WO2019137268A1

WO2019137268A1 - Data transmission method and device, network apparatus, and storage medium

Info

Publication number: WO2019137268A1
Application number: PCT/CN2018/125840
Authority: WO
Inventors: 齐旻鹏; 刘福文; 杨波
Original assignee: 中国移动通信有限公司研究院; 中国移动通信集团有限公司
Priority date: 2018-01-12
Filing date: 2018-12-29
Publication date: 2019-07-18
Also published as: CN110035036B; CN110035036A

Abstract

Disclosed are a data transmission method and device, a network apparatus, and a storage medium. The method comprises: receiving a data packet sent by a first network, wherein the received data packet is a data packet sent by a source network and capable of arriving at a target network by passing through at least one intermediate network, the first network is the source network corresponding to the received data packet or to an intermediate network of the at least one intermediate network, and the received data packet is a data packet signed by a border apparatus of the first network; performing, on the basis of information of the target network, transmission related processing on the content of the received data packet; generating a data packet to be transmitted on the basis of the received data packet and the processed data packet; performing signing on the data packet to be transmitted; and transmitting the signed data packet to a next hop network.

Description

Data transmission method, device, network device and storage medium

Cross-reference to related applications

The present application is filed on the basis of the Chinese Patent Application No. PCT Application No. PCT Application No

Technical field

The present disclosure relates to the field of network security technologies, and in particular, to a data transmission method, apparatus, network device, and storage medium.

Background technique

In the traditional communication network, the services provided by each operator have a certain regionality. In order to meet the global mobile communication requirements of users, different carrier networks are gradually connected through a variety of different methods, so as to provide services for users. Message signaling data and user data can be transmitted and processed across carriers to provide a basis for the user's global use.

In the early communication network interconnection, since the communication network was a fully enclosed network, the connection between the operators' networks was relatively closed, and no more security protection was considered. With the introduction of technologies such as IP, the network that the operators independently deploy still has certain closed conditions, which can effectively ensure the security between the network elements deployed centrally, but the network interfaces between the operators' networks are no longer connected. It is a closed environment, so it is necessary to provide security protection for the information transmission between these centrally deployed network element sets and network element sets.

Related technologies: For the security protection between different network domains, Internet Protocol Security (IPsec) is deployed on the border gateways of the two domains, and the connections between the two NEs in the network domain can be selected according to the actual deployment. Apply an IPsec connection. In this deployment mode, if the carrier network cannot be directly connected, there will be security risks, and when the non-adjacent carrier network attempts to transmit data, the network through which the data passes is not protected, and the information may be Was tampered with.

Summary of the invention

In order to solve the existing technical problems, embodiments of the present disclosure provide a data transmission method, apparatus, network device, and storage medium.

The technical solution of the embodiment of the present disclosure is implemented as follows:

The embodiment of the present disclosure provides a data transmission method, which is applied to a network device of an intermediate network, and includes:

Receiving a data packet sent by the first network; the received data packet is a data packet sent by the source network and capable of reaching the target network through the at least one intermediate network; the first network is a source network corresponding to the received data packet or An intermediate network of the at least one intermediate network; the received data packet is a data packet signed by a border device in the first network;

Transmitting and processing related to the content of the received data packet based on information of the target network;

Generating a to-be-sent data packet based on the received data packet and the processed data packet;

Sign the sending data packet;

Send the signed data packet to the next hop network.

In the above solution, the generating, according to the received data packet and the processed data packet, a data packet to be sent, including:

The received data packet and the corresponding signature and the processed data packet are packaged to obtain the to-be-sent data packet.

And comparing the received data packet with the processed data packet to obtain comparison information;

And encoding the processed data packet, the comparison information, and the signature corresponding to the received data packet to obtain the to-be-sent data packet.

In the above solution, the sending, according to the information of the target network, the related processing of sending the received data packet, including:

Verifying the signature of the received data packet;

After the verification succeeds, the received data packet is sent and processed according to the information of the target network.

The embodiment of the present disclosure further provides a data transmission method, which is applied to a network device of a target network, and includes:

Receiving a data packet sent by the second network; the received data packet is a data packet sent by the source network and reaching the target network through the at least one intermediate network; the second network is a last hop network of the target network; The received data packet is a data packet signed by at least a border device in each network;

Starting from the second network, the signatures in the received data packets are sequentially verified until the source network is verified.

In the above solution, the path of the received data packet transmission passes through N networks; N is an integer greater than or equal to 2; and the signature in the received data packet is sequentially verified from the second network. Until the source network is verified, including:

Verifying a correspondence between the received data packet and a corresponding signature; the second network is an Nth network of the path;

Obtaining, by the received data packet, a data packet sent by the N-1th network and a corresponding signature;

Verifying the correspondence between the data packet sent by the N-1th network and the corresponding signature; and so on, until the correspondence between the data packet sent by the source network and the corresponding signature is verified.

