WO2020078164A1

WO2020078164A1 - Method and device for creating tunnel, and storage medium

Info

Publication number: WO2020078164A1
Application number: PCT/CN2019/107043
Authority: WO
Inventors: 吴水华
Original assignee: 中兴通讯股份有限公司
Priority date: 2018-10-19
Filing date: 2019-09-20
Publication date: 2020-04-23
Also published as: CN111083091A; CN111083091B

Abstract

The present application discloses a method for creating a tunnel. The method comprises: in the initial negotiation phase for a secret key, determining that a message receiver has the ability to create an extended virtual private network (VPN) tunnel according to the interaction information in the initial negotiation phase (101); when the data carried in the extended VPN tunnel satisfy the conditions for the creation thereof, extracting feature information for creating the extended VPN tunnel from the current user message (102); generating, according to the feature information, an extended code for creating the extended VPN tunnel (103); and creating the extended VPN tunnel according to the extended code (104). The present application further discloses a device for creating a tunnel and a storage medium.

Description

Tunnel creation method, device and storage medium

cross reference

This application refers to the Chinese patent application No. 201811223937.x filed on October 19, 2018 and titled "A tunnel creation method, device and storage medium", which is fully incorporated by reference into this application.

Technical field

This application relates to network communication technology, and in particular to a method, device and storage medium for creating an Internet Protocol Security (IPSec) Tunnel.

Background technique

VPN refers to the technology of establishing a private network on a public network. VPN supports the establishment of a VPN tunnel between the two parties in order to encrypt the transmission process and improve transmission security. In the process of establishing a VPN tunnel, the VMs of both parties of the communication determine the VPN tunnel common parameters of the two parties through multiple negotiations based on their respective configured parameters, keys, and certificates. The VPN tunnel common parameters include encryption and decryption algorithms, authentication algorithms, and keys , Certificates, etc. After determining the common parameters of the VPN tunnel, both parties of the communication generate a tunnel descriptor (Security Association, SA) containing the common parameters of the VPN tunnel to complete the establishment of the tunnel between the two parties.

In some cases, TS (Traffic Selector, traffic filter) payload is generated from the quintuple information of source IP address, destination IP address, transport layer protocol number, source port, and destination port, thereby creating a single different virtual private network ( VPN, Virtual Private Network) tunnel.

However, in 5G (fifth generation communication system) base station communication, due to the large data throughput of the user plane, the processing capacity of a single VPN tunnel created by many devices using quintuple information is limited.

Summary of the invention

To solve the existing technical problems, the embodiments of the present application are expected to provide a tunnel creation method, device, and storage medium, which can dynamically create multiple extended VPN tunnels to offload data service flows when the amount of data is large.

The technical solution of the embodiment of the present application is implemented as follows: According to an aspect in the embodiment of the present application, a method for creating a tunnel is provided, the method comprising: in an initial negotiation phase for a key, according to the initial negotiation phase Interactive information, it is determined that the message recipient has the ability to create an extended virtual information private network VPN tunnel; when the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel, it is extracted from the current user message for creation Characteristic information of the extended VPN tunnel; generating an extension code for creating the extended VPN tunnel according to the characteristic information; creating the extended VPN tunnel according to the extension code.

In the above solution, the method further includes: detecting the data traffic carried in the extended VPN tunnel to obtain a detection result; when the detection result indicates that the data traffic reaches the first preset traffic threshold, determining The data carried in the extended VPN tunnel satisfies the conditions of the extended VPN tunnel.

In the above solution, in the initial negotiation stage for the key, according to the interaction information in the initial negotiation stage, it is determined that the message receiver has the ability to create an extended VPN tunnel, including: extracting the capability negotiation from the interaction information in the initial negotiation stage Information to obtain an extraction result; when the extraction result represents the interaction information in the initial negotiation stage and the capability negotiation information is successfully extracted, it is determined that the message recipient has the capability to create the extended VPN tunnel.

In the above solution, the feature information includes: information for creating the extended VPN tunnel except for quintuple information; wherein, the quintuple information includes: source IP address, source port, destination IP address, and destination Port and transport layer protocol numbers.

