WO2022166979A1 - 报文处理方法、客户端设备、服务器端设备和计算机可读介质 - Google Patents

报文处理方法、客户端设备、服务器端设备和计算机可读介质 Download PDF

Info

Publication number
WO2022166979A1
WO2022166979A1 PCT/CN2022/075472 CN2022075472W WO2022166979A1 WO 2022166979 A1 WO2022166979 A1 WO 2022166979A1 CN 2022075472 W CN2022075472 W CN 2022075472W WO 2022166979 A1 WO2022166979 A1 WO 2022166979A1
Authority
WO
WIPO (PCT)
Prior art keywords
server
client
encrypted
service
address
Prior art date
Application number
PCT/CN2022/075472
Other languages
English (en)
French (fr)
Inventor
周娜
闫新成
彭少富
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to US18/276,280 priority Critical patent/US20240114013A1/en
Priority to EP22749258.4A priority patent/EP4287550A1/en
Publication of WO2022166979A1 publication Critical patent/WO2022166979A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0435—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply symmetric encryption, i.e. same key used for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/34—Source routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/56—Routing software
    • H04L45/566—Routing instructions carried by the data packet, e.g. active networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L45/00—Routing or path finding of packets in data switching networks
    • H04L45/74—Address processing for routing
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0407—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the identity of one or more communicating identities is hidden
    • H04L63/0421—Anonymous communication, i.e. the party's identifiers are hidden from the other party or parties, e.g. using an anonymizer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0442—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0471—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying encryption by an intermediary, e.g. receiving clear information at the intermediary and encrypting the received information at the intermediary before forwarding
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer

Definitions

  • the present disclosure relates to the field of communication technologies, and in particular, to a message processing method, a client device, a server device, and a computer-readable medium.
  • the Segment Routing IPv6 (SRv6) architecture based on Internet Protocol Version 6 is designed based on the concept of source routing.
  • a new extension is made in the extension header to realize the forwarding of IPv6 data packets.
  • the new extension is called the Segment Routing Header (SRH).
  • the segment routing packet header contains the IPv6 address stack, which relies on the intermediate nodes to sequentially update the destination address, thereby completing the hop-by-hop forwarding of the packet in the network.
  • the intermediate nodes in the link can obtain the NE information of the source end and the destination end by parsing the packet. Therefore, there is a third party that intercepts the packet through illegal means and obtains the host by parsing the packet. The possibility of related information and server-related information, the security of message transmission cannot be guaranteed.
  • an embodiment of the present disclosure provides a packet processing method, which is applied to a client device, where the client device includes a client, and the method includes:
  • an embodiment of the present disclosure further provides a packet processing method, which is applied to a server-side device, where the server-side device includes a server-side, and the method includes:
  • the server-side private key In response to the first service message sent by the client, use the server-side private key to decrypt the source address and destination address of the first service message, and replace the destination address of the first service message with the server-side address.
  • the source address of the first service packet is the encrypted client segment identifier encrypted by the client device using the server public key
  • the destination address of the first service packet is the client device using the server public key Encrypted encrypted server-side segment identifier
  • the source address of the second service message is replaced with the encrypted server segment identifier corresponding to the server, and the second service The destination address of the message is the encrypted client segment identifier corresponding to the client;
  • the source address and the destination address of the second service packet are encrypted by using the client public key, and the encrypted second service packet is sent to the client.
  • an embodiment of the present disclosure further provides a client device, including:
  • memory configured to store one or more computer programs
  • the one or more processors are caused to implement the packet processing method described in the first aspect above.
  • an embodiment of the present disclosure further provides a server-side device, including:
  • memory configured to store one or more computer programs
  • the one or more processors When the one or more computer programs are executed by the one or more processors, the one or more processors are caused to implement the message processing method described in the second aspect above.
  • an embodiment of the present disclosure further provides a computer-readable medium on which a computer program is stored, and when the computer program is executed by a processor, implements the packet processing method described in the first aspect.
  • an embodiment of the present disclosure further provides a computer-readable medium on which a computer program is stored, and when the computer program is executed by a processor, implements the packet processing method described in the second aspect above.
  • FIG. 1 is a schematic structural diagram of a network architecture according to an embodiment of the present disclosure
  • FIG. 2 is a flowchart of a packet processing method according to an embodiment of the present disclosure
  • FIG. 3 is a flowchart of a packet processing method according to an embodiment of the present disclosure.
  • FIG. 4 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • FIG. 5 is a flowchart of a specific implementation method of step S2 in an embodiment of the disclosure.
  • FIG. 6 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • FIG. 7 is a flowchart of a packet processing method according to an embodiment of the present disclosure.
  • FIG. 8 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • FIG. 9 is a flowchart of a specific implementation method of step S9 in an embodiment of the disclosure.
  • FIG. 10 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • FIG. 11 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • FIG. 13 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • FIG. 14 is a schematic structural diagram of a client device according to an embodiment of the present disclosure.
  • FIG. 15 is a schematic structural diagram of a server-side device according to an embodiment of the present disclosure.
  • FIG. 16 is a schematic structural diagram of a computer-readable medium provided by an embodiment of the present disclosure.
  • first, second, etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. Thus, for example, a first service message discussed below may be referred to as a second service message without departing from the teachings of the present disclosure.
  • the destination address is a service packet with a specific type of segment identifier corresponding to the receiving end.
  • the service packet is sent.
  • the receiving end receives the service packet, decrypts the destination address of the service packet, and replaces the destination address of the service packet with the receiving end.
  • the corresponding address realizes the protection of the network element information of both the sender and the receiver of the service message, and effectively solves the security problem of the service message transmission in the network.
  • FIG. 1 is a schematic structural diagram of a network architecture provided by an embodiment of the present disclosure. As shown in FIG. 1 , the network architecture includes a client device, an intermediate node, a server device and a service management controller.
  • the network architecture is a segment routing architecture based on the sixth edition of the Internet Protocol.
  • the client device and the server device transmit service packets through an intermediate node, and the intermediate node is a segment routing node.
  • the client device includes a client and a client gateway.
  • the client is a device that accesses the network through the client gateway and needs to communicate with the server, including personal computers, tablets, and mobile terminals.
  • the server device includes the server and a server-side gateway, the server-side can access the network through the server-side gateway; the service management controller is a control layer, and is configured to manage and control the business communication between the server-side and the client-side; in some embodiments, the segment routing node may include Carrier backbone router (Provider), carrier edge router (Provider Edge, PE), Autonomous System Boundary Router (ASBR) and Area Border Router (ABR), etc.
  • the segment routing node may include Carrier backbone router (Provider), carrier edge router (Provider Edge, PE), Autonomous System Boundary Router (ASBR) and Area Border Router (ABR), etc.
  • FIG. 2 is a flowchart of a packet processing method provided by an embodiment of the present disclosure. As shown in FIG. 2 , the packet processing method is applied to a client device, and the method includes steps S1 to S3.
  • Step S1 In response to the first service packet sent from the client to the server, replace the source address of the first service packet with the encrypted client segment identifier corresponding to the client.
  • the client device includes a client, and the packet processing method flow is executed by the client; or, in some embodiments, the client device further includes a client gateway corresponding to the client, At this time, the flow of the packet processing method can be executed by the client gateway.
  • the destination address of the first service message is an encrypted server-side segment identifier corresponding to the server-side.
  • a corresponding segment identifier (Segment ID, SID for short) is configured for a network address, and the segment identifier has an explicit indication function and is a network instruction.
  • the intermediate node when the corresponding service packet passes through the intermediate node, the intermediate node reads the segment identifier carried in the segment routing header of the service packet and a corresponding series of instruction operations (also called segment operations) , according to the segment identification and the indication operation, complete the corresponding forwarding action to forward the service message, and the indication operation is used for instructing the routing and transmission of the data (for example, the service message) in the network.
  • segment operations also called segment operations
  • the encrypted client segment identifier and the encrypted server segment identifier are respectively a specific type of segment identifiers preconfigured by the client and the server, which are different from other existing segment identifiers.
  • This particular type of segment identifier is not used to indicate an existing forwarding action, but is used to indicate an encrypted forwarding action, that is, the encrypted client-side segment identifier and the encrypted server-side segment identifier are not used to indicate data (such as traffic packets).
  • the encrypted client segment identifier and the encrypted server segment identifier do not represent the segment identifier. It is encrypted by itself, but is used to refer to the encrypted forwarding action described above.
  • a specific type of segment identification may be marked using the type field "END.S.DECI".
  • a mapping relationship between a specific type of segment identifier and an address of a corresponding device may be established through configuration or based on a routing protocol in a service authorization process.
  • Step S2 Encrypt the source address and destination address of the first service message by using the server's public key according to the segment identifier of the encrypted server, and send the encrypted first service message to the server.
  • the encrypted first service message means the first service message whose source address and destination address have been encrypted.
  • the parameter portions of the source and destination addresses are encrypted.
  • the server-side public key belongs to the server-side public-private key pair, which can be pre-configured by the server-side or pre-configured by the service management controller and delivered to the server-side, and the client device can obtain the server-side public key in advance.
  • Step S3 in response to the second service message sent by the server, decrypt the destination address of the second service message by using the client's private key, and replace the destination address of the second service message with the address of the client.
  • the destination address of the second service packet is the encrypted client segment identifier encrypted by the server using the client's public key; the client's private key belongs to the client's public-private key pair, and the public-private key pair can be pre-configured by the client Or pre-configured by the service management controller and delivered to the client, the server-side device can obtain the client's public key in advance.
  • the packet processing method further includes: decrypting the source address of the second service packet by using the client's private key.
  • the source address of the second service packet is the encrypted server-side segment identifier encrypted by the server-side using the client-side public key.
  • the client gateway can decrypt the destination address of the second service packet, replace the destination address of the second service packet with the address of the client, and then send the second service packet to the client.
  • the client device sends its source address to the service packet.
  • the segment identifier of the specific type corresponding to the client and encrypt the source address and destination address of the service packet according to the segment identifier of the specific type, and then send the encrypted service packet to the server;
  • the destination address of the service packet is decrypted, and the destination address of the service packet is replaced with the address corresponding to the client, so that the network element information of the sender and receiver of the service packet can be retrieved. It effectively solves the security problem of service packet transmission in the network.
  • FIG. 3 is a flowchart of a packet processing method according to an embodiment of the present disclosure.
  • the packet processing method is an implementation based on the packet processing method shown in FIG. 2 .
  • the message processing method not only includes the above steps S1 to S3, but also includes steps S01 and S02 before step S1. Only step S01 and step S02 will be described in detail below.
  • Step S01 in response to the service authorization request sent from the client to the server, configure an encrypted client segment identifier, and establish a mapping relationship between the encrypted client segment identifier and the address of the client.
  • the client sends a service authorization request to the server to pre-establish a service communication relationship.
  • the client can also send a service authorization request to the service management controller for service authorization.
  • the segment identifier includes a locator field (Locator), a function field (Function), an optional parameter field (Argument), etc.; the location field is mainly responsible for the routing function and is unique in the segment routing domain; the function field is responsible for the function of identifying the device, For example, forwarding function and service function, etc.; and for the specific type of segment identification provided by the present disclosure, in some embodiments, by using at least part of the optional parameter fields as reference fields, the reference field and the client can be established.