Obtaining comparison information and a signature corresponding to the N-1th network from the received data packet; the comparison information characterizing the data packet sent by the N-1th network and the Nth network based on the target network pair The content of the data packet sent by the N-1th network is sent to the deviation ratio information of the data packet after the relevant processing;

And using the comparison information to obtain the data packets sent by the N-1 networks; and verifying the correspondence between the data packets sent by the N-1th network and the corresponding signatures; and so on, until the data sent by the source network is verified. The correspondence between the package and the corresponding signature.

The embodiment of the present disclosure further provides a data transmission apparatus, including:

a first receiving unit, configured to receive a data packet sent by the first network; the received data packet is a data packet sent by the source network and capable of reaching the target network through the at least one intermediate network; the first network is the received a source network corresponding to the data packet or an intermediate network of the at least one intermediate network; the received data packet is a data packet signed by a border device in the first network;

a first processing unit, configured to: perform transmission related processing on content of the received data packet based on information of the target network; generate a to-be-sent data packet based on the received data packet and the processed data packet; and send the data packet to be sent The data packet is signed;

The sending unit is configured to send the signed data packet to the next hop network.

a second receiving unit, configured to receive a data packet sent by the second network; the received data packet is a data packet sent by the source network and reaching the target network through the at least one intermediate network; the second network is the target network a last hop network; the received data packet is a data packet signed by at least a border device in each network;

The second processing unit is configured to, from the second network, verify the signatures in the received data packets in sequence until the source network is verified.

The embodiment of the present disclosure further provides a network device, including:

a first communication interface, configured to receive a data packet sent by the first network; the received data packet is a data packet sent by the source network and capable of reaching the target network through the at least one intermediate network; the first network is the received a source network corresponding to the data packet or an intermediate network of the at least one intermediate network; the received data packet is a data packet signed by a border device in the first network;

a first processor, configured to perform a transmission related process on the content of the received data packet based on information of the target network; generate a to-be-sent data packet based on the received data packet and the processed data packet; and send the data packet to be sent The data packet is signed;

The first communication interface is further configured to send the signed data packet to the next hop network.

In the above solution, the first processor is configured to:

And packetizing the received data packet and the corresponding signature and the processed data packet to obtain the to-be-sent data packet;

or,

And comparing the received data packet with the processed data packet to obtain comparison information, and packaging the processed data packet, the comparison information, and a signature corresponding to the received data packet And obtaining the to-be-sent data packet.

In the above solution, the first processor is configured to:

Verifying the signature of the received data packet;

a second communication interface, configured to receive a data packet sent by the second network; the received data packet is a data packet sent by the source network and reaching the target network through the at least one intermediate network; the second network is the target network a last hop network; the received data packet is a data packet signed by at least a border device in each network;

The second processor is configured to, from the second network, verify the signatures in the received data packets in sequence until the source network is verified.

In the above solution, the path of the received data packet transmission passes through N networks; N is an integer greater than or equal to 2; and the second processor is configured to:

Verifying a correspondence between the received data packet and a corresponding signature; the second network is an Nth network of the path; and acquiring, by the received data packet, a data packet sent by the N-1th network and corresponding Signature; verify the correspondence between the data packet sent by the N-1th network and the corresponding signature; and so on, until the correspondence between the data packet sent by the source network and the corresponding signature is verified;

or,

Verifying a correspondence between the received data packet and a corresponding signature; the second network is an Nth network of the path; obtaining comparison information from the received data packet and corresponding to the N-1th network Signing; the comparison information characterizing the data packet sent by the N-1th network and the data packet of the Nth network transmitting and processing the content of the data packet sent by the N-1 network based on the target network Deviation comparison information; data packets sent by N-1 networks obtained by using the comparison information; and verifying correspondence between data packets sent by the N-1th network and corresponding signatures; and so on until verification Correspondence between data packets sent by the source network and corresponding signatures.

An embodiment of the present disclosure also provides a network device, including: a first processor and a first memory configured to store a computer program executable on the processor,

The first processor is configured to perform the steps of any method on the network device side of the intermediate network when the computer program is run.

Embodiments of the present disclosure also provide a network device, including: a second processor and a second memory configured to store a computer program executable on the processor,

The second processor is configured to perform the step of any method on the network device side of the target network when the computer program is run.

The embodiment of the present disclosure further provides a storage medium on which a computer program is stored, and when the computer program is executed by the processor, the steps of any method of the network device side of the intermediate network are implemented, or the network device side of the target network is implemented. The steps of either method.

The data transmission method, device, network device and storage medium provided by the embodiments of the present disclosure, in the source network, the data packet to be sent is signed and sent to the intermediate network; in the intermediate network, the information is received based on the information of the target network. Transmitting the content of the data packet; generating a to-be-sent data packet based on the received data packet and the processed data packet; signing the data packet to be sent; and transmitting the signed data packet to the next hop network; In the target network, the data packet is received, and the signature of the received data packet is sequentially verified on the previous network until the source network is verified. Since the data packet has a signature corresponding to the network, the signature can be used for the corresponding The network is verified, so the security protection of the data packet can be realized.

