WO2022002098A1

WO2022002098A1 - Information sending method, information receiving method and network

Info

Publication number: WO2022002098A1
Application number: PCT/CN2021/103364
Authority: WO
Inventors: 周娜; 李锐; 吴华强; 闫新成
Original assignee: 中兴通讯股份有限公司
Priority date: 2020-06-30
Filing date: 2021-06-30
Publication date: 2022-01-06
Also published as: CN113872915A

Abstract

Embodiments of the present disclosure provide an information sending method, comprising: sending to another network terminal of an Internet Protocol Security tunnel quality of service assurance capability information, wherein the quality of service assurance capability information is used for indicating whether the network terminal enables multi-window capability and/or whether the network terminal enables multi-number capability, wherein the multi-number capability is the ability to, when sending packets, separately number at least a part of the packets having different quality of service, and the multi-window capability is the ability to, when receiving packets, process at least a part of the packets having different quality of service using different preset anti-replay windows. The embodiments of the present disclosure also provide an information receiving method and a network terminal.

Description

Method of sending information, method of receiving information, network terminal

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims priority to Chinese patent application No. 202010613157.7 filed on June 30, 2020, the entire contents of which are incorporated herein by reference.

technical field

The present disclosure relates to the technical field of communication security, and in particular, to a method for sending information, a method for receiving information, and a network terminal.

Background technique

In a network system, packets (eg, IP packets) exchanged between different network terminals (eg, gateways of different networks, different offices, etc.) are often transmitted through an open third-party network (eg, the Internet). However, because the third-party network is open and transparent, and most of the packets are in plain text, they do not have sufficient security features. Therefore, when the packets are transmitted in the third-party network, they may be intercepted, viewed, or tampered with by attackers, resulting in Serious privacy and security concerns.

Therefore, the security of data transmission in an untrusted network is one of the important components of network security. The Internet Security Protocol (IPsec, Internet Protocol Security) is one of the important technologies to solve the security of network transmission. IPsec technology can establish an Internet Security Protocol tunnel (IPSec tunnel) between two network ends, so that subsequent packets between the two network ends are transmitted in the IPSec tunnel, so as to realize the security of data in an untrusted network transmission.

However, when the quality of service (QoS, Quality of Service) of the packets transmitted in the IPSec tunnel is different and the amount of data is large, the anti-replay window (or the anti-replay queue) may incorrectly discard some packets. Affect the quality and security of data transmission.

SUMMARY OF THE INVENTION

In a first aspect, an embodiment of the present disclosure provides a method for sending information, which is used for a network end of an Internet security protocol tunnel, the method includes: sending service quality assurance capability information to another network end of the Internet security protocol tunnel, wherein, The service quality assurance capability information is used to indicate whether the network end enables the multi-window capability, and/or whether the network end enables the multi-numbering capability, wherein the multi-numbering capability is when sending a message, at least The ability to independently number some packets with different quality of service; the multi-window capability is the ability to use different preset anti-replay windows to process at least part of the packets with different quality of service when receiving packets.

In a second aspect, an embodiment of the present disclosure provides a method for receiving information, which is used at a network end of an Internet security protocol tunnel, the method comprising: receiving service quality assurance capability information from another network end of the Internet security protocol tunnel, wherein, The service quality assurance capability information is used to indicate whether the other network end of the Internet security protocol tunnel enables the multi-window capability, and/or whether the other network end enables the multi-numbering capability, wherein the multi-numbering capability is in the When sending a message, the ability to independently number at least some of the messages with different quality of service; the multi-window capability is to use different preset anti-replay windows to process at least some of the messages with different quality of service when receiving messages Ability.

In a third aspect, an embodiment of the present disclosure provides a network end of an Internet security protocol tunnel, which includes: a sending module configured to send service quality assurance capability information to another network end of the Internet security protocol tunnel, wherein the quality of service The guarantee capability information is used to indicate whether the network end enables the multi-window capability, and/or whether the network end enables the multi-numbering capability, wherein the multi-numbering capability is to change at least part of the quality of service different when sending a message The capability of independently numbering the corresponding messages; the multi-window capability is the capability of using different preset anti-replay windows to process at least some of the messages with different quality of service when receiving messages.

In a fourth aspect, an embodiment of the present disclosure provides a network end of an Internet security protocol tunnel, comprising: a receiving module configured to receive service quality assurance capability information from another network end of the Internet security protocol tunnel, wherein the quality of service The assurance capability information is used to indicate whether the other network end of the Internet security protocol tunnel enables the multi-window capability, and/or whether the other network end enables the multi-numbering capability, wherein the multi-numbering capability is when sending a message , the ability to independently number at least some of the packets with different quality of service; the multi-window capability is the ability to use different preset anti-replay windows to process at least some of the packets with different quality of service when receiving packets.

