WO2018001042A1 - 报文传输方法、装置及系统 - Google Patents

报文传输方法、装置及系统 Download PDF

Info

Publication number
WO2018001042A1
WO2018001042A1 PCT/CN2017/087102 CN2017087102W WO2018001042A1 WO 2018001042 A1 WO2018001042 A1 WO 2018001042A1 CN 2017087102 W CN2017087102 W CN 2017087102W WO 2018001042 A1 WO2018001042 A1 WO 2018001042A1
Authority
WO
WIPO (PCT)
Prior art keywords
index information
packet
quintuple
transmission parameter
gateway
Prior art date
Application number
PCT/CN2017/087102
Other languages
English (en)
French (fr)
Inventor
尤建洁
魏含宇
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP17819039.3A priority Critical patent/EP3468120A4/en
Publication of WO2018001042A1 publication Critical patent/WO2018001042A1/zh
Priority to US16/225,711 priority patent/US20190149513A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H04L47/24—Traffic characterised by specific attributes, e.g. priority or QoS
    • H04L47/2441—Traffic characterised by specific attributes, e.g. priority or QoS relying on flow classification, e.g. using integrated services [IntServ]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/029—Firewall traversal, e.g. tunnelling or, creating pinholes
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/02—Details
    • H04L12/14—Charging, metering or billing arrangements for data wireline or wireless communications
    • H04L12/1403—Architecture for metering, charging or billing
    • H04L12/1407—Policy-and-charging control [PCC] architecture
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H04L45/745—Address table lookup; Address filtering
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0281—Proxies
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/329—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the application layer [OSI layer 7]