DRAWINGS

1 is a schematic diagram of a connection relationship between two networks in the related art;

2 is a schematic diagram of a connection relationship between multiple networks in an embodiment of the present disclosure;

3 is a schematic flowchart of a data transmission method according to an embodiment of the present disclosure;

4 is a schematic flow chart of another data transmission method according to an embodiment of the present disclosure;

FIG. 5 is a schematic flowchart of a third data transmission method according to an embodiment of the present disclosure;

6 is a schematic flowchart of a data transmission process according to an application embodiment of the present disclosure;

FIG. 7 is a schematic structural diagram of a data transmission apparatus according to an embodiment of the present disclosure;

FIG. 8 is a schematic structural diagram of another data transmission apparatus according to an embodiment of the present disclosure;

FIG. 9 is a schematic structural diagram of a network device according to an embodiment of the present disclosure;

FIG. 10 is a schematic structural diagram of another network device according to an embodiment of the present disclosure;

FIG. 11 is a schematic structural diagram of a data transmission system according to an embodiment of the present disclosure.

Detailed ways

The present disclosure will be further described in detail below with reference to the accompanying drawings and embodiments.

In the related art, the network security between the operators adopts an IP-based network domain security protection method (NDS/IP (Network Domain Security: IP network layer security)), and the method mainly divides the communication network into different network security. Domain, then place a secure network at the boundary of the security domain. When two network security domains are connected, IPsec needs to be applied on the border gateways of the two domains. For example, as shown in Figure 1, in order to ensure the security of the network, a secure network needs to be placed on the border gateway (ie, SEG _A ) and the border gateway (ie, SEG _B ). In the connection between two network elements in the network domain, an IPsec connection can be optionally applied according to the actual deployment situation.

On the one hand, this security protection method is well adapted to the realistic scenario of centralized deployment of communication network operators, and on the other hand, it can flexibly provide security protection between the network domain and the network domain, thereby ensuring two adjacent network domains. The security between.

However, the related art only considers the security protection between two different network domains, and assumes that the information within the network domain is trusted and cannot be changed. This assumption is established when two different operators are directly connected. However, when the operator's network connection is complicated and the two operators cannot directly connect, the mechanism will have major problems. When multiple networks are connected one by one, security mechanisms based on related technologies can only establish secure connections between two adjacent network domains one by one. At this time, if the non-adjacent carrier network attempts to transmit data, the data is not protected inside the network passing through, and the information may be tampered with. For example, as shown in FIG. 2, when three network domains are connected one by one, that is, the first network domain is connected to the second network domain, and the second network domain is connected to the third network domain, when the first network domain tries When data is transmitted to the third network domain, the data inside the network (ie, the second network domain) that passes through the middle is unprotected, and the information may be tampered with. In addition, after the tamperized data packet arrives at the target network, the target network cannot confirm where the data packet is modified and cannot be traced. The reason for this is because the intermediate network is an untrusted network domain, and there is no direct trust relationship between the source network and the target network. Therefore, the related art assumes that all network domains are trusted network domains is unreasonable.

At this point, consider introducing end-to-end security protection. However, end-to-end security cannot meet the security requirements of the communication network, because when the data packet passes through the intermediate network, the intermediate network needs to modify part of the content of the data packet, such as the source address and the destination address, to facilitate routing. If end-to-end protection is performed, the intermediate network cannot modify the contents of the packet, and the packets will not be forwarded normally, resulting in communication interruption.

Based on this, in various embodiments of the present disclosure, multiple networks are connected together, and communication between all networks can be directly or indirectly transmitted through other networks, and there is no direct connection between some networks, one The edge devices in the network have the ability to sign data packets, apply integrity protection to the data packets and provide signatures for the network; interconnected networks whose boundaries sign the packets are mutually trustworthy.

The embodiment of the present disclosure provides a data transmission method, which is applied to a network device of an intermediate network. As shown in FIG. 3, the method includes:

Step 301: Receive a data packet sent by the first network.

Here, the received data packet is a data packet transmitted by the source network and capable of reaching the target network through at least one intermediate network. At the same time, the received data packet is a data packet signed by a border device in the first network.

The first network is a source network corresponding to the received data packet or an intermediate network of the at least one intermediate network.

Step 302: Perform a transmission related process on the content of the received data packet based on the information of the target network.

Here, in actual application, the transmission related processing may include modifying a source address, a target address, and the like in the data packet to perform routing.

After the data packet is transmitted to the intermediate network, in order to further ensure the security of the data packet transmission, the intermediate network can verify the signature of the received data packet (also can be understood as verification).

Based on this, in an embodiment, in step 302, the signature of the received data packet is verified;

Certainly, after the verification fails, an error message is returned to the first network, and the received data packet is not sent based on the information of the target network.

Step 303: Generate a to-be-sent data packet based on the received data packet and the processed data packet.

Here, there are two ways to generate a data packet to be sent:

In a first manner, the received data packet, the corresponding signature, and the processed data packet are packaged to obtain the data packet to be sent;

In a second manner, the received data packet is compared with the processed data packet to obtain comparison information.

Wherein, in actual application, one of the two methods may be selected according to the need to implement.