Description of drawings

In the accompanying drawings of embodiments of the present disclosure:

Fig. 1 is the schematic diagram that two network ends are connected through IPSec tunnel;

2 is a schematic diagram of a process of processing a message through an anti-replay window;

3 is a schematic diagram of a process of processing a message in an embodiment of the present disclosure;

4 is a flowchart of a method for sending information according to an embodiment of the present disclosure;

FIG. 5 is a flowchart of another method for sending information according to an embodiment of the present disclosure;

6 is a flowchart of another method for sending information provided by an embodiment of the present disclosure;

7 is a flowchart of a method for receiving information according to an embodiment of the present disclosure;

8 is a block diagram of the composition of a network end of an Internet security protocol tunnel provided by an embodiment of the present disclosure;

FIG. 9 is a block diagram of the composition of a network end of an Internet security protocol tunnel provided by an embodiment of the present disclosure.

detailed description

In order for those skilled in the art to better understand the technical solutions of the embodiments of the present disclosure, the information sending method, the information receiving method, and the network terminal provided by the embodiments of the present disclosure are described in detail below with reference to the accompanying drawings.

Embodiments of the present disclosure will be described more fully hereinafter with reference to the accompanying drawings, but the illustrated embodiments may be embodied in different forms and should not be construed as limited to the embodiments set forth in this disclosure. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

The accompanying drawings of the embodiments of the present disclosure are used to provide a further understanding of the embodiments of the present disclosure, constitute a part of the specification, and together with the embodiments of the present disclosure, are used to explain the present disclosure, and do not constitute a limitation to the present disclosure. The above and other features and advantages will become more apparent to those skilled in the art by describing detailed example embodiments with reference to the accompanying drawings,

Embodiments of the present disclosure may be described with reference to plan views and/or cross-sectional views with the aid of idealized schematic illustrations of the present disclosure. Accordingly, example illustrations may be modified according to manufacturing techniques and/or tolerances.

Various embodiments of the present disclosure and various features of the embodiments may be combined with each other without conflict.

The terminology used in this disclosure is used to describe particular embodiments only, and is not intended to limit the disclosure. As used in this disclosure, the term "and/or" includes any and all combinations of one or more of the associated listed items. As used in this disclosure, the singular forms "a" and "the" are intended to include the plural forms as well, unless the context clearly dictates otherwise. The terms "comprising", "made of", as used in this disclosure, specify the presence of stated features, integers, steps, operations, elements and/or components, but do not preclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and/or groups thereof.

Unless otherwise defined, all terms (including technical and scientific terms) used in this disclosure have the same meaning as commonly understood by one of ordinary skill in the art. It will also be understood that terms such as those defined in common dictionaries should be construed as having meanings consistent with their meanings in the context of the related art and the present disclosure, and will not be construed as having idealized or over-formal meanings, Unless this disclosure expressly so limited.

Embodiments of the present disclosure are not limited to the embodiments shown in the drawings, but include modifications of configurations formed based on manufacturing processes. Thus, the regions illustrated in the figures have schematic properties and the shapes of regions illustrated in the figures are illustrative of the specific shapes of regions of elements and are not intended to be limiting.

In some related technologies, the problem of data transmission security in an untrusted network can be solved through Internet Security Protocol (IPsec, Internet Protocol Security).

IPsec is a protocol suite, which is mainly composed of three parts: AH protocol (Authentication Header), ESP (Encapsulating Security Payload), and IKE (Internet Key Exchange).

Among them, the AH protocol can provide data source authentication, integrity, and anti-replay service (implemented through the anti-replay window). Data encapsulation is based on the ESP protocol. The IKE protocol is used to establish an Internet Security Protocol tunnel (IPSec tunnel) between two different network ends through negotiation.

Specifically, referring to Figure 1, the IKE protocol negotiates a Security Association (SA, Security Association) with a five-tuple based on source IP (Internet Protocol), destination IP, protocol number, source port (Port), and destination port, and according to The SA establishes the corresponding IPSec tunnel. Among them, each SA records the encapsulation mode, encryption algorithm, encryption key, verification algorithm, key and other information used to protect the packet, that is, the SA records the policy and policy parameters of each IPSec tunnel, which is equivalent to the IPSec tunnel's A special communication agreement established between two parties (the initiator and the responder). Based on the directionality of SAs, each IPSec tunnel usually includes two SAs (or it can also be considered that each unidirectional IPSec tunnel includes one SA). Each SA is uniquely identified by the Security Parameter Index (SPI, Security Parameter Index), and the SPI identifier will be carried in the subsequent transmitted packets (IPSec packets) to determine whether it belongs to the corresponding SA (of course, the IPSec tunnel to which it belongs). ).

Of course, in addition to negotiating through the IKE protocol, an IPSec tunnel may also be established (or configured) manually, which will not be described in detail here.

As a result, a dedicated IPSec tunnel can be established between two different network ends through IPsec technology, and subsequent packets between the two network ends are transmitted in the IPSec tunnel, and encrypted, encapsulated, and authenticated in a specific way. , decryption, etc., so as to realize the secure transmission of data in untrusted networks, and provide security privacy and security guarantees for individual mobile users, enterprise mobile users, and operators.

In order to avoid repeatedly receiving packets, both sides of the IPSec tunnel (the initiator and the responder) need to use an anti-replay window (or an anti-replay queue) to process (or filter) the received packets.

