WO2013064062A1

WO2013064062A1 - Method and device for transmitting data packet

Info

Publication number: WO2013064062A1
Application number: PCT/CN2012/083804
Authority: WO
Inventors: 姚宗明; 夏林峰
Original assignee: 华为技术有限公司
Priority date: 2011-10-31
Filing date: 2012-10-31
Publication date: 2013-05-10
Also published as: CN103096303A; CN103096303B

Abstract

Embodiments of the present invention provide a method and device for transmitting a data packet. The method comprises: determining an access type of a data packet; according to the correlation between the access type and an encryption algorithm of the data packet negotiated with a receiver, determining an encryption algorithm of the data packet; using the encryption algorithm of the data packet to encrypt the data packet; and sending the encrypted data packet to the receiver. In the embodiment of the present invention, data packets of different access types are configured with corresponding encryption algorithms, so as to resolve the conflict between the security and the real-time performance of data packet transmission, thereby improving the data packet transmission efficiency.

Description

Method and device for transmitting data packets

Embodiments of the present invention relate to the field of communications, and more particularly, to a method and apparatus for transmitting data packets. Background technique

IEEE (Institute of Electrical and Electronics Engineers, IEEE) 802.11 technology develops a common MAC (Medium Access Control) for multiple PHYs (Physical Layers) to build standard WLANs. The main task of the MAC is to establish addressing and channel access control mechanisms for multiple sites in the same network, making communication between multiple sites possible.

The basic component of WLAN (Wireless Local Area Networks) is BSS (Basic Service Set), which consists of STAs (Stations) with certain associations within a specific coverage area. The central site in the network that has a full-time management BSS is called an AP (Access Point), and other STAs in the network are associated with it. Multiple BSS networks are interconnected by DS (Distribution System) to form an ESS (Extended Service Set). In the absence of an AP, STAs can also communicate directly with each other by self-organizing the network. This network is an independent BSS or IBSS (Alternate Basic Service Set).

IEEE 802. Hi is a wireless security protocol and is a general principle. TKIP (Temporal Key Integrity Protocol) and CCMP (Counter Mode/CBC-MAC Protocol) are two types of data encryption algorithms. CCMP requires two AES (Advanced Encryption Standard) encryption operations for every 16 bytes of data, so the number of encryption operations is high. Moreover, CCMP is based on a "chain" mode, which requires processing 16-byte blocks in order, because the chain-encrypted mode requires the output of the previous stage as the source for the input of the next stage.

IEEE 802.11ac and IEEE 802.11ad have higher data rates and have had a significant impact on network protocols in other related fields. CCMP may not meet the requirements. At present, a new protocol GCMP (Galois/Counter Mode Protocol) uses the same AES encryption engine as CCMP, but it is equipped with a more powerful and effective framework. The number of dense operations is reduced to half and can be applied to the entire transmission parallel frame.

EDCA (Enhanced Distributed Channel Access) is an extension of the basic DCF (Distributed Coordinator Function) introduced in the IEEE 802. lie revision to support priority quality of service ( QoS). The EDCA mechanism defines four access categories (AC) based on data priority from low to high: AC_BK (background), AC_BE (best effort), AC_VI (video) and AC_VO (voice). Among them, AC-BK and AC-BE do not require much real-time data communication. However, for AC-VI and AC-VO, the amount of data is large and the real-time requirements are quite high.

The existing IEEE 802.11ac protocol specifies the encryption algorithm as follows: In an ESS, if the AP informs the relevant VHT (very High Throughput) STA that it supports CCMP encryption or beacon transmission by the AP. The detection feedback includes HT (High Throughput) capability information or VHT capability information. Therefore, the VHT STA can only use the CCMP encryption algorithm as the only choice of its encryption algorithm, which may result in delay in data packet transmission and result in data packets. The contradiction between security and real-time transmission. Summary of the invention

The embodiments of the present invention provide a method and a device for transmitting a data packet, which can resolve the contradiction between the security and real-time performance of the data packet transmission, and improve the transmission efficiency of the data packet.

In one aspect, a method for transmitting a data packet is provided, including: determining an access category of a data packet; determining an encryption algorithm of the data packet according to a correspondence between an access category of the data packet determined by the negotiation with the receiving end and an encryption algorithm. Encrypting the data packet using the encryption algorithm of the data packet; transmitting the encrypted data packet to the receiving end.

