WO2021037216A1 - 一种报文传输方法及设备、计算机存储介质 - Google Patents

一种报文传输方法及设备、计算机存储介质 Download PDF

Info

Publication number
WO2021037216A1
WO2021037216A1 PCT/CN2020/112165 CN2020112165W WO2021037216A1 WO 2021037216 A1 WO2021037216 A1 WO 2021037216A1 CN 2020112165 W CN2020112165 W CN 2020112165W WO 2021037216 A1 WO2021037216 A1 WO 2021037216A1
Authority
WO
WIPO (PCT)
Prior art keywords
message
esp
service type
field
header
Prior art date
Application number
PCT/CN2020/112165
Other languages
English (en)
French (fr)
Inventor
王春宁
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Priority to EP20858281.7A priority Critical patent/EP4020915A4/en
Publication of WO2021037216A1 publication Critical patent/WO2021037216A1/zh
Priority to US17/672,359 priority patent/US20220174051A1/en

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/10—Network architectures or network communication protocols for network security for controlling access to devices or network resources
    • H04L63/105—Multiple levels of security
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/06—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols the encryption apparatus using shift registers or memories for block-wise or stream coding, e.g. DES systems or RC4; Hash functions; Pseudorandom sequence generators
    • H04L9/0618—Block ciphers, i.e. encrypting groups of characters of a plain text message using fixed encryption transformation