Specifically, referring to Figure 1 and Figure 2, the packets received by a network end are arranged in the corresponding position of the receiving queue according to the sequence number (SN, Sequence Number) (if a packet has not been received, the packet with the corresponding sequence number The corresponding "position" still exists, but there is no content in it), and the anti-replay window has a certain size (or length, that is, the number of packets contained in it), and can "slide" on the receive queue.

When the received message is located in the anti-replay window (that is, the sequence number of the message is within the range of the anti-replay window), the message is saved; and when the received message is located on the right side of the anti-replay window (that is, the sequence number of the message is larger than the maximum sequence number in the anti-replay window), the anti-replay window will be shifted to the right so that the maximum value reaches the position of the newly received message, so that the message It is located in the anti-replay window (at the far right end of the anti-replay window), and saves the message; if the received message is located on the left side of the anti-replay window (that is, the sequence number of the message is smaller than the smallest value in the anti-replay window) When the sequence number is still small), the corresponding message is discarded, so as to avoid repeated reception of the message with the small sequence number.

In many cases, the data transmitted in the IPSec tunnel may come from different network elements, so it has different quality of service (QoS, Quality of Service). Among them, QoS is the regulation of packet delay, packet loss rate, etc., which is equivalent to the "quality requirement" for packet transmission. Therefore, when the packet is transmitted in an intermediate transmission device (such as a router), the network device will Different QoS processes packets with different priorities.

Since different packets are actually transmitted through many different intermediate transmission devices, the order in which packets with different QoS are reached may be different from the order in which the packets are sent (or sequence numbers), that is, high-priority, large sequence numbers. Packets may be "sent first, arrive first", while low-priority packets with small sequence numbers may be "sent first, arrive first", resulting in "out of order".

The network terminals of both sides of an IPSec tunnel are usually communication base stations, security gateways, etc. The data transmitted between these network terminals may come from many different network elements (such as terminals of different users), so the amount of data transmitted between them is relatively large. big.

In particular, with the rapid development of 5G technology and Internet of Things technology, the network transmission volume continues to increase. For example, the traffic of a typical single 5G base station far exceeds that of 4G (downlink traffic can reach 40Gbps, and uplink traffic can reach 20Gbps), but the 5G base station and the corresponding security gateway are usually only connected through one IPSec tunnel, that is, all data is transmitted through a single IPSec tunnel. IPSec tunnel transmission, the data throughput in the IPSec tunnel is large, and the number of packets is large.

When the amount of data is large and the QoS is different, many packets with large sequence numbers and high priorities will arrive before packets with small sequence numbers and low priorities in the packets transmitted through an IPSec tunnel. . When the network first receives a packet with a large sequence number (such as the n+100 packet in Figure 2), the anti-replay window will move to the right to the packet with a large sequence number, which often leads to subsequent reception. The message with the small sequence number (such as the n-number message in Figure 2) is already located on the left side of the anti-replay window (for example, the size of the anti-replay window is 100 in Figure 2), and is discarded by mistake.

That is to say, in the case of a large amount of data, when the IPSec tunnel transmits packets with different QoS, it is very likely that some of the packets are discarded incorrectly, which affects the quality and security of data transmission.

Moreover, simply increasing the anti-playback window will not solve the above problems, because: on the one hand, if the anti-playback window is too large, it is equivalent to losing the original anti-playback function; on the other hand, it cannot Determine the size of the anti-replay window to completely avoid the above problems.

In a first aspect, an embodiment of the present disclosure provides a method for sending information.

The method of the embodiment of the present disclosure is applied to a network end of an Internet Security Protocol tunnel (IPSec tunnel), which may be an initiator (Initiator) or a responder (Responder) of the IPSec tunnel, that is, any network of the IPSec tunnel. The terminal may perform the method of an embodiment of the present disclosure.

It should be understood that, in addition to exchanging information with another network end through an IPSec tunnel, the above network end may also be connected to other network devices through other means (means other than the IPSec tunnel).

Exemplarily, the network end in this embodiment of the present disclosure may be any network element that can establish a connection through an IPSec tunnel, such as a wireless communication base station (such as a 2G, 3G, 4G, 5G and other base station), a set-top box, a security gateway, a firewall device, a Network equipment with other software, etc.

Referring to FIG. 4 , the method for sending information according to an embodiment of the present disclosure includes:

Step S101: Send quality of service (QoS) guarantee capability information to another network end of the IPSec tunnel.

The QoS guarantee capability information is used to indicate whether the network end enables the multi-window capability, and/or whether the network end enables the multi-numbering capability.

Among them, the multi-numbering capability is the capability of independently numbering at least some of the packets with different QoS when the network sends packets; the multi-window capability is the ability to use different preset anti-replay when receiving packets at the network. The ability of the window to handle at least some of the packets with different QoS.

The network end sends QoS assurance capability information to the other network end of the IPSec tunnel to "inform" the other network end of its own QoS assurance capability. The QoS assurance capability specifically refers to whether the network end itself enables the multi-window capability and/or the multi-numbering capability. Therefore, through "negotiation" with another network end, it is decided whether to enable the corresponding QoS guarantee capability.