In the above solution, creating the extended VPN tunnel according to the extended code includes: in the second negotiation phase for the key, loading the extended code in the extended field of the TS load of the traffic filter; sending to the message receiver Carrying the second interaction information of the extension code; receiving the first response information of the message receiver for the second interaction information; determining that the extension code is included in the first response information, determining the The extended VPN tunnel is created.

In the above solution, creating the extended VPN tunnel according to the extended code includes: during the second negotiation phase for the key, sending second interaction information to the message recipient, the second interaction information carrying Notification load information; receiving a second response message sent by the message receiver for the second interaction information; when it is determined that the second response message carries the notification load information, according to the notification load information To create the extended VPN tunnel.

In the above solution, after the extended VPN tunnel is created according to the extended code, the method further includes: detecting the traffic data of the extended VPN tunnel to obtain a detection result; when the detection result is representative of the extended VPN tunnel When the flow data is less than the second preset flow threshold, the extended VPN tunnel is recovered.

In the above solution, the second preset threshold is the same as or different from the first preset threshold that determines that the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel.

According to another aspect in the embodiments of the present application, an apparatus for creating a tunnel is provided. The apparatus includes: a determining unit configured to determine a message according to interaction information in the initial negotiation stage during an initial negotiation stage for a key The receiver has the ability to create an extended VPN tunnel; the extraction unit is used to extract the extended VPN tunnel from the current user packet when the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel Characteristic information of; a generating unit for generating an extended code for creating the extended VPN tunnel according to the characteristic information; a creating unit for creating the extended VPN tunnel based on the extended code.

According to a third aspect of the embodiments of the present application, an apparatus for creating a tunnel is provided. The apparatus includes: a memory and a processor; wherein the memory is used to store a computer program that can run on the processor; The processor is configured to execute any of the steps of the method in any one of the above tunnel creation methods when running the computer program.

According to a fourth aspect in the embodiments of the present application, there is provided a computer-readable storage medium on which a computer program is stored, which is characterized in that when the computer program is executed by a processor, any of the above tunnel creation methods A method step.

Embodiments of the present application provide a tunnel creation method, device, and storage medium. In an initial negotiation phase for a key, according to the interaction information in the initial negotiation phase, it is determined that the message receiver is capable of creating an extended virtual private network (VPN, Virtual Private Network) tunnel capability; when the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel, extract the feature information used to create the extended VPN tunnel in the current user message; according to the The feature information generates an extension code for creating the extended VPN tunnel; and creates the extended VPN tunnel according to the extension code. In this way, the dynamic creation of an extended VPN tunnel through the amount of data traffic can break through the limitation of the existing technology that only a single IPSec tunnel can be created through the 5-tuple information, and it also solves the problems in the fifth generation mobile communication technology (5G, 5th- Generation) IPSec encrypted channel problem in high-traffic services.

BRIEF DESCRIPTION

FIG. 1 is a schematic flowchart of a tunnel creation method according to an embodiment of this application;

2 is a schematic diagram of message interaction between two communication parties during the initial negotiation stage in the IKEv2 protocol process in the prior art;

3 is a schematic diagram of the message interaction between the two parties in the initial negotiation phase of the IKEv2 protocol process of this application;

4 is a schematic diagram of the TS load structure in the prior art;

Figure 5 is a schematic diagram of the TS load structure in this application;

FIG. 6 is a schematic diagram of message interaction using the TS payload structure shown in FIG. 5 to establish a sub-safety connection;

FIG. 7 is a schematic diagram of message interaction for establishing a sub-security connection in this application;

8 is a schematic diagram 1 of the structural composition of the tunnel creation device in the present application;

FIG. 9 is a second schematic diagram of the structural composition of the tunnel creation device in the embodiment of the present application.

Specific examples

The specific embodiments of the present application will be described in detail below with reference to the drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present application, and are not used to limit the present application.

FIG. 1 is a schematic flowchart of a tunnel creation method according to an embodiment of the present application.

Step 101: In the initial negotiation phase for the key, according to the interaction information in the initial negotiation phase, it is determined that the message receiver has the ability to create a VPN tunnel for the extended virtual information private network.

In this application, the method is mainly applied to a device that can support protocol programming processing, for example, the device may be a base station.

In this application, the device can use Internet Key Exchange (IKE, Internet Key Exchange) to authenticate the identities of the two parties during the IPSec process between the two parties, as well as negotiate security policies, and Handle session key interaction.

