program running on a processor or by a specific logic circuit.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种基于安全联盟的IPSec报文处理方法，包括：将互联网安全协议安全性IPSec报文按照所述IPSec报文所属的安全联盟SA分发给各线程；其中，属于同一SA的IPSec报文分发到同一线程。本发明还相应地公开了了一种基于安全联盟的IPSec报文处理装置。本发明能实现抗重放和保序协同处理，避免了在入向上使用统一线程进行保序，简化了处理流程，提高了转发效率。

Description

基于安全联盟的 IPSec报文处理方法及装置 技术领域
本发明涉及 IPSec报文处理技术， 尤其涉及一种基于安全联盟 ( SA, Security Association ) 的 IPSec 4艮文处理方法及装置。 背景技术
随着通讯技术和网络技术的快速发展， 网络信息安全问题显得越来越 突出。 互联网十办议安全性（ IPSec， Internet Protocol Security )技术是一种解 决信息安全问题的有效途径。其通过在网络路由设备上配置 IPSec业务而加 密信息， 并建立安全的传输通道， 使得信息在网络传输过程中安全可靠。
在网络路由设备上， 为了加快 IPSec业务的处理速度，往往采用多核处 理器进行多线程处理。 图 1为现有多线程 IPSec报文处理原理示意图，如图 1所示， IPSec报文接收和分发单元将接收到的 IPSec报文平均分发到线程 1 到线程 n进行处理， 处理完后再将 IPSec报文统一发送到保序线程进行 IPSec ^艮文的保序， 最后再由 IPSec报文发送单元发送出去。 首先， 这种方 法由于将保序处理统一到一个线程处理， 很容易造成转发性能的瓶颈； 其 次， 这种方法处理 IPSec报文， 忽略了各个安全联盟之间的影响： 为了正常 实现抗重放功能， 网络设备需要对各 IPSec报文的序列号 （SN， Sequence Number )进行处理， 当同一 SA的 IPSec报文分发到不同线程进行处理时， 会出现几个线程同时修改同一 SA的 SN的冲突， 此时就需要进行互斥访问 的操作， 从而会造成转发性能的降低。 发明内容
有鉴于此，本发明的主要目的在于提供一种基于安全联盟的 IPSec报文 处理方法及装置， 能够简化处理流程， 提高 IPSec报文的转发效率。
为达到上述目的， 本发明的技术方案是这样实现的：
一种基于安全联盟的 IPSec报文处理方法， 包括：
将 IPSec报文按照所述 IPSec报文所属的 SA分发给各线程； 其中， 属 于同一 SA的 IPSec才艮文分发到同一线程；
线程对 IPSec报文设置序列号 SN并加密， 然后发送。
优选地， 所述方法还包括：
同一线程能同时处理分属不同 SA的 IPSec 4艮文。
优选地， 所述线程对 IPSec报文设置 SN具体为：
线程接收到 IPSec 4艮文后， 对属于同一 SA的 IPSec报文顺序编号。 优选地， 所述方法还包括：
检测出有负荷超出设定的第一阈值的线程时， 将该负荷超出设定阈值 的线程上的至少一个 SA的待发送 IPSec报文分发到负荷未达到设定的第二 阈值的线程。
一种基于安全联盟的 IPSec报文处理方法， 包括：