In another aspect, a method for transmitting a data packet is provided, including: receiving an encrypted data packet from a transmitting end; determining an access category of the data packet; and determining an access category and encryption of the data packet according to the negotiation with the transmitting end Corresponding relationship of the algorithm, determining an encryption algorithm of the data packet; using the encryption algorithm of the data packet to decrypt the data packet.

In another aspect, an apparatus for transmitting a data packet is provided, including: a first determining unit, configured to determine an access category of the data packet; and a second determining unit, configured to determine, according to the data packet determined by the receiving end, Corresponding relationship between the access category and the encryption algorithm, determining an encryption algorithm of the data packet; an encryption unit for encrypting the data packet using an encryption algorithm of the data packet; and a sending unit, configured to send the encrypted data to the receiving end package. In another aspect, an apparatus for transmitting a data packet is provided, including: a receiving unit, configured to receive an encrypted data packet from a transmitting end; a category determining unit, configured to determine an access category of the data packet; and an algorithm determining unit And determining, according to a correspondence between an access category and an encryption algorithm of the data packet determined by the sending end, determining an encryption algorithm of the data packet; and a decryption unit, configured to decrypt the data packet by using an encryption algorithm of the data packet .

The embodiment of the present invention can solve the contradiction between the security and the real-time performance of the data packet transmission by configuring the corresponding encryption algorithm for the data packets of different access categories, and improve the transmission efficiency of the data packet. DRAWINGS

In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings used in the embodiments or the prior art description will be briefly described below. Obviously, the drawings in the following description are only some of the present invention. For the embodiments, those skilled in the art can obtain other drawings according to the drawings without any creative work.

1 is a schematic flow chart of a method of transmitting a data packet according to an embodiment of the present invention. 2 is a schematic flow chart of a method of transmitting a data packet according to another embodiment of the present invention. FIG. 3 is a schematic flowchart of a process of transmitting a data packet according to another embodiment of the present invention. 4 is a schematic diagram of a format of a negotiating information element according to an embodiment of the present invention.

Figure 5 is a block diagram of an apparatus for transmitting data packets in accordance with one embodiment of the present invention.

6 is a block diagram of an apparatus for transmitting a data packet in accordance with another embodiment of the present invention. detailed description

The technical solutions in the embodiments of the present invention are clearly and completely described in the following with reference to the accompanying drawings in the embodiments of the present invention. It is obvious that the described embodiments are a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without making creative labor are within the scope of the present invention.

1 is a schematic flow chart of a method of transmitting a data packet according to an embodiment of the present invention. The method of Figure 1 is performed by a transmitting end, for example, the transmitting end may be a station in a wireless local area network, such as a STA defined in a WLAN.

110. Determine an access category of the data packet.

For example, the access category can be four access categories in the EDCA mechanism: AC—BK (background),

AC BE (best effort), AC VI (video) and AC VO (voice). However, the embodiments of the present invention It is not limited to the specific access categories described above.

120. Determine, according to a correspondence between an access category of the data packet determined by the negotiation with the receiving end and an encryption algorithm, an encryption algorithm of the data packet.

For example, the sending end may negotiate with the receiving end to determine the correspondence between the access category of the data packet and the encryption algorithm, for example, in the process of detecting the request/detecting response and/or the associated request/association response, the sending end and the receiving end may The correspondence is determined by negotiation, or the corresponding relationship is determined by negotiating with the receiving end through newly added dedicated signaling. Optionally, in an embodiment, before determining the access category of the data packet, the sending end may negotiate with the receiving end to determine a correspondence between the access category of the data packet and the encryption algorithm, for example, sending a detection request to the receiving end. In the process of associating the request, the receiver negotiates with the receiving end to determine the correspondence.

Optionally, as an embodiment, the sending end may generate a first negotiation information element, where the first negotiation information element indicates the first correspondence, and sends the first negotiation information element to the receiving end. For example, the sender may send the first negotiation information element when sending a detection request or an association request to the receiving end.

Optionally, as another embodiment, the sending end may receive a response message returned by the receiving end, where the response message carries a second negotiation information element from the receiving end, where the second negotiation information element indicates a second correspondence, according to the first The corresponding relationship and the second correspondence, the sending end determines the correspondence. In addition, the sending end may also receive an acknowledgement message returned by the receiving end for confirming acceptance of the first negotiation information element. For example, the sender may receive a response message or a confirmation message returned by the receiving end when detecting or correlating the detection request or the association request to the sender. In addition, the receiving end may not return any response message, and the default is to accept the first negotiation information element of the sending end. The embodiment of the invention is not limited.

