WO2012149745A1

WO2012149745A1 - Data multiplexing transmission method, device and system

Info

Publication number: WO2012149745A1
Application number: PCT/CN2011/079809
Authority: WO
Inventors: 席辉; 严卫平
Original assignee: 华为技术有限公司
Priority date: 2011-09-19
Filing date: 2011-09-19
Publication date: 2012-11-08
Also published as: CN102742247B; CN102742247A

Abstract

An end data multiplexing transmission method, including: a source device requesting from a security gateway the private network IP addresses of at least two logic tunnels in an Internet protocol security (IPsec) tunnel; the source device obtaining the private network IP addresses of the at least two logic tunnels and information about the correlation between the same and each destination device; the source device mapping the data stream sent to each destination device to the corresponding logic tunnel and transmitting the same to the security gateway according to the correlation information, so that the security gateway sends the received data streams to the corresponding destination devices. The method realizes secure end-to-end data multiplexing transmission.

Description

Data branching transmission method, device and system

Technical field

The present invention relates to the field of communications technologies, and in particular, to a data split transmission method, apparatus, and system. Background technique

IPSec (IP Security) is a three-layer tunnel encryption protocol developed by the IETF to ensure the security and confidentiality of data transmitted over the Internet. IPSec provides security services for IP packets at the IP layer. In the IPSec protocol, how to add fields to IP packets to ensure the integrity, privacy and authenticity of IP packets and how to encrypt packets is defined. With IPSec, data can be transmitted securely over the public network.

Figure 1 is a schematic diagram of a system structure in which IPsec is applied in the prior art. The source device, the security gateway, and the destination device communicate through the public network IP, and the source device and the security gateway supporting the IPsec client protocol (at least the IPSec server are supported). An IPSec tunnel is established between the side protocols for secure data transmission, and data is routed to the destination device through the security gateway.

However, when there is only one interface (physical port or IP address) of the source device and the security gateway, and at least two destination devices, such as destination device 1 and destination device 2, data 1 and source sent by the source device to destination device 1 The data 2 of the destination device 2 sent by the device is transmitted to the security gateway through the IPsec tunnel. The security gateway cannot identify the destination of data 1 and data 2. At this time, data 1, 2 can only be sent to one destination device, and cannot be disconnected. That is, for the above application scenario, end-to-end data isolation cannot be achieved between the source device and multiple destination devices. Summary of the invention

Embodiments of the present invention provide a data split transmission method, apparatus, and system, which can implement end-to-end data isolation between a source device and multiple destination devices.

In order to solve the above technical problem, the technical solution of the embodiment of the present invention is as follows:

The source device requests the security gateway for the private network IP address of at least two logical tunnels in the Internet Protocol security IPsec tunnel;

Obtaining, by the source device, a private network IP address of the at least two logical tunnels and corresponding relationship information with each destination device; The source device maps the data stream sent to the destination device to the corresponding logical tunnel according to the correspondence information, and transmits the data flow to the security gateway, so that the security gateway will receive the data stream. Send to the corresponding destination device.

A data shunt transmission method includes:

The security gateway receives the request of the source device for the private network IP address of at least two logical tunnels in the IPsec tunnel;

The security gateway allocates a private network IP address to at least two logical tunnels in the IPsec tunnel, and feeds back the private network IP address of the at least two logical tunnels to the source device;

The security gateway receives the data stream sent by the source device through different logical tunnels; the security gateway identifies the received data stream according to the private network IP address of the at least two logical tunnels, and according to at least two logical tunnels The corresponding relationship between the private network IP address and each destination device sends the identified data stream to the corresponding destination device.

A communication device, comprising:

An address requesting unit, configured to request, from the security gateway, a private network IP address of at least two logical tunnels in the IPsec tunnel;

An address receiving unit, configured to obtain a private network IP address of the at least two logical tunnels and corresponding relationship information with each destination device;

a data isolation unit, configured to map, according to the correspondence information, a data flow sent to each destination device to a corresponding logical tunnel, and transmit the data flow to the security gateway, so that the security gateway receives the data flow Send to the corresponding destination device.

