WO2023024540A1 - 处理报文、获取sa信息的方法、装置、系统及介质 - Google Patents

处理报文、获取sa信息的方法、装置、系统及介质 Download PDF

Info

Publication number
WO2023024540A1
WO2023024540A1 PCT/CN2022/088290 CN2022088290W WO2023024540A1 WO 2023024540 A1 WO2023024540 A1 WO 2023024540A1 CN 2022088290 W CN2022088290 W CN 2022088290W WO 2023024540 A1 WO2023024540 A1 WO 2023024540A1
Authority
WO
WIPO (PCT)
Prior art keywords
security
information
data plane
database
processing module
Prior art date
Application number
PCT/CN2022/088290
Other languages
English (en)
French (fr)
Inventor
赵宇萍
史玉林
赵凤华
韩涛
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority claimed from CN202111302023.4A external-priority patent/CN115941228A/zh
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023024540A1 publication Critical patent/WO2023024540A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the communication field, and in particular to a method, device, system and medium for processing messages and obtaining SA information.
  • the sending end when the sending end establishes a communication connection with the receiving end, the sending end and the receiving end negotiate through a network security protocol to generate security association (SA) information; the sending end encrypts and encrypts the data to be sent based on the SA information. /or security processing such as authentication, and send the processed data to the receiving end. After the data transmission is completed, the sending end disconnects the communication connection with the receiving end. When there is a need for data transmission again, and the sending end is re-establishing a communication connection with the receiving end, the sending end and the receiving end renegotiate to generate new SA information, and use the new SA information to send data.
  • SA security association
  • SA information needs to be renegotiated to generate SA information, which not only leads to low efficiency of security processing, but also leads to high overhead of network resources.
  • the present application provides a method, device, system and medium for processing messages and acquiring SA information, so as to improve security processing efficiency and save network resource overhead. Described technical scheme is as follows:
  • the present application provides a method for processing messages, the method is applied to a first device, the first device includes at least one data plane security processing module, and the security association SA database corresponding to the first device includes N SAs information, N is a natural number greater than 0, and each SA information in the N pieces of SA information includes an address, an SA identifier, and a security parameter respectively.
  • the first data plane security processing module obtains m pieces of SA information from the SA database based on the first address, m is a natural number greater than 0 and less than or equal to N, and the first address is the second device
  • Each SA information in the m pieces of SA information includes a first address
  • the first data plane security processing module is a data plane security processing module in at least one data plane security module included in the first device.
  • the first data plane security processing module obtains the message to be sent, and the destination address of the message to be sent is the first address.
  • the first data plane security processing module performs first security processing on the payload of the message to be sent based on the security parameters included in the m pieces of SA information, and adds the SA identifier of the m pieces of SA information to the message to be sent, so as to obtain The first packet, the payload of the first packet is the payload after the first security processing.
  • the communication interface of the first device sends the first packet to the second device.
  • the first data plane security module acquires m pieces of SA information including the first address from the SA database based on the first address. In this way, every time the first device establishes a connection with the second device and needs to send data, the first device and the second device do not need to first negotiate to generate SA information, but the first device obtains it from the first SA database based on the first address.
  • the m pieces of SA information are used to perform security processing on the message to be sent, thereby improving security processing efficiency and saving network resource overhead.
  • the SA database corresponding to the first device further includes attribute information corresponding to N security association SA information, and the attribute information corresponding to the first SA information among the N SA information includes information that can use the first SA information.
  • One or more data plane security protocols for SA information The first data plane security processing module obtains m pieces of SA information from the SA database according to the first address and the filter condition, and the attribute information of each SA information in the m pieces of SA information satisfies the filter condition, and the filter condition includes the first A data plane security protocol required by the data plane security processing module.