Optionally, as another embodiment, if the second correspondence is the same as the first correspondence, the sending end determines that the corresponding relationship is the first correspondence or the second correspondence; and if the second correspondence is the first correspondence The sender determines that the correspondence is the second correspondence.

Optionally, as an embodiment, in the correspondence, the access class with higher real-time performance may correspond to a less complex encryption algorithm. For example, in the EDCA mechanism, the access category AC-VI or AC-VO has higher real-time requirements. In order to obtain higher real-time performance, a less complex encryption algorithm such as TKIP or GCMP can be used. Category AC—BK or AC—BE has lower requirements for real-time performance. For higher security, more complex encryption algorithms such as CCMP can be used. The sender and the receiver can synthesize each other's security configuration and negotiate the encryption algorithm of the data packets of different access categories. However, embodiments of the present invention are not limited to the specific categories and specific algorithms described above. Optionally, as an embodiment, the sending end may negotiate with the receiving end to determine a key corresponding to the encryption algorithm in the corresponding relationship. For example, for the encryption algorithm in the corresponding relationship, the sending end and the receiving end separately calculate and negotiate to determine the encryption algorithm. Corresponding unicast and multicast keys.

130. Encrypt the data packet by using an encryption algorithm of the data packet.

Optionally, as another embodiment, the sending end may use a key corresponding to the encryption algorithm determined by the receiving end to negotiate, and encrypt the data packet according to the encryption algorithm of the data packet determined in 120, and update the key. For the next packet encryption.

140. Send an encrypted data packet to the receiving end.

The embodiment of the present invention can solve the contradiction between the security and the real-time performance of the data packet transmission by configuring the corresponding encryption algorithm for the data packets of different access categories, and improve the transmission efficiency of the data packet.

2 is a schematic flow chart of a method of transmitting a data packet according to another embodiment of the present invention. The method of Figure 2 is performed by the receiving end. For example, the receiving end can be an access point in a wireless local area network, such as an AP defined in a WLAN.

210. Receive an encrypted data packet from the sending end.

220. Determine an access category of the data packet.

For example, the access category can be four access categories in the EDCA mechanism: AC—BK (background), AC_BE (best effort), AC_VI (video), and AC_VO (voice). However, embodiments of the present invention are not limited to the specific access categories described above.

230. Determine, according to a correspondence between an access category of the data packet determined by the sending end and the encryption algorithm, the encryption algorithm of the data packet.

For example, the receiving end may negotiate with the sending end to determine the correspondence between the access category of the data packet and the encryption algorithm, for example, in the process of detecting the request/detecting response and/or the associated request/association response, the receiving end and the transmitting end may The correspondence is determined by negotiation, or the corresponding relationship is determined by negotiating with the sender through the newly added dedicated signaling. Optionally, in an embodiment, before the receiving end receives the encrypted data packet from the transmitting end, the receiving end may negotiate with the transmitting end to determine a correspondence between the access category of the data packet and the encryption algorithm. For example, in the process of making a detection response or an association response at the receiving end, the correspondence is determined by negotiating with the transmitting end.

Optionally, as an embodiment, the receiving end may receive the first negotiation information element from the sending end, where the first negotiation information element indicates the first correspondence relationship; according to the first correspondence, the receiving end generates the second negotiation information element, where The negotiation information element indicates the second correspondence relationship; the receiving end returns a response message carrying the second negotiation information element to the sending end. In addition, the receiving end can also return to the sender for confirmation. Accept the confirmation message of the first negotiation information element. For example, the receiving end may send a response message carrying the second negotiation information element or an acknowledgement message for confirming acceptance of the first negotiation information element to the transmitting end when the detection response or the association response is sent to the sending end. . In addition, the receiving end may not return any response message, and the default is to accept the first negotiation information element of the sending end. The embodiments of the present invention are not limited.

Optionally, as another embodiment, if the receiving end accepts the first correspondence, the second corresponding relationship is the same as the first corresponding relationship; if the receiving end does not accept the first corresponding relationship, the second corresponding relationship corresponds to the first correspondence The relationship is different. For example, if the receiving end does not support the encryption algorithm or the non-correlation configuration in the correspondence indicated by the first negotiation information element of the transmitting end, the receiving end configures a corresponding encryption algorithm for the data packets of different access categories according to the situation of the receiving end, thereby A second correspondence is established, and a second negotiation information element is generated to indicate the second correspondence.