Among them, "enable" a certain guarantee capability (multi-window capability and multi-number capability) means that, firstly, the network end must have the guarantee capability, and wish to use the guarantee capability.

"Not enabling" a certain guarantee capability (multi-window capability and multi-numbering capability) may mean that the network end does not have the guarantee capability at all, or the network end has the guarantee capability but currently does not wish to use the guarantee capability.

Referring to FIG. 3 , "multi-window capability" refers to the capability of processing received packets with different preset anti-replay windows according to their QoS.

Among them, there are at least two preset anti-replay windows, that is, packets with at least two different QoS should be processed in different preset anti-replay windows; and different preset anti-replay windows correspond to different QoS, so Packets with any QoS can only be processed in one preset anti-replay window, and will not enter the receive queues of two anti-replay windows at the same time.

The "multi-numbering capability" refers to the capability of independently numbering packets with different QoS according to different QoS when sending packets. Thus, in each numbering, the sequence number (SN) of the message starts from "1". Of course, the sequence numbers of packets with different QoS may be "duplicated" at this time, but because the packets with different QoS are processed in different preset anti-replay windows, the above "duplication" will not cause a problem.

As before, if all packets are still numbered uniformly, the sequence numbers of adjacent packets in the same QoS may still be very different (because there are many other QoS packets), and a preset anti-replay window is still It is possible to continuously receive packets with greatly different sequence numbers, which may still cause problems.

Therefore, when the receiver uses multiple preset anti-replay windows to process packets with different QoS, the sender should first independently number the packets with different QoS.

Among them, it should be understood that the QoS methods corresponding to the above multi-window capability and multi-numbering capability should be the same, and the QoS corresponding to each preset anti-replay window should be independently numbered.

The QoS corresponding to each preset anti-replay window or independent number may specifically be a QoS determined by "one", or a "group" of QoS with similar properties, that is, actually a "QoS" group.

Therefore, in the QoS guarantee capability information, in addition to whether the multi-numbering capability and the multi-window capability are included, more detailed information about the QoS guarantee capability can also be included, for example, whether the packets (or corresponding presets) are assigned according to the QoS. Anti-replay windows, numbers) are divided into several different groups, and the specific QoS included in each group.

In the embodiment of the present disclosure, whether to enable the QoS guarantee capability is negotiated by sending the QoS guarantee capability information. When the QoS guarantee capability is enabled, at least some of the packets with different QoS are processed in different anti-replay windows (anti-replay filtering) , so that the number of packets processed by each anti-replay window is relatively small, and the priorities (such as QoS) of the packets are the same or relatively close. There are few cases where packets with small sequence numbers are sent first and then arrive later (that is, "out-of-order"), which can eliminate or greatly reduce the erroneous discarding of packets without increasing the anti-replay window. to improve the quality assurance capability of the system.

In some optional embodiments, referring to FIG. 5 , the network terminal has (or enables) multi-window capability; and the method for sending the information also includes:

Step S1021: Receive QoS guarantee capability information from another network end of the IPSec tunnel.

The received QoS guarantee capability information indicates that the other network end of the IPSec tunnel has (or enables) the multi-numbering capability.

After sending the QoS assurance capability information to the other network end of the IPSec tunnel and receiving the QoS assurance capability information from the other network end of the IPSec tunnel, the method further includes:

Step S1031: Receive a packet from another network end of the IPSec tunnel, and use a corresponding preset anti-replay window to process the packet according to the QoS of the packet.

Wherein, the number of preset anti-playback windows is multiple, and any different preset anti-playback windows correspond to different QoS.

When the local network end supports the multi-window capability, if it also receives the QoS guarantee capability information from the other network end of the IPSec tunnel, indicating that the other network end has (or enables) the multi-numbering capability, it means that both parties have completed the QoS guarantee capability. A "negotiation" of safeguarding capabilities.

Therefore, the local network terminal can enable the multi-window capability, that is, when it subsequently receives packets from another network terminal of the IPSec tunnel (of course, the packets with different QoS are independently numbered by the other network terminal), it can analyze the packets. According to the QoS in the text, the packets are put into the corresponding receive queues according to the QoS, and processed with the corresponding preset anti-replay windows.

Among them, QoS is carried by any one of the Differentiated Services Code Point (DSCP, Differentiated Services Code Point) value, the service type (TOS, Type Of Service) value, the communication classification (TC, Traffic Class) value, and the priority value carried in the message. kind of sure.

The QoS information may be carried in a packet header (eg, an IP header), or may be carried in an SPI.

It should be understood that there is no necessary sequence between the above steps of "sending QoS assurance capability information to another network end of the IPSec tunnel" and "receiving QoS assurance capability information from another network end of the IPSec tunnel".

For example, the local network terminal may first send the QoS guarantee capability information, and then the other network terminal "replies" the QoS guarantee capability information to the local network terminal according to the QoS guarantee capability information; The QoS guarantee capability information is sent to the local network, and the local network "replies" the QoS guarantee capability information; alternatively, both transmitters can send the QoS guarantee capability information to each other independently.

It should be understood that when another network end sends the QoS guarantee capability information, the other network end is equivalent to executing the method of the embodiment of the present disclosure.

