WO2016107359A1

WO2016107359A1 - Signature method and apparatus

Info

Publication number: WO2016107359A1
Application number: PCT/CN2015/096030
Authority: WO
Inventors: 刘微
Original assignee: 中兴通讯股份有限公司
Priority date: 2014-12-29
Filing date: 2015-11-30
Publication date: 2016-07-07
Also published as: CN105812137A

Abstract

Disclosed are a signature method and apparatus. The signature method comprises: determining translation processing to be performed on an application level gateway (ALG) subjected to network address translation (NAT) when a message to be sent is forwarded after the message is sent to an intermediate device; and signing the message by using a source internet protocol (IP) address or a destination IP address of the message, wherein when the source IP address is used for signing, the source IP address is retained in the message after translation processing on the ALG subjected to NAT and is used for designature. The present invention solves the problem in the relevant art that designature cannot be performed after translation processing on the ALG subjected to NAT for the message in a signature machine network, thereby achieving the technical effects that signing and designature can be realized by using the source IP address or the destination IP address of the message.

Description

Signature method and device

Technical field

The present invention relates to the field of communications, and in particular to a signature method and apparatus.

Background technique

While the rapid development of network technology, it has also been threatened by different degrees of infringement. The signature machine network can effectively protect the network security, and ensure the integrity, authenticity and non-repudiation of the data by signing and protecting the data encryption of the marginal device. The signature network deployment environment is as follows: First, the marginal device configuration on the user side is online, on which the signature de-signature function can be implemented, and the intermediate device is simulated. Finally, the marginal device on the network side is connected to the external network, and the signature solution can also be implemented. Signature function. Of course, the network deployment environment is not limited to this.

Digital signatures (also known as public key digital signatures, electronic signatures) are similar to ordinary physical signatures written on paper, but use techniques in the field of public key encryption and decryption to identify digital information. A set of digital signatures usually defines two complementary operations, one for the signature and one for the verification, that is, the signature. Simply put, a digital signature is some data attached to a data unit, or a password transformation made to a data unit. Here are some key segment cryptographic signatures of the message, which are used by the receiver to confirm the data source, information integrity and prevent tampering during transmission.

During the network interaction process, the IP address and port of the data need to be converted. The network address translation (NAT) can only convert the IP address and port in the UDP or TCP packet header. Field conversion in layer data payloads is powerless. The application level gateway (ALG) of the technology in the NAT solves this problem well, and can parse and translate the application layer protocol message information to ensure the correctness of the application layer communication. However, in the current cryptographic signature algorithm, if the source IP address of the packet is used as the plaintext to encrypt the packet, the NAT function will convert all the source IP addresses of the packet's three-layer header and four-layer header, and the signature. The key requirements for the machine environment are strictly the same. The source IP address translation will result in the change of the encrypted plaintext, which will result in unsuccessful de-signature, so that the original legitimate packet is also discarded as an illegal packet, so that the intranet wants to access the external network ftp and other services. can not achieve.

In view of the above problems in the related art, an effective solution has not yet been proposed.

Summary of the invention

The present invention provides a signature method and apparatus to at least solve the network address translation nat in the related art. Application level gateway alg can not be applied in the signature machine network.

According to an aspect of the present invention, a signature method is provided, including: determining, when a packet to be sent is forwarded after being sent to an intermediate device, performing a conversion process of an application level gateway alg that performs network address translation nat; The source IP address or the destination IP address of the packet is used to sign the packet. When the source IP address is used for signature, the source IP address is retained in the packet processed by the nat alg conversion process. Used for deregistration.

According to another aspect of the present invention, a signature method is provided, comprising: receiving a message to be forwarded, wherein the message is signed by a source Internet Protocol IP address or a destination IP address; and the received message is received Performing a conversion process of the application-level gateway alg of the network address translation nat; forwarding the converted packet, wherein the converted packet is signed by the source IP address, and the converted packet is The source IP address before the alg conversion processing of nat is reserved for de-signing.

Optionally, before forwarding the converted packet, the method further includes: when the packet before the conversion is signed by the source IP address, storing the source IP address before the alg conversion processing in the conversion In the payload field of the subsequent message, the converted message is marked.