将接收到经前述基于安全联盟的 IPSec报文处理方法处理过的 IPSec报 文按照 IPSec报文所属的 SA分发给各线程； 其中， 属于同一 SA的 IPSec 报文分发到同一线程；
在每一队列中按 IPSec报文所属的 SA分别设置緩存队列， 并按 IPSec 报文的 SN緩存所接收到的 IPSec报文， 对緩存队列中的 IPSec报文进行解 密。
一种基于安全联盟的 IPSec报文处理装置， 包括分发单元、一个以上线 程处理单元和发送单元， 其中：
分发单元， 设置为将 IPSec报文按照所述 IPSec报文所属的安全联盟 SA分发给各线程； 其中， 属于同一 SA的 IPSec报文分发到同一线程； 线程处理单元， 设置为对 IPSec报文设置 SN并加密；
发送单元， 设置为发送处理单元处理后的 IPSec报文。
优选地， 线程处理单元能同时处理分属不同 SA的 IPSec报文。
优选地， 所述线程处理单元在接收到 IPSec报文后， 对属于同一 SA的 IPSec 4艮文顺序编号。
优选地， 所述装置还包括：
检测单元， 设置为检测是否同时存在负荷超出设定的第一阈值的线程 处理单元以及负荷未达到设定的第二阈值的线程处理单元， 同时存在时通 知所述分发单元将该负荷超出设定阈值的线程处理单元中的至少一个 SA 的待发送 IPSec报文分发到负荷未达到设定的第二阈值的线程处理单元。
一种基于安全联盟的 IPSec报文处理装置， 包括接收单元、 分发单元、 设置单元、 存储单元和处理单元， 其中：
接收单元， 设置为接收所述发送单元发送的 IPSec报文；
分发单元，设置为将所述接收单元接收的 IPSec报文按照 IPSec报文所 属的 SA分发给各线程；其中，属于同一 SA的 IPSec报文分发到同一线程； 设置单元，设置为在每一队列中按 IPSec报文所属的 SA分别设置緩存 队列；
存储单元， 设置为按 IPSec报文所属的 SA分别设置緩存队列， 处理单元， 设置为解密所緩存的 IPSec报文。
本发明实施例将同一 SA的 IPSec报文分发到同一线程上进行处理，这 样， 保证了同一 SA的 IPSec报文不会出现乱序， 避免了 IPSec报文因保序 而致的网络延迟、 丟包、 重复覆盖、 转发效率低， 流量抖动等一系列问题。 本发明还根据处理线程的忙闲状态，动态分配 IPSec报文到负荷较轻的线程 进行处理， 使得各个线程的负载更均衡， 充分提高了多核处理器的处理效 率， 所以， 本发明实施例能实现抗重放和保序协同处理， 避免了在入向上 使用统一线程进行保序， 简化了处理流程， 提高了转发效率。 附图说明
图 1为现有多线程 IPSec 4艮文处理原理示意图；
图 2为本发明实施例在多核处理器上多线程处理出向 IPSec报文的示意 图；
图 3为本发明实施例在多核处理器上多线程处理入向 IPSec报文的示意 图； 图 4为入向 IPSec报文处理模块进行抗重放的原理图；
图 5为本发明实施例出向 IPSec报文在某一线程上的处理流程图； 图 6为本发明实施例入向 IPSec报文在某一线程上的处理流程图； 图 7为本发明实施例一种基于安全联盟的 IPSec报文处理装置的组成结 构示意图；
图 8为本发明实施例另一种基于安全联盟的 IPSec报文处理装置的组成 结构示意图。 具体实施方式 本发明实施例的基本思想是， 将 IPSec报文按照该 IPSec报文所属的 SA分发给各线程； 其中， 属于同一 SA的 IPSec报文分发到同一线程， 而 同一线程可处理一个以上的 SA的 IPSec报文； 由于同一 SA的 IPSec报文 实际上由一个线程进行处理， 因此不会导致 IPSec报文的 SN错乱等， 有效 地避免了 IPSec报文因保序而致的网络延迟、丟包、重复覆盖、转发效率低。
