WO2016082363A1

WO2016082363A1 - User data management method and apparatus

Info

Publication number: WO2016082363A1
Application number: PCT/CN2015/073522
Authority: WO
Inventors: 唐骁琨
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-11-25
Filing date: 2015-03-02
Publication date: 2016-06-02
Also published as: CN105610599B; CN105610599A

Abstract

Provided are a user data management method and apparatus. The method comprises: receiving a user information list containing internet protocol security (IPsec) configuration information; according to user information in the user information list, generating a global user node; and adding the global user node into a global user table, and managing access users via the global user table. By means of the present invention, the problem in the related art of reduced management efficiency due to excessive access users is solved.

Description

User data management method and device

Technical field

The present invention relates to the field of communications, and in particular to a user data management method and apparatus.

Background technique

Internet Protocol Security (IPsec) is a set of IP security protocols established by the IPsec team of the Internet Engineering Task Force (IETF). IPsec defines the security services used at the Internet layer, and its functions include data encryption, access control to network elements, data source address verification, data integrity checking, and replay prevention attacks.

IPsec remote access is a virtual private network (VPN) access technology based on IPsec tunnel encryption protection. Unlike the peer network model, remote access uses a client-server model. Unlike peer Internet Key Exchange (IKE) negotiation, remote access requires extended authentication and mode configuration exchange between the first phase and the second phase. After the first phase of IKE negotiation is completed, the server initiates extended authentication to the client. The first phase provides device-level authentication by means of a pre-shared key or certificate; and the extended authentication is outside the use of existing widely used authentication mechanisms, such as Remote Authentication Dial-In User Service (Remote Authentication Dial-In User Service, RADIUS), Secure ID (SecurID) and One Time Programmable (OTP) provide user-level authentication. After the client expands the authentication, it enters the mode configuration exchange phase. The client obtains the configuration information required to access the internal network from the IPsec VPN gateway, including the internal IP address assigned by the gateway, the internal DNS server, and the IP address of the WINS server. After the mode is configured, the IKE is negotiated in the second phase to generate a security association. The negotiation is complete. After that, the remote client can access the internal network resources protected by the IPsec VPN gateway by using the assigned internal IP address under the protection of the previously established IPsec tunnel.

The IPsec VPN gateway is responsible for managing and maintaining remote access client information. In a centralized system, all remote users are connected to the master to facilitate maintenance of user information. However, the capacity of the centralized system access user is limited. In addition, the device usually needs to bear other services at the same time. The user access speed and IPsec packet processing performance are weak. Distributed systems have significant advantages over centralized systems in terms of performance and capacity. The distributed system is generally composed of the main control, line card, and IPsec service card. The main control is mainly responsible for various management tasks, such as gateway configuration management and routing table management; the line card is mainly responsible for packet forwarding; the service card is mainly responsible for processing application protocols. For example, the IPsec protocol, the hardware encryption and decryption chip of the service card can provide powerful IPsec processing capability. When a large number of users access, you can use more The IPsec service cards are processed at the same time, and the problem introduced is that users are distributed over multiple service cards, resulting in very complicated user management.

In view of the problem that the management efficiency is lowered due to too many access users in the related art, an effective solution has not been proposed yet.

Summary of the invention

The present invention provides a user data management method and apparatus, so as to at least solve the problem that the related technology is reduced in management efficiency due to excessive access users.

According to an embodiment of the present invention, a user data management method is provided, including:

Receiving a list of user information including Internet Protocol security IPsec configuration information; generating a global user node according to the user information in the user information list; adding the global user node to the global user table, and managing the accessed user through the global user table.

Preferably, the user information in the user information list includes at least one of the following: a user group, a service card address, and IPsec configuration information, where the IPsec configuration information is used to configure an intranet resource for the access user; the user information list further includes: The user index table is used to index access users. The access user index table is composed of an IPsec interface and a user intranet IP.