  • the mapping relationship of the addresses is used to establish the mapping relationship between the segment identifier of the encrypted client and the address of the client.
  • the packet processing method further includes: performing route publishing for the encrypted client segment identifier through an Interior Gateway Protocol (Interior Gateway Protocol, IGP for short).
  • IGP Interior Gateway Protocol
  • Step S02 sending a service authorization request to the server, and receiving a service authorization response fed back by the server.
  • the service authorization response includes an encrypted server-side segment identifier, whereby the client device obtains an encrypted server-side segment identifier corresponding to the address of the server-side, and the encrypted server-side segment identifier can actually be used as the encrypted server-side segment identifier on the client device side. server-side address.
  • FIG. 4 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • the packet processing method is an implementation based on the packet processing method shown in FIG. 2 .
  • the message processing method not only includes the above steps S1 to S3, but also includes steps S4 to S6. Only steps S4 to S6 will be described in detail below.
  • Step S4 establishing a mapping relationship between the encrypted client segment identifier encrypted with the server-side public key and the address of the client, and establishing the encrypted server-side segment identifier encrypted with the server-side public key and the encrypted server-side segment identifier. Mapping relations.
  • the step of encrypting the specific type of segment identification using the server-side public key includes encrypting a reference field of the specific type of segment identification using the server-side public key. Therefore, in some embodiments, similar to step S01, in step S4, a mapping relationship between the reference field of the segment identifier encrypted with the server-side public key and the address of the client is established, so as to establish the encryption using the server-side public key The mapping relationship between the segment identifier and the client's address after the specific type.
  • Step S5 in response to the third service message sent from the client to the server, replace the source address of the third service message with the encrypted client segment identifier encrypted with the public key of the server, and replace the third service message with the encrypted client segment identifier. Replace the destination address with the encrypted server-side segment ID encrypted with the server-side public key.
  • the destination address of the third service message is the segment identifier of the encrypted server; in step S5, the client device side can establish a mapping relationship between the encrypted segment identifier of a specific type and the corresponding address in advance.
  • the source address and destination address of the service packet are directly replaced, thereby reducing the response delay.
  • Step S6 sending a third service message to the server.
  • FIG. 5 is a flowchart of a specific implementation of step S2 in the embodiment of the disclosure.
  • the client device further includes a client gateway; as shown in FIG. 5 , step S2 includes step S201.
  • Step S201 according to the client gateway address, the intermediate node address in the link, and the server-side gateway address corresponding to the server-side, generate a tunnel header and a segment routing extension header in the outer layer of the first service packet, and send them to the server-side gateway.
  • the first service message after the above processing.
  • step S201 since the first service packet is to be sent to the server through the client gateway and the segment routing node in the communication link, the address of the client gateway, the address of the segment routing node and the server gateway address, and perform outer encapsulation on the first service message, so as to add a tunnel header and a segment routing extension header to the first service message. Therefore, in the packet processing method of the foregoing embodiment, when the service packet passes through the segment routing node, the destination address of the service packet is replaced based on the segment routing protocol mechanism. After the packet is encapsulated in the outer layer of the tunnel, when the service packet passes through the segment routing node, the outer destination address of the service packet is replaced based on the segment routing protocol mechanism.
  • the packet processing method provided by the embodiments of the present disclosure can protect the transmission of service packets by using the tunneling technology and setting a specific type of segment identifier.
  • FIG. 6 is a flowchart of a packet processing method according to an embodiment of the present disclosure. As shown in FIG. 6 , the message processing method is applied to a server-side device, the server-side device includes a server-side, and the message processing method includes steps S7 to S9 .
  • Step S7 in response to the first service message sent by the client, decrypt the destination address of the first service message by using the private key of the server, and replace the destination address of the first service message with the address of the server.
  • the source address of the first service packet is the encrypted client segment identifier encrypted by the client device using the server-side public key
  • the destination address of the first service packet is the encrypted client-side segment identifier encrypted by the client device using the server-side public key.
  • the server-side device includes a server-side, and the packet processing method flow is executed by the server-side; or, in some embodiments, the server-side device further includes a server-side gateway corresponding to the server-side, At this time, the flow of the packet processing method may be executed by the server-side gateway.
  • the packet processing method further includes: decrypting the source address of the first service packet by using the server-side private key.
  • the source address of the first service packet is the encrypted client segment identifier encrypted by the client device using the server-side public key.
  • the flow of the packet processing method can be executed by the server-side gateway, so that the server-side gateway can decrypt the destination address of the first service packet, and replace the destination address of the first service packet with the server-side address. After the address, the first service message is sent to the server.
  • Step S8 In response to the second service message sent from the server to the client, replace the source address of the second service message with the segment identifier of the encrypted server.
  • the destination address of the second service packet is the encrypted client segment identifier corresponding to the client.
  • Step S9 using the client public key to encrypt the source address and destination address of the second service message according to the encrypted client segment identification, and send the encrypted second service message to the client.
  • the client public key to encrypt the source address and destination address of the second service packet, and send the encrypted second service packet to the client
  • the encrypted second service message is the second service message whose source address and destination address have been encrypted
  • the client's public key belongs to the client's public-private key pair, which can be pre-configured by the client or set by
  • the service management controller is pre-configured and delivered to the client, and the server-side device can obtain the client's public key in advance.
  • the parameter portions of the source and destination addresses are encrypted.
  • the server-side device sends its source address to the service packet. Replace it with a specific type of segment identifier corresponding to the server side, and encrypt the source address and destination address of the service packet according to the specific type of segment identifier, and then send the encrypted service packet to the client;
  • the service packet returned by the terminal decrypts the destination address of the service packet, and replaces the destination address of the service packet with the address corresponding to the server, so as to protect the network element information of the sender and receiver of the service packet. , which effectively solves the security problem of service packet transmission in the network.
  • FIG. 7 is a flowchart of a packet processing method according to an embodiment of the present disclosure.
  • the packet processing method is an implementation based on the packet processing method shown in FIG. 6 .
  • the message processing method not only includes steps S7 to S9, but also includes steps S7a and S7b before step S7. Only step S7a and step S7b will be described in detail below.
  • Step S7a in response to the service registration request sent from the server to the service management controller, configure the encrypted server-side segment identifier, and establish a mapping relationship between the encrypted server-side segment identifier and the server-side address.
  • the service registration request may include a server identifier, such as a service ID, a server ID, and the like.
  • At least part of the optional parameter fields of the encrypted server-side segment identifier can be used as reference fields to establish a mapping relationship between the reference field and the server-side address, so as to establish the encrypted server-side segment identifier and the server-side segment identifier.
  • the mapping relationship of server-side addresses can be used as reference fields to establish a mapping relationship between the reference field and the server-side address, so as to establish the encrypted server-side segment identifier and the server-side segment identifier.
  • Step S7b sending a service registration request to the service management controller, and receiving a service registration response fed back by the service management controller.
  • step S7b receiving a service registration response fed back by the service management controller indicates that the service registration on the server side is successful.
  • FIG. 8 is a flowchart of a packet processing method according to an embodiment of the present disclosure.
  • the packet processing method is an implementation based on the packet processing method shown in FIG. 6 .
  • the message processing method not only includes steps S7 to S9, but also includes steps S10 to S12. Only steps S10 to S12 will be described in detail below.
  • Step S10 establishing a mapping relationship between the encrypted client segment identifier encrypted with the client’s public key and the encrypted client segment identifier, and establishing a relationship between the encrypted server segment identifier encrypted with the client’s public key and the address of the server. Mapping relations.
  • the step of encrypting the particular type of segment identification using the client public key includes encrypting a reference field of the particular type of segment identification using the client public key. Therefore, in some embodiments, similar to step S7a, in step S10, a mapping relationship between the reference field of the segment identifier encrypted with the client's public key and the address of the server is established, so as to establish the encryption with the client's public key. The mapping relationship between the segment identifier of the specific type and the address on the server side.
  • Step S11 in response to the fourth service message sent from the server to the client, replace the source address of the fourth service message with the encrypted server segment identifier encrypted with the client's public key, and replace the fourth service message with the encrypted server segment identifier. Replace the destination address with the encrypted client segment ID encrypted with the client's public key.
  • the destination address of the fourth service message is the segment identifier of the encrypted client; in step S11, the server can establish a mapping relationship between the segment identifier of the specific type after encryption and the corresponding address in advance, and then perform the service report.
  • the source address and destination address of the service packet are directly replaced, thereby reducing the response delay.
  • Step S12 Send a fourth service message to the client.
  • FIG. 9 is a flowchart of a specific implementation manner of step S9 in an embodiment of the disclosure.
  • the server-side device further includes a server-side gateway; step S9 includes step S901.
  • Step S901 according to the server gateway address, the intermediate node address in the link, and the client gateway address corresponding to the client, generate a tunnel header and a segment routing extension header in the outer layer of the second service packet, and send them to the client gateway.
  • the second service message after the above processing.
  • step S901 since the second service packet is to be sent to the client via the server-side gateway and the segment routing node in the communication link, the corresponding client-side gateway address and segment routing node address are The client gateway address of the second service packet is encapsulated in the outer layer to add a tunnel header and a segment routing extension header to the second service packet. Therefore, in the packet processing method of the foregoing embodiment, when the service packet passes through the segment routing node, the destination address of the service packet is replaced based on the segment routing protocol mechanism. After the packet is encapsulated in the outer layer of the tunnel, when the service packet passes through the segment routing node, the outer destination address of the service packet is replaced based on the segment routing protocol mechanism.
  • FIG. 10 is a flowchart of a packet processing method provided by an embodiment of the present disclosure. As shown in FIG. 10 , the packet processing method is applied to the interaction between a client device and a server device via an intermediate node.
  • the client device includes a client