A security gateway, including:

a request receiving unit, configured to receive, by the source device, a request for a private network IP address of at least two logical tunnels in the IPsec tunnel;

An address allocation unit, configured to separately allocate a private network IP address to at least two logical tunnels in the IPsec tunnel, and feed back, to the source device, a private network IP address of the at least two logical tunnels;

a data receiving unit, configured to receive a data stream that is sent by the source device by using a different logical tunnel; and a data offloading unit, configured to identify the received data stream according to the private network IP address of the at least two logical tunnels, and according to at least two The data relationship between the private IP address of the logical tunnel and the destination device sends the identified data stream to the corresponding destination device. A data shunt transmission system includes a source device, a security gateway, and at least two destination devices, where

The source device is configured to request, by the security gateway, a private network IP address of at least two logical tunnels in the IPsec tunnel; obtain a private network IP address of the at least two logical tunnels, and a corresponding relationship between each of the destination devices And mapping, according to the correspondence information, the data stream sent to each destination device to a corresponding logical tunnel, and transmitting the data stream to the security gateway, so that the security gateway sends the received data stream to the Corresponding destination device.

In the embodiment of the present invention, a plurality of logical tunnels are set up in an IPsec tunnel, so that the source device can transmit data streams sent to different destination devices through different logical tunnels, and the data is shunted by the security gateway, and finally sent to the corresponding The destination device realizes the end-to-end secure transmission of data, such as splitting the service flow and the data flow, that is, ensuring data security and ensuring data isolation, which can better support the networking, and the method is implemented. To save external resources, such as IP addresses, ports, etc., it is possible to use end-to-end secure transmission with existing equipment more reasonably. This method is simple to implement, and this solution can be completed by standard protocols. DRAWINGS

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the embodiments or the description of the prior art will be briefly described below. Obviously, the drawings in the following description are only It is a certain embodiment of the present invention, and other drawings can be obtained from those skilled in the art without any inventive labor.

1 is a schematic structural diagram of a system for applying IPsec in the prior art;

2 is a flowchart of a data split transmission method according to an embodiment of the present invention;

FIG. 3a is a flowchart of another data split transmission method according to an embodiment of the present invention; FIG.

Figure 3b is a schematic diagram of end-to-end data shunt transmission in the embodiment shown in Figure 3a;

4 is a schematic diagram of an IPSec tunnel negotiation between a source device and a security gateway in the embodiment shown in FIG. 3a;

5 is a schematic diagram of an IKE-SA-AUTH exchange between a source device and a security gateway in the embodiment shown in FIG. 3a;

Figure 6 is a diagram showing the source device and the security gateway performing CREATE_CHILD-SA handover in the embodiment shown in Figure 3a. Schematic diagram of the exchange;

7 is a schematic structural diagram of a communication device according to an embodiment of the present invention;

8 is a schematic structural diagram of a security gateway according to an embodiment of the present invention;

9 is a schematic structural diagram of another security gateway according to an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of a data split transmission system according to an embodiment of the present invention.

detailed description

BRIEF DESCRIPTION OF THE DRAWINGS The technical solutions in the embodiments of the present invention will be described in detail below with reference to the accompanying drawings. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without the creative work are all within the scope of the present invention.

The technical solution of the present invention will be described below with reference to the accompanying drawings and embodiments.

2 is a flowchart of a data split transmission method according to an embodiment of the present invention.

The method can include:

Step 201: The source device requests the security gateway to request a private network IP address of at least two logical tunnels in the IPsec tunnel.

After the IKEv2-based IPSec tunnel negotiation between the source device and the security gateway, or after the IPsec tunnel between the source device and the security gateway is established, the source device can exchange messages with the security gateway or through the source device and the security gateway. The other newly added interactive message is negotiated with the security gateway to request the private network IP address of the logical tunnel in the IPsec tunnel. The source device can also request the private network IP address of the logical tunnel, such as the network management system, from other intermediate network elements. The number of the logical tunnels is at least two, so as to implement isolation of at least two sets of data flows, and the request may also carry other information such as a network segment of the private network IP address to be allocated.

Step 202: The source device obtains a private network IP address of at least two logical tunnels and corresponding relationship information with each destination device.