In the first mode, the received data packet, the corresponding signature, and the processed data packet are directly packaged to obtain the to-be-sent data packet.

In the second mode, the network device needs to first compare the received data packet with the processed data packet to obtain a difference between two data packets, such as a source address and a target address. And obtaining the comparison information; and then packetizing the processed data packet, the comparison information, and the signature corresponding to the received data packet to obtain the to-be-sent data packet.

Step 304: Sign the data packet to be sent;

Here, the signature algorithm may be RSA, ElGamal, Fiat-Shamir, Guillou-Quisquarter, Schnorr, Ong-Schnorr-Shamir digital signature algorithm, Des/DSA, elliptic curve digital signature algorithm or finite automaton digital signature algorithm. Of course, with the development of technology, it can also be a new digital signature algorithm. The embodiment of the present disclosure does not limit this.

Step 305: Send the signed data packet to the next hop network.

Here, in actual application, the next hop network may be determined according to information of the target network, which is an intermediate network or the target network. As can be seen from the above description, the signature is used to verify the corresponding network.

Correspondingly, the embodiment of the present disclosure further provides a data transmission method, which is applied to a network device of a target network, as shown in FIG. 4, the method includes:

Step 401: Receive a data packet sent by the second network.

Here, the received data packet is a data packet sent by the source network and reaching the target network through at least one intermediate network; meanwhile, the received data packet is a data packet signed by at least a border device in each network.

That is, the path of the received data packet transmission passes through N networks; N is an integer greater than or equal to 2. More specifically, the received data packet is counted from the source network to the first network, and reaches the target network through the N networks, that is, the N networks include the source network and the at least one intermediate network.

The second network is a last hop network of the target network.

Step 402: Starting from the second network, verify signatures in the received data packets in sequence until the source network is verified.

As described above, since the manner of generating the data to be transmitted is the above two manners, when the data packet to be sent is generated by using the foregoing first manner, the verification process includes:

When the data packet to be sent is generated by using the second method described above, the verification process includes:

As can be seen from the above description, as shown in FIG. 5, a process in which a data packet is transmitted from a source network to a target network (a method of data transmission) includes:

Step 501: The network device in the source network signs the to-be-sent data packet and sends the data packet to the intermediate network.

Step 502: The network device of the intermediate network sends a related process to the content of the received data packet based on the information of the target network.

Step 503: The network device of the intermediate network generates a to-be-sent data packet based on the received data packet and the processed data packet, and signs the data packet to be sent, and sends the signed data packet to the next hop network.

Here, when the data packet needs to pass through multiple intermediate networks to reach the target network, the network devices of the multiple intermediate networks perform steps 502-503, that is, after the network device of each intermediate network receives the data packet, step 502 needs to be performed. ~ 503 to transfer the packet to the target network.

Step 504: The target network receives the data packet, starts with the previous network of itself, and sequentially verifies the signature in the received data packet until the source network is verified.

It should be noted that the specific processing procedures of the network device of the intermediate network and the network device of the target network are detailed above, and are not described herein again.

In addition, the source network refers to an initial network corresponding to a data packet, which can be understood as a network that initially sends a data packet; correspondingly, the target network refers to a final network corresponding to a data packet, which can be understood as a network in which a data packet finally arrives. .

In the data transmission method provided by the embodiment of the present disclosure, in the source network, the data packet to be sent is signed and sent to the intermediate network; in the intermediate network, the content of the received data packet is sent and processed based on the information of the target network. Generating a to-be-sent data packet based on the received data packet and the processed data packet; signing the data packet to be sent; and transmitting the signed data packet to the next hop network; receiving the data packet in the target network, Start with the previous network of itself, and verify the signatures in the received data packets in turn until the source network is verified. Since the data packets have signatures corresponding to the network, the corresponding network can be verified by using the signature, so that it can be implemented. Security protection of the packet.

The present disclosure will be further described in detail below in conjunction with application examples.

The process of data transmission in this application embodiment, as shown in FIG. 6, includes the following steps:

Step 601: Any network element in the source network sends a data packet m, and the data packet m is not protected.

Step 602: When the data packet reaches the boundary of the source network, the data packet is signed sig(m) by the boundary network element, and sent to the intermediate network.

At this point, the packet is a signed packet [m, sig(m)].

Step 603: After the signed data packet [m, sig(m)] reaches the directly connected intermediate network, the signature of the data packet is verified by the intermediate network;

Here, if the verification fails, the error message is returned to the up hop network; if the verification is passed, step 604 is continued.

Assuming that the data packet is M and the signature is sig(M), the correspondence between sig(M) and M is directly verified.

Step 604: After receiving the data packet, the intermediate network may modify the content of the data packet (assuming the modified data packet is recorded as m'), and send the information to the next network based on the information of the target network (the next network may be in the middle) Network or target network);

Step 605: When the data packet of the intermediate network reaches the boundary of the intermediate network, the border network element signs the sig(M) to be sent, and sends the data.

Here, when the receiving network of the data packet is still the intermediate network, the receiving network transmits the signed transmission data [M, sig(M)] as [m, sig(m)], and steps 603 to 605 are performed.