In some optional embodiments, referring to FIG. 6 , the network terminal has (or enables) multi-numbering capability, and the method for sending the information further includes:

Step S1022: Receive QoS guarantee capability information from another network end of the IPSec tunnel.

The received QoS guarantee capability information indicates that the other network end of the IPSec tunnel has (or enables) the multi-window capability.

Step S1032: Send a packet to another network end of the IPSec tunnel, and determine the sequence number of the packet according to the QoS of the packet.

Wherein, at least some of the packets with different QoS are numbered independently.

Similarly, when the local network end supports the multi-numbering capability, if it also receives the QoS guarantee capability information from the other network end of the IPSec tunnel, indicating that the other network end has (or enables) the multi-window capability, it is equivalent to the completion of the Another kind of "negotiation" of QoS guarantee capability.

Therefore, when the local network terminal sends a packet to another network terminal subsequently, the packets with different QoS should be numbered independently, so that the other network terminal can process the packets using the multi-window capability.

Same as above, there is no necessary sequence between the above steps of "sending QoS assurance capability information to the other network end of the IPSec tunnel" and "receiving QoS assurance capability information from the other network end of the IPSec tunnel".

In some optional embodiments, sending the QoS guarantee capability information to another network end of the IPSec tunnel (step S101) includes:

Step S1011: Send QoS guarantee capability information to another network end of the IPSec tunnel through a negotiation request message or negotiation response message for establishing the IPSec tunnel.

In some optional embodiments, the negotiation request message is any one of an IKE_SA_INIT request message, a local IKE security proposal sending message, a key material sending message, and an identity information sending message.

The negotiation response message is any one of the IKE_SA_INIT response message, the IKE security proposal confirmation message, the key material sending message, and the identity information sending message.

As an optional implementation manner of the present disclosure, the above "negotiation" may be performed during the process of establishing an IPSec tunnel, that is, when negotiating to establish an IPSec tunnel, in addition to sending the information required according to the standard IPSec protocol, also The above QoS assurance capability information may be sent, so that the QoS assurance capability information is also a negotiation request message or a negotiation response message for establishing an IPSec tunnel (depending on whether the initiator or responder of the IPSec tunnel sends the QoS assurance capability information).

Specifically, the above negotiation request message can be any one of IKE_SA_INIT request message, local IKE security proposal sending message, key material sending message, and identity information sending message; and the negotiation response message is IKE_SA_INIT response message, IKE security proposal confirmation message , any one of the key material sending message and the identity information sending message

Of course, it should be understood that the QoS guarantee capability information received by the local network end may also all be negotiation request messages.

In the second aspect, referring to FIG. 7 , an embodiment of the present disclosure provides a method for receiving information, which is used at a network end of an IPSec tunnel, including:

Step S201: Receive QoS guarantee capability information from another network end of the IPSec tunnel.

The QoS guarantee capability information is used to indicate whether the other network end of the IPSec tunnel enables the multi-window capability, and/or whether the other network end enables the multi-numbering capability. The ability to independently number at least some of the packets with different QoS; the multi-window capability is the ability to use different preset anti-replay windows to process at least some of the packets with different QoS when receiving packets.

When one network end of an IPSec tunnel sends QoS assurance capability information, the other network end will inevitably receive the above QoS assurance capability information, so for a process of sending QoS assurance capability information, the two network ends of the IPSec tunnel are equivalent to The two methods of the embodiments of the present disclosure are carried out separately.

However, when both network ends send the QoS guarantee capability information to each other, it is equivalent that each network end performs the two methods of the embodiments of the present disclosure.

In some optional embodiments, the received QoS guarantee capability information indicates that another network end of the IPSec tunnel has (or enables) the multi-numbering capability, and the method for receiving the information further includes:

Step S2021: Send QoS guarantee capability information to another network end of the IPSec tunnel. The QoS guarantee capability information indicates that the network has (or enables) the multi-window capability.

After receiving the QoS assurance capability information from the other network end of the IPSec tunnel and sending the QoS assurance capability information to the other network end of the IPSec tunnel, the received information further includes:

Step S2031: Receive a packet from another network end of the IPSec tunnel, and use a corresponding preset anti-replay window to process the packet according to the QoS of the packet.

In some embodiments, the received QoS guarantee capability information indicates that another network end of the IPSec tunnel has (or enables) multi-window capability; and the method for receiving the information further includes:

Step S2022: Send QoS guarantee capability information to another network end of the IPSec tunnel. The QoS guarantee capability information indicates that the network has (or enables) the multi-numbering capability.

After receiving the QoS assurance capability information from the other network end of the IPSec tunnel and sending the QoS assurance capability information to the other network end of the IPSec tunnel, the method for receiving the information further includes:

Step S2032: Send a packet to another network end of the IPSec tunnel, and determine the sequence number of the packet according to the QoS of the packet. Wherein, at least some of the packets with different QoS are numbered independently.

As before, when the local network determines that the other network has (or enables) the multi-numbering capability or the multi-window capability according to the received QoS guarantee capability information, the local network can also send the QoS guarantee capability to the other network, informing the other network of the QoS guarantee capability. A network end itself has (or enables) the multi-window capability or the multi-numbering capability, and subsequently starts to use the multi-window capability to process the received message, or use the multi-numbering capability to process the sent message.