The source device obtains the private network IP address of the logical tunnel and its corresponding relationship with each destination device. The private network IP address of the logical tunnel obtained by the source device may be allocated by the security gateway or the network management system. Sent to the source device. The mapping between the private IP address of the logical tunnel and the destination device may be pre-assigned by the source device when requesting the private IP address of the logical tunnel, or may be assigned by the security gateway or the network management device as needed. The corresponding relationship is informed to the source device. For example, when the source device initiates the logical tunnel private network IP address request, the request includes the network segment of the private network IP address of the logical tunnel corresponding to each destination device, and the security gateway allocates the network segment according to the specified network segment. After the IP address of the private network is received, the source device obtains the mapping between the private IP address of the logical tunnel and the destination device. The corresponding relationship may be further notified by the source device to the security gateway. Of course, the source device and the security gateway may pre-negotiate the destination device corresponding to the specified network segment, and the security gateway receives the network segment specified by the source device and allocates the private network accordingly. After the IP address, the above correspondence can be obtained.

For example, when the source device initiates the request for the private IP address of the logical tunnel, the security gateway allocates the private network IP address, and establishes the correspondence between the private network IP address of each logical tunnel and the peer destination device. The security gateway then sends the private network IP address of the logical tunnel and its correspondence with the destination device to the source device.

For example, when the source device initiates the request for the private IP address of the logical tunnel, the security gateway allocates the private network IP address, and the network management system assigns the correspondence between the private network IP address of the logical tunnel and the destination device, and then The gateway sends the correspondence to the source device and the security gateway. Of course, there are other situations, no longer here - enumeration.

The private network IP addresses of each logical tunnel are different. Further, they can be in different network segments. Correspondence between the private IP address of the logical tunnel and the destination device, for example:

Logical tunnel 1 - private network IP address 1 - destination device 1

Logical tunnel 2 - private network IP address 2 - destination device 2

......

The corresponding relationship may be divided into multiple lists for storage, and the specific storage form is not limited, and the foregoing correspondence may be included in the security gateway.

Step 203: The source device maps the data stream sent to each destination device to the corresponding logical tunnel according to the correspondence information, and transmits the data stream to the security gateway.

The source device determines a logical tunnel corresponding to each data flow according to the correspondence information between the private network IP address of the received logical tunnel and each destination device. For example, the data stream 1 to be sent by the source device to the destination device 1 is sent to the private network. In the logical tunnel 1 corresponding to the network IP address 1, the data stream to be sent by the source device to the destination device 2 is sent to the logical tunnel 2 corresponding to the private network IP address 2.

After determining the logical tunnel corresponding to the data flow, the source device according to the private network IP address of each logical tunnel The address maps each data stream into a corresponding logical tunnel, for example, mapping data stream 1 into logical tunnel 1 and data stream 2 into logical tunnel 2.

The process of mapping the data stream to the corresponding logical tunnel is a process of isolating the sent data. The specific mapping process may be to insert the private network IP address of the corresponding logical tunnel into the data.

After the data flow mapping is completed, the source device sends each data stream to the security gateway through a different logical tunnel. After receiving the data flow of each logical tunnel, the security gateway can identify each data flow according to the private network IP address of the logical tunnel, that is, the private network IP address of the logical tunnel inserted in the data flow, and then according to each logical tunnel. The corresponding relationship between the private network IP address and the destination device, and the identified data stream is sent to the corresponding destination device, for example, the data stream carrying the private network IP address 1 and the data stream transmitted by the logical tunnel 1 is received, according to The corresponding relationship between the private network IP address of the logical tunnel 1 and the destination device 1 is sent to the destination device 1 to complete the end-to-end data split transmission of the data from the source device to the destination device. The process of obtaining the correspondence between the IP address of the logical tunnel private network and the destination device by the security gateway may be as described in step 202.

In the embodiment of the present invention, a plurality of logical tunnels are set up in an IPsec tunnel, so that the source device can transmit data streams sent to different destination devices through different logical tunnels, and the data is shunted by the security gateway, and finally sent to the corresponding The destination device realizes the end-to-end secure transmission of data, such as splitting the service flow and the data flow, that is, ensuring data security and ensuring data isolation, which can better support the networking, and the method is implemented. To save external resources, such as IP addresses, ports, etc., it is possible to use end-to-end secure transmission with existing equipment more reasonably. This method is simple to implement, and this solution can be completed by standard protocols.