Definitions

  • This application relates to the field of communication technology, and in particular to a method and device for message transmission, and a computer storage medium.
  • the present application provides a message transmission method and device, and a computer storage medium, which can solve the problem of large calculation overhead in the process of determining the service type of the original message by the current device.
  • a message transmission method is provided, which is applied in a communication network.
  • the communication network includes a first device and a second device.
  • a target security alliance is established between the first device and the second device.
  • the first device is the initiator of the target security alliance, and the second device is the destination of the target security alliance.
  • the method includes:
  • the first device obtains the service type information of the original message.
  • the first device generates an ESP message of the original message based on the target security alliance.
  • the ESP message includes a message header, an ESP header, a service type field, a first encryption part, and an ESP authentication data field.
  • the service type field includes the service type.
  • Information, the first encrypted part includes the data part of the original message, and the service type field is used to enable the second device to determine the processing of the ESP message according to the service type information.
  • the first device sends an ESP packet to the second device.
  • the service type field is used to enable the second device to determine the processing of the ESP message according to the service type information, so the second device analyzes the ESP message
  • the service type field can obtain the service type information of the original message, so as to determine the next operation of the ESP message without decrypting the first encrypted part, which can reduce the second device’s trouble in determining the service type of the original message.
  • the amount of decryption calculations in the process reduces the calculation overhead of the second device.
  • the ESP message further includes a block identification field, the block identification field is located between the message header and the ESP header, and the block identification field is used to indicate that the ESP message includes a service type field.
  • the receiving device by adding a block identification field between the header of the ESP message and the ESP header, it indicates that there is a service type field in the ESP message.
  • the block identification field indicates that there is no service type field in the ESP message, so that the receiving device can process the traditional ESP message and the ESP message provided in the embodiment of the present application in a compatible manner, so as to ensure the compatibility of the device.
  • the block identification field is also used to indicate that the service type field is obtained before decrypting the first encrypted part.
  • the configuration of the target security association indicates to obtain the service type field before decrypting the first encrypted part.
  • the service type field is the second encrypted part of the ESP message.
  • the service type field in the ESP message may not be encrypted, which is not limited in this application.
  • the service type information includes the priority of the original message, the identity of the application to which the original message belongs, the identity of the company that sent the original message, the identity of the department that sent the original message, and the identity of the user who sent the original message One or more of.
  • a message transmission method is provided, which is applied in a communication network.
  • the communication network includes a first device and a second device.
  • a target security alliance is established between the first device and the second device.
  • the first device is the initiator of the target security alliance, and the second device is the destination of the target security alliance.
  • the method includes:
  • the second device receives the ESP message sent by the first device.
  • the ESP message includes a message header, an ESP header, a service type field, a first encrypted part, and an ESP authentication data field.
  • the first encrypted part includes data of the original message Part
  • the service type field includes the service type information of the original message.
  • the second device parses the service type field to obtain the service type information of the original message.
  • the second device performs a target operation on the ESP message according to the service policy and the service type information of the original message.
  • the second device can obtain the service type information of the original message by analyzing the service type field of the ESP message, and further compare the service type information of the original message according to the service policy
  • the ESP message performs the target operation without decrypting the first encrypted part, which reduces the amount of decryption calculations of the second device in the process of determining the service type of the original message, thereby reducing the calculation overhead of the second device.
  • the target operation includes any one of the following: decrypting the first encrypted part of the ESP message, discarding the ESP message, caching the ESP message, and forwarding the ESP message.
  • the ESP message further includes a block identification field, the block identification field is located between the message header and the ESP header, and the block identification field is used to indicate that the ESP message includes a service type field.
  • the block identification field is also used to indicate that the service type field is obtained before decrypting the first encrypted part.
  • the configuration of the target security association indicates to obtain the service type field before decrypting the first encrypted part.
  • the service type field is the second encrypted part of the ESP message.
  • the second device Before the second device parses the service type field, the second device also decrypts the service type field based on the encryption algorithm configured in the target security alliance.
  • a message transmission device in a third aspect, includes a plurality of functional modules, and the plurality of functional modules interact to implement the above-mentioned first aspect and the methods in various embodiments thereof.
  • the multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be combined or divided arbitrarily based on specific implementations.
  • a message transmission device in a fourth aspect, includes a plurality of functional modules, and the plurality of functional modules interact with each other to implement the above-mentioned second aspect and the methods in various embodiments thereof.
  • the multiple functional modules can be implemented based on software, hardware, or a combination of software and hardware, and the multiple functional modules can be combined or divided arbitrarily based on specific implementations.
  • a message transmission device including: a processor and a memory;
  • the memory is used to store a computer program, and the computer program includes program instructions
  • the processor is configured to call the computer program to implement the message transmission method according to any one of the first aspect.
  • a message transmission device including: a processor and a memory;
  • the memory is used to store a computer program, and the computer program includes program instructions
  • the processor is configured to call the computer program to implement the message transmission method according to any one of the second aspect.
  • a computer storage medium stores program instructions, and when the program instructions are executed, the message transmission method according to any one of the first aspect or the second aspect is implemented .
  • a communication network includes a first device and a second device.
  • a target security alliance is established between the first device and the second device, the first device is the initiator of the target security alliance, and the second device is the target of the target security alliance.
  • the first device includes the message transmission device according to the third aspect, and the second device includes the message transmission device according to the fourth aspect.
  • the service type field is used to enable the second device to determine the processing of the ESP message according to the service type information, so the second device
  • the service type information of the original message can be obtained by parsing the service type field of the ESP message, and the target operation is performed on the ESP message according to the service policy and the service type information of the original message without decrypting the first encrypted part.
  • the amount of decryption calculations of the second device in the process of determining the service type of the original message can be reduced, thereby reducing the calculation overhead of the second device.
  • Figure 1 is a schematic diagram of the structure of an ESP message currently encapsulated in a transmission mode
  • Figure 2 is a schematic diagram of the structure of an ESP message obtained by tunnel mode encapsulation at present;
  • FIG. 3 is a schematic structural diagram of a communication network provided by an embodiment of the present application.
  • FIG. 4 is a flowchart of a message transmission method provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of the structure of an ESP message provided by an embodiment of the present application.
  • FIG. 6 is a schematic structural diagram of another ESP message provided by an embodiment of the present application.
  • FIG. 7 is a schematic structural diagram of a message transmission device provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of another message transmission apparatus provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another message transmission device provided by an embodiment of the present application.
  • FIG. 10 is a block diagram of a message transmission device provided by an embodiment of the present application.
  • SA security association
  • IKE Internet Key Exchange
  • a security association is a one-way logical connection, and the peers that have established a security alliance include the initiator and the destination.
  • the security alliance stipulates the protection method for the data sent from the initiator to the destination.
  • the security alliance is uniquely identified by a triplet, which includes a security parameter index (security parameters index, SPI), the IP address of the destination and the security protocol used.
  • Security protocols are used to provide security services such as encryption and/or authentication.
  • Security protocols include AH protocol and ESP protocol, both of which are transport layer protocols based on IP.
  • the working principle of the ESP protocol is to add the ESP header before the data part of the original message, add the ESP tail and the ESP authentication data field after the data part of the original message, and encrypt the data part of the original message, and finally Encapsulate the ESP message.
  • the data part of the original message is also the payload part of the original message, including the transport layer protocol header and the data (data) field.
  • Packet encapsulation modes include transmission mode and tunnel mode.
  • the embodiments of the present application respectively describe the structure of the ESP message in the transmission mode and the tunnel mode.
  • Figure 1 is a schematic diagram of the structure of an ESP message currently encapsulated in a transmission mode.
  • Fig. 2 is a schematic diagram of the structure of an ESP message obtained by current tunnel mode encapsulation.
  • the ESP message includes a message header, an ESP header, a payload data field, an ESP tail, and an ESP authentication data field.
  • the payload data field is used to carry the content of the original message.
  • the payload data field includes the data part of the original message; as shown in Figure 2, in the tunnel mode, the payload data field includes the header of the original message (abbreviation: original message Header) and the data part of the original message.
  • the data part of the original message specifically includes a transport layer protocol header and data fields.
  • the transport layer protocol defined in the message header is the ESP protocol.
  • the integrity verification part of the ESP message includes the ESP header, the payload data field, and the ESP tail.
  • the encrypted part of the ESP message includes the payload data field and the ESP tail.
  • the ESP header includes an SPI field and a sequence number.
  • the SPI field is used to carry SPI, and SPI is used to uniquely identify the security association.
  • the sequence number is used to uniquely identify the message and prevent message replay attacks.
  • the ESP tail includes a padding field (optional), a padding length field, and the next header.
  • the padding length field is used to indicate the length of the padding field.
  • the next header is used to indicate the load type of the payload data field, and the next header carries the identifier of the next field in the ESP header.
  • the next header carries the number of the transport layer protocol (TCP protocol, UDP protocol, or ICMP protocol); in tunnel mode, the next header carries the IP protocol number of the original message, and the device resolves The original message header determines the transport layer protocol used by the original message.
  • the length of the SPI field is 32 bits.
  • the length of the serial number is 32 bits.
  • the payload data field is a variable length field.
  • the length of the padding field is 0 to 255 bytes.
  • the length of the padding length field is 8 bits.
  • the length of the next header is 8 bits.
  • the ESP authentication data field is a variable-length field, and the length is an integer multiple of 32 bits, usually 96 bits.
  • the device When the device receives the ESP message shown in Figure 1 or Figure 2 and needs to determine the service type of the original message, since the service information of the original message is carried in the payload data field, the device needs to parse the payload data field to obtain the service information To determine the service type of the original message, the device needs to decrypt the encrypted part of the ESP message as a whole, determine the payload type of the payload data field according to the next header in the ESP tail, and then parse the payload data field based on the payload type. The device has a relatively high amount of calculation to decrypt the encrypted part of the ESP packet as a whole, resulting in a large amount of calculation overhead for the device.
  • the device needs to determine the importance of the ESP packet according to the service type of the original packet, and discard it ESP packets with lower importance are guaranteed to be transmitted preferentially.
  • the priority of the signaling message is higher than the priority of the multimedia service message, and the device can ensure the priority transmission of the signaling message by discarding the multimedia service message.
  • the device also needs to decrypt the encrypted part of the ESP packet as a whole, which occupies a large amount of computing power of the device and causes a waste of device performance.
  • Fig. 3 is a schematic structural diagram of a communication network provided by an embodiment of the present application.
  • the communication network includes a first device 301 and a second device 302.
  • a target SA is established between the first device 301 and the second device 302.
  • the first device 301 is the initiator of the target SA
  • the second device 302 is the target of the target SA.
  • the security protocol configured in the target SA is the ESP protocol. That is, the target SA stipulates that the message sent by the first device 301 to the second device 302 is encapsulated and protected by the ESP protocol.
  • the message that is encapsulated and protected by the ESP protocol is referred to as an ESP message.
  • the communication network may be a metropolitan area network, a wide area network, or a campus network.
  • the wide area network may be a software defined wide area network (software defined wild area network, SD-WAN).
  • the first device 301 and the second device 302 may be network devices, and specifically may be routers or switches.
  • the target SA may be established between the first device 301 and the second device 302 through manual configuration, or the target SA may be established between the first device 301 and the second device 302 through IKE auto-negotiation.
  • Fig. 4 is a flowchart of a message transmission method provided by an embodiment of the present application. This method can be applied to the communication network as shown in FIG. 3. As shown in Figure 4, the method includes:
  • Step 401 The first device obtains the service type information of the original message.
  • the original message may be a TCP message, a UDP message, or an ICMP message.
  • the service type information of the original message includes the priority of the original message, the identity of the application to which the original message belongs, the identity of the company that sent the original message, the identity of the department that sent the original message, and the identity of the user who sent the original message One or more of.
  • the priority of the original message may be represented by the value of the differentiated services code point (DSCP) field in the original message header.
  • the identification of the application to which the original message belongs can be represented by an application identification (application identification, APP ID).
  • the identification of the company that sent the original message and/or the identification of the department that sent the original message can be represented by a virtual private network identification (VPN ID).
  • the identity of the user who sent the original message may be represented by the user's IP address.
  • the service type information of the original message is usually carried in the data part of the original message, and the data part of the original message includes the transport layer protocol header and data field of the original message.
  • the first device parses the data part of the original message to obtain the service type information of the original message.
  • Step 402 The first device generates an ESP message of the original message based on the target security association.
  • FIG. 5 is a schematic structural diagram of an ESP packet provided by an embodiment of the present application.
  • the ESP message includes a message header, an ESP header, a service type field, a first encryption part, and an ESP authentication data field.
  • the service type field includes service type information of the original message.
  • the first encrypted part includes the data part of the original message.
  • the data part of the original message is carried in the payload data field of the first encrypted part, and the first encrypted part also includes the ESP tail.
  • the service type field is used to enable the second device to determine the processing of the ESP message according to the service type information.
  • the service type information of the original message may be encoded by TLV (type-length-value) and then carried in the service type field of the ESP message.
  • the service type field may be divided into multiple subfields, and each subfield serves as a basic information element (information element, IE) for carrying fixed service type information.
  • the business type field can be divided into a priority subfield, an application identification subfield, an enterprise identification subfield, a department identification subfield, and a user identification subfield.