  • the filter condition includes the data plane security protocol required by the first data plane security processing module
  • the SA information corresponding to the data plane security protocol required by different data plane security processing modules can be obtained from the SA database, so that the use of the SA information is consistent with Negotiation management and unbinding of SA information simplifies management of network security protocols and improves scalability.
  • the attribute information corresponding to the first SA information among the N pieces of SA information also includes the source of the first SA information
  • the filter condition also includes the SA information required by the first data plane security processing module origin of.
  • the first data plane security processing module obtains the Obtain m SA information from the database.
  • the first data plane security processing module has requirements on the source of the SA, and since the filter condition includes the source required by the first data plane security module, the SA information that meets the requirements of the first data plane security processing module can be obtained.
  • the first data plane security processing module acquires x pieces of SA information from the SA database based on the first address, where x is a natural number greater than or equal to m and less than or equal to N.
  • the first data plane security processing module selects m pieces of SA information from the x pieces of SA information based on a random method or a polling method.
  • the x pieces of SA information are the SA information including the first address in the SA database, so whenever the first data plane security processing module needs to send a message whose destination address is the first address, m is selected from the x pieces of SA information SA information, so that there is no need to frequently query the SA database.
  • the first device reports the security capability of the first device to the third device, where the security capability includes at least one supported security processing algorithm and/or at least one supported data plane security protocol, so as to support
  • the third device generates at least one piece of SA information based on the security capability of the second device, the security capability of the first device, and a security policy between the first device and the second device, and stores the at least one piece of SA information in the SA database.
  • the security policy is used to indicate the target security processing and the target data plane security protocol
  • the address included in each SA information in at least one SA information is the address of the second device
  • the SA identifier in each SA information is assigned by the third device Yes
  • the security parameter in each SA message is a parameter specified by a security policy and is a parameter supported by both the security capability of the first device and the capability of the second device.
  • the third device is a management device, and the management device is configured to generate, for each of the at least three devices, the SA information required by each device and the communication peer device of each device , the at least three devices include a first device and a second device.
  • the third device centrally generates SA information for the first device and the second device, the first device and the second device do not need to deploy a negotiation module for negotiating to generate SA information, saving the calculation of the first device and the second device resource.
  • the third device is a negotiating device corresponding to the first device, where the negotiating device corresponding to the first device is used to negotiate for the first device the SA required by the first device and the communication peer device information.
  • the first device and the peer communication device of the first device are devices in different regions (such as different countries), so that the negotiating device negotiates and generates SA information for the first device, ensuring that the first device can obtain the SA information.
  • the negotiating device corresponding to the first device is integrated into the same physical device as the first device. In this way, the first device can directly negotiate to generate SA information, realize distributed negotiation, and do not need to deploy a separate third device for statistically generating SA information, saving costs.
  • the data plane security protocol includes: Media Access Control security MACSec, Internet Protocol security IPSec, Segment Routing Internet Protocol version 6 security SRv6Sec or Secure Sockets SSL.
  • the first data plane security processing module corresponds to at least one data plane security protocol.
  • the first device includes multiple data plane security processing modules
  • the SA database is an SA database to which at least two data plane security processing modules among the multiple data plane security processing modules have access rights.
  • the SA database is a shared database of the at least two data plane security processing modules, so that different database security processing modules can share the SA information in the SA database, so that the management and use of SA information are unbound.
  • the first SA information further includes an aging time.
  • the first device obtains the second SA information and replaces the first SA information with the second SA information.
  • the address included in the second SA information is the same as that of the first SA information.
  • the addresses included in the SA information are the same, and the security parameters included in the second SA information are different from those included in the first SA information. In this way, the first SA information is updated at regular intervals, preventing the first SA information from being compromised for a long time and improving security.
  • the security parameter of the first SA information includes a security processing algorithm and the first parameter required by the security processing algorithm
  • the security parameter of the second SA information includes the security processing algorithm and the second parameter required by the security processing algorithm. parameter, the first parameter and the second parameter are different. In this way, the parameters required by the security processing algorithm are updated at regular intervals, preventing the first parameter from being compromised for a long time and improving security.