为使本发明的目的、 技术方案和优点更加清楚明白， 以下举实施例并 参照附图， 对本发明进一步详细说明。
图 2为本发明实施例在多核处理器上多线程处理出向 IPSec报文的示意 图，如图 2所示， 图中包括出向 IPSec报文接收和分发模块 210、 出向 IPSec 报文处理模块 220和出向 IPSec报文发送模块 230， 其中， 出向 IPSec报文 接收和分发模块 210， 设置为接收出向 IPSec报文， 并将接收到的 IPSec报 文根据 SA分发到相应的 IPSec报文处理线程；其中，属于同一 SA的 IPSec 报文分发到同一线程， 而同一线程可处理一个以上的 SA的 IPSec报文； 由 于同一 SA的 IPSec 4艮文实际上由一个线程进行处理， 因此不会导致 IPSec 报文的 SN错乱等。 出向 IPSec报文处理模块 220， 该模块包含若干并行运 行的 IPSec报文处理线程， 设置为对 IPSec报文 SN进行加一， 并对 IPSec 报文进行加密处理。 本发明实施例中的加密主要是对报文进行保密和完整 性保护等处理。
由于将 IPSec报文根据 SA分发到相应的 IPSec报文处理线程， 即同一 个 SA的 IPSec报文只会在同一个线程处理， 避免了同一个 IPSec报文经过 多个线程处理后的乱序。本发明实施例允许不同 SA的 IPSec报文进出顺序 可以不一致， 但这不影响 IPSec的抗重放（即报文排序）功能及其它功能的 实现，省略了现有技术中的同一保序处理模块，克服了 IPSec报文转发的瓶 颈， 提高了 IPSec报文转发的效率。
上述经设置 SN以及加密处理后的 IPSec报文， 经出向 IPSec报文发送 模块 230发送。
图 3为本发明实施例在多核处理器上多线程处理入向 IPSec报文的示意 图， 如图 3所示， 图中包括： 入向 IPSec报文接收和分发模块 310和入向 IPSec报文处理模块 320， 其中， 入向 IPSec报文接收和分发模块 310的功 能同图 2中的出向 IPSec报文接收和分发模块 210; 入向 IPSec报文处理模 块 320，该模块也包含若干并行运行的 IPSec报文处理线程，设置为对 IPSec 的加密 IPSec报文进行抗重放处理， 并对 IPSec报文进行解密处理。
经上述处理后的 IPSec报文，经入向 IPSec报文发送模块 330进行发送。 图 4为入向 IPSec报文处理模块进行抗重放的原理图，如图 4所示，在 每个线程中为每个 SA分配一个緩存队列，对抗重放窗口内的 IPSec报文进 行緩存， 在抗重放处理过程中， 随着抗重放窗口的移动， 将处于窗口外（即 已经过抗重放 )的緩存 IPSec报文按 SN顺序发送到入向 IPSec报文发送模 块 330。 本发明中抗重放主要是实现对所接收到的报文进行排序， 主要是因 为接收侧在接收所接收到的经图 2处理后的 IPSec报文时， 在某一时段内， IPSec报文的 SN并不一定会连续， 需要等待一些 SN非连续的 IPSec报文 (如因传输路径等导致的延迟等， 即需要设定必要的等待时间， 以确定所 接收到的 IPSec报文的 SN联系）。 该过程与保序过程是对应的， 即经过保 序后的 IPSec报文的 SN， 在接收到须保证其接收连续。