  • the priority subfield carries the DSCP field value
  • the application identification subfield carries the APP ID
  • the enterprise identification subfield carries the VPN ID
  • the department identification subfield carries the VPN ID
  • the user identification subfield carries the IP address.
  • FIG. 6 is a schematic structural diagram of another ESP packet provided by an embodiment of the present application.
  • the ESP message further includes a block identification field.
  • the block identification field is located between the message header and the ESP header, and the block identification field is used to indicate that the ESP message includes a service type field.
  • a value between 0 and 255 can be used as the segment identifier to be filled in the segment identifier field.
  • a value of 100 can be used as the segment identifier to fill in the segment identifier field, and the specific value can be in the target Agreement in the security alliance.
  • the SPI in the ESP header uses a value that is not between 0 and 255, when a value between 0 and 255 is used as the block identifier, the receiving device (the second device in the embodiment of this application) is receiving After arriving at the ESP message, it can be distinguished whether the field after the message header is the block identification field or the SPI field according to the field value after the message header.
  • the block identification can also be represented by other identifications such as letters or character strings, which is not limited in the embodiment of the present application.
  • the configuration can be negotiated in the target security association: If there is a block identification field between the header of the ESP message and the ESP header, the receiving device parses the service The type field determines the service type of the ESP message; if there is no block identification field between the header of the ESP message and the ESP header, the receiving device determines the service type of the ESP message in the traditional way, that is, the receiving device performs the encryption part After the overall decryption, the payload data field is parsed to determine the service type of the ESP message.
  • a block identification field between the header of the ESP message and the ESP header, it indicates that there is a service type field in the ESP message.
  • the absence of a block identification field indicates that there is no service type field in the ESP message, which enables the receiving device to process the traditional ESP message and the ESP message provided in the embodiment of the present application in a compatible manner to ensure the compatibility of the device.
  • the service type field is usually located after the ESP header.
  • the service type field is located between the ESP header and the first encrypted part.
  • the service type field may also be located between the first encrypted part and the ESP authentication data field.
  • the embodiment of the present application does not limit the specific position of the service type field in the ESP message.
  • the length of the service type field and the position of the service type field in the ESP message can be configured in the target security association.
  • the service type field can be a fixed-length field, for example, the length of the service type field can be 4 bytes; or, the service type field can also be a variable length field.
  • the service type field may be the second encrypted part of the ESP message.
  • Both the first encrypted part and the second encrypted part in the ESP message are encrypted using an encryption algorithm configured in the target security association.
  • the encryption algorithm configured in the target security alliance can be a symmetric encryption algorithm, including data encryption standard (DES) algorithm, triple data encryption standard (3DES) algorithm, advanced data encryption standard (advanced encryption standard, AES) algorithm or domestic cryptographic algorithm (SM1).
  • DES data encryption standard
  • 3DES triple data encryption standard
  • AES advanced data encryption standard
  • SM1 domestic cryptographic algorithm
  • the service type field in the ESP message may not be encrypted, which is not limited in the embodiment of the present application.
  • the configuration of the target security association may indicate to obtain the service type field before decrypting the first encrypted part.
  • the block identification field may also be used to indicate that the service type field is obtained before decrypting the first encrypted part. If the service type field is the second encrypted part of the ESP message, that is, when the service type field is an encrypted field, obtaining the service type field before decrypting the first encrypted part includes: encrypting the second encrypted part before decrypting the first encrypted part Perform decryption to obtain the business type field.
  • the payload data field when the encapsulation mode configured in the target security association is the transmission mode, the payload data field includes the data part of the original message.
  • the payload data field when the encapsulation mode configured in the target SA is the tunnel mode, the payload data field includes the original message header and the data part of the original message.
  • the data part of the original message includes the transport layer protocol header and data fields.
  • the integrity verification part may include an ESP header, a service type field, a load data field, and an ESP tail.
  • Step 403 The first device sends an ESP packet to the second device.
  • Step 404 The second device parses the service type field in the ESP message to obtain the service type information of the original message.
  • the second device receives the ESP message sent by the first device, according to the configuration in the target security alliance
  • the position and length of the service type field of the ESP message are directly parsed to obtain the service type information of the original message.
  • the second device receives the first After an ESP message is sent by a device, it first checks whether the field after the header is a block identification field; when it is determined that the field after the message header is a block identification field, the second device is configured according to the target security association Analyze the service type field of the ESP message to obtain the service type information of the original message; when it is determined that the field after the message is not the block identification field, the second device follows the traditional method The service type of the original message is determined, that is, the second device decrypts the encrypted part of the ESP message as a whole, and parses the payload data field to obtain the service type information of the original message.
  • the second device decrypts the service type field based on the encryption algorithm configured in the target security association.
  • the second device can obtain the service type information of the original message by analyzing the service type field of the ESP message, thereby determining the next operation of the ESP message , Without decrypting the first encrypted part.
  • the second device can also decrypt the first encrypted part of the ESP message while parsing the service type field in the ESP message, or the second device can also decrypt the first encrypted part of the ESP message.
  • the service type field in the text decrypts the first encrypted part of the ESP message before.
  • Step 405 The second device performs a target operation on the ESP message according to the service policy and the service type information of the original message.
  • the target operation includes any one of the following: decrypt the first encrypted part of the ESP message, discard the ESP message, forward (or bypass) the ESP message, cache the ESP message, and decapsulate the ESP message ESP message to obtain the original message and so on.
  • the configuration of the target security association or the block identification field is used to instruct the second device to parse the service type field in the ESP message before decrypting the first encrypted part of the ESP message to obtain the original message Business type information.
  • the ESP packet is determined to be discarded or forwarded by parsing the service type field, it is possible to prevent the second device from wasting the amount of calculation used to decrypt the first encrypted part, thereby reducing the calculation overhead of the second device.
  • the implementation process of step 405 may include: when the actual message reception rate of the second device is greater than the maximum message reception rate of the second device, the second device discards low-priority ESP packets , The priority and high priority ESP packets in the cache.
  • the second device may forward the received ESP message to the decryption device.
  • the second device can directly determine the priority of the ESP message after parsing the service type field; when the service type field of the ESP message does not carry the priority
  • the second device can analyze the service type field according to the application program to which the original message belongs, the company that sent the original message, the department that sent the original message, and the user who sent the original message. One or more determine the priority of the ESP packet.
  • the service policy is defined as: the total interface bandwidth of the second device is 100 Mbps (megabits per second), the interface bandwidth allocated to department A is 40 Mbps, and the interface bandwidth allocated to department B is 60 Mbps.
  • the interface bandwidth allocated to voice applications is 20 Mbps
  • the interface bandwidth allocated to mail applications is 10 Mbps
  • the interface bandwidth allocated to Internet applications is 10 Mbps.
  • voice applications are high-priority applications
  • mail applications are medium-priority applications
  • Internet applications are low-priority applications.
  • the second device When the interface of the second device receives 100Mbps department A traffic and 100Mbps department B traffic, the second device passes 40Mbps department A traffic (discards 60Mbps department A traffic), and passes 60Mbps department B (discards 40Mbps department B) Traffic). For department A's traffic, if the voice application traffic exceeds 20 Mbps or the mail application traffic exceeds 10 Mbps, the second device buffers the excess packets, and when the subsequent traffic decreases, it sends the buffered packets by way of buffering the packets. To achieve peak elimination and valley filling; if the traffic of the Internet application exceeds 10Mbps, the second device directly discards the excess packets.
  • the second device can obtain the service type information of the original message by parsing the service type field of the ESP message. Perform the target operation on the ESP message according to the service policy and the service type information of the original message, without decrypting the first encrypted part, which reduces the amount of decryption calculation for the second device in the process of determining the service type of the original message. In turn, the computational overhead of the second device is reduced.
  • FIG. 7 is a schematic structural diagram of a message transmission device provided by an embodiment of the present application. It can be applied to the first device 301 in the communication network as shown in FIG. 3. As shown in Fig. 7, the device 70 includes:
  • the obtaining module 701 is used to obtain service type information of the original message.
  • the generating module 702 is used to generate the ESP message of the original message based on the target security alliance.
  • the ESP message includes a message header, an ESP header, a service type field, a first encryption part, and an ESP authentication data field.
  • the service type The field includes service type information
  • the first encrypted part includes the data part of the original message
  • the service type field is used to enable the second device to determine the processing of the ESP message according to the service type information.
  • the sending module 703 is configured to send an ESP message to the second device.
  • the ESP message further includes a block identification field, the block identification field is located between the message header and the ESP header, and the block identification field is used to indicate that the ESP message includes a service type field.
  • the block identification field is also used to indicate that the service type field is obtained before decrypting the first encrypted part.
  • the configuration of the target security association indicates to obtain the service type field before decrypting the first encrypted part.
  • the service type field is the second encrypted part of the ESP message.
  • the service type information includes the priority of the original message, the identity of the application to which the original message belongs, the identity of the company that sent the original message, the identity of the department that sent the original message, and the identity of the user who sent the original message One or more of.
  • the service type field is used to enable the second device to determine the ESP according to the service type information.
  • the processing of the message so the second device can obtain the service type information of the original message by analyzing the service type field of the ESP message, and further execute the target operation on the ESP message according to the service policy and the service type information of the original message, and There is no need to decrypt the first encrypted part, which reduces the amount of decryption calculation for the second device in the process of determining the service type of the original message, thereby reducing the calculation overhead of the second device.
  • FIG. 8 is a schematic structural diagram of another message transmission apparatus provided by an embodiment of the present application. It can be applied to the second device 302 in the communication network as shown in FIG. 3. As shown in Fig. 8, the device 80 includes:
  • the receiving module 801 is configured to receive an ESP message sent by a first device.
  • the ESP message includes a message header, an ESP header, a service type field, a first encrypted part, and an ESP authentication data field.
  • the first encrypted part includes the original message.
  • the service type field includes the service type information of the original message.
  • the parsing module 802 is used for parsing the service type field to obtain the service type information of the original message.
  • the processing module 803 is configured to perform target operations on the ESP message according to the service strategy and the service type information of the original message.
  • the target operation includes any one of the following: decrypting the first encrypted part of the ESP message, discarding the ESP message, caching the ESP message, and forwarding the ESP message.
  • the ESP message further includes a block identification field, the block identification field is located between the message header and the ESP header, and the block identification field is used to indicate that the ESP message includes a service type field.
  • the block identification field is also used to indicate that the service type field is obtained before decrypting the first encrypted part.
  • the configuration of the target security association indicates to obtain the service type field before decrypting the first encrypted part.
  • the service type field is the second encrypted part of the ESP message.
  • the apparatus 80 further includes:
  • the decryption module 804 is configured to decrypt the service type field based on the encryption algorithm configured in the target security association.
  • the second device can obtain the service type information of the original message by analyzing the service type field of the ESP message through the parsing module ,
  • the processing module is further used to perform target operations on the ESP message according to the service policy and the service type information of the original message without decrypting the first encrypted part, which reduces the second device’s process of determining the service type of the original message The amount of decryption calculations, thereby reducing the calculation overhead of the second device.
  • FIG. 10 is a block diagram of a message transmission device provided by an embodiment of the present application.
  • the message transmission device may be a router or a switch.
  • the device 100 includes a processor 1001 and a memory 1002.
  • the memory 1002 is used to store a computer program, and the computer program includes program instructions;
  • the processor 1001 is configured to call a computer program to implement the steps executed by the first device and/or the second device in the message transmission method shown in FIG. 4.
  • the device 100 may further include a communication bus 1003 and a communication interface 1004.
  • the processor 1001 may be a central processing unit (CPU).
  • the processor 1001 may include one or more processing cores, and the processor 1001 executes various functional applications and data processing by running a computer program.
  • the processor 1001 and the memory 1002 are connected through the communication bus 1003.
  • the processor 1001 may further include a hardware chip.
  • the aforementioned hardware chip may be an application specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the above-mentioned PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a generic array logic (GAL), or any combination thereof.
  • the hardware chip can be used to implement encryption/decryption operations.
  • the memory 1002 may be used to store computer programs.
  • the memory may store an operating system and at least one application program unit required by the function.
  • the operating system can be a real-time operating system (Real Time eXecutive, RTX), LINUX, UNIX, WINDOWS, or OS X.
  • the memory 1002 may include a volatile memory (English: volatile memory), such as a random access memory (random access memory, RAM); the memory may also include a non-volatile memory (English: non-volatile memory), such as a flash memory (English: flash memory), hard disk drive (HDD) or solid-state drive (SSD); the memory 1002 may also include a combination of the foregoing types of memory.
  • volatile memory such as a random access memory (random access memory, RAM
  • non-volatile memory such as a flash memory (English: flash memory), hard disk drive (HDD) or solid-state drive (SSD)
  • SSD solid-state drive
  • the communication interface 1004 may include a wired communication interface, a wireless communication interface, or a combination thereof.
  • the wired communication interface may be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface may be a wireless local area network (WLAN) interface, a cellular network communication interface, or a combination thereof.
  • WLAN wireless local area network
  • An embodiment of the present application also provides a computer storage medium with program instructions stored on the computer storage medium.
  • the program instructions When executed, the execution performed by the first device in the message transmission method shown in FIG. 4 is implemented. Steps and/or steps performed by the second device.
  • the program can be stored in a computer-readable storage medium.
  • the storage medium mentioned can be a read-only memory, a magnetic disk or an optical disk, etc.
  • the terms “first”, “second” and “third” are only used for descriptive purposes, and cannot be understood as indicating or implying relative importance.
  • the term “at least one” refers to one or more, and the term “plurality” refers to two or more, unless expressly defined otherwise.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)