Same as above, at this time, the QoS guarantee capability information received and sent by the local network terminal may also be a negotiation request message or a negotiation response message.

Specific example 1:

For both parties (the initiator and the responder) of the IPSec tunnel, the QoS guarantee capability can be "negotiated" by the method of the embodiment of the present disclosure, which may specifically include the following steps:

A101. The initiator sends a negotiation request message to the responder, which carries QoS guarantee capability information.

That is, the initiator "notifies" the responder of its own QoS guarantee capability information through the negotiation request message.

The initiator may be a base station, a security gateway, a firewall, or any other network element or function with IPSec capability.

The responder may be a base station, a security gateway, a firewall, or any other network element or function with IPSec capability.

The negotiation request message may be an IKE_SA_INIT request message, a local IKE security proposal sending message, a key material sending message, or an identity information sending message.

The QoS guarantee capability information indicates the support situation of the initiator for the multi-window capability and the multi-numbering capability.

A102. After receiving the request message from the initiator, the responder replies with a negotiation response message carrying the QoS guarantee capability information.

That is, the responder "replies" its own QoS guarantee capability information to the initiator through the negotiation response message.

The negotiation response message may be an IKE_SA_INIT response message, an IKE security proposal confirmation message, a key material sending message, or an identity information sending message.

The QoS guarantee capability information indicates the support of the responder for the multi-window capability and the multi-numbering capability.

The content of the QoS guarantee capability information sent by the responder may only be determined according to the status of the responder itself, that is, it may not be related to the QoS guarantee capability information received by the responder.

Alternatively, the content of the QoS assurance capability information sent by the responder may also be determined according to the QoS assurance capability information it receives, for example, only "meaningful" QoS assurance capability information may be returned. For example, when the QoS guarantee capability information sent by the initiator indicates that the initiator "does not support (or does not have)" the multi-window capability, it is meaningless whether the responder supports the multi-numbering capability (because even if it supports it, it cannot be used) , so the QoS guarantee capability sent by the responder may not involve its own multi-numbering capability.

As before, only one of the above steps A101 and A102 may be performed; or, the order of steps A101 and A102 may be interchanged; or, steps A101 and A102 may be performed independently by both parties in the IPSec tunnel, and there is no necessary relationship between the two.

In a word, through the above example, both parties of the IPSec tunnel can know the QoS guarantee capability of the other party, and then decide how to activate the QoS guarantee capability.

Specific example 2:

A specific method of the embodiment of the present disclosure may include the following steps:

A201. The initiator and the responder complete IPSec tunnel negotiation, and the initiator learns that the responder has or decides to enable the QoS guarantee capability.

A202. The initiator independently marks the serial numbers (ie, independent numbers) of the packets (IPSec packets) sent by the initiator according to the SPI and the QoS.

The QoS can be a DSCP value, a TOS value, a Traffic Class value, or a priority value.

A203. The initiator sends a packet to the responder, carrying QoS.

Among them, the QoS can be carried through the SPI, that is, the QoS can be filled into the SPI.

Alternatively, the QoS can also be carried through the QoS field of the packet, that is, the IP header of the packet already has the QoS field.

A204. The responder receives the packet, extracts the QoS, and places IPSec packets with different QoS in different receiving queues, and uses different anti-replay windows for processing.

Specific example 3:

This embodiment is similar to the specific example 2, and the difference between it and the specific example 2 is:

The initiator has or decides to enable the QoS guarantee capability, so that the responder independently numbers the packets of different QoS according to the QoS guarantee capability information of the initiator.

Specific example 4:

The difference between this specific example and the specific example 1 is that according to the difference in the QoS guarantee capabilities of the initiator and the responder, the following situations can also be included after the specific example 1:

(1) The initiator enables the multi-window capability and the multi-numbering capability; the responder enables the multi-window capability and the multi-numbering capability.

Therefore, the subsequent packets sent by the initiator to the responder need to be numbered separately, and the packets sent by the responder to the initiator also need to be numbered separately.

At the same time, the initiator needs to use the multi-window mode to process the received message, and the responder also needs to use the multi-window mode to process the received message.

(2) The initiator enables the multi-window capability, but does not enable (eg does not have, or does not want to use) the multi-numbering capability, and the responder enables the multi-numbering capability (the responder's multi-window capability is meaningless at this time).

Therefore, the packets sent by the responder to the initiator need to be numbered separately, and the initiator needs to process the received packets in a multi-window manner.

The process of sending packets from the initiator to the response can be performed by using the existing IPSec rules.

(3) The initiator enables the multi-numbering capability, but does not enable (eg does not have, or does not want to use) the multi-window capability, and the responder enables the multi-window capability (the multi-numbering capability of the responder is meaningless at this time).

Therefore, the packets sent by the initiator to the responder need to be numbered separately, and the responder needs to process the received packets in a multi-window manner.

The process of sending packets from the response direction can be performed by using the existing IPSec rules.