Optionally, as another embodiment, in the corresponding relationship, the access class with higher real-time performance may correspond to a lower complexity encryption algorithm. For example, in the EDCA mechanism, the access category AC-VI or AC-VO has higher real-time requirements. In order to obtain higher real-time performance, a less complex encryption algorithm such as TKIP or GCMP can be used. Category AC—BK or AC—BE has lower requirements for real-time performance. For higher security, more complex encryption algorithms such as CCMP can be used. The sender and the receiver can synthesize each other's security configuration and negotiate the encryption algorithm of the data packets of different access categories.

Optionally, as another embodiment, the receiving end may negotiate with the sending end to determine a key corresponding to the encryption algorithm in the corresponding relationship, for example, for the encryption algorithm in the corresponding relationship, the receiving end and the sending end separately calculate and negotiate to determine the encryption algorithm. Corresponding unicast and multicast keys.

240. Decrypt the data packet using the encryption algorithm of the data packet.

Optionally, the receiving end may use the key corresponding to the encryption algorithm in the correspondence determined by the sending end to negotiate, according to the encryption algorithm of the data packet determined in 230, decrypt the data packet, and update the key, so as to perform the next time. Packet decryption.

FIG. 3 is a schematic flowchart of a process of transmitting a data packet according to another embodiment of the present invention. In the embodiment of FIG. 3, the sending end of the data packet is the STA defined in the WLAN, and the receiving end is the AP defined in the WLAN as an example.

For the sake of brevity, only one STA and one AP are illustrated in FIG. 3, but the embodiment of the present invention is for STA. There is no limit to the number of APs. For example, STAs and APs in a BSS work in two modes of operation, MU-MIM0 (Multiple User MIMO) mode and SU-MIMO (Single User MIMO) mode. In the MU-MIMO mode, the AP simultaneously transmits data to multiple STAs or simultaneously receives data from multiple STAs. In the SU-MIMO mode, the AP transmits and receives data to and from only one STA at a time. Embodiments of the invention are applicable to either mode.

301. The STA generates a first negotiation information element, where the first negotiation information element indicates a first correspondence between the access category of the data packet and the encryption algorithm.

302. The STA sends a first negotiation information element to the AP.

For example, the STA may send the first negotiation information element to the AP when sending a detection request or an association request to the AP.

303. The AP generates, according to the received first negotiation information element from the STA, a second negotiation information element, where the second negotiation information element indicates a second correspondence between the access category of the data packet and the encryption algorithm.

Optionally, as an embodiment, if the AP accepts the first correspondence from the STA, the second correspondence is the same as the first correspondence, and if the AP does not accept the first correspondence from the STA, according to the In the case, the second correspondence is established, and the second negotiation information element is generated to indicate the second correspondence.

304. The AP returns a response message carrying the second negotiation information element to the STA.

For example, the AP may return a response message carrying the second negotiation information element to the STA when the detection response or the association response is sent to the STA, or the AP may return an acknowledgement to accept the first negotiation information element. The message, or the AP may not return any message, and the default is to accept the first negotiation information element of the STA. The embodiments of the present invention are not limited.

305. The STA determines, according to the response message that the second negotiation information element is returned by the AP, the correspondence between the access category of the data packet and the encryption algorithm.

Optionally, as an embodiment, if the second correspondence relationship indicated by the second negotiation information element is the same as the first correspondence relationship, the STA determines that the correspondence relationship is the first correspondence relationship or the second correspondence relationship; Different from the first correspondence, the STA determines that the correspondence is the second correspondence.

Optionally, as another embodiment, in the corresponding relationship, the access class with higher real-time performance may correspond to a less complex encryption algorithm. For example, in the EDCA mechanism, the access category AC-VI or AC-VO has higher real-time requirements. In order to obtain higher real-time performance, a less complex encryption algorithm such as TKIP or GCMP can be used. Category AC—BK or AC—BE for real-time Lower requirements, in order to achieve higher security, you can use more complex encryption algorithms, such as CCMP. The sender and the receiver can synthesize each other's security configuration and negotiate encryption algorithms for different access category data packets.