Referring to FIG. 3a, a flowchart of another data split transmission method according to an embodiment of the present invention is shown.

An example of the end-to-end data split transmission in this embodiment is as shown in FIG. 3b. The two logical tunnels are set up in an IPsec tunnel as an example. The method may include:

Step 301: The source device and the security gateway establish a pair of IKE SAs through IKE-SA-INIT exchange. In the IKEv2-based IPSec tunnel negotiation process between the source device and the security gateway, as shown in Figure 4, the establishment of a pair of IKE SAs and a pair of IPSec SAs is completed through IKE-SA-INIT exchange and IKE-SA-AUTH exchange. Through the CREATE-CHILD-SA exchange, another pair of IPSec SAs is established. Through the above negotiation, the source device and the security gateway can complete the establishment of the IPSec tunnel.

In the embodiment of the present invention, based on the foregoing tunnel establishment process, the IKE SA AUTH and CREATE - CHILD - SA two exchanges are adjusted to create multiple IPSec logical tunnels. In this step, the process of establishing a pair of IKE SAs through IKE-SA-INIT exchange is not adjusted, which is the same as the prior art. I won't go into details here.

Step 302: The source device sends the first exchange information to the security gateway, where the exchange information includes the request for obtaining the private network IP address of the first logical tunnel in the IPsec tunnel and the designated private network IP address of the first logical tunnel. Network segment.

In this step, the IKE-SA-AUTH exchange information in the prior art can be adjusted as the first exchange information. As shown in FIG. 5, the source device requests the security gateway to request the first logical tunnel in the IPsec tunnel through the exchange message. Private network IP address.

Specifically, the exchange message may carry a CP and a TSr payload, where the CP payload indicates that an IP address needs to be obtained; the TSr payload: indicates which network segment is desired to obtain an address; and the remaining payloads are carried as needed, and FIG. 5 is only an example.

Step 303: The source device sends the second exchange information to the security gateway, where the exchange information includes the request for obtaining the private network IP address of the second logical tunnel in the IPsec tunnel and the network to which the private network IP address of the second logical tunnel belongs. segment.

In this step, the information exchange and the CREATE_CHILD-SA exchange information can be adjusted as the second exchange information. As shown in FIG. 6, the source device requests the security gateway to request the private network of the second logical tunnel in the IPsec tunnel through the exchange message. IP address.

Specifically, the information exchange and the CREATE-CHILD-SA exchange message may respectively carry the CP and the TSR payload, where the CP payload indicates that the IP address needs to be obtained; the TSr payload: indicates which network segment is desired to obtain the address; Carrying, Figure 6 is only an example.

The private network IP addresses of the logical tunnels specified by the source device belong to different network segments, and the different network segments correspond to different logical tunnels and different destination devices, for example, the private network IP address of the first network segment specified by the source device. The address is corresponding to the destination device 1, and the private network IP address of the designated second network segment is corresponding to the destination device 2. In this embodiment, the corresponding relationship between the specified network segment and the destination device may be negotiated by the source device and the security gateway in advance; in other embodiments, the subsequent security gateway may allocate the private network IP address according to the specified network segment. After the source device obtains the private network IP address, it informs the security gateway of the corresponding relationship between the private network IP address of the logical tunnel and the destination device.

Step 304: After receiving the exchange message of the source device, the security gateway is the logic in the IPsec tunnel. The tunnels are assigned private network IP addresses, and the mappings between the private IP addresses of the logical tunnels and the destination devices are established.

The security gateway allocates the first logical tunnel according to the network segment to which the private IP address of the first logical tunnel specified in the IKE-SA-AUTH exchange information belongs, that is, the TSr payload in the IKE-SA-AUTH exchange information. The IP address of the private network, and the correspondence between the private network IP address of the first logical tunnel and the first destination device is established according to the correspondence between the specified network segment and the destination device negotiated by the source device and the security gateway.

The security gateway allocates a private network to the second logical tunnel according to the network segment to which the private IP address of the second logical tunnel specified in the information exchange and CREATE_CHILD-SA exchange information belongs, that is, according to the TSR payload in the exchange information. The IP address, and the correspondence between the private network IP address of the second logical tunnel and the second destination device is established according to the correspondence between the specified network segment and the destination device negotiated by the source device and the security gateway.

