WO2016180020A1

WO2016180020A1 - Message processing method, device and system

Info

Publication number: WO2016180020A1
Application number: PCT/CN2015/097553
Authority: WO
Inventors: 唐亮; 蒋维廉; 韩涛; 王滨
Original assignee: 华为技术有限公司
Priority date: 2015-05-13
Filing date: 2015-12-16
Publication date: 2016-11-17
Also published as: CN104993993B; CN104993993A

Abstract

Disclosed are a message processing method, device and system. The method comprises: an access device establishing at least one tunnel between same and a CGN device; the access device receiving a first data message sent by a first user terminal; the access device acquiring, according to the mapping relationship between a user terminal address and a user identifier, a first user identifier corresponding to the first user terminal, and performing GRE encapsulation on the first data message, so as to obtain a first GRE message, wherein the first GRE message carries the first user identifier; and the access device sending the first GRE message to the CGN device through the at least one tunnel. By means of the embodiment, when a large number of users access a network, the overhead of tunnel resources can be reduced, the configuration process can be simplified, and the system overhead and network resources can be saved.

Description

Message processing method, device and system

This application claims priority to Chinese Patent Application No. 201510243026.3, entitled "A Message Processing Method, Apparatus and System", filed on May 13, 2015, the entire contents of which are incorporated by reference. In this application.

Technical field

The present invention relates to the field of network technologies, and in particular, to a packet processing method, device, and system.

Background technique

Tunneling is a way to pass data between networks by using the infrastructure of the Internet. For example, in the home user access scenario, the traditional customer premises equipment (CPE) integrates the dynamic host configuration protocol (DHCP) of the control plane and the universal plug and play server (Universal Plug and Play). Server, UPnP server), TR069 protocol (Technical Report 069), user management functions, and network address translation (NAT), routing and forwarding functions of the forwarding plane. The integration of these functions is based on CPE hardware support. When an operator wants to deploy a new service, such as upgrading to the Internet Protocol version 6, IPv6, software and hardware upgrades are required for the massive CPE distributed in each home, resulting in an increase in equipment investment costs. The multi-functional integration of CPE also causes an increase in the operation and maintenance and management costs of the existing network. To solve this problem, the different functions of the CPE can be decomposed into different devices, for example, the control plane function is decomposed into a Broadband Remote Access Server (BRAS). At this time, the Layer 2 client-side device L2-CPE Only the basic Layer 2 forwarding function is required. The BRAS device encapsulates the L2-CPE user traffic into different Generic Routing Encapsulation (GRE) and sends it to the carrier-level network address translation through the tunnel. , CGN) equipment.

However, the foregoing method of the prior art needs to configure an independent GRE tunnel for each user end, and at least the following problems exist: (1) For a large number of users, a large number of GRE tunnels need to be set to support, and the overhead of the tunnel resources is increased. (2) GRE tunnel is statically configured for mass use The client will greatly increase the configuration of the client; (3) The massive GRE tunnel enables Keep alive detection, which increases system overhead and occupies a large amount of network resources.

Summary of the invention

In view of this, the embodiments of the present invention provide a packet processing method, device, and system, so as to reduce the overhead of tunnel resources when accessing a large number of users.

The technical solution provided by the embodiment of the present invention is as follows:

In a first aspect, a message processing method includes:

The access device establishes at least one tunnel with the CGN device;

Receiving, by the access device, the first data packet sent by the first user end;

Obtaining, by the access device, the first user address carried in the first data packet, and acquiring a first user identifier corresponding to the address of the first user terminal according to a mapping relationship between the user address and the user identifier, The first data packet sent by the first user end is GRE-encapsulated to obtain a first GRE packet, where the first GRE packet carries the first user identifier;

The access device sends the first GRE message to the CGN device by using the at least one tunnel.

In a first possible implementation manner of the first aspect, the method further includes:

The access device receives a second GRE message sent by the CGN device through the at least one tunnel, where the second GRE message is a second data packet sent by the CGN device to the server to the second user end. The second GRE packet carries the second user identifier corresponding to the second user end.

Decapsulating the second GRE packet by the access device to obtain the second data packet;

The access device sends the second data packet to the second user end.

With reference to the foregoing first aspect, or the first possible implementation manner of the first aspect, in a second possible implementation manner of the first aspect, the GRE header of the first GRE packet carries the first user identifier.

In combination with the above first aspect, or any one of the possible implementations of the first aspect, the first aspect The third possible implementation manner, before the sending the first GRE message by using the at least one tunnel, the method further includes: performing Internet protocol security on the first GRE message (English full name: Internet Protocol Security, English abbreviation: IPsec) protocol encapsulation.

A second aspect is a message processing method, where the method is applied to a CGN device, and the CGN device and the access device include at least one tunnel established by the access device, and the method includes:

Receiving, by the CGN device, the first GRE packet sent by the access device by using the at least one tunnel, where the first GRE packet is sent by the access device to the first data packet from the first user end The first GRE packet carries the first user identifier corresponding to the first user end, as obtained by the GRE encapsulation;

Decapsulating the first GRE packet by the CGN device, and acquiring the first data packet;

The CGN device sends the first data packet to a server.

In a first possible implementation manner of the second aspect, the method further includes:

Receiving, by the CGN device, a second data packet sent by the server to the second user end;

Obtaining, by the CGN device, the address of the second user end, acquiring the second user identifier corresponding to the second user end according to the mapping relationship between the user end address and the user identifier, and performing the second data packet on the GRE Encapsulating, obtaining a second GRE packet, where the second GRE packet carries the second user identifier;

The CGN device sends the second GRE message to the access device by using the at least one tunnel.

With reference to the foregoing second aspect, or the first possible implementation manner of the second aspect, in a second possible implementation manner of the second aspect, the GRE header of the first GRE packet carries the first user identifier.