Here, the communication parties may be a base station and a base station, or a base station and a virtual private network gateway (VPN, Virtual Private Network Gateway), or a VPN and a VPN.

The second version of IKE, the IKEv2 protocol, is used as an example to describe in detail how the application determines whether the receiver has the ability to create an extended VPN tunnel based on the interactive information at the initial negotiation stage.

First of all, during the negotiation process of the IKEv2 protocol, the two communication parties are usually divided into two negotiation stages. These are the first consultation stage and the second consultation stage.

Among them, the first negotiation stage is also called the initial negotiation stage, which is mainly used to negotiate IKE.SA. The second negotiation stage is also called the negotiation sub-SA exchange stage, which is mainly used to negotiate CHILD.SA. In addition, there can also be an information exchange phase, which is mainly used to notify some errors, configuration, deletion and other information between the communication parties of the IKEv2 association.

FIG. 2 is a schematic diagram of message interaction between two communication parties during the initial negotiation stage in the IKEv2 protocol process in the prior art, as shown in FIG. 2.

In the initial negotiation phase, the two parties of the communication mainly exchanged two messages, and each message exchange included 2 messages.

Among them, the first message 201 in the first message interaction is a message sent by the message sender 20 to the message receiver 30, and the second message 301 in the first message interaction is the message sender 30 receives the message sender After the first message 201 sent by 20, a response message sent to the message sender 20.

Specifically, the response message may be that after the message receiver 30 receives the first message 201 sent by the message sender 20, a certain proposal is selected in SAi1 to form SAr1, and KEl and Nr are respectively used as the Diffle of the message receiver 30 -The Hellman public value and the Nonce value are sent to the message sender 20. In addition, the message receiver 30 may also include an optional certificate in the response message 301 sent to the message sender 20.

Generally, after the first message exchange (IKE.SA) exchange is completed, the two parties (message sender 20 and message receiver 30) can calculate the seed key SKE USED to obtain 7 other secrets: SK_d, SK_ai , SK_ar, SK_ei, SK_er, SK_pi, SK_pr.

Then the second message exchange, which is IKE.AUTH exchange.

As shown in Figure 2, in the second message negotiation stage (IKE.AUTH), the two parties use the encryption, authentication algorithm and key contained in the IKE.SA obtained in the first message exchange for security protection and use The authentication payload authenticates the exchange process that has ended in the initial negotiation phase (IKE, SA, INIT), and finally negotiates to get the first CHILD.SA, which is IPSec SA.

As shown in FIG. 2, in the second message interaction, the first message 202 and the second message 302 are both composed of the IKEv2 header HDR and an encrypted payload, and the encrypted payload includes an identity payload (ID) , Optional certificate load (CERT) and certificate request load (CERTREQ), authentication load (AUTH), safety-related load (SA), flow selection load (TS), etc. Among them, SK {} means that the included payload is encrypted and authenticated by SK.e and SK.a in the corresponding direction.

Figure 3 is a schematic diagram of the message interaction between the two parties in the initial negotiation phase of the IKEv2 protocol process of this application. The negotiation process of Figure 3 is basically similar to that of Figure 2, and the similarities are not repeated here. The difference is that The message sender 20 and the message receiver 30 in 3 add the capability negotiation field with the dynamic creation of a VPN tunnel to the interaction information at the initial negotiation stage, for example, the capability negotiation field is the notification payload [Nx]. The capability negotiation field may be loaded in the first interaction message in the initial negotiation stage, or may be loaded in the second interaction message.

In this application, when the message sender 20 sends a message message carrying the capability negotiation field to the message receiver in the initial negotiation phase for the key, the message receiver 30 will send a message to the message receiver after receiving the message. The message sender 20 sends a response message for the message.

After receiving the response message sent by the message receiver, the message sender 20 extracts the information of the capability negotiation field in the response message, and obtains the extraction result.

When the extraction result represents the information of successfully extracting the capability negotiation field in the response message, it is determined that the message receiver has the capability to create the extended VPN tunnel. On the contrary, if the extraction result indicates that extraction of capability negotiation information in the response message fails, it is determined that the message receiver 30 does not have the ability to create an extended VPN tunnel.

In this application, when the capability negotiation between the message sender 20 and the message receiver 30 fails, the subsequent dynamic creation of the VPN tunnel is not performed.