Definitions

  • the present invention relates to the field of security, and in particular, to a message transmission method, apparatus, and system.
  • the prior art deploys a network operator's intermediate agent system between the client and the content provider's server, when the client sends a service request to the server.
  • the request message sent by the client is intercepted by the intermediate proxy system, and the intermediate proxy system replaces the server to establish a connection with the client, and the intermediate proxy system replaces the client to establish a connection with the server.
  • the data flow between the client and the intermediate proxy system, the intermediate proxy system and the data flow between the server are encrypted data streams, and the intermediate proxy system has the corresponding key to encrypt The data stream is decrypted. Therefore, the intermediate proxy system can acquire the application content in the data stream and process the content-aware service according to the application content.
  • the intermediate proxy system generally needs to decrypt the encrypted data stream in the credit mode or the cooperation mode, that is, the content provider needs to own
  • the key is shared with the network agent's intermediate agent system, and the intermediate agent system can decrypt the encrypted data stream according to the key to obtain the application content in the data stream, and then process the content-aware service.
  • network service providers are generally reluctant to provide keys to intermediate agent systems.
  • an embodiment of the present invention provides a packet transmission method, apparatus, and system.
  • the technical solution is as follows:
  • a first aspect of the present invention provides a packet transmission method, which is applied to a server of a content provider, where the method includes: receiving an application request sent by a client; and acquiring encrypted data of the original data requested by the application request; Generating a first packet including the encrypted data; adding index information to the first packet to obtain a second packet; and sending a second packet to a gateway of the network operator, where the index information is used to indicate the The gateway determines the transmission parameter corresponding to the index information, and sends the encrypted data to the user end according to the transmission parameter, where the transmission parameter includes at least one of a resource type, a priority, a delay, a packet loss rate, and a service type.
  • the server obtains the encrypted data corresponding to the application request sent by the user, generates the first packet including the encrypted data, adds the index information to the first packet, obtains the second packet, and sends the second packet.
  • the gateway to the network operator determines the transmission parameter corresponding to the index information by using the gateway, so that the gateway sends the first packet according to the transmission parameter. That is, when transmitting the encrypted data, the present invention adds the index information that the gateway in the carrier network can recognize in the message, so that only the transmission parameter needs to be determined according to the index information, and the existing data can be encrypted without changing the existing data.
  • the encryption method and the existing business process enable the network operator to rely on the content-aware service to be used normally without reducing the security and privacy of the service.
  • the gateway includes a policy and charging execution function PCEF and a policy and charging rule function PCRF;
  • the method further includes: acquiring a first quintuple in the application request, where a source Internet Protocol IP address of the first quintuple is The IP address of the client, the destination IP address is the IP address of the server, the source port number is the port number of the client, and the destination port number is the port number of the server; The source IP address and the destination IP address are exchanged, and the source port number and the destination port number in the first quintuple are exchanged to obtain a second quintuple; and the second five is searched according to the quintuple mapping table.
  • a source Internet Protocol IP address of the first quintuple is The IP address of the client
  • the destination IP address is the IP address of the server
  • the source port number is the port number of the client
  • the destination port number is the port number of the server
  • the source IP address and the destination IP address are exchanged, and the source port number and the destination port number in the first quintuple are exchanged to obtain a second quintuple; and
  • each entry of the quintuple mapping table includes a quintuple and corresponding index information; and the second quintuple and the index information are sent to the PCRF,
  • the PCRF is configured to generate a detection policy including the second quintuple and the index information, where the detection policy is used to instruct the PCEF to determine a packet to be verified according to the second quintuple, and verify the The quintuple and the place in the message to be verified Index information message to be authenticated satisfy a predetermined relationship, for indicating said predetermined relationship allows the transmission parameters to transmit data corresponding to the index information.
  • the adding the index information to the first packet includes: according to the five-element The group mapping table searches for index information corresponding to the second quintuple, and adds the index information to the first packet.
  • the method further includes: establishing a mutual trust relationship with the gateway by using the PCRF.
  • a second aspect of the present invention provides a packet transmission method, which is applied to an operator network, where the method includes:
  • the gateway receives the second packet that is sent by the server of the content provider and includes the index information, where the second packet is obtained by adding the index information to the first packet, where the first packet is sent according to the user end. Encrypted data generated by the application requesting the original data requested;
  • a transmission parameter corresponding to the index information Determining, by the gateway, a transmission parameter corresponding to the index information, where the transmission parameter includes at least one of a resource type, a priority, a delay, a packet loss rate, and a service type;
  • the gateway sends the encrypted data to the client according to the transmission parameter.
  • the gateway receives the second packet including the index information, and the second packet is obtained by adding the index information to the first packet, where the first packet includes the request according to the application request sent by the user end.
  • the encrypted data generated by the original data; the gateway determines a transmission parameter corresponding to the index information, and sends the first packet according to the transmission parameter. That is, when transmitting the encrypted data, the present invention adds the index information that the gateway can recognize in the carrier network, so that the gateway only needs to determine the transmission parameter according to the index information, and can change the current data in the case of universal encryption.
  • the determining, by the gateway, the transmission parameter corresponding to the index information the determining, by the gateway, determining, according to the pre-stored transmission parameter mapping table,
  • the transmission parameter corresponding to the index information in the second packet, each entry of the transmission parameter mapping table includes an index information and a corresponding at least one transmission parameter.
  • the gateway includes a policy and charging rule function PCRF and a policy and charging execution function PCEF;
  • the method further includes: the PCRF receiving the second quintuple sent by the server, and the index information,
  • the index information is index information corresponding to the second quintuple found by the server according to the quintuple mapping table;
  • the second quintuple is the first five of the server requests by the server
  • the source IP address and the destination IP address in the tuple are exchanged, and the source port number and the destination port number in the first quintuple are exchanged;
  • the PCRF generation includes the second quintuple and a detection policy of the index information, and sending a detection policy to the PCEF; the PCEF receiving the detection policy;
  • Determining, by the gateway, the transmission parameter corresponding to the index information in the second packet according to the pre-stored transmission parameter mapping table including: the PCEF verifying the second packet according to the detection policy, after the verification is passed And determining, according to the transmission parameter mapping table, the transmission parameter corresponding to the index information.
  • the PCEF verifies the second packet, including:
  • the PCEF detects whether the quintuple in the second packet is the same as the second quintuple in the detection policy, and the index information in the second packet is in the detection policy. Whether the index information is the same;
  • the PCEF detects whether the quintuple in the second packet and the index information in the second packet meet a predetermined relationship, where the predetermined relationship is used to indicate that the transmission parameter corresponding to the index information is allowed. transfer data;
  • the PCRF receives the second quintuple and the index information sent by the server Previously, the method further includes: the gateway establishing a mutual trust relationship with the server by using the PCRF.
  • a message transmission apparatus for use in a server of a content provider, the apparatus comprising at least one unit for implementing the above first aspect or at least one implementation of the first aspect The message transmission method provided.
  • a fourth aspect provides a message transmission apparatus for a gateway in an operator network, the apparatus comprising at least one unit, wherein the at least one unit is configured to implement at least one of the foregoing second aspect or the second aspect The message transmission method provided.
  • a server for a content provider comprising: a processor, and a transceiver and a memory connected to the process;
  • the transceiver is configured to be controlled by a processor to enable communication with other entities for storing program instructions.
  • the processor is configured to invoke the program instructions to implement the message transmission method provided in the above first aspect or at least one implementation manner of the first aspect.
  • FIG. 1 is a schematic structural diagram of a message transmission system according to an embodiment of the present invention.
  • FIG. 2 is a schematic structural diagram of a message transmission system according to an embodiment of the present invention.
  • FIG. 3 is a schematic structural diagram of a server of a content provider according to an embodiment of the present invention.
  • FIG. 4 is a flowchart of a method for transmitting a message according to an embodiment of the present invention.
  • FIG. 5 is a flowchart of another method for transmitting a message according to an embodiment of the present invention.
  • FIG. 6 is a block diagram of a message transmission apparatus according to an embodiment of the present invention.
  • FIG. 7 is a block diagram of another message transmission apparatus according to an embodiment of the present invention.
  • a “module” as referred to herein refers to a program or instruction stored in a memory that is capable of implementing certain functions;
  • "unit” as referred to herein refers to a functional structure that is logically divided, the “unit” may be Pure hardware implementation, or a combination of hardware and software.
  • FIG. 1 shows a schematic structural diagram of an exemplary message transmission system provided by the present invention.
  • the message transmission system includes a server 110, a carrier network 120, and a client 130 of a content provider.
  • the operator network is a network managed and operated by the network operator.
  • the server 110 is configured to receive various application requests of the Hypertext Transfer Protocol (HTTP) 1.1/HTTP2 and other service definitions sent by the user terminal 130, and respond to the application request sent by the user terminal 130, and provide the network operator.
  • HTTP Hypertext Transfer Protocol
  • the network device, gateway 121 in the carrier network 120 provides encrypted or unencrypted data to the client 130.
  • the client 130 is a general user terminal or any client that performs network access, such as a client of a video software installed on the user's mobile phone.
  • the server 110 After receiving the application request sent by the user terminal 130, the server 110 acquires the encrypted data of the original data requested by the application request, generates a first packet including the encrypted data, adds index information to the first packet, and obtains the second report. Text.