According to a third aspect of the present invention, a method for de-signing is provided, which includes: receiving, by the intermediate device, a forwarding packet after the conversion processing of the application-level gateway alg of the network address translation nat, wherein the forwarding packet adopts a source The IP address of the Internet Protocol or the destination IP address is signed. When the forwarded packet is signed by the source IP address, the source IP address before the alg conversion processing of the nat is retained in the converted message; The forwarded packet is de-signed by using the source IP address or the destination IP address.

According to a fourth aspect of the present invention, a signature device is provided, comprising: a determining module, configured to determine an application level gateway alg that is to perform network address translation nat when a message to be sent is forwarded after being sent to an intermediate device. a conversion process, the signature module, configured to sign the message using a source Internet Protocol IP address or a destination IP address of the message, wherein the source IP address is retained when the source IP address is used for signature Used for de-signing in the message after the nat alg conversion process.

According to a fifth aspect of the present invention, a signature apparatus is provided, comprising: a first receiving module, configured to receive a message to be forwarded, wherein the message is signed by a source Internet Protocol IP address or a destination IP address a conversion module, configured to perform a network address translation nat of the application level gateway alg for the received message, and a forwarding module configured to forward the converted message, wherein the message before the conversion When the source IP address is used for signature, the source IP address before the alg conversion processing of the nat is retained in the converted message for de-signing.

Optionally, the method further includes: a saving module, configured to: when the packet before the conversion is signed by the source IP address, save the source IP address before the alg conversion processing in the payload field of the converted packet Medium and Mark the converted message.

According to a sixth aspect of the present invention, there is provided a de-signing device, comprising: a second receiving module, configured to receive a forwarding message after the conversion processing of the application-level gateway alg of the network address translation nat of the intermediate device, wherein The forwarded message is signed by the source Internet Protocol IP address or the destination IP address. When the forwarded message is signed by the source IP address, the converted message retains the nat before the alg conversion process. The source IP address; the de-signing module is configured to perform de-signing processing on the received forwarding packet by using the source IP address or the destination IP address.

According to a seventh aspect of the present invention, a user side marginal device comprising the signature device of the fourth aspect described above and the de-signature device of the sixth aspect described above is provided.

According to an eighth aspect of the invention, there is provided an intermediate device comprising the signing device of the fifth aspect described above.

According to a ninth aspect of the present invention, a network side marginal device comprising the above-described fourth aspect signature device and the above-described sixth aspect de-signature device is provided.

In the embodiment of the present invention, when the packet to be sent is forwarded after being sent to the intermediate device, the application level gateway alg of the network address translation nat is converted, and the source Internet protocol IP address or destination IP address of the packet is used. The message is signed; the problem that the signature of the application-level gateway alg in the network of the signature machine is not solved after the conversion of the packet in the network of the signature machine is solved, and the consistency of the encrypted plaintext in the process of encryption and result is ensured. In addition, the technical effect of signing and de-signing can be achieved by using the source IP address or the destination IP address of the packet.

DRAWINGS

The drawings described herein are intended to provide a further understanding of the invention, and are intended to be a part of the invention. In the drawing:

1 is a flow chart of an alternative signature method in accordance with the present invention;

2 is a flow chart of another method of signing optional according to an embodiment of the present invention;

3 is a flow chart of an alternative signature method according to an embodiment of the present invention;

4 is a block diagram showing the structure of a signature device according to an embodiment of the present invention;

FIG. 5 is a block diagram showing another structure of a signature device according to an embodiment of the present invention; FIG.

6 is a block diagram showing the structure of a de-signing device according to an embodiment of the present invention;

FIG. 7 is a schematic structural diagram of an overall implementation of signature and de-signature according to an embodiment of the present invention; FIG.

8 is a block diagram showing a connection structure of a marginal device and an intermediate device according to an embodiment of the present invention;

9 is a flowchart of an optional signature and de-signature implementation according to an embodiment of the present invention;

10 is a flow chart showing the operation of an optional signature marginal device in accordance with a preferred embodiment of the present invention;

11 is a flow chart showing the operation of an optional intermediate device in accordance with a preferred embodiment of the present invention;

12 is a flowchart showing the operation of an optional de-signing device according to a preferred embodiment of the present invention;

13 is a flowchart showing the operation of an optional signature device according to a preferred embodiment of the present invention;

14 is a flow chart showing the operation of an optional intermediate device according to a preferred embodiment of the present invention;

15 is a flow chart showing the operation of an optional de-signing device in accordance with a preferred embodiment of the present invention.

detailed description

The invention will be described in detail below with reference to the drawings in conjunction with the embodiments. It should be noted that the embodiments in the present application and the features in the embodiments may be combined with each other without conflict.