(4) The initiator does not enable (eg does not have, or does not want to use) the multi-numbering capability, nor does it enable (eg does not have, or does not wish to use) the multi-numbering capability (at this time, the responder's multi-window and multi-numbering capabilities are not available). significance).

Therefore, all packets are sent and received using the existing IPSec rules.

Specific example 5:

In this specific example, in the IPSec tunnel negotiation stage, the QoS guarantee capability information is not transmitted.

Instead, in the packet sending stage after the IPSec tunnel is established, the initiator and the responder can carry QoS guarantee capability information in the packets (IPSec packets), and determine whether to enable the QoS guarantee capability subsequently according to the QoS guarantee capability information.

The QoS guarantee capability information may be carried through the SPI.

Specific example 6:

In this specific example, the transmission of the QoS guarantee capability information is not performed. Instead, in the message sending stage, the receiver of the message uses different preset anti-replay windows to process messages with different QoS according to the QoS in the SPI.

Specific example 7:

In this specific example, the QoS corresponding to each anti-replay window or number may not be "one QoS", but multiple similar QoSs, that is, a QoS group.

Specific example 8:

In this specific example, the IPSec tunnel can be established by manually configuring the IPSec tunnel or through IKE negotiation, but its QoS guarantee capability information is locally configured and does not need to be "negotiated".

In a third aspect, referring to FIG. 8 , an embodiment of the present disclosure provides a network end of an IPSec tunnel, which includes: a sending module configured to send QoS guarantee capability information to another network end of the IPSec tunnel. The QoS guarantee capability information is used to indicate whether the network end enables the multi-window capability, and/or whether the network end enables the multi-numbering capability. The multi-numbering capability is the capability of independently numbering at least some of the packets with different QoS when sending packets; the multi-window capability is the ability to use different preset anti-replay windows to process at least some of the packets with different QoS when receiving packets. ability to write.

Specifically, the network end in the embodiment of the present disclosure may be any network element that can establish a connection through an IPSec tunnel, such as a wireless communication base station (such as 2G, 3G, 4G, 5G and other base stations), a set-top box, a security gateway, a firewall device, a device loaded with Other software network equipment, etc.

It should be understood that the network end of the IPSec tunnel in the embodiment of the present disclosure is actually any one of the IPSec tunnels, so it can also receive QoS assurance capability information from another network end of the IPSec tunnel, so it may actually have a receiving module.

In a fourth aspect, referring to FIG. 9 , an embodiment of the present disclosure provides a network end of an IPSec tunnel, which includes: a receiving module configured to receive QoS guarantee capability information from another network end of the IPSec tunnel. The QoS guarantee capability information is used to indicate whether the other network end of the IPSec tunnel enables the multi-window capability, and/or whether the other network end enables the multi-numbering capability. The multi-numbering capability is the capability to independently number at least some of the packets with different QoS when sending packets; the multi-window capability is the ability to use different preset anti-replay windows to process at least some of the packets with different QoS when receiving the packets. ability to write.

It should be understood that the network end of the IPSec tunnel in the embodiment of the present disclosure is actually any party in the IPSec tunnel, so it can also send the QoS guarantee capability information to another network end of the IPSec tunnel, so it may actually have a sending module.

Those of ordinary skill in the art can understand that all or some of the steps, systems, and functional modules/units in the apparatus disclosed above can be implemented as software, firmware, hardware, and appropriate combinations thereof.

In a hardware implementation, the division between functional modules/units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component may have multiple functions, or one function or step may be composed of several physical components Components execute cooperatively.

Some or all of the physical components may be implemented as software executed by a processor, such as a central processing unit (CPU), digital signal processor or microprocessor, or as hardware, or as an integrated circuit such as Application-specific integrated circuits. Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media). As known to those of ordinary skill in the art, the term computer storage media includes both volatile and nonvolatile implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules or other data flexible, removable and non-removable media. Computer storage media include, but are not limited to, random access memory (RAM, more specifically SDRAM, DDR, etc.), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory (FLASH), or other disk storage ; compact disk-read only (CD-ROM), digital versatile disk (DVD), or other optical disk storage; magnetic cartridge, tape, magnetic disk storage, or other magnetic storage; any other storage that can be used to store desired information and that can be accessed by a computer medium. In addition, communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well known to those of ordinary skill in the art .

This disclosure has disclosed example embodiments, and although specific terms are employed, they are used and should only be construed in a general descriptive sense and not for purposes of limitation. In some instances, it will be apparent to those skilled in the art that features, characteristics and/or elements described in connection with a particular embodiment may be used alone or in combination with other embodiments, unless expressly stated otherwise. Features and/or elements are used in combination. Accordingly, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the scope of the present disclosure as set forth in the appended claims.