  • the server device includes a server
  • the intermediate node may be one or more intermediate nodes. (only one is shown in FIG. 10 )
  • the message processing method includes steps BZ01 to BZ07 .
  • Step BZ01 The server prepares to send a service registration request to the service management controller, configures the encrypted server segment identifier, and establishes a mapping relationship between the encrypted server segment identifier and the address of the server.
  • Step BZ02 The server sends a service registration request to the service management controller, where the service registration request includes the server identifier.
  • Step BZ03 the service management controller saves the server identifier, and completes the service registration on the server side.
  • Step BZ04 the service management controller sends a service registration response to the server.
  • Step BZ05 the client prepares to send a service authorization request to the server, configures an encrypted client segment identifier, and establishes a mapping relationship between the encrypted client segment identifier and the address of the client.
  • Step BZ06 the client sends a service authorization request to the server via the intermediate node.
  • Step BZ07 The server performs service authorization, and sends a service authorization response to the client via the intermediate node, where the service authorization response includes the encrypted server-side segment identifier.
  • FIG. 11 is a flowchart of a packet processing method provided by an embodiment of the present disclosure. As shown in FIG. 11 , the packet processing method is applied to the interaction process between a client device and a server device via an intermediate node.
  • the client device includes a client
  • the server device includes a server
  • the intermediate node may be one or more intermediate nodes. (only one is shown in FIG. 11 )
  • the message processing method includes steps BZ101 to BZ4 .
  • Step BZ101 The client replaces the source address of the first service packet to be sent to the server with the encrypted client segment identifier, and the destination address of the first service packet is the encrypted server segment identifier corresponding to the server.
  • Step BZ102 the client uses the server-side public key to encrypt the source address and destination address of the first service message based on the encrypted forwarding action indicated by the encrypted server-side segment identifier, and thereafter, sends the first service message to the server via the intermediate node .
  • Step BZ2 The server decrypts the source address and destination address of the first service packet by using the server's private key, and replaces the destination address of the first service packet with the address of the server.
  • Step BZ301 The server replaces the source address of the second service message to be sent to the client with the encrypted server segment identifier, and the destination address of the second service message is the encrypted client segment identifier.
  • Step BZ302 the server uses the client public key to encrypt the source address and destination address of the second service message based on the encrypted forwarding action indicated by the encrypted client segment identifier, and thereafter, sends the second service to the client via the intermediate node message.
  • Step BZ4 The client uses the client private key to decrypt the source address and destination address of the second service packet, and replaces the destination address of the second service packet with the address of the client.
  • FIG. 12 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • the packet processing method is applied in the interaction process between a client device and a server device via an intermediate node.
  • the client device includes a client and a client gateway
  • the server device includes a server and a server gateway.
  • the packet processing method includes steps BZ081 to BZ0132 .
  • Step BZ081 The server sends a service registration request to the server-side gateway, and the service registration request is ready to be sent to the service management controller.
  • Step BZ082 The server-side gateway configures the encrypted server-side segment identifier, and establishes a mapping relationship between the encrypted server-side segment identifier and the server-side address.
  • Step BZ083 The server-side gateway sends a service registration request to the service management controller, where the service registration request includes the server identifier.
  • Step BZ09 the service management controller saves the server identifier, and completes the service registration on the server side.
  • Step BZ0101 The service management controller sends a service registration response to the server-side gateway.
  • Step BZ0102 The server-side gateway sends a service registration response to the server-side.
  • Step BZ0111 the client sends a service authorization request to the client gateway, and the service authorization request is ready to be sent to the server.
  • Step BZ0112 The client gateway configures the encrypted client segment identifier, and establishes a mapping relationship between the encrypted client segment identifier and the address of the client.
  • Step BZ0113 The client gateway sends a service authorization request to the server via the intermediate node and the server gateway.
  • Step BZ012 The server performs service authorization, and sends a service authorization response to the client gateway via the server-side gateway and the intermediate node, where the service authorization response includes the encrypted server-side segment identifier.
  • Step BZ0131 The client gateway stores the encrypted server-side segment identifier.
  • Step BZ0132 The client gateway sends a service authorization response to the client.
  • FIG. 13 is a flowchart of a packet processing method provided by an embodiment of the present disclosure.
  • the message processing method is applied in the interaction process between the client device and the server device via the intermediate node, the client device includes a client and a client gateway, and the server device includes a server and a server gateway , there may be one or more intermediate nodes, and the packet processing method includes steps BZ501 to BZ802.
  • Step BZ501 The client sends a first service packet to the client gateway, and the first service packet is ready to be sent to the server.
  • Step BZ502 The client gateway replaces the source address of the first service packet with the corresponding encrypted client segment identifier.
  • Step BZ503 the client gateway encrypts the source address and destination address of the first service message by using the server-side public key based on the encryption forwarding action indicated by the encrypted server-side segment identifier, and thereafter, sends the first service to the server-side gateway via the intermediate node message.
  • Step BZ601 The server-side gateway uses the server-side private key to decrypt the source address and destination address of the first service packet, and replaces the destination address of the first service packet with the server-side address.
  • Step BZ602 The server-side gateway sends the first service message processed in step BZ601 to the server-side.
  • Step BZ701 The server sends a second service packet to the server-side gateway, and the second service packet is ready to be sent to the client.
  • Step BZ702 The server-side gateway replaces the source address of the second service packet with the encrypted server-side segment identifier, and the destination address of the second service packet is the encrypted client-side segment identifier.
  • Step BZ703 the server-side gateway uses the client-side public key to encrypt the source address and destination address of the second service message based on the encrypted forwarding action indicated by the encrypted client-side segment identifier, and thereafter, sends the second service message to the client-side gateway via the intermediate node.
  • Step BZ801 The client gateway uses the client private key to decrypt the source address and destination address of the second service packet, and replaces the destination address of the second service packet with the address of the client.
  • Step BZ802 The client gateway sends the second service message processed in step BZ801 to the client.
  • FIG. 14 is a schematic structural diagram of a client device according to an embodiment of the present disclosure. As shown in Figure 14, the client device includes:
  • processors 101 one or more processors 101;
  • a message processing method applied to a client device of any of the examples
  • One or more I/O interfaces 103 are connected between the processor 101 and the memory 102 and are configured to realize information exchange between the processor 101 and the memory 102 .
  • the processor 101 is a device with data processing capabilities, including but not limited to a central processing unit (CPU), etc.; the memory 102 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM) , DDR, etc.), read-only memory (ROM), electrified erasable programmable read-only memory (EEPROM), and flash memory (FLASH); and an I/O interface (read-write interface) 103 is connected between the processor 101 and the memory 102 , can realize the information exchange between the processor 101 and the memory 102, which includes but is not limited to a data bus (Bus) and the like.
  • RAM random access memory
  • ROM read-only memory
  • EEPROM electrified erasable programmable read-only memory
  • FLASH flash memory
  • I/O interface (read-write interface) 103 is connected between the processor 101 and the memory 102 , can realize the information exchange between the processor 101 and the memory 102, which includes but is not limited to a data bus (Bus
  • processor 101, memory 102, and I/O interface 103 are interconnected by bus 104, and in turn are connected to other components of the computing device.
  • a client device includes a client and a client gateway.
  • FIG. 15 is a schematic structural diagram of a server-side device according to an embodiment of the present disclosure. As shown in Figure 15, the server-side device includes:
  • processors 201 one or more processors 201;
  • the memory 202 has one or more computer programs stored thereon, and when the one or more computer programs are executed by the one or more processors 201, causes the one or more processors 201 to implement any of the above-mentioned embodiments.
  • One or more I/O interfaces 203 are connected between the processor 201 and the memory 202 and are configured to realize information exchange between the processor 201 and the memory 202 .
  • the processor 201 is a device with data processing capabilities, including but not limited to a central processing unit (CPU), etc.; the memory 202 is a device with data storage capabilities, including but not limited to random access memory (RAM, more specifically SDRAM) , DDR, etc.), read only memory (ROM), electrified erasable programmable read only memory (EEPROM), and flash memory (FLASH); and an I/O interface (read and write interface) 203 is connected between the processor 201 and the memory 202 , which can realize the information exchange between the processor 201 and the memory 202, which includes but is not limited to a data bus (Bus) and the like.
  • RAM random access memory
  • ROM read only memory
  • EEPROM electrified erasable programmable read only memory
  • FLASH flash memory
  • I/O interface (read and write interface) 203 is connected between the processor 201 and the memory 202 , which can realize the information exchange between the processor 201 and the memory 202, which includes but is not limited to a data bus
  • processor 201, memory 202, and I/O interface 203 are interconnected by bus 204, and in turn are connected to other components of the computing device.
  • the server-side device includes a server-side and a server-side gateway.
  • FIG. 16 is a schematic structural diagram of a computer-readable medium provided by an embodiment of the present disclosure.
  • the computer-readable medium stores a computer program, and when the computer program is executed by the processor, implements the packet processing method applied to the client device or the packet processing method applied to the server device as in any of the foregoing embodiments.
  • Such software may be distributed on computer-readable media, which may include computer storage media (or non-transitory media) and communication media (or transitory media).
  • computer storage media includes both volatile and nonvolatile implemented in any method or technology for storage of information, such as computer readable instructions, data structures, program modules or other data flexible, removable and non-removable media.
  • Computer storage media include, but are not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD) or other optical disk storage, magnetic cartridges, magnetic tape, magnetic disk storage or other magnetic storage devices, or may Any other medium used to store desired information and which can be accessed by a computer.
  • communication media typically embodies computer readable instructions, data structures, program modules, or other data in a modulated data signal such as a carrier wave or other transport mechanism, and can include any information delivery media, as is well known to those of ordinary skill in the art .
  • Example embodiments have been disclosed herein, and although specific terms are employed, they are used and should only be construed in a general descriptive sense and not for purposes of limitation. In some instances, it will be apparent to those skilled in the art that features, characteristics and/or elements described in connection with a particular embodiment may be used alone or in combination with features, characteristics and/or elements described in connection with other embodiments unless expressly stated otherwise. Features and/or elements are used in combination. Accordingly, it will be understood by those of ordinary skill in the art that various changes in form and details may be made therein without departing from the scope of the present disclosure as set forth in the appended claims.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Mobile Radio Communication Systems (AREA)
  • Telephonic Communication Services (AREA)