Preferably, the accessed user is managed by the global user table by at least one of the following methods:

The first step is to determine, according to the preset threshold, whether the number of access users in the user group is greater than a preset threshold in the global user table; if the determination result is yes, the access interface is closed;

In the second solution, an abnormal service card is obtained by querying the global user table; all users on the upper line in the abnormal service card are deleted;

In the third solution, the access user is searched according to the access user index table, and the preset operation is performed on the access user. The preset operation includes at least one of the following: query and delete.

Preferably, after managing the accessed user by using the global user table, the method further includes: generating an entry according to the user information in the global user table; and establishing communication with the user access device according to the entry.

Preferably, establishing communication with the user access device according to the entry includes: mode 1: receiving an encrypted message sent by the user access device; decapsulating the encrypted message by using an Internet protocol security IPsec, and obtaining the decapsulated inner layer The packet is sent to the intranet device corresponding to the user access device.

or,

The second method is to receive the plaintext sent by the intranet device, and encapsulate the plaintext by using the Internet Protocol security IPsec to obtain the encapsulated packet; and send the packet to the user access device.

According to another embodiment of the present invention, a user data management apparatus is provided, including:

a receiving module, configured to receive a list of user information including Internet Protocol security IPsec configuration information; a generating module configured to generate a global user node according to user information in the user information list; and a management module configured to join the global user node to the global user In the table, users who are accessed through the global user table are managed.

Preferably, the management module is configured to manage the accessed user through the global user table by using at least one of the following manners: the first management unit is configured to determine, according to the preset threshold, whether the number of access users of the user group is in the global user table. If the result is YES, the access interface is closed; the second management unit is configured to obtain an abnormal service card by querying the global user table; deleting all users of the online line in the abnormal service card; The management unit is configured to search for an access user according to the access user index table, and perform a preset operation on the access user, where the preset operation includes at least one of the following: querying and deleting.

Preferably, the device further includes: an entry generating module, configured to generate a table according to user information in the global user table after managing the accessed user through the global user table; and the communication module is configured to generate according to the entry generating module The entry establishes communication with the user access device.

Preferably, the communication module includes: a first receiving unit configured to receive an encrypted message sent by the user access device; and a decapsulation unit configured to perform Internet Protocol security IPsec decapsulation on the encrypted message received by the first receiving unit And obtaining the decapsulated inner layer packet; the first sending unit is configured to send the decapsulated memory message to the intranet device corresponding to the user access device; or the second receiving unit is configured to receive the intranet The plaintext sent by the device; the encapsulation unit is configured to encapsulate the plaintext through the Internet Protocol security IPsec encapsulation, and the second sending unit is configured to send the packet to the user access device.

Through the present invention, a user information list containing Internet Protocol security IPsec configuration information is received; a global user node is generated according to user information in the user information list; and a global user node is added to the global user table. In the process of managing access users through the global user table, the problem of reduced management efficiency due to excessive access users is solved, thereby improving the efficiency of managing access users.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flowchart of a user data management method according to an embodiment of the present invention;

2 is a structural diagram of a user information list according to an embodiment of the present invention;

3 is a structural diagram of managing a user through a global user table according to an embodiment of the present invention;

4 is a block diagram showing the structure of a user data management apparatus according to an embodiment of the present invention;

FIG. 5 is a structural block diagram of a user data management apparatus according to a preferred embodiment of the present invention; FIG.

6 is a structural block diagram of a user data management apparatus according to a preferred embodiment of the present invention;

FIG. 7 is a structural block diagram of a user data management apparatus according to a preferred embodiment of the present invention; FIG.

Figure 8 is a schematic illustration of an operating environment suitable for use in accordance with an embodiment of the present invention;

FIG. 9 is a schematic diagram of a process for processing an IPC VPN gateway to a client access request according to an embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

In this embodiment, a user data management method is provided. FIG. 1 is a flowchart of a user data management method according to an embodiment of the present invention. As shown in FIG. 1, the process includes the following steps:

Step S102: Receive a user information list including Internet Protocol security IPsec configuration information.

Step S104: Generate a global user node according to the user information in the user information list.

Step S106: The global user node is added to the global user table, and the accessed user is managed by the global user table.