虽然以上对本发明实施例的基于安全联盟的 IPSec报文处理方法进行 了详细论述， 以下基于上述论述进一步阐明本发明技术方案的实质。 需要 说明的是， 上述的处理模块， 均是根据本发明技术方案在实际的处理系统 中的应用程序的处理方式进行虚拟的， 是为了阐明本发明技术方案而设置 的， 上述的处理模块仅是为说明上的方便而设的， 并不构成对本发明技术 方案的限定， 上述的处理模块， 仅需关注其记载功能以及各模块之间的交 互信息即可。
图 5为本发明实施例出向 IPSec报文在某一线程上的处理流程图，如图 5所示， 本发明实施例出向 IPSec报文在某一线程上的处理主要包括以下步 骤：
步骤 S501， IPSec报文接收和分发单元接收到 IPSec报文根据 IPSec报 文所属的 SA分发到各线程， IPSec报文的分发遵循同一 SA分发到同一线 程的原则；
步骤 S502，出向 IPSec报文处理单元对各 IPSec报文的 SN分别进行加 1处理； 步骤 S503， 出向 IPSec报文处理单元进行 IPSec 4艮文加密等其他处理； 步骤 S504， IPSec报文发送单元不需要对 IPSec报文进行保序处理直接 将 IPSec报文发送出。
图 6为本发明实施例入向 IPSec报文在某一线程上的处理流程图，如图 6所示， 本发明实施例入向 IPSec报文在某一线程上的处理主要包括以下步 骤：
步骤 S601， 同步骤 S501 ;
步骤 S602， 入向 IPSec报文处理单元对各 IPSec报文进行抗重放处理， 并为每个 SA分配一个緩存队列， 对抗重放窗口内的 IPSec报文进行緩存， 窗口外报文打上待发标记；
步骤 S603， 入向 IPSec报文处理单元进行 IPSec 4艮文解密等其他处理； 步骤 S604， 判断緩存队列是否有待发报文；
步骤 S605， 在抗重放处理过程中， 随着抗重放窗口的移动， 处理单元 逐步将处于窗口外的緩存 IPSec报文按 SN顺序发送到 IPSec报文发送单元 或进行丟弃处理。
本发明实施例的基于安全联盟的 IPSec报文处理方法，主要包括对待发 送 IPSec报文的处理以及接收到经本发明处理后的 IPSec报文后如何实现解 报文，具体的，对待发送 IPSec报文的处理方法包括：将 IPSec报文按照 IPSec 报文所属的 SA分发给各线程； 其中， 属于同一 SA的 IPSec报文分发到同 一线程； 也就说， 本发明不会将分属于同一 SA的 IPSec报文分发给两个以 上的线程， 以避免两个以上的线程对 IPSec报文设置 SN后， 导致后续的 IPSec报文的 SN不连续， 从而导致丟包等。 另外， 通过本发明实施例的处 理后， 不必再对 IPSec报文进行保序处理， 从而使得 IPSec报文的处理效率 大大提 1¾。 各线程对 IPSec报文设置序列号 SN并加密， 然后发送即可。
上述方法中， 同一线程能同时处理分属不同 SA的 IPSec 4艮文。 也就是 说， 每个线程可以同时处理两个以上的分属不同 SA的 IPSec报文。
上述线程对 IPSec报文设置 SN具体为：
线程接收到 IPSec 4艮文后， 对属于同一 SA的 IPSec 4艮文顺序编号。 上述方法还包括：