Abstract

本公开提供了一种报文处理方法，该报文处理方法应用于客户端设备，客户端设备包括客户端，该报文处理方法包括：响应于从客户端发送至服务器端的第一业务报文，将第一业务报文的源地址替换为客户端对应的加密客户端分段标识；根据加密服务器端分段标识，使用服务器端公钥对第一业务报文的源地址和目的地址进行加密，并向服务器端发送加密后的第一业务报文；以及响应于服务器端发送的第二业务报文，使用客户端私钥对第二业务报文的源地址和目的地址进行解密，并将第二业务报文的目的地址替换为客户端的地址。本公开还提供了一种应用于服务器端设备的报文处理方法、一种客户端设备、一种服务器端设备和一种计算机可读介质。

Description

报文处理方法、客户端设备、服务器端设备和计算机可读介质
相关申请的交叉引用
本公开要求于2021年2月8日提交的中国专利申请NO.202110184521.7的优先权，该中国专利申请的内容通过引用的方式整体合并于此。
技术领域
本公开涉及通信技术领域，特别涉及报文处理方法、客户端设备、服务器端设备和计算机可读介质。
背景技术
作为一种网络转发技术，基于互联网协议第六版的分段路由(Segment Routing IPv6，简称SRv6)架构基于源路由理念进行设计，借助互联网协议第六版(IPv6)的转发机制，通过在其IP扩展头中进行新的扩展来实现IPv6数据包的转发，新增的扩展部分称为分段路由报文头(Segment Routing Header，简称SRH)。分段路由报文头中包含了IPv6地址栈，依靠中间节点顺序对目的地址进行更新操作，从而完成报文在网络中的逐跳转发。
在报文传输过程中，链路中的中间节点可以通过解析报文获得源端和目的端的网元信息，由此，存在第三方通过非正当手段截获报文并利用解析报文的方式获取主机相关信息和服务器相关信息的可能，报文传输的安全性无法得到保证。
公开内容
第一方面，本公开实施例提供了一种报文处理方法，应用于客户端设备，所述客户端设备包括客户端，所述方法包括：
响应于从客户端发送至服务器端的第一业务报文，将所述第一 业务报文的源地址替换为所述客户端对应的加密客户端分段标识，所述第一业务报文的目的地址为所述服务器端对应的加密服务器端分段标识；
根据所述加密服务器端分段标识，使用服务器端公钥对所述第一业务报文的源地址和目的地址进行加密，并向所述服务器端发送加密后的所述第一业务报文；以及
响应于所述服务器端发送的第二业务报文，使用客户端私钥对所述第二业务报文的源地址和目的地址进行解密，并将所述第二业务报文的目的地址替换为所述客户端的地址，所述第二业务报文的目的地址为所述服务器端设备使用客户端公钥加密后的所述加密客户端分段标识。
第二方面，本公开实施例还提供了一种报文处理方法，应用于服务器端设备，所述服务器端设备包括服务器端，所述方法包括：
响应于客户端发送的第一业务报文，使用服务器端私钥对所述第一业务报文的源地址和目的地址进行解密，并将所述第一业务报文的目的地址替换为服务器端的地址，所述第一业务报文的源地址为客户端设备使用服务器端公钥加密后的加密客户端分段标识，所述第一业务报文的目的地址为客户端设备使用服务器端公钥加密后的加密服务器端分段标识；
响应于从所述服务器端发送至所述客户端的第二业务报文，将所述第二业务报文的源地址替换为所述服务器端对应的加密服务器端分段标识，所述第二业务报文的目的地址为所述客户端对应的加密客户端分段标识；以及
根据所述加密客户端分段标识，使用客户端公钥对所述第二业务报文的源地址和目的地址进行加密，并向所述客户端发送加密后的所述第二业务报文。
第三方面，本公开实施例还提供了一种客户端设备，包括：
一个或多个处理器；以及
存储器，配置为存储一个或多个计算机程序；
当所述一个或多个计算机程序被所述一个或多个处理器执行时， 使得所述一个或多个处理器实现如上述第一方面所述的报文处理方法。
第四方面，本公开实施例还提供了一种服务器端设备，包括：
一个或多个处理器；以及
存储器，配置为存储一个或多个计算机程序；
当所述一个或多个计算机程序被所述一个或多个处理器执行时，使得所述一个或多个处理器实现如上述第二方面所述的报文处理方法。
第五方面，本公开实施例还提供了一种计算机可读介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现如上述第一方面所述的报文处理方法。
第六方面，本公开实施例还提供了一种计算机可读介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现如上述第二方面所述的报文处理方法。
附图说明
图1为本公开实施例提供的一种网络架构的结构示意图；
图2为本公开实施例提供的一种报文处理方法的流程图；
图3为本公开实施例提供的一种报文处理方法的流程图；
图4为本公开实施例提供的一种报文处理方法的流程图；
图5为本公开实施例中步骤S2的一种具体实施方法的流程图；
图6为本公开实施例提供的一种报文处理方法的流程图；
图7为本公开实施例提供的一种报文处理方法的流程图；
图8为本公开实施例提供的一种报文处理方法的流程图；
图9为本公开实施例中步骤S9的一种具体实施方法的流程图；
图10为本公开实施例提供的一种报文处理方法的流程图；
图11为本公开实施例提供的一种报文处理方法的流程图；
图12为本公开实施例提供的一种报文处理方法的流程图；
图13为本公开实施例提供的一种报文处理方法的流程图；
图14为本公开实施例提供的一种客户端设备的结构示意图；
图15为本公开实施例提供的一种服务器端设备的结构示意图；以及
图16为本公开实施例提供的一种计算机可读介质的结构示意图。
具体实施方式
为使本领域的技术人员更好地理解本公开的技术方案，下面结合附图对本公开提供的报文处理方法、客户端设备、服务器端设备和计算机可读介质进行详细描述。
在下文中将参考附图更充分地描述示例实施例，但是所述示例实施例可以以不同形式来体现且不应当被解释为限制性的。提供这些实施例的目的在于使本公开更加透彻和完整，并使本领域技术人员充分理解本公开的范围。
本文所使用的术语仅用于描述特定实施例，且不意欲限制本公开。如本文所使用的，单数形式“一个”和“该”也意欲包括复数形式，除非上下文另外清楚指出。还将理解的是，当本说明书中使用术语“包括”和/或“由……制成”时，指定存在特定特征、整体、步骤、操作、元件和/或组件，但不排除存在或可添加一个或多个其他特征、整体、步骤、操作、元件、组件和/或其群组。
将理解的是，虽然本文可以使用术语第一、第二等来描述各种元素，但这些元素不应当受限于这些术语。这些术语仅用于区分一个元素和另一元素。因此，在不背离本公开的指教的情况下，例如，下文讨论的第一业务报文可称为第二业务报文。
除非另外限定，否则本文所用的所有术语(包括技术术语和科学术语)的含义与本领域普通技术人员通常理解的含义相同。还将理解，诸如在常用字典中限定的那些术语应当被解释为具有与其在相关技术以及本公开的背景下的含义一致的含义，且将不解释为具有理想化或过度形式上的含义，除非本文明确如此限定。
利用本公开所提供的报文处理方法、客户端设备、服务器端设备和计算机可读介质，在业务报文传输过程中，对于客户端设备和服务器端设备中的发送端，对于预备发送的、目的地址为接收端对应的 特定类型的分段标识的业务报文，发送端将其源地址替换为发送端对应的特定类型的分段标识，并根据特定类型的分段标识对该业务报文的源地址和目的地址进行加密后，再对该业务报文进行发送，接收端接收该业务报文并对该业务报文的目的地址进行解密，将该业务报文的目的地址替换为接收端对应的地址，实现了对业务报文的收发双方的网元信息的保护，有效地解决了网络中业务报文传输的安全性问题。
图1为本公开实施例提供的一种网络架构的结构示意图。如图1所示，所述网络架构中包括客户端设备、中间节点、服务器端设备和服务管理控制器。
该网络架构为基于互联网协议第六版的分段路由架构，客户端设备和服务器端设备通过中间节点进行业务报文传递，该中间节点为分段路由节点。具体地，客户端设备包括客户端和客户端网关，客户端为通过客户端网关接入网络并需要与服务器端进行通信的设备，包括个人电脑、平板和移动终端等；服务器端设备包括服务器端和服务器端网关，服务器端可通过服务器端网关接入网络；服务管理控制器为控制层，配置为对服务器端和客户端的业务通信进行管理控制；在一些实施方式中，分段路由节点可包括运营商骨干路由器(Provider)、运营商边缘路由器(Provider Edge，简称PE)、自治系统边界路由器(Autonomous System Boundary Router，简称ASBR)和区域边界路由器(Area Border Router，简称ABR)等。
图2为本公开实施例提供的一种报文处理方法的流程图。如图2所示，所述报文处理方法应用于客户端设备，该方法包括步骤S1至S3。
步骤S1、响应于从客户端发送至服务器端的第一业务报文，将第一业务报文的源地址替换为客户端对应的加密客户端分段标识。
在一些实施方式中，所述客户端设备包括客户端，所述报文处理方法流程由客户端执行；或者，在一些实施方式中，所述客户端设备还包括客户端对应的客户端网关，此时，所述报文处理方法流程可由客户端网关执行。
在步骤S1中，第一业务报文的目的地址为服务器端对应的加密 服务器端分段标识。具体地，在基于互联网协议第六版的分段路由架构中，针对网络地址配置对应的分段标识(Segment ID，简称SID)，该分段标识具备显式的指示作用，是一种网络指令(Instruction)；相应的业务报文经过中间节点时，该中间节点读取携带于业务报文的分段路由报文头中的分段标识以及对应的一系列的指示操作(也称段操作)，根据分段标识和指示操作，完成相应的转发动作以进行业务报文的转发，所述指示操作用于指示数据(例如业务报文)在网络中的路由和传输。
在步骤S1中，加密客户端分段标识和加密服务器端分段标识分别为客户端和服务器端各自预先配置的一种特定类型的分段标识，与现有的其他类型的分段标识不同，该特定类型的分段标识并非用于指示现有的转发动作，而是用于指示加密转发动作，即，加密客户端分段标识和加密服务器端分段标识除了用于指示数据(例如业务报文)在网络中的路由和传输外，还用于指示需要对相应业务报文的源地址和目的地址进行加密，故加密客户端分段标识和加密服务器端分段标识并不表示分段标识自身是加密的，而是用于指代上述的加密转发动作。
在一些实施方式中，可使用类型字段“END.S.DECI”对特定类型的分段标识进行标记。在一些实施方式中，可通过配置方式或者在业务授权过程中基于路由协议建立特定类型的分段标识与对应设备(例如，客户端、服务器端)的地址的映射关系。
步骤S2、根据加密服务器端分段标识使用服务器端公钥对第一业务报文的源地址和目的地址进行加密，并向服务器端发送加密后的第一业务报文。
具体地，根据加密服务器端分段标识所指示的加密转发动作，使用服务器端公钥对第一业务报文的源地址和目的地址进行加密，并向服务器端发送加密后的第一业务报文，该加密后的第一业务报文即表示源地址和目的地址均已被加密的第一业务报文。具体地，在一些实施方式中，对源地址和目的地址的参数部分进行加密。