The user data management method provided by the embodiment of the present invention is applicable to an Internet Protocol Security (IPsec) gateway device, where at least one of the following is included in the gateway device: a main control, a service card, and a line card. Steps 102 to 106 are applied to the master control. The master generates a global user node according to the user information in the user information list reported by the received service card, and adds the generated global user node to the global user table, and manages the global user table. Access user. Before the step 102, the service card receives the negotiation form of the access user forwarded by the line card, performs IPsec processing according to the negotiation message, and obtains the internal network address and user group configuration information corresponding to the access user, and according to the above internal network address. And the user group configuration information is generated on the user node of the service card, and the user node is added to the user information list of the service board, and the user information list is uploaded to the main control, and then step S102 is performed.

Through the above steps, the user information list including the Internet Protocol security IPsec configuration information is received; the global user node is generated according to the user information in the user information list; the global user node is added to the global user table, and the access is managed through the global user table. The user solves the problem that the management efficiency is reduced due to too many access users, thereby achieving the effect of improving the management efficiency of the access user.

Preferably, the user information in the user information list includes at least one of the following: a user group, a service card address, and IPsec configuration information, where the IPsec configuration information is used to configure an intranet resource for the access user;

The user information list further includes: an access user index table, which is used to index the access user, and the access user index table is composed of an IPsec interface and a user intranet IP.

The user information list is as shown in FIG. 2. FIG. 2 is a structural diagram of a user information list according to an embodiment of the present invention, including:

(1) all the remote user nodes in the service card, that is, the access user corresponding to the user node generated on the service card;

(2) The user information list in the service card uses the IPsec interface and the user intranet IP as an index, and is used to index the corresponding user node;

(3) The user information stored at the user node includes at least one of the following: an access user group, a service card address, an external network address of the access user, and IPsec configuration information. The IPsec configuration information is the IPsec configuration of the negotiation packet processed by the IKE protocol on the service card. That is, the access user uses the network resources and network devices available on the intranet according to the assigned intranet IP address.

Preferably, the access user is managed by the global user table in at least one of the following manners. As shown in FIG. 3, FIG. 3 is a structural diagram of managing a user through a global user table according to an embodiment of the present invention, as follows:

The IPsec VPN gateway stores the user node under the user group corresponding to the IPsec interface according to the parameters carried in the negotiation of the access user. These users can go online from different business cards. Through the IPsec interface-user group management mode, the master can know the distribution of each user group's access users in each service card in real time. When the number of users in the user group reaches the maximum allowed number, the master notifies the client to turn off the user access function.

When the service card uploads user information, it carries the service card address information, and the master controls all users who are online on the service card. These users can belong to different user groups. When the service card is abnormal or is pulled out from the device, the master can sense and delete all users who are online on the service card.

Use the access user's IPsec interface and the user's intranet IP as the key value for indexing. The purpose of this index table is to quickly find users. When the gateway administrator needs to kick a user to go offline, the master obtains the input IPsec interface and the user's intranet IP. After the master finds the user, the user deletes the user and notifies the service card to delete. . Similarly, when the administrator views the specific information of a certain user, the master can also quickly find the user and display the user information through the obtained query request.

or,

In the embodiment, a user data management device is provided, which is used to implement the above-mentioned embodiments and preferred embodiments, and has not been described again. As used below, the term "module" can be implemented A combination of software and/or hardware for the intended function. Although the apparatus described in the following embodiments is preferably implemented in software, hardware, or a combination of software and hardware, is also possible and contemplated.

4 is a structural block diagram of a user data management apparatus according to an embodiment of the present invention. As shown in FIG. 4, the apparatus includes: a receiving module 22, a generating module 24, and a management module 26, where

The receiving module 22 is configured to receive a list of user information including Internet Protocol security IPsec configuration information;

The generating module 24 is connected to the receiving module 22 and configured to generate a global user node according to the user information in the user information list;

The management module 26 is connected to the generating module 24, and is configured to add the global user node to the global user table, and manage the accessed user through the global user table.