Abstract

本申请公开了一种报文传输方法及装置、计算机存储介质，属于通信技术领域。第一设备获取原始报文的业务类型信息。第一设备基于目标安全联盟，生成原始报文的ESP报文，该ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，业务类型字段中包括业务类型信息。第一设备向第二设备发送ESP报文。第二设备解析业务类型字段，获取原始报文的业务类型信息。第二设备根据业务策略以及原始报文的业务类型信息，对ESP报文执行目标操作。第二设备通过解析ESP报文的业务类型字段即可获取原始报文的业务类型信息，而无需对第一加密部分进行解密，降低了第二设备在确定原始报文的业务类型的过程中的计算开销。

Description

一种报文传输方法及设备、计算机存储介质
本申请要求了2019年8月29日提交的，申请号为201910810004.9，发明名称为“一种报文传输方法及装置、计算机存储介质”的中国申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信技术领域，特别涉及一种报文传输方法及装置、计算机存储介质。
背景技术
本申请提供了一种报文传输方法及装置、计算机存储介质，可以解决目前设备在确定原始报文的业务类型的过程中计算开销较大的问题。
第一方面，提供了一种报文传输方法，应用于通信网络中。该通信网络中包括第一设备和第二设备，第一设备与第二设备之间建立有目标安全联盟，第一设备为目标安全联盟的发起端，第二设备为目标安全联盟的目的端。该方法包括：
第一设备获取原始报文的业务类型信息。第一设备基于目标安全联盟，生成原始报文的ESP报文，ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，业务类型字段中包括业务类型信息，第一加密部分包括原始报文的数据部分，业务类型字段用于使第二设备根据业务类型信息确定ESP报文的处理。第一设备向第二设备发送ESP报文。
本申请中，由于第一设备生成的ESP报文中包括业务类型字段，该业务类型字段用于使第二设备根据业务类型信息确定ESP报文的处理，因此第二设备通过解析ESP报文的业务类型字段即可获取原始报文的业务类型信息，从而确定对该ESP报文的下一步操作，而无需对第一加密部分进行解密，可以减少第二设备在确定原始报文的业务类型的过程中的解密计算量，进而降低第二设备的计算开销。
可选地，ESP报文还包括分块标识字段，分块标识字段位于报文头与ESP头部之间，分块标识字段用于指示ESP报文中包括业务类型字段。
本申请中，通过在ESP报文的报文头与ESP头部之间添加分块标识字段，指示ESP报文中有业务类型字段，当ESP报文的报文头与ESP头部之间无分块标识字段，表示该ESP报文中无业务类型字段，可以使接收设备兼容处理传统ESP报文和本申请实施例提供的ESP报文，保证设备的兼容性能。
可选地，分块标识字段还用于指示在解密第一加密部分之前获取业务类型字段。
可选地，目标安全联盟的配置中指示在解密第一加密部分之前获取业务类型字段。
可选地，业务类型字段为ESP报文的第二加密部分。当然，ESP报文中的业务类型字段也可以不加密，本申请对此不做限定。
可选地，业务类型信息包括原始报文的优先级、原始报文所属应用程序的标识、发送原始报文的企业的标识、发送原始报文的部门的标识和发送原始报文的用户的标识中的一个或多个。
第二方面，提供了一种报文传输方法，应用于通信网络中。通信网络中包括第一设备和 第二设备，第一设备与第二设备之间建立有目标安全联盟，第一设备为目标安全联盟的发起端，第二设备为目标安全联盟的目的端。该方法包括：
第二设备接收第一设备发送的ESP报文，该ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，第一加密部分包括原始报文的数据部分，业务类型字段中包括该原始报文的业务类型信息。第二设备解析业务类型字段，获取原始报文的业务类型信息。第二设备根据业务策略以及原始报文的业务类型信息，对ESP报文执行目标操作。
本申请中，由于ESP报文中包括业务类型字段，第二设备通过解析ESP报文的业务类型字段即可获取原始报文的业务类型信息，进一步根据业务策略和原始报文的业务类型信息对ESP报文执行目标操作，而无需对第一加密部分进行解密，减少了第二设备在确定原始报文的业务类型的过程中的解密计算量，进而降低了第二设备的计算开销。
可选地，目标操作包括以下任意一个：对ESP报文的第一加密部分进行解密，丢弃ESP报文，缓存ESP报文以及转发ESP报文。
可选地，ESP报文还包括分块标识字段，分块标识字段位于报文头与ESP头部之间，分块标识字段用于指示ESP报文中包括业务类型字段。
可选地，分块标识字段还用于指示在解密第一加密部分之前获取业务类型字段。
可选地，目标安全联盟的配置中指示在解密第一加密部分之前获取业务类型字段。
可选地，业务类型字段为ESP报文的第二加密部分，在第二设备解析业务类型字段之前，第二设备还基于目标安全联盟中配置的加密算法，对业务类型字段进行解密。
第三方面，提供了一种报文传输装置。所述装置包括多个功能模块，所述多个功能模块相互作用，实现上述第一方面及其各实施方式中的方法。所述多个功能模块可以基于软件、硬件或软件和硬件的结合实现，且所述多个功能模块可以基于具体实现进行任意组合或分割。
第四方面，提供了一种报文传输装置。所述装置包括多个功能模块，所述多个功能模块相互作用，实现上述第二方面及其各实施方式中的方法。所述多个功能模块可以基于软件、硬件或软件和硬件的结合实现，且所述多个功能模块可以基于具体实现进行任意组合或分割。
第五方面，提供了一种报文传输装置，所述装置包括：处理器和存储器；
所述存储器，用于存储计算机程序，所述计算机程序包括程序指令；
所述处理器，用于调用所述计算机程序，实现如第一方面任一所述的报文传输方法。
第六方面，提供了一种报文传输装置，所述装置包括：处理器和存储器；
所述存储器，用于存储计算机程序，所述计算机程序包括程序指令；
所述处理器，用于调用所述计算机程序，实现如第二方面任一所述的报文传输方法。
第七方面，提供了一种计算机存储介质，所述计算机存储介质上存储有程序指令，当所述程序指令被执行时，实现如第一方面或第二方面任一所述的报文传输方法。
第八方面，提供了一种通信网络，该通信网络中包括第一设备和第二设备。第一设备与第二设备之间建立有目标安全联盟，第一设备为该目标安全联盟的发起端，第二设备为该目标安全联盟的目的端。第一设备包括如第三方面所述的报文传输装置，第二设备包括如第四方面所述的报文传输装置。
本申请提供的技术方案带来的有益效果至少包括：
本申请提供的报文传输方法中，由于第一设备生成的ESP报文中包括业务类型字段，该业务类型字段用于使第二设备根据业务类型信息确定ESP报文的处理，因此第二设备通过解析ESP报文的业务类型字段即可获取原始报文的业务类型信息，进一步根据业务策略和原始报文的业务类型信息对ESP报文执行目标操作，而无需对第一加密部分进行解密，可以减少 第二设备在确定原始报文的业务类型的过程中的解密计算量，进而降低第二设备的计算开销。
附图说明
图1是目前采用传输模式封装得到的ESP报文的结构示意图；
图2是目前采用隧道模式封装得到的ESP报文的结构示意图；
图3是本申请实施例提供的一种通信网络的结构示意图；
图4是本申请实施例提供的一种报文传输方法的流程图；
图5是本申请实施例提供的一种ESP报文的结构示意图；
图6是本申请实施例提供的另一种ESP报文的结构示意图；
图7是本申请实施例提供的一种报文传输装置的结构示意图；
图8是本申请实施例提供的另一种报文传输装置的结构示意图；
图9是本申请实施例提供的又一种报文传输装置的结构示意图；
图10是本申请实施例提供的一种报文传输装置的框图。
具体实施方式
为使本申请的目的、技术方案和优点更加清楚，下面将结合附图对本申请实施方式作进一步地详细描述。
IPSec安全传输数据的前提是在对等体(即运行IPSec的两个端点)之间成功建立安全联盟(security association，SA)。对等体之间通过安全联盟约定多个要素，包括：对等体间使用的安全协议、报文封装模式、加密算法、验证算法、对等体间的密钥交换方式、对等体间使用的互联网密钥交换(Internet Key Exchange，IKE)协议以及安全联盟的生存周期等。可选地，可以通过手工配置方式建立对等体间的安全联盟，或者，对等体间可以通过IKE自动协商方式建立安全联盟。
安全联盟是单向的逻辑连接，建立有安全联盟的对等体包括发起端和目的端。安全联盟中规定了从发起端发送到目的端的数据采取的保护方式。安全联盟由一个三元组来唯一标识，该三元组中包括安全参数索引(security parameters index，SPI)、目的端的IP地址和使用的安全协议。
安全协议用于提供加密和/或认证等安全服务。安全协议包括AH协议和ESP协议，这两个安全协议均为基于IP的传输层协议。其中，ESP协议的工作原理是在原始报文的数据部分前面添加ESP头部，在原始报文的数据部分后面添加ESP尾部和ESP认证数据字段，并对原始报文的数据部分进行加密，最后封装得到ESP报文。其中，原始报文的数据部分也即是原始报文的有效载荷部分，包括传输层协议头和数据(data)字段。
报文封装模式包括传输模式和隧道模式。本申请实施例分别对传输模式和隧道模式下的ESP报文的结构进行说明。图1是目前采用传输模式封装得到的ESP报文的结构示意图。图2是目前采用隧道模式封装得到的ESP报文的结构示意图。如图1和图2所示，ESP报文包括报文头、ESP头部、负载数据字段、ESP尾部和ESP认证数据字段。负载数据字段用于承载原始报文的内容。如图1所示，在传输模式下，负载数据字段包括原始报文的数据部分；如图2所示，在隧道模式下，负载数据字段包括原始报文的报文头(简称：原始报文头)以及原始报文的数据部分。参见图1和图2，原始报文的数据部分具体包括传输层协议头和数据字段。其中，报文头中定义的传输层协议为ESP协议。ESP报文的完整性验证部分包括ESP头部、负载数据字段和ESP尾部。该ESP报文的加密部分包括负载数据字段和ESP尾部。