服务器端公钥属于服务器端的公私钥对，该公私钥对可由服务 器端自行预先配置或由服务管理控制器预先配置并下发至服务器端，客户端设备可提前获取到服务器端公钥。
步骤S3、响应于服务器端发送的第二业务报文，使用客户端私钥对第二业务报文的目的地址进行解密，并将第二业务报文的目的地址替换为客户端的地址。
具体地，第二业务报文的目的地址为服务器端使用客户端公钥加密后的加密客户端分段标识；客户端私钥属于客户端的公私钥对，该公私钥对可由客户端自行预先配置或由服务管理控制器预先配置并下发至客户端，服务器端设备可提前获取到客户端公钥。
在一些实施方式中，所述报文处理方法还包括：使用客户端私钥对第二业务报文的源地址进行解密。
具体地，第二业务报文的源地址为服务器端使用客户端公钥加密后的加密服务器端分段标识。
在一些实施方式中，可由客户端网关对第二业务报文的目的地址进行解密，并将第二业务报文的目的地址替换为客户端的地址后，将第二业务报文发送至客户端。
利用本公开实施例提供的报文处理方法，在业务报文传输过程中，对于预备发送的、目的地址为服务器端对应的特定类型的分段标识的业务报文，客户端设备将其源地址替换为客户端对应的特定类型的分段标识，并根据特定类型的分段标识对该业务报文的源地址和目的地址进行加密后，再向服务器端发送加密后的业务报文；对于服务器端设备返回的业务报文，对该业务报文的目的地址进行解密，并将该业务报文的目的地址替换为客户端对应的地址，实现了对业务报文的收发双方的网元信息的保护，有效地解决了网络中业务报文传输的安全性问题。
图3为本公开实施例提供的一种报文处理方法的流程图。如图3所示，该报文处理方法为基于图2所示报文处理方法的一种实施方式。具体地，该报文处理方法不仅包括上述步骤S1至步骤S3，在步骤S1之前，该报文处理方法还包括步骤S01和步骤S02。下面仅对步骤S01和步骤S02进行详细描述。
步骤S01、响应于从客户端发送至服务器端的业务授权请求，配置加密客户端分段标识，并建立加密客户端分段标识与客户端的地址的映射关系。
具体地，客户端向服务器端发送业务授权请求以预建立业务通信关系。在一些实施方式中，客户端还可向服务管理控制器发送业务授权请求以进行业务授权。
具体地，分段标识包括定位字段(Locator)、功能字段(Function)和可选参数字段(Argument)等；定位字段主要承担路由功能，在分段路由域内唯一；功能字段承担标识设备的功能，如转发功能以及业务功能等；而针对本公开所提供的特定类型的分段标识，在一些实施方式中，可通过将可选参数字段中的至少部分作为引用字段，建立该引用字段与客户端的地址的映射关系，以建立加密客户端分段标识与客户端的地址的映射关系。
在一些实施方式中，所述报文处理方法还包括：通过内部网关协议(Interior Gateway Protocol，简称IGP)针对加密客户端分段标识进行路由发布。
步骤S02、将业务授权请求发送至服务器端，并接收服务器端反馈的业务授权响应。
具体地，业务授权响应包括加密服务器端分段标识，由此，客户端设备获得与服务器端的地址相对应的加密服务器端分段标识，该加密服务器端分段标识在客户端设备侧实际可作为服务器端的地址。
图4为本公开实施例提供的一种报文处理方法的流程图。如图4所示，该报文处理方法为基于图2所示报文处理方法的一种实施方式。具体地，该报文处理方法不仅包括上述步骤S1至步骤S3，还包括步骤S4至步骤S6。下面仅对步骤S4至步骤S6进行详细描述。
步骤S4、建立使用服务器端公钥加密后的加密客户端分段标识与客户端的地址的映射关系，以及建立使用服务器端公钥加密后的加密服务器端分段标识与加密服务器端分段标识的映射关系。
在一些实施方式中，使用服务器端公钥对特定类型的分段标识进行加密的步骤包括：使用服务器端公钥对特定类型的分段标识的引 用字段进行加密。由此，在一些实施方式中，类似于步骤S01，在步骤S4中，建立使用服务器端公钥加密后的分段标识的引用字段与客户端的地址的映射关系，以建立使用服务器端公钥加密后的特定类型的分段标识与客户端的地址的映射关系。
步骤S5、响应于从客户端发送至服务器端的第三业务报文，将第三业务报文的源地址替换为使用服务器端公钥加密后的加密客户端分段标识，将第三业务报文的目的地址替换为使用服务器端公钥加密后的加密服务器端分段标识。
具体地，第三业务报文的目的地址为加密服务器端分段标识；在步骤S5中，客户端设备侧可通过提前建立加密后的特定类型的分段标识与相应地址的映射关系，在进行业务报文发送或转发时，对业务报文的源地址和目的地址进行直接替换，从而减少响应延迟。
步骤S6、向服务器端发送第三业务报文。
图5为本公开实施例中步骤S2的一种具体实施方式的流程图。具体地，客户端设备还包括客户端网关；如图5所示，步骤S2包括步骤S201。
步骤S201、根据客户端网关地址、链路中的中间节点地址和服务器端对应的服务器端网关地址，在第一业务报文外层生成隧道头和分段路由扩展头，并向服务器端网关发送经上述处理后的第一业务报文。
在步骤S201中，由于第一业务报文要经客户端网关和通信链路中的分段路由节点被发送至服务器端，因此，根据客户端网关地址、分段路由节点的地址和服务器端网关地址，对第一业务报文进行外层封装，以为第一业务报文增加隧道头和分段路由扩展头。由此，在前述实施方式的报文处理方法中，业务报文经过分段路由节点时，基于分段路由协议机制对业务报文的目的地址进行替换，而在本实施方式中，在业务报文经隧道外层封装后，业务报文经过分段路由节点时，基于分段路由协议机制对业务报文的外层目的地址进行替换。
由此，本公开实施例提供的报文处理方法可通过隧道技术和设置特定类型的分段标识，对业务报文传输进行保护。
图6为本公开实施例提供的一种报文处理方法的流程图。如图6所示，所述报文处理方法应用于服务器端设备，所述服务器端设备包括服务器端，该报文处理方法包括步骤S7至步骤S9。
步骤S7、响应于客户端发送的第一业务报文，使用服务器端私钥对第一业务报文的目的地址进行解密，并将第一业务报文的目的地址替换为服务器端的地址。
具体地，第一业务报文的源地址为客户端设备使用服务器端公钥加密后的加密客户端分段标识，第一业务报文的目的地址为客户端设备使用服务器端公钥加密后的加密服务器端分段标识；服务器端私钥属于服务器端的公私钥对，该公私钥对可由服务器端自行预先配置或由服务管理控制器预先配置并下发至服务器端，客户端设备可提前获取到服务器端公钥。
在一些实施方式中，所述服务器端设备包括服务器端，所述报文处理方法流程由服务器端执行；或者，在一些实施方式中，所述服务器端设备还包括服务器端对应的服务器端网关，此时，所述报文处理方法流程可由服务器端网关执行。
在一些实施方式中，所述报文处理方法还包括：使用服务器端私钥对第一业务报文的源地址进行解密。
具体地，第一业务报文的源地址为客户端设备使用服务器端公钥加密后的加密客户端分段标识。
在一些实施方式中，所述报文处理方法流程可由服务器端网关执行，从而，可由服务器端网关对第一业务报文的目的地址进行解密，将第一业务报文的目的地址替换为服务器端的地址后，将第一业务报文发送至服务器端。
步骤S8、响应于从服务器端发送至客户端的第二业务报文，将第二业务报文的源地址替换为加密服务器端分段标识。
具体地，第二业务报文的目的地址为客户端对应的加密客户端分段标识。
步骤S9、根据加密客户端分段标识使用客户端公钥对第二业务报文的源地址和目的地址进行加密，并向客户端发送加密后的第二业 务报文。
具体地，根据加密客户端分段标识所指示的加密转发动作，使用客户端公钥对第二业务报文的源地址和目的地址进行加密并向客户端发送加密后的第二业务报文，该加密后的第二业务报文即表示源地址和目的地址均已被加密的第二业务报文；客户端公钥属于客户端的公私钥对，该公私钥对可由客户端自行预先配置或由服务管理控制器预先配置并下发至客户端，服务器端设备可提前获取到客户端公钥。具体地，在一些实施方式中，对源地址和目的地址的参数部分进行加密。
利用本公开实施例提供的报文处理方法，在业务报文传输过程中，对于预备发送的、目的地址为客户端对应的特定类型的分段标识的业务报文，服务器端设备将其源地址替换为服务器端对应的特定类型的分段标识，并根据特定类型的分段标识对该业务报文的源地址和目的地址进行加密后，再向客户端发送加密后的业务报文；对于客户端返回的业务报文，对该业务报文的目的地址进行解密，并将该业务报文的目的地址替换为服务器端对应的地址，实现了对业务报文的收发双方的网元信息的保护，有效地解决了网络中业务报文传输的安全性问题。
图7为本公开实施例提供的一种报文处理方法的流程图。如图7所示，该报文处理方法为基于图6所示报文处理方法的一种实施方式。具体地，该报文处理方法不仅包括步骤S7至步骤S9，在步骤S7之前，该报文处理方法还包括步骤S7a和步骤S7b。下面仅对步骤S7a和步骤S7b进行详细描述。
步骤S7a、响应于从服务器端发送至服务管理控制器的业务注册请求，配置加密服务器端分段标识，并建立加密服务器端分段标识与服务器端的地址的映射关系。
具体地，业务注册请求中可包括服务器标识，如服务ID、服务器ID等。
在一些实施方式中，可通过将加密服务器端分段标识的可选参数字段中的至少部分作为引用字段，来建立该引用字段与服务器端的 地址的映射关系，以建立加密服务器端分段标识与服务器端的地址的映射关系。
步骤S7b、将业务注册请求发送至服务管理控制器，并接收服务管理控制器反馈的业务注册响应。
在步骤S7b中，接收到服务管理控制器反馈的业务注册响应则表示服务器端的业务注册成功。
图8为本公开实施例提供的一种报文处理方法的流程图。如图8所示，该报文处理方法为基于图6所示报文处理方法的一种实施方式。具体地，该报文处理方法不仅包括步骤S7至步骤S9，还包括步骤S10至步骤S12。下面仅对步骤S10至步骤S12进行详细描述。
步骤S10、建立使用客户端公钥加密后的加密客户端分段标识与加密客户端分段标识的映射关系，以及建立使用客户端公钥加密后的加密服务器端分段标识与服务器端的地址的映射关系。
在一些实施方式中，使用客户端公钥对特定类型的分段标识进行加密的步骤包括：使用客户端公钥对特定类型的分段标识的引用字段进行加密。由此，在一些实施方式中，类似于步骤S7a，在步骤S10中，建立使用客户端公钥加密后的分段标识的引用字段与服务器端的地址的映射关系，以建立使用客户端公钥加密后的特定类型的分段标识与服务器端的地址的映射关系。
步骤S11、响应于从服务器端发送至客户端的第四业务报文，将第四业务报文的源地址替换为使用客户端公钥加密后的加密服务器端分段标识，将第四业务报文的目的地址替换为使用客户端公钥加密后的加密客户端分段标识。
具体地，第四业务报文的目的地址为加密客户端分段标识；在步骤S11中，服务器端可通过提前建立加密后的特定类型的分段标识与相应地址的映射关系，在进行业务报文发送或转发时，对业务报文的源地址和目的地址进行直接替换，从而减少响应延迟。
步骤S12、向客户端发送第四业务报文。
图9为本公开实施例中步骤S9的一种具体实施方式的流程图。如图9所示，具体地，服务器端设备还包括服务器端网关；步骤S9 包括步骤S901。
步骤S901、根据服务器端网关地址、链路中的中间节点地址和客户端对应的客户端网关地址，在第二业务报文外层生成隧道头和分段路由扩展头，并向客户端网关发送经上述处理后的第二业务报文。