Preferably, FIG. 5 is a structural block diagram of a user data management apparatus according to a preferred embodiment of the present invention. As shown in FIG. 5, the management module 26 further includes: a first management unit 261, a second management unit 262, and a third management unit. 263. The management module 26 is configured to manage the accessed user by using a global user table by using at least one of the following manners:

The first management unit 261 is configured to determine, according to the preset threshold, whether the number of access users of the user group is greater than a preset threshold in the global user table; if the determination result is yes, the access interface is closed;

The second management unit 262 is configured to obtain an abnormal service card by querying the global user table, and delete all users of the online line in the abnormal service card;

The third management unit 263 is configured to search for an access user according to the access user index table, and perform a preset operation on the access user, where the preset operation includes at least one of the following: query, delete.

Preferably, FIG. 6 is a structural block diagram of a user data management apparatus according to a preferred embodiment of the present invention. As shown in FIG. 6, the apparatus includes, in addition to all the modules shown in FIG. 4, an entry generation module 42 and communication. Module 44, wherein

The entry generation module 42 is configured to generate an entry according to user information in the global user table after managing the accessed user through the global user table;

The communication module 44 is connected to the entry generation module 42 and configured to establish communication with the user access device according to the entry generated by the entry generation module 42.

Preferably, FIG. 7 is a structural block diagram of a user data management apparatus according to a preferred embodiment of the present invention. The communication module 44 includes: a first receiving unit 441, a decapsulation unit 442, a first sending unit 443, and a second receiving unit 444. Encapsulation unit 445 and second transmission unit 446, wherein

The first receiving unit 441 is configured to receive an encrypted message sent by the user access device.

The decapsulation unit 442 is connected to the first receiving unit 441, and configured to perform Internet Protocol security IPsec decapsulation on the encrypted packet received by the first receiving unit 441 to obtain a decapsulated inner layer packet.

The first sending unit 443 is connected to the decapsulation unit 442, and is configured to send the memory packet decapsulated by the decapsulation unit 442 to the intranet device corresponding to the user access device;

or,

The second receiving unit 444 is configured to receive the plaintext sent by the intranet device;

The encapsulating unit 445 is connected to the second receiving unit 444, and is configured to encapsulate the plaintext through the Internet Protocol security IPsec to obtain the encapsulated packet.

The second sending unit 446 is connected to the encapsulating unit 445 and configured to send the packet to the user access device.

The technical problem to be solved by the present invention is to overcome the problem of complicated management of IPsec remote access users in a distributed system existing in the prior art, and to provide a distributed user management method for cooperation between a master control and a service card.

The invention adopts the following technical solutions: the IPsec service card is responsible for remote access user negotiation, each IPsec service card maintains a user information list, and the user information is sent to the main control at the same time; the main control maintains the global user table according to the sent information. The user information list maintains all user information of the online service of the service card; the global user table maintains all user information of the service cards of the gateway. The user information includes a private network address assigned to the access user, mode configuration information, a service card address, and the like. The specific instructions are as follows:

(1) The remote access client initiates negotiation, and the line card selects an IPsec service card to process the negotiation packet.

(2) If the negotiation is successful, the service card generates a local user node and synchronizes the user information to the master.

(3) The master receives the user information sent by the service card, generates a user node, and joins the global user table.

(4) The master sends a line card according to the user information generation entry, and the line card checks the sent entry to ensure that the IPsec data packet sent between the subsequent access user and the intranet device is sent to the service card that the user goes online. Process it.

(5) When the user goes offline, the IPsec service card deletes the user node and notifies the master to delete it.

Specifically, as shown in FIG. 8, the remote access client accesses the public network and obtains the public network IP address (2.1.1.X). Now the client wants to access the intranet resources protected by the IPsec VPN gateway. The client initiates remote access negotiation to the gateway, and requests the gateway to allocate the internal network IP address (1.1.1.X) and other configuration information. After successful, the intranet resource can be accessed by using the intranet address. Data packets sent between the intranet host and the client are protected by IPsec tunnel encryption.

As shown in Figure 9, the IPsec VPN gateway processes the client access request as follows:

(1) The gateway administrator configures the parameters of the negotiation to ensure that the client access negotiation succeeds. The main configuration includes:

Step1. Negotiate the relevant parameters of the first phase and the second phase. Usually the negotiation parameters are selected under the configuration template.