Step 102: When the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel, extract the feature information used to create the extended VPN tunnel in the current user packet.

In this application, when the message sender determines that the message receiver has the ability to dynamically create an extended VPN tunnel, it detects the data traffic carried in the extended VPN tunnel to obtain a detection result; and compares the data traffic in the detection result with A first preset threshold characterizing the creation of an extended VPN tunnel is compared, and a comparison result is obtained. When the comparison result indicates that the data traffic is detected to be greater than or equal to the first preset traffic threshold, the location of the extended VPN tunnel is determined. The data carried meets the conditions for expanding the VPN tunnel. Then extract the characteristic information used to create the extended VPN tunnel in the current user packet.

Here, the user message refers to the message message generated by the message sender and the consumer in the negotiation process. For example, the message includes: a tunnel terminal identifier (TEID, Tunnel Endpoint Identifier), a differential service code point (DSCP, Differentiated Service, Code Point), and so on.

In this application, the characteristic information includes: information for creating the extended VPN tunnel except for quintuple information; for example, TEID, DSCP and other information.

Wherein, the quintuple information includes: source IP address, source port, destination IP address, destination port and transport layer protocol number. In this way, according to the information other than the quintuple information, when service traffic is large, an extended VPN tunnel can be dynamically created to carry more service traffic through the created extended VPN tunnel.

Step 103: Generate an extension code for creating the extended VPN tunnel according to the feature information.

In this application, the characteristic parameter in the characteristic information may be calculated by a HASH algorithm to obtain a calculation result. Then, the spreading code is generated from the calculation result.

Here, the HASH algorithm is an algorithm set.

In this application, each sub-feature information in the feature information may be combined based on the feature information directly to generate the spreading code.

Step 104: Create the extended VPN tunnel according to the extended code.

In this application, specifically, the message sender may load the extension code in the extension field of the TS load of the traffic filter during the second negotiation phase for the key (see FIG. 5).

4 is a schematic diagram of the structure of a TS payload in the prior art. As shown in FIG. 4, the TS payload includes TS type information, IP protocol ID information, sample selector length information, start port, end port, and start address And end address information.

FIG. 5 is a schematic diagram of the TS payload structure in this application. FIG. 5 is substantially the same as FIG. 4. The similarities are not repeated here. The difference is that FIG. 5 is loaded in the extension field after the end address of the TS payload. There is an extended code (Extended).

In this application, when the message sender loads the extension code in the extension field of the TS payload in the second negotiation stage, the interactive information carrying the extension code will also be sent to the second negotiation stage. The message receiver sends; when the message receiver receives the interactive message sent by the message sender in the second negotiation phase, it sends a response message to the message sender for the interactive message in the second negotiation phase (see Image 6).

FIG. 6 is a schematic diagram of message interaction using the TS payload structure shown in FIG. 5 to establish a sub-safety connection.

As shown in FIG. 6, the packets in the interactive message between the message sender 20 and the message receiver 30 carry TSi and TSr; among them, TSi and TSr represent the extension codes.

After receiving the response information sent by the message receiver for the interaction information in the second negotiation stage, the message sender extracts the extension code from the response message. When the sender of the message successfully extracts the extended code in the response message, it indicates that the extended VPN tunnel has been created.

Conversely, when the message sender fails to extract the extended code in the response message, it indicates that the extended VPN tunnel creation operation failed.

In another embodiment, the message sender can also send interaction information carrying notification payload information to the message receiver in the second negotiation phase for the key; the message receiver receives the notification payload information sent by the message developed party Response message of the interactive message to the sender of the message (see Figure 7).

FIG. 7 is a schematic diagram of message interaction for establishing a sub-security link in this application. As shown in FIG. 7, the interaction message between the message sender 20 and the message receiver 30 carries notification payload information (N-EXC,). And (N-EXC,) means Notify payload carrying Extended Code (Extended).

Specifically, the message sender sends a message carrying notification load information to the message receiver. When the message receiver receives the message carrying the notification load information sent by the message sender, it sends a response message to the message sender for the message.

When the message sender receives the response message for the interaction information of the second coordination stage sent by the message receiver, the notification payload information is extracted from the response message.