在步骤S901中，由于第二业务报文要经服务器端网关和通信链路中的分段路由节点被发送至客户端，因此，根据服务器端网关地址、分段路由节点的地址和客户端对应的客户端网关地址，对第二业务报文进行外层封装，以为第二业务报文增加隧道头和分段路由扩展头。由此，在前述实施方式的报文处理方法中，业务报文经过分段路由节点时，基于分段路由协议机制对业务报文的目的地址进行替换，而在本实施方式中，在业务报文经隧道外层封装后，业务报文经过分段路由节点时，基于分段路由协议机制对业务报文的外层目的地址进行替换。
下面结合实际应用对本公开实施例提供的报文处理方法进行详细描述。
图10为本公开实施例提供的一种报文处理方法的流程图。如图10所示，所述报文处理方法应用于客户端设备和服务器端设备经中间节点的交互过程中，客户端设备包括客户端，服务器端设备包括服务器端，中间节点可为一个或多个(图10中仅示出一个)，该报文处理方法包括步骤BZ01至步骤BZ07。
步骤BZ01、服务器端预备向服务管理控制器发送业务注册请求，配置加密服务器端分段标识，并建立加密服务器端分段标识与服务器端的地址的映射关系。
步骤BZ02、服务器端向服务管理控制器发送业务注册请求，业务注册请求包括服务器标识。
步骤BZ03、服务管理控制器保存服务器标识，完成服务器端的业务注册。
步骤BZ04、服务管理控制器向服务器端发送业务注册响应。
步骤BZ05、客户端预备向服务器端发送业务授权请求，配置加密客户端分段标识，并建立加密客户端分段标识与客户端的地址的映 射关系。
步骤BZ06、客户端经由中间节点向服务器端发送业务授权请求。
步骤BZ07、服务器端进行业务授权，并经由中间节点向客户端发送业务授权响应，业务授权响应包括加密服务器端分段标识。
至此，完成服务器端的业务注册和客户端的业务授权。
图11为本公开实施例提供的一种报文处理方法的流程图。如图11所示，所述报文处理方法应用于客户端设备和服务器端设备经中间节点的交互过程中，客户端设备包括客户端，服务器端设备包括服务器端，中间节点可为一个或多个(图11中仅示出一个)，该报文处理方法包括步骤BZ101至步骤BZ4。
步骤BZ101、客户端将预备发送至服务器端的第一业务报文的源地址替换为加密客户端分段标识，第一业务报文的目的地址为服务器端对应的加密服务器端分段标识。
步骤BZ102、客户端基于加密服务器端分段标识指示的加密转发动作，使用服务器端公钥加密第一业务报文的源地址和目的地址，此后，经由中间节点向服务器端发送第一业务报文。
步骤BZ2、服务器端使用服务器端私钥对第一业务报文的源地址和目的地址进行解密，并将第一业务报文的目的地址替换为服务器端的地址。
步骤BZ301、服务器端将预备发送至客户端的第二业务报文的源地址替换为加密服务器端分段标识，第二业务报文的目的地址为加密客户端分段标识。
步骤BZ302、服务器端基于加密客户端分段标识指示的加密转发动作，使用客户端公钥对第二业务报文的源地址和目的地址进行加密，此后，经由中间节点向客户端发送第二业务报文。
步骤BZ4、客户端使用客户端私钥对第二业务报文的源地址和目的地址进行解密，并将第二业务报文的目的地址替换为客户端的地址。
至此，完成客户端和服务器端之间的业务报文的一次相互传递。
图12为本公开实施例提供的一种报文处理方法的流程图。如图12所示，所述报文处理方法应用于客户端设备和服务器端设备经中 间节点的交互过程中，客户端设备包括客户端和客户端网关，服务器端设备包括服务器端和服务器端网关，中间节点可为一个或多个(图12中仅示出一个)，该报文处理方法包括步骤BZ081至步骤BZ0132。
步骤BZ081、服务器端向服务器端网关发送业务注册请求，业务注册请求预备发往服务管理控制器。
步骤BZ082、服务器端网关配置加密服务器端分段标识，并建立加密服务器端分段标识与服务器端的地址的映射关系。
步骤BZ083、服务器端网关向服务管理控制器发送业务注册请求，业务注册请求包括服务器标识。
步骤BZ09、服务管理控制器保存服务器标识，完成服务器端的业务注册。
步骤BZ0101、服务管理控制器向服务器端网关发送业务注册响应。
步骤BZ0102、服务器端网关向服务器端发送业务注册响应。
步骤BZ0111、客户端向客户端网关发送业务授权请求，业务授权请求预备发往服务器端。
步骤BZ0112、客户端网关配置加密客户端分段标识，建立加密客户端分段标识与客户端的地址的映射关系。
步骤BZ0113、客户端网关经由中间节点和服务器端网关向服务器端发送业务授权请求。
步骤BZ012、服务器端进行业务授权，并经由服务器端网关和中间节点向客户端网关发送业务授权响应，业务授权响应包括加密服务器端分段标识。
步骤BZ0131、客户端网关保存加密服务器端分段标识。
步骤BZ0132、客户端网关向客户端发送业务授权响应。
至此，完成服务器端的业务注册和客户端的业务授权。
图13为本公开实施例提供的一种报文处理方法的流程图。如图13所示，所述报文处理方法应用于客户端设备和服务器端设备经中间节点的交互过程中，客户端设备包括客户端和客户端网关，服务器端设备包括服务器端和服务器端网关，中间节点可为一个或多个，该 报文处理方法包括步骤BZ501至步骤BZ802。
步骤BZ501、客户端向客户端网关发送第一业务报文，第一业务报文预备发往服务器端。
步骤BZ502、客户端网关将第一业务报文的源地址替换为对应的加密客户端分段标识。
步骤BZ503、客户端网关基于加密服务器端分段标识指示的加密转发动作，使用服务器端公钥加密第一业务报文的源地址和目的地址，此后，经由中间节点向服务器端网关发送第一业务报文。
步骤BZ601、服务器端网关使用服务器端私钥对第一业务报文的源地址和目的地址进行解密，并将第一业务报文的目的地址替换为服务器端的地址。
步骤BZ602、服务器端网关向服务器端发送经步骤BZ601处理后的第一业务报文。
步骤BZ701、服务器端向服务器端网关发送第二业务报文，第二业务报文预备发往客户端。
步骤BZ702、服务器端网关将第二业务报文的源地址替换为加密服务器端分段标识，第二业务报文的目的地址为加密客户端分段标识。
步骤BZ703、服务器端网关基于加密客户端分段标识指示的加密转发动作，使用客户端公钥对第二业务报文的源地址和目的地址进行加密，此后，经由中间节点向客户端网关发送第二业务报文。
步骤BZ801、客户端网关使用客户端私钥对第二业务报文的源地址和目的地址进行解密，并将第二业务报文的目的地址替换为客户端的地址。
步骤BZ802、客户端网关向客户端发送经步骤BZ801处理后的第二业务报文。
至此，完成客户端和服务器端之间的业务报文的一次相互传递。
图14为本公开实施例提供的一种客户端设备的结构示意图。如图14所示，该客户端设备包括：
一个或多个处理器101；
存储器(装置)102，其上存储有一个或多个计算机程序，当该 一个或多个计算机程序被该一个或多个处理器101执行时，使得该一个或多个处理器101实现如上述实施例中任一的应用于客户端设备的报文处理方法；以及
一个或多个I/O接口103，连接在处理器101与存储器102之间，配置为实现处理器101与存储器102之间的信息交互。
处理器101为具有数据处理能力的器件，其包括但不限于中央处理器(CPU)等；存储器102为具有数据存储能力的器件，其包括但不限于随机存取存储器(RAM，更具体如SDRAM、DDR等)、只读存储器(ROM)、带电可擦可编程只读存储器(EEPROM)以及闪存(FLASH)；以及I/O接口(读写接口)103连接在处理器101与存储器102之间，能实现处理器101与存储器102之间的信息交互，其包括但不限于数据总线(Bus)等。
在一些实施方式中，处理器101、存储器102和I/O接口103通过总线104相互连接，进而与计算设备的其它组件连接。
在一些实施方式中，客户端设备包括客户端和客户端网关。
图15为本公开实施例提供的一种服务器端设备的结构示意图。如图15所示，该服务器端设备包括：
一个或多个处理器201；
存储器202，其上存储有一个或多个计算机程序，当该一个或多个计算机程序被该一个或多个处理器201执行时，使得该一个或多个处理器201实现如上述实施例中任一的应用于服务器端设备的报文处理方法；以及
一个或多个I/O接口203，连接在处理器201与存储器202之间，配置为实现处理器201与存储器202之间的信息交互。
处理器201为具有数据处理能力的器件，其包括但不限于中央处理器(CPU)等；存储器202为具有数据存储能力的器件，其包括但不限于随机存取存储器(RAM，更具体如SDRAM、DDR等)、只读存储器(ROM)、带电可擦可编程只读存储器(EEPROM)以及闪存(FLASH)；以及I/O接口(读写接口)203连接在处理器201与存储器202之间，能实现处理器201与存储器202之间的信息交互，其包括但不限于数 据总线(Bus)等。
在一些实施方式中，处理器201、存储器202和I/O接口203通过总线204相互连接，进而与计算设备的其它组件连接。
在一些实施方式中，服务器端设备包括服务器端和服务器端网关。
图16为本公开实施例提供的一种计算机可读介质的结构示意图。该计算机可读介质上存储有计算机程序，该计算机程序被处理器执行时实现如上述实施例中任一的应用于客户端设备的报文处理方法或应用于服务器端设备的报文处理方法。
本领域普通技术人员可以理解，上文中所公开的报文处理方法中的全部或某些步骤、设备/装置中的功能模块/单元可以被实施为软件、固件、硬件及其适当的组合。在硬件实施方式中，在以上描述中提及的功能模块/单元之间的划分不一定对应于物理组件的划分；例如，一个物理组件可以具有多个功能，或者一个功能或步骤可以由若干物理组件合作执行。某些物理组件或所有物理组件可以被实施为由处理器(如中央处理器、数字信号处理器或微处理器)执行的软件，或者被实施为硬件，或者被实施为集成电路，如专用集成电路。这样的软件可以分布在计算机可读介质上，计算机可读介质可以包括计算机存储介质(或非暂时性介质)和通信介质(或暂时性介质)。如本领域普通技术人员公知的，术语计算机存储介质包括在用于存储信息(诸如计算机可读指令、数据结构、程序模块或其他数据)的任何方法或技术中实施的易失性和非易失性、可移除和不可移除介质。计算机存储介质包括但不限于RAM、ROM、EEPROM、闪存或其他存储器技术、CD-ROM、数字多功能盘(DVD)或其他光盘存储、磁盒、磁带、磁盘存储或其他磁存储装置、或者可以用于存储期望的信息并且可以被计算机访问的任何其他的介质。此外，本领域普通技术人员公知的是，通信介质通常包含计算机可读指令、数据结构、程序模块或者诸如载波或其他传输机制之类的调制数据信号中的其他数据，并且可包括任何信息递送介质。
本文已经公开了示例实施例，并且虽然采用了具体术语，但它 们仅用于并仅应当被解释为一般说明性含义，并且不用于限制的目的。在一些实例中，对本领域技术人员显而易见的是，除非另外明确指出，否则，与特定实施例相结合描述的特征、特性和/或元素可单独使用，或可与结合其他实施例描述的特征、特性和/或元件组合使用。因此，本领域技术人员将理解，在不脱离由所附的权利要求阐明的本公开的范围的情况下，可进行各种形式和细节上的改变。