1 is a flow chart of an optional signature method according to the present invention. As shown in FIG. 1, the flow includes the following steps:

Step S102, determining that the packet to be sent is to be forwarded after being sent to the intermediate device, and then performing conversion processing of the application level gateway alg of the network address translation nat;

Step S104: Sign the packet by using the source Internet Protocol IP address or the destination IP address of the packet. When the source IP address is used for signature, the source IP address is reserved in the packet processed by the nat alg conversion process. Unsigned.

By using the above two signature methods, that is, using the source Internet Protocol IP address or the destination IP address of the packet plus the plaintext field such as the packet payload, the source IP address is retained by the source IP address. The message of the nat ag conversion process is used for de-signing, which solves the problem that the signature of the application-level gateway alg in the signature machine network in the signature machine network can not be solved after the conversion processing of the application-level gateway alg. The technical effect of signature and de-signature can be achieved by using the source IP address or destination IP address of the packet.

The application layer protocol packet includes the MAC address of the Layer 2 header, the source IP address and destination IP address of the Layer 3 header, and the source IP address and destination IP address of the Layer 4 header packet payload. The application layer protocol can be completed by using the nat alg conversion. The source IP address is used as the plaintext encryption. The source IP address in the Layer 3 header and the source IP address in the Layer 4 header are changed. As a result, the signature is unsuccessful. Source Internet Association using messages When the IP address or destination IP address is used to sign the packet, the cryptographic signature result can be stored in the idle field of the packet. The source IP address in the Layer 3 header and the Layer 4 header packet in the application layer data packet is retained in the packet payload processed by the nat alg conversion process, so that the source IP address is used for signature. The conversion of the source IP address by the nat alg function does not affect the subsequent de-signing, and the original legal packet is discarded as an illegal packet. To ensure the consistency of the signature and the unsigned signature, otherwise the signature failure will be solved, and the nat of nat caused by the failure of the source IP address due to the change of the source IP address caused by the nat alg conversion in the application layer protocol packet is solved in the related art. The conversion feature is not a technical issue in the signature machine network application.

FIG. 2 is a flowchart of another method for signing according to an embodiment of the present invention. As shown in FIG. 2, the process includes the following steps:

Step S202: Receive a packet to be forwarded, where the packet is signed by using a source Internet Protocol IP address or a destination IP address.

Step S204, performing a conversion process of the application level gateway alg of the network address translation nat on the received message;

In step S206, the converted packet is forwarded. When the packet before the conversion is signed by the source IP address, the source IP address before the alg conversion processing of the nat is reserved in the converted packet. Unsigned.

Optionally, in step S206, before forwarding the converted packet, the method further includes: when the packet before the conversion is signed by the source IP address, the source IP before the alg conversion process is performed. The address is stored in the payload field of the converted message and the converted message is marked.

This embodiment provides a solution to the case where the packet before the conversion is signed by the source IP address, that is, before the alg conversion process of the nat, the source IP address before the alg conversion process is saved in the converted report. In the payload field of the text, not only the normal nat alg conversion processing can be guaranteed, but also the source IP address is not changed and can be used for de-signing. In the related art, the source IP address pair is adopted in the signature network. After the data is encrypted and signed, the nat of the nat of the source IP address of the packet is processed, and the source IP address cannot be de-signed after the source IP address is changed. Therefore, the problem that the nat ag conversion cannot be applied in the signature machine network is realized. In the network of the signature machine, the integrity, authenticity and non-repudiation of the data are ensured by encrypting and signing the packet data, and the nat ag conversion processing of the application layer data is guaranteed.

FIG. 3 is a flowchart of an optional de-signing method according to an embodiment of the present invention. As shown in FIG. 3, the process includes the following steps:

Step S302: Receive the forwarding packet after the conversion processing of the application-level gateway alg of the network address translation nat, wherein the forwarding packet is signed by the source Internet protocol IP address or the destination IP address, and the source is used to forward the packet. When the IP address is signed, the source IP address before the alg conversion processing of the nat is retained in the conversion message;

Step S304: Perform de-signing processing on the received forwarded packet by using the source IP address or the destination IP address.