With reference to the first possible implementation manner of the foregoing second aspect, or the second possible implementation manner of the second aspect, in a third possible implementation manner of the second aspect, the sending, by using the at least one tunnel Before the second GRE packet, the method further includes: performing the second GRE packet IPsec encapsulation.

In a third aspect, an access device includes at least one tunnel between the access device and the CGN device; the access device includes:

a first receiving unit, configured to receive a first data packet sent by the first user end;

a processing unit, configured to acquire an address of the first user end from the first data packet, and acquire a first user identifier corresponding to the first user end according to a mapping relationship between the user end address and the user identifier, where the first The first GRE packet carries the first user identifier, and the first GRE packet carries the first user identifier.

The first sending unit is configured to send the first GRE message to the CGN device by using the at least one tunnel.

In a first possible implementation manner of the third aspect, the access device further includes: a second receiving unit and a second sending unit, where:

The second receiving unit is configured to receive a second GRE message that is sent by the CGN device by using the at least one tunnel, where the second GRE message is sent by the CGN device to the second user end of the server. The second data message is obtained by the GRE encapsulation, and the second GRE message carries the second user identifier corresponding to the second user end.

The processing unit is configured to decapsulate the second GRE message and the second user identifier, and obtain the second data packet;

The second sending unit is configured to send the second data packet to the second user end.

With reference to the foregoing third aspect, or the first possible implementation manner of the third aspect, in a second possible implementation manner of the third aspect, the GRE header of the first GRE packet carries the first user identifier.

With reference to the foregoing third aspect, or any one of the possible implementation manners of the third aspect, in a third possible implementation manner of the third aspect, the processing unit is further configured to send, by using the at least one tunnel The first GRE packet is IPsec encapsulated before the first GRE packet.

A fourth aspect, a CGN device, where the CGN device and the access device include at least one a tunnel established by the access device; the CGN device includes:

a first receiving unit, configured to receive a first universal routing encapsulation protocol GRE packet sent by the access device by using the at least one tunnel, where the first GRE packet is sent by the access device from the first user The first data packet is obtained by the GRE encapsulation, and the first GRE packet carries the first user identifier corresponding to the first user end.

a processing unit, configured to decapsulate the first GRE packet, and obtain the first data packet;

The first sending unit is configured to send the first data packet to the server.

In a first possible implementation manner of the fourth aspect, the CGN device further includes a second receiving unit and a second sending unit, where:

The second receiving unit is configured to receive a second data packet sent by the server to the second user end;

The processing unit is configured to obtain a second user identifier corresponding to the second user end according to the mapping relationship between the user address and the user identifier, and perform the GRE encapsulation on the second data packet to obtain the second GRE report. The second GRE packet carries the second user identifier;

The second sending unit is configured to send the second GRE message to the access device by using the at least one tunnel.

With reference to the foregoing fourth aspect, or the first possible implementation manner of the fourth aspect, in a second possible implementation manner of the fourth aspect, the GRE header of the first GRE packet carries the first user identifier.

In conjunction with the first possible implementation of the foregoing fourth aspect, or the second possible implementation of the fourth aspect, in a third possible implementation manner of the fourth aspect, the processing unit is further configured to pass Before the at least one tunnel sends the second GRE packet, performing IPsec encapsulation on the second GRE packet.

In a fifth aspect, a message processing system includes:

The access device provided by any one of the foregoing third aspect or the third aspect, and the CGN provided by any one of the foregoing fourth or fourth possible implementation manners device.

With the foregoing solution, the packet processing method, device, and system provided by the embodiment of the present invention establish at least one tunnel with the CGN device by using the access device, and the access device receives the first data packet sent by the first user end. Obtaining, by the first data packet, the address of the first user end, and acquiring a first user identifier corresponding to the first user end address according to a mapping relationship between the user end address and the user identifier, where the first The first data packet sent by the UE is encapsulated by the GRE to obtain the first GRE packet, where the first GRE packet carries the first user identifier, and the access device uses the at least one tunnel to the The CGN device sends the first GRE packet; correspondingly, the CGN device receives and decapsulates the first GRE packet, acquires the first data packet, and then sends the first data packet to the server. . The method, device, and system of the embodiments of the present invention are applied, so that when a large number of users access the network, the overhead of the tunnel resource can be reduced, the configuration process can be simplified, and system overhead and network resources can be saved.

DRAWINGS

1 is a flowchart of a message processing method according to a first embodiment of the present invention;

2 is a schematic diagram of a format of a GRE packet header in the prior art;

3 is a first schematic diagram of a format of a GRE packet header according to an embodiment of the present invention;

4 is a second schematic diagram of a format of a GRE packet header according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of IPsec encapsulation of a GRE packet according to an embodiment of the present invention;

FIG. 6 is a flowchart of a packet processing method according to a second embodiment of the present invention; FIG.

FIG. 7 is a flowchart of an application scenario of an embodiment of the present invention;

FIG. 8 is a schematic structural diagram of an access device according to an embodiment of the present invention;

FIG. 9 is a schematic structural diagram of hardware of an access device according to an embodiment of the present invention;

FIG. 10 is a schematic structural diagram of a CGN device according to an embodiment of the present invention;

11 is a schematic structural diagram of hardware of a CGN device according to an embodiment of the present invention;

FIG. 12 is a schematic structural diagram of a system according to an embodiment of the present invention.

detailed description

The embodiment of the invention provides a packet processing method, device and system, which can reduce the overhead of the tunnel resource, simplify the configuration process, save system overhead and network resources in the service scenario of the user accessing the network.

The detailed description will be respectively made below through specific embodiments.

In order to make the object, the features and the advantages of the present invention more obvious and understandable, the technical solutions in the embodiments of the present invention will be clearly described below with reference to the accompanying drawings in the embodiments of the present invention. The examples are only a part of the embodiments of the invention, but not all of them. All other embodiments obtained by a person of ordinary skill in the art based on the embodiments of the present invention without creative efforts are within the scope of the present invention.