When the message sender extracts the notification payload information in the response message, the extended VPN tunnel is created according to the extension code carried in the notification payload information.

In this application, when the data flow of the first extended VPN tunnel reaches the first preset flow threshold, a new extension code is generated according to the characteristic information of the current service flow, and the new extension code is used to negotiate a new extension VPN tunnel.

Here, for example, the first threshold traffic threshold is 60% of the data traffic handled by a single VPN tunnel.

This application can also repeatedly generate new extension codes and create new extension VPN tunnels according to business needs.

In this application, after successfully creating the extended VPN tunnel according to the extended code, the message sender can also recover the created extended VPN tunnel according to the current service traffic.

Specifically, after successfully creating the extended VPN tunnel according to the extended code, the message sender may also detect the flow data of the extended VPN tunnel to obtain a detection result; and recover the flow data and the characterization in the detection result The second preset traffic threshold of the created extended VPN tunnel is compared, and the comparison result is obtained. When the comparison result indicates that the flow data of the extended VPN tunnel is less than the second preset flow threshold, the extended VPN tunnel is recovered. To release more business resources.

Of course, in this application, when the business data is relatively rich, the extended VPN tunnel that has been created may not be recovered.

Here, the second preset traffic threshold characterizing the recovery of the created extended VPN tunnel and the first preset traffic threshold characterizing the creation of the extended VPN tunnel may be the same or different. Specifically, it can be set or adjusted according to current business resources.

Using the method of dynamically creating an extended VPN tunnel described in this application, compared with the prior art, it breaks through the limitation that quintuple information can only create a single IPSec tunnel, solves the problem of 5G communication large throughput IPSec encrypted channel, and reaches The effect of traffic dynamically creating an IPSec tunnel.

FIG. 8 is a schematic structural composition diagram of a tunnel creation device in the present application. As shown in FIG. 8, the device includes: a determination unit 801, an extraction unit 802, a generation unit 803, and a creation unit 804; wherein, the determination unit 801 uses In the initial negotiation phase for the key, according to the interaction information in the initial negotiation phase, it is determined that the message receiver has the ability to create an extended VPN tunnel; the extraction unit 802 is used to process the data carried in the extended VPN tunnel When the condition of the extended VPN tunnel is satisfied, extract the feature information used to create the extended VPN tunnel in the current user packet; the generating unit 803 is used to generate the feature used to create the extended VPN tunnel according to the feature information Extension code; the creating unit 804 is used to create the extended VPN tunnel according to the extension code.

In the present application, the device further includes: a detection unit 805; the detection unit 805 is used to detect the data traffic carried in the extended VPN tunnel to obtain a detection result; and the determination unit 801 is further used to perform the detection The result characterizes that when it is detected that the data traffic reaches the first preset traffic threshold, it is determined that the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel.

In this application, the extraction unit 802 is also used to extract capability negotiation information from the interaction information in the initial negotiation stage to obtain an extraction result; the determination unit 801 is specifically used to characterize the extraction result in the initial negotiation In the interaction information at the stage, when the capability negotiation information is successfully extracted, it is determined that the message receiver has the capability to create the extended VPN tunnel.

In this application, the feature information includes: information for creating the extended VPN tunnel except for quintuple information; wherein, the quintuple information includes: source IP address, source port, destination IP address, and destination Port and transport layer protocol numbers.

In this application, the apparatus further includes: a loading unit 806, a sending unit 807, and a receiving unit 808; the loading unit 806 is used to load in the extension field of the traffic filter TS load in the second negotiation phase for the key The spreading code; the sending unit 807 is used to send the second interaction information carrying the spreading code to the message recipient; the receiving unit 808 is used to receive the message recipient for the second interaction The first response information of the information; the determining unit 801 is further specifically configured to determine that the creation of the extended VPN tunnel is completed when the first response information includes the extended code.

In another embodiment of the present application, the sending unit 807 is further configured to send the second interaction information to the message receiver in the second negotiation phase for the key, where the second interaction information carries a notification Load information; the receiving unit 808 is also used to receive a second response message sent by the message recipient for the second interaction information; the determining unit 801 is also specifically used to determine that the second response message carries When there is the notification load information, the extended VPN tunnel is created according to the extension code carried in the notification load information.