  • the control information needs to be sent to the gateway 121 in the operator network 120 in a signaling manner, so that the gateway 121 can process the second. Message.
  • the gateway 121 in the carrier network 120 may include a policy management system.
  • the policy management system is a Policy and Control and Charging (PCC) system.
  • PCC Policy and Control and Charging
  • the policy management system is configured to verify the second packet, and transmit the encrypted data in the second packet according to the transmission parameter corresponding to the index information in the second packet.
  • the gateway 121 includes a Policy and Charging Rules Function (PCRF) 1211 and a Policy and Charging Enforcement Function (PCEF) 1212.
  • PCRF1211 and PCEF1212 can be located on the same hardware device or not. On the same hardware device.
  • the carrier network 120 may further include a transmission device (not shown), wherein the transmission device may be any one of a routing device, an intermediate device, and a conversion device.
  • the server 110 after receiving the application request sent by the client 130, the server 110 obtains the second quintuple according to the first quintuple in the application request. Determining the index information corresponding to the second quintuple, and sending the second quintuple and the corresponding index information to the PCRF 1211, and the PCRF 1211 receives the second quintuple and the corresponding index information, and sends the second quintuple and the corresponding index information to the PCEF 1212, including the second A detection strategy for quintuple and corresponding index information.
  • the server 110 obtains the encrypted data of the original data requested by the application request, generates a first packet including the encrypted data, adds index information to the first packet, obtains the second packet, and then obtains the second packet.
  • the file is sent to the PCEF 1212, and the PCEF 1212 verifies the quintuple and the index information in the second packet according to the received detection policy.
  • the PCEF 1212 determines the transmission parameter corresponding to the index information that satisfies the predetermined relationship; The parameter sends the encrypted data to the client 130.
  • the server 110 and the PCRF 1211 establish a mutual trust relationship.
  • FIG. 3 is a schematic structural diagram of the server 110 according to an embodiment of the present invention.
  • the server 110 includes a transceiver 311, a processor 312, and a memory 313.
  • the processor 312 is connected to the transceiver 311 and the memory 313.
  • the transceiver 311 may be composed of one or more input and output ports, configured to be controlled by the processor to implement communication with other entities, for example, to receive an application request sent by the client, and send the index to the gateway in the operator network.
  • the second message of the information, the index information is used to indicate the transmission parameter of the encrypted data in the second message.
  • Processor 312 includes one or more processing cores.
  • the processor 312 executes various software applications and data processing to execute various functional applications and data processing, such as: acquiring encrypted data of the original data requested by the application request, and generating a first packet including the encrypted data, which is the first packet. Add index information to get the second message.
  • the memory 313 stores a quintuple mapping table and original data and data encryption policies for responding to application requests sent by the client, each entry of the quintuple mapping table including a quintuple and corresponding index information. .
  • the memory 313 is also used to store system programs and program instructions. Memory 313 can store operating system 31 and program instructions 32 required for at least one function.
  • the program instructions 32 may include an acquisition module 321, a generation module 322, an add module 323, and the like.
  • the obtaining module 321 is configured to acquire encrypted data corresponding to the application request.
  • the generating module 322 is configured to generate a first packet that includes the encrypted data.
  • the adding module 323 is configured to add index information to the first packet to obtain a second packet.
  • Memory 313 can be implemented by any type of volatile or non-volatile storage device, or a combination thereof, such as Static random access memory (SRAM), dynamic random access memory (DRAM), electrically erasable programmable read-only memory (EEPROM), Erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic memory, flash Memory, disk or disc.
  • SRAM Static random access memory
  • DRAM dynamic random access memory
  • EEPROM electrically erasable programmable read-only memory
  • EPROM Erasable programmable read-only memory
  • PROM programmable read-only memory
  • ROM read-only memory
  • magnetic memory magnetic memory
  • flash Memory disk or disc.
  • server 110 does not constitute a limitation on the server 110.
  • the server in the present invention may include more or less components or combinations of some components than illustrated. , or different parts layout.
  • FIG. 4 is a flowchart of a message transmission method according to an embodiment of the present invention. This embodiment is exemplified by applying the method to the message transmission system shown in FIG. 1. The method includes the following steps:
  • Step 401 The server receives an application request sent by the client.
  • the user performs an operation of acquiring data on the client, and the client sends an application request for acquiring data to the server.
  • the user uses a client of a content provider on the mobile phone to watch a video.
  • the client on the mobile phone sends an application request for acquiring the video to the server of the content provider.
  • the server receives an application request sent by the client.
  • Step 402 The server acquires encrypted data of the original data requested by the application request.
  • the server obtains the original data requested by the application request, and encrypts the original data according to a predetermined data encryption policy to obtain encrypted data.
  • the original data requested by the application request is the video resource of the xx video
  • the server encrypts the video resource to obtain the encrypted data
  • step 403 the server generates a first message including the encrypted data.
  • the server obtains the first quintuple from the application request, where the first quintuple in the application request includes a source Internet Protocol (IP) address (ie, an IP address of the client) and a source port number (ie, the client side) The port number), the destination IP address of the client (that is, the IP address of the server), the destination port (that is, the port number of the server), and the protocol number of the transport layer.
  • IP Internet Protocol
  • the first quintuple is used to generate the first report of the encrypted data. Text.
  • the server exchanges the source IP address and the destination IP address in the first quintuple, the source port number and the destination port number are exchanged, and the second quintuple is obtained, and the first report is generated according to the second quintuple. Text.
  • Step 404 The server adds index information to the first packet to obtain a second packet.
  • the index information is information used to indicate that the gateway in the carrier network determines the transmission parameter corresponding to the index information, and also That is, the index information is used to determine the transmission parameters corresponding to the encrypted data.
  • the server determines a transmission parameter for transmitting the encrypted data, and then determines the index information according to the transmission parameter, and adds the determined index information to the first packet to obtain the second packet.
  • Step 405 The server sends a second packet to a gateway in the carrier network.
  • the server sends the second packet to the gateway of the network operator, and the gateway has the capability of identifying the index information.
  • Step 406 The gateway in the operator network receives the second packet that is sent by the server and includes the index information.
  • the second packet received by the gateway includes not only the index information but also the encrypted data of the original data requested by the application sent by the UE.
  • Step 407 The gateway determines a transmission parameter corresponding to the index information.
  • the gateway determines, according to the transmission parameter mapping table, a transmission parameter corresponding to the index information in the second packet.
  • Each entry of the transmission parameter mapping table includes an index information and a corresponding at least one transmission parameter.
  • Step 408 The gateway sends the encrypted data to the UE according to the transmission parameter.
  • the gateway directly sends the second packet to the UE according to the transmission parameter.
  • the UE After receiving the second packet, the UE obtains the encrypted data according to the second packet, and then parses the encrypted data to obtain a corresponding packet. The raw data requested by the application.
  • the gateway deletes the index information in the second packet to obtain the first packet, and sends the first packet to the UE according to the transmission parameter. After receiving the first packet, the UE obtains the encrypted data according to the first packet, and then parses the encrypted data to obtain original data corresponding to the application request.
  • steps 401 to 405 can be implemented separately as an embodiment on the server side, and the steps 406 to 408 can be separately implemented as an embodiment on the operator network side.
  • the packet transmission method generateds the first packet including the encrypted data by adding the encrypted data corresponding to the application request sent by the user end, and adds the index information to the first packet.
  • Obtaining a second packet the second packet is sent to a gateway in the carrier network, the gateway determines a transmission parameter corresponding to the index information, and sends the encrypted data to the user end according to the transmission parameter.
  • the embodiment of the invention enables the network operator to use the key to decrypt the encrypted data to obtain the content transmitted by the content provider, and only needs to determine the transmission parameter according to the index information, and can change the existing data without the data being generally encrypted.
  • the encryption method and the existing business process enable the network operator to rely on the content-aware service to be used normally without reducing the security and privacy of the service.
  • FIG. 5 is a flowchart of a message transmission method according to another embodiment of the present invention. This embodiment is applied to the gateway 120 shown in FIG. 2 in this way, and the gateway includes a PCEF and a PCRF.
  • the method includes The following steps:
  • step 501 the server establishes a mutual trust relationship with the gateway through the PCRF in the gateway in the carrier network.
  • the PCRF establishes a mutual trust relationship with the server.
  • the server provides the PCRF with an identity such as an IP address, a certificate, a media access control (MAC) address, etc., to establish a mutual trust relationship with the PCRF; or the server and the PCRF utilize network protocol security (Internet)
  • IPsec protocol security
  • This embodiment does not limit the manner in which the server establishes a mutual trust relationship with the PCRF.
  • Step 502 The server receives an application request sent by the client.
  • step 401 in FIG. 4 For specific implementation of this step, reference may be made to step 401 in FIG.
  • step 503 the server acquires the first five-tuple in the application request.
  • the source IP address of the first quintuple is the IP address of the client
  • the destination IP address is the IP address of the server
  • the source port number is the port number of the client
  • the destination port number is the port number of the server.
  • Step 504 The server exchanges the source IP address and the destination IP address in the first quintuple, and exchanges the source port number and the destination port number in the first quintuple to obtain the second quintuple.
  • Step 505 The server searches for index information corresponding to the second quintuple according to the quintuple mapping table.
  • Each entry of the quintuple mapping table includes a correspondence between a quintuple and an index information.
  • Table 1 schematically shows the correspondence between the quintuple and the index information:
  • the server exchanges the source IP address and the destination IP address of the first quintuple, and exchanges the source port number and the destination port number in the first quintuple.
  • the second quintuple is obtained as the quintuple 3 in Table 1, the corresponding index information is determined to be the index information 3.
  • the quintuple mapping table may be jointly negotiated by the content provider and the network operator, and the embodiment is not limited. Determine how the correspondence is obtained.
  • Step 506 The server sends the index information corresponding to the second quintuple and the second quintuple to the PCRF.