Claims

A method for sending information, which is used for a network end of an Internet security protocol tunnel, the method comprising:

sending service quality assurance capability information to the other network end of the Internet security protocol tunnel,

Wherein, the service quality assurance capability information is used to indicate whether the network end enables the multi-window capability, and/or whether the network end enables the multi-numbering capability, wherein the multi-numbering capability is when sending a message, The ability to independently number at least some packets with different quality of service; the multi-window capability is the ability to use different preset anti-replay windows to process at least part of the packets with different quality of service when receiving packets.
The method of claim 1, wherein the network has the multi-window capability;

The method further includes: receiving service quality assurance capability information from the other network end of the Internet security protocol tunnel; wherein the received service quality assurance capability information indicates the other network end of the Internet security protocol tunnel. the network has the multi-numbering capability; and

After the sending the service quality assurance capability information to the other network end of the Internet security protocol tunnel and the receiving the service quality assurance capability information from the other network end of the Internet security protocol tunnel, the method further The method includes: receiving a message from the other network end of the Internet security protocol tunnel, and processing the message using a corresponding preset anti-replay window according to the service quality of the message, wherein the preset anti-replay window is used to process the message. The number of playback windows is multiple, and any different preset anti-playback windows correspond to different quality of service.
The method of claim 1, wherein the network has the multi-numbering capability;

The method further includes: receiving service quality assurance capability information from the other network end of the Internet security protocol tunnel; wherein the received service quality assurance capability information indicates the other network end of the Internet security protocol tunnel. The network end has the multi-window capability;

After the sending the QoS assurance capability information to the other network end of the Internet security protocol tunnel and the receiving the QoS assurance capability information from the other network end of the Internet security protocol tunnel, the The method further includes: sending a message to the other network end of the Internet security protocol tunnel, and determining the sequence number of the message according to the quality of service of the message, wherein at least some of the messages with different quality of service individually numbered.
The method according to claim 1, wherein the sending the service quality assurance capability information to the other network end of the Internet security protocol tunnel comprises:

By establishing a negotiation request message or negotiation response message of the Internet security protocol tunnel, the service quality assurance capability information is sent to the other network end of the Internet security protocol tunnel.
The method of claim 4, wherein,

The negotiation request message is any one of an IKE_SA_INIT request message, a local IKE security proposal sending message, a key material sending message, and an identity information sending message;

The negotiation response message is any one of the IKE_SA_INIT response message, the IKE security proposal confirmation message, the key material sending message, and the identity information sending message.
A method for receiving information, which is used for a network end of an Internet security protocol tunnel, the method comprising:

receiving service quality assurance capability information from another network end of the Internet security protocol tunnel;

Wherein, the service quality assurance capability information is used to indicate whether the other network end of the Internet security protocol tunnel enables the multi-window capability, and/or whether the other network end enables the multi-numbering capability, wherein the The multi-numbering capability is the capability of independently numbering at least some messages with different quality of service when sending messages; the multi-window capability is that when receiving messages, different preset anti-replay windows are used to process at least some of the messages. The ability of packets of different quality of service.
The method according to claim 6, wherein the received QoS assurance capability information indicates that the other network end of the Internet Security Protocol tunnel has the multi-numbering capability;

The method further includes: sending service quality assurance capability information to the other network end of the Internet security protocol tunnel; wherein, the service quality assurance capability information indicates that the network end has the multi-window capability;

After the receiving the service quality assurance capability information from the other network end of the Internet security protocol tunnel and the sending the service quality assurance capability information to the other network end of the Internet security protocol tunnel, the The method further includes: receiving a message from the other network end of the Internet security protocol tunnel, and processing the message using a corresponding preset anti-replay window according to the quality of service of the message, wherein the preset anti-replay window is used to process the message. It is assumed that the number of anti-playback windows is multiple, and any different preset anti-playback windows correspond to different quality of service.
The method according to claim 6, wherein the received QoS assurance capability information indicates that the other network end of the Internet Security Protocol tunnel has the multi-window capability;

The method further includes: sending service quality assurance capability information to the other network end of the Internet security protocol tunnel; wherein, the service quality assurance capability information indicates that the network end has the multi-number capability;

After the receiving the service quality assurance capability information from the other network end of the Internet security protocol tunnel and the sending the service quality assurance capability information to the other network end of the Internet security protocol tunnel, the The method further includes: sending a message to the other network end of the Internet security protocol tunnel, and determining the sequence number of the message according to the quality of service of the message, wherein at least some of the messages with different quality of service individually numbered.
A network end of an Internet security protocol tunnel, comprising:

a sending module, sending service quality assurance capability information to another network end of the Internet security protocol tunnel;

Wherein, the service quality assurance capability information is used to indicate whether the network end enables the multi-window capability, and/or whether the network end enables the multi-numbering capability, wherein the multi-numbering capability is when sending a message, The ability to independently number at least some packets with different quality of service; the multi-window capability is the ability to use different preset anti-replay windows to process at least part of the packets with different quality of service when receiving packets.
A network end of an Internet security protocol tunnel, comprising:

a receiving module, which is configured to receive service quality assurance capability information from another network end of the Internet security protocol tunnel;

Wherein, the service quality assurance capability information is used to indicate whether the other network end of the Internet security protocol tunnel enables the multi-window capability, and/or whether the other network end enables the multi-numbering capability, wherein the multi-numbering capability When sending packets, the ability to independently number at least some of the packets with different quality of service; the multi-window capability is to use different preset anti-replay windows to process at least part of the packets with different quality of service when receiving packets. message capability.