In this application, the device further includes: a recovery unit 809; the recovery unit 809 is configured to recover the extended VPN tunnel when detecting that the flow data of the extended VPN tunnel is less than a second preset flow threshold.

Wherein, the second preset flow threshold and the first preset flow threshold may be the same or different, and may specifically be set according to current business resources.

It should be noted that when the tunnel creation device provided in the above embodiment creates an extended VPN tunnel, only the above-mentioned division of each program module is used as an example for illustration. In practical applications, the above processing may be allocated by different program modules as needed When completed, the internal structure of the tunnel creation device is divided into different program modules to complete all or part of the processing described above. In addition, the tunnel creation device and the tunnel creation method embodiment provided in the above embodiments belong to the same concept. For the specific implementation process, see the method embodiments, and details are not described here.

9 is a schematic structural diagram 2 of the apparatus for creating a tunnel in an embodiment of the present application; as shown in FIG. 9, the apparatus 900 for creating a tunnel may be a mobile phone, a computer, a digital broadcasting terminal, an information receiving and sending device, a game console, Tablet devices, personal digital assistants, information push servers, content servers, identity authentication servers, etc. The tunnel creation device 900 shown in FIG. 9 includes: at least one processor 901, a memory 902, at least one network interface 904, and a user interface 903. The various components in the tunnel creation device 900 are coupled together through the bus system 905. It can be understood that the bus system 905 is used to implement connection and communication between these components. In addition to the data bus, the bus system 905 also includes a power bus, a control bus, and a status signal bus. However, for clarity, various buses are marked as the bus system 905 in FIG. 9.

The user interface 903 may include a display, a keyboard, a mouse, a trackball, a click wheel, buttons, buttons, a touch panel, or a touch screen.

It can be understood that the memory 902 may be a volatile memory or a non-volatile memory, and may also include both volatile and non-volatile memory. Among them, the non-volatile memory can be read-only memory (ROM, Read Only Memory), programmable read-only memory (PROM, Programmable Read-Only Memory), erasable programmable read-only memory (EPROM, Erasable Programmable Read- Only Memory), Electrically Erasable Programmable Read-Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, Ferromagnetic Random Access Memory), Flash Memory (Flash) Memory, Magnetic Surface Memory , Compact disc, or read-only compact disc (CD-ROM, Compact, Read-Only Memory); the magnetic surface memory can be a disk storage or a tape storage. The volatile memory may be a random access memory (RAM, Random Access Memory), which is used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM, Static Random Access Memory), synchronous static random access memory (SSRAM, Synchronous Static Random Access Memory), dynamic random access Memory (DRAM, Dynamic Random Access Memory), Synchronous Dynamic Random Access Memory (SDRAM, Synchronous Dynamic Random Access Memory), Double Data Rate Synchronous Dynamic Random Access Memory (DDRSDRAM, Double Data Rate Synchronous Dynamic Random Access Random Access Memory), enhanced Type synchronous dynamic random access memory (ESDRAM, Enhanced Synchronous Dynamic Random Access Memory), synchronous connection dynamic random access memory (SLDRAM, SyncLink Dynamic Random Access Memory), direct memory bus random access memory (DRRAM, Direct Rambus Random Access Random Access Memory ). The memory 902 described in the embodiments of the present application is intended to include, but not limited to, these and any other suitable types of memories.

The memory 902 in the embodiment of the present application is used to store various types of data to support the operation of the apparatus 900 for creating a tunnel. Examples of these data include: any computer program for operating on the tunnel creation device 900, such as an operating system 9021 and an application program 9022; where the operating system 9021 contains various system programs, such as a framework layer, a core library layer, and drivers Layers, etc., are used to implement various basic services and handle hardware-based tasks. The application program 9022 may include various application programs, such as a media player (Media Player), a browser (Browser), etc., for implementing various application services. The program for implementing the method of the embodiment of the present application may be included in the application program 9022.

The method disclosed in the above embodiments of the present application may be applied to the processor 901, or implemented by the processor 901. The processor 901 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the processor 901 or an instruction in the form of software. The foregoing processor 901 may be a general-purpose processor, a digital signal processor (DSP, Digital Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and the like. The processor 901 may implement or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present application. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the method disclosed in the embodiments of the present application may be directly implemented and completed by a hardware decoding processor, or executed and completed by a combination of hardware and software modules in the decoding processor. The software module may be located in a storage medium, and the storage medium is located in the memory 902. The processor 901 reads the information in the memory 902 and completes the steps of the foregoing method in combination with its hardware.