In step 605, the border network element (such as a border gateway, etc.) needs to generate a data packet to be sent and perform signature.

Here, there are two ways to generate a packet to be sent:

The first mode: the boundary network element encapsulates the received original data packet m, and the corresponding signature sig(m), and the modified data packet m', that is, the information to be sent M=m'|| (m||sig(m)) and sign sig(M).

The second way: the boundary network element compares the received original data m packet with the modified data packet m' (records the deviation as - operation, so the deviation is recorded as m-m'), and then the modified data Packet m', deviation comparison, the signature sig(m) corresponding to the original data packet m is packaged together, that is, the information to be transmitted M=m'||(m-m'||sig(m)), and the signature sig(M) ).

Step 606: After receiving the data packet, the target network sequentially verifies the correctness of the signature from the previous network until the source network is verified.

Here, in the verification, when the information to be transmitted is generated in the first manner, the target network first verifies the correspondence between the sig(M) and the M of the previous network. At this time, it is assumed that the last network received by the nth network is sent. The incoming data packet is M _n-1 , and the modified data packet is m _n , then the information of the nth network received by the target network is M=m _n ||M _n-1 ||sig(M _n-1 );

After the verification is passed, the correspondence between the back-test and the previous network is continued. At this time, the information of the previous network is M=M _n-1 =m _n-1 ||M _n-2 ||sig(M _n-2 ), verify in turn until verification to the source network, ie m = sig (m).

When the information to be sent is generated in the second manner, the target network first verifies the correspondence between the sig(M) and the M of the previous network. At this time, it is assumed that the data packet sent by the previous network received by the nth network is m _n-1 , the modified data packet is m _n , information M=m _n ||m _n -m _n-1 ||sig(m _n-1 );

After the verification is passed, the correspondence between the back-test and the previous network is continued. At this time, since the data packet of the jacket network is not retained, but the original text is retained, only the deviation from the original text is retained, so the data packet of the previous network needs to be based on the current data. There are data and deviations to recover, and the recovery action is recorded as a + operation. That is, M = m _n-1 = m _n + (m _{n-1 -} m _n ). Verify in turn until verification to the source network, ie verify to m=sig(m).

As can be seen from the above description, the solution provided by the embodiment of the present disclosure is a new untrusted inter-domain data transfer protection method, in which the data packet is hop-by-hop security protection between network domains, and thus, Can achieve the following effects:

1. It can meet the modification requirements of the intermediate network for data packets;

2. There is no need for a trust relationship between the source network and the target network;

3. The target network can verify the original information of the data packet;

4. If the packet is maliciously tampered with, the target network can find out which network the change occurred on.

In order to implement the method of the network device side of the intermediate network in the embodiment of the present disclosure, the embodiment of the present disclosure further provides a data transmission device, which is disposed in the network device of the intermediate network. As shown in FIG. 7, the device includes:

The first receiving unit 71 is configured to receive a data packet sent by the first network; the received data packet is a data packet that is sent by the source network and can reach the target network through the at least one intermediate network; the first network is the receiving a source network corresponding to the data packet or an intermediate network of the at least one intermediate network; the received data packet is a data packet signed by a border device in the first network;

The first processing unit 72 is configured to: perform transmission related processing on the content of the received data packet based on information of the target network; generate a to-be-sent data packet based on the received data packet and the processed data packet; Send a packet for signature;

The sending unit 73 is configured to send the signed data packet to the next hop network.

In an embodiment, the first processing unit 72 is specifically configured to:

or,

Based on this, in an embodiment, the first processing unit 72 is specifically configured to:

Verifying the signature of the received data packet;

Of course, after the verification fails, the first processing unit 72 returns an error message to the first network, and does not perform transmission related processing on the received data packet based on the information of the target network.

In practical applications, the first receiving unit 71 and the transmitting unit 73 may be implemented by a communication interface in a data transmission device; the first processing unit 72 may be implemented by a processor in the data transmission device.

In order to implement the method on the network device side of the target network of the embodiment of the present invention, the embodiment of the present disclosure further provides a data transmission device, which is disposed in a network device of the target network, as shown in FIG.

The second receiving unit 81 is configured to receive a data packet sent by the second network; the received data packet is a data packet sent by the source network and reaches the target network through the at least one intermediate network; the second network is the target network a last hop network; the received data packet is a data packet signed by at least a border device in each network;

The second processing unit 82 is configured to, from the second network, verify the signatures in the received data packets in sequence until the source network is verified.

The received data packet is a data packet sent by the source network and reaching the target network through at least one intermediate network; meanwhile, the received data packet is a data packet signed by at least a border device in each network.

The second processing unit 82 is specifically configured to: when the data to be sent is generated in the foregoing manner, the second processing unit 82 is specifically configured to:

When the data packet to be sent is generated in the foregoing manner, the second processing unit 82 is specifically configured to:

In practical applications, the second receiving unit 81 can be implemented by a communication interface in the data transmission device; the second processing unit 82 can be implemented by a processor in the data transmission device.