在如图1和图2所示的ESP报文中，ESP头部中包括SPI字段和序列号。SPI字段用于承 载SPI，SPI用于唯一标识安全联盟。序列号用于唯一标识报文，防止报文重放攻击。ESP尾部中包括填充字段(可选)、填充长度字段和下一头部。填充长度字段用于指示填充字段的长度。下一头部用于指示负载数据字段的负载类型，下一头部中携带有ESP头部的下一个字段的标识。在传输模式下，下一头部中携带传输层协议(TCP协议、UDP协议或ICMP协议)的编号；在隧道模式下，下一头部中携带原始报文的IP协议的编号，设备通过解析原始报文头确定原始报文所采用的传输层协议。其中，SPI字段的长度为32比特。序列号的长度为32比特。负载数据字段为变长字段。填充字段的长度为0～255字节。填充长度字段的长度为8比特。下一头部的长度为8比特。ESP认证数据字段为变长字段，长度为32比特的整数倍，通常为96比特。
当设备接收到如图1或图2所示的ESP报文后，需要确定原始报文的业务类型时，由于原始报文的业务信息承载于负载数据字段，设备需要解析负载数据字段得到业务信息以确定原始报文的业务类型，因此设备需要对ESP报文的加密部分进行整体解密，根据ESP尾部中的下一头部确定负载数据字段的负载类型，再基于该负载类型解析负载数据字段。设备对ESP报文的加密部分整体解密的计算量较高，导致设备的计算开销较大。
示例地，在设备入方向限速场景中，若设备的实际报文接收速率大于设备的最大报文接收速率，则设备需要根据原始报文的业务类型确定该ESP报文的重要程度，并丢弃重要程度较低的ESP报文，以保证重要程度高的ESP报文的优先传输。例如，信令报文的优先级高于多媒体业务报文的优先级，设备可以通过丢弃多媒体业务报文保证信令报文的优先传输。但是，对于设备需要丢弃的ESP报文，设备也需要对ESP报文的加密部分进行整体解密，占用了设备的大量计算能力，造成了设备的性能浪费。
图3是本申请实施例提供的一种通信网络的结构示意图。如图3所示，该通信网络中包括第一设备301和第二设备302。第一设备301与第二设备302之间建立有目标SA。第一设备301为该目标SA的发起端，第二设备302为该目标SA的目的端。该目标SA中配置的安全协议为ESP协议。也即是，该目标SA中规定第一设备301发送到第二设备302的报文采用ESP协议封装保护。本申请实施例中将采用ESP协议封装保护的报文称为ESP报文。
可选地，通信网络可以是城域网络、广域网络或园区网络等。广域网络可以是软件定义广域网络(software defined wild area network，SD-WAN)。第一设备301和第二设备302可以是网络设备，具体可以是路由器或交换机等。
可选地，第一设备301和第二设备302之间可以通过手工配置方式建立目标SA，或者，第一设备301和第二设备302之间可以通过IKE自动协商方式建立目标SA。
图4是本申请实施例提供的一种报文传输方法的流程图。该方法可以应用于如图3所示的通信网络中。如图4所示，该方法包括：
步骤401、第一设备获取原始报文的业务类型信息。
可选地，原始报文可以是TCP报文、UDP报文或ICMP报文。原始报文的业务类型信息包括原始报文的优先级、原始报文所属应用程序的标识、发送原始报文的企业的标识、发送原始报文的部门的标识和发送原始报文的用户的标识中的一个或多个。原始报文的优先级可以采用原始报文头中的差分服务代码点(differentiated services code point，DSCP)字段值表示。原始报文所属应用程序的标识可以采用应用标识(application identification，APP ID)表示。发送原始报文的企业的标识和/或发送原始报文的部门的标识可以采用虚拟专 用网络标识(virtual private network identification，VPN ID)表示。发送原始报文的用户的标识可以采用用户的IP地址表示。
原始报文的业务类型信息通常承载于原始报文的数据部分中，原始报文的数据部分包括原始报文的传输层协议头和数据字段。第一设备在接收到原始报文后，对原始报文的数据部分进行解析，以获取原始报文的业务类型信息。
步骤402、第一设备基于目标安全联盟，生成原始报文的ESP报文。
可选地，图5是本申请实施例提供的一种ESP报文的结构示意图。如图5所示，该ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段。业务类型字段中包括原始报文的业务类型信息。第一加密部分包括原始报文的数据部分。原始报文的数据部分承载于第一加密部分的负载数据字段，第一加密部分还包括ESP尾部。该业务类型字段用于使第二设备根据业务类型信息确定ESP报文的处理。
可选地，原始报文的业务类型信息可以采用TLV(type-length-value)编码后承载于ESP报文的业务类型字段中。本申请实施例中，可以将业务类型字段划分为多个子字段，每个子字段作为一个基本信息单元(information element，IE)，用于承载固定的业务类型信息。例如，可以将业务类型字段划分为优先级子字段、应用标识子字段、企业标识子字段、部门标识子字段和用户标识子字段。优先级子字段中携带DSCP字段值，应用标识子字段中携带APP ID，企业标识子字段中携带VPN ID，部门标识子字段中携带VPN ID，用户标识子字段中携带IP地址。
可选地，图6是本申请实施例提供的另一种ESP报文的结构示意图。如图6所示，在如图5所示的ESP报文的基础上，该ESP报文还包括分块标识字段。该分块标识字段位于报文头与ESP头部之间，分块标识字段用于指示ESP报文中包括业务类型字段。
本申请实施例中可以采用0～255之间的某个数值作为分块标识填充在分块标识字段中，例如可以采用数值100作为分块标识填充在分块标识字段中，具体数值可以在目标安全联盟中约定。由于ESP头部中的SPI使用非0～255之间的数值，因此，当采用0～255之间的某个数值作为分块标识时，接收设备(本申请实施例指第二设备)在接收到ESP报文后，可以根据报文头之后的字段值区分位于报文头之后的字段为分块标识字段还是SPI字段。当然，分块标识也可以采用字母或字符串等其它标识表示，本申请实施例对此不做限定。
可选地，当采用如图6所示的ESP报文时，可以在目标安全联盟中协商配置：若ESP报文的报文头与ESP头部之间有分块标识字段，接收设备解析业务类型字段确定ESP报文的业务类型；若ESP报文的报文头与ESP头部之间无分块标识字段，接收设备按照传统方式确定ESP报文的业务类型，即接收设备对加密部分进行整体解密后，再解析负载数据字段，以确定ESP报文的业务类型。
本申请实施例中，通过在ESP报文的报文头与ESP头部之间添加分块标识字段，指示ESP报文中有业务类型字段，当ESP报文的报文头与ESP头部之间无分块标识字段，表示该ESP报文中无业务类型字段，可以使接收设备兼容处理传统ESP报文和本申请实施例提供的ESP报文，保证设备的兼容性能。
可选地，业务类型字段通常位于ESP头部之后。示例地，参见图5和图6，业务类型字段位于ESP头部和第一加密部分之间。当然，业务类型字段也可以位于第一加密部分和ESP认证数据字段之间，本申请实施例对业务类型字段在ESP报文中的具体位置不做限定。业务类型字段的长度以及业务类型字段在ESP报文中的位置可以在目标安全联盟中配置。业务类型字段可以是固定长度的字段，例如业务类型字段的长度可以是4个字节；或者，业务类型字 段也可以是变长字段。
可选地，参见图5和图6，业务类型字段可以为ESP报文的第二加密部分。ESP报文中的第一加密部分和第二加密部分均采用目标安全联盟中配置的加密算法进行加密。目标安全联盟中配置的加密算法可以是对称加密算法，包括数据加密标准(data encryption standard，DES)算法、三重数据加密标准(triple data encryption standard，3DES)算法、高级数据加密标准(advanced encryption standard，AES)算法或国产密码算法(SM1)。当然，ESP报文中的业务类型字段也可以不加密，本申请实施例对此不做限定。
可选地，目标安全联盟的配置中可以指示在解密第一加密部分之前获取业务类型字段。或者，在如图6所示的ESP报文中，分块标识字段还可以用于指示在解密第一加密部分之前获取业务类型字段。若业务类型字段为ESP报文的第二加密部分，即业务类型字段为加密字段时，则在解密第一加密部分之前获取业务类型字段，包括：在解密第一加密部分之前对第二加密部分进行解密，以获取业务类型字段。
可选地，在如图5和图6所示的ESP报文中，当目标安全联盟中配置的封装模式为传输模式时，负载数据字段包括原始报文的数据部分。当目标安全联盟中配置的封装模式为隧道模式时，负载数据字段包括原始报文头和原始报文的数据部分。原始报文的数据部分包括传输层协议头和数据字段。本申请实施例提供的ESP报文中除业务类型字段和分块标识字段以外的其它字段的解释和作用可参考IPSec中的相关解释说明，本申请实施例在此不做赘述。另外，在如图5和图6所示的ESP报文中，完整性验证部分可以包括ESP头部、业务类型字段、负载数据字段和ESP尾部。
步骤403、第一设备向第二设备发送ESP报文。
步骤404、第二设备解析ESP报文中的业务类型字段，获取原始报文的业务类型信息。
可选地，当目标安全联盟中规定第一设备向第二设备发送如图5所示的ESP报文时，第二设备接收到第一设备发送的ESP报文后，根据目标安全联盟中配置的业务类型字段的位置以及长度，直接解析ESP报文的业务类型字段，以获取原始报文的业务类型信息。当目标安全联盟中规定第一设备可以向第二设备发送传统ESP报文(图1或图2所示的ESP报文)以及如图6所示的ESP报文时，第二设备接收到第一设备发送的ESP报文后，首先检测位于报文头之后的字段是否为分块标识字段；当确定位于报文头之后的字段为分块标识字段时，第二设备根据目标安全联盟中配置的业务类型字段的位置以及长度，解析ESP报文的业务类型字段，以获取原始报文的业务类型信息；当确定位于报文之后的字段不为分块标识字段时，第二设备按照传统方式确定原始报文的业务类型，即第二设备对ESP报文的加密部分进行整体解密，并解析负载数据字段，以获取原始报文的业务类型信息。
可选地，当业务类型字段为ESP报文的第二加密部分，则在步骤404执行之前，第二设备基于目标安全联盟中配置的加密算法，对业务类型字段进行解密。
本申请实施例中，由于ESP报文中包括业务类型字段，第二设备通过解析ESP报文的业务类型字段即可获取原始报文的业务类型信息，从而确定对该ESP报文的下一步操作，而无需对第一加密部分进行解密。当然，在某些应用场景下，第二设备也可以在解析ESP报文中的业务类型字段的同时，对ESP报文的第一加密部分进行解密，或者，第二设备还可以在解析ESP报文中的业务类型字段之前对ESP报文的第一加密部分进行解密。