In an exemplary embodiment, the tunnel creation device 900 may be one or more application specific integrated circuits (ASIC, Application Specific Integrated Circuit), DSP, programmable logic device (PLD, Programmable Logic Device), complex programmable logic device (CPLD, Complex Programmable Logic Device), Field Programmable Gate Array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller), microprocessor (Microprocessor), or Other electronic components are implemented to perform the aforementioned method.

Specifically, when the processor 901 runs the computer program, it executes: during the initial negotiation phase for the key, based on the interaction information in the initial negotiation phase, it is determined that the message recipient has the ability to create an extended virtual information pseudo-private network VPN tunnel ; When the data carried in the extended VPN tunnel satisfies the conditions of the extended VPN tunnel, extract the feature information used to create the extended VPN tunnel in the current user message; according to the feature information is generated for creating the The extended code of the extended VPN tunnel; creating the extended VPN tunnel according to the extended code.

When the processor 901 runs the computer program, it also executes: detecting the data traffic carried in the extended VPN tunnel to obtain a detection result; when the detection result indicates that the data traffic reaches the first preset traffic At the threshold, it is determined that the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel.

When the processor 901 runs the computer program, it also executes: extracting capability negotiation information from the interaction information in the initial negotiation stage to obtain an extraction result; when the extraction result is characterized in the interaction information in the initial negotiation stage , When the capability negotiation information is successfully extracted, it is determined that the message receiver has the capability to create the extended VPN tunnel.

When the processor 901 runs the computer program, it also executes: in the second negotiation phase for the key, the extension code is loaded in the extension field of the TS load of the traffic filter; Receiving the second interaction information of the extension code; receiving the first response information of the message receiver for the second interaction information; determining that the extension VPN tunnel is included in the first response information when determining that the extension code is included in the first response information The creation is complete.

When the processor 901 runs the computer program, it also executes: in the second negotiation phase for the key, sending second interaction information to the message recipient, the second interaction information carrying notification payload information Receiving the second response message sent by the message receiver for the second interaction information; when it is determined that the second response message carries the notification payload information, according to the extension code carried in the notification payload information Create the extended VPN tunnel.

When the processor 901 runs the computer program, it further executes: when the detection result indicates that the traffic data of the extended VPN tunnel is less than the second preset traffic threshold, recover the extended VPN tunnel.

The second preset threshold is the same as or different from the first preset threshold that determines that the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel.

In an exemplary embodiment, an embodiment of the present application further provides a computer-readable storage medium, for example, a memory 902 including a computer program, which can be executed by the processor 901 of the tunnel creation device 900 to complete the foregoing method. Described steps. The computer-readable storage medium may be a memory such as FRAM, ROM, PROM, EPROM, EEPROM, Flash Memory, magnetic surface memory, optical disk, or CD-ROM; it may also be a variety of devices including one or any combination of the above memories, such as Mobile phones, computers, tablet devices, personal digital assistants, etc.

A computer-readable storage medium on which a computer program is stored, which when executed by a processor, executes: during an initial negotiation phase for a key, according to the interaction information in the initial negotiation phase, it is determined that the message receiver has Ability to create extended virtual information pseudo-private network VPN tunnel; when the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel, extract the characteristic information used to create the extended VPN tunnel in the current user message Generating an extension code for creating the extended VPN tunnel according to the characteristic information; creating the extended VPN tunnel according to the extension code.

When the computer program is run by the processor, it also executes: detecting the data traffic carried in the extended VPN tunnel to obtain a detection result; when the detection result indicates that the data traffic reaches the first preset traffic threshold, It is determined that the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel.

When the computer program is executed by the processor, it also executes: extracting capability negotiation information from the interaction information in the initial negotiation stage to obtain an extraction result; when the extraction result is characterized in the interaction information in the initial negotiation stage, it is successfully extracted When the capability negotiation information is reached, it is determined that the message receiver has the capability to create the extended VPN tunnel.