306. The STA and the AP negotiate to determine a key corresponding to the encryption algorithm in the correspondence.

For example, after the STA and the AP negotiate to determine the correspondence between the access category of the data packet and the encryption algorithm, the unicast and multicast keys corresponding to the encryption algorithm are separately calculated and negotiated for the encryption algorithm in the corresponding relationship. Used to encrypt or decrypt packets when sending or receiving data packets between STAs and APs.

307. Before sending a data packet to the AP, the STA determines an access category of the data packet.

308. The STA determines an encryption algorithm of the data packet according to the correspondence determined by the negotiation with the AP.

309. The STA encrypts the data packet by using an encryption algorithm of the data packet.

For example, the STA may encrypt the data packet using a key corresponding to the encryption algorithm that has been negotiated with the AP. The STA then updates the key for the next packet encryption.

310. The STA sends an encrypted data packet to the AP.

311. After receiving the encrypted data packet from the STA, the AP determines an access category of the data packet.

312. The AP determines an encryption algorithm of the data packet according to the correspondence determined by the STA.

313. The AP decrypts the data packet by using an encryption algorithm of the data packet.

For example, the AP may encrypt the data packet using a key corresponding to the encryption algorithm that has been negotiated with the STA. The AP then updates the key for the next packet decryption.

It should be understood that the size of the sequence numbers of the above processes does not imply a sequence of executions, and the order of execution of the processes should be determined by its function and internal logic, and should not be construed as limiting the implementation process of the embodiments of the present invention.

4 is a schematic diagram of a format of a negotiating information element according to an embodiment of the present invention.

As shown in FIG. 4, the specific meanings of the fields in the negotiation information element are as follows: The information element ID can help identify that the information element is a negotiation information element; the length represents the information element ID field and the length field in the negotiation information element. The overall length of the other fields; AC-VI encryption algorithm, AC-VO encryption algorithm, AC-BE encryption algorithm and AC-BK encryption algorithm field respectively represent the encryption algorithm corresponding to each access category, for example, 0 means no encryption, 1 for TKIP, 2 for GCMP, 3 for CCMP, 4~255 is reserved and not used temporarily.

The negotiation information element in the embodiment of the present invention can solve the contradiction between the security and the real-time performance of the data packet transmission by indicating the encryption algorithm corresponding to different access categories, and improve the transmission efficiency of the data packet.

Figure 5 is a block diagram of an apparatus for transmitting data packets in accordance with one embodiment of the present invention. An example of the device 500 of Figure 5 is a transmitting end, such as a station or access point in a wireless local area network, such as a STA or AP defined in a WLAN. The device 500 includes: a first determining unit 510, a second determining unit 520, an encrypting unit 530, and a transmitting unit 540.

The first determining unit 510 determines an access category of the data packet. The second determining unit 520 determines the encryption algorithm of the data packet according to the correspondence between the access category and the encryption algorithm of the data packet determined in agreement with the receiving end. The encryption unit 530 is configured to encrypt the data packet by using an encryption algorithm of the data packet. The sending unit 540 is configured to send the encrypted data packet to the receiving end.

For other functions and operations of the device 500, reference may be made to the process involving the transmitting end in the method embodiments of FIG. 1 and FIG. 3 above, and the detailed description is not repeated in order to avoid repetition.

Optionally, as an embodiment, as shown in FIG. 5, the device 500 may further include a negotiation determining unit 550, and determine the corresponding relationship by negotiating with the receiving end.

Optionally, in another embodiment, the negotiation determining unit 550 may receive a response message returned by the receiving end, where the response message carries a second negotiation information element from the receiving end, where the second negotiation information element indicates the second correspondence, And determining the correspondence according to the first correspondence relationship and the second correspondence relationship. The negotiation determining unit 550 is further configured to determine that the corresponding relationship is the first correspondence relationship or the second correspondence relationship if the second correspondence relationship is the same as the first correspondence relationship, or if the second correspondence relationship is different from the first correspondence relationship, Then, the correspondence is determined to be the second correspondence.

6 is a block diagram of an apparatus for transmitting a data packet in accordance with another embodiment of the present invention. An example of the device 600 of Figure 6 is a receiving end, such as a station or access point in a wireless local area network, such as a STA or AP defined in a WLAN. The device 600 includes: a receiving unit 610, a class determining unit 620, an algorithm determining unit 630, and a decrypting unit 640.