  • the PCRF is used to generate a detection policy including the second quintuple and the index information.
  • the detection policy is used to instruct the PCEF to determine the packet to be verified according to the second quintuple and the index information, and verify the five in the packet to be verified. Whether the index information in the tuple and the message to be verified satisfies a predetermined relationship; the predetermined relationship is used to indicate that the data is allowed to be transmitted with the transmission parameter corresponding to one index information.
  • Step 507 The PCRF in the operator network receives the second quintuple and index information sent by the server.
  • step 508 the PCRF in the operator network sends a detection policy to the PCEF.
  • the detection strategy includes the second quintuple and index information received by the PCRF.
  • step 509 the PCEF receives the detection policy sent by the PCRF.
  • the server may not send the second quintuple and index information to the policy management system.
  • the server does not send the second quintuple and index information to the PCRF in the policy management system
  • the PCRF does not send the detection to the PCEF.
  • the policy that is, steps 506 through 509 are not performed.
  • Step 510 The server acquires encrypted data of the original data requested by the application request.
  • the server acquires the original data requested by the application request, and encrypts the original data according to a predetermined data encryption policy to obtain encrypted data of the original data requested by the application request.
  • the original data requested by the application request is the video resource of the xx video
  • the server encrypts the video resource to obtain the encrypted data
  • step 511 the server generates a first message including encrypted data.
  • Step 512 The server searches for the index information corresponding to the second quintuple in the first packet according to the quintuple mapping table, and adds the index information to the first packet to obtain the second packet.
  • the quintuple mapping table may be obtained by the content provider and the network operator.
  • the embodiment does not limit the acquiring manner of the corresponding relationship.
  • the index information is a Quality of Service Class Identifier (QCI).
  • QCI Quality of Service Class Identifier
  • the index information is QCI as an example, and is described in detail.
  • each entry of the quintuple mapping table includes a quintuple and a corresponding QCI value, for example, quintuple 1 corresponds to QCI1, and QCI1 indicates that the QCI value is 1.
  • the manner of adding index information to the first packet depends on the negotiation between the content provider and the network operator, for example, adding index information in a newly added TCP Option field, or in enhanced security. Adding index information in a Transport Layer Security (TLS) field, the embodiment of the present invention The manner in which the index information is added is not limited.
  • TLS Transport Layer Security
  • step 513 the server sends a second packet with the index information added to the PCEF.
  • the index information is used to instruct the PCEF to determine a transmission parameter corresponding to the index information, and send the encrypted data according to the transmission parameter.
  • the transmission parameter includes at least one of a resource type, a priority, a delay, a packet loss rate, and a service type.
  • the correspondence between the index information and the transmission parameter may be obtained by the content provider and the network operator.
  • the embodiment does not limit the manner in which the correspondence is obtained.
  • the index information as an example of QCI, as shown in Table 2, it exemplarily shows a transmission parameter mapping table between QCI and transmission parameters:
  • each QCI value corresponds to four transmission parameters, which are resource type, priority, delay, and packet loss rate.
  • the resource types include: Guaranteed Bit Rate (GBR) and Non-GBR.
  • GBR Guaranteed Bit Rate
  • Non-GBR Non-GBR
  • Step 514 The PCEF in the operator network receives the second packet that is sent by the server and includes the index information.
  • the second packet is obtained by adding index information to the first packet, where the first packet includes the response according to the user end. Encrypted data generated with the original data requested by the request.
  • Step 515 The PCEF in the carrier network verifies the second packet according to the detection policy.
  • the PCEF detects whether the quintuple in the second packet is the same as the quintuple in the detection policy, and detects whether the index information in the second packet is the same as the index information in the detection policy. If the quintuple in the second packet is the same as the quintuple in the detection policy, and the index information in the second packet is the same as the index information in the detection policy, the PCEF further detects the five-element in the second packet. Whether the index information in the group and the second message satisfies a predetermined relationship. If the detection result is that the quintuple in the second packet and the index information in the second packet satisfy the predetermined relationship, it is determined that the verification of the second packet is passed. The predetermined relationship is used to indicate that the data is allowed to be transmitted with the transmission parameter corresponding to the index information.
  • step 516 is performed; when the PCEF detects the index information in the second packet and the first packet
  • the index information may be modified to continue to transmit the second packet by using the index information that satisfies the predetermined relationship, or the second packet may be discarded.
  • the quintuple 1 corresponds to QCI1
  • the PCEF detects that the quintuple in the second packet is quintuple 1, and the index information is QCI2, and the PCEF modifies the QCI2 to QCI1 and continues to transmit the second packet. Or discard the second message.
  • the server does not send the quintuple and the index information to the PCRF in the policy management system, that is, when the steps 506 to 509 are not performed, the step 516 is not performed, and the step 516 is directly executed.
  • step 516 the PCEF in the operator network determines the transmission parameter corresponding to the index information.
  • the PCEF determines a transmission parameter corresponding to the index information in the second packet according to the pre-stored quintuple mapping table.
  • the index information in the second packet is QCI3 after the second packet is received by the PCEF.
  • the transmission parameter is GBR
  • the priority is 3
  • the delay is 50 ms
  • the packet loss rate is 10. -3 .
  • Step 517 The gateway in the carrier network sends the encrypted data to the UE according to the transmission parameter.
  • the PCEF in the carrier network sends the determined transmission parameters to the transmission device, and the transmission device sends the encrypted data to the UE according to the transmission parameters.
  • the transmission device sends the encrypted data in the message to the UE according to the transmission parameter and the quintuple in the second packet.
  • the transmission parameter is GBR
  • the priority is 3
  • the delay is 50ms
  • the packet loss rate is 10 -3
  • the encrypted data in the packet is allocated to meet the resource type GBR
  • the priority is 3.
  • the packet loss rate is 10 -3 traffic
  • the encrypted data is transmitted according to the allocated traffic.
  • the transmitting device sends the second packet to the UE according to the transmission parameter.
  • the UE After receiving the second packet, the UE obtains the encrypted data according to the second packet, and parses the encrypted data to obtain the corresponding data. Apply the requested raw data.
  • the transmitting device deletes the index information in the second packet to obtain the first packet, and sends the first packet to the UE according to the transmission parameter. After receiving the first packet, the UE receives the first packet according to the transmission parameter. The first message gets the encrypted data, and then the encrypted data is parsed to obtain the original data corresponding to the application request.
  • steps 501 to 506 and steps 510 to 513 can be separately implemented as an embodiment on the server side, and steps 507 to 509 and 514 to 517 can be separately implemented as an embodiment on the operator network side.
  • the packet transmission method obtains the first packet including the encrypted data by acquiring the encrypted data corresponding to the application request sent by the user end, and adds the index information to the first packet.
  • the second packet sends the second packet to the gateway in the carrier network, and the gateway determines the transmission parameter corresponding to the index information, and sends the encrypted data to the client according to the transmission parameter.
  • the embodiment of the invention enables the network operator to use the key to decrypt the encrypted data to obtain the content transmitted by the content provider, and only needs to determine the transmission parameter according to the index information, and can change the existing data without the data being generally encrypted.
  • the encryption method and the existing business process enable the network operator to rely on the content-aware service to be used normally without reducing the security and privacy of the service.
  • the present invention also sends the index information and the quintuple to the PCRF in the network operator by using the server, and the PCRF sends the detection policy including the index information and the quintuple to the PCEF, and the PCEF detects the index in the received message according to the detection policy. Whether the information and the quintuple in the packet satisfy the predetermined relationship. When the index information in the packet satisfies the predetermined relationship with the quintuple in the packet, the PCEF determines the transmission parameter corresponding to the index information, which can effectively avoid the PCEF. The problem of transmitting encrypted data in a message using a transmission parameter that is not allowed by the network operator.
  • FIG. 6 shows a block diagram of a message transmission apparatus according to an embodiment of the present invention.
  • the message transmission device can be implemented as all or part of the server by software, hardware or a combination of both.
  • the message transmission device includes:
  • the receiving unit 610 is configured to implement the functions of steps 401 and 502.
  • the obtaining unit 620 is configured to implement the functions of steps 402, 503, 504, 505, and 510.
  • the generating unit 630 is configured to implement the functions of steps 403 and 511.
  • Adding unit 640 is used to implement the functions of steps 404 and 512.
  • the sending unit 650 is configured to implement the functions of steps 405, 506, and 513.
  • the message transmission device may further comprise an establishing unit for implementing the functions of the above step 501.
  • receiving unit 610 and the sending unit 650 may be implemented by a transceiver in a server of a content provider, and the obtaining unit 620, the generating unit 630, and the adding unit 640 may pass through a server.
  • the processor executes the program instructions in the memory to implement.
  • FIG. 7 is a block diagram of a message transmission apparatus according to another embodiment of the present invention.
  • the message transmission device can be implemented as all or part of the operator network by software, hardware or a combination of both.
  • the message transmission device may be a gateway in an operator network, and the device includes:
  • the receiving unit 710 is configured to implement the function of step 406.
  • the sending unit 720 is configured to implement the functions of the steps 408 and 517.
  • the determining unit 730 is configured to implement the function of step 407.
  • the gateway further includes a policy and charging rule function PCRF and a policy and charging execution function PCEF, which are used to implement the functions of steps 501, 507 and 508.
  • the PCEF is used to implement the functions of steps 514 through 516.
  • the disclosed apparatus and method may be implemented in other manners.
  • the device embodiments described above are merely illustrative.
  • the division of the unit may be only a logical function division.
  • there may be another division manner for example, multiple units or components may be combined. Or it can be integrated into another system, or some features can be ignored or not executed.
  • the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, may be located in one place, or may be distributed to multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of the embodiment.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本发明公开了一种报文传输方法、装置及系统，属于安全领域。所述方法应用于内容提供商的服务器中，所述方法包括：接收用户端发送的应用请求；获取所述应用请求所请求的原始数据的加密数据；生成包括所述加密数据的第一报文；并为第一报文添加索引信息得到第二报文，将第二报文发送至运营商网络中的网关；网关确定与索引信息对应的传输参数，根据传输参数将加密数据发送给用户端。在报文中添加运营商网络中的网关能识别的索引信息使得只需要根据索引信息确定传输参数，能够在数据普遍加密的情况下，不改变现有的加密方式和现有的业务流程，使网络运营商依托于内容感知的业务能够正常使用，并且不降低业务的安全性和隐私性。