When the computer program is run by the processor, it also executes: in the second negotiation phase for the key, loading the extension code in the extension field of the traffic filter TS payload; sending the message carrying the extension code to the message receiver Receiving the second interaction information of the message; receiving the first response information of the message receiver with respect to the second interaction information; determining that the extended code is included in the first response information, determining that the creation of the extended VPN tunnel is completed.

When the computer program is run by the processor, it also executes: in the second negotiation phase for the key, sending second interaction information to the message recipient, the second interaction information carries notification payload information; A second response message sent by the message receiver in response to the second interaction information; when it is determined that the second response message carries the notification payload information, the message response information is created according to the extension code carried in the notification payload information Expand VPN tunnel.

When the computer program is executed by the processor, it also executes: detecting the flow data of the extended VPN tunnel to obtain a detection result; when the detection result indicates that the flow data of the extended VPN tunnel is less than the second preset flow threshold, recovering The extended VPN tunnel.

The above are only specific examples of this application, but the scope of protection of this application is not limited to this, any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in this application. It should be covered by the scope of protection of this application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

A method for creating a tunnel, the method includes:

In the initial negotiation phase for the key, based on the interaction information in the initial negotiation phase, it is determined that the message receiver has the ability to create a VPN tunnel for the extended virtual information private network;

When the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel, extract the characteristic information used to create the extended VPN tunnel in the current user packet;

Generating an extension code for creating the extended VPN tunnel according to the characteristic information;

Create the extended VPN tunnel according to the extended code.
The method according to claim 1, further comprising:

Detecting the data traffic carried in the extended VPN tunnel to obtain the detection result;

When the detection result indicates that the data traffic reaches the first preset traffic threshold, it is determined that the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel.
According to the method of claim 1, in the initial negotiation phase for the key, based on the interaction information in the initial negotiation phase, it is determined that the message recipient has the ability to create an extended VPN tunnel, including:

Extracting capability negotiation information from the interactive information in the initial negotiation stage to obtain an extraction result;

When the extraction result is characterized in the interaction information in the initial negotiation stage, and the capability negotiation information is successfully extracted, it is determined that the message recipient has the capability to create the extended VPN tunnel.
The method according to claim 1, wherein the characteristic information includes: information other than quintuple information for creating the extended VPN tunnel;

Wherein, the quintuple information includes: source IP address, source port, destination IP address, destination port and transport layer protocol number.
The method of claim 1, creating the extended VPN tunnel according to the extended code, comprising:

In the second negotiation phase for the key, the extension code is loaded in the extension field of the traffic TS payload;

Sending the interactive information carrying the extension code to the message receiver;

Receiving the response information of the message receiver for the interactive information in the second negotiation stage;

When it is determined that the extension code is included in the response information, it is determined that the creation of the extended VPN tunnel is completed.
The method of claim 1, creating the extended VPN tunnel according to the extended code, comprising:

In the second negotiation stage for the key, sending the interactive information carrying the notification payload information to the message receiver;

Receiving a response message sent by the message receiver for the interaction information carrying notification payload information;

When it is determined that the response load information is carried in the response message, the extended VPN tunnel is created according to the extension code carried in the notification load information.
The method of claim 1, after creating the extended VPN tunnel according to the extended code, the method further comprises:

Detecting the flow data of the extended VPN tunnel to obtain the detection result;

When the detection result indicates that the flow data of the extended VPN tunnel is less than the second preset flow threshold, the extended VPN tunnel is recovered.
According to the method of claim 7, the second preset threshold is the same as or different from the first preset threshold that determines that the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel.
A tunnel creation device, the device includes:

The determining unit is used to determine that the message receiver has the ability to create an extended VPN tunnel based on the interaction information in the initial negotiation stage for the key during the initial negotiation stage;

An extracting unit, configured to extract the characteristic information used to create the extended VPN tunnel in the current user packet when the data carried in the extended VPN tunnel meets the conditions of the extended VPN tunnel;

A generating unit, configured to generate an extension code for creating the extended VPN tunnel according to the characteristic information;

The creating unit is used to create the extended VPN tunnel according to the extended code.
A tunnel creation device, the device includes: a memory and a processor;

Wherein, the memory is used to store a computer program that can run on the processor;

The processor is configured to execute the steps of the method according to any one of claims 1 to 8 when running the computer program.
A computer-readable storage medium on which a computer program is stored, characterized in that when the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 8 are implemented.