Step2.IPsec interface. An IPsec interface is a logical interface that carries the IPsec protocol. You need to bind the previously generated configuration template to the IPsec interface. When the client negotiates, it first finds the IPsec interface and then obtains the configuration bound to it.

Step3. User group. Configure the parameters related to extended authentication and mode configuration in the user group, and the maximum number of access allowed by the user group.

(2) The line card packet receiving and receiving module receives the negotiation message sent by the client, selects a service card according to a specific algorithm, and delivers the message to the service card for processing. Subsequent negotiation messages sent by the client are also delivered to the same service card for processing.

(3) After receiving the negotiation packet, the service card sends the packet to the IPsec processing module. The IPsec processing module is responsible for the IKE protocol related functions, including the first phase negotiation, the extended authentication/mode configuration negotiation, and the second phase negotiation.

(4) After the negotiation is successful, the IPsec processing module generates a local user node according to the intranet address and user group configuration information allocated for the client, and joins the user information list. The data structure of the business card user information list is shown in Figure 2:

The service card user information list maintains all remote user nodes accessed by the service card.

The user information list is indexed using the IPsec interface + user private network IP as the key value.

The user information stored by the user node includes: an access user group, a service card address, a client public network address, mode configuration information, and the like.

(5) After the service card IPsec processing module generates the local user node, the user information is sent to the master IPsec processing module to generate a global user node and join the global user table. As shown in Figure 3, the master global user table provides three ways to manage access users:

a. Based on IPsec interface - user group management.

b. Management based on the service card where the access user negotiates.

When the service card sends user information, it carries the service card address information, and the master controls all users who go online. These users can belong to different user groups. When the service card is abnormal or is pulled out from the device, the master can sense and delete all users who are online on the service card.

c. Access user index table.

Use the access user's IPsec interface + user private network IP as the key value for indexing. The purpose of this index table is to quickly find users. When the gateway administrator needs to kick a user offline, enter the IPsec interface + user private network IP that the user accesses. After the master finds the user, the user deletes the user and notifies the service card to delete. Similarly, when an administrator views the specific information of a user, it can also quickly find the user and display the user information.

(6) The master IPsec processing module generates various entries according to the user information in the global user table, and sends the packet to the line card. These entries are used by the gateway to process IPsec encryption and decryption data packets of the client after the client accesses successfully. The line card packet sending and receiving module performs the following processing according to the delivered entry:

a. The ciphertext sent by the client to the intranet device is delivered to the service card of the client for IPsec decapsulation, and then the service card sends the inner packet back to the line card, and the line card forwards the packet to the client. Access to intranet devices.

b. The service card sent by the intranet device to the client is delivered to the client's online service card for IPsec encapsulation, and then the service card sends the encapsulated packet back to the line card and forwards it to the client.

In the above manner, the requirements of all the access users of the management gateway can be realized, including viewing user information, kicking the user offline, user table and associated module linkage, etc., and having the advantages of fast user positioning and diversified management modes:

a. The maximum number of allowed access users is set under the user group. When the maximum number is reached, subsequent requests to access the user group are rejected. The user in the user group can be online on multiple service cards. Therefore, only the master global user table can obtain the current number of access users in the user group. After the master discovers that the number of users reaches the upper limit, the service card is notified to disable the access function of the user group, and the service card rejects all IKE negotiation that is accessed to the user group; due to the timing, the master user group is closed. After the function, the local user node sent by the service card may still be received. At this time, the global user table cannot be added, but the service card should be notified to delete the redundant user. When the user goes offline and the number of users is lower than the maximum number, the master informs the service card to enable the access function of the user group.

b. The administrator can view the user access status of each user group or each service card, and the specific configuration information of each user.

c. The user table and the associated module can be linked. For example, after configuring the management module, after the administrator modifies the gateway configuration, the master can notify the service card to perform corresponding processing. For example, the user group bound to the IPsec interface is deleted, and the master control notifies each service card to delete all access users belonging to the user group, and notifies the client.

d. The administrator can kick the user down the line by accessing the user index table. You can also use the IPsec interface, user group, or service card as the unit to kick the user offline. When the user goes offline, the master deletes the user from the global user list and notifies the service card to delete.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

According to the foregoing technical solution provided by the embodiment of the present invention, a user information list including Internet Protocol security IPsec configuration information is received; a global user node is generated according to user information in the user information list; and a global user node is added to the global user table. The user accessing the user through the global user table solves the problem that the management efficiency is reduced due to excessive access users, thereby improving the efficiency of managing the access user.