The terms "first", "second", "third", and "fourth" and the like in the specification and claims of the present application are used to distinguish different objects, and are not intended to describe a particular order. Moreover, the terms "include" and "have" are not exclusive. For example, a process, method, system, product, or device that comprises a series of steps or units is not limited to the listed steps or units, and may include steps or units not listed.

FIG. 1 is a flowchart of a packet processing method according to a first embodiment of the present invention. As shown in FIG. 1, the method may include:

S102. The access device establishes at least one tunnel with the CGN device.

For example, the access device is a bridge between the broadband access network and the backbone network, providing basic access means and management functions of the broadband access network, and the access device is located at the edge of the network to provide broadband access services and implement The aggregation and forwarding of multiple services can meet the requirements of different users for transmission capacity and bandwidth utilization. Exemplarily, the access device may be a BRAS device; the basic function of the CGN device is to translate an internal private Internet Protocol (IP) address into a public network IP address; the access device and the CGN device may be tunneled. . In this way, the access device can establish at least one tunnel with the carrier-class network address translation CGN device, wherein each tunnel can carry data messages of multiple users. It should be noted that a tunnel can be established between the access device and the CGN device to support a large number of users. Of course, optional, access devices and More than one tunnel can be established between CGN devices. For example, two tunnels can be constructed. In this case, one tunnel can be used as the primary tunnel and the other as the standby tunnel to form the hot standby redundancy mechanism. The tunnels are all primary tunnels, and load sharing is performed on a large number of users.

S104. The access device receives the first data packet sent by the first user end.

For example, the access device can provide an access function for the UE and a management function for the broadband access network. Therefore, one side of the access device is used to connect multiple clients, so that the access device can receive the first data packet sent by the first user. The first data packet is not limited, and the first data packet may be a service request or a data stream that is sent by the UE to the server. For example, the first data packet may include an access network request message, a request message for accessing a certain web address or data, an upload data message, and the like.

S106: The access device acquires a first user address that is carried in the first data packet, and obtains a first user identifier corresponding to the first user end address according to a mapping relationship between the user address and the user identifier. The first data packet sent by the first user end is encapsulated by a general routing encapsulation protocol (GRE) to obtain a first GRE packet, where the first GRE packet carries the first user identifier.

For example, for each user end, there is a unique user identifier, and the user identifier is used to identify the user end, so that different user terminals can be distinguished by the user identifier. Optionally, the user identifier may be directly allocated by the operator to the client when the user opens the account. Correspondingly, a mapping relationship between the client address and the user identifier is established on the access device. Optionally, the client address may include an IP address of the client. The mapping relationship may be periodically updated by the operator or updated in real time. For example, a user terminal is added. When the user opens an account, the operator assigns a unique client identifier to the client. At the same time, the operator updates the user identifier to the mapping relationship of the access device in an updated manner. Therefore, after receiving the first data packet sent by the first user end, the access device acquires the first client address carried in the first data packet, and obtains and is based on the mapping relationship between the client address and the user identifier. The first user identifier corresponding to the first client address. Then, the first data packet sent by the first user end is GRE Encapsulation, the first GRE message is obtained. Among them, the GRE protocol is applicable to the encapsulation of IP datagrams tunneled through the Internet. GRE can be used as a Layer 3 tunneling protocol to provide transparent transmission channels for data of any protocol. The first GRE message carries the first user identifier. The first data packet is GRE-encapsulated, and the first GRE packet carries the first user identifier corresponding to the obtained first user address. In this embodiment, the specific location of the first user identifier in the first GRE packet is not limited. For example, the first user identifier may be located in the header of the GRE, or in the payload of the GRE packet, or in other locations of the GRE packet, as long as the first GRE packet carries the first user identifier. .

S108. The access device sends the first GRE packet to the CGN device by using the at least one tunnel.

For example, after completing the encapsulation of the first GRE packet, the access device may send the first GRE packet to the CGN device by using at least one tunnel. The first user identifier can be used to identify a unique user end, and a tunnel can allow multiple GRE packets to be shared. That is to say, a tunnel allows GRE packets of multiple users to be transmitted simultaneously or non-simultaneously. Since GRE packets carry user identifiers, multiple GRE packets are not confusing when a tunnel is used to transmit data.

In the packet processing method provided by the embodiment, the access device establishes at least one tunnel with the CGN device, and the access device enables the GRE packet to carry the user when receiving the data packet of the user end and performing GRE encapsulation. The user ID of the data packet is used to distinguish the data packets from different users by the user ID, and the multiple GRE packets are allowed to share the same tunnel. Therefore, when a large number of users access the network, the cost of the tunnel resources can be reduced and the configuration can be simplified. Process, save system overhead and network resources.

Optionally, the access device receives a second GRE packet sent by the CGN device by using the at least one tunnel, where the second GRE packet is sent by the CGN device to the second user end of the server. The second data message is obtained by the GRE encapsulation, and the second GRE message carries the second user identifier corresponding to the second user end.

For example, the access device may receive the first data packet from the first user end, and then send the packet to the CGN device after processing, if such data flow direction is referred to as an uplink direction. Correspondingly, the access device can also receive the second data packet from the server from the CGN device, and such data flow direction can be referred to as a downlink direction. The second data packet is not limited to the second data packet, and the second data packet may be a service request response packet or a data stream that is sent by the server to the client. Exemplarily, the second data packet may include an access network request response message, a request response message for accessing a certain web address or data, a download data message, and the like. The access device receives a second GRE message sent by the CGN device by using the at least one tunnel. The second GRE packet is obtained by GRE encapsulating the second data packet from the server by the CGN device. Correspondingly, the second GRE message carries a second user identifier corresponding to the second data packet. For the downlink direction, in order to allow a tunnel to carry GRE messages of multiple users, the same method as that provided by S106 in the first embodiment may be used, so that the GRE message carries the user identifier corresponding to the user end, thereby distinguishing according to the user identifier. Data packets to be sent to different clients. The access device decapsulates the second GRE packet, and obtains the second data packet, and sends the second data packet to the user end corresponding to the second data packet.