  • the first data plane security processing module obtains the m pieces of SA information from an SA database through a public interface. In this way, each data plane security processing module accesses the SA database through a public interface, so that different database security processing modules can share the SA information in the SA database, so that the management and use of SA information are unbound.
  • the public interface includes a publish/subscribe Pub/Sub interface.
  • the first security processing includes one or more of the following: encryption processing, authentication processing, anti-tampering processing, or anti-replay processing.
  • the present application provides a method for processing messages, the method is applied to a second device, the second device includes at least one data plane security processing module, and the security association SA database corresponding to the second device includes M SAs information, M is a natural number greater than 0, and each SA information in the M pieces of SA information includes an SA identifier and a security parameter.
  • the second device receives the first message, and the first message includes m SA identifiers and payloads, where m is a natural number greater than 0 and less than or equal to M.
  • the second data plane security processing module Based on the m SA identities, acquires m pieces of SA information corresponding to the m SA identities from the SA database, and the second data plane security processing module is at least one data plane security processing module included in the second device A data plane security processing module in the module.
  • the second data plane security processing module performs second security processing on the payload of the first message based on the security parameters included in the m pieces of SA information.
  • the first message received by the second device includes m SA identifiers
  • the second data plane security module selects m SA information from the SA database based on the m SA identifiers. information.
  • the second device and the first device do not need to first negotiate to generate SA information, but the second device based on the SA identification in the received message
  • the m pieces of SA information are obtained from the SA database, and the received message is safely processed through the m pieces of SA information, thereby improving security processing efficiency and saving network resource overhead.
  • the second device reports the security capability of the second device to the third device, where the security capability includes at least one supported security processing algorithm and/or at least one supported data plane security protocol, so as to support the third device.
  • the third device generates at least one piece of SA information based on the security capability of the first device, the security capability of the second device, and a security policy between the first device and the second device, and saves the at least one piece of SA information in the SA database.
  • the security policy is used to indicate target security processing and target data plane security protocol
  • the SA identifier in each SA information is assigned by the third device
  • the security parameter in each SA information is the parameter specified by the security policy and is A parameter supported by both the security capability of the first device and the capability of the second device.
  • the third device is a management device, and the management device is configured to generate, for each of the at least three devices, the SA information required by each device and the communication peer device of each device , the at least three devices include a first device and a second device, and a negotiating device corresponding to the second device is used for negotiating SA information required by the second device and a communication peer device for the second device.
  • the third device centrally generates SA information for the first device and the second device, the first device and the second device do not need to deploy a negotiation module for negotiating to generate SA information, saving the calculation of the first device and the second device resource.
  • the third device is a negotiating device corresponding to the second device, and the negotiating device corresponding to the second device is used for negotiating SA information required by the second device and the communication peer device for the second device.
  • the second device and the peer communication device of the second device are devices in different regions (such as different countries), so that the negotiation device generates SA information for the second device to ensure that the second device can obtain the SA information.
  • the first SA information further includes an aging time.
  • the second device obtains the second SA information and replaces the first SA information with the second SA information.
  • the address included in the second SA information is the same as the first SA information.
  • the included addresses are the same, and the security parameters included in the second SA information are different from the security parameters included in the first SA information. In this way, the first SA information is updated at regular intervals, preventing the first SA information from being compromised for a long time and improving security.
  • the security parameter of the first SA information includes a security processing algorithm and the first parameter required by the security processing algorithm
  • the security parameter of the second SA information includes the security processing algorithm and the second parameter required by the security processing algorithm. parameter, the first parameter and the second parameter are different. In this way, the parameters required by the security processing algorithm are updated at regular intervals, preventing the first parameter from being compromised for a long time and improving security.