After receiving the request of step 302, the security gateway may allocate a private network IP address for the first logical tunnel, and after receiving the request of step 303, allocate a private network IP address for the second logical tunnel, and may also receive After all the requests are received, the private network IP address is assigned to each logical tunnel, and the mapping relationship between the private IP address of the logical tunnel and the destination device is established.

Through the above process, the source device and the security gateway can complete the establishment of two logical tunnels, and then the source device can map the data to different logical tunnels for end-to-end secure transmission.

In other embodiments, if a third or more logical tunnel needs to be established, the process of establishing the second logical tunnel may be repeated. In step 303, the security gateway repeatedly allocates the private network IP address.

Step 305: The source device maps the data stream sent to each destination device to the corresponding logical tunnel according to the private network IP address of each logical tunnel and the corresponding relationship information with each destination device, and transmits the data to the security gateway.

The source device receives the private network IP address of the two logical tunnels sent by the security gateway, and further obtains the corresponding relationship between the private network IP address of the logical tunnel and the destination device according to the pre-designated network segment, and then sends the data to the destination device. The data is mapped to the corresponding logical tunnel, and the mapping process is similar to the step 203 in the foregoing embodiment, and details are not described herein again.

Step 306: The security gateway receives the data stream sent by the source device through different logical tunnels. Step 307: The security gateway identifies the received data stream according to the private network IP address of the logical tunnel in the data, and sends the identified data stream according to the correspondence between the private network IP address of the two logical tunnels and each destination device. To the corresponding destination device.

The above is a description of an embodiment of the method of the present invention, and an apparatus and system for implementing the above method will be described below.

Referring to FIG. 7, a schematic structural diagram of a communication device according to an embodiment of the present invention is shown.

The communication device can include:

The address requesting unit 701 is configured to request a private network IP address of at least two logical tunnels in the IPsec tunnel.

The address receiving unit 702 is configured to obtain a private network IP address of the at least two logical tunnels and corresponding relationship information with each destination device.

The data isolation unit 703 is configured to map, according to the correspondence information, a data flow sent to each destination device to a corresponding logical tunnel, and transmit the data to the security gateway, so that the security gateway will receive the data. The stream is sent to the corresponding destination device.

After the communication device and the security gateway negotiate the IKEv2-based IPSec tunnel, or after the IPsec tunnel between the source device and the security gateway is established, the address requesting unit 701 of the communication device can exchange messages with the security gateway. The private network IP address of the logical tunnel in the IPsec tunnel is requested by the security gateway, and the number of the logical tunnel is at least two. For the isolation of the data stream, the address receiving unit 702 obtains the private network IP address of the at least two logical tunnels and the correspondence between the private network addresses of the logical tunnels, and obtains the private network IP address of the logical tunnel and its correspondence with each destination device. There are various methods, wherein the private network IP address of the obtained logical tunnel can be obtained by a security gateway or a network management system. The corresponding relationship between the private network IP address of the logical tunnel and the destination device that is allocated and sent to the address receiving unit 702 may also be pre-designated by the address requesting unit 701 when requesting the private network IP address of the logical tunnel, or may be specified. After the security gateway or the network management device allocates the information as needed, the corresponding relationship is notified to the address receiving unit 702. The data isolation unit 703 determines a logical tunnel corresponding to each data stream, and after determining the logical tunnel corresponding to the data flow, maps each data flow to a corresponding logical tunnel according to the private network IP address of each logical tunnel, and maps the data flow. The process of the corresponding logical tunnel is a process of isolating the transmitted data. After the data flow mapping is completed, each data stream is sent to the security gateway through a different logical tunnel. After receiving the data flow of each logical tunnel, the security gateway can identify each data flow according to the private network IP address of the logical tunnel, and then identify the data according to the correspondence between the private network IP address of the logical tunnel and the destination device. The stream is sent to the corresponding destination device.

The communication device in the embodiment of the present invention implements the end-to-end data transmission security of the data through the above-mentioned unit, for example, the service flow and the data flow are separately transmitted, that is, the data security is ensured and the data isolation is ensured, and the group can be better supported. The network, and the method realizes saving external resources, such as an IP address, a port, etc., and can realize the end-to-end secure transmission by using the existing equipment more reasonably. The method is simple to implement, and the solution can be completed by using a standard protocol.