In addition, optionally, in the process of decapsulating the second GRE packet by the access device to obtain the second data packet, a verification method may be added. That is, the decapsulated second GRE packet is verified according to the mapping relationship between the client address and the user identifier established on the access device. The specific process is: the second GRE packet carries the second user identifier, and the access device obtains the corresponding second client address by using the second user identifier according to the mapping relationship between the user address and the user identifier established on the access device.

It should be noted that the “first data packet” and the “second data packet” in the embodiment are only used to distinguish the direction of the data stream, and the “first data packet” is used to represent the data flowing from the client to the server. Stream; use "second data message" to indicate the flow of data from the server to the client.

Optionally, the GRE header of the first GRE packet carries the first user identifier. Similarly, the GRE header of the second GRE message carries the second user identifier.

Optionally, in the above-mentioned first embodiment, the user identifier may be located in the GRE packet header, or in the payload of the GRE packet, or other location of the GRE packet. Further, for example, the user identifier may be located in a reserved field of the GRE header or an optional field of the GRE header. FIG. 2 shows a GRE header format in the prior art, FIG. 3 schematically shows a GRE header format in the embodiment of the present invention, and FIG. 4 schematically shows another embodiment of the present invention. GRE header format.

As shown in FIG. 2, the GRE header of the prior art includes a key field (Key Field) and has a length of 32 bits. The key field is used to perform end-to-end verification on the encapsulated packets. When the value of the "K" flag in the header is 1, the channel identification keyword (key Key, also called a keyword) is verified at both ends of the tunnel channel. Only when the identification keywords set at both ends of the tunnel are identical. To pass the authentication, otherwise the packet is discarded. As you can see, the key field provides a weak authentication mechanism. In addition, the GRE packet header further includes a recursive control field and a flag field, and the two fields may be set as a reserved field, and thus, by way of example, the reserved field may be used to carry the user identifier.

For example, the user identifier may be located in an optional field of the GRE packet header. Further, optionally, the key field may be used to carry the user identifier. As shown in FIG. 3, all the fields of the key field may be used to carry the user identifier to form a user identification field. Thus, the length of the user identification field is 32 bits, and the user identification field can be used to identify 2 ³² -1 users. This means that a tunnel can accommodate the first data packet of 2 ³² -1 clients, that is, the user identifier field of the GRE header carries different subscriber identifiers, allowing 2 ³² -1 users to use the same simultaneously. A tunnel, so a tunnel can meet the requirements of a large number of users, saving tunnel resources.

For example, as shown in FIG. 4, a part of a field of a key field may also be used to carry a user identifier to form a user identification field. For example, the user identifier can be carried by using 16 bits in the key field, so that the length of the user identification field is 16 bits, and the user identification field can be used to identify 2 ¹⁶ -1 users. This means that a tunnel can accommodate the first data packet of 2 ¹⁶ -1 clients, that is, the user identifier field of the GRE header carries different subscriber identifiers, allowing 2 ¹⁶ -1 users to use the same simultaneously. A tunnel, so a tunnel can meet the requirements of a large number of users, saving tunnel resources, and because the user identification field occupies part of the key field, the upper 16 bits of the key field can still remain. The weak authentication mechanism features.

It should be noted that the implementation shown in FIG. 4 is only a representation of using a partial field of the key field to carry the user identifier. It should be understood that the location occupied by the user identifier field in the key field is not limited, for example, The user identification field is located at the upper 16 bits. Meanwhile, the length occupied by the user identification field in the key field is not limited. For example, the user identification field occupies 24 bits or 8 bits.

For example, the manner in which the user identifier is carried by the key field can be used to share a tunnel with a maximum of 2 ³² -1 clients. Therefore, a tunnel can be established to meet the needs of a large number of users. Of course, optionally, more than one tunnel may be established between the access device and the CGN device. For example, the construction of two tunnels is used as an example. In this case, one tunnel can be used as the primary tunnel and the other as the standby tunnel to form a hot standby redundancy mechanism. The specific method for sharing the number of users in a plurality of tunnels is not limited. For example, the manner in which multiple tunnels share a large amount of users can be understood as: when a tunnel is fully loaded (for example, 2 ³² -1 users are carried) The second tunnel is used to carry the redundant users; or the number of users can be shared by multiple tunnels even if the number of users is not full; or there are multiple CGN devices, and at least one tunnel is established for each CGN device. For the implementation of the specific data packet, the first data packet can be determined to enter the tunnel of the different CGN by parsing the source address and the destination address of the first data packet.

Optionally, before the sending the first GRE packet by using the at least one tunnel, performing IPsec encapsulation on the first GRE packet.

For example, although there is a key field in the GRE header, a weak authentication mechanism is provided. However, from the perspective of its implementation mechanism, this weak authentication mechanism cannot be considered as a reliable encryption measure. In fact, during the interaction between the client and the server, some data streams, such as video and audio data, may need to be encrypted to ensure security. The IPsec encapsulation method can provide high quality and mutual access to IP datagrams by authenticating and encrypting each IP packet in the data stream. Operational, cryptographic-based security, so data streams that need to be encrypted can be encapsulated with IPsec to ensure data security. As shown in FIG. 5, before the GRE packet is sent through the tunnel, the GRE packet is encapsulated by IPsec, so that the data stream to be encrypted is encrypted by performing IPsec encapsulation on the outer layer of the GRE encapsulated packet. Encapsulation ensures data security.