步骤405、第二设备根据业务策略以及原始报文的业务类型信息，对ESP报文执行目标操作。
可选地，目标操作包括以下任意一个：对该ESP报文的第一加密部分进行解密，丢弃该 ESP报文，转发(或旁路)该ESP报文，缓存该ESP报文，解封装该ESP报文以获取该原始报文等等。
可选地，通过目标安全联盟的配置或者分块标识字段，来指示第二设备在对ESP报文的第一加密部分进行解密之前，解析ESP报文中的业务类型字段，获取原始报文的业务类型信息。这样，如果通过解析业务类型字段，确定该ESP报文要被丢弃或者转发出去，则可以避免第二设备浪费用于解密第一加密部分的计算量，进而降低第二设备的计算开销。
在设备入方向限速场景中，步骤405的实现过程可以包括：当第二设备的实际报文接收速率大于第二设备的最大报文接收速率时，第二设备丢弃低优先级的ESP报文，缓存中优先级和高优先级的ESP报文。当第二设备上配置的业务策略中指定专门的解密设备对ESP报文进行加解密功能卸载时，第二设备可以将接收到的ESP报文转发至该解密设备。当ESP报文的业务类型字段中携带有原始报文的优先级时，第二设备可以在解析业务类型字段后直接确定该ESP报文的优先级；当ESP报文的业务类型字段中未携带原始报文的优先级时，第二设备可以在解析业务类型字段后，根据原始报文所属的应用程序、发送原始报文的企业、发送原始报文的部门以及发送原始报文的用户中的一个或多个确定该ESP报文的优先级。
示例地，假设业务策略定义为：第二设备的总接口带宽为100Mbps(兆比特每秒)，分配给部门A的接口带宽为40Mbps，分给部门B的接口带宽为60Mbps。部门A的接口带宽中，分配给语音应用的接口带宽为20Mbps，分配给邮件应用的接口带宽为10Mbps，分配给上网应用的接口带宽为10Mbps。其中，语音应用为高优先级应用，邮件应用为中优先级应用，上网应用为低优先级应用。当第二设备的接口收到100Mbps部门A的流量和100Mbps部门B的流量时，第二设备通过40Mbps部门A的流量(丢弃60Mbps部门A的流量)，通过60Mbps部门B的流量(丢弃40Mbps部门B的流量)。对于部门A的流量，若语音应用的流量超过20Mbps或者邮件应用的流量超过10Mbps时，第二设备缓存超出的报文，并在后续流量减小时，发送缓存的报文，通过缓存报文的方式实现消峰填谷；若上网应用的流量超过10Mbps，则第二设备直接丢弃超出的报文。
本申请实施例提供的报文传输方法的步骤先后顺序可以进行适当调整。步骤也可以根据情况进行相应增减。任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化的方法，都应涵盖在本申请的保护范围之内，因此不再赘述。
综上所述，本申请实施例提供的报文传输方法，由于ESP报文中包括业务类型字段，第二设备通过解析ESP报文的业务类型字段即可获取原始报文的业务类型信息，进一步根据业务策略和原始报文的业务类型信息对ESP报文执行目标操作，而无需对第一加密部分进行解密，减少了第二设备在确定原始报文的业务类型的过程中的解密计算量，进而降低了第二设备的计算开销。
图7是本申请实施例提供的一种报文传输装置的结构示意图。可以应用于如图3所示的通信网络中的第一设备301。如图7所示，该装置70包括：
获取模块701，用于获取原始报文的业务类型信息。
生成模块702，用于基于目标安全联盟，生成原始报文的ESP报文，该ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，该业务类型字段中包括业务类型信息，第一加密部分包括原始报文的数据部分，该业务类型字段用于使第二设备根据业务类型信息确定ESP报文的处理。
发送模块703，用于向第二设备发送ESP报文。
可选地，ESP报文还包括分块标识字段，分块标识字段位于报文头与ESP头部之间，分块标识字段用于指示ESP报文中包括业务类型字段。
可选地，分块标识字段还用于指示在解密第一加密部分之前获取业务类型字段。
可选地，目标安全联盟的配置中指示在解密第一加密部分之前获取业务类型字段。
可选地，业务类型字段为ESP报文的第二加密部分。
可选地，业务类型信息包括原始报文的优先级、原始报文所属应用程序的标识、发送原始报文的企业的标识、发送原始报文的部门的标识和发送原始报文的用户的标识中的一个或多个。
此处未尽之细节可参考图4所示的报文传输方法中的详细描述。
综上所述，本申请实施例提供的报文传输装置，由于第一设备通过生成模块生成的ESP报文中包括业务类型字段，该业务类型字段用于使第二设备根据业务类型信息确定ESP报文的处理，因此第二设备通过解析ESP报文的业务类型字段即可获取原始报文的业务类型信息，进一步根据业务策略和原始报文的业务类型信息对ESP报文执行目标操作，而无需对第一加密部分进行解密，减少了第二设备在确定原始报文的业务类型的过程中的解密计算量，进而降低了第二设备的计算开销。
图8是本申请实施例提供的另一种报文传输装置的结构示意图。可以应用于如图3所示的通信网络中的第二设备302。如图8所示，该装置80包括：
接收模块801，用于接收第一设备发送的ESP报文，该ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，第一加密部分包括原始报文的数据部分，业务类型字段中包括该原始报文的业务类型信息。
解析模块802，用于解析业务类型字段，获取原始报文的业务类型信息。
处理模块803，用于根据业务策略以及原始报文的业务类型信息，对ESP报文执行目标操作。
可选地，目标操作包括以下任意一个：对ESP报文的第一加密部分进行解密，丢弃ESP报文，缓存ESP报文以及转发ESP报文。
可选地，ESP报文还包括分块标识字段，分块标识字段位于报文头与ESP头部之间，分块标识字段用于指示ESP报文中包括业务类型字段。
可选地，分块标识字段还用于指示在解密第一加密部分之前获取业务类型字段。
可选地，目标安全联盟的配置中指示在解密第一加密部分之前获取业务类型字段。
可选地，业务类型字段为ESP报文的第二加密部分，如图9所示，装置80还包括：
解密模块804，用于基于目标安全联盟中配置的加密算法，对业务类型字段进行解密。
此处未尽之细节可参考图4所示的报文传输方法中的详细描述。
综上所述，本申请实施例提供的报文传输装置，由于ESP报文中包括业务类型字段，第二设备通过解析模块解析ESP报文的业务类型字段即可获取原始报文的业务类型信息，进一步通过处理模块根据业务策略和原始报文的业务类型信息对ESP报文执行目标操作，而无需对第一加密部分进行解密，减少了第二设备在确定原始报文的业务类型的过程中的解密计算量，进而降低了第二设备的计算开销。
关于上述实施例中的装置，其中各个模块执行操作的具体方式已经在有关该方法的实施例中进行了详细描述，此处将不做详细阐述说明。
图10是本申请实施例提供的一种报文传输装置的框图。该报文传输装置可以是路由器或交换机等。如图10所示，该装置100包括：处理器1001和存储器1002。
存储器1002，用于存储计算机程序，该计算机程序包括程序指令；
处理器1001，用于调用计算机程序，实现如图4所示的报文传输方法中第一设备和/或第二设备执行的步骤。
可选地，装置100还可以包括通信总线1003和通信接口1004。
其中，处理器1001可以是中央处理器(central processing unit，CPU)。处理器1001可以包括一个或者一个以上处理核心，处理器1001通过运行计算机程序执行各种功能应用以及数据处理。处理器1001和存储器1002通过所述通信总线1003相连。
处理器1001还可以进一步包括硬件芯片。上述硬件芯片可以是专用集成电路(application specific integrated circuits，ASIC)，可编程逻辑器件(programmable logic device，PLD)或其组合。上述PLD可以是复杂可编程逻辑器件(complex programmable logic device，CPLD)，现场可编程逻辑门阵列(field-programmable gate array，FPGA)，通用阵列逻辑(generic array logic，GAL)或其任意组合。可选地，该硬件芯片可用于实现加密/解密操作。
存储器1002可用于存储计算机程序。可选地，存储器可存储操作系统和至少一个功能所需的应用程序单元。操作系统可以是实时操作系统(Real Time eXecutive，RTX)、LINUX、UNIX、WINDOWS或OS X之类的操作系统。
存储器1002可以包括易失性存储器(英文：volatile memory)，例如随机存取存储器(random access memory，RAM)；存储器也可以包括非易失性存储器(英文：non-volatile memory)，例如快闪存储器(英文：flash memory)，硬盘(hard disk drive，HDD)或固态硬盘(solid-state drive，SSD)；存储器1002还可以包括上述种类的存储器的组合。
通信接口1004可以为多个，通信接口1004用于与其它设备进行通信。通信接口1004可以包括有线通信接口，无线通信接口或其组合。其中，有线通信接口例如可以为以太网接口。以太网接口可以是光接口，电接口或其组合。无线通信接口可以为无线局域网(wireless local area network，WLAN)接口，蜂窝网络通信接口或其组合等。
本申请实施例还提供了一种计算机存储介质，所述计算机存储介质上存储有程序指令，当所述程序指令被执行时，实现如图4所示的报文传输方法中第一设备执行的步骤和/或第二设备执行的步骤。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
在本申请实施例中，术语“第一”、“第二”和“第三”仅用于描述目的，而不能理解为指示或暗示相对重要性。术语“至少一个”是指一个或多个，术语“多个”指两个或两个以上，除非另有明确的限定。
本申请中术语“和/或”，仅仅是一种描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。另外， 本文中字符“/”，一般表示前后关联对象是一种“或”的关系。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的构思和原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (20)