In another embodiment of the present invention, the address requesting unit in the communications device may further include: a first requesting subunit, configured to exchange information by using the first exchange information, such as IKE_SA_AUTH, when the logical tunnel is two Requesting the security gateway to obtain the private IP address of the first logical tunnel.

a second request subunit, configured to: when the logical tunnel is two, pass the second exchange information, such as

Informational exchange and CREATE - CHILD - The SA exchange information requests the security gateway to obtain the private IP address of the second logical tunnel. The first exchange information and the second exchange information include a specified network segment of the requested private network IP address, and the private network IP addresses of the logical tunnels belong to different network segments.

FIG. 8 is a schematic structural diagram of a security gateway according to an embodiment of the present invention.

The security gateway can include:

The request receiving unit 801 is configured to receive, by the source device, a request for a private network IP address of at least two logical tunnels in the IPsec tunnel;

The address allocation unit 802 is configured to separately allocate a private network IP address to at least two logical tunnels in the IPsec tunnel, and feed back, to the source device, a private network IP address of the at least two logical tunnels; The data receiving unit 803 is configured to receive a data stream that is sent by the source device by using a different logical tunnel. The data offloading unit 804 is configured to identify the received data stream according to the private network IP address of the at least two logical tunnels, and according to at least two The data relationship between the private IP address of the logical tunnel and the destination device sends the identified data stream to the corresponding destination device.

After receiving the request of the source device for the private network IP address of at least two logical tunnels in the IPsec tunnel, the request receiving unit 801 respectively allocates a private network IP address for the logical tunnel by the address assigning unit 802, and feeds back the above information to the source device. The source device maps the different data streams to the respective logical tunnels according to the foregoing information, and then transmits the data stream to the security gateway, and the data receiving unit 803 receives the data stream, and the data stream splitting unit 804 identifies the data stream and distributes the data stream to the corresponding destination device. in. Transmission, such as the transmission of traffic and data streams, guarantees data security and data isolation, which can better support networking. Moreover, this method saves external resources, such as IP addresses, ports, etc. More reasonable use of existing equipment to achieve end-to-end secure transmission, the method is simple to implement, this solution can be completed using standard protocols.

FIG. 9 is a schematic structural diagram of another security gateway according to an embodiment of the present invention.

The security gateway may also include a request receiving unit 901, an address assigning unit 902, a data receiving unit 903, and a data splitting unit 904.

The request receiving unit 901 may further include:

The first receiving subunit 9011 is configured to: when the logical tunnel is two, receive first exchange information, such as IKE_SA_AUTH exchange information, sent by the source device to request to obtain a private network IP address of the first logical tunnel;

The second receiving subunit 9012 is configured to: when the logical tunnel is two, receive second exchange information, such as Informational exchange and CREATE, sent by the source device to request a private network IP address of the second logical tunnel. — CHILD — SA exchange information. The first exchange information and the second exchange information include a specified network segment of the requested private network IP address. The private network IP addresses of logical tunnels belong to different network segments.

The address allocation unit 902 is specifically configured to allocate a private network IP address for each of the two logical tunnels in the IPsec tunnel according to the specified network segment of the requested private network IP address included in the first exchange information and the second exchange information. The data receiving unit 903 and the data distributing unit 904 are similar to the data receiving unit 803 and the data distributing unit 804 in the foregoing embodiments, and details are not described herein again. Transmission, such as the transmission of traffic and data streams, guarantees data security and data isolation, which can better support networking. Moreover, this method saves external resources, such as IP addresses, ports, etc. More reasonable use of existing equipment to achieve end-to-end secure transmission, the method is simple to implement, this solution can be completed using standard protocols.

The system can include a source device 1001, a security gateway 1002, and at least two destination devices 1003. The source device 1001 is configured to request at least two logical tunnels from the security gateway 1002.

Obtaining a private network IP address of the at least two logical tunnels and corresponding relationship information with each destination device 1003; mapping, according to the correspondence information, a data flow sent to each destination device 1003 to And corresponding to the logical tunnel, and transmitted to the security gateway 1002, so that the security gateway 1002 sends the received data stream to the corresponding destination device 1003.