The receiving unit 610 receives the encrypted data packet from the transmitting end. The category determining unit 620 determines an access category of the data packet. The algorithm determining unit 630 determines an encryption algorithm of the data packet according to the correspondence between the access category and the encryption algorithm of the data packet determined in agreement with the transmitting end. The decryption unit 640 decrypts the data packet using the encryption algorithm of the data packet. The embodiment of the present invention can solve the contradiction between the security and the real-time performance of the data packet transmission by configuring the corresponding encryption algorithm for the data packets of different access categories, and improve the transmission efficiency of the data packet.

For other functions and operations of the device 600, reference may be made to the process involving the receiving end in the method embodiments of FIG. 2 and FIG. 3 above, and the detailed description is not repeated in order to avoid redundancy.

Optionally, as an embodiment, as shown in FIG. 6, the device 600 further includes a negotiation determining unit.

650. Negotiate the correspondence relationship with the sending end.

Optionally, as another embodiment, the negotiation determining unit 650 may receive the first negotiation information element from the sending end, where the first negotiation information element indicates the first correspondence, and generates the second negotiation information according to the first correspondence. The second negotiation information element indicates the second correspondence, and returns a response message carrying the second negotiation information element to the sending end.

A communication system according to an embodiment of the present invention may include the above-described device 500 or device 600.

Those of ordinary skill in the art will appreciate that the elements and algorithm steps of the various examples described in connection with the embodiments disclosed herein can be implemented in a combination of electronic hardware or computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the solution. A person skilled in the art can use different methods for implementing the described functions for each particular application, but such implementation should not be considered to be beyond the scope of the present invention.

A person skilled in the art can clearly understand that the specific working process of the system, the device and the unit described above can be referred to the corresponding process in the foregoing method embodiments for the convenience and brevity of the description, and details are not described herein again.

In the several embodiments provided herein, it should be understood that the disclosed systems, devices, and methods may be implemented in other ways. For example, the device embodiments described above are merely illustrative. For example, the division of the unit is only a logical function division. In actual implementation, there may be another division manner, for example, multiple units or components may be combined or Can be integrated into another system, or some features can be ignored, or not executed. In addition, the coupling or direct coupling or communication connection shown or discussed may be an indirect coupling or communication connection through some interface, device or unit, and may be electrical, mechanical or otherwise. The components displayed for the unit may or may not be physical units, ie may be located in one place, or may be distributed over multiple network units. Some or all of the units may be selected according to actual needs to achieve the objectives of the solution of the embodiment.

In addition, each functional unit in various embodiments of the present invention may be integrated in one processing unit. It is also possible that each unit physically exists alone, or two or more units may be integrated in one unit.

The functions, if implemented in the form of software functional units and sold or used as separate products, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention, which is essential or contributes to the prior art, or a part of the technical solution, may be embodied in the form of a software product, which is stored in a storage medium, including The instructions are used to cause a computer device (which may be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods described in various embodiments of the present invention. The foregoing storage medium includes: a U disk, a removable hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and the like, which can store program codes. .

The above is only the specific embodiment of the present invention, but the scope of the present invention is not limited thereto, and any person skilled in the art can easily think of changes or substitutions within the technical scope of the present invention. It should be covered by the scope of the present invention. Therefore, the scope of the invention should be determined by the scope of the claims.

Claims

Rights request

A method for transmitting a data packet, comprising:

Determine the access category of the data packet;

Determining an encryption algorithm of the data packet according to a correspondence between an access category of the data packet determined in negotiation with the receiving end and an encryption algorithm;

Encrypting the data packet using an encryption algorithm of the data packet;

Sending an encrypted data packet to the receiving end.

2. The method according to claim 1, wherein before determining the access category of the data packet, the method further comprises:

Negotiating with the receiving end to determine the correspondence.

The method according to claim 2, wherein the determining, by the receiving end, the determining the correspondence includes:

Generating a first negotiation information element, where the first negotiation information element indicates a first correspondence relationship; and sending the first negotiation information element to the receiving end.

The method according to claim 3, wherein the determining, by the receiving end, the determining the correspondence, further comprises:

Receiving a response message returned by the receiving end, where the response message carries a second negotiation information element from the receiving end, where the second negotiation information element indicates a second correspondence relationship;

And determining the correspondence according to the first correspondence relationship and the second correspondence relationship.

The method according to claim 4, wherein determining the correspondence according to the first correspondence and the second correspondence comprises:

If the second correspondence is the same as the first correspondence, determining that the corresponding relationship is the first correspondence or the second correspondence;

And if the second correspondence is different from the first correspondence, determining that the correspondence is the second correspondence.