  • the second data plane security processing module acquires m pieces of SA information corresponding to the m SA identities from the SA database through a public interface based on the m SA identities. In this way, each data plane security processing module accesses the SA database through a public interface, so that different database security processing modules can share the SA information in the SA database, so that the management and use of SA information are unbound.
  • the public interface includes a publish/subscribe Pub/Sub interface.
  • the second security processing includes one or more of the following: decryption processing, authentication processing, anti-tampering processing, or anti-replay processing.
  • the present application provides a method for obtaining security association SA information, in which method: obtain the security capability of the first device, the security capability of the second device, and the information between the first device and the second device security policy.
  • the security capability of the first device includes the security processing algorithm supported by the first device and/or the data plane security protocol supported by the first device
  • the security capability of the second device includes the security processing algorithm supported by the second device and/or the security protocol supported by the second device
  • the data plane security protocol of , the security policy is used to indicate the target security processing and the target data plane security protocol.
  • At least one piece of SA information is generated, and each piece of SA information in the at least one piece of SA information includes a first address, an SA identifier, and a security parameter; the security parameter is The parameters specified by the security policy are parameters supported by both the security capability of the first device and the security capability of the second device.
  • the first device and the second device do not need to include a negotiation module, thereby saving computing resources of the first device and the second device.
  • attribute information corresponding to at least one piece of SA information is generated based on the security capability of the first device, the security capability of the second device, and the security policy, and the attribute information corresponding to the first SA information in the at least one piece of SA information is
  • the information includes one or more data plane security protocols capable of using the first SA information.
  • the filter condition for the data plane security processing module to obtain SA information includes the data plane security protocol required by the data plane security processing module, In this way, different data plane security processing modules obtain SA information corresponding to data plane security protocols required by different data plane security processing modules based on filter conditions, so that the use of SA information is unbound from the negotiation and management of SA information, and the management of network security protocols is simplified. , to improve scalability.
  • the protocol set and the algorithm set are acquired based on the security capability of the first device, the security capability and the security policy of the second device.
  • the protocol set is the intersection of the data plane security protocol supported by the first device, the data plane security protocol supported by the second device, and the target data plane security protocol
  • the algorithm set is the security processing algorithm supported by the first device and the security processing algorithm supported by the second device Intersection of supported security processing algorithms. Based on the set of protocols, the set of algorithms and the target security process, at least one piece of SA information is generated.
  • the security parameters in the first SA information include the first security processing algorithm and parameters required by the first security processing algorithm
  • the first security processing algorithm is an algorithm in the algorithm set
  • the first security processing algorithm is a protocol in the protocol set.
  • At least one piece of SA information is stored in the SA database corresponding to the first device, and/or at least one piece of SA information is stored in the SA database corresponding to the second device.
  • the present application provides an apparatus for processing packets, configured to execute the method in the first aspect or any possible implementation manner of the first aspect.
  • the apparatus includes a unit for executing the method in the first aspect or any possible implementation manner of the first aspect.
  • the present application provides an apparatus for processing packets, configured to execute the method in the second aspect or any possible implementation manner of the second aspect.
  • the apparatus includes a unit for executing the second aspect or the method in any possible implementation manner of the second aspect.
  • the present application provides an apparatus for acquiring SA information, which is used to execute the method in the third aspect or any possible implementation manner of the third aspect.
  • the apparatus includes a unit for executing the third aspect or the method in any possible implementation manner of the third aspect.
  • the present application provides a device for processing packets, where the device includes a processor and a memory.
  • the processor and the memory may be connected through an internal connection.
  • the memory is used to store a program
  • the processor is used to execute the program in the memory, so that the device completes the method in the first aspect or any possible implementation manner of the first aspect.
  • the present application provides a device for processing packets, where the device includes a processor and a memory.
  • the processor and the memory may be connected through an internal connection.
  • the memory is used to store a program
  • the processor is used to execute the program in the memory, so that the device completes the method in the second aspect or any possible implementation manner of the second aspect.