  1. 一种报文传输方法，应用于通信网络中，其特征在于，所述通信网络中包括第一设备和第二设备，所述第一设备与所述第二设备之间建立有目标安全联盟，所述第一设备为所述目标安全联盟的发起端，所述第二设备为所述目标安全联盟的目的端，所述方法包括：
    所述第一设备获取原始报文的业务类型信息；
    所述第一设备基于所述目标安全联盟，生成所述原始报文的封装安全载荷ESP报文，所述ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，所述业务类型字段中包括所述业务类型信息，所述第一加密部分包括所述原始报文的数据部分，所述业务类型字段用于使所述第二设备根据所述业务类型信息确定所述ESP报文的处理；
    所述第一设备向所述第二设备发送所述ESP报文。
  2. 根据权利要求1所述的方法，其特征在于，所述ESP报文还包括分块标识字段，所述分块标识字段位于所述报文头与所述ESP头部之间，所述分块标识字段用于指示所述ESP报文中包括所述业务类型字段。
  3. 根据权利要求2所述的方法，其特征在于，所述分块标识字段还用于指示在解密所述第一加密部分之前获取所述业务类型字段。
  4. 根据权利要求1或2所述的方法，其特征在于，所述目标安全联盟的配置中指示在解密所述第一加密部分之前获取所述业务类型字段。
  5. 根据权利要求1至4任一所述的方法，其特征在于，所述业务类型字段为所述ESP报文的第二加密部分。
  6. 根据权利要求1至5任一所述的方法，其特征在于，所述业务类型信息包括所述原始报文的优先级、所述原始报文所属应用程序的标识、发送所述原始报文的企业的标识、发送所述原始报文的部门的标识和发送所述原始报文的用户的标识中的一个或多个。
  7. 一种报文传输方法，应用于通信网络中，其特征在于，所述通信网络中包括第一设备和第二设备，所述第一设备与所述第二设备之间建立有目标安全联盟，所述第一设备为所述目标安全联盟的发起端，所述第二设备为所述目标安全联盟的目的端，所述方法包括：
    所述第二设备接收所述第一设备发送的封装安全载荷ESP报文，所述ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，所述第一加密部分包括原始报文的数据部分，所述业务类型字段中包括所述原始报文的业务类型信息；
    所述第二设备解析所述业务类型字段，获取所述原始报文的业务类型信息；
    所述第二设备根据业务策略以及所述原始报文的业务类型信息，对所述ESP报文执行目标操作。
  8. 根据权利要求7所述的方法，其特征在于，所述目标操作包括以下任意一个：
    对所述ESP报文的第一加密部分进行解密，丢弃所述ESP报文，缓存所述ESP报文以及 转发所述ESP报文。
  9. 根据权利要求7或8所述的方法，其特征在于，所述ESP报文还包括分块标识字段，所述分块标识字段位于所述报文头与所述ESP头部之间，所述分块标识字段用于指示所述ESP报文中包括所述业务类型字段。
  10. 根据权利要求9所述的方法，其特征在于，所述分块标识字段还用于指示在解密所述第一加密部分之前获取所述业务类型字段。
  11. 根据权利要求7至9任一所述的方法，其特征在于，所述目标安全联盟的配置中指示在解密所述第一加密部分之前获取所述业务类型字段。
  12. 根据权利要求7至11任一所述的方法，其特征在于，所述业务类型字段为所述ESP报文的第二加密部分，在所述第二设备解析所述业务类型字段之前，所述方法还包括：
    所述第二设备基于所述目标安全联盟中配置的加密算法，对所述业务类型字段进行解密。
  13. 一种报文传输装置，应用于通信网络中，其特征在于，所述通信网络中包括第一设备和第二设备，所述第一设备与所述第二设备之间建立有目标安全联盟，所述第一设备为所述目标安全联盟的发起端，所述第二设备为所述目标安全联盟的目的端，所述装置应用于所述第一设备，所述装置包括：
    获取模块，用于获取原始报文的业务类型信息；
    生成模块，用于基于所述目标安全联盟，生成所述原始报文的封装安全载荷ESP报文，所述ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，所述业务类型字段中包括所述业务类型信息，所述第一加密部分包括所述原始报文的数据部分，所述业务类型字段用于使所述第二设备根据所述业务类型信息确定所述ESP报文的处理；
    发送模块，用于向所述第二设备发送所述ESP报文。
  14. 根据权利要求13所述的装置，其特征在于，所述ESP报文还包括分块标识字段，所述分块标识字段位于所述报文头与所述ESP头部之间，所述分块标识字段用于指示所述ESP报文中包括所述业务类型字段。
  15. 一种报文传输装置，应用于通信网络中，其特征在于，所述通信网络中包括第一设备和第二设备，所述第一设备与所述第二设备之间建立有目标安全联盟，所述第一设备为所述目标安全联盟的发起端，所述第二设备为所述目标安全联盟的目的端，所述装置应用于所述第二设备，所述装置包括：
    接收模块，用于接收所述第一设备发送的封装安全载荷ESP报文，所述ESP报文包括报文头、ESP头部、业务类型字段、第一加密部分和ESP认证数据字段，所述第一加密部分包括原始报文的数据部分，所述业务类型字段中包括所述原始报文的业务类型信息；
    解析模块，用于解析所述业务类型字段，获取所述原始报文的业务类型信息；
    处理模块，用于根据业务策略以及所述原始报文的业务类型信息，对所述ESP报文执行目标操作。
  16. 根据权利要求15所述的装置，其特征在于，所述目标操作包括以下任意一个：
    对所述ESP报文的第一加密部分进行解密，丢弃所述ESP报文，缓存所述ESP报文以及转发所述ESP报文。
  17. 根据权利要求15或16所述的装置，其特征在于，所述ESP报文还包括分块标识字段，所述分块标识字段位于所述报文头与所述ESP头部之间，所述分块标识字段用于指示所述ESP报文中包括所述业务类型字段。
  18. 根据权利要求17所述的装置，其特征在于，所述目标安全联盟的配置中或者所述分块标识字段，指示在解密所述第一加密部分之前获取所述业务类型字段。
  19. 一种报文传输装置，其特征在于，所述装置包括：处理器和存储器；
    所述存储器，用于存储计算机程序；
    所述处理器，用于调用所述计算机程序，实现如权利要求1至6任一所述的报文传输方法，或者如权利要求7至12任一所述的报文传输方法。
  20. 一种计算机存储介质，其特征在于，所述计算机存储介质上存储有程序指令，当所述程序指令被执行时，实现如权利要求1至6任一所述的报文传输方法，或者如权利要求7至12任一所述的报文传输方法。
PCT/CN2020/112165 2019-08-29 2020-08-28 一种报文传输方法及设备、计算机存储介质 WO2021037216A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
EP20858281.7A EP4020915A4 (en) 2019-08-29 2020-08-28 METHOD AND DEVICE FOR TRANSMITTING MESSAGES, AND COMPUTER STORAGE MEDIUM
US17/672,359 US20220174051A1 (en) 2019-08-29 2022-02-15 Packet transmission method and apparatus and computer storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910810004.9A CN112448918B (zh) 2019-08-29 2019-08-29 报文传输方法及装置、计算机存储介质
CN201910810004.9 2019-08-29