This embodiment provides a specific de-signing method after the signature is performed by using the source Internet protocol IP address or the destination IP address, that is, for the data packet signed by the source IP address, the nat alg conversion is retained in the converted message. The source IP address before processing. Therefore, the source IP address is still used for de-signing and the success rate of the signature can be guaranteed. The data packet signed by the destination IP address is not processed by the nat alg conversion. The destination IP address will be involved, so the success rate of the signature can also be guaranteed. By changing the signature method of the source IP address and signing with the destination IP address, the nat alg conversion does not affect the normal signature and de-signature of the signature network, thereby implementing the nat alg conversion function in the signature machine network. Applications.

FIG. 4 is a block diagram showing the structure of a signature device according to an embodiment of the present invention. As shown in FIG. 4, the signature device includes: a determining module 102, configured to determine that a packet to be sent is forwarded after being sent to an intermediate device. The conversion process of the application level gateway alg of the network address translation nat is to be performed; the signature module 104 is configured to sign the message using the source Internet Protocol IP address or the destination IP address of the message, wherein when the source IP address is used for signature The source IP address is reserved for signature after being processed by the nat alg conversion process.

FIG. 5 is a block diagram showing another structure of a signature device according to an embodiment of the present invention. As shown in FIG. 5, the signature device includes: a first receiving module 106, configured to receive a packet to be forwarded, where the packet is used. The source network protocol IP address or the destination IP address is used for the signature; the conversion module 108 is configured to perform the conversion process of the application level gateway alg of the network address translation nat of the received message; and the forwarding module 110 is configured to perform the converted message. The forwarding process is performed. When the packet before the conversion is signed by the source IP address, the source IP address before the alg conversion process of the nat is reserved for the signature in the converted message. The saving module 112 is configured to save the source IP address before the nat alg conversion process in the payload field of the converted message, and set the converted message to the converted message. The text is marked.

FIG. 6 is a block diagram showing a structure of a de-signing device according to an embodiment of the present invention. As shown in FIG. 6, the de-signing device includes: a second receiving module 114 configured to receive an intermediate device for network address translation nat. The forwarded packet is processed by the gateway alg. The forwarded packet is signed by the source IP address or the destination IP address. When the forwarded packet is signed by the source IP address, the packet is retained in the converted packet. The source IP address before the alg conversion processing is performed; the de-signing module 116 is configured to perform the de-signing process on the received forwarding packet by using the source IP address or the destination IP address.

FIG. 7 is a schematic structural diagram of an overall implementation of signature and de-signature according to an embodiment of the present invention. As shown in FIG. 7, the user side margin device 202 includes the above-mentioned signature device composed of the determination module 102 and the signature module 104. The de-signature device consisting of the second receiving module 114 and the de-signing module 116; the user-side marginal device 202 is configured to go online, and the signature and de-signature functions can be implemented; and a network-side marginal device 206 is provided, which also includes the above-described determining module 102. And a signature device composed of the signature module 104 and designed by the second receiving module 114 The de-signing device composed by the module 116; the network side marginal device is connected to the external network, and can also implement the signature and de-signature function; at the same time, an intermediate device 204 is provided, including the first receiving module 106, the conversion module 108, and the forwarding module. 110. The signature device formed by the save module 112. The intermediate device 204 is disposed between the user side margin device 202 and the network side margin device 206, and is configured to implement a conversion processing function of the application level gateway alg of the nat.

In an implementation, the embodiment of the present invention does not need to change the existing network environment, does not need to add other devices, does not damage the security and integrity of the original network deployment environment, and only utilizes existing network conditions through software and hardware. The solution to the above problem can be solved. In the network of the signature machine, the encryption key can be a symmetric key or an asymmetric key.