  • the present application provides a device for acquiring SA information, where the device includes a processor and a memory.
  • the processor and the memory may be connected through an internal connection.
  • the memory is used to store a program, and the processor is used to execute the program in the memory, so that the device completes the third aspect or the method in any possible implementation manner of the third aspect.
  • the present application provides a computer program product, the computer program product includes a computer program stored in a computer-readable storage medium, and the calculation program is loaded by a processor to implement the above-mentioned first aspect and the first aspect.
  • the present application provides a computer-readable storage medium for storing a computer program, and the computer program is loaded by a processor to execute the first aspect, the second aspect, the third aspect, and the first aspect Any possible implementation manner, any possible implementation manner of the second aspect, or any possible implementation manner of the third aspect.
  • the present application provides a chip, including a memory and a processor, the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to perform the above-mentioned first aspect, second aspect, A method of the third aspect, any possible implementation of the first aspect, any possible implementation of the second aspect, or any possible implementation of the third aspect.
  • the present application provides a device for processing messages, including a memory and a processor, the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to perform the above-mentioned first aspect,
  • the second aspect any possible implementation of the first aspect, or a method of any possible implementation of the second aspect.
  • the present application provides a device for obtaining security association SA information, including a memory and a processor, the memory is used to store computer instructions, and the processor is used to call and run the computer instructions from the memory to execute the above third A method of any possible implementation of the aspect or the third aspect.
  • the present application provides a system for processing messages, including the device described in the fourth aspect and the device described in the fifth aspect, or, including the device described in the seventh aspect and the device described in the eighth aspect installation.
  • system further includes the device described in the sixth aspect or the device described in the ninth aspect.
  • Fig. 1 is the flow chart of the negotiation key generation provided by the embodiment of the present application.
  • FIG. 2 is a flow chart of SA negotiation establishment provided by an embodiment of the present application.
  • FIG. 3 is a flowchart of the negotiated key exchange provided by the embodiment of the present application.
  • FIG. 4 is a schematic diagram of a network architecture provided by an embodiment of the present application.
  • FIG. 5 is a schematic diagram of another network architecture provided by an embodiment of the present application.
  • FIG. 6 is a schematic diagram of another network architecture provided by an embodiment of the present application.
  • FIG. 7 is a schematic diagram of another network architecture provided by an embodiment of the present application.
  • FIG. 8 is a flow chart of a method for centralized acquisition of SA information provided by an embodiment of the present application.
  • FIG. 9 is a flow chart of a method for distributed acquisition of SA information provided by an embodiment of the present application.
  • FIG. 10 is a flow chart of a method for processing a message provided in an embodiment of the present application.
  • FIG. 11 is a flow chart of another method for processing messages provided by the embodiment of the present application.
  • FIG. 12 is a schematic structural diagram of a device for processing messages provided by an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram of another device for processing messages provided by the embodiment of the present application.
  • FIG. 14 is a schematic structural diagram of a device for acquiring SA information provided by an embodiment of the present application.
  • FIG. 15 is a schematic structural diagram of a device for processing messages provided by an embodiment of the present application.
  • FIG. 16 is a schematic structural diagram of another device for processing messages provided by an embodiment of the present application.
  • FIG. 17 is a schematic structural diagram of an apparatus for acquiring SA information provided by an embodiment of the present application.
  • cross-network links are insecure, ranging from personal privacy to state secrets. If data is to be transmitted from one end of the Internet to the other, it will face network security problems.
  • the sending end uses the SA information to perform security processing on the data to be sent, and sends the securely processed data to the receiving end.
  • each layer protocol contains a security processing solution.
  • security processing solutions include media access control security (media access control security, MACSec), Internet protocol security (internet protocol security, IPSec), and/or secure sockets layer (secure sockets layer, SSL), etc.