检测出有负荷超出设定的第一阈值的线程时， 将该负荷超出设定阈值 的线程上的至少一个 SA的待发送 IPSec报文分发到负荷未达到设定的第二 阈值的线程。 这里， 第一阈值以及第二阈值最好不是相同的值， 第二阈值 的值远限于第一阈值。 需要说明的是， 上述的阈值可以是由运营商根据系 统运行需要而设置的具体值。 本发明并不限定上述阈值的具体取值。 本领 域技术人员应当立即， 设定上述阈值是容易实现的。
接收到经前述方法处理后的 IPSec报文的处理方法， 包括：
将接收到经前述基于安全联盟的 IPSec报文处理方法处理过的 IPSec报 文按照 IPSec报文所属的 SA分发给各线程； 其中， 属于同一 SA的 IPSec 报文分发到同一线程；
在每一队列中按 IPSec报文所属的 SA分别设置緩存队列， 并按 IPSec 报文的 SN緩存所接收到的 IPSec报文， 对緩存队列中的 IPSec报文进行解 密。
上述的方法， 可参照前述对图 2至图 5的相关描述而理解。
图 7为本发明实施例一种基于安全联盟的 IPSec报文处理装置的组成结 构示意图，如图 7所示，本实施例的基于安全联盟的 IPSec报文处理装置包 括分发单元 70、 一个以上线程处理单元 71和发送单元 72， 其中：
分发单元 70， 设置为将 IPSec报文按照所述 IPSec报文所属的安全联 盟 SA分发给各线程； 其中， 属于同一 SA的 IPSec报文分发到同一线程； 线程处理单元 71， 设置为对 IPSec报文设置 SN并加密； 发送单元 72， 设置为发送处理单元处理后的 IPSec报文。
上述线程处理单元 71能同时处理分属不同 SA的 IPSec报文。
上述线程处理单元 71进一步在接收到 IPSec报文后， 对属于同一 SA 的 IPSec 4艮文顺序编号。
本实施例的基于安全联盟的 IPSec报文处理装置还包括：
检测单元（未图示）， 设置为检测是否同时存在负荷超出设定的第一阈 值的线程处理单元以及负荷未达到设定的第二阈值的线程处理单元， 同时 存在时通知所述分发单元将该负荷超出设定阈值的线程处理单元中的至少 一个 SA的待发送 IPSec报文分发到负荷未达到设定的第二阈值的线程处理 单元。
图 8为本发明实施例另一种基于安全联盟的 IPSec报文处理装置的组成 结构示意图，如图 8所示，本实施例的基于安全联盟的 IPSec报文处理装置 包括接收单元 80、分发单元 81、设置单元 82、存储单元 83和处理单元 84， 其中：
接收单元 80， 设置为接收发送单元 72发送的 IPSec报文；
分发单元 81， 设置为将所述接收单元接收的 IPSec报文按照 IPSec报 文所属的 SA分发给各线程； 其中， 属于同一 SA的 IPSec报文分发到同一 线程；
设置单元 82，设置为在每一队列中按 IPSec报文所属的 SA分别设置緩 存队列；
存储单元 83， 设置为按 IPSec报文所属的 SA分别设置緩存队列， 处理单元 84， 设置为解密所緩存的 IPSec报文。
本领域技术人员应当理解， 本发明图 7及图 8所示的基于安全联盟的 IPSec报文处理装置是为实现前述的基于安全联盟的 IPSec报文处理方法而 设计的， 上述各处理单元的实现功能可参照前述方法的相关描述而理解， 具体可参见前述实施例的描述而理解。 图中的各处理单元的功能可通过运 行于处理器上的程序而实现， 也可通过具体的逻辑电路而实现。
以上所述， 仅为本发明的较佳实施例而已， 并非用于限定本发明的保 护范围。