In a typical implementation manner in which the solution of the embodiment of the present invention is not used, in the process of interacting between the client and the server, an independent GRE tunnel needs to be configured for each client. However, in the current network development, the integration of the network device is continuously The number of users is also increasing. In this way, in the face of a large number of users, if the above-mentioned common implementation is adopted, a large number of GRE tunnels need to be set up for support, which obviously increases the overhead of the tunnel resources, and the GRE tunnel is Static configuration, massive GRE tunnels greatly increase the configuration workload. In addition, GRE tunnels usually use keep-alive detection measures. For the GRE tunnels to start keep-alive detection, system overhead and network resources are inevitably increased. Therefore, the above implementation method has been implemented. Unable to meet the increasing demand for users.

In the technical solution provided by the embodiment of the present invention, the access device establishes at least one tunnel with the CGN device, and the access device carries the GRE packet when receiving the first data packet of the user end and performing GRE encapsulation. The user identifier corresponding to the first data packet of the user end is used to distinguish the first data packet from the different user terminals by using the user identifier, and the GRE packets of the multiple users are allowed to share the same tunnel, so that a large number of users can access the network. Reduces the overhead of tunnel resources, simplifies the configuration process, and saves system overhead and network resources.

FIG. 6 is a flowchart of a packet processing method according to a second embodiment of the present invention. The second embodiment of the present invention describes a packet processing method from the perspective of a CGN device. As shown in FIG. 6, the method is applied to a CGN device, the CGN device and the access device include at least one tunnel established by the access device; the method may include:

S602, the CGN device receives a GRE message sent by the access device by using the at least one tunnel, where the first GRE message is performed by the access device to the first data packet from the first user end. The first GRE message carries the first user end obtained by the GRE encapsulation Corresponding first user identifier.

For example, the function of the CGN device is to translate the internal private IP address into a public network IP address, and the CGN device receives the first GRE message sent by the access device through the at least one tunnel, where the first GRE The packet is obtained by GRE encapsulating the first data packet from the first user end by the access device, where the first GRE packet carries the first user identifier. For the execution process of the first GRE packet encapsulation and carrying the first user identifier, refer to the corresponding description in the first embodiment.

S604. The CGN device decapsulates the first GRE packet, and acquires the first data packet.

For example, the CGN device decapsulates the first GRE packet and obtains the first data packet. In addition, optionally, in the process of decapsulating the first GRE packet to obtain the first data packet, the CGN device may add a verification method, that is, according to the client address established on the CGN device. The first GRE packet is verified by the first user identifier, and the first GRE packet carries the first user identifier, and the CGN device obtains the first user identifier according to the mapping relationship. Corresponding the first client address, comparing the first client address obtained by the mapping relationship with the client address corresponding to the first data packet in the decapsulated first GRE packet, thereby verifying the first The data packet belongs to the first data packet sent by the first user.

S606. The CGN device sends the first data packet to a server.

For example, after acquiring the first data packet, the CGN device translates the internal private IP address into a public network IP address, and sends the first data packet to the server, and performs corresponding processing on the server according to the request of the first data packet. access. The CGN searches the NAT forward session table through the information of the quintuple (source IP address, destination IP address, source port number, destination port number, protocol number), and translates the IP address of the private network into a public network IP address.

In the packet processing method provided in this embodiment, the access device establishes at least one tunnel with the CGN device, and the GRE packet received by the CGN carries the user identifier, thereby allowing the GRE packets of multiple users to share the same tunnel. With this implementation, there can be a large number of users When entering the network, reduce the overhead of tunnel resources, simplify the configuration process, save system overhead and network resources.

Optionally, the CGN device receives a second data packet that is sent by the server to the second user end; the CGN device acquires an address of the second user end, and obtains a location according to a mapping relationship between the user end address and the user identifier. The second user identifier corresponding to the second user end, the second data packet is GRE-encapsulated to obtain a second GRE packet, and the second GRE packet carries the second user identifier; The CGN device sends the second GRE message to the access device by using the at least one tunnel.

For example, the CGN device receives the second data packet sent by the server. According to the foregoing, the second data packet is in the downlink data flow direction with respect to the first data packet, and the CGN passes the quintuple (source IP address, destination). The IP address, the source port number, the destination port number, and the protocol number are used to search the NAT reverse session table, and the public network IP address is translated into the IP address of the private network. The mapping relationship between the user address and the user identifier is established on the CGN device. Optionally, the client address may include an IP address, and the information of the mapping relationship may be updated by an operator cycle or in real time. According to the mapping relationship, the CGN device acquires the first user identifier corresponding to the first user end, and performs the GRE encapsulation on the second data packet to obtain a second GRE packet, where the second GRE packet carries The second user identifier is sent by the CGN device to the access device by using the at least one tunnel. For the specific process of encapsulating the second GRE packet, the second GRE packet carrying the second user identifier, and transmitting the data through the tunnel, refer to the corresponding description in the first embodiment. Similarly, the specific location of the second user identifier in the GRE packet is not limited, for example, it may be located in the GRE packet header, or in the packet payload, or other location, as long as the GRE report is guaranteed. This embodiment can be implemented by carrying a user identifier.

For the specific implementation of the GRE packet carrying the user identifier through the GRE header, refer to the corresponding description in the first embodiment, which has the same principle and technical effect, and is not performed here. Narration.

Optionally, before the sending the second GRE packet by using the at least one tunnel, performing IPsec encapsulation on the second GRE packet.

For example, the principles and implementations of the IPsec encapsulation of the GRE packets are described in the corresponding description in the first embodiment, which have the same principles and technical effects, and are not described herein again.

FIG. 7 is a flowchart of an application scenario according to an embodiment of the present invention. The application scenario flowchart may perform the packet processing method of the foregoing first embodiment and/or the second embodiment, as shown in FIG. The device includes: a service device, a layer 2 client-side device L2-CPE, an access device, a CGN device, and a server. Optionally, the access device may be a BRAS device, and the server may be an Internet network server. Specifically, the L2-CPE provides a basic Layer 2 forwarding function. The L2-CPE as the user end is connected to multiple specific service devices. The service device can be, but is not limited to, a personal computer, an intelligent mobile terminal, an IPTV, or an intelligent security device. The upstream of the L2-CPE is connected to the BRAS device through a communication network (for example, Metro Network), and the BRAS device shares the control plane functions (such as user management and data forwarding) of the traditional integrated CPE, so that the L2-CPE is hanged through the BRAS. The way to complete the management of the client, the BRAS device is connected to the CGN device through a communication network (for example, the core network Core Network), the BRAS device establishes at least one tunnel with the CGN device, and the CGN device connects to the Internet network. It should be noted that the L2-CPE shown in FIG. 7 is not limited, and a conventional CPE may also be used in practical applications.

As shown in FIG. 7, the flow direction of the data can be divided into an uplink process and a downlink process. The following describes different data flow directions. It should be noted that, in the present embodiment, without special description, The appearance of the Tunnel - equivalent to the user identity in the present invention.

For the upstream process.

S700. The BRAS device receives the first data packet sent by the user 1.

S702, the BRAS device acquires the Tunnel-1 corresponding to the user 1, and performs the GRE encapsulation on the first data packet to obtain the first GRE packet, where the first GRE packet carries the Tunnel-1;

The mapping between the client address and the tunnel is established on the BRAS device.

S704. The BRAS device sends the first GRE message by using the GRE tunnel.

S706. The CGN device receives the first GRE message by using the GRE tunnel.

S708. The CGN device decapsulates the first GRE packet, and obtains the first data packet.

S710. The CGN device sends the first data packet to the Internet.

For the downstream process.

S720: The CGN device receives the second data packet sent by the Internet.

S722, the CGN device acquires the Tunnel-2 corresponding to the user 2, and performs the GRE encapsulation on the second data packet to obtain the second GRE packet, where the second GRE packet carries the Tunnel-2;

The mapping between the client address and the tunnel is established on the CGN device.

S724. The CGN device sends a second GRE message by using a GRE tunnel.

S726. The BRAS device receives the second GRE message by using the GRE tunnel.

S728: The BRAS device decapsulates the second GRE packet, and obtains the second data packet.

S730. The BRAS device sends a second data packet to the user 2.

The BRAS device and the CGN device shown in FIG. 7 can be used to perform the respective steps performed by the access device and the CGN device in the method of the previous embodiment. The access device establishes at least one tunnel with the CGN device, so that the GRE packets of the multiple users are shared by the same tunnel, thereby reducing the overhead of the tunnel resource and simplifying the configuration process when a large number of users access the network. Save system overhead and network resources.

FIG. 8 is a schematic structural diagram of an access device according to an embodiment of the present invention. As shown in FIG. 8, the access device and the CGN device include at least one tunnel; the access device includes a first receiving unit 802, a processing unit 804, and First sending unit 806:

The first receiving unit 802 is configured to receive a first data packet sent by the first user end.

The processing unit 804 is configured to obtain an address of the first user end from the first data packet, and obtain a number corresponding to the first user end according to a mapping relationship between the user end address and the user identifier. a user identifier, the first data packet is GRE-encapsulated to obtain a first GRE packet, and the first GRE packet carries the first user identifier;

The first sending unit 806 is configured to send the first GRE message to the CGN device by using the at least one tunnel.

Optionally, the access device further includes a second receiving unit 808 and a second sending unit 810. The second receiving unit 808 is configured to receive a second GRE message that is sent by the CGN device by using the at least one tunnel, where the second GRE message is sent by the CGN device to the server to the second user end. The second data packet is obtained by GRE encapsulation, and the second GRE packet carries the second user identifier corresponding to the second user end. The processing unit 804 is further configured to decapsulate the second GRE report. And the second user identifier, the second data packet is obtained, and the second sending unit 810 is configured to send the second data packet to the second user end.

Optionally, the processing unit 804 is further configured to perform IPsec encapsulation on the first GRE packet before sending the first GRE packet by using the at least one tunnel.

The access device shown in Figure 8 can be used to perform the respective steps performed by the access device in the method of the previous embodiment. Between the access device and the CGN device, the at least one tunnel is configured to allow the GRE packets of the multiple users to share the same tunnel. Therefore, when a large number of users access the network, the bandwidth of the tunnel resources is reduced, and the configuration process is simplified. Save system overhead and network resources.

FIG. 9 is a schematic structural diagram of a hardware structure of an access device according to an embodiment of the present invention. As shown in FIG. 9, the access device includes a processor 901, a memory 902, an interface 903, and a bus 904. The interface 903 can be implemented by using a wireless or wired manner. Specifically, it may be an element such as a network interface card (NIC), and the processor 901, the memory 902, and the interface 903 are connected by a bus 904.

The memory 902 is configured to store program code. Optionally, the program code may include an operating system program and an application.

The interface 903 is configured to receive a first data packet sent by the first user end.

The processor 901 is configured to obtain an address of the first user end from the first data packet, and obtain a first user identifier corresponding to the first user end according to a mapping relationship between the user end address and the user identifier, The first data packet is GRE-encapsulated to obtain a first GRE packet, where the first GRE packet carries the first user identifier;

The interface 903 is further configured to send the first GRE message to the CGN device by using the at least one tunnel.

Optionally, the interface 903 is further configured to receive a second GRE message sent by the CGN device by using the at least one tunnel, where the second GRE message is sent by the CGN device to the server to the second The second data packet of the user end is obtained by GRE encapsulation, and the second GRE message carries the second user identifier corresponding to the second user end. The processor 901 is further configured to decapsulate the second user identifier. The GRE message and the second user identifier acquire the second data packet; the interface 903 is further configured to send the second data packet to the second user end.

Optionally, the processor 901 is further configured to perform IPsec encapsulation on the first GRE packet before sending the first GRE packet by using the at least one tunnel.

The access device shown in Figure 9 can be used to perform the corresponding steps performed by the access device in the method of the previous embodiment. Between the access device and the CGN device, the at least one tunnel is configured to allow the GRE packets of the multiple users to share the same tunnel. Therefore, when a large number of users access the network, the bandwidth of the tunnel resources is reduced, and the configuration process is simplified. Save system overhead and network resources.

10 is a schematic structural diagram of a CGN device according to an embodiment of the present invention. As shown in FIG. 10, the access device and the CGN device include at least one tunnel. The CGN device includes a first receiving unit 1002, a processing unit 1004, and a first Sending unit 1006:

The first receiving unit 1002 is configured to receive a first GRE message sent by the access device by using the at least one tunnel, where the first GRE message is sent by the access device from a first user end. The first data packet is obtained by GRE encapsulation, and the first GRE packet carries The first user identifier corresponding to the first user end;

The processing unit 1004 is configured to decapsulate the first GRE packet, and obtain the first data packet.

The first sending unit 1006 is configured to send the first data packet to a server.

Optionally, the CGN device further includes a second receiving unit, and further includes a second receiving unit 1008 and a second sending unit 1010. The second receiving unit 1008 is configured to receive a second data packet sent by the server to the second user end, where the processing unit 1004 is further configured to acquire, according to a mapping relationship between the user end address and the user identifier, a second user identifier corresponding to the second user end, the second data packet is GRE-encapsulated to obtain a second GRE packet, and the second GRE packet carries the second user identifier; the second sending The unit 1010 is configured to send the second GRE message to the access device by using the at least one tunnel.

Optionally, the processing unit 1004 is further configured to perform IPsec encapsulation on the second GRE packet before sending the second GRE packet by using the at least one tunnel.

The CGN device shown in Figure 10 can be used to perform the respective steps performed by the CGN device in the method of the previous embodiment. Between the access device and the CGN device, the at least one tunnel is configured to allow the GRE packets of the multiple users to share the same tunnel. Therefore, when a large number of users access the network, the bandwidth of the tunnel resources is reduced, and the configuration process is simplified. Save system overhead and network resources.

FIG. 11 is a schematic structural diagram of a hardware of a CGN device according to an embodiment of the present invention. As shown in FIG. 11, the access device includes a processor 1101, a memory 1102, an interface 1103, and a bus 1104. The interface 1103 can be implemented by using a wireless or a wired manner. For example, it may be an element such as a network interface card (NIC), and the processor 1101, the memory 1102, and the interface 1103 are connected by a bus 1104.

The memory 1102 is configured to store program code. Optionally, the program code may include an operating system program and an application.

The interface 1103 is configured to receive a first GRE packet sent by the access device by using the at least one tunnel, where the first GRE packet is used by the access device to the first data from the first user end. The first GRE packet carries the first user identifier corresponding to the first user end.

The processor 1101 is configured to decapsulate the first GRE packet, and obtain the first data packet.

The interface 1103 is further configured to send the first data packet to a server.

Optionally, the interface 1103 is configured to receive a second data packet that is sent by the server to the second user end, where the processor 1101 is further configured to obtain a location according to a mapping relationship between the user address and the user identifier. a second user identifier corresponding to the second user end, the second data packet is GRE-encapsulated to obtain a second GRE packet, and the second GRE packet carries the second user identifier; the interface 1103 And sending the second data packet to the second user end.

Optionally, the processor 1101 is further configured to perform IPsec encapsulation on the second GRE packet before sending the second GRE packet by using the at least one tunnel.

The CGN device shown in Figure 11 can be used to perform the respective steps performed by the CGN device in the method of the previous embodiment. Between the access device and the CGN device, the at least one tunnel is configured to allow the GRE packets of the multiple users to share the same tunnel. Therefore, when a large number of users access the network, the bandwidth of the tunnel resources is reduced, and the configuration process is simplified. Save system overhead and network resources.

FIG. 12 is a schematic structural diagram of a system according to an embodiment of the present invention. As shown in FIG. 12, the system includes an access device and a CGN device. The system can implement the technical solutions of the first embodiment and the second embodiment, and the implementation principles and technical effects are similar, and details are not described herein again.

Those of ordinary skill in the art will appreciate that various aspects of the present invention, or possible implementations of various aspects, may be embodied as a system, method, or computer program product. Thus, aspects of the invention, or possible implementations of various aspects, may be implemented in an entirely hardware embodiment. All software embodiments (including firmware, resident software, etc.), or a combination of software and hardware aspects, are collectively referred to herein as "circuits," "modules," or "systems." Furthermore, aspects of the invention, or possible implementations of various aspects, may take the form of a computer program product, which is a computer readable program code stored in a computer readable medium.

The computer readable medium can be a computer readable signal medium or a computer readable storage medium. The computer readable storage medium includes, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or device, or any suitable combination of the foregoing, such as a random access memory (English name: Random access memory, English abbreviation: RAM) ), read-only memory (English full name: Read-only memory, English abbreviation: ROM), erasable programmable read-only memory (English full name: Erasable programmable read only memory, English abbreviation: EPROM) or flash memory, Optical fiber, portable read-only memory (English full name: Compact disc read-only memory, English abbreviation: CD-ROM).

The processor in the computer reads the computer readable program code stored in the computer readable medium such that the processor is capable of performing the various functional steps specified in each step of the flowchart, or a combination of steps; A device that functions as specified in each block, or combination of blocks.