Description

报文传输方法、装置及系统
本申请要求于2016年6月28日提交中国专利局、申请号为201610485497.X、发明名称为“报文传输方法、装置及系统”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本发明涉及安全领域，特别涉及一种报文传输方法、装置及系统。
背景技术
随着人们对网络访问安全、隐私保护问题的广泛重视，内容提供商对传输到网络上的数据流的进行加密成为越来越普遍的现象。然而，数据流被加密后，数据流中传输的应用内容也被加密，网络运营商无法获取该应用内容，从而无法识别数据流中的业务类型，进而无法处理一些依托于内容感知的业务，例如，加速，流量管理，过滤等。
为了解决网络运营商无法处理依托于内容感知的业务的问题，现有技术在用户端和内容提供商的服务器之间部署一个网络运营商的中间代理系统，当用户端向该服务器发送服务请求时，用户端发送的请求消息被中间代理系统截获，中间代理系统代替该服务器和该用户端建立连接，中间代理系统再代替该用户端和该服务器建立连接。在用户访问的整个过程中，用户端和中间代理系统之间的数据流、中间代理系统和该服务器之间的数据流均为加密的数据流，且中间代理系统拥有相应的密钥可以对加密的数据流进行解密，因此，中间代理系统可以获取数据流中的应用内容，根据应用内容处理依托于内容感知的业务。
在实现本发明的过程中，发明人发现现有技术至少存在以下问题：中间代理系统一般需要在授信模式或合作模式下才能够对加密的数据流进行解密，也即需要内容提供商将自己的密钥分享给网络运营商的中间代理系统，中间代理系统才能够依据密钥对加密的数据流进行解密，以获取数据流中的应用内容，进而处理依托于内容感知的业务。然而，网络业务提供商一般不愿意将密钥提供给中间代理系统。
发明内容
为了解决现有技术的问题，本发明实施例提供了一种报文传输方法、装置及系统。所述技术方案如下：
本发明第一方面提供了一种报文传输方法，应用于内容提供商的服务器中，所述方法包括：接收用户端发送的应用请求；获取所述应用请求所请求的原始数据的加密数据； 生成包括所述加密数据的第一报文；为所述第一报文添加索引信息，得到第二报文；向网络运营商的网关发送第二报文，所述索引信息用于指示所述网关确定所述索引信息对应的传输参数，根据所述传输参数向所述用户端发送所述加密数据，传输参数包括资源类型、优先级、时延、丢包率、服务类型中的至少一个。
本发明中，服务器获取与用户端发送的应用请求对应的加密数据，生成包括加密数据的第一报文，并为第一报文添加索引信息，得到第二报文，将第二报文发送至网络运营商的网关，利用网关确定与索引信息对应的传输参数，使网关根据传输参数发送第一报文。即，本发明在传输加密数据时，在报文中添加运营商网络中的网关能识别的索引信息，使得只需要根据索引信息确定传输参数，能够在数据普遍加密的情况下，不改变现有的加密方式和现有的业务流程，使网络运营商依托于内容感知的业务能够正常使用，并且不降低业务的安全性和隐私性。
结合第一方面，在第一方面的第一种可能的实施方式中，所述网关包括策略和计费执行功能PCEF和策略和计费规则功能PCRF；
所述获取所述应用请求所请求的原始数据的加密数据之前，所述方法还包括：获取所述应用请求中的第一五元组，所述第一五元组的源因特网协议IP地址为所述用户端的IP地址，目的IP地址为所述服务器的IP地址，源端口号为所述用户端的端口号，目的端口号为所述服务器的端口号；将所述第一五元组中的源IP地址和目的IP地址互换，并将所述第一五元组中的源端口号和目的端口号互换，得到第二五元组；根据五元组映射表查找所述第二五元组对应的所述索引信息，所述五元组映射表的每个表项包括一个五元组与对应的索引信息；向所述PCRF发送所述第二五元组和所述索引信息，所述PCRF用于生成包括所述第二五元组和所述索引信息的检测策略，所述检测策略用于指示所述PCEF根据所述第二五元组确定待验证的报文，验证所述待验证的报文中的五元组和所述待验证的报文中的索引信息是否满足预定关系，所述预定关系用于指示允许以所述索引信息对应的传输参数传输数据。
结合所述第一方面的第一种可能的实施方式，在该第一方面的第二种可能的实施方式中，所述为所述第一报文添加索引信息，包括：根据所述五元组映射表查找所述第二五元组对应的索引信息，为所述第一报文添加所述索引信息。
结合所述第一方面的第一种或第二种可能的实施方式，在该第一方面的第三种可能的实施方式中，述向所述PCRF发送所述第二五元组和所述索引信息之前，所述方法还包括：通过所述PCRF与所述网关建立互信关系。
本发明第二方面提供了一种报文传输方法，应用于运营商网络中，所述方法包括：
网关接收内容提供商的服务器发送的包括了索引信息的第二报文，所述第二报文通过为第一报文添加所述索引信息得到，所述第一报文包括根据用户端发送的应用请求所请求的原始数据生成的加密数据；
所述网关确定所述索引信息对应的传输参数，所述传输参数包括资源类型、优先级、时延、丢包率、服务类型中的至少一个；
所述网关根据所述传输参数向所述用户端发送所述加密数据。
本发明中，网关接收包括了索引信息的第二报文，该第二报文通过为第一报文添加所述索引信息得到，该第一报文包括根据用户端发送的应用请求所请求的原始数据生成的加密数据；该网关确定与该索引信息对应的传输参数，并根据传输参数发送第一报文。即，本发明在传输加密数据时，在报文中添加运营商网络中的网关能识别的索引信息，使得网关只需要根据索引信息确定传输参数，能够在数据普遍加密的情况下，不改变现有的加密方式和现有的业务流程，使网络运营商依托于内容感知的业务能够正常使用，并且不降低业务的安全性和隐私性。
结合第二方面，在第二方面的第一种可能的实施方式中，所述网关确定所述索引信息对应的传输参数，包括：所述网关根据预先存储的传输参数映射表确定与所述第二报文中的索引信息对应的传输参数，所述传输参数映射表的每个表项包括一条索引信息与对应的至少一个传输参数。
结合第二方面的第一种实现方式，在第二方面的第二种可能的实施方式中，所述网关包括策略和计费规则功能PCRF和策略和计费执行功能PCEF；
所述网关接收内容提供商的服务器发送的包括了索引信息的第二报文之前，所述方法还包括：所述PCRF接收所述服务器发送的第二五元组和所述索引信息，所述索引信息是所述服务器根据五元组映射表查找到的与所述第二五元组对应的索引信息；所述第二五元组是所述服务器通过将所述应用请求中的第一五元组中的源IP地址和目的IP地址互换，并将所述第一五元组中的源端口号和目的端口号互换得到的；所述PCRF生成包括所述第二五元组和所述索引信息的检测策略，并向所述PCEF发送检测策略；所述PCEF接收所述检测策略；
所述网关根据预先存储的传输参数映射表确定与所述第二报文中的索引信息对应的传输参数，包括：所述PCEF根据所述检测策略验证所述第二报文，在验证通过后，根据所述传输参数映射表确定与所述索引信息对应的所述传输参数。
结合第二方面的第二种实现方式，在第二方面的第三种可能的实施方式中，所述PCEF根据所述检测策略对验证所述第二报文，包括：
所述PCEF检测所述第二报文中的五元组与所述检测策略中的所述第二五元组是否相同且所述第二报文中的索引信息与所述检测策略中的所述索引信息是否相同；
若所述第二报文中的五元组和所述检测策略中的所述第二五元组相同且所述第二报文中的索引信息与所述检测策略中的所述索引信息相同，则所述PCEF检测所述第二报文中的五元组与所述第二报文中的索引信息是否满足预定关系，所述预定关系用于指示允许以所述索引信息对应的传输参数传输数据；
若所述第二报文中的五元组与所述第二报文中的索引信息满足所述预定关系，则确定对所述第二报文的验证通过。
结合第二方面的第二种或第三种实现方式，在第二方面的第三种可能的实施方式中，所述PCRF接收所述服务器发送的所述第二五元组和所述索引信息之前，所述方法还包括：所述网关通过所述PCRF与所述服务器建立互信关系。
第三方面，提供了一种报文传输装置，用于内容提供商的服务器中，该装置包括至少一个单元，该至少一个单元用于实现上述第一方面或第一方面的至少一种实现中所提供的报文传输方法。
第四方面，提供了一种报文传输装置，用于运营商网络中网关，该装置包括至少一个单元，该至少一个单元用于实现上述第二方面或第二方面的至少一种实现中所提供的报文传输方法。
第五方面，提供了一种内容提供商的服务器，该服务器包括：处理器、以及与处理相连的收发器和存储器；
该收发器被配置为由处理器控制以实现与其他实体通信，该存储器用于存储程序指令。该处理器用于调用所述程序指令实现上述第一方面或第一方面的至少一种实现方式中所提供的报文传输方法。
附图说明
为了更清楚地说明本发明实施例中的技术方案，下面将对实施例描述中所需要使用的附图作简单地介绍。
图1是本发明实施例提供的一种报文传输系统的结构示意图；
图2是本发明实施例提供的一种报文传输系统的结构示意图；
图3是本发明实施例提供的一种内容提供商的服务器的结构示意图；
图4是本发明实施例提供的一种报文传输方法的方法流程图；
图5是本发明实施例提供的另一种报文传输方法的方法流程图；
图6是本发明实施例提供的一种报文传输装置的框图；
图7是本发明实施例提供的另一种报文传输装置的框图。
具体实施方式
为使本发明的目的、技术方案和优点更加清楚，下面将结合附图对本发明实施方式作进一步地详细描述。
在本文提及的“模块”是指存储在存储器中的能够实现某些功能的程序或指令；在本文中提及的“单元”是指按照逻辑划分的功能性结构，该“单元”可以由纯硬件实现，或者，软硬件的结合实现。
请参考图1，其示出了本发明提供的一个示例性报文传输系统的结构示意图，该报文传输系统包括内容提供商的服务器110、运营商网络120和用户端130。其中，运营商网络即由网络运营商管理、运营的网络。
服务器110用于接收用户端130发送的超文本传输协议(Hypertext Transfer Protocol，HTTP)1.1/HTTP2以及其他业务定义的各种应用请求，并响应用户端130发送的应用请求，通过网络运营商提供的网络设备，即运营商网络120中的网关121，为用户端130提供加密或非加密的数据。其中，用户端130为一般的用户终端或任何进行网络访问的客户端，比如：用户手机上安装的某个视频软件的客户端。
服务器110接收到用户端130发送的应用请求后，获取应用请求所请求的原始数据的加密数据，生成包括该加密数据的第一报文，为该第一报文添加索引信息，得到第二报文。
需要说明的是，在该服务器110获取应用请求所请求的原始数据的加密数据之前，还需要以信令形式向运营商网络120中的网关121发送控制信息，以使该网关121能够处理第二报文。
可选的，请参考图2，运营商网络120中的网关121可以包括策略管理系统。策略管理系统是策略控制和计费(Policy and Control and Charging，PCC)系统。策略管理系统用于验证该第二报文，根据该第二报文中的索引信息对应的传输参数传输该第二报文中的加密数据。
可选的，网关121包括策略和计费规则功能(Policy and Charging Rules Function，PCRF)1211和策略和计费规则执行功能(Policy and Charging Enforcement Function，PCEF)1212。其中，PCRF1211和PCEF1212可以位于同一硬件设备上，也可以位于不 同的硬件设备上。
本发明中，运营商网络120中还可以包括传输设备(图中未示出)，其中传输设备可以是路由设备、中间设备以及转换设备中的任意一种。
在一个实施方式中，该服务器110在接收到用户端130发送的应用请求后，根据该应用请求中的第一五元组得到第二五元组。确定该第二五元组对应的索引信息，并向PCRF1211发送该第二五元组及对应的索引信息，PCRF1211接收到该第二五元组及对应的索引信息后向PCEF1212发送包括该第二五元组和对应索引信息的检测策略。然后，该服务器110获取该应用请求所请求的原始数据的加密数据，生成包括加密数据的第一报文，为该第一报文添加索引信息，得到第二报文，再将该第二报文发送至PCEF1212，PCEF1212根据接收到的检测策略对该第二报文中的五元组和索引信息进行验证，当验证通过时，PCEF1212确定满足预定关系的索引信息对应的传输参数；根据该传输参数向用户端130发送该加密数据。在该服务器110向PCRF1211发送第二五元组和索引信息之前，该服务器110和PCRF1211建立互信关系。
请参考图3，其示出了本发明一实施例提供的该服务器110的结构示意图。该该服务器110包括：收发器311、处理器312、存储器313。
处理器312与收发器311、存储器313相连。
收发器311可以由一个或多个输入输出端口组成，被配置为由处理器控制以实现与其他实体通信，例如用于接收用户端发送的应用请求，向运营商网络中的网关发送包括了索引信息的第二报文，索引信息用于指示该第二报文中的加密数据的传输参数。
处理器312包括一个或一个以上处理核心。处理器312通过运行软件程序以及模块，从而执行各种功能应用以及数据处理，比如：获取应用请求所请求的原始数据的加密数据，生成包括加密数据的第一报文，为该第一报文添加索引信息以得到第二报文。
存储器313中存储有五元组映射表，以及用于响应用户端发送的应用请求的原始数据和数据加密策略，该五元组映射表的每个表项包括一个五元组与对应的索引信息。
存储器313还用于存储系统程序及程序指令。存储器313可存储操作系统31以及至少一个功能所需的程序指令32。程序指令32可以包括获取模块321、生成模块322、添加模块323等。其中，获取模块321，用于获取与应用请求对应的加密数据。生成模块322，用于生成包括加密数据的第一报文。添加模块323，用于为所述第一报文添加索引信息以得到第二报文。
存储器313可以由任何类型的易失性或非易失性存储设备或者它们的组合实现，如 静态随机存取存储器(static random access memory，SRAM)，动态随机存取存储器(dynamic random access memory，DRAM)，电可擦除可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)，可擦除可编程只读存储器(erasable programmable read-only memory，EPROM)，可编程只读存储器(programmable read-only memory，PROM)，只读存储器(read-only memory，ROM)，磁存储器，快闪存储器，磁盘或光盘。
本领域技术人员可以理解，图3中所示出的该服务器110结构并不构成对该服务器110的限定，本发明中的服务器可以包括比图示更多或更少的部件或组合某些部件，或者不同的部件布置。
请参考图4，其示出了本发明一个实施例提供的报文传输方法的流程图。本实施例以该方法应用于如图1所示的报文传输系统中来举例说明。该方法包括以下步骤：
步骤401，服务器接收用户端发送的应用请求。