Claims

权利要求书
1、 一种基于安全联盟的 IPSec报文处理方法， 其中， 该方法包括： 将互联网安全协议安全性 IPSec报文按照所述 IPSec报文所属的安全联 盟 SA分发给各线程； 其中， 属于同一 SA的 IPSec报文分发到同一线程； 线程对 IPSec报文设置序列号 SN并加密， 然后发送。
2、 根据权利要求 1所述的方法， 其中， 该方法还包括：
同一线程能同时处理分属不同 SA的 IPSec 4艮文。
3、根据权利要求 2所述的方法， 其中， 所述线程对 IPSec报文设置 SN 具体为：
线程接收到 IPSec 4艮文后， 对属于同一 SA的 IPSec报文顺序编号。
4、 根据权利要求 1至 3任一项所述的方法， 其中， 该方法还包括： 检测出有负荷超出设定的第一阈值的线程时， 将该负荷超出设定阈值 的线程上的至少一个 SA的待发送 IPSec报文分发到负荷未达到设定的第二 阈值的线程。
5、 一种基于安全联盟的 IPSec报文处理方法， 其中， 该方法包括： 将接收到经权利要求 1至 4任一项所述方法处理过的 IPSec报文按照
IPSec报文所属的 SA分发给各线程； 其中， 属于同一 SA的 IPSec报文分 发到同一线程；
在每一队列中按 IPSec报文所属的 SA分别设置緩存队列， 并按 IPSec 报文的 SN緩存所接收到的 IPSec报文， 对緩存队列中的 IPSec报文进行解 密。
6、 一种基于安全联盟的 IPSec报文处理装置， 其中， 该装置包括分发 单元、 一个以上线程处理单元和发送单元， 其中：
所述分发单元，设置为将 IPSec报文按照所述 IPSec报文所属的安全联 盟 SA分发给各线程； 属于同一 SA的 IPSec报文分发到同一线程； 所述线程处理单元， 设置为对 IPSec报文设置 SN并加密； 所述发送单元， 设置为发送处理单元处理后的 IPSec报文。
7、 根据权利要求 6所述的装置， 其中， 所述线程处理单元能同时处理 分属不同 SA的 IPSec才艮文。
8、根据权利要求 7所述的装置，其中，所述线程处理单元在接收到 IPSec 才艮文后， 对属于同一 SA的 IPSec报文顺序编号。
9、 根据权利要求 6至 8任一项所述的装置， 其中， 该装置还包括： 检测单元， 设置为检测是否同时存在负荷超出设定的第一阈值的线程 处理单元以及负荷未达到设定的第二阈值的线程处理单元， 同时存在时通 知所述分发单元将该负荷超出设定阈值的线程处理单元中的至少一个 SA 的待发送 IPSec报文分发到负荷未达到设定的第二阈值的线程处理单元。
10、 一种基于安全联盟的 IPSec报文处理装置， 其中， 该装置包括接收 单元、 分发单元、 设置单元、 存储单元和处理单元， 其中：
所述接收单元， 设置为接收权利要求 6至 9任一项所述发送单元发送 的 IPSec 4艮文；
所述分发单元，设置为将所述接收单元接收的 IPSec报文按照 IPSec报 文所属的 SA分发给各线程； 其中， 属于同一 SA的 IPSec报文分发到同一 线程；
所述设置单元，设置为在每一队列中按 IPSec报文所属的 SA分别设置 緩存队列；
所述存储单元， 设置为按 IPSec报文所属的 SA分别设置緩存队列， 所述处理单元， 设置为解密所緩存的 IPSec报文。
PCT/CN2011/081039 2011-01-18 2011-10-20 基于安全联盟的IPSec报文处理方法及装置 WO2012097614A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN2011100210383A CN102075427A (zh) 2011-01-18 2011-01-18 基于安全联盟的IPSec报文处理方法及装置
CN201110021038.3 2011-01-18

Publications (1)

Publication Number Publication Date
WO2012097614A1 true WO2012097614A1 (zh) 2012-07-26

Family

ID=44033779

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2011/081039 WO2012097614A1 (zh) 2011-01-18 2011-10-20 基于安全联盟的IPSec报文处理方法及装置

Country Status (2)

Country Link
CN (1) CN102075427A (zh)
WO (1) WO2012097614A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9992223B2 (en) 2015-03-20 2018-06-05 Nxp Usa, Inc. Flow-based anti-replay checking

Families Citing this family (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102075427A (zh) * 2011-01-18 2011-05-25 中兴通讯股份有限公司 基于安全联盟的IPSec报文处理方法及装置
CN102868636A (zh) * 2012-09-11 2013-01-09 汉柏科技有限公司 多核网络设备报文按流保序方法及系统
CN103414637B (zh) * 2013-07-29 2016-03-30 北京华为数字技术有限公司 一种流量转发的方法及相关装置
CN103442068A (zh) * 2013-08-30 2013-12-11 成都卫士通信息产业股份有限公司 一种多进程高并发的IPSec VPN隧道实现方法及装置
CN104038505B (zh) * 2014-06-24 2017-09-15 新华三技术有限公司 一种IPSec防重放的方法和装置
CN104468309B (zh) * 2014-10-31 2018-06-19 成都卫士通信息产业股份有限公司 一种低速smp与高速密码卡的高效适配方法
CN105846968A (zh) * 2015-01-14 2016-08-10 中兴通讯股份有限公司 一种实现重传的方法和装置、发送设备和接收设备
CN105071987B (zh) * 2015-07-28 2018-07-24 中国工程物理研究院计算机应用研究所 基于流量分析的加密网络路径质量分析方法
CN109428867B (zh) * 2017-08-30 2020-08-25 华为技术有限公司 一种报文加解密方法、网路设备及系统
CN109495404B (zh) * 2018-12-14 2021-03-26 北京金山云网络技术有限公司 一种报文处理方法、装置、交换机设备及存储介质
CN113014528B (zh) * 2019-12-19 2022-12-09 厦门网宿有限公司 报文处理方法、处理单元及虚拟专用网络服务器