Claims (12)

  1. 一种报文处理方法，应用于客户端设备，所述客户端设备包括客户端，所述方法包括：
    响应于从客户端发送至服务器端的第一业务报文，将所述第一业务报文的源地址替换为所述客户端对应的加密客户端分段标识，其中，所述第一业务报文的目的地址为所述服务器端对应的加密服务器端分段标识；
    根据所述加密服务器端分段标识，使用服务器端公钥对所述第一业务报文的源地址和目的地址进行加密，并向所述服务器端发送加密后的所述第一业务报文；以及
    响应于所述服务器端发送的第二业务报文，使用客户端私钥对所述第二业务报文的源地址和目的地址进行解密，并将所述第二业务报文的目的地址替换为所述客户端的地址，其中，所述第二业务报文的目的地址为服务器端设备使用客户端公钥加密后的所述加密客户端分段标识。
  2. 根据权利要求1所述的报文处理方法，还包括：
    在所述响应于从客户端发送至服务器端的第一业务报文、将所述第一业务报文的源地址替换为所述客户端对应的加密客户端分段标识之前，响应于从所述客户端发送至所述服务器端的业务授权请求，配置所述加密客户端分段标识，并建立所述加密客户端分段标识与所述客户端的地址的映射关系；以及
    将所述业务授权请求发送至所述服务器端，并接收所述服务器端反馈的业务授权响应；其中，所述业务授权响应包括所述加密服务器端分段标识。
  3. 根据权利要求1所述的报文处理方法，还包括：
    建立使用所述服务器端公钥加密后的所述加密客户端分段标识与所述客户端的地址的映射关系，以及建立使用所述服务器端公钥加 密后的所述加密服务器端分段标识与所述加密服务器端分段标识的映射关系；
    响应于从所述客户端发送至所述服务器端的第三业务报文，将所述第三业务报文的源地址替换为使用所述服务器端公钥加密后的所述加密客户端分段标识，将所述第三业务报文的目的地址替换为使用所述服务器端公钥加密后的所述加密服务器端分段标识，其中，所述第三业务报文的目的地址为所述加密服务器端分段标识；以及
    向所述服务器端发送所述第三业务报文。
  4. 根据权利要求1所述的报文处理方法，其中，所述客户端设备还包括客户端网关；以及
    所述向所述服务器端发送所述第一业务报文包括：
    根据客户端网关地址、链路中的中间节点地址和所述服务器端对应的服务器端网关地址在所述第一业务报文外层生成隧道头和分段路由扩展头，并向服务器端网关发送经上述处理后的所述第一业务报文。
  5. 一种报文处理方法，应用于服务器端设备，所述服务器端设备包括服务器端，所述方法包括：
    响应于客户端发送的第一业务报文，使用服务器端私钥对所述第一业务报文的源地址和目的地址进行解密，并将所述第一业务报文的目的地址替换为服务器端的地址，其中，所述第一业务报文的源地址为客户端设备使用服务器端公钥加密后的加密客户端分段标识，所述第一业务报文的目的地址为客户端设备使用服务器端公钥加密后的加密服务器端分段标识；
    响应于从所述服务器端发送至所述客户端的第二业务报文，将所述第二业务报文的源地址替换为所述服务器端对应的加密服务器端分段标识，其中，所述第二业务报文的目的地址为所述客户端对应的加密客户端分段标识；以及
    根据所述加密客户端分段标识，使用客户端公钥对所述第二业 务报文的源地址和目的地址进行加密，并向所述客户端发送加密后的所述第二业务报文。
  6. 根据权利要求5所述的报文处理方法，还包括：
    在所述响应于客户端发送的第一业务报文、使用服务器端私钥对所述第一业务报文的源地址和目的地址进行解密之前，响应于从所述服务器端发送至服务管理控制器的业务注册请求，配置所述加密服务器端分段标识，并建立所述加密服务器端分段标识与所述服务器端的地址的映射关系；以及
    将所述业务注册请求发送至所述服务管理控制器，并接收所述服务管理控制器反馈的业务注册响应。
  7. 根据权利要求5所述的报文处理方法，还包括：
    建立使用所述客户端公钥加密后的所述加密客户端分段标识与所述加密客户端分段标识的映射关系，以及建立使用所述客户端公钥加密后的所述加密服务器端分段标识与所述服务器端的地址的映射关系；
    响应于从所述服务器端发送至所述客户端的第四业务报文，将所述第四业务报文的源地址替换为使用所述客户端公钥加密后的所述加密服务器端分段标识，将所述第四业务报文的目的地址替换为使用所述客户端公钥加密后的所述加密客户端分段标识，其中，所述第四业务报文的目的地址为所述加密客户端分段标识；以及
    向所述客户端发送所述第四业务报文。
  8. 根据权利要求5所述的报文处理方法，其中，所述服务器端设备还包括服务器端网关；以及
    所述向所述客户端发送所述第二业务报文包括：
    根据服务器端网关地址、链路中的中间节点地址和所述客户端对应的客户端网关地址，在所述第二业务报文外层生成隧道头和分段路由扩展头，并向客户端网关发送经上述处理后的所述第二业务报文。
  9. 一种客户端设备，包括：
    至少一个处理器；以及
    存储器，配置为存储至少一个计算机程序；
    当所述至少一个计算机程序被所述至少一个处理器执行时，使得所述至少一个处理器实现如权利要求1至4中任一项所述的报文处理方法。
  10. 一种服务器端设备，包括：
    至少一个处理器；以及
    存储器，配置为存储至少一个计算机程序；
    当所述至少一个计算机程序被所述至少一个处理器执行时，使得所述至少一个处理器实现如权利要求5至8中任一项所述的报文处理方法。
  11. 一种计算机可读介质，其上存储有计算机程序，其中，所述计算机程序被处理器执行时实现如权利要求1至4中任一项所述的报文处理方法。
  12. 一种计算机可读介质，其上存储有计算机程序，其中，所述计算机程序被处理器执行时实现如权利要求5至8中任一项所述的报文处理方法。
PCT/CN2022/075472 2021-02-08 2022-02-08 报文处理方法、客户端设备、服务器端设备和计算机可读介质 WO2022166979A1 (zh)

Priority Applications (2)

Application Number Priority Date Filing Date Title
US18/276,280 US20240114013A1 (en) 2021-02-08 2022-02-08 Packet processing method, client end device, server end device, and computer-readable medium
EP22749258.4A EP4287550A1 (en) 2021-02-08 2022-02-08 Packet processing method, client end device, server end device, and computer-readable medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110184521.7A CN114915583A (zh) 2021-02-08 2021-02-08 报文处理方法、客户端设备、服务器端设备和介质
CN202110184521.7 2021-02-08

Publications (1)

Publication Number Publication Date
WO2022166979A1 true WO2022166979A1 (zh) 2022-08-11

Family

ID=82741995

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/075472 WO2022166979A1 (zh) 2021-02-08 2022-02-08 报文处理方法、客户端设备、服务器端设备和计算机可读介质

Country Status (4)

Country Link
US (1) US20240114013A1 (zh)
EP (1) EP4287550A1 (zh)
CN (1) CN114915583A (zh)
WO (1) WO2022166979A1 (zh)

Cited By (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115996210A (zh) * 2023-03-23 2023-04-21 湖南盾神科技有限公司 一种源变模式的地址端口跳变方法

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080235336A1 (en) * 2007-03-23 2008-09-25 Microsoft Corporation Implementation of private messaging
CN102281261A (zh) * 2010-06-10 2011-12-14 杭州华三通信技术有限公司 一种数据传输方法、系统和装置
US20120137123A1 (en) * 2010-08-05 2012-05-31 Northeastern University Technology Transfer Center Encryption/decryption communication system
CN111010274A (zh) * 2019-12-30 2020-04-14 烽火通信科技股份有限公司 一种安全低开销的SRv6实现方法

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20080235336A1 (en) * 2007-03-23 2008-09-25 Microsoft Corporation Implementation of private messaging
CN102281261A (zh) * 2010-06-10 2011-12-14 杭州华三通信技术有限公司 一种数据传输方法、系统和装置
US20120137123A1 (en) * 2010-08-05 2012-05-31 Northeastern University Technology Transfer Center Encryption/decryption communication system
CN111010274A (zh) * 2019-12-30 2020-04-14 烽火通信科技股份有限公司 一种安全低开销的SRv6实现方法

Cited By (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN115996210A (zh) * 2023-03-23 2023-04-21 湖南盾神科技有限公司 一种源变模式的地址端口跳变方法
CN115996210B (zh) * 2023-03-23 2023-06-27 湖南盾神科技有限公司 一种源变模式的地址端口跳变方法

Also Published As

Publication number Publication date
CN114915583A (zh) 2022-08-16
US20240114013A1 (en) 2024-04-04
EP4287550A1 (en) 2023-12-06

Similar Documents

Publication Publication Date Title
US10992654B2 (en) Secure WAN path selection at campus fabric edge
US9100370B2 (en) Strong SSL proxy authentication with forced SSL renegotiation against a target server
US7519834B1 (en) Scalable method and apparatus for transforming packets to enable secure communication between two stations
CN110650076B (zh) Vxlan的实现方法，网络设备和通信系统
US8433900B2 (en) Secure transport of multicast traffic
JP4407452B2 (ja) サーバ、ｖｐｎクライアント、ｖｐｎシステム、及びソフトウェア
US9516061B2 (en) Smart virtual private network
WO2017143611A1 (zh) 用于处理vxlan报文的方法、设备及系统
EP2874376A1 (en) Method and system for information synchronization between cloud storage gateways, and cloud storage gateway
US11888818B2 (en) Multi-access interface for internet protocol security
WO2020063528A1 (zh) 数据中心中虚拟机之间的通信方法、装置和系统
CN113852552B (zh) 一种网络通讯方法、系统与存储介质
WO2022166979A1 (zh) 报文处理方法、客户端设备、服务器端设备和计算机可读介质
CN108989342B (zh) 一种数据传输的方法及装置
EP3854053A1 (en) Method and apparatus for secure messaging between network functions
US20100275008A1 (en) Method and apparatus for secure packet transmission
WO2023272498A1 (zh) 一种报文转发方法、装置、网络节点及存储介质
WO2019076025A1 (zh) 一种加密数据流的识别方法、设备、存储介质及系统
US11610011B2 (en) Secure transfer of data between programs executing on the same end-user device
CN114785536A (zh) 一种报文处理方法及装置
CN116346769A (zh) 一种业务交互方法、装置、业务系统、电子设备及介质
CN117749471A (zh) Nat穿越的isakmp协商方法及相关装置
Cui et al. RFC 7856: Softwire Mesh Management Information Base (MIB)
Cui et al. Softwire Mesh Management Information Base (MIB)

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22749258

Country of ref document: EP

Kind code of ref document: A1

WWE Wipo information: entry into national phase

Ref document number: 18276280

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2022749258

Country of ref document: EP

ENP Entry into the national phase

Ref document number: 2022749258

Country of ref document: EP

Effective date: 20230831

NENP Non-entry into the national phase

Ref country code: DE