用户在用户端上执行获取数据的操作，用户端向服务器发送用于获取数据的应用请求。比如：用户使用手机上的某内容提供商的客户端观看某一视频，当用户点击该视频的播放控件时，手机上的客户端向该内容提供商的服务器发送获取该视频的应用请求，该服务器接收客户端发送的应用请求。
步骤402，服务器获取应用请求所请求的原始数据的加密数据。
服务器获取应用请求所请求的原始数据，并根据预定的数据加密策略对原始数据加密，得到加密数据。
比如：应用请求是该内容提供商提供的xx视频的请求时，应用请求所请求的原始数据为该xx视频的视频资源，服务器对该视频资源进行加密，得到加密数据。
步骤403，服务器生成包括加密数据的第一报文。
该服务器从应用请求中获取第一五元组，其中，应用请求中的第一五元组包括源互联网协议(Internet Protocol，IP)地址(即用户端的IP地址)、源端口号(即用户端的端口号)、用户端的目的IP地址(即该服务器的IP地址)和目的端口(即该服务器的端口号)以及传输层的协议号，利用第一五元组生成主体为加密数据的第一报文。具体来说，服务器将第一五元组中的源IP地址和目的IP地址互换，源端口号和目的端口号互换，得到第二五元组，根据第二五元组生成第一报文。
步骤404，服务器为该第一报文添加索引信息，得到第二报文。
索引信息是用于指示运营商网络中的网关确定索引信息对应的传输参数的信息，也 即索引信息用于确定加密数据对应的传输参数。
服务器确定用于传输加密数据的传输参数，再根据传输参数确定索引信息，为该第一报文添加确定的索引信息，得到第二报文。
步骤405，服务器向运营商网络中的网关发送第二报文。
服务器向网络运营商的网关发送该第二报文，网关具有识别索引信息的能力。
步骤406，运营商网络中的网关接收服务器发送的包括了索引信息的第二报文。
网关接收到的第二报文不仅包括索引信息，还包括用户端发送的应用请求所请求的原始数据的加密数据。
步骤407，网关确定该索引信息对应的传输参数。
该网关根据传输参数映射表确定第二报文中的索引信息对应的传输参数。其中，传输参数映射表的每个表项包括一条索引信息及对应的至少一个传输参数。
步骤408，网关根据传输参数向用户端发送加密数据。
在一个实施方式中，网关根据传输参数向用户端直接发送该第二报文，当用户端接收到该第二报文后，根据该第二报文得到加密数据，然后解析该加密数据得到对应于应用请求的原始数据。
在另一个实施方式中，网关将第二报文中的索引信息删除，得到第一报文，根据传输参数向用户端发送第一报文。当用户端接收到该第一报文后，根据该第一报文得到该加密数据，然后解析加密数据得到对应于该应用请求的原始数据。
其中，上述步骤401至405可单独实现成为该服务器侧的实施例，步骤406至408可单独实现成为运营商网络侧的实施例。
综上所述，本发明实施例提供的报文传输方法，通过获取与用户端发送的应用请求对应的加密数据，生成包括加密数据的第一报文，并为该第一报文添加索引信息得到第二报文，将该第二报文发送至运营商网络中的网关，该网关确定与该索引信息对应的传输参数，根据该传输参数将该加密数据发送给用户端。本发明实施例使得网络运营商不需要使用密钥来解密加密数据来获取内容提供商传输的内容，只需要根据索引信息就能确定传输参数，能够在数据普遍加密的情况下，不改变现有的加密方式和现有的业务流程，使网络运营商依托于内容感知的业务能够正常使用，并且不降低业务的安全性和隐私性。
请参考图5，其示出了本发明另一实施例提供的报文传输方法的流程图。本实施例以该方法应用于如图2所示的网关120，此时该网关包括PCEF和PCRF。该方法包括 以下步骤：
步骤501，服务器通过运营商网络中的网关中的PCRF与网关建立互信关系。
相应地，PCRF和服务器建立互信关系。
服务器向PCRF提供诸如IP地址、证书、介质访问控制(media access control，MAC)地址之类能够表明身份的身份标识，实现与PCRF建立互信关系；或者，该服务器和PCRF利用网络协议安全性(Internet Protocol Security，IPsec)应用中的隧道模式建立互信关系，本实施例不对服务器与PCRF建立互信关系的方式作限定。
步骤502，服务器接收用户端发送的应用请求。
本步骤的具体实现可以参考图4中的步骤401。
步骤503，服务器获取应用请求中的第一五元组。
第一五元组的源IP地址为用户端的IP地址，目的IP地址为服务器的IP地址，源端口号为用户端的端口号，目的端口号为服务器的端口号。
步骤504，服务器将第一五元组中的源IP地址和目的IP地址互换，并将第一五元组中的源端口号和目的端口号互换，得到第二五元组。
步骤505，服务器根据五元组映射表查找第二五元组对应的索引信息。
其中，五元组映射表的每个表项包括一个五元组与一条索引信息的对应关系。
表一示意性地示出了五元组和索引信息之间的对应关系：
表一
Figure PCTCN2017087102-appb-000001
比如，服务器获取到应用请求中的第一五元组后，将第一五元组的源IP地址和目的IP地址互换，将第一五元组中的源端口号和目的端口号互换后，得到第二五元组为表一中的五元组3，则确定对应的索引信息为索引信息3。
其中，五元组映射表可以由内容提供商和网络运营商共同协商得到，本实施例不限 定该对应关系的获取方式。
步骤506，服务器向PCRF发送第二五元组和第二五元组对应的索引信息。
其中，PCRF用于生成包括第二五元组和索引信息的检测策略；检测策略用于指示PCEF根据第二五元组和索引信息确定待验证的报文，验证待验证的报文中的五元组和待验证的报文中的索引信息是否满足预定关系；预定关系用于指示允许以一条索引信息对应的传输参数传输数据。
步骤507，运营商网络中的PCRF接收该服务器发送的第二五元组和索引信息。
步骤508，运营商网络中的PCRF向PCEF发送检测策略。
检测策略包括PCRF接收到的第二五元组和索引信息。
步骤509，PCEF接收PCRF发送的检测策略。
需要说明的是，服务器可以不向该策略管理系统发送第二五元组和索引信息，当服务器不向策略管理系统中的PCRF发送第二五元组和索引信息时，PCRF不向PCEF发送检测策略，即不执行步骤506至509。
步骤510，服务器获取应用请求所请求的原始数据的加密数据。
服务器获取应用请求所请求的原始数据，并根据预定的数据加密策略对原始数据加密，得到应用请求所请求的原始数据的加密数据。
比如：应用请求是内容提供商客户端发送的xx视频的请求时，应用请求所请求的原始数据为该xx视频的视频资源，服务器对该视频资源进行加密，得到加密数据。
步骤511，服务器生成包括加密数据的第一报文。
本步骤的具体实现可以参考图4中的步骤403。
步骤512，服务器根据五元组映射表查找第一报文中的第二五元组对应的索引信息，为第一报文添加该索引信息，得到第二报文。
其中，五元组映射表可以由内容提供商和网络运营商共同协商得到，本实施例不限定该对应关系的获取方式。
可选的，索引信息是服务质量标度值(Quality of Service Class Identifier，QCI)。本发明实施例中以索引信息是QCI为例，进行详细说明。此时，五元组映射表的每个表项包括一个五元组和对应的一个QCI的值，比如五元组1对应QCI1，QCI1表示QCI的值为1。
需要说明的是，为第一报文添加索引信息的方式取决于内容提供商和网络运营商之间的协商，比如：在新增加的一个TCP Option字段中添加索引信息，或者，在增强的安全传输层协议(Transport Layer Security，TLS)字段中添加索引信息，本发明实施例 对索引信息的添加方式不作限定。
步骤513，服务器向PCEF发送添加了索引信息的第二报文。
索引信息用于指示PCEF确定索引信息对应的传输参数，根据传输参数发送加密数据。其中，传输参数包括资源类型、优先级、时延、丢包率、服务类型中的至少一个。
可选的，索引信息和传输参数之间的对应关系可以由内容提供商和网络运营商共同协商得到，本实施例不限定该对应关系的获取方式。
以索引信息是QCI为例，如表二所示，其示例性的示出了QCI与传输参数之间的传输参数映射表：
表二
Figure PCTCN2017087102-appb-000002
从表二可以看出QCI共有13个值，每个QCI的值对应4个传输参数，分别是资源类型，优先级、时延、丢包率。其中资源类型包括：保证比特率(Guaranteed Bit Rat，GBR)和Non-GBR，GBR类型的数据的实时性要求高。
步骤514，运营商网络中的PCEF接收服务器发送的包括了索引信息的第二报文。
第二报文通过为第一报文添加索引信息得到，该第一报文包括根据用户端发送的应 用请求所请求的原始数据生成的加密数据。
步骤515，运营商网络中的PCEF根据检测策略对该第二报文进行验证。
PCEF检测第二报文中的五元组与检测策略中的五元组是否相同，以及检测第二报文中的索引信息与检测策略中的索引信息是否相同。若第二报文中的五元组和检测策略中的五元组相同，且第二报文中的索引信息与检测策略中的索引信息相同，则PCEF进一步检测第二报文中的五元组与第二报文中的索引信息是否满足预定关系。若检测结果为第二报文中的五元组与第二报文中的索引信息满足预定关系，则确定对第二报文的验证通过。其中，预定关系用于指示允许以索引信息对应的传输参数传输数据。
当PCEF检测到第二报文中的索引信息与第二报文中的五元组满足预定关系，也即验证通过时，执行步骤516；当PCEF检测到第二报文中的索引信息与第二报文中的五元组不满足预定关系时，可以将索引信息修改为满足预定关系的索引信息继续传输第二报文，或者，丢弃该第二报文。比如：预定关系中五元组1对应QCI1，PCEF检测到第二报文中的五元组为五元组1，而索引信息为QCI2，则PCEF将QCI2修改为QCI1后继续传输第二报文，或者丢弃第二报文。
需要说明的是，当服务器不向策略管理系统中的PCRF发送五元组和索引信息时，也即不执行步骤506至509时，不执行步骤515，直接执行步骤516。
步骤516，运营商网络中的PCEF确定索引信息对应的传输参数。
具体地，PCEF根据预先存储的五元组映射表确定与第二报文中的索引信息对应的传输参数。
假设PCEF接收到第二报文后，获取第二报文中的索引信息为QCI3，从表二可知，传输参数为资源类型为GBR，优先级为3，时延为50ms，丢包率为10-3。
步骤517，运营商网络中的网关根据传输参数向用户端发送加密数据。
运营商网络中的PCEF将确定的传输参数发送至传输设备，传输设备根据传输参数向用户端发送加密数据。
由传输设备根据传输参数、第二报文中的五元组向用户端发送报文中的加密数据。比如：传输参数为资源类型为GBR，优先级为3，时延为50ms，丢包率为10-3，则为报文中的加密数据分配满足资源类型为GBR，优先级为3，时延为50ms，丢包率为10-3的流量，并根据分配的流量传输该加密数据。
在一个实施方式中，传输设备根据传输参数向用户端发送第二报文，当用户端接收到第二报文后，根据第二报文得到加密数据，对加密数据进行解析，获取到对应于应用请求的原始数据。
在另一个实施方式中，传输设备将第二报文中的索引信息删除，得到第一报文，根据传输参数向用户端发送第一报文，当用户端接收到第一报文后，根据第一报文得到加密数据，然后解析加密数据得到对应于应用请求的原始数据。
其中，上述步骤501至506和步骤510至513可单独实现成为服务器侧的实施例，步骤507至509和514至517可单独实现成为运营商网络侧的实施例。
综上所述，本发明实施例提供的报文传输方法，通过获取与用户端发送的应用请求对应的加密数据，生成包括加密数据的第一报文，并为第一报文添加索引信息得到第二报文，将第二报文发送至运营商网络中的网关，网关确定与索引信息对应的传输参数，根据传输参数将加密数据发送给用户端。本发明实施例使得网络运营商不需要使用密钥来解密加密数据来获取内容提供商传输的内容，只需要根据索引信息就能确定传输参数，能够在数据普遍加密的情况下，不改变现有的加密方式和现有的业务流程，，使网络运营商依托于内容感知的业务能够正常使用，并且不降低业务的安全性和隐私性。
另外，本发明还通过服务器向网络运营商中的PCRF发送索引信息和五元组，PCRF向PCEF下发包括索引信息和五元组的检测策略，PCEF根据检测策略检测接收的报文中的索引信息与该报文中的五元组是否满足预定关系，当报文中的索引信息与报文中的五元组满足预定关系时，PCEF才确定索引信息对应的传输参数，能够有效地避免PCEF使用网络运营商不允许使用的传输参数传输报文中的加密数据的问题。
请参考图6，其示出了本发明一个实施例提供的报文传输装置的框图。该报文传输装置可以通过软件、硬件或者两者的结合实现成为服务器的全部或者一部分。该报文传输装置包括：
接收单元610，用于实现步骤401和502的功能。
获取单元620，用于实现步骤402、503、504、505和510的功能。
生成单元630，用于实现步骤403和511的功能。
添加单元640，用于实现步骤404和512的功能。
发送单元650，用于实现步骤405、506和513的功能。
此外，所述报文传输装置还可以包括建立单元，用于实现上述步骤501的功能。
相关细节可结合参考图4和图5所述的方法实施例。
需要说明的是，上述接收单元610和发送单元650可以通过内容提供商的服务器中的收发器来实现，上述获取单元620、生成单元630和添加单元640可以通过服务器中 的处理器执行存储器中的程序指令来实现。
请参考图7，其示出了本发明另一个实施例提供的报文传输装置的框图。该报文传输装置可以通过软件、硬件或者两者的结合实现成为运营商网络的全部或者一部分。该报文传输装置可以是运营商网络中的网关，该装置包括：
接收单元710，用于实现步骤406的功能。
发送单元720，用于实现骤408和517的功能。
确定单元730，用于实现步骤407的功能。
相关细节可结合参考图4所述的方法实施例。
此外，所述网关还包括策略和计费规则功能PCRF和策略和计费执行功能PCEF，所述PCRF用于实现步骤501、507和508的功能。所述PCEF用于实现步骤514至516的功能。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。
本领域普通技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的实施例中，应该理解到，所揭露的装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，可以仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
以上所述，仅为本发明的具体实施方式，但本发明的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本发明揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本发明的保护范围之内。因此，本发明的保护范围应所述以权利要求的保护范围为准。