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US17/672,359 Continuation US20220174051A1 (en) 2019-08-29 2022-02-15 Packet transmission method and apparatus and computer storage medium

Publications (1)

Publication Number Publication Date
WO2021037216A1 true WO2021037216A1 (zh) 2021-03-04

Family

ID=74685570

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/112165 WO2021037216A1 (zh) 2019-08-29 2020-08-28 一种报文传输方法及设备、计算机存储介质

Country Status (4)

Country Link
US (1) US20220174051A1 (zh)
EP (1) EP4020915A4 (zh)
CN (1) CN112448918B (zh)
WO (1) WO2021037216A1 (zh)

Families Citing this family (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115150338A (zh) * 2021-03-29 2022-10-04 华为技术有限公司 报文流量控制的方法、装置、设备及计算机可读存储介质
CN115695565B (zh) * 2021-07-13 2024-04-09 大唐移动通信设备有限公司 一种数据报文处理方法、装置及计算机可读存储介质
CN113676466B (zh) * 2021-08-11 2023-06-16 中国人民银行数字货币研究所 一种网络安全检测的方法和装置
CN114465775B (zh) * 2021-12-31 2023-10-20 华为技术有限公司 安全传输方法及装置
CN115134806B (zh) * 2022-08-31 2024-04-19 北京博特数通技术有限公司 IPSec安全加固传输方法、CPE和网络传输系统
CN116471345B (zh) * 2023-06-19 2023-10-20 中电科网络安全科技股份有限公司 一种数据通信方法、装置、设备及介质
CN117560226B (zh) * 2024-01-09 2024-03-19 上海芯联芯智能科技有限公司 一种通过虚拟专用网络vpn进行数据传输的方法及装置

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1540916A (zh) * 2003-04-24 2004-10-27 松下电器产业株式会社 加密信息包处理设备、方法、程序和程序记录媒体
US20060193320A1 (en) * 2005-02-28 2006-08-31 Samsung Electronics Co., Ltd. Data transmission method having improved network address translation method in home gateway and a system thereof
CN102158977A (zh) * 2011-04-07 2011-08-17 大唐移动通信设备有限公司 一种指示业务类型的方法、装置及系统
US20130103940A1 (en) * 2011-10-19 2013-04-25 Alexandru R. Badea Methods, systems, and computer readable media for performing encapsulating security payload (esp) rehashing
CN103475598A (zh) * 2013-08-23 2013-12-25 天津汉柏汉安信息技术有限公司 一种通过spi划分用户优先级的方法
CN108200071A (zh) * 2018-01-11 2018-06-22 江苏农林职业技术学院 支持报文信息提取和携带的IPSecNAT穿越方法及系统

Family Cites Families (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6055236A (en) * 1998-03-05 2000-04-25 3Com Corporation Method and system for locating network services with distributed network address translation
CN101217494A (zh) * 2008-01-08 2008-07-09 杭州华三通信技术有限公司 一种监控业务流的方法及网络设备
JP5460085B2 (ja) * 2009-03-13 2014-04-02 キヤノン株式会社 情報処理装置、通信システム、それらの制御方法、及びプログラム
JP2012010254A (ja) * 2010-06-28 2012-01-12 Fujitsu Ltd 通信装置、通信方法及び通信システム
CN102413176B (zh) * 2011-11-11 2014-01-01 华为技术有限公司 连接转换方法和设备
US9185130B2 (en) * 2012-05-29 2015-11-10 Panasonic Intellectual Property Management Co., Ltd. Transmission apparatus, reception apparatus, communication system, transmission method, and reception method
CN104168553B (zh) * 2014-08-29 2017-11-03 大唐移动通信设备有限公司 一种业务报文发送和计费方法及装置
CN107370654B (zh) * 2016-05-11 2019-12-24 华为技术有限公司 一种伪线数据报文的封装、解封装方法和相关装置

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1540916A (zh) * 2003-04-24 2004-10-27 松下电器产业株式会社 加密信息包处理设备、方法、程序和程序记录媒体
US20060193320A1 (en) * 2005-02-28 2006-08-31 Samsung Electronics Co., Ltd. Data transmission method having improved network address translation method in home gateway and a system thereof
CN102158977A (zh) * 2011-04-07 2011-08-17 大唐移动通信设备有限公司 一种指示业务类型的方法、装置及系统
US20130103940A1 (en) * 2011-10-19 2013-04-25 Alexandru R. Badea Methods, systems, and computer readable media for performing encapsulating security payload (esp) rehashing
CN103475598A (zh) * 2013-08-23 2013-12-25 天津汉柏汉安信息技术有限公司 一种通过spi划分用户优先级的方法
CN108200071A (zh) * 2018-01-11 2018-06-22 江苏农林职业技术学院 支持报文信息提取和携带的IPSecNAT穿越方法及系统

Non-Patent Citations (1)

* Cited by examiner, † Cited by third party
Title
See also references of EP4020915A4

Also Published As

Publication number Publication date
CN112448918A (zh) 2021-03-05
US20220174051A1 (en) 2022-06-02
EP4020915A1 (en) 2022-06-29
CN112448918B (zh) 2023-06-09
EP4020915A4 (en) 2022-09-28

Similar Documents

Publication Publication Date Title
WO2021037216A1 (zh) 一种报文传输方法及设备、计算机存储介质
US11277391B2 (en) Packet sending method and apparatus
US7835285B2 (en) Quality of service, policy enhanced hierarchical disruption tolerant networking system and method
CN112583647B (zh) 用于针对有线和无线节点的公共控制协议的方法和设备
US9369550B2 (en) Protocol for layer two multiple network links tunnelling
US8370921B2 (en) Ensuring quality of service over VPN IPsec tunnels
US10044841B2 (en) Methods and systems for creating protocol header for embedded layer two packets
US20080162922A1 (en) Fragmenting security encapsulated ethernet frames
KR20080059601A (ko) 무선 네트워크들을 위한 공중-인터페이스 애플리케이션 층보안
Hu et al. Survey of proposed use cases for the IPv6 flow label
WO2022001287A1 (zh) 一种报文处理的方法及设备
KR100748698B1 (ko) 보안 통신 시스템의 패킷 처리 방법 및 그 장치
WO2020135011A1 (zh) 传输方法、装置、报文发送端和接收端
US20050198498A1 (en) System and method for performing cryptographic operations on network data
Seggelmann et al. SSH over SCTP—Optimizing a multi-channel protocol by adapting it to SCTP
CN106161386B (zh) 一种实现IPsec分流的方法和装置
CN114268518B (zh) 一种实现sdwan数据隧道转发加速的方法及系统
CN113965518A (zh) 一种报文处理的方法及设备
US20050198500A1 (en) System and method for performing security operations on network data
US20230113138A1 (en) Application Information Verification Method, Packet Processing Method, And Apparatuses Thereof
US20090073971A1 (en) Per-packet quality of service support for encrypted ipsec tunnels
Hohendorf et al. Secure End-to-End Transport Over SCTP.
WO2021208088A1 (en) Method and apparatus for security communication
CN112787905A (zh) Mtu确定方法及系统、电子设备及存储介质
KR101584836B1 (ko) 네트워크 보안 방법 및 장치

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20858281

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2020858281

Country of ref document: EP

Effective date: 20220322