It should be noted that, when the data transmission device provided by the foregoing embodiment performs data transmission, only the division of each of the foregoing program modules is illustrated. In an actual application, the processing may be allocated by different program modules as needed. The internal structure of the device is divided into different program modules to complete all or part of the processing described above. In addition, the data transmission apparatus and the data transmission method embodiment provided by the foregoing embodiments are in the same concept, and the specific implementation process is described in detail in the method embodiment, and details are not described herein again.

Based on the hardware implementation of the foregoing apparatus, and in order to implement the method of the network device side of the intermediate network in the embodiment of the present disclosure, the embodiment of the present disclosure further provides a network device. As shown in FIG. 9, the network device 90 includes:

The first communication interface 91 is capable of performing information interaction with other network devices;

The first processor 92 is connected to the first communication interface 91 to implement information interaction with other network devices, and is configured to perform the method provided by one or more technical solutions on the network device side of the intermediate network when the computer program is run .

Specifically, the first communication interface 91 is configured to receive a data packet sent by the first network; the received data packet is a data packet that is sent by the source network and can reach the target network through the at least one intermediate network; the first network is a source network corresponding to the received data packet or an intermediate network of the at least one intermediate network; the received data packet is a data packet signed by a border device in the first network;

The first processor 92 is configured to: perform transmission related processing on the content of the received data packet based on information of the target network; generate a to-be-sent data packet based on the received data packet and the processed data packet; Send a packet for signature;

The first communication interface 91 is further configured to send the signed data packet to the next hop network.

In an embodiment, the first processor 92 is specifically configured to:

or,

In an embodiment, the first processor 92 is specifically configured to:

Verifying the signature of the received data packet;

Of course, in actual application, the network device 90 may further include: a first memory 93. The various components in the network device 90 are coupled together by a bus system 94. It will be appreciated that bus system 94 is configured to enable connection communication between these components. The bus system 94 includes, in addition to the data bus, a power bus, a control bus, and a status signal bus. However, for clarity of description, various buses are labeled as bus system 94 in FIG.

The number of the first processors 92 is at least one.

The first memory 93 in an embodiment of the present disclosure is configured to store various types of data to support operation of the network device 90. Examples of such data include any computer program configured to operate on network device 90.

The method disclosed in the above embodiments of the present disclosure may be applied to the first processor 92 or implemented by the first processor 92. The first processor 92 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the first processor 92 or an instruction in a form of software. The first processor 92 described above may be a general purpose processor, a digital signal processor (DSP), or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or the like. The first processor 92 may implement or perform the methods, steps, and logic blocks disclosed in the embodiments of the present disclosure. A general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present disclosure may be directly implemented as a hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium located in the first memory 93, the first processor 92 reading the information in the first memory 93, in conjunction with its hardware, to perform the steps of the foregoing method.

In an exemplary embodiment, the network device 90 may be configured by one or more Application Specific Integrated Circuits (ASICs), DSPs, Programmable Logic Devices (PLDs), and Complex Programmable Logic Devices (CPLDs). , Complex Programmable Logic Device), Field-Programmable Gate Array (FPGA), General Purpose Processor, Controller, Micro Controller Unit (MCU), Microprocessor, or other electronics The component implementation is configured to perform the aforementioned method.

In order to implement the method of the network device side of the target network of the embodiment of the present disclosure, and based on the hardware implementation of the foregoing apparatus, the embodiment of the present disclosure further provides a network device. As shown in FIG. 10, the network device 100 includes:

The second communication interface 101 is capable of performing information interaction with other network devices;

The second processor 102 is connected to the second communication interface 101 to implement information interaction with other network devices, and is configured to perform the method provided by one or more technical solutions on the network device side of the target network when the computer program is run .

Specifically, the second communication interface 101 is configured to receive a data packet sent by the second network; the received data packet is a data packet that is sent by the source network and reaches the target network through the at least one intermediate network; the second network a previous hop network of the target network; the received data packet is a data packet signed by at least a border device in each network;

The second processor 102 is configured to, from the second network, verify the signatures in the received data packets in sequence until the source network is verified.

In an embodiment, the path of the received data packet transmission passes through N networks; N is an integer greater than or equal to 2; and the second processor 102 is specifically configured to:

or,

Of course, in actual application, the network device 100 may further include: a second memory 103. The various components in network device 100 are coupled together by bus system 104. It will be appreciated that the bus system 104 is configured to enable connection communication between these components. The bus system 104 includes, in addition to the data bus, a power bus, a control bus, and a status signal bus. However, for clarity of description, various buses are labeled as bus system 104 in FIG.

The number of the second processors 102 is at least one.

The second memory 102 in an embodiment of the present disclosure is configured to store various types of data to support operation of the network device 70. Examples of such data include any computer program configured to operate on network device 100.