Claims (18)

  1. 一种报文传输方法，其特征在于，应用于内容提供商的服务器中，所述方法包括：
    接收用户端发送的应用请求；
    获取所述应用请求所请求的原始数据的加密数据；
    生成包括所述加密数据的第一报文；
    为所述第一报文添加索引信息，得到第二报文；
    向运营商网络中的网关发送所述第二报文，所述索引信息用于指示所述网关确定所述索引信息对应的传输参数，根据所述传输参数向所述用户端发送所述加密数据，所述传输参数包括资源类型、优先级、时延、丢包率、服务类型中的至少一个。
  2. 根据权利要求1所述的方法，其特征在于，所述网关包括策略和计费执行功能PCEF和策略和计费规则功能PCRF；
    所述获取所述应用请求所请求的原始数据的加密数据之前，所述方法还包括：
    获取所述应用请求中的第一五元组，所述第一五元组的源因特网协议IP地址为所述用户端的IP地址，目的IP地址为所述服务器的IP地址，源端口号为所述用户端的端口号，目的端口号为所述服务器的端口号；
    将所述第一五元组中的源IP地址和目的IP地址互换，并将所述第一五元组中的源端口号和目的端口号互换，得到第二五元组；
    根据五元组映射表查找所述第二五元组对应的所述索引信息，所述五元组映射表的每个表项包括一个五元组与对应的索引信息；
    向所述PCRF发送所述第二五元组和所述索引信息，所述PCRF用于生成包括所述第二五元组和所述索引信息的检测策略，所述检测策略用于指示所述PCEF根据所述第二五元组确定待验证的报文，验证所述待验证的报文中的五元组和所述待验证的报文中的索引信息是否满足预定关系，所述预定关系用于指示允许以所述索引信息对应的传输参数传输数据。
  3. 根据权利要求2所述的方法，其特征在于，所述为所述第一报文添加索引信息，包括：
    根据所述五元组映射表查找所述第二五元组对应的索引信息，为所述第一报文添加 所述索引信息。
  4. 根据权利要求2或3所述的方法，其特征在于，所述向所述PCRF发送所述第二五元组和所述索引信息之前，所述方法还包括：
    通过所述PCRF与所述网关建立互信关系。
  5. 一种报文传输方法，其特征在于，应用于运营商网络中，所述方法包括：
    网关接收内容提供商的服务器发送的包括了索引信息的第二报文，所述第二报文通过为第一报文添加所述索引信息得到，所述第一报文包括根据用户端发送的应用请求所请求的原始数据生成的加密数据；
    所述网关确定所述索引信息对应的传输参数，所述传输参数包括资源类型、优先级、时延、丢包率、服务类型中的至少一个；
    所述网关根据所述传输参数向所述用户端发送所述加密数据。
  6. 根据权利要求5所述的方法，其特征在于，所述网关确定所述索引信息对应的传输参数，包括：
    所述网关根据预先存储的传输参数映射表确定与所述第二报文中的索引信息对应的传输参数，所述传输参数映射表的每个表项包括一条索引信息与对应的至少一个传输参数。
  7. 根据权利要求6所述的方法，其特征在于，所述网关包括策略和计费规则功能PCRF和策略和计费执行功能PCEF；
    所述网关接收内容提供商的服务器发送的包括了索引信息的第二报文之前，所述方法还包括：
    所述PCRF接收所述服务器发送的第二五元组和所述索引信息，所述索引信息是所述服务器根据五元组映射表查找到的与所述第二五元组对应的索引信息；所述第二五元组是所述服务器通过将所述应用请求中的第一五元组中的源IP地址和目的IP地址互换，并将所述第一五元组中的源端口号和目的端口号互换得到的；
    所述PCRF生成包括所述第二五元组和所述索引信息的检测策略，并向所述PCEF发送检测策略；所述PCEF接收所述检测策略；
    所述网关根据预先存储的传输参数映射表确定与所述第二报文中的索引信息对应 的传输参数，包括：
    所述PCEF根据所述检测策略验证所述第二报文，在验证通过后，根据所述传输参数映射表确定与所述索引信息对应的所述传输参数。
  8. 根据权利要求7所述的方法，其特征在于，所述PCEF根据所述检测策略对验证所述第二报文，包括：
    所述PCEF检测所述第二报文中的五元组与所述检测策略中的所述第二五元组是否相同且所述第二报文中的索引信息与所述检测策略中的所述索引信息是否相同；
    若所述第二报文中的五元组和所述检测策略中的所述第二五元组相同且所述第二报文中的索引信息与所述检测策略中的所述索引信息相同，则所述PCEF检测所述第二报文中的五元组与所述第二报文中的索引信息是否满足预定关系，所述预定关系用于指示允许以所述索引信息对应的传输参数传输数据；
    若所述第二报文中的五元组与所述第二报文中的索引信息满足所述预定关系，则确定对所述第二报文的验证通过。
  9. 根据权利要求7或8所述的方法，其特征在于，所述PCRF接收所述服务器发送的所述第二五元组和所述索引信息之前，所述方法还包括：
    所述网关通过所述PCRF与所述服务器建立互信关系。
  10. 一种报文传输装置，其特征在于，应用于内容提供商的服务器中，所述装置包括：
    接收单元，用于接收用户端发送的应用请求；
    获取单元，用于获取所述接收单元接收到的所述应用请求所请求的原始数据的加密数据；
    生成单元，用于生成包括所述获取单元获取到的所述加密数据的第一报文；
    添加单元，用于为所述生成单元生成的所述第一报文中添加索引信息，得到第二报文；
    发送单元，用于向运营商网络中的网关发送所述第二报文，所述索引信息用于指示所述网关确定所述索引信息对应的传输参数，根据所述传输参数向所述用户端发送所述加密数据，所述传输参数包括资源类型、优先级、时延、丢包率、服务类型中的至少一个。
  11. 根据权利要求10所述的装置，其特征在于，所述网关包括策略和计费执行功能PCEF和策略和计费规则功能PCRF；
    所述获取单元，还用于获取所述应用请求中的第一五元组，所述第一五元组的源因特网协议IP地址为所述用户端的IP地址，目的IP地址为所述服务器的IP地址，源端口号为所述用户端的端口号，目的端口号为所述服务器的端口号；将所述第一五元组中的源IP地址和目的IP地址互换，并将所述第一五元组中的源端口号和目的端口号互换，得到第二五元组；根据五元组映射表查找所述第二五元组对应的所述索引信息，所述五元组映射表的每个表项包括一个五元组与对应的索引信息；
    所述发送单元，还用于向所述PCRF发送所述第二五元组和所述索引信息，所述PCRF用于生成包括所述第二五元组和所述索引信息的检测策略，所述检测策略用于指示所述PCEF根据所述第二五元组确定待验证的报文，验证所述待验证的报文中的五元组和所述待验证的报文中的索引信息是否满足预定关系，所述预定关系用于指示允许以所述索引信息对应的传输参数传输数据。
  12. 根据权利要求11所述的装置，其特征在于，所述添加单元，还用于：
    根据所述五元组映射表查找所述第一报文中的五元组对应的索引信息，为所述第一报文添加所述索引信息中，所述五元组映射表的每个表项包括一个五元组与对应的索引信息。
  13. 根据权利要求11或12所述的装置，其特征在于，所述装置还包括：
    建立单元，用于通过所述PCRF与所述网关建立互信关系。
  14. 一种报文传输装置，其特征在于，所述装置为运营商网络中的网关，所述装置包括：
    接收单元，用于接收内容提供商的服务器发送的包括了索引信息的第二报文，所述第二报文通过为第一报文添加所述索引信息得到，所述第一报文包括根据用户端发送的应用请求所请求的原始数据生成的加密数据；
    确定单元，用于确定所述索引信息对应的传输参数，所述传输参数包括资源类型、优先级、时延、丢包率、服务类型中的至少一个；
    发送单元，用于根据所述传输参数向所述用户端发送所述加密数据。
  15. 根据权利要求14所述的装置，其特征在于，
    所述确定单元，具体用于根据预先存储的传输参数映射表确定与所述第二报文中的索引信息对应的传输参数，所述传输参数映射表的每个表项包括一条索引信息与对应的至少一个传输参数。
  16. 根据权利要求15所述的装置，其特征在于，所述网关还包括策略和计费规则功能PCRF和策略和计费执行功能PCEF；
    所述PCRF用于接收所述服务器发送的第二五元组和所述索引信息，所述索引信息是所述服务器根据五元组映射表查找到的与所述第二五元组对应的索引信息；所述第二五元组是所述服务器通过将所述应用请求中的第一五元组中的源IP地址和目的IP地址互换，并将所述第一五元组中的源端口号和目的端口号互换得到的；
    所述PCRF还用于生成包括所述第二五元组和所述索引信息的检测策略，并向所述PCEF发送所述检测策略；
    所述PCEF用于接收所述检测策略；根据所述检测策略验证所述第二报文，在验证通过后，根据所述传输参数映射表确定与所述索引信息对应的所述传输参数。
  17. 根据权利要求16所述的装置，其特征在于，
    在验证所述第二报文时，所述PCEF具体用于检测所述第二报文中的五元组与所述检测策略中的所述第二五元组是否相同且所述第二报文中的索引信息与所述检测策略中的所述索引信息是否相同；若所述第二报文中的五元组和所述检测策略中的所述第二五元组相同且所述第二报文中的索引信息与所述检测策略中的所述索引信息相同，则检测所述报文中的五元组与所述报文中的索引信息是否满足预定关系，所述预定关系用于指示允许以所述索引信息对应的传输参数传输数据；若所述第二报文中的五元组与所述第二报文中的索引信息满足所述预定关系，则确定对所述报文的验证通过。
  18. 根据权利要求15或16所述的装置，其特征在于，所述所述PCRF还用于使所述网关与所述内容提供商的服务器建立互信关系。
PCT/CN2017/087102 2016-06-28 2017-06-02 报文传输方法、装置及系统 WO2018001042A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP17819039.3A EP3468120A4 (en) 2016-06-28 2017-06-02 PACKET TRANSMISSION PROCESS, DEVICE AND SYSTEM
US16/225,711 US20190149513A1 (en) 2016-06-28 2018-12-19 Packet transmission method, apparatus, and system