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1414730A (zh) * 2002-05-22 2003-04-30 华为技术有限公司 验证数据安全传输的方法
CN1996958A (zh) * 2006-12-30 2007-07-11 华为技术有限公司 保证报文顺序的方法和装置
CN101175033A (zh) * 2007-11-27 2008-05-07 中兴通讯股份有限公司 报文保序方法及其装置
CN101741691A (zh) * 2008-11-11 2010-06-16 英业达股份有限公司 网络流量负载平衡的处理方法
CN102075427A (zh) * 2011-01-18 2011-05-25 中兴通讯股份有限公司 基于安全联盟的IPSec报文处理方法及装置

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7814310B2 (en) * 2003-04-12 2010-10-12 Cavium Networks IPsec performance optimization
CN101155183B (zh) * 2006-09-29 2012-02-08 松下电器产业株式会社 处理巢状网际网络安全协议信道的方法及网络装置
CN101499965B (zh) * 2008-02-29 2011-11-02 沈建军 一种基于IPSec安全关联的网络报文路由转发和地址转换方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1414730A (zh) * 2002-05-22 2003-04-30 华为技术有限公司 验证数据安全传输的方法
CN1996958A (zh) * 2006-12-30 2007-07-11 华为技术有限公司 保证报文顺序的方法和装置
CN101175033A (zh) * 2007-11-27 2008-05-07 中兴通讯股份有限公司 报文保序方法及其装置
CN101741691A (zh) * 2008-11-11 2010-06-16 英业达股份有限公司 网络流量负载平衡的处理方法
CN102075427A (zh) * 2011-01-18 2011-05-25 中兴通讯股份有限公司 基于安全联盟的IPSec报文处理方法及装置

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9992223B2 (en) 2015-03-20 2018-06-05 Nxp Usa, Inc. Flow-based anti-replay checking

Also Published As

Publication number Publication date
CN102075427A (zh) 2011-05-25

Similar Documents

Publication Publication Date Title
WO2012097614A1 (zh) 基于安全联盟的IPSec报文处理方法及装置
US10757013B2 (en) System and method for virtual multipath data transport
US10084754B2 (en) Virtual private network aggregation
US11095616B2 (en) Virtualized application performance through disabling of unnecessary functions
US11356418B2 (en) Systems and methods for using unencrypted communication tunnels
US11469896B2 (en) Method for securing the rendezvous connection in a cloud service using routing tokens
US20190123894A1 (en) Programmable hardware based data encryption and decryption systems and methods
WO2017206763A1 (zh) 一种终端设备及数据处理方法、存储介质
CN106790221B (zh) 一种英特网协议安全IPSec协议加密方法和网络设备
CN113383528A (zh) 用于经由tls终止节点的智能内联路径发现的针对https流量的增强的qos、引导和策略实施的系统和设备
Wu et al. A transport-friendly NIC for multicore/multiprocessor systems
US20230118136A1 (en) Deep packet analysis
Kim et al. A case for smartnic-accelerated private communication
US11044350B1 (en) Methods for dynamically managing utilization of Nagle's algorithm in transmission control protocol (TCP) connections and devices thereof
WO2010023951A1 (ja) セキュア通信装置、セキュア通信方法及びプログラム
CN113810397B (zh) 协议数据的处理方法及装置
KR102476159B1 (ko) Ｎｉｃ로의 보안연결 설정기능 이양방법 및 이를 이용한 ｎｉｃ, 그리고 컴퓨터 판독 가능 기록매체
Schinazi Improving TCP latency with super-packets

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 11856188

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 11856188

Country of ref document: EP

Kind code of ref document: A1