The system realizes end-to-end data transmission and secure transmission. For example, the service flow and the data flow are transmitted separately, that is, the data security is ensured and the data isolation is ensured, which can better support the networking, and the method achieves the saving. External resources, such as IP addresses, ports, etc., can make more reliable use of existing devices to achieve end-to-end secure transmission. This method is simple to implement, and this solution can be completed by standard protocols.

The embodiments of the present invention described above are not intended to limit the scope of the present invention. Any modifications, equivalent substitutions and improvements made within the spirit and scope of the invention are intended to be included within the scope of the appended claims.

Claims

Rights request

A data split transmission method, comprising:

The source device obtains a private network IP address of the at least two logical tunnels and corresponding relationship information with each destination device;

The source device maps the data stream sent to the destination device to the corresponding logical tunnel according to the correspondence information, and transmits the data flow to the security gateway, so that the security gateway will receive the data stream. Send to the corresponding destination device.

The method according to claim 1, wherein the source device requests the security gateway to request a private network IP address of at least two logical tunnels in the IPsec tunnel, including:

The source device requests the security gateway to obtain a private network IP address of the first logical tunnel by using the first exchange information;

The source device requests the security gateway for the private network IP address of the second logical tunnel by using the second exchange information.

The method according to claim 2, wherein the first exchange information and the second exchange information comprise a specified network segment of the requested private network IP address.

4. The method according to claim 3, wherein the private network IP addresses of the logical tunnels belong to different network segments.

5. A data shunt transmission method, comprising:

Receiving, by the security gateway, a data flow that is sent by the source device through different logical tunnels;

The security gateway identifies the received data stream according to the private network IP address of the at least two logical tunnels, and identifies the data according to the correspondence between the private network IP address of the at least two logical tunnels and each destination device. The stream is sent to the corresponding destination device.

The method according to claim 5, wherein, when the logical tunnel is two, the security gateway receives a request of a source device for a private network IP address of at least two logical tunnels in the IPsec tunnel. , including:

Receiving, by the security gateway, first exchange information that is sent by the source device to request to obtain a private network IP address of the first logical tunnel;

The security gateway receives second exchange information sent by the source device to request a private network IP address of the second logical tunnel.

The method according to claim 6, wherein the first exchange information and the second exchange information comprise a specified network segment of the requested private network IP address.

The method according to claim 7, wherein the security gateway allocates a private network IP address to at least two logical tunnels in the IPsec tunnel, specifically:

The security gateway allocates a private network IP address to the two logical tunnels in the IPsec tunnel according to the specified network segment of the requested private network IP address included in the first exchange information and the second exchange information.

9. A communication device, comprising:

10. The communication device according to claim 9, wherein the address requesting unit comprises:

a first requesting sub-unit, configured to: when the logical tunnel is two, request, by using the first exchange information, the private network IP address of the first logical tunnel to be obtained by using the first switching information;

And a second request subunit, configured to: when the logical tunnel is two, request the private network IP address of the second logical tunnel from the security gateway by using the second exchange information.

11. A security gateway, comprising: a request receiving unit, configured to receive, by the source device, a request for a private network IP address of at least two logical tunnels in the IPsec tunnel;

a data receiving unit, configured to receive a data stream that is sent by the source device by using a different logical tunnel; and a data offloading unit, configured to identify the received data stream according to the private network IP address of the at least two logical tunnels, and according to at least two The data relationship between the private IP address of the logical tunnel and the destination device sends the identified data stream to the corresponding destination device.

The security gateway according to claim 11, wherein the request receiving unit comprises:

a first receiving subunit, configured to receive, when the logical tunnel is two, first exchange information that is sent by the source device to request to obtain a private network IP address of the first logical tunnel;

The second receiving subunit is configured to receive, when the logical tunnel is two, second exchange information that is sent by the source device to request to obtain a private network IP address of the second logical tunnel.

The security gateway according to claim 12, wherein the first exchange information and the second exchange information comprise a specified network segment of the requested private network IP address.

14. The security gateway of claim 13 wherein:

The address allocation unit is specifically configured to separately allocate two logical tunnels in the IPsec tunnel according to the specified network segment of the requested private network IP address included in the first exchange information and the second exchange information. Private network IP address.

A data split transmission system, comprising: a source device, a security gateway, and at least two destination devices, wherein