The method disclosed in the above embodiments of the present disclosure may be configured in the second processor 102 or implemented by the second processor 102. The second processor 102 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the foregoing method may be completed by an integrated logic circuit of hardware in the second processor 102 or an instruction in a form of software. The second processor 102 described above may be a general purpose processor, a DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or the like. The second processor 72 can implement or perform the various methods, steps, and logic blocks disclosed in the embodiments of the present disclosure. A general purpose processor can be a microprocessor or any conventional processor or the like. The steps of the method disclosed in the embodiments of the present disclosure may be directly implemented as a hardware decoding processor, or may be performed by a combination of hardware and software modules in the decoding processor. The software module can be located in a storage medium located in the second memory 103, the second processor 102 reading the information in the second memory 103, and completing the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, network device 100 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general purpose processors, controllers, MCUs, Microprocessors, or other electronic components configured to perform the aforementioned methods.

It will be appreciated that the memories (first memory 93 and second memory 103) of embodiments of the present disclosure may be either volatile memory or non-volatile memory, and may include both volatile and non-volatile memory. The non-volatile memory may be a Read Only Memory (ROM), a Programmable Read-Only Memory (PROM), or an Erasable Programmable Read (EPROM). Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM), Ferromagnetic Random Access Memory (FRAM), Flash Memory, Magnetic Surface Memory , CD-ROM, or Compact Disc Read-Only Memory (CD-ROM); the magnetic surface memory can be a disk storage or a tape storage. The volatile memory can be a random access memory (RAM) that acts as an external cache. By way of example and not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Synchronous Static Random Access Memory (SSRAM), Dynamic Random Access (SSRAM). DRAM (Dynamic Random Access Memory), Synchronous Dynamic Random Access Memory (SDRAM), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM), enhancement Enhanced Synchronous Dynamic Random Access Memory (ESDRAM), Synchronous Dynamic Random Access Memory (SLDRAM), Direct Memory Bus Random Access Memory (DRRAM) ). The memories described in the embodiments of the present disclosure are intended to include, but are not limited to, these and any other suitable types of memory.

The embodiment of the present disclosure further provides a data transmission system. As shown in FIG. 11, the system includes:

The network device 111 is located in the source network and configured to sign the to-be-sent data packet and send it to the intermediate network.

The network device 112 is located in the intermediate network, configured to receive the data packet, and perform related processing on the content of the received data packet based on the information of the target network; and generate a to-be-sent data packet based on the received data packet and the processed data packet. ; to sign the transmitted data packet; and send the signed data packet to the next hop network;

The network device 113, located in the target network, is configured to receive the data packet, start with the previous network of itself, and sequentially verify the signature in the received data packet until the source network is verified.

It should be noted that the specific processing procedures of the network device 112 and the network device 113 are detailed above, and are not described herein again.

In an exemplary embodiment, an embodiment of the present disclosure further provides a storage medium, that is, a computer storage medium, particularly a computer readable storage medium, for example, including a first memory 93 storing a computer program, which may be provided by the network device 90. The first processor 92 executes to perform the steps described in the foregoing methods. As another example, a second memory 103 storing a computer program can be included, which can be executed by the second processor 102 of the network device 100 to perform the steps described in the foregoing methods. The computer readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM.

It should be noted that the technical solutions described in the embodiments of the present disclosure may be arbitrarily combined without conflict.

The above description is only for the preferred embodiments of the present disclosure, and is not intended to limit the scope of the disclosure.

Claims

A data transmission method includes:

Receiving a data packet sent by the first network; the received data packet is a data packet sent by the source network and capable of reaching the target network through the at least one intermediate network; the first network is a source network corresponding to the received data packet or An intermediate network of the at least one intermediate network; the received data packet is a data packet signed by a border device in the first network;

Transmitting and processing related to the content of the received data packet based on information of the target network;

Generating a to-be-sent data packet based on the received data packet and the processed data packet;

Sign the sending data packet;

Send the signed data packet to the next hop network.
The method of claim 1, wherein the generating the to-be-sent data packet based on the received data packet and the processed data packet comprises:

The received data packet and the corresponding signature and the processed data packet are packaged to obtain the to-be-sent data packet.
The method of claim 1, wherein the generating the to-be-sent data packet based on the received data packet and the processed data packet comprises:

And comparing the received data packet with the processed data packet to obtain comparison information;

And encoding the processed data packet, the comparison information, and the signature corresponding to the received data packet to obtain the to-be-sent data packet.
The method of claim 1, wherein the transmitting the related processing of the received data packet based on the information of the target network comprises:

Verifying the signature of the received data packet;

After the verification succeeds, the received data packet is sent and processed according to the information of the target network.
A data transmission method includes:

Receiving a data packet sent by the second network; the received data packet is a data packet sent by the source network and reaching the target network through the at least one intermediate network; the second network is a last hop network of the target network; The received data packet is a data packet signed by at least a border device in each network;

Starting from the second network, the signatures in the received data packets are sequentially verified until the source network is verified.
The method of claim 5, wherein the path of the received data packet transmission passes through N networks; N is an integer greater than or equal to 2; said starting from said second network, said received data The signatures in the package are verified in turn until the source network is verified, including:

Verifying a correspondence between the received data packet and a corresponding signature; the second network is an Nth network of the path;