Claims

A user data management method includes:

Receiving a list of user information including Internet Protocol security IPsec configuration information;

Generating a global user node according to the user information in the user information list;

Adding the global user node to the global user table, and managing the accessed user through the global user table.
The method according to claim 1, wherein the user information in the user information list comprises at least one of: a user group, a service card address, and the IPsec configuration information, wherein the IPsec configuration information is used for Enter the user to configure intranet resources;

The user information list includes an access user index table for indexing an access user, and the access user index table is composed of an IPsec interface and a user intranet IP.
The method of claim 2, wherein the accessed user is managed by the global user table by at least one of:

The first step is to determine, according to the preset threshold, whether the number of access users of the user group is greater than the preset threshold in the global user table; if the determination result is yes, the access interface is closed;

In the second scenario, an abnormal service card is obtained by querying the global user table; and all users on the online service in the abnormal service card are deleted;

The third step is to search for an access user according to the access user index table, and perform a preset operation on the access user, where the preset operation includes at least one of the following: querying and deleting.
The method of claim 2, after the managing the accessed user by the global user table, further comprising:

Generating an entry according to the user information in the global user table;

Establishing communication with the user access device according to the entry.
The method of claim 4, wherein the establishing communication with the user access device according to the entry comprises:

Manner 1: receiving an encrypted packet sent by the user access device, performing Internet Protocol security IPsec decapsulation on the encrypted packet, and obtaining the decapsulated inner layer packet; sending the inner layer packet to the The internal network device corresponding to the user access device;

or,

The second method is to receive the plaintext sent by the intranet device, and encapsulate the plaintext by using the Internet Protocol security IPsec to obtain the encapsulated packet; and send the packet to the user access device.
A user data management device comprising:

a receiving module, configured to receive a list of user information including Internet Protocol security IPsec configuration information;

Generating a module, configured to generate a global user node according to the user information in the user information list;

The management module is configured to add the global user node to the global user table, and manage the accessed user by using the global user table.
The device according to claim 6, wherein the user information in the user information list comprises at least one of: a user group, a service card address, and the IPsec configuration information, wherein the IPsec configuration information is used for Enter the user to configure intranet resources;

The user information list includes an access user index table for indexing an access user, and the access user index table is composed of an IPsec interface and a user intranet IP.
The device according to claim 7, wherein the management module is configured to manage the accessed user through the global user table by at least one of:

The first management unit is configured to determine, according to the preset threshold, whether the number of access users of the user group is greater than the preset threshold in the global user table; if the determination result is yes, the access interface is closed;

a second management unit, configured to obtain an abnormal service card by querying the global user table; deleting all users of the online line in the abnormal service card;

The third management unit is configured to search for an access user according to the access user index table, and perform a preset operation on the access user, where the preset operation includes at least one of the following: querying and deleting.
The apparatus of claim 7 wherein said apparatus further comprises:

An entry generating module, configured to generate an entry according to the user information in the global user table after the user that is accessed by the global user table is managed;

The communication module is configured to establish communication with the user access device according to the entry generated by the entry generation module.
The apparatus of claim 9, wherein the communication module comprises:

a first receiving unit, configured to receive an encrypted message sent by the user access device;

The decapsulation unit is configured to perform Internet Protocol security IPsec decapsulation on the encrypted packet received by the first receiving unit, to obtain an encapsulated inner layer packet;

The first sending unit is configured to send the decapsulated inner layer packet to an intranet device corresponding to the user access device;

or,

a second receiving unit, configured to receive the plaintext sent by the intranet device;

The encapsulating unit is configured to encapsulate the plaintext by using the Internet Protocol security IPsec to obtain the encapsulated packet;

The second sending unit is configured to send the message to the user access device.