First, the signature method of the embodiment of the present invention will be described in detail by taking a single direction as an example:

The user side marginal device includes a message transceiver module, a decision module, and a signature module. The signed marginal device configures the user to go online and configures the signature function. Because the marginal device on the user side already knows that the intermediate device will enable the alg service of the nat, and the service changes the original source IP address field of the packet, the specific method of the signature is to use the secret key to set the destination IP address of the packet. The address field is encrypted and signed by the encryption algorithm. The source IP address and payload field do not participate in the cryptographic signature calculation to prevent address and port translation by services such as nat. The cryptographic signature result will be stored in the idle field of the message for verification by the de-signing device. The marginal device on the user side completes the packet parsing through the packet receiving module. The determining module determines whether the packet needs to be signed. The signature module completes the packet signature, and the packet sending module completes the final packet transmission.

The intermediate device includes a message receiving module (corresponding to the first receiving module 106), a determination module of the alg alg, and an implementation module of the alg function of the nat (corresponding to the conversion module 108), and implements address and port conversion to the application layer protocol. The intermediate device completes the packet receiving and parsing through the packet receiving module, and the determining module of the nat alg determines whether the nat alg function needs to be performed, and the nat agl module completes the nat alg function, and the packet source IP field is converted and modified. The text sending module completes the last transmission of the message.

The marginal device on the network side includes a packet transceiver module, a determination module, and the de-signature module, wherein the packet transceiver module is responsible for receiving and transmitting the message, and the determination module includes whether the signature processing needs to be performed and whether the nat has been done. Address translation. The network side marginal device is configured with a de-signature function, and the demarcation operation corresponding to the marginal device on the user side is performed. The marginal device on the network side also knows whether the packet forwarded at this time implements the alg function of the nat, if Address translation, then only use the destination IP address field of the packet to de-sign, instead of using the source IP address or packet payload field, to check the validity of the packet.

The invention designs an implementation method of an application level gateway (alg) based on a signature machine network. Firstly, it describes the composition and principle of the signature machine network, then describes the principle application of nat's alg, and finally describes the specific implementation method of combining the two, and solves the practical application problem in a real network application. In order to make the description clearer, the following detailed description will be made with reference to the accompanying drawings.

Preferred embodiments of the invention are described below.

Preferred embodiment one:

The following only illustrates the single direction as an example. In fact, the marginal device is both a signature device and a de-signature device. In the network of the signature machine shown in FIG. 8, the user host 201 is online on the user side margin device 202, and the user side margin device 202 is configured with a signature function. The user side margin device 202 determines that if the current message needs to be signed, And this needs to do the nat alg service processing later, then only use the destination IP address of the message as the plaintext, and combine the secret key to encrypt the signature, and the source IP address and the payload field are not involved in the encryption calculation for being converted. The calculation result is stored in the idle field of the message. The intermediate device 204 simulates the alg function of the real overlay nat. The network side margin device 206 is connected to the external network server 207, and after the determination is made corresponding to the user side margin device 202, if it needs to be de-signed and has been address-converted, only the destination IP address is used for the de-signing process. As shown in FIG. 9, after the message enters the message of the marginal device, after the parsing is completed, the determining module determines whether it is necessary to perform signature or de-signature processing. If no signature or de-signature processing is required, the decision module directly sends the signal to the sending module, otherwise it is sent to the signature de-signing module for processing, and finally to the transmitting module. As shown in FIG. 9, the specific steps include:

S401: The packet enters a packet receiving module, and performs packet parsing.

S402. The message passes the determination module to determine whether a message signature or a signature process needs to be performed. If the determination is no, the process jumps to S404.

S403. The message is signed or de-signed.

S404. The message is sent by the message sending module.

The end user accesses the existing internet network through the network side margin device 202 in the signature machine network. The intermediate device 204 configures the alg function of the nat. The following process is described in detail.

As shown in FIG. 10, the specific steps of the signature device include:

S501. The signed marginal device receives the packet and parses it.

S502. The determination module determines whether to perform signature processing. If the determination result is YES, the process jumps to S503. If the result of the determination is no, the process jumps to S506.

S503. The nat determination module determines whether there is a nat alg service processing in the forwarding process. If the result of the determination is YES, the process jumps to S504, and if the result of the determination is NO, the process proceeds to S505.

S504: The signature module uses the destination IP address field as the plaintext encryption signature for the received packet, and the source IP address and other fields that will be converted by the nat alg service will not be processed. Go to S506.

S505. The signature module is normally signed.

S506. The packet sending module sends the packet to the intermediate device.

As shown in FIG. 11, the specific steps of the intermediate device include:

S601: A packet receiving module of the intermediate device receives the packet and parses the packet.