  • MACSec defines a method for data security communication based on IEEE 802 local area network. MACSec can provide users with secure MAC layer data sending and receiving services, including user data encryption and decryption, data frame integrity check, data source authenticity check, and replay protection.
  • the MACsec key agreement (MACSec key agreement, MKA) in MACSec defines the key management protocol, and defines that the protocol message still adopts the 802.1X message format. MACSec is an improvement and extension to the original 802.1X protocol.
  • MACSec uses Layer 2 encryption technology to provide secure data transmission hop by hop.
  • MKA defines that devices use the configured pre-shared key (Pre-Shared Key, PSK) as the secure connection association key (secure Connectivity Association Key, CAK), and negotiate sessions through EAPOL-MKA messages (wherein, EAPOL is based on LAN The full English name of EAPOL is: extensible authentication protocol over LAN).
  • MKA elects ports with higher priority among multiple devices as Key Server, and Key Server is responsible for generating and distributing secure association key (SAK).
  • MI member identifier
  • MN Message Number
  • CA1 and CA2 are members of the certificate authority (CA) associated with the same secure link.
  • IPsec is a three-layer tunnel encryption protocol proposed by the Internet Engineering Task Force (IETF), which provides high-quality, interoperable, and cryptography-based security guarantees for data transmitted on the Internet. .
  • IETF Internet Engineering Task Force
  • Specific communication parties provide the following security services through encryption and data source authentication at the IP layer: data confidentiality, data integrity, data source authentication, and anti-replay.
  • Internet key exchange (IKE) in IPSec can realize the auto-negotiation function of the key and reduce the overhead of key negotiation.
  • SA services can be established and maintained through IKE, which simplifies the use and management of IPsec.
  • Internet key exchange version 2 Internet key exchange version 2, IKEv2 just can complete the negotiation and establishment of the first pair of IPSec SA through the initial exchange.
  • messages 1 and 2 belong to the first exchange (called IKE_SA_INIT exchange), and the IKE SA parameter negotiation is completed in plain text, including negotiating encryption and verification algorithms, exchanging temporary random numbers and Diffie-Hellman ( diffie-hellman, DH) exchange.
  • IKE_SA_INIT is exchanged, a shared key material is generated, and all keys of IPSec SA can be derived from this shared key material.
  • IKE_AUTH exchange the second exchange
  • IKEv2 supports asymmetric encryption (RSA) signature authentication, pre-shared key authentication, and extended authentication protocol (extensible authentication protocol, EAP).
  • EAP authentication is implemented in IKE as an additional IKE_AUTH exchange, and the initiator indicates the need to use EAP authentication by omitting the authentication payload in message 3.
  • SSL solves the security problem of the World Wide Web and is located between the application layer and the transport layer.
  • SSL can theoretically provide security guarantees for all application layer protocols based on reliable connections such as Transmission Control Protocol (transmission control protocol, TCP).
  • TCP transmission control protocol
  • SSL also uses data encryption, identity verification and message integrity verification mechanisms to ensure the security of data transmitted over the network.
  • SSL has become a global standard for identifying sites and web browsers on the Internet, and encrypting communications between browser users and web servers.
  • the SSL protocol has been integrated into most browsers, such as Internet Explorer, Google Chrome, Firefox, etc. This means that any computer with a browser supports SSL connections. No need to install additional client (client) software.
  • the SSL handshake protocol is used to negotiate the cipher suite (encryption algorithm, key exchange algorithm and MAC algorithm, etc.) used in the communication process, securely exchange keys between the server and the client, and realize the authentication of the server and the client.
  • the process includes the following steps 1-5.
  • client_hello the request initiated by the client, transmits the request information in plain text, including version information, cipher suite candidate list, compression algorithm candidate list, random number, extension field and other information.
  • the list of cipher suites supported by the client, each cipher suite corresponds to the combination of four functions in the previous transport layer security (TLS) principle: authentication algorithm Au (for identity verification), key exchange Algorithm KeyExchange (for key agