WO2017118413A1 - 一种检测报文的方法、装置和系统 - Google Patents

一种检测报文的方法、装置和系统 Download PDF

Info

Publication number
WO2017118413A1
WO2017118413A1 PCT/CN2017/070444 CN2017070444W WO2017118413A1 WO 2017118413 A1 WO2017118413 A1 WO 2017118413A1 CN 2017070444 W CN2017070444 W CN 2017070444W WO 2017118413 A1 WO2017118413 A1 WO 2017118413A1
Authority
WO
WIPO (PCT)
Prior art keywords
signature
packet
mirrored
uplink packet
downlink packet
Prior art date
Application number
PCT/CN2017/070444
Other languages
English (en)
French (fr)
Inventor
荆泉霖
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Publication of WO2017118413A1 publication Critical patent/WO2017118413A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/01—Protocols
    • H04L67/10—Protocols in which an application is distributed across nodes in the network
    • H04L67/1095—Replication or mirroring of data, e.g. scheduling or transport for data synchronisation between network nodes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0227—Filtering policies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L65/00—Network arrangements, protocols or services for supporting real-time applications in data packet communication
    • H04L65/40—Support for services or applications

Definitions

  • the present invention relates to the field of mobile communication and the Internet, and more particularly to a method, device and system for detecting a message.
  • a special packet in the network can be understood as a packet that is falsified by the intermediate network device to the information flowing through its own packet, or a packet sent by the intermediate network device according to the information in the packet flowing through itself. Due to their concealment, these messages are often difficult to detect and cannot be controlled.
  • the existing method for detecting special messages is usually to connect the detection devices in series in the network for detection.
  • the original network needs to be interrupted before the connection, which affects the user experience.
  • the present invention provides a method, device and system for detecting a message, which can detect when the original network is not interrupted, thereby improving the user experience.
  • the present invention provides a method for detecting a message, including:
  • the first device/the second device receives the mirrored first uplink packet/first downlink packet, calculates the signature of the mirrored first uplink packet/first downlink packet, and saves the mirrored first uplink packet. / correspondence between the flag information of the first downlink message and the calculated signature;
  • the second device/the first device receives the mirrored second uplink packet/second downlink packet, and calculates the signature of the mirrored second uplink packet/second downlink packet, and sends the identifier to the first device/second device. Calculating the second uplink packet/second downlink packet of the signature;
  • the first device/the second device obtains the flag information and the signature in the second uplink packet/second downlink packet that includes the calculated signature, searches for the signature corresponding to the obtained identifier information in the correspondence, and determines the found identifier.
  • the signature is the same as the obtained signature, and it is determined that the second uplink packet/second downlink packet is not a special packet.
  • the method also includes:
  • the first device/second device determines that the second uplink packet/second downlink packet is a special packet
  • the step of the first device/second device continuing to execute the signature corresponding to the flag information obtained by searching in the corresponding relationship after the first preset time.
  • the second uplink packet/second including the calculated signature Before the downlink message, it also includes:
  • the sending, by the first device/the second device, the second uplink packet/second downlink packet that includes the calculated signature includes:
  • the method further includes:
  • the first device/second device determines that the second uplink packet/second downlink packet is a non-multicast packet, and deletes the found signature and corresponding flag information.
  • the method further includes:
  • the found signature and the corresponding flag information are deleted after the second preset time.
  • the invention also proposes a method for detecting a message, comprising:
  • the fourth device/third device acquires the flag information and the signature in the first uplink packet/first downlink packet that includes the calculated signature, and saves the correspondence between the obtained identifier information and the signature;
  • the fourth device/third device receives the mirrored second uplink packet/second downlink packet, obtains the mirrored second uplink packet/second downlink packet, and calculates the mirrored second uplink packet.
  • the signature of the second downlink packet, and the signature corresponding to the flag information in the second uplink packet/second downlink packet in the mirrored relationship is determined in the correspondence, and the found signature and the mirrored second uplink packet are determined/
  • the signature of the second downlink packet is the same, and it is determined that the second uplink packet/second downlink packet is not a special packet.
  • the fourth device/third device does not find the signature corresponding to the flag information in the second uplink packet/second downlink packet in the corresponding relationship, or determines the searching
  • the method further includes:
  • the fourth device/third device determines that the second uplink packet/second downlink packet is a special packet
  • the fourth device/third device continues to perform the step of searching for the signature corresponding to the flag information in the mirrored second uplink packet/second downlink packet in the corresponding relationship after the first preset time.
  • the first uplink packet containing the calculated signature is sent to the fourth device/third device.
  • a downlink message it also includes:
  • the sending, by the fourth device/third device, the first uplink packet/first downlink packet that includes the calculated signature includes:
  • the method further includes:
  • the fourth device/third device determines that the second uplink packet/second downlink packet is a non-multicast packet, and deletes the found signature and corresponding flag information.
  • the method further includes:
  • the found signature and the corresponding flag information are deleted after the second preset time.
  • the invention also proposes a first device, which at least comprises:
  • the first receiving module is configured to receive the mirrored first uplink packet, receive the second uplink packet from the second device that includes the calculated signature, and receive the mirrored second downlink packet.
  • the first signature module is configured to calculate a signature of the mirrored first uplink packet, and save a correspondence between the mirrored first uplink packet identifier information and the calculated signature; and calculate the mirrored second downlink packet signature. ;
  • the first check module is configured to obtain the identifier information and the signature of the second uplink packet that includes the calculated signature, and search for the signature corresponding to the obtained identifier information in the correspondence relationship, and determine that the found signature is the same as the obtained signature. Determining that the second uplink packet is not a special packet;
  • the first sending module is configured to send, to the second device, a second downlink packet that includes the calculated signature.
  • the first verification module is further configured to:
  • the first sending module is specifically configured to:
  • the second device corresponding to the network segment of the source IP address or the network segment where the destination IP address is obtained, and the second device that includes the calculated signature is sent to the second device that is found.
  • the invention also proposes a second device, which at least comprises:
  • the second receiving module is configured to receive the mirrored first downlink packet, receive the second downlink packet that is the calculated signature from the first device, and receive the mirrored second uplink packet.
  • a second signature module configured to calculate a signature of the first downlink packet, and save a correspondence between the flag information of the mirrored first downlink packet and the calculated signature; and calculate the second uplink packet of the mirroring Signature
  • a second check module configured to obtain the flag information and the signature of the second downlink packet that includes the calculated signature, and search for the signature corresponding to the obtained flag information in the correspondence relationship, and determine that the found signature is the same as the obtained signature Determining that the second downlink message is not a special message;
  • the second sending module is configured to send, to the first device, a second uplink packet that includes the calculated signature.
  • the second verification module is further configured to:
  • the second sending module is specifically configured to:
  • the first device corresponding to the destination IP address network segment where the source IP address is obtained or the destination IP address is obtained; and the second uplink packet that includes the calculated signature is sent to the first device that is found.
  • the invention also proposes a third device, which at least comprises:
  • a third receiving module configured to receive the mirrored first uplink packet, receive the first downlink packet that includes the calculated signature from the fourth device, and receive the mirrored second downlink packet;
  • a third signature module configured to calculate a signature of the first uplink packet that is mirrored; obtain the flag information and the signature in the first downlink packet that is calculated, and save the correspondence between the obtained identifier information and the signature; The flag information in the mirrored second downlink packet, and the signature of the mirrored second downlink packet is calculated;
  • a third sending module configured to send, to the fourth device, a first uplink packet that includes the calculated signature
  • the third check module is configured to search for a signature corresponding to the flag information in the mirrored second downlink packet in the corresponding relationship, and determine that the signature of the found signature and the mirrored second downlink packet are the same, and the second downlink is determined.
  • the message is not a special message.
  • the third verification module is further configured to:
  • the second downlink packet is a special packet; or, after the first preset time, the step of searching for the signature corresponding to the flag information in the mirrored second downlink packet in the corresponding relationship is performed.
  • the third sending module is specifically configured to:
  • the source Internet Protocol IP address or the destination IP address of the first uplink packet Obtaining the source Internet Protocol IP address or the destination IP address of the first uplink packet, and searching for the source IP address obtained in the correspondence between the network segment of the source IP address or the network segment of the destination IP address and the fourth device. And the fourth device corresponding to the destination IP address network segment where the destination IP address is located, and the first uplink packet that includes the calculated signature is sent to the found fourth device.
  • the invention also proposes a fourth device, which at least comprises:
  • a fourth receiving module configured to receive the mirrored first downlink packet; and receive the included device from the third device The first uplink packet of the obtained signature; the second uplink packet that receives the mirroring;
  • a fourth signature module configured to calculate a signature of the first downlink packet that is mirrored, obtain the flag information and the signature in the first uplink packet that is calculated, and save the correspondence between the obtained identifier information and the signature; The flag information in the mirrored second uplink packet, and the signature of the mirrored second uplink packet is calculated;
  • a fourth sending module configured to send, to the third device, a first downlink packet that includes the calculated signature
  • the fourth check module is configured to search for a signature corresponding to the flag information in the mirrored second uplink packet in the corresponding relationship, and determine that the signature of the found signature and the mirrored second uplink packet are the same, and determine the second uplink.
  • the message is not a special message.
  • the fourth verification module is further configured to:
  • the second uplink packet is a special packet; or, after the first preset time, the step of searching for the signature corresponding to the flag information in the mirrored second uplink packet in the corresponding relationship is performed.
  • the fourth sending module is specifically configured to:
  • the third device corresponding to the destination IP address network segment where the source IP address is located or the destination IP address is obtained; and the first downlink packet that includes the calculated signature is sent to the found third device.
  • the invention also provides a system for detecting a message, comprising at least:
  • the first device is configured to receive the mirrored first uplink packet, calculate a signature of the mirrored first uplink packet, and save a correspondence between the mirrored first uplink packet identifier information and the calculated signature; And the signature information and the signature in the second uplink packet, where the calculated signature is included, and the signature corresponding to the obtained identifier information is searched in the corresponding relationship, and the found signature is determined to be the same as the obtained signature, and the second uplink packet is determined not to be a special packet; the second downlink packet that is mirrored is received, the signature of the mirrored second downlink packet is calculated, and the second downlink packet that includes the calculated signature is sent to the second device;
  • the second device is configured to receive the mirrored first downlink packet, calculate the signature of the mirrored first downlink packet, and save the correspondence between the mirrored first downlink packet identifier information and the calculated signature.
  • the second uplink packet of the mirrored image is received, the signature of the second uplink packet is calculated, the second uplink packet that includes the calculated signature is sent to the first device, and the second downlink that includes the calculated signature is obtained.
  • the flag information and the signature in the packet are searched for the signature corresponding to the obtained flag information in the corresponding relationship, and it is determined that the found signature is the same as the obtained signature, and it is determined that the second downlink packet is not a special packet.
  • the first device/second device is further configured to:
  • the invention also provides a system for detecting a message, comprising at least:
  • the third device is configured to receive the mirrored first uplink packet, calculate the signature of the mirrored first uplink packet, and send the first uplink packet that includes the calculated signature to the fourth device, and obtain the calculated signature.
  • the flag information and the signature in the first downlink packet, and the correspondence between the obtained flag information and the signature is saved; the second downlink packet that is mirrored is obtained, and the flag information in the mirrored second downlink packet is obtained.
  • the signature of the mirrored second downlink packet is calculated, and the signature corresponding to the flag information in the mirrored second downlink packet is searched for in the corresponding relationship, and the signature of the found signature and the mirrored second downlink packet are determined to be the same.
  • the second downlink packet is not a special packet;
  • the fourth device is configured to receive the mirrored first downlink packet, calculate the signature of the mirrored first downlink packet, and send the first downlink packet that includes the calculated signature to the third device; Obtaining the flag information and the signature in the first uplink packet of the signature, and storing the correspondence between the obtained identifier information and the signature; receiving the mirrored second uplink packet, and obtaining the flag in the mirrored second uplink packet.
  • the information is used to calculate the signature of the second uplink packet in the mirrored image, and the signature corresponding to the flag information in the mirrored second uplink packet is searched in the corresponding relationship, and the signature of the second signature packet is the same as that of the mirrored second uplink packet. And determining that the second uplink packet is not a special packet.
  • the third device/fourth device is further configured to:
  • the signature corresponding to the flag information in the second uplink packet/second downlink packet is not found in the corresponding relationship, or the found signature and the second uplink packet/second are determined.
  • the signature of the downlink packet is different, and the second uplink packet/second downlink packet is determined to be a special packet; or, after the first preset time, the second uplink of the mirrored image is searched for in the corresponding relationship.
  • the step of signing corresponding to the flag information in the message/second downlink message is not found in the corresponding relationship, or the found signature and the second uplink packet/second are determined.
  • the signature of the downlink packet is different, and the second uplink packet/second downlink packet is determined to be a special packet; or, after the first preset time, the second uplink of the mirrored image is searched for in the corresponding relationship.
  • the technical solution of the present invention includes: the first device/the second device receives the mirrored first uplink packet/first downlink packet, and calculates the mirrored first uplink packet/first downlink
  • the signature of the line message saves the correspondence between the mirrored first uplink packet/first downlink packet identifier information and the calculated signature; the second device/first device receives the mirrored second uplink packet.
  • a second downlink packet/second downlink packet, and a second uplink packet/second downlink packet that includes the calculated signature is sent to the first device/second device.
  • the first device/the second device obtains the flag information and the signature in the second uplink packet/second downlink packet that includes the calculated signature, searches for the signature corresponding to the obtained identifier information in the correspondence, and determines the search.
  • the obtained signature is the same as the obtained signature, and it is determined that the second uplink packet/second downlink packet is not a special packet.
  • the device of the present invention detects the uplink packet/downlink packet mirrored by the intermediate network device by using the first device/second device and the second device/first device, without interrupting the original network, thereby improving the user. Experience.
  • FIG. 1 is a flowchart of a method for detecting a special message according to the present invention
  • FIG. 2 is a schematic diagram of separately setting devices at an entrance and an exit of an intermediate network device according to the present invention
  • FIG. 3 is a schematic diagram of another apparatus for setting an inlet and an outlet of an intermediate network device according to the present invention.
  • Figure 5 is a schematic structural view of the first device of the present invention.
  • FIG. 6 is a schematic structural view of a second device of the present invention.
  • Figure 7 is a schematic structural view of a third device of the present invention.
  • FIG. 8 is a schematic structural view of a fourth device of the present invention.
  • FIG. 9 is a schematic structural diagram of a system for detecting a message according to the present invention.
  • FIG. 10 is a schematic structural diagram of another system for detecting a message according to the present invention.
  • the present invention provides a method for detecting a message, where a first device and a second device are respectively set at an entrance and an exit of an intermediate network device.
  • FIG. 2 is a schematic diagram of separately setting devices at the entrance and exit of the intermediate network device.
  • the terminal communicates between the intermediate network device and the Internet (Internet).
  • Internet the Internet
  • the intermediate network device has only one entry and one exit, only one first device (ie, device 1) and the second device (ie, device 2) need to be respectively set at the entrance and the exit.
  • Figure 3 is a schematic diagram of another apparatus for setting the inlet and outlet of an intermediate network device, respectively.
  • the terminal 1 and the terminal 2 communicate between the intermediate network device and the Internet.
  • the intermediate network device has multiple entries and/or multiple outlets, it is required to separately set a plurality of first devices (ie, device 1 and device 2) and/or multiple second devices (ie, devices 3 and devices) at the ingress and the egress. 4).
  • the method includes:
  • Step 100 The first device/second device receives the mirrored first uplink packet/first downlink packet, and calculates the signature of the mirrored first uplink packet/first downlink packet, and saves the first image. Correspondence between the flag information of the uplink packet/first downlink packet and the calculated signature.
  • the first device/second device may adopt an existing algorithm, such as a key-related hash operation.
  • HMS Hash-based Message Authentication Code
  • MD5 Message Digest Algorithm 5
  • the signature of the eigenvalue of the first uplink packet/first downlink packet is calculated.
  • the eigenvalue of the mirrored first uplink packet/first downlink packet refers to the mirrored number.
  • the content that does not change when an uplink packet/first downlink packet is transmitted in the network such as destination IP address + payload, source IP address + payload, and the like.
  • the identifier information includes one or more of the following: an source Internet Protocol (IP) address, a destination IP address, a protocol number, a source port number, a destination port number, an identifier field, a fragment tag bit, and a minute. Slice offset, etc.
  • IP Internet Protocol
  • the flag information must at least be able to uniquely identify the message.
  • Step 101 The second device/the first device receives the mirrored second uplink packet/second downlink packet, and calculates the signature of the mirrored second uplink packet/second downlink packet to the first device/second The device sends a second uplink packet/second downlink packet that includes the calculated signature.
  • the second device/the first device may use the existing algorithm, such as the HMAC-MD5, to calculate the signature of the second uplink packet/second downlink packet, which is known to those skilled in the art. It is not intended to limit the scope of the present invention, and is not described herein again.
  • the existing algorithm such as the HMAC-MD5
  • the signature of the eigenvalue of the second uplink packet/second downlink packet is generally calculated, and the eigenvalue of the mirrored second uplink packet/second downlink packet refers to the second uplink of the mirror.
  • the content that the packet/second downlink packet does not change when it is transmitted in the network such as destination IP address + payload, source IP address + payload, and so on.
  • the second uplink packet/second downlink packet that includes the calculated signature is the same as the other information of the second uplink packet/second downlink packet, and is only in the second uplink packet/second.
  • the downlink message carries the signature.
  • the signature may be set at the end of the payload field of the second uplink packet/second downlink packet, or the option field, or the AH header commonly used by IPSec (IP Security) and the Identification field of the IP header.
  • IPSec IP Security
  • the second uplink packet/second downlink packet with the calculated signature is sent to the first device/second device
  • the second uplink packet/second downlink packet is sent to the first device/second device. Also includes:
  • Sending the second uplink packet/second downlink packet that includes the calculated signature to the first device/second device includes: sending, to the found first device/second device, the second uplink report that includes the calculated signature Text / second downlink message.
  • Step 102 The first device/second device acquires the flag information and the signature in the second uplink packet/second downlink packet that includes the calculated signature, and searches for the signature corresponding to the obtained identifier information in the corresponding relationship, and determines that The found signature is the same as the obtained signature, and it is determined that the second uplink packet/second downlink packet is not a special packet.
  • the first device/second device determines The second uplink packet/second downlink packet is a special packet; or the step of the ingress device continuing to perform the signature corresponding to the identifier information obtained by searching in the corresponding relationship after the first preset time.
  • the ingress device may perform an alarm and/or output the second uplink packet/second downlink packet.
  • the well-known technology of the person is not intended to limit the scope of protection of the present invention, and details are not described herein again.
  • the device of the present invention detects the uplink packet/downlink packet mirrored by the intermediate network device by using the first device/second device and the second device/first device, without interrupting the original network, thereby improving the user.
  • the device of the present invention detects the uplink packet/downlink packet mirrored by the intermediate network device by using the first device/second device and the second device/first device, without interrupting the original network, thereby improving the user.
  • the device of the present invention detects the uplink packet/downlink packet mirrored by the intermediate network device by using the first device/second device and the second device/first device, without interrupting the original network, thereby improving the user.
  • the device of the present invention detects the uplink packet/downlink packet mirrored by the intermediate network device by using the first device/second device and the second device/first device, without interrupting the original network, thereby improving the user.
  • the first device/second device and the second device/first device without interrupting the original network
  • the method further includes:
  • the first device/second device determines that the second uplink packet/second downlink packet is a non-multicast packet, and deletes the found signature and the corresponding flag information.
  • the searched signature and the corresponding flag information are deleted after the second preset time.
  • the present invention also provides a method for detecting a message, where a third device and a fourth device are respectively set at an entrance and an exit of the intermediate network device.
  • the terminal communicates between the intermediate network device and the Internet (Internet).
  • the intermediate network device has only one entry and one exit, it is only necessary to separately set a third device (ie, device 1) and a fourth device (ie, device 2) at the entrance and the exit.
  • the terminal 1 and the terminal 2 communicate between the intermediate network device and the Internet.
  • the intermediate network device has multiple entries and/or multiple outlets, it is required to separately set a plurality of third devices (ie, device 1 and device 2) and/or multiple fourth devices (ie, devices 3 and devices) at the ingress and the outlet. 4).
  • the method includes:
  • Step 400 The third device/fourth device receives the mirrored first uplink packet/first downlink packet, and calculates the signature of the mirrored first uplink packet/first downlink packet to the fourth device/ The third device sends the first uplink packet/first downlink packet that includes the calculated signature.
  • the third device/fourth device can use the existing algorithm, such as the HMAC-MD5, to calculate the signature of the first uplink packet/first downlink packet, which is a well-known technology of the person skilled in the art. It is not intended to limit the scope of protection of the present invention, and is not described herein again.
  • the existing algorithm such as the HMAC-MD5
  • the signature of the eigenvalue of the first uplink packet/first downlink packet is calculated.
  • the eigenvalue of the mirrored first uplink packet/first downlink packet refers to the mirrored number.
  • the content that does not change when an uplink packet/first downlink packet is transmitted in the network such as destination IP address + payload, source IP address + payload, and the like.
  • the first uplink packet/first downlink packet including the calculated signature is sent to the fourth device/third device.
  • the text also includes:
  • the fourth device/third device corresponding to the source IP address network segment where the source IP address is obtained or the destination IP address segment where the destination IP address is obtained is obtained.
  • Sending the first uplink packet/first downlink packet that includes the calculated signature to the fourth device/third device includes: sending, to the found fourth device/third device, the first uplink that includes the calculated signature Message/first downlink message.
  • Step 401 The fourth device/third device acquires the flag information and the signature in the first uplink packet/first downlink packet that includes the calculated signature, and saves the correspondence between the obtained identifier information and the signature.
  • the identifier information includes one or more of the following: a source IP address, a destination IP address, a protocol number, a source port number, a destination port number, an identifier field, a fragment tag bit, and a fragment offset.
  • Step 402 The fourth device/third device receives the mirrored second uplink packet/second downlink packet, obtains the flag information in the mirrored second uplink packet/second downlink packet, and calculates the second mirror image.
  • the signature of the uplink packet/second downlink packet, and the signature corresponding to the flag information in the mirrored second uplink packet/second downlink packet is searched in the corresponding relationship, and the found signature and the mirrored second uplink are determined.
  • the signature of the packet/second downlink packet is the same, and it is determined that the second uplink packet/second downlink packet is not a special packet.
  • the fourth device/third device when the fourth device/third device does not find the signature corresponding to the flag information in the second uplink packet/second downlink packet in the corresponding relationship, or determines the found signature and the second uplink report.
  • the fourth device/third device determines that the second uplink packet/second downlink packet is a special packet; or the egress device continues to execute after the first preset time.
  • the method further includes:
  • the fourth device/third device determines that the second uplink packet/second downlink packet is a non-multicast packet, and deletes the found signature and the corresponding flag information.
  • the fourth device/third device determines that the second uplink packet/second downlink packet is a multicast packet, the found signature and the corresponding flag information are deleted after the second preset time.
  • the intermediate network device when the terminal sends the first uplink packet to the Internet through the intermediate network device, the intermediate network device mirrors the first uplink packet to the device 1 at the ingress, and the first uplink packet is transmitted to the middle.
  • the egress of the network device becomes the second uplink packet.
  • the second uplink packet may be the same as the first uplink packet, and may be different.
  • the intermediate network device mirrors the second uplink packet to the device 2 at the egress.
  • the device 1 receives the mirrored first uplink packet, calculates the signature of the mirrored first uplink packet, and saves the correspondence between the mirrored first uplink packet identifier information and the calculated signature.
  • the device 2 receives the mirrored second uplink packet, calculates the signature of the mirrored second uplink packet, and sends the second uplink packet that includes the calculated signature to the device 1;
  • the device 1 obtains the flag information and the signature in the second uplink packet that includes the calculated signature, searches for the signature corresponding to the obtained flag information in the corresponding relationship, determines that the found signature is the same as the obtained signature, and determines the second uplink.
  • the message is not a special message.
  • the device 1 determines that the second uplink packet is a special packet
  • the device 1 continues to perform the step of searching for the signature corresponding to the obtained flag information in the corresponding relationship after the first preset time.
  • the intermediate network device When the Internet sends the first downlink packet to the terminal through the intermediate network device, the intermediate network device mirrors the first downlink packet to the device 2 at the ingress, and the first downlink packet is transmitted to the egress of the intermediate network device.
  • the second downlink packet may be the same as the first downlink packet, and may be different.
  • the first downlink packet is tampered with by the intermediate network device, the second downlink packet is the first downlink packet.
  • the intermediate network device mirrors the second downlink packet to the device 1 at the egress.
  • the device 2 receives the mirrored first downlink packet, calculates the signature of the mirrored first downlink packet, and saves the correspondence between the mirrored first downlink packet identifier information and the calculated signature.
  • the device 1 receives the mirrored second downlink packet, calculates the signature of the mirrored second downlink packet, and sends the second downlink packet that includes the calculated signature to the device 2;
  • the device 2 obtains the flag information and the signature in the second downlink packet that includes the calculated signature, searches for the signature corresponding to the obtained flag information in the corresponding relationship, determines that the found signature is the same as the obtained signature, and determines the second downlink.
  • the message is not a special message.
  • the device 2 determines that the second downlink packet is a special packet
  • the device 2 continues to perform the step of searching for the signature corresponding to the obtained flag information in the corresponding relationship after the first preset time.
  • the intermediate network device when the terminal 1/terminal 2 sends the first uplink packet to the Internet through the intermediate network device, the intermediate network device mirrors the first uplink packet to the device 1/device 2 at the ingress.
  • One up The packet is transmitted to the egress of the intermediate network device and becomes the second uplink packet.
  • the second uplink packet may be the same as the first uplink packet, or may be different.
  • the second uplink packet is different from the first uplink packet, and the intermediate network device mirrors the second uplink packet to the device 3 or the device 4 at the egress.
  • the device 1/device 2 receives the mirrored first uplink packet, calculates the signature of the mirrored first uplink packet, and saves the correspondence between the mirrored first uplink packet identifier information and the calculated signature.
  • the device 3 or the device 4 receives the mirrored second uplink packet, calculates the signature of the mirrored second uplink packet, and obtains the source IP address of the second uplink packet, between the preset source IP address network segment and the device. In the corresponding relationship, find the device corresponding to the source IP address network segment where the source IP address is obtained (or obtain the destination IP address of the second uplink packet, and the corresponding destination IP address between the network segment and the device) In the relationship, the device corresponding to the network segment of the destination IP address where the destination IP address is obtained is searched. If the device is the device 1/device 2, the second uplink report containing the calculated signature is sent to the device 1/device 2. Text
  • the device 1/device 2 obtains the flag information and the signature in the second uplink packet that includes the calculated signature, searches for the signature corresponding to the obtained flag information in the corresponding relationship, and determines that the found signature and the obtained signature are the same, and determine The second uplink packet is not a special packet.
  • the device 1/device 2 determines that the second uplink packet is a special report.
  • the device 1/device 2 continues to perform the step of searching for the signature corresponding to the obtained flag information in the corresponding relationship after the first preset time.
  • the intermediate network device When the Internet sends the first downlink packet to the terminal 1/terminal 2 through the intermediate network device, the intermediate network device mirrors the first downlink packet to the device 3 or the device 4 at the ingress, and the first downlink packet is transmitted to the device.
  • the egress of the intermediate network device becomes the second downlink packet.
  • the second downlink packet may be the same as the first downlink packet, or may be different.
  • the first downlink packet is tampered with by the intermediate network device, the second packet is second.
  • the downlink packet is different from the first downlink packet.
  • the intermediate network device mirrors the second downlink packet to the device 1/device 2 at the egress.
  • the device 3 or the device 4 receives the mirrored first downlink packet, calculates the signature of the mirrored first downlink packet, and saves the correspondence between the mirrored first downlink packet identifier information and the calculated signature. ;
  • the device 1/device 2 receives the mirrored second downlink packet, calculates the signature of the mirrored second downlink packet, and obtains the destination IP address of the second downlink packet, between the preset destination IP address network segment and the device. In the corresponding relationship, the device corresponding to the network segment of the destination IP address where the obtained destination IP address is located is searched. If the device that is found is device 3 or device 4, the second downlink containing the calculated signature is sent to device 3 or device 4. Message
  • the device 3 or the device 4 obtains the flag information and the signature in the second downlink packet that includes the calculated signature, searches for the signature corresponding to the obtained flag information in the correspondence, determines that the found signature is the same as the obtained signature, and determines The second downlink message is not a special message.
  • the device 3 or the device 4 determines that the second downlink packet is a special report.
  • the device 3 or the device 4 continues to perform the search for the obtained flag in the corresponding relationship after the first preset time.
  • the step of signing the information is a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, a simple operation, or the device 4 continues to perform the search for the obtained flag in the corresponding relationship after the first preset time. The step of signing the information.
  • the intermediate network device when the terminal sends the first uplink packet to the Internet through the intermediate network device, the intermediate network device mirrors the first uplink packet to the device 1 at the ingress, and the first uplink packet is transmitted to the middle.
  • the egress of the network device becomes the second uplink packet.
  • the second uplink packet may be the same as the first uplink packet, and may be different.
  • the intermediate network device mirrors the second uplink packet to the device 2 at the egress.
  • the device 1 receives the mirrored first uplink packet, calculates the signature of the mirrored first uplink packet, and sends the first uplink packet including the calculated signature to the device 2;
  • the device 2 obtains the flag information and the signature in the first uplink packet that includes the calculated signature, and saves the correspondence between the obtained identifier information and the signature.
  • the device 2 receives the mirrored second uplink packet, obtains the flag information in the mirrored second uplink packet, calculates the signature of the mirrored second uplink packet, and searches for the signature corresponding to the obtained flag information in the corresponding relationship, and determines The found signature is the same as the obtained signature, and it is determined that the second uplink packet is not a special packet.
  • the device 2 determines that the second uplink packet is a special packet
  • the device 2 continues to perform the step of searching for the signature corresponding to the obtained flag information in the corresponding relationship after the first preset time.
  • the intermediate network device When the Internet sends the first downlink packet to the terminal through the intermediate network device, the intermediate network device mirrors the first downlink packet to the device 2 at the ingress, and the first downlink packet is transmitted to the egress of the intermediate network device.
  • the second downlink packet may be the same as the first downlink packet, and may be different.
  • the first downlink packet is tampered with by the intermediate network device, the second downlink packet is the first downlink packet.
  • the intermediate network device mirrors the second downlink packet to the device 1 at the egress.
  • the device 2 receives the mirrored first downlink packet, calculates the signature of the mirrored first downlink packet, and sends the first downlink packet that includes the calculated signature to the device 1;
  • the device 1 obtains the flag information and the signature in the first downlink packet that includes the calculated signature, and saves the correspondence between the obtained identifier information and the signature.
  • the device 1 receives the mirrored second downlink packet, obtains the flag information in the mirrored second downlink packet, calculates the signature of the mirrored second downlink packet, and searches for the signature corresponding to the obtained flag information in the corresponding relationship, and determines The found signature is the same as the obtained signature, and it is determined that the second downlink packet is not a special packet.
  • the device 1 determines that the second downlink packet is a special packet
  • the device 1 continues to perform the step of searching for the signature corresponding to the obtained flag information in the corresponding relationship after the first preset time.
  • the intermediate network device when the terminal 1/terminal 2 sends the first uplink packet to the Internet through the intermediate network device, the intermediate network device mirrors the first uplink packet to the device 1/device 2 at the ingress.
  • One up The packet is transmitted to the egress of the intermediate network device and becomes the second uplink packet.
  • the second uplink packet may be the same as the first uplink packet, or may be different.
  • the second uplink packet is different from the first uplink packet, and the intermediate network device mirrors the second uplink packet to the device 3 or the device 4 at the egress.
  • the device 1/device 2 receives the mirrored first uplink packet, calculates the signature of the mirrored first uplink packet, and obtains the source IP address of the first uplink packet, between the preset source IP address network segment and the device. In the corresponding relationship, find the device corresponding to the source IP address network segment where the source IP address is obtained (or obtain the destination IP address of the first uplink packet, and set the mapping between the pre-set destination IP address network segment and the device. The device corresponding to the network segment of the destination IP address where the destination IP address is obtained. If the device is the device 3 or device 4, the device sends the first uplink packet containing the calculated signature to the device 3 or device 4.
  • the device 3 or the device 4 obtains the flag information and the signature in the first uplink packet that includes the calculated signature, and saves the correspondence between the obtained flag information and the signature.
  • the device 3 or the device 4 receives the mirrored second uplink packet, obtains the flag information in the mirrored second uplink packet, calculates the signature of the mirrored second uplink packet, and searches for the mirrored second uplink packet in the corresponding relationship.
  • the signature corresponding to the flag information in the text is determined to be the same as the signature of the second uplink packet of the mirrored image, and it is determined that the second uplink packet is not a special packet.
  • the device 3 or the device 4 determines that the second uplink packet is a special packet.
  • the device 3 or the device 4 continues to perform the step of searching for the signature corresponding to the flag information in the mirrored second uplink packet in the corresponding relationship after the first preset time.
  • the intermediate network device When the Internet sends the first downlink packet to the terminal 1/terminal 2 through the intermediate network device, the intermediate network device mirrors the first downlink packet to the device 3 or the device 4 at the ingress, and the first downlink packet is transmitted to the device.
  • the egress of the intermediate network device becomes the second downlink packet.
  • the second downlink packet may be the same as the first downlink packet, or may be different.
  • the first downlink packet is tampered with by the intermediate network device, the second packet is second.
  • the downlink packet is different from the first downlink packet.
  • the intermediate network device mirrors the second downlink packet to the device 1/device 2 at the egress.
  • the device 3 or the device 4 receives the mirrored first downlink packet, calculates the signature of the mirrored first downlink packet, and obtains the destination IP address of the first downlink packet, in the preset destination IP address network segment and The device corresponding to the network segment of the destination IP address where the obtained destination IP address is located is found in the mapping between the devices. If the device is the device 1/device 2, the device containing the calculated signature is sent to device 1/device 2. A downlink message.
  • the device 1/device 2 acquires the flag information and the signature in the first downlink packet that includes the calculated signature, and saves the correspondence between the obtained flag information and the signature.
  • the device 1/device 2 receives the mirrored second downlink packet, obtains the flag information in the mirrored second downlink packet, calculates the signature of the mirrored second downlink packet, and searches for the mirrored second downlink packet in the corresponding relationship.
  • the signature corresponding to the flag information in the text determines that the signature of the found signature is the same as the signature of the mirrored second downlink packet, and determines that the second downlink packet is not a special packet.
  • Device 1/device 2 determines that the second downlink packet is a special packet
  • the device 1/device 2 continues to perform the step of searching for the signature corresponding to the flag information in the mirrored second downlink message in the corresponding relationship after the first preset time.
  • the present invention provides a first device, including at least:
  • the first receiving module is configured to receive the mirrored first uplink packet, receive the second uplink packet from the second device that includes the calculated signature, and receive the mirrored second downlink packet.
  • the first signature module is configured to calculate a signature of the mirrored first uplink packet, and save a correspondence between the mirrored first uplink packet identifier information and the calculated signature; and calculate the mirrored second downlink packet signature. ;
  • the first check module is configured to obtain the identifier information and the signature of the second uplink packet that includes the calculated signature, and search for the signature corresponding to the obtained identifier information in the correspondence relationship, and determine that the found signature is the same as the obtained signature. Determining that the second uplink packet is not a special packet;
  • the first sending module is configured to send, to the second device, a second downlink packet that includes the calculated signature.
  • the first verification module is further configured to:
  • the second uplink packet is determined to be a special packet; or, after the first preset time, the continuation is performed.
  • the step of searching for the signature corresponding to the obtained flag information in the correspondence relationship is performed.
  • the first sending module is specifically configured to:
  • the second device corresponding to the destination IP address network segment where the source IP address is obtained or the destination IP address is obtained; and the second downlink packet containing the calculated signature is sent to the found second device.
  • the method further includes:
  • the first deleting module is configured to determine that the second uplink packet is a non-multicast packet, and delete the found signature and the corresponding flag information.
  • the first deletion module is further configured to:
  • the second uplink packet is determined to be a multicast packet, and the found signature and the corresponding flag information are deleted after the second preset time.
  • the present invention further provides a second device, including at least:
  • the second receiving module is configured to receive the mirrored first downlink packet, receive the second downlink packet that is the calculated signature from the first device, and receive the mirrored second uplink packet.
  • a second signature module configured to calculate a signature of the first downlink packet, and save a correspondence between the flag information of the mirrored first downlink packet and the calculated signature; and calculate the second uplink packet of the mirroring Signature
  • a second verification module configured to acquire the identifier information and the signature of the second downlink packet that includes the calculated signature Searching for the signature corresponding to the obtained flag information in the corresponding relationship, determining that the found signature is the same as the obtained signature, and determining that the second downlink packet is not a special packet;
  • the second sending module is configured to send, to the first device, a second uplink packet that includes the calculated signature.
  • the second verification module is further configured to:
  • the second downlink packet is determined to be a special packet; or, after the first preset time, the continuation is performed.
  • the step of searching for the signature corresponding to the obtained flag information in the correspondence relationship is performed.
  • the second sending module is specifically configured to:
  • the first device corresponding to the destination IP address network segment where the source IP address is obtained or the destination IP address is obtained; and the second uplink packet that includes the calculated signature is sent to the first device that is found.
  • the method further includes:
  • the second deleting module is configured to determine that the second downlink packet is a non-multicast packet, and delete the found signature and the corresponding flag information.
  • the second deletion module is further configured to:
  • the second downlink packet is determined to be a multicast packet, and the found signature and the corresponding flag information are deleted after the second preset time.
  • the present invention further provides a third device, including at least:
  • a third receiving module configured to receive the mirrored first uplink packet, receive the first downlink packet that includes the calculated signature from the fourth device, and receive the mirrored second downlink packet;
  • a third signature module configured to calculate a signature of the first uplink packet that is mirrored; obtain the flag information and the signature in the first downlink packet that is calculated, and save the correspondence between the obtained identifier information and the signature; The flag information in the mirrored second downlink packet, and the signature of the mirrored second downlink packet is calculated;
  • a third sending module configured to send, to the fourth device, a first uplink packet that includes the calculated signature
  • the third check module is configured to search for a signature corresponding to the flag information in the mirrored second downlink packet in the corresponding relationship, and determine that the signature of the found signature and the mirrored second downlink packet are the same, and the second downlink is determined.
  • the message is not a special message.
  • the third verification module is further configured to:
  • the signature corresponding to the flag information in the second downlink packet is not found in the corresponding relationship, or the signature of the found signature and the second downlink packet are different, and the second downlink packet is determined to be a special packet; or After the first preset time, the step of searching for the signature corresponding to the flag information in the mirrored second downlink packet in the corresponding relationship is performed.
  • the third sending module is specifically configured to:
  • the device sends a first uplink message including the calculated signature to the found fourth device.
  • the method further includes:
  • the third deleting module is configured to determine that the second downlink packet is a non-multicast packet, and delete the found signature and the corresponding flag information.
  • the third deletion module is further configured to:
  • the second downlink packet is determined to be a multicast packet, and the found signature and the corresponding flag information are deleted after the second preset time.
  • the present invention further provides a fourth device, including at least:
  • the fourth receiving module is configured to receive the mirrored first downlink packet, receive the first uplink packet that is the calculated signature from the third device, and receive the mirrored second uplink packet.
  • a fourth signature module configured to calculate a signature of the first downlink packet that is mirrored, obtain the flag information and the signature in the first uplink packet that is calculated, and save the correspondence between the obtained identifier information and the signature; The flag information in the mirrored second uplink packet, and the signature of the mirrored second uplink packet is calculated;
  • a fourth sending module configured to send, to the third device, a first downlink packet that includes the calculated signature
  • the fourth check module is configured to search for a signature corresponding to the flag information in the mirrored second uplink packet in the corresponding relationship, and determine that the signature of the found signature and the mirrored second uplink packet are the same, and determine the second uplink.
  • the message is not a special message.
  • the fourth verification module is further configured to:
  • the second uplink packet is determined to be a special packet; or After the first preset time, the step of searching for the signature corresponding to the flag information in the mirrored second uplink packet in the corresponding relationship is performed.
  • the fourth sending module is specifically configured to:
  • the third device corresponding to the destination IP address network segment where the source IP address is located or the destination IP address is obtained.
  • the first downlink packet that contains the calculated signature is sent to the third device that is found.
  • the method further includes:
  • the fourth deleting module is configured to determine that the second uplink packet is a non-multicast packet, and delete the found signature and the corresponding flag information.
  • the fourth deleting module is further configured to:
  • the second uplink packet is determined to be a multicast packet, and the found signature and the corresponding flag information are deleted after the second preset time.
  • the present invention further provides a system for detecting a message, including at least:
  • the first device is configured to receive the mirrored first uplink packet, calculate a signature of the mirrored first uplink packet, and save a correspondence between the mirrored first uplink packet identifier information and the calculated signature; And the signature information and the signature in the second uplink packet, where the calculated signature is included, and the signature corresponding to the obtained identifier information is searched in the corresponding relationship, and the found signature is determined to be the same as the obtained signature, and the second uplink packet is determined not to be a special packet; the second downlink packet that is mirrored is received, the signature of the mirrored second downlink packet is calculated, and the second downlink packet that includes the calculated signature is sent to the second device;
  • the second device is configured to receive the mirrored first downlink packet, calculate the signature of the mirrored first downlink packet, and save the correspondence between the mirrored first downlink packet identifier information and the calculated signature.
  • the second uplink packet of the mirrored image is received, the signature of the second uplink packet is calculated, the second uplink packet that includes the calculated signature is sent to the first device, and the second downlink that includes the calculated signature is obtained.
  • the flag information and the signature in the packet are searched for the signature corresponding to the obtained flag information in the corresponding relationship, and it is determined that the found signature is the same as the obtained signature, and it is determined that the second downlink packet is not a special packet.
  • the first device/second device is further configured to:
  • the present invention further provides a system for detecting a message, including at least:
  • the third device is configured to receive the mirrored first uplink packet, calculate the signature of the mirrored first uplink packet, and send the first uplink packet that includes the calculated signature to the fourth device, and obtain the calculated signature.
  • the flag information and the signature in the first downlink packet, and the correspondence between the obtained flag information and the signature is saved; the second downlink packet that is mirrored is obtained, and the flag information in the mirrored second downlink packet is obtained.
  • the signature of the mirrored second downlink packet is calculated, and the signature corresponding to the flag information in the mirrored second downlink packet is searched for in the corresponding relationship, and the signature of the found signature and the mirrored second downlink packet are determined to be the same.
  • the second downlink packet is not a special packet;
  • the fourth device is configured to receive the mirrored first downlink packet, calculate the signature of the mirrored first downlink packet, and send the first downlink packet that includes the calculated signature to the third device; Obtaining the flag information and the signature in the first uplink packet of the signature, and storing the correspondence between the obtained identifier information and the signature; receiving the mirrored second uplink packet, and obtaining the flag in the mirrored second uplink packet.
  • the information is used to calculate the signature of the second uplink packet in the mirrored image, and the signature corresponding to the flag information in the mirrored second uplink packet is searched in the corresponding relationship, and the signature of the second signature packet is the same as that of the mirrored second uplink packet. And determining that the second uplink packet is not a special packet.
  • the third device/fourth device is further configured to:
  • the signature corresponding to the flag information in the second uplink packet/second downlink packet is not found in the corresponding relationship, or the signature of the found signature and the second uplink packet/second downlink packet are different.
  • the packet/second downlink packet is a special packet; or, after the first preset time, the signature corresponding to the flag information in the second uplink packet/second downlink packet that is mirrored in the corresponding relationship is continuously executed. step.
  • Each module or unit in the apparatus and system for detecting a message provided by the embodiment of the present application may pass through one or more digital signal processors (DSPs), application specific integrated circuits (ASICs), processors, microprocessors, controllers, Implemented by a microcontroller, field programmable array (FPGA), programmable logic device, or other electronic unit, or any combination thereof.
  • DSPs digital signal processors
  • ASICs application specific integrated circuits
  • processors microprocessors
  • controllers Implemented by a microcontroller, field programmable array (FPGA), programmable logic device, or other electronic unit, or any combination thereof.
  • FPGA field programmable array
  • programmable logic device or other electronic unit, or any combination thereof.
  • the invention relates to the field of mobile communication and the Internet, so that the message can be detected without interrupting the original network, thereby improving the user experience.

Abstract

本发明公开了一种检测报文的方法、装置和系统，包括：第一设备/第二设备接收到镜像的第一上行报文/第一下行报文，计算第一上行报文/第一下行报文的签名，保存第一上行报文/第一下行报文的标志信息和签名之间的对应关系；第二设备/第一设备接收到镜像的第二上行报文/第二下行报文，计算第二上行报文/第二下行报文的签名，向第一设备/第二设备发送包含签名的第二上行报文/第二下行报文；第一设备/第二设备获取包含签名的第二上行报文/第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文/第二下行报文不是特殊报文。本发明提高了用户体验。

Description

一种检测报文的方法、装置和系统 技术领域
本发明涉及移动通讯和互联网领域，尤指一种检测报文的方法、装置和系统。
背景技术
随着互联网技术的迅速发展，网络的安全性越来越受到人们的重视，如何保证网络中的信息不被窃取泄密，增强网络的安全性，成为日益需要解决的问题。
网络中的特殊报文可以理解为被中间网络设备对流经自身的报文中的信息进行篡改得到的报文，或中间网络设备根据流经自身的报文中的信息自行发送的报文。这些报文由于其隐蔽性，往往很不容易被发现，从而无法对其进行控制。
现有的检测特殊报文的方法通常是把检测设备串联在网络中进行检测，然而串联之前需要中断原有网络，影响了用户体验。
发明内容
为了解决上述问题，本发明提出了一种检测报文的方法、装置和系统，能够在不中断原有网络时进行检测，从而提高用户体验。
为了达到上述目的，本发明提出了一种检测报文的方法，包括：
第一设备/第二设备接收到镜像的第一上行报文/第一下行报文，计算镜像的第一上行报文/第一下行报文的签名，保存镜像的第一上行报文/第一下行报文的标志信息和计算得到的签名之间的对应关系；
第二设备/第一设备接收到镜像的第二上行报文/第二下行报文，计算镜像的第二上行报文/第二下行报文的签名，向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文；
第一设备/第二设备获取包含计算得到的签名的第二上行报文/第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文/第二下行报文不是特殊报文。
可选的，当所述第一设备/第二设备在所述对应关系中查找不到获得的标志信息对应的签名，或判断出所述查找到的签名和所述获得的签名不相同时，该方法还包括：
所述第一设备/第二设备确定所述第二上行报文/第二下行报文为特殊报文；
或者，所述第一设备/第二设备在第一预设时间后继续执行所述在对应关系中查找获得的标志信息对应的签名的步骤。
可选的，所述计算镜像的第二上行报文/第二下行报文的签名后，在所述向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文之前还包括：
获取第二上行报文/第二下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第一设备/第二设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第一设备/第二设备；
所述向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文包括：
向查找到的第一设备/第二设备发送所述包含计算得到的签名的第二上行报文/第二下行报文。
可选的，该方法还包括：
所述第一设备/第二设备判断出所述第二上行报文/第二下行报文为非组播报文，删除查找到的签名和对应的标志信息。
可选的，当所述第一设备/第二设备判断出所述第二上行报文/第二下行报文为组播报文时，该方法还包括：
在第二预设时间后删除查找到的签名和对应的标志信息。
本发明还提出了一种检测报文的方法，包括：
第三设备/第四设备接收到镜像的第一上行报文/第一下行报文，计算镜像的第一上行报文/第一下行报文的签名，向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文；
第四设备/第三设备获取包含计算得到的签名的第一上行报文/第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；
第四设备/第三设备接收到镜像的第二上行报文/第二下行报文，获取镜像的第二上行报文/第二下行报文中的标志信息，计算镜像的第二上行报文/第二下行报文的签名，在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文/第二下行报文的签名相同，确定第二上行报文/第二下行报文不是特殊报文。
可选的，当所述第四设备/第三设备在所述对应关系中查找不到所述第二上行报文/第二下行报文中的标志信息对应的签名，或判断出所述查找到的签名和所述第二上行报文/第二下行报文的签名不相同时，该方法还包括：
所述第四设备/第三设备确定所述第二上行报文/第二下行报文为特殊报文；
或者，所述第四设备/第三设备在第一预设时间后继续执行所述在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名的步骤。
可选的，所述计算镜像的第一上行报文/第一下行报文的签名后，在所述向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文之前还包括：
获取第一上行报文/第一下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第四设备/第三设备之间的对应关系中，查 找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第四设备/第三设备；
所述向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文包括：
向查找到的第四设备/第三设备发送所述包含计算得到的签名的第一上行报文/第一下行报文。
可选的，该方法还包括：
所述第四设备/第三设备判断出所述第二上行报文/第二下行报文为非组播报文，删除查找到的签名和对应的标志信息。
可选的，当所述第四设备/第三设备判断出所述第二上行报文/第二下行报文为组播报文时，该方法还包括：
在第二预设时间后删除查找到的签名和对应的标志信息。
本发明还提出了一种第一设备，至少包括：
第一接收模块，用于接收到镜像的第一上行报文；接收到来自第二设备的包含计算得到的签名的第二上行报文；接收到镜像的第二下行报文；
第一签名模块，用于计算镜像的第一上行报文的签名，保存镜像的第一上行报文的标志信息和计算得到的签名之间的对应关系；计算镜像的第二下行报文的签名；
第一校验模块，用于获取包含计算得到的签名的第二上行报文的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文；
第一发送模块，用于向第二设备发送包含计算得到的签名的第二下行报文。
可选的，所述第一校验模块还用于：
在所述对应关系中查找不到获得的标志信息对应的签名，或判断出所述查找到的签名和所述获得的签名不相同，确定所述第二上行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找获得的标志信息对应的签名的步骤。
可选的，所述第一发送模块具体用于：
获取第二下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第二设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第二设备；向查找到的第二设备发送所述包含计算得到的签名的第二下行报文。
本发明还提出了一种第二设备，至少包括：
第二接收模块，用于接收到镜像的第一下行报文；接收到来自第一设备的包含计算得到的签名的第二下行报文；接收到镜像的第二上行报文；
第二签名模块，用于计算镜像的第一下行报文的签名，保存镜像的第一下行报文的标志信息和计算得到的签名之间的对应关系；计算镜像的第二上行报文的签名；
第二校验模块，用于获取包含计算得到的签名的第二下行报文的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文；
第二发送模块，用于向第一设备发送包含计算得到的签名的第二上行报文。
可选的，所述第二校验模块还用于：
在所述对应关系中查找不到获得的标志信息对应的签名，或判断出所述查找到的签名和所述获得的签名不相同，确定所述第二下行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找获得的标志信息对应的签名的步骤。
可选的，所述第二发送模块具体用于：
获取第二上行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第一设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第一设备；向查找到的第一设备发送所述包含计算得到的签名的第二上行报文。
本发明还提出了一种第三设备，至少包括：
第三接收模块，用于接收到镜像的第一上行报文；接收到来自第四设备的包含计算得到的签名的第一下行报文；接收到镜像的第二下行报文；
第三签名模块，用于计算镜像的第一上行报文的签名；获取包含计算得到的第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；获取镜像的第二下行报文中的标志信息，计算镜像的第二下行报文的签名；
第三发送模块，用于向第四设备发送包含计算得到的签名的第一上行报文；
第三校验模块，用于在对应关系中查找镜像的第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二下行报文的签名相同，确定第二下行报文不是特殊报文。
可选的，所述第三校验模块还用于：
在所述对应关系中查找不到所述第二下行报文中的标志信息对应的签名，或判断出所述查找到的签名和所述第二下行报文的签名不相同，确定所述第二下行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找镜像的第二下行报文中的标志信息对应的签名的步骤。
可选的，所述第三发送模块具体用于：
获取第一上行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第四设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第四设备；向查找到的第四设备发送所述包含计算得到的签名的第一上行报文。
本发明还提出了一种第四设备，至少包括：
第四接收模块，用于接收到镜像的第一下行报文；接收到来自第三设备的包含计 算得到的签名的第一上行报文；接收到镜像的第二上行报文；
第四签名模块，用于计算镜像的第一下行报文的签名；获取包含计算得到的第一上行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；获取镜像的第二上行报文中的标志信息，计算镜像的第二上行报文的签名；
第四发送模块，用于向第三设备发送包含计算得到的签名的第一下行报文；
第四校验模块，用于在对应关系中查找镜像的第二上行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文的签名相同，确定第二上行报文不是特殊报文。
可选的，所述第四校验模块还用于：
在所述对应关系中查找不到所述第二上行报文中的标志信息对应的签名，或判断出所述查找到的签名和所述第二上行报文的签名不相同，确定所述第二上行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找镜像的第二上行报文中的标志信息对应的签名的步骤。
可选的，所述第四发送模块具体用于：
获取第一下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第三设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第三设备；向查找到的第三设备发送所述包含计算得到的签名的第一下行报文。
本发明还提出了一种检测报文的系统，至少包括：
第一设备，用于接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，保存镜像的第一上行报文的标志信息和计算得到的签名之间的对应关系；获取包含计算得到的签名的第二上行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文；接收到镜像的第二下行报文，计算镜像的第二下行报文的签名，向第二设备发送包含计算得到的签名的第二下行报文；
第二设备，用于接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，保存镜像的第一下行报文的标志信息和计算得到的签名之间的对应关系；接收到镜像的第二上行报文，计算镜像的第二上行报文的签名，向第一设备发送包含计算得到的签名的第二上行报文；获取包含计算得到的签名的第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文。
可选的，所述第一设备/第二设备还用于：
在所述对应关系中查找不到获得的标志信息对应的签名，或判断出所述查找到的签名和所述获得的签名不相同，确定所述第二上行报文/第二下行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找获得的标志信息对应的签名 的步骤。
本发明还提出了一种检测报文的系统，至少包括：
第三设备，用于接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，向第四设备发送包含计算得到的签名的第一上行报文；获取包含计算得到的签名的第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；接收到镜像的第二下行报文，获取镜像的第二下行报文中的标志信息，计算镜像的第二下行报文的签名，在对应关系中查找镜像的第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二下行报文的签名相同，确定第二下行报文不是特殊报文；
第四设备，用于接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，向第三设备发送包含计算得到的签名的第一下行报文；获取包含计算得到的签名的第一上行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；接收到镜像的第二上行报文，获取镜像的第二上行报文中的标志信息，计算镜像的第二上行报文的签名，在对应关系中查找镜像的第二上行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文的签名相同，确定第二上行报文不是特殊报文。
可选的，所述第三设备/第四设备还用于：
在所述对应关系中查找不到所述第二上行报文/第二下行报文中的标志信息对应的签名，或判断出所述查找到的签名和所述第二上行报文/第二下行报文的签名不相同，确定所述第二上行报文/第二下行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名的步骤。
与现有技术相比，本发明的技术方案包括：第一设备/第二设备接收到镜像的第一上行报文/第一下行报文，计算镜像的第一上行报文/第一下行报文的签名，保存镜像的第一上行报文/第一下行报文的标志信息和计算得到的签名之间的对应关系；第二设备/第一设备接收到镜像的第二上行报文/第二下行报文，计算镜像的第二上行报文/第二下行报文的签名，向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文；第一设备/第二设备获取包含计算得到的签名的第二上行报文/第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文/第二下行报文不是特殊报文。通过本发明的方案，采用第一设备/第二设备和第二设备/第一设备对中间网络设备镜像的上行报文/下行报文进行检测，而不需要中断原有网络，从而提高了用户体验。
附图说明
下面对本发明实施例中的附图进行说明，实施例中的附图是用于对本发明的进一步理解，与说明书一起用于解释本发明，并不构成对本发明保护范围的限制。
图1为本发明检测特殊报文的方法的流程图；
图2为本发明在中间网络设备的入口和出口分别设置设备的示意图；
图3为本发明另一种在中间网络设备的入口和出口分别设置设备的示意图
图4为本发明另一种检测报文的方法的流程图；
图5为本发明第一设备的结构组成示意图；
图6为本发明第二设备的结构组成示意图；
图7为本发明第三设备的结构组成示意图；
图8为本发明第四设备的结构组成示意图；
图9为本发明检测报文的系统的结构组成示意图；
图10为本发明另一种检测报文的系统的结构组成示意图。
具体实施方式
为了便于本领域技术人员的理解，下面结合附图对本发明作进一步的描述，并不能用来限制本发明的保护范围。需要说明的是，在不冲突的情况下，本申请中的实施例及实施例中的各种方式可以相互组合。
参见图1，本发明提出了一种检测报文的方法，在中间网络设备的入口和出口分别设置第一设备和第二设备。
图2为在中间网络设备的入口和出口分别设置设备的示意图。如图2所示，终端通过中间网络设备和因特网(Internet)之间进行通信。当中间网络设备只有一个入口和一个出口时，只需要在入口和出口分别设置一个第一设备(即设备1)和第二设备(即设备2)。
图3为另一种在中间网络设备的入口和出口分别设置设备的示意图。如图3所示，终端1和终端2通过中间网络设备和Internet之间进行通信。当中间网络设备有多个入口和/或多个出口时，需要在入口和出口分别设置多个第一设备(即设备1和设备2)和/或多个第二设备(即设备3和设备4)。
因此，在以下的描述中，处理上行报文和下行报文的方法是相同的，因此用“/”来表示，即”/“表示可替代的意思，在整套方法的描述中，只包含“/”前面的描述为一套完整的方案，只包含“/”后面的描述为另一套完整的方案。
该方法包括：
步骤100，第一设备/第二设备接收到镜像的第一上行报文/第一下行报文，计算镜像的第一上行报文/第一下行报文的签名，保存镜像的第一上行报文/第一下行报文的标志信息和计算得到的签名之间的对应关系。
本步骤中，第一设备/第二设备可以采用现有的算法，如密钥相关的哈希运算消 息认证码(HMAC，Hash-based Message Authentication Code)-信息摘要算法5(MD5，Message-Digest Algorithm 5)计算镜像的第一上行报文/第一下行报文的签名，具体实现属于本领域技术人员的公知技术，并不用于限定本发明的保护范围，这里不再赘述。
本步骤中，一般对镜像的第一上行报文/第一下行报文的特征值的签名进行计算，镜像的第一上行报文/第一下行报文的特征值是指镜像的第一上行报文/第一下行报文在网络中传输时通常不改变的内容，如目的IP地址+payload、源IP地址+payload等。
本步骤中，标志信息包括以下的一种或多种：源互联网协议(IP，Internet Protocol)地址、目的IP地址、协议号、源端口号、目的端口号、标识字段、分片标记位和分片偏移等。
需要说明的是，标志信息至少要能够唯一标识报文。
步骤101，第二设备/第一设备接收到镜像的第二上行报文/第二下行报文，计算镜像的第二上行报文/第二下行报文的签名，向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文。
本步骤中，第二设备/第一设备可以采用现有的算法，如HMAC-MD5计算镜像的第二上行报文/第二下行报文的签名，具体实现属于本领域技术人员的公知技术，并不用于限定本发明的保护范围，这里不再赘述。
本步骤中，一般对镜像的第二上行报文/第二下行报文的特征值的签名进行计算，镜像的第二上行报文/第二下行报文的特征值是指镜像的第二上行报文/第二下行报文在网络中传输时通常不改变的内容，如目的IP地址+payload、源IP地址+payload等。
本步骤中，包含计算得到的签名的第二上行报文/第二下行报文与第二上行报文/第二下行报文的其他信息均相同，仅仅是在第二上行报文/第二下行报文中携带了签名。
本步骤中，签名可以设置在第二上行报文/第二下行报文的payload字段末尾，或option字段、或IPSec(IP Security)常用的AH头和IP头的Identification字段等。
本步骤中，计算镜像的第二上行报文/第二下行报文的签名后，在向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文之前还包括：
获取第二上行报文/第二下行报文的源IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第一设备/第二设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第一设备/第二设备；
向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文包括：向查找到的第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文。
步骤102，第一设备/第二设备获取包含计算得到的签名的第二上行报文/第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文/第二下行报文不是特殊报文。
本步骤中，当第一设备/第二设备在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同时，第一设备/第二设备确定第二上行报文/第二下行报文为特殊报文；或者，入口设备在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
其中，入口设备确定出第二上行报文/第二下行报文为特殊报文后，还可以进行告警和/或将第二上行报文/第二下行报文输出，具体实现属于本领域技术人员的公知技术，并不用于限定本发明的保护范围，这里不再赘述。
通过本发明的方案，采用第一设备/第二设备和第二设备/第一设备对中间网络设备镜像的上行报文/下行报文进行检测，而不需要中断原有网络，从而提高了用户体验。
进一步地，该方法还包括：
第一设备/第二设备判断出第二上行报文/第二下行报文为非组播报文，删除查找到的签名和对应的标志信息。
其中，当第一设备/第二设备判断出第二上行报文/第二下行报文为组播报文时，在第二预设时间后删除查找到的签名和对应的标志信息。
其中，具体如何判断第二上行报文/第二下行报文是否是组播报文属于本领域技术人员的公知技术，并不用于限定本发明的保护范围，这里不再赘述。
参见图4，本发明还提出了一种检测报文的方法，在中间网络设备的入口和出口分别设置第三设备和第四设备。
如图2所示，终端通过中间网络设备和因特网(Internet)之间进行通信。当中间网络设备只有一个入口和一个出口时，只需要在入口和出口分别设置一个第三设备(即设备1)和第四设备(即设备2)。
如图3所示，终端1和终端2通过中间网络设备和Internet之间进行通信。当中间网络设备有多个入口和/或多个出口时，需要在入口和出口分别设置多个第三设备(即设备1和设备2)和/或多个第四设备(即设备3和设备4)。
因此，在以下的描述中，处理上行报文和下行报文的方法是相同的，因此用“/”来表示，即”/“表示可替代的意思，在整套方法的描述中，只包含“/”前面的描述为一套完整的方案，只包含“/”后面的描述为另一套完整的方案。
该方法包括：
步骤400，第三设备/第四设备接收到镜像的第一上行报文/第一下行报文，计算镜像的第一上行报文/第一下行报文的签名，向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文。
本步骤中，第三设备/第四设备可以采用现有的算法，如HMAC-MD5计算镜像的第一上行报文/第一下行报文的签名，具体实现属于本领域技术人员的公知技术，并不用于限定本发明的保护范围，这里不再赘述。
本步骤中，一般对镜像的第一上行报文/第一下行报文的特征值的签名进行计算，镜像的第一上行报文/第一下行报文的特征值是指镜像的第一上行报文/第一下行报文在网络中传输时通常不改变的内容，如目的IP地址+payload、源IP地址+payload等。
本步骤中，计算镜像的第一上行报文/第一下行报文的签名后，在向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文之前还包括：
获取第一上行报文/第一下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第四设备/第三设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第四设备/第三设备；
向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文包括：向查找到的第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文。
步骤401，第四设备/第三设备获取包含计算得到的签名的第一上行报文/第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系。
本步骤中，标志信息包括以下的一种或多种：源IP地址、目的IP地址、协议号、源端口号、目的端口号、标识字段、分片标记位和分片偏移等。
步骤402，第四设备/第三设备接收到镜像的第二上行报文/第二下行报文，获取镜像的第二上行报文/第二下行报文中的标志信息，计算镜像的第二上行报文/第二下行报文的签名，在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文/第二下行报文的签名相同，确定第二上行报文/第二下行报文不是特殊报文。
本步骤中，当第四设备/第三设备在对应关系中查找不到第二上行报文/第二下行报文中的标志信息对应的签名，或判断出查找到的签名和第二上行报文/第二下行报文的签名不相同时，第四设备/第三设备确定第二上行报文/第二下行报文为特殊报文；或者，出口设备在第一预设时间后继续执行在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名的步骤。
进一步地，该方法还包括：
第四设备/第三设备判断出第二上行报文/第二下行报文为非组播报文，删除查找到的签名和对应的标志信息。
其中，当第四设备/第三设备判断出第二上行报文/第二下行报文为组播报文时，在第二预设时间后删除查找到的签名和对应的标志信息。
下面通过具体实施例详细说明本发明的方法。
第一实施例，参见图2，当终端通过中间网络设备向Internet发送第一上行报文时，中间网络设备在入口处将第一上行报文镜像给设备1，第一上行报文传输到中间网络设备的出口处变为第二上行报文(第二上行报文可能与第一上行报文相同，也可能不同，当第一上行报文被中间网络设备篡改时，则第二上行报文与第一上行报文不同)，中间网络设备在出口处将第二上行报文镜像给设备2。
设备1接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，保存镜像的第一上行报文的标志信息和计算得到的签名之间的对应关系；
设备2接收到镜像的第二上行报文，计算镜像的第二上行报文的签名，向设备1发送包含计算得到的签名的第二上行报文；
设备1获取包含计算得到的签名的第二上行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文。
当设备1在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同时，设备1确定第二上行报文为特殊报文；
或者，设备1在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
当Internet通过中间网络设备向终端发送第一下行报文时，中间网络设备在入口处将第一下行报文镜像给设备2，第一下行报文传输到中间网络设备的出口处变为第二下行报文(第二下行报文可能与第一下行报文相同，也可能不同，当第一下行报文被中间网络设备篡改时，则第二下行报文与第一下行报文不同)，中间网络设备在出口处将第二下行报文镜像给设备1。
设备2接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，保存镜像的第一下行报文的标志信息和计算得到的签名之间的对应关系；
设备1接收到镜像的第二下行报文，计算镜像的第二下行报文的签名，向设备2发送包含计算得到的签名的第二下行报文；
设备2获取包含计算得到的签名的第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文。
当设备2在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同时，设备2确定第二下行报文为特殊报文；
或者，设备2在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
第二实施例，参见图3，当终端1/终端2通过中间网络设备向Internet发送第一上行报文时，中间网络设备在入口处将第一上行报文镜像给设备1/设备2，第一上行 报文传输到中间网络设备的出口处变为第二上行报文(第二上行报文可能与第一上行报文相同，也可能不同，当第一上行报文被中间网络设备篡改时，则第二上行报文与第一上行报文不同)，中间网络设备在出口处将第二上行报文镜像给设备3或设备4。
设备1/设备2接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，保存镜像的第一上行报文的标志信息和计算得到的签名之间的对应关系；
设备3或设备4接收到镜像的第二上行报文，计算镜像的第二上行报文的签名，获取第二上行报文的源IP地址，在预先设置的源IP地址网段和设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段对应的设备(或者，获取第二上行报文的目的IP地址，在预先设置的目的IP地址网段和设备之间的对应关系中，查找获得的目的IP地址所在的目的IP地址网段对应的设备)，若查找到的设备为设备1/设备2，向设备1/设备2发送包含计算得到的签名的第二上行报文；
设备1/设备2获取包含计算得到的签名的第二上行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文。
当设备1/设备2在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同时，设备1/设备2确定第二上行报文为特殊报文；
或者，设备1/设备2在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
当Internet通过中间网络设备向终端1/终端2发送第一下行报文时，中间网络设备在入口处将第一下行报文镜像给设备3或设备4，第一下行报文传输到中间网络设备的出口处变为第二下行报文(第二下行报文可能与第一下行报文相同，也可能不同，当第一下行报文被中间网络设备篡改时，则第二下行报文与第一下行报文不同)，中间网络设备在出口处将第二下行报文镜像给设备1/设备2。
设备3或设备4接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，保存镜像的第一下行报文的标志信息和计算得到的签名之间的对应关系；
设备1/设备2接收到镜像的第二下行报文，计算镜像的第二下行报文的签名，获取第二下行报文的目的IP地址，在预先设置的目的IP地址网段和设备之间的对应关系中，查找获得的目的IP地址所在的目的IP地址网段对应的设备，若查找到的设备为设备3或设备4，向设备3或设备4发送包含计算得到的签名的第二下行报文；
设备3或设备4获取包含计算得到的签名的第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文。
当设备3或设备4在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同时，设备3或设备4确定第二下行报文为特殊报文；
或者，设备3或设备4在第一预设时间后继续执行在对应关系中查找获得的标志 信息对应的签名的步骤。
第三实施例，参见图2，当终端通过中间网络设备向Internet发送第一上行报文时，中间网络设备在入口处将第一上行报文镜像给设备1，第一上行报文传输到中间网络设备的出口处变为第二上行报文(第二上行报文可能与第一上行报文相同，也可能不同，当第一上行报文被中间网络设备篡改时，则第二上行报文与第一上行报文不同)，中间网络设备在出口处将第二上行报文镜像给设备2。
设备1接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，向设备2发送包含计算得到的签名的第一上行报文；
设备2获取包含计算得到的签名的第一上行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；
设备2接收到镜像的第二上行报文，获取镜像的第二上行报文中的标志信息，计算镜像的第二上行报文的签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文。
当设备2在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同时，设备2确定第二上行报文为特殊报文；
或者，设备2在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
当Internet通过中间网络设备向终端发送第一下行报文时，中间网络设备在入口处将第一下行报文镜像给设备2，第一下行报文传输到中间网络设备的出口处变为第二下行报文(第二下行报文可能与第一下行报文相同，也可能不同，当第一下行报文被中间网络设备篡改时，则第二下行报文与第一下行报文不同)，中间网络设备在出口处将第二下行报文镜像给设备1。
设备2接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，向设备1发送包含计算得到的签名的第一下行报文；
设备1获取包含计算得到的签名的第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；
设备1接收到镜像的第二下行报文，获取镜像的第二下行报文中的标志信息，计算镜像的第二下行报文的签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文。
当设备1在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同时，设备1确定第二下行报文为特殊报文；
或者，设备1在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
第四实施例，参见图3，当终端1/终端2通过中间网络设备向Internet发送第一上行报文时，中间网络设备在入口处将第一上行报文镜像给设备1/设备2，第一上行 报文传输到中间网络设备的出口处变为第二上行报文(第二上行报文可能与第一上行报文相同，也可能不同，当第一上行报文被中间网络设备篡改时，则第二上行报文与第一上行报文不同)，中间网络设备在出口处将第二上行报文镜像给设备3或设备4。
设备1/设备2接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，获取第一上行报文的源IP地址，在预先设置的源IP地址网段和设备之间的对应关系中查找获得的源IP地址所在的源IP地址网段对应的设备(或获取第一上行报文的目的IP地址，在预先设置的目的IP地址网段和设备之间的对应关系中查找获得的目的IP地址所在的目的IP地址网段对应的设备)若查找到的设备为设备3或设备4，向设备3或设备4发送包含计算得到的签名的第一上行报文。
设备3或设备4获取包含计算得到的签名的第一上行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系。
设备3或设备4接收到镜像的第二上行报文，获取镜像的第二上行报文中的标志信息，计算镜像的第二上行报文的签名，在对应关系中查找镜像的第二上行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文的签名相同，确定第二上行报文不是特殊报文。
当设备3或设备4在对应关系中查找不到镜像的第二上行报文中的标志信息对应的签名，或判断出查找到的签名和镜像的第二上行报文中的签名不相同时，设备3或设备4确定第二上行报文为特殊报文；
或者，设备3或设备4在第一预设时间后继续执行在对应关系中查找镜像的第二上行报文中的标志信息对应的签名的步骤。
当Internet通过中间网络设备向终端1/终端2发送第一下行报文时，中间网络设备在入口处将第一下行报文镜像给设备3或设备4，第一下行报文传输到中间网络设备的出口处变为第二下行报文(第二下行报文可能与第一下行报文相同，也可能不同，当第一下行报文被中间网络设备篡改时，则第二下行报文与第一下行报文不同)，中间网络设备在出口处将第二下行报文镜像给设备1/设备2。
设备3或设备4接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，获取第一下行报文的目的IP地址，在预先设置的目的IP地址网段和设备之间的对应关系中查找获得的目的IP地址所在的目的IP地址网段对应的设备，若查找到的设备为设备1/设备2，向设备1/设备2发送包含计算得到的签名的第一下行报文。
设备1/设备2获取包含计算得到的签名的第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系。
设备1/设备2接收到镜像的第二下行报文，获取镜像的第二下行报文中的标志信息，计算镜像的第二下行报文的签名，在对应关系中查找镜像的第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二下行报文的签名相同，确定第二下行报文不是特殊报文。
当设备1/设备2在对应关系中查找不到镜像的第二下行报文中的标志信息对应的签名，或判断出查找到的签名和镜像的第二下行报文中的签名不相同时，设备1/设备2确定第二下行报文为特殊报文；
或者，设备1/设备2在第一预设时间后继续执行在对应关系中查找镜像的第二下行报文中的标志信息对应的签名的步骤。
参见图5，本发明提出了一种第一设备，至少包括：
第一接收模块，用于接收到镜像的第一上行报文；接收到来自第二设备的包含计算得到的签名的第二上行报文；接收到镜像的第二下行报文；
第一签名模块，用于计算镜像的第一上行报文的签名，保存镜像的第一上行报文的标志信息和计算得到的签名之间的对应关系；计算镜像的第二下行报文的签名；
第一校验模块，用于获取包含计算得到的签名的第二上行报文的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文；
第一发送模块，用于向第二设备发送包含计算得到的签名的第二下行报文。
本发明的第一设备中，第一校验模块还用于：
在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同，确定第二上行报文为特殊报文；或者，在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
本发明的第一设备中，第一发送模块具体用于：
获取第二下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第二设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第二设备；向查找到的第二设备发送包含计算得到的签名的第二下行报文。
本发明的第一设备中，还包括：
第一删除模块，用于判断出第二上行报文为非组播报文，删除查找到的签名和对应的标志信息。
本发明的第一设备中，第一删除模块还用于：
判断出第二上行报文为组播报文，在第二预设时间后删除查找到的签名和对应的标志信息。
参见图6，本发明还提出了一种第二设备，至少包括：
第二接收模块，用于接收到镜像的第一下行报文；接收到来自第一设备的包含计算得到的签名的第二下行报文；接收到镜像的第二上行报文；
第二签名模块，用于计算镜像的第一下行报文的签名，保存镜像的第一下行报文的标志信息和计算得到的签名之间的对应关系；计算镜像的第二上行报文的签名；
第二校验模块，用于获取包含计算得到的签名的第二下行报文的标志信息和签 名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文；
第二发送模块，用于向第一设备发送包含计算得到的签名的第二上行报文。
本发明的第二设备中，第二校验模块还用于：
在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同，确定第二下行报文为特殊报文；或者，在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
本发明的第二设备中，第二发送模块具体用于：
获取第二上行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第一设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第一设备；向查找到的第一设备发送包含计算得到的签名的第二上行报文。
本发明的第二设备中，还包括：
第二删除模块，用于判断出第二下行报文为非组播报文，删除查找到的签名和对应的标志信息。
本发明的第二设备中，第二删除模块还用于：
判断出第二下行报文为组播报文，在第二预设时间后删除查找到的签名和对应的标志信息。
参见图7，本发明还提出了一种第三设备，至少包括：
第三接收模块，用于接收到镜像的第一上行报文；接收到来自第四设备的包含计算得到的签名的第一下行报文；接收到镜像的第二下行报文；
第三签名模块，用于计算镜像的第一上行报文的签名；获取包含计算得到的第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；获取镜像的第二下行报文中的标志信息，计算镜像的第二下行报文的签名；
第三发送模块，用于向第四设备发送包含计算得到的签名的第一上行报文；
第三校验模块，用于在对应关系中查找镜像的第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二下行报文的签名相同，确定第二下行报文不是特殊报文。
本发明的第三设备中，第三校验模块还用于：
在对应关系中查找不到第二下行报文中的标志信息对应的签名，或判断出查找到的签名和第二下行报文的签名不相同，确定第二下行报文为特殊报文；或者，在第一预设时间后继续执行在对应关系中查找镜像的第二下行报文中的标志信息对应的签名的步骤。
本发明的第三设备中，第三发送模块具体用于：
获取第一上行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP 地址网段或目的IP地址网段和第四设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第四设备；向查找到的第四设备发送包含计算得到的签名的第一上行报文。
本发明的第三设备中，还包括：
第三删除模块，用于判断出第二下行报文为非组播报文，删除查找到的签名和对应的标志信息。
本发明的第三设备中，第三删除模块还用于：
判断出第二下行报文为组播报文，在第二预设时间后删除查找到的签名和对应的标志信息。
参见图8，本发明还提出了一种第四设备，至少包括：
第四接收模块，用于接收到镜像的第一下行报文；接收到来自第三设备的包含计算得到的签名的第一上行报文；接收到镜像的第二上行报文；
第四签名模块，用于计算镜像的第一下行报文的签名；获取包含计算得到的第一上行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；获取镜像的第二上行报文中的标志信息，计算镜像的第二上行报文的签名；
第四发送模块，用于向第三设备发送包含计算得到的签名的第一下行报文；
第四校验模块，用于在对应关系中查找镜像的第二上行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文的签名相同，确定第二上行报文不是特殊报文。
本发明的第四设备中，第四校验模块还用于：
在对应关系中查找不到第二上行报文中的标志信息对应的签名，或判断出查找到的签名和第二上行报文的签名不相同，确定第二上行报文为特殊报文；或者，在第一预设时间后继续执行在对应关系中查找镜像的第二上行报文中的标志信息对应的签名的步骤。
本发明的第四设备中，第四发送模块具体用于：
获取第一下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第三设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第三设备；向查找到的第三设备发送包含计算得到的签名的第一下行报文。
本发明的第四设备中，还包括：
第四删除模块，用于判断出第二上行报文为非组播报文，删除查找到的签名和对应的标志信息。
本发明的第四设备中，第四删除模块还用于：
判断出第二上行报文为组播报文，在第二预设时间后删除查找到的签名和对应的标志信息。
参见图9，本发明还提出了一种检测报文的系统，至少包括：
第一设备，用于接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，保存镜像的第一上行报文的标志信息和计算得到的签名之间的对应关系；获取包含计算得到的签名的第二上行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文；接收到镜像的第二下行报文，计算镜像的第二下行报文的签名，向第二设备发送包含计算得到的签名的第二下行报文；
第二设备，用于接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，保存镜像的第一下行报文的标志信息和计算得到的签名之间的对应关系；接收到镜像的第二上行报文，计算镜像的第二上行报文的签名，向第一设备发送包含计算得到的签名的第二上行报文；获取包含计算得到的签名的第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文。
本发明的系统中，第一设备/第二设备还用于：
在对应关系中查找不到获得的标志信息对应的签名，或判断出查找到的签名和获得的签名不相同，确定第二上行报文/第二下行报文为特殊报文；或者，在第一预设时间后继续执行在对应关系中查找获得的标志信息对应的签名的步骤。
参见图10，本发明还提出了一种检测报文的系统，至少包括：
第三设备，用于接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，向第四设备发送包含计算得到的签名的第一上行报文；获取包含计算得到的签名的第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；接收到镜像的第二下行报文，获取镜像的第二下行报文中的标志信息，计算镜像的第二下行报文的签名，在对应关系中查找镜像的第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二下行报文的签名相同，确定第二下行报文不是特殊报文；
第四设备，用于接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，向第三设备发送包含计算得到的签名的第一下行报文；获取包含计算得到的签名的第一上行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；接收到镜像的第二上行报文，获取镜像的第二上行报文中的标志信息，计算镜像的第二上行报文的签名，在对应关系中查找镜像的第二上行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文的签名相同，确定第二上行报文不是特殊报文。
本发明的系统中，第三设备/第四设备还用于：
在对应关系中查找不到第二上行报文/第二下行报文中的标志信息对应的签名，或判断出查找到的签名和第二上行报文/第二下行报文的签名不相同，确定第二上行 报文/第二下行报文为特殊报文；或者，在第一预设时间后继续执行在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名的步骤。
本申请实施例提供的检测报文的装置及系统中的各个模块或单元可以通过一个或多个数字信号处理器(DSP)、专用集成电路(ASIC)、处理器、微处理器、控制器、微控制器、现场可编程阵列(FPGA)、可编程逻辑器件或其他电子单元或其任意组合来实现。在本申请实施例中描述的一些功能或处理也可以通过在处理器上执行的软件来实现。
工业实用性
本发明涉及移动通讯和互联网领域，使得不需要中断原有网络就可以对报文进行检测，从而提高了用户体验。
需要说明的是，以上所述的实施例仅是为了便于本领域的技术人员理解而已，并不用于限制本发明的保护范围，在不脱离本发明的发明构思的前提下，本领域技术人员对本发明所做出的任何显而易见的替换和改进等均在本发明的保护范围之内。

Claims (26)

  1. 一种检测报文的方法，包括：
    第一设备/第二设备接收到镜像的第一上行报文/第一下行报文，计算镜像的第一上行报文/第一下行报文的签名，保存镜像的第一上行报文/第一下行报文的标志信息和计算得到的签名之间的对应关系；
    第二设备/第一设备接收到镜像的第二上行报文/第二下行报文，计算镜像的第二上行报文/第二下行报文的签名，向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文；
    第一设备/第二设备获取包含计算得到的签名的第二上行报文/第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文/第二下行报文不是特殊报文。
  2. 根据权利要求1所述的方法，其中，当所述第一设备/第二设备在所述对应关系中查找不到获得的标志信息对应的签名，或判断出所述查找到的签名和所述获得的签名不相同时，该方法还包括：
    所述第一设备/第二设备确定所述第二上行报文/第二下行报文为特殊报文；
    或者，所述第一设备/第二设备在第一预设时间后继续执行所述在对应关系中查找获得的标志信息对应的签名的步骤。
  3. 根据权利要求1或2所述的方法，其中，所述计算镜像的第二上行报文/第二下行报文的签名后，在所述向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文之前还包括：
    获取第二上行报文/第二下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第一设备/第二设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第一设备/第二设备；
    所述向第一设备/第二设备发送包含计算得到的签名的第二上行报文/第二下行报文包括：
    向查找到的第一设备/第二设备发送所述包含计算得到的签名的第二上行报文/第二下行报文。
  4. 根据权利要求1或2所述的方法，其中，该方法还包括：
    所述第一设备/第二设备判断出所述第二上行报文/第二下行报文为非组播报文，删除查找到的签名和对应的标志信息。
  5. 根据权利要求4所述的方法，其中，当所述第一设备/第二设备判断出所述第二上行报文/第二下行报文为组播报文时，该方法还包括：
    在第二预设时间后删除查找到的签名和对应的标志信息。
  6. 一种检测报文的方法，包括：
    第三设备/第四设备接收到镜像的第一上行报文/第一下行报文，计算镜像的第一上行报文/第一下行报文的签名，向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文；
    第四设备/第三设备获取包含计算得到的签名的第一上行报文/第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；
    第四设备/第三设备接收到镜像的第二上行报文/第二下行报文，获取镜像的第二上行报文/第二下行报文中的标志信息，计算镜像的第二上行报文/第二下行报文的签名，在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文/第二下行报文的签名相同，确定第二上行报文/第二下行报文不是特殊报文。
  7. 根据权利要求6所述的方法，其中，当所述第四设备/第三设备在所述对应关系中查找不到所述第二上行报文/第二下行报文中的标志信息对应的签名，或判断出所述查找到的签名和所述第二上行报文/第二下行报文的签名不相同时，该方法还包括：
    所述第四设备/第三设备确定所述第二上行报文/第二下行报文为特殊报文；
    或者，所述第四设备/第三设备在第一预设时间后继续执行所述在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名的步骤。
  8. 根据权利要求6或7所述的方法，其中，所述计算镜像的第一上行报文/第一下行报文的签名后，在所述向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文之前还包括：
    获取第一上行报文/第一下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第四设备/第三设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第四设备/第三设备；
    所述向第四设备/第三设备发送包含计算得到的签名的第一上行报文/第一下行报文包括：
    向查找到的第四设备/第三设备发送所述包含计算得到的签名的第一上行报文/第一下行报文。
  9. 根据权利要求6或7所述的方法，还包括：
    所述第四设备/第三设备判断出所述第二上行报文/第二下行报文为非组播报文，删除查找到的签名和对应的标志信息。
  10. 根据权利要求9所述的方法，其中，当所述第四设备/第三设备判断出所述第二上行报文/第二下行报文为组播报文时，该方法还包括：
    在第二预设时间后删除查找到的签名和对应的标志信息。
  11. 一种第一设备，至少包括：
    第一接收模块，设置为接收到镜像的第一上行报文；接收到来自第二设备的包含计算得到的签名的第二上行报文；接收到镜像的第二下行报文；
    第一签名模块，设置为计算镜像的第一上行报文的签名，保存镜像的第一上行报文的标志信息和计算得到的签名之间的对应关系；计算镜像的第二下行报文的签名；
    第一校验模块，设置为获取包含计算得到的签名的第二上行报文的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文；
    第一发送模块，设置为向第二设备发送包含计算得到的签名的第二下行报文。
  12. 根据权利要求11所述的第一设备，其中，所述第一校验模块还设置为：
    在所述对应关系中查找不到获得的标志信息对应的签名，或判断出所述查找到的签名和所述获得的签名不相同，确定所述第二上行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找获得的标志信息对应的签名的步骤。
  13. 根据权利要求11或12所述的第一设备，其中，所述第一发送模块设置为：
    获取第二下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第二设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第二设备；向查找到的第二设备发送所述包含计算得到的签名的第二下行报文。
  14. 一种第二设备，至少包括：
    第二接收模块，设置为接收到镜像的第一下行报文；接收到来自第一设备的包含计算得到的签名的第二下行报文；接收到镜像的第二上行报文；
    第二签名模块，设置为计算镜像的第一下行报文的签名，保存镜像的第一下行报文的标志信息和计算得到的签名之间的对应关系；计算镜像的第二上行报文的签名；
    第二校验模块，设置为获取包含计算得到的签名的第二下行报文的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文；
    第二发送模块，设置为向第一设备发送包含计算得到的签名的第二上行报文。
  15. 根据权利要求14所述的第二设备，其中，所述第二校验模块还设置为：
    在所述对应关系中查找不到获得的标志信息对应的签名，或判断出所述查找到的签名和所述获得的签名不相同，确定所述第二下行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找获得的标志信息对应的签名的步骤。
  16. 根据权利要求14或15所述的第二设备，其中，所述第二发送模块设置为：
    获取第二上行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP 地址网段或目的IP地址网段和第一设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第一设备；向查找到的第一设备发送所述包含计算得到的签名的第二上行报文。
  17. 一种第三设备，至少包括：
    第三接收模块，设置为接收到镜像的第一上行报文；接收到来自第四设备的包含计算得到的签名的第一下行报文；接收到镜像的第二下行报文；
    第三签名模块，设置为计算镜像的第一上行报文的签名；获取包含计算得到的第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；获取镜像的第二下行报文中的标志信息，计算镜像的第二下行报文的签名；
    第三发送模块，设置为向第四设备发送包含计算得到的签名的第一上行报文；
    第三校验模块，设置为在对应关系中查找镜像的第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二下行报文的签名相同，确定第二下行报文不是特殊报文。
  18. 根据权利要求17所述的第三设备，其中，所述第三校验模块还设置为：
    在所述对应关系中查找不到所述第二下行报文中的标志信息对应的签名，或判断出所述查找到的签名和所述第二下行报文的签名不相同，确定所述第二下行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找镜像的第二下行报文中的标志信息对应的签名的步骤。
  19. 根据权利要求17或18所述的第三设备，其中，所述第三发送模块设置为：
    获取第一上行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第四设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第四设备；向查找到的第四设备发送所述包含计算得到的签名的第一上行报文。
  20. 一种第四设备，至少包括：
    第四接收模块，设置为接收到镜像的第一下行报文；接收到来自第三设备的包含计算得到的签名的第一上行报文；接收到镜像的第二上行报文；
    第四签名模块，设置为计算镜像的第一下行报文的签名；获取包含计算得到的第一上行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；获取镜像的第二上行报文中的标志信息，计算镜像的第二上行报文的签名；
    第四发送模块，设置为向第三设备发送包含计算得到的签名的第一下行报文；
    第四校验模块，设置为在对应关系中查找镜像的第二上行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文的签名相同，确定第二上行报文不是特殊报文。
  21. 根据权利要求20所述的第四设备，其中，所述第四校验模块还设置为：
    在所述对应关系中查找不到所述第二上行报文中的标志信息对应的签名，或判 断出所述查找到的签名和所述第二上行报文的签名不相同，确定所述第二上行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找镜像的第二上行报文中的标志信息对应的签名的步骤。
  22. 根据权利要求20或21所述的第四设备，其中，所述第四发送模块设置为：
    获取第一下行报文的源互联网协议IP地址或目的IP地址，在预先设置的源IP地址网段或目的IP地址网段和第三设备之间的对应关系中，查找获得的源IP地址所在的源IP地址网段或获得的目的IP地址所在的目的IP地址网段对应的第三设备；向查找到的第三设备发送所述包含计算得到的签名的第一下行报文。
  23. 一种检测报文的系统，至少包括：
    第一设备，设置为接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，保存镜像的第一上行报文的标志信息和计算得到的签名之间的对应关系；获取包含计算得到的签名的第二上行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二上行报文不是特殊报文；接收到镜像的第二下行报文，计算镜像的第二下行报文的签名，向第二设备发送包含计算得到的签名的第二下行报文；
    第二设备，设置为接收到镜像的第一下行报文，计算镜像的第一下行报文的签名，保存镜像的第一下行报文的标志信息和计算得到的签名之间的对应关系；接收到镜像的第二上行报文，计算镜像的第二上行报文的签名，向第一设备发送包含计算得到的签名的第二上行报文；获取包含计算得到的签名的第二下行报文中的标志信息和签名，在对应关系中查找获得的标志信息对应的签名，判断出查找到的签名和获得的签名相同，确定第二下行报文不是特殊报文。
  24. 根据权利要求23所述的系统，其中，所述第一设备/第二设备还设置为：
    在所述对应关系中查找不到获得的标志信息对应的签名，或判断出所述查找到的签名和所述获得的签名不相同，确定所述第二上行报文/第二下行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找获得的标志信息对应的签名的步骤。
  25. 一种检测报文的系统，至少包括：
    第三设备，设置为接收到镜像的第一上行报文，计算镜像的第一上行报文的签名，向第四设备发送包含计算得到的签名的第一上行报文；获取包含计算得到的签名的第一下行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；接收到镜像的第二下行报文，获取镜像的第二下行报文中的标志信息，计算镜像的第二下行报文的签名，在对应关系中查找镜像的第二下行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二下行报文的签名相同，确定第二下行报文不是特殊报文；
    第四设备，设置为接收到镜像的第一下行报文，计算镜像的第一下行报文的签 名，向第三设备发送包含计算得到的签名的第一下行报文；获取包含计算得到的签名的第一上行报文中的标志信息和签名，保存获得的标志信息和签名之间的对应关系；接收到镜像的第二上行报文，获取镜像的第二上行报文中的标志信息，计算镜像的第二上行报文的签名，在对应关系中查找镜像的第二上行报文中的标志信息对应的签名，判断出查找到的签名和镜像的第二上行报文的签名相同，确定第二上行报文不是特殊报文。
  26. 根据权利要求25所述的系统，其中，所述第三设备/第四设备还设置为：
    在所述对应关系中查找不到所述第二上行报文/第二下行报文中的标志信息对应的签名，或判断出所述查找到的签名和所述第二上行报文/第二下行报文的签名不相同，确定所述第二上行报文/第二下行报文为特殊报文；或者，在第一预设时间后继续执行所述在对应关系中查找镜像的第二上行报文/第二下行报文中的标志信息对应的签名的步骤。
PCT/CN2017/070444 2016-01-06 2017-01-06 一种检测报文的方法、装置和系统 WO2017118413A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610012567.XA CN106953835B (zh) 2016-01-06 2016-01-06 一种检测报文的方法、装置和系统
CN201610012567.X 2016-01-06

Publications (1)

Publication Number Publication Date
WO2017118413A1 true WO2017118413A1 (zh) 2017-07-13

Family

ID=59273501

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/070444 WO2017118413A1 (zh) 2016-01-06 2017-01-06 一种检测报文的方法、装置和系统

Country Status (2)

Country Link
CN (1) CN106953835B (zh)
WO (1) WO2017118413A1 (zh)

Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101304407A (zh) * 2007-05-09 2008-11-12 华为技术有限公司 一种源地址认证方法、系统及装置
CN101404579A (zh) * 2008-10-31 2009-04-08 成都市华为赛门铁克科技有限公司 一种防止网络攻击的方法及装置
CN101567812A (zh) * 2009-03-13 2009-10-28 华为技术有限公司 对网络攻击进行检测的方法和装置
CN101848085A (zh) * 2009-03-25 2010-09-29 华为技术有限公司 通信系统、验证设备、报文身份的验证及签名方法
CN101860435A (zh) * 2009-04-13 2010-10-13 中国移动通信集团公司 报文发送、接收以及确定网络节点的方法及装置
CN103561001A (zh) * 2013-10-21 2014-02-05 华为技术有限公司 一种安全防护方法及路由设备
CN105471839A (zh) * 2015-11-11 2016-04-06 中国人民解放军信息工程大学 一种判断路由器数据是否被窜改的方法
CN105743863A (zh) * 2014-12-12 2016-07-06 华为技术有限公司 一种对报文进行处理的方法及装置
CN105743649A (zh) * 2014-12-11 2016-07-06 中兴通讯股份有限公司 一种用户签名、解用户签名的方法、装置和系统
CN105763390A (zh) * 2014-12-16 2016-07-13 中兴通讯股份有限公司 一种网络异常流量的检测和控制方法、装置和系统
CN105763328A (zh) * 2014-12-16 2016-07-13 中兴通讯股份有限公司 一种分片报文传输方法和网络设备

Family Cites Families (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103067199B (zh) * 2012-12-19 2015-11-25 华为技术有限公司 深度报文检测结果扩散方法及装置

Patent Citations (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101304407A (zh) * 2007-05-09 2008-11-12 华为技术有限公司 一种源地址认证方法、系统及装置
CN101404579A (zh) * 2008-10-31 2009-04-08 成都市华为赛门铁克科技有限公司 一种防止网络攻击的方法及装置
CN101567812A (zh) * 2009-03-13 2009-10-28 华为技术有限公司 对网络攻击进行检测的方法和装置
CN101848085A (zh) * 2009-03-25 2010-09-29 华为技术有限公司 通信系统、验证设备、报文身份的验证及签名方法
CN101860435A (zh) * 2009-04-13 2010-10-13 中国移动通信集团公司 报文发送、接收以及确定网络节点的方法及装置
CN103561001A (zh) * 2013-10-21 2014-02-05 华为技术有限公司 一种安全防护方法及路由设备
CN105743649A (zh) * 2014-12-11 2016-07-06 中兴通讯股份有限公司 一种用户签名、解用户签名的方法、装置和系统
CN105743863A (zh) * 2014-12-12 2016-07-06 华为技术有限公司 一种对报文进行处理的方法及装置
CN105763390A (zh) * 2014-12-16 2016-07-13 中兴通讯股份有限公司 一种网络异常流量的检测和控制方法、装置和系统
CN105763328A (zh) * 2014-12-16 2016-07-13 中兴通讯股份有限公司 一种分片报文传输方法和网络设备
CN105471839A (zh) * 2015-11-11 2016-04-06 中国人民解放军信息工程大学 一种判断路由器数据是否被窜改的方法

Also Published As

Publication number Publication date
CN106953835A (zh) 2017-07-14
CN106953835B (zh) 2020-05-22

Similar Documents

Publication Publication Date Title
US10505907B2 (en) Securely recognizing mobile devices
US9787717B2 (en) Intelligent security analysis and enforcement for data transfer
US9294461B2 (en) Virtual private network dead peer detection
CN106330944B (zh) 恶意系统漏洞扫描器的识别方法和装置
US9185121B2 (en) Detecting malicious circumvention of virtual private network
JP2018528647A5 (zh)
EP3021549A1 (en) Terminal authentication apparatus and method
WO2014032612A1 (zh) 防止信息泄露的方法、装置、服务器、系统和设备
CN109347700B (zh) 一种测试方法、装置、电子设备和存储介质
WO2013091435A1 (zh) 文件类型识别方法及文件类型识别装置
WO2015085848A1 (zh) 一种安全认证方法和双向转发检测bfd设备
US9246930B2 (en) System and method for pattern matching in a network security device
JP2012034129A (ja) 管理サーバ、通信遮断装置、情報処理システム、方法およびプログラム
WO2019057023A1 (zh) 数据恢复方法、发送/接收装置和计算机可读存储介质
WO2017185978A1 (zh) 一种报文解析方法及设备
US10122755B2 (en) Method and apparatus for detecting that an attacker has sent one or more messages to a receiver node
CN110943840A (zh) 一种签名验证方法及系统
CN109617972B (zh) 一种连接建立方法、装置、电子设备及存储介质
WO2019047693A1 (zh) 一种进行WiFi网络安全监控的方法与设备
WO2017118413A1 (zh) 一种检测报文的方法、装置和系统
US9027096B2 (en) Method and device for enhancing security of user security model
JP5551061B2 (ja) 情報処理装置、アドレス重複対処方法およびアドレス重複対処用プログラム
US8438637B1 (en) System, method, and computer program product for performing an analysis on a plurality of portions of potentially unwanted data each requested from a different device
CN108055262B (zh) 视频会议终端注册方法、终端及网守
CN113992387B (zh) 资源管理方法、装置、系统、电子设备和可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17735851

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 17735851

Country of ref document: EP

Kind code of ref document: A1