S602. The determining module of the intermediate device determines whether the device needs to perform the nat alg service. If the result of the determination is YES, the process goes to S603, and if the result of the determination is NO, the process goes to S604.

S603, the nat alg module of the intermediate device performs the nat alg service processing, and the original source IP address of the packet is converted, and the destination IP address will not be changed.

S604. The sending module of the intermediate device sends the message to the de-signed edge device.

As shown in Figure 12, the specific steps for de-signing the marginal device are as follows:

S701: The signed edge device receives and parses the message.

S702. The determining module of the de-signed signed margin device determines whether a de-signing process needs to be performed. If the result of the determination is YES, the process goes to S703, and if the result of the determination is NO, the process goes to S706.

S703. The nat alg determination module of the de-signed signature device determines whether the received message has been subjected to the nat alg address translation. If the result of the determination is YES, the process goes to S704, and if the result of the determination is NO, the process goes to S705.

S704. The de-signature module of the de-signed signature device uses only the destination IP address of the packet as a plaintext de-signature process.

S705. The signed signature marginal device is normally de-signed.

S706: The message sending module of the demarcation marginal device sends the packet.

Preferred Embodiment 2:

The embodiment of the invention uses the source IP address to perform cryptographic signature. Because the nat alg function converts the application layer three-layer header data packet payload and the source IP address in the four-layer header data packet payload, the de-signature is unsuccessful. Therefore, the data packet of the alg alg is marked on the intermediate device, and the source IP address field before the conversion is retained in the packet payload field. The marginal device that solves the signature is responsible for parsing the received message. First, it is determined whether the alg function of the nat has been done, and the source IP address field of the function packet is restored to the message field before the conversion, that is, The plaintext field is restored and deleted in the payload field. The replaced plaintext field is used for the cryptographic signature. The calculated result is compared with the idle field of the previous result. If they are inconsistent, they are discarded and the original decryption function is processed.

In the network of the signature machine, the user accesses the existing network of the Internet through the user of the marginal device on the user side and the marginal device on the network side. Both marginal devices can perform signature and signature processing. The intermediate device judges whether or not the nat alg function is enabled, and transmits the message to the demarcation marginal device.

The signature device operates as shown in Figure 13, and the specific steps include:

S801. The signed marginal device receives the packet and parses it.

S802, the signed margin device determines whether the signature function is enabled, and if the determination result is YES, the process proceeds to S803, and if the determination result is NO, the process proceeds to S804.

S803: Sign the received packet, encrypt the signature of the source IP address field of the packet, and store the result in the idle field of the packet.

S804. The message is sent to the intermediate device.

The operation of the intermediate device is as shown in FIG. 14, and the specific steps include:

S901: Enter an intermediate device configuration mode, and receive and parse the packet.

In S902, it is determined whether or not the alg service processing of the nat needs to be performed. If the determination result is YES, the process proceeds to S903, and if the determination result is NO, the process proceeds to S904.

S903: The intermediate device saves the source IP address field to the payload field, and marks the packet to implement the nat alg service processing.

S904. The intermediate device sends the packet.

The solution of the signature signature device is shown in Figure 15, and the specific steps include:

S1001: The de-signature marginal device receives and parses the message.

S1002: The de-signature marginal device determines whether it is necessary to enable the de-signature operation process. If the determination result is YES, the process proceeds to S1003. If the determination result is negative, the process proceeds to S1006.

S1003: The de-signature marginal device determines whether the received message has been processed by the nat alg service. If the determination result is YES, the process proceeds to S1004. If the determination result is negative, the process proceeds to S1005.

S1004: The de-signature marginal device restores the source IP address field before the nat alg service conversion, and uses the source IP address field before the conversion to perform the signature processing.

S1005, the signature signature marginal device is normally de-signed.

S1006: The de-signature marginal device sends a message.

The invention is based on the signature machine network environment, and according to the characteristics of the signature machine signature algorithm, two implementation methods of the nat alg function in the network environment are proposed. Nat's alg function mainly converts the source IP address or port number of the application layer protocol. In this method, it is circumvented by this feature, and only the destination IP address field of the packet or the source IP address field before the conversion is reserved as the plaintext. The signature is such that the conversion of the source IP address does not affect the correctness of the signature result, so that the packet is forwarded normally.