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201610485497.X 2016-06-28
CN201610485497.XA CN107547478B (zh) 2016-06-28 2016-06-28 报文传输方法、装置及系统

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US16/225,711 Continuation US20190149513A1 (en) 2016-06-28 2018-12-19 Packet transmission method, apparatus, and system

Publications (1)

Publication Number Publication Date
WO2018001042A1 true WO2018001042A1 (zh) 2018-01-04

Family

ID=60786677

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/087102 WO2018001042A1 (zh) 2016-06-28 2017-06-02 报文传输方法、装置及系统

Country Status (4)

Country Link
US (1) US20190149513A1 (zh)
EP (1) EP3468120A4 (zh)
CN (1) CN107547478B (zh)
WO (1) WO2018001042A1 (zh)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112243002B (zh) * 2020-10-10 2023-07-04 腾讯科技（深圳）有限公司 数据转发方法、装置、电子设备以及计算机可读介质
CN115801398A (zh) * 2022-11-15 2023-03-14 联想(北京)有限公司 一种数据处理方法及设备

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101272594A (zh) * 2007-03-22 2008-09-24 华为技术有限公司 过滤加密内容的方法、过滤设备和内容消费设备
CN101335675A (zh) * 2008-01-09 2008-12-31 中兴通讯股份有限公司 一种策略控制方法
US20150271205A1 (en) * 2014-03-21 2015-09-24 Cisco Technology, Inc. Method, system, and logic for in-band exchange of meta-information
CN105429962A (zh) * 2015-11-03 2016-03-23 清华大学 一种通用的面向加密数据的中间网络服务构建方法与体系

Family Cites Families (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20090300207A1 (en) * 2008-06-02 2009-12-03 Qualcomm Incorporated Pcc enhancements for ciphering support
CN104349400B (zh) * 2013-07-23 2019-04-05 华为技术有限公司 无线通信的方法、有线传输检测的方法及相关设备
US8996873B1 (en) * 2014-04-08 2015-03-31 Cloudflare, Inc. Secure session capability using public-key cryptography without access to the private key

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101272594A (zh) * 2007-03-22 2008-09-24 华为技术有限公司 过滤加密内容的方法、过滤设备和内容消费设备
CN101335675A (zh) * 2008-01-09 2008-12-31 中兴通讯股份有限公司 一种策略控制方法
US20150271205A1 (en) * 2014-03-21 2015-09-24 Cisco Technology, Inc. Method, system, and logic for in-band exchange of meta-information
CN105429962A (zh) * 2015-11-03 2016-03-23 清华大学 一种通用的面向加密数据的中间网络服务构建方法与体系

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP3468120A4 *

Also Published As

Publication number Publication date
EP3468120A4 (en) 2019-05-08
US20190149513A1 (en) 2019-05-16
EP3468120A1 (en) 2019-04-10
CN107547478A (zh) 2018-01-05
CN107547478B (zh) 2020-09-11

Similar Documents

Publication Publication Date Title
US9749292B2 (en) Selectively performing man in the middle decryption
US11190489B2 (en) Methods and systems for establishing a connection between a first device and a second device across a software-defined perimeter
US10341357B2 (en) Selectively performing man in the middle decryption
US9306936B2 (en) Techniques to classify virtual private network traffic based on identity
US20150113588A1 (en) Firewall Limiting with Third-Party Traffic Classification
CN115348060A (zh) 选择性地解密ssl/tls通信的方法和装置
US10587579B2 (en) Varying encryption level of traffic through network tunnels
US20130312054A1 (en) Transport Layer Security Traffic Control Using Service Name Identification
US20190140823A1 (en) Method for Detecting Encrypted Content, and Device
EP3605948B1 (en) Distributing overlay network ingress information
US20080155645A1 (en) Network-implemented method using client's geographic location to determine protection suite
US10785196B2 (en) Encryption key management of client devices and endpoints within a protected network
US10389538B2 (en) Processing a security policy for certificate validation error
US8199916B2 (en) Selectively loading security enforcement points with security association information
US8386783B2 (en) Communication apparatus and communication method
WO2018001042A1 (zh) 报文传输方法、装置及系统
KR101387937B1 (ko) 사용자 인증을 통한 네트워크 자원 사용 제어 방법
Cisco Configuring IPSec Network Security
EP3200420B1 (en) Providing communications security to an end-to-end communication connection
US20230388106A1 (en) Privacy-Preserving Filtering of Encrypted Traffic

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17819039

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2017819039

Country of ref document: EP

Effective date: 20190103