The method according to any one of claims 1-5, wherein, in the correspondence, an access class with higher real-time performance corresponds to an encryption algorithm with lower complexity.

The method according to any one of claims 1-5, further comprising: negotiating with the receiving end to determine a key corresponding to the encryption algorithm in the correspondence relationship.

The method according to claim 7, wherein the encrypting the data packet by using an encryption algorithm of the data packet comprises: Using the key, encrypting the data packet according to an encryption algorithm of the data packet; updating the key.

A method for transmitting a data packet, comprising:

Receiving an encrypted data packet from the sender;

Determining an access category of the data packet;

Determining an encryption algorithm of the data packet according to a correspondence between an access category of the data packet determined in negotiation with the transmitting end and an encryption algorithm;

The data packet is decrypted using an encryption algorithm of the data packet.

10. The method according to claim 9, wherein before receiving the encrypted data packet from the transmitting end, the method further comprises:

Negotiating with the sending end to determine the correspondence.

The method according to claim 10, wherein the negotiating with the sending end to determine the correspondence includes:

Receiving a first negotiation information element from the sending end, where the first negotiation information element indicates a first correspondence relationship;

Generating, according to the first correspondence, a second negotiation information element, where the second negotiation information element indicates a second correspondence relationship;

Returning, to the sending end, a response message carrying the second negotiation information element.

12. The method according to claim 11, wherein if the first correspondence is accepted, the second correspondence is the same as the first correspondence;

If the first correspondence is not accepted, the second correspondence is different from the first correspondence.

The method according to any one of claims 8 to 12, wherein, in the correspondence, an access class with higher real-time performance corresponds to a less complex encryption algorithm.

The method according to any one of claims 8 to 12, further comprising: negotiating with the sender to determine a key corresponding to the encryption algorithm in the correspondence.

The method according to claim 14, wherein the decrypting the data packet according to the encryption algorithm of the data packet comprises:

Using the key, decrypting the data packet according to an encryption algorithm of the data packet; updating the key.

16. An apparatus for transmitting a data packet, comprising: a first determining unit, configured to determine an access category of the data packet;

a second determining unit, configured to determine an encryption algorithm of the data packet according to a correspondence between an access category of the data packet determined by the receiving end and the encryption algorithm;

An encryption unit, configured to encrypt the data packet by using an encryption algorithm of the data packet, and a sending unit, configured to send the encrypted data packet to the receiving end.

17. The device according to claim 16, further comprising:

And a negotiation determining unit, configured to negotiate with the receiving end to determine the correspondence.

The device according to claim 17, wherein the negotiation determining unit is configured to generate a first negotiation information element, where the first negotiation information element indicates a first correspondence, and sends the first correspondence information to the receiving end. The first negotiation information element is described.

The device according to claim 18, wherein the negotiation determining unit is further configured to receive a response message returned by the receiving end, where the response message carries a second negotiation information element from the receiving end, where The second negotiation information element indicates a second correspondence, and the correspondence is determined according to the first correspondence and the second correspondence.

The device according to claim 19, wherein the negotiation determining unit is configured to determine that the corresponding relationship is the first one if the second correspondence is the same as the first correspondence Correspondence relationship or the second correspondence relationship;

Or the negotiation determining unit is specifically configured to determine that the corresponding relationship is the second corresponding relationship if the second corresponding relationship is different from the first corresponding relationship.

An apparatus for transmitting a data packet, comprising:

a receiving unit, configured to receive an encrypted data packet from the sending end;

a category determining unit, configured to determine an access category of the data packet;

An algorithm determining unit, configured to determine an encryption algorithm of the data packet according to a correspondence between an access category and an encryption algorithm of the data packet determined by the sending end;

And a decryption unit, configured to decrypt the data packet by using an encryption algorithm of the data packet.

22. The device according to claim 21, further comprising:

And a negotiation determining unit, configured to negotiate with the sending end to determine the correspondence.

The device according to claim 22, wherein the negotiation determining unit is configured to receive a first negotiation information element from the sending end, where the first negotiation information element indicates a first correspondence, according to the Generating a second negotiation information element, where the second negotiation information element indicates a second correspondence, and returning a response carrying the second negotiation information element to the sending end

l708C80/ZlOZN3/X3d Ζ90^90/εΐΟΖ OAV