It will be apparent to those skilled in the art that the various modules or steps of the present invention described above can be implemented by a general-purpose computing device that can be centralized on a single computing device or distributed across a network of multiple computing devices. Alternatively, they may be implemented by program code executable by the computing device such that they may be stored in the storage device by the computing device and, in some cases, may be different from the order herein. The steps shown or described are performed, or they are separately fabricated into individual integrated circuit modules, or a plurality of modules or steps thereof are fabricated as a single integrated circuit module. Thus, the invention is not limited to any specific combination of hardware and software.

The above description is only the preferred embodiment of the present invention, and is not intended to limit the present invention, and various modifications and changes can be made to the present invention. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and scope of the present invention are intended to be included within the scope of the present invention.

Industrial applicability

As described above, the signature method and apparatus provided by the embodiments of the present invention have the following beneficial effects: the problem that the signature cannot be de-signed after the conversion processing of the application-level gateway alg of the network address translation nat in the signature machine network in the related art is solved. The technical effect of signature and de-signing can be achieved by using the source IP address or the destination IP address of the packet.

Claims

A signature method that includes:

After the packet to be sent is forwarded after being sent to the intermediate device, the application level gateway alg of the network address translation nat is to be converted;

And signing the packet by using a source Internet Protocol IP address or a destination IP address of the packet, where the source IP address is retained by the nat alg conversion process when the source IP address is used for signature. Used in the message to de-sign.
A signature method that includes:

Receiving a packet to be forwarded, where the packet is signed by using a source Internet Protocol IP address or a destination IP address;

Performing conversion processing of the application level gateway alg of the network address translation nat on the received message;

Forwarding the converted packet, wherein, when the packet before the conversion is signed by the source IP address, the source IP address before the alg conversion processing of the nat is retained in the converted packet. Sign the signature.
The method of claim 2, wherein before the forwarding of the converted message, the method further comprises:

When the packet before the conversion is signed by the source IP address, the source IP address before the alg conversion processing is stored in the payload field of the converted packet, and the converted packet is marked.
A method of de-signing, including:

Receiving, by the intermediate device, the forwarding packet of the application-level gateway alg of the network address translation nat, wherein the forwarding packet is signed by using the source Internet protocol IP address or the destination IP address, and the forwarding packet is used in the forwarding packet. When the source IP address is signed, the source IP address before the alg conversion processing of the nat is retained in the converted message;

The source IP address or the destination IP address is used for de-signing processing on the received forwarding packet.
A signature device comprising:

The determining module is configured to determine that the to-be-sent packet is to be forwarded after being sent to the intermediate device, and then the network-level address conversion nat is applied to the application-level gateway alg.

a signature module, configured to sign the message by using a source Internet Protocol IP address or a destination IP address of the packet, wherein when the source IP address is used for signature, the source IP address is retained by the nat The message after the alg conversion process is used for de-signing.
A signature device comprising:

The first receiving module is configured to receive a packet to be forwarded, where the packet is signed by using a source Internet Protocol IP address or a destination IP address;

The conversion module is configured to perform a conversion process of the application level gateway alg that performs network address translation nat on the received message;

The forwarding module is configured to perform forwarding processing on the converted packet, where the packet before the conversion is signed by the source IP address, and the nat alg conversion processing is retained in the converted packet. The source IP address is used for deregistration.
The apparatus of claim 6 further comprising:

The saving module is configured to save the source IP address before the alg ag conversion process in the payload field of the converted message, and convert the converted message to the payload field of the converted message. The message is marked.
A de-signing device includes:

The second receiving module is configured to receive the forwarding packet after the conversion processing of the application-level gateway alg of the network address translation nat, wherein the forwarding packet is signed by the source Internet protocol IP address or the destination IP address. When the forwarded packet is signed by using the source IP address, the source IP address before the alg conversion processing of the nat is retained in the converted packet;

The de-signing module is configured to perform de-signing processing on the received forwarding packet by using the source IP address or the destination IP address.
A user side marginal device comprising the signature device of claim 5 and the de-signature device of claim 8.
An intermediate device comprising the signature device of claim 6 or 7.
A network side marginal device comprising the signature device of claim 5 and the de-signature device of claim 8.