Obtaining, by the received data packet, a data packet sent by the N-1th network and a corresponding signature;

Verifying the correspondence between the data packet sent by the N-1th network and the corresponding signature; and so on, until the correspondence between the data packet sent by the source network and the corresponding signature is verified.
The method of claim 5, wherein the path of the received data packet transmission passes through N networks; N is an integer greater than or equal to 2; said starting from said second network, said received data The signatures in the package are verified in turn until the source network is verified, including:

Verifying a correspondence between the received data packet and a corresponding signature; the second network is an Nth network of the path;

Obtaining comparison information and a signature corresponding to the N-1th network from the received data packet; the comparison information characterizing the data packet sent by the N-1th network and the Nth network based on the target network pair The content of the data packet sent by the N-1th network is sent to the deviation ratio information of the data packet after the relevant processing;

And using the comparison information to obtain the data packets sent by the N-1 networks; and verifying the correspondence between the data packets sent by the N-1th network and the corresponding signatures; and so on, until the data sent by the source network is verified. The correspondence between the package and the corresponding signature.
A data transmission device comprising:

a first receiving unit, configured to receive a data packet sent by the first network; the received data packet is a data packet sent by the source network and capable of reaching the target network through the at least one intermediate network; the first network is the received a source network corresponding to the data packet or an intermediate network of the at least one intermediate network; the received data packet is a data packet signed by a border device in the first network;

a first processing unit, configured to: perform transmission related processing on content of the received data packet based on information of the target network; generate a to-be-sent data packet based on the received data packet and the processed data packet; and send the data packet to be sent The data packet is signed;

The sending unit is configured to send the signed data packet to the next hop network.
A data transmission device comprising:

a second receiving unit, configured to receive a data packet sent by the second network; the received data packet is a data packet sent by the source network and reaching the target network through the at least one intermediate network; the second network is the target network a last hop network; the received data packet is a data packet signed by at least a border device in each network;

The second processing unit is configured to, from the second network, verify the signatures in the received data packets in sequence until the source network is verified.
A network device, including:

a first communication interface, configured to receive a data packet sent by the first network; the received data packet is a data packet sent by the source network and capable of reaching the target network through the at least one intermediate network; the first network is the received a source network corresponding to the data packet or an intermediate network of the at least one intermediate network; the received data packet is a data packet signed by a border device in the first network;

a first processor, configured to perform a transmission related process on the content of the received data packet based on information of the target network; generate a to-be-sent data packet based on the received data packet and the processed data packet; and send the data packet to be sent The data packet is signed;

The first communication interface is further configured to send the signed data packet to the next hop network.
The network device according to claim 10, wherein the first processor is configured to:

And packetizing the received data packet and the corresponding signature and the processed data packet to obtain the to-be-sent data packet;

or,

And comparing the received data packet with the processed data packet to obtain comparison information, and packaging the processed data packet, the comparison information, and a signature corresponding to the received data packet And obtaining the to-be-sent data packet.
The network device according to claim 10, wherein the first processor is configured to:

Verifying the signature of the received data packet;

After the verification succeeds, the received data packet is sent and processed according to the information of the target network.
A network device, including:

a second communication interface, configured to receive a data packet sent by the second network; the received data packet is a data packet sent by the source network and reaching the target network through the at least one intermediate network; the second network is the target network a last hop network; the received data packet is a data packet signed by at least a border device in each network;

The second processor is configured to, from the second network, verify the signatures in the received data packets in sequence until the source network is verified.
The network device according to claim 13, wherein the path of the received data packet transmission passes through N networks; N is an integer greater than or equal to 2; and the second processor is configured to:

Verifying a correspondence between the received data packet and a corresponding signature; the second network is an Nth network of the path; and acquiring, by the received data packet, a data packet sent by the N-1th network and corresponding Signature; verify the correspondence between the data packet sent by the N-1th network and the corresponding signature; and so on, until the correspondence between the data packet sent by the source network and the corresponding signature is verified;

or,

Verifying a correspondence between the received data packet and a corresponding signature; the second network is an Nth network of the path; obtaining comparison information from the received data packet and corresponding to the N-1th network Signing; the comparison information characterizing the data packet sent by the N-1th network and the data packet of the Nth network transmitting and processing the content of the data packet sent by the N-1 network based on the target network Deviation comparison information; data packets sent by N-1 networks obtained by using the comparison information; and verifying correspondence between data packets sent by the N-1th network and corresponding signatures; and so on until verification Correspondence between data packets sent by the source network and corresponding signatures.
A network device comprising: a first processor and a first memory configured to store a computer program executable on the processor,

Wherein the first processor is configured to perform the steps of the method of any one of claims 1 to 4 when the computer program is run.
A network device comprising: a second processor and a second memory configured to store a computer program executable on the processor,

Wherein the second processor is configured to perform the steps of the method of any one of claims 5 to 7 when the computer program is run.
A storage medium having stored thereon a computer program, the computer program being executed by a processor to perform the steps of the method of any one of claims 1 to 4, or the method of any one of claims 5 to 7 step.