The computer readable program code can execute entirely on the user's local computer, partly on the user's local computer, as a separate software package, partly on the user's local computer and partly on the remote computer, or entirely on the remote computer or Executed on the server. It should also be noted that in some alternative implementations, the functions noted in the various steps in the flowcharts or in the blocks in the block diagrams may not occur in the order noted. For example, two steps, or two blocks, shown in succession may be executed substantially concurrently or the blocks may be executed in the reverse order.

It is apparent that those skilled in the art can make various modifications and variations to the invention without departing from the spirit and scope of the invention. Thus, it is intended that the present invention cover the modifications and modifications of the invention

Claims

A packet processing method, characterized in that the method comprises:

The access device establishes at least one tunnel between the carrier-class network address translation CGN device;

Receiving, by the access device, the first data packet sent by the first user end;

Obtaining, by the access device, the first user address carried in the first data packet, and acquiring a first user identifier corresponding to the address of the first user terminal according to a mapping relationship between the user address and the user identifier, The first data packet sent by the first user end is encapsulated by the Generic Routing Encapsulation Protocol (GRE) to obtain a first GRE packet, and the first GRE packet carries the first user identifier.

The access device sends the first GRE message to the CGN device by using the at least one tunnel.
The method of claim 1 further comprising:

The access device receives a second GRE message sent by the CGN device through the at least one tunnel, where the second GRE message is a second data packet sent by the CGN device to the server to the second user end. The second GRE packet carries the second user identifier corresponding to the second user end.

Decapsulating the second GRE packet by the access device to obtain the second data packet;

The access device sends the second data packet to the second user end.
The method according to claim 1 or 2, wherein the GRE header of the first GRE message carries the first user identifier.
The method according to any one of claims 1-3, wherein before the sending the first GRE message by using the at least one tunnel, the method further comprises: performing the first GRE message Internet Protocol Secure IPsec Protocol Encapsulation.
A packet processing method, the method is applied to a carrier-level network address translation CGN device, and the CGN device and the access device include at least one tunnel established by the access device; Methods include:

Receiving, by the CGN device, a first Generic Route Encapsulation Protocol (GRE) message sent by the access device by using the at least one tunnel, where the first GRE message is the first device from the first user end by the access device The data packet is encapsulated by the GRE, and the first GRE packet carries the first user identifier corresponding to the first user end.

Decapsulating the first GRE packet by the CGN device, and acquiring the first data packet;

The CGN device sends the first data packet to a server.
The method of claim 5, further comprising:

Receiving, by the CGN device, a second data packet sent by the server to the second user end;

Obtaining, by the CGN device, the address of the second user end, acquiring the second user identifier corresponding to the second user end according to the mapping relationship between the user end address and the user identifier, and performing the second data packet on the GRE Encapsulating, obtaining a second GRE packet, where the second GRE packet carries the second user identifier;

The CGN device sends the second GRE message to the access device by using the at least one tunnel.
The method according to claim 5 or 6, wherein the GRE header of the first GRE message carries the first user identifier.
The method according to claim 6 or 7, wherein before the sending the second GRE message through the at least one tunnel, the method further comprises: performing Internet Protocol Security IPsec on the second GRE message Protocol encapsulation.
An access device, where the access device includes at least one tunnel between the access device and the carrier-level network address translation CGN device; the access device includes:

a first receiving unit, configured to receive a first data packet sent by the first user end;

a processing unit, configured to acquire an address of the first user end from the first data packet, and acquire a first user identifier corresponding to the first user end according to a mapping relationship between the user end address and the user identifier, where the first The first GRE packet carries the first user identifier, and the first GRE packet carries the first user identifier.

The first sending unit is configured to send the first GRE message to the CGN device by using the at least one tunnel.
The access device according to claim 9, further comprising a second receiving unit and a second transmitting unit, wherein:

The second receiving unit is configured to receive a second GRE message that is sent by the CGN device by using the at least one tunnel, where the second GRE message is sent by the CGN device to the second user end of the server. The second data message is obtained by the GRE encapsulation, and the second GRE message carries the second user identifier corresponding to the second user end.

The processing unit is further configured to decapsulate the second GRE message and the second user identifier, and obtain the second data packet;

The second sending unit is configured to send the second data packet to the second user end.
The access device according to claim 9 or 10, wherein the GRE header of the first GRE message carries the first user identifier.
The access device according to any one of claims 9-11, wherein the processing unit is further configured to: before sending the first GRE message by using the at least one tunnel, A GRE message is encapsulated in the Internet Protocol Secure IPsec protocol.
A carrier-level network address translation CGN device, wherein the CGN device and the access device include at least one tunnel established by the access device; the CGN device includes:

a first receiving unit, configured to receive a first universal routing encapsulation protocol GRE packet sent by the access device by using the at least one tunnel, where the first GRE packet is sent by the access device from the first user The first data packet is obtained by the GRE encapsulation, and the first GRE packet carries the first user identifier corresponding to the first user end.

a processing unit, configured to decapsulate the first GRE packet, and obtain the first data packet;

The first sending unit is configured to send the first data packet to the server.
The CGN device of claim 13 further comprising a second receive a unit and a second sending unit, wherein

The second receiving unit is configured to receive a second data packet sent by the server to the second user end;

The processing unit is further configured to: obtain a second user identifier corresponding to the second user end according to the mapping relationship between the user address and the user identifier, and perform GRE encapsulation on the second data packet to obtain a second GRE. a packet, the second GRE packet carrying the second user identifier;

The second sending unit is configured to send the second GRE message to the access device by using the at least one tunnel.
The CGN device according to claim 13 or 14, wherein the GRE header of the first GRE message carries the first user identifier.
The CGN device according to claim 14 or 15, wherein the processing unit is further configured to perform the second GRE message before sending the second GRE message through the at least one tunnel Internet Protocol Secure IPsec Protocol Encapsulation.
A message processing system, comprising the access device according to any one of claims 9-12 and the CGN device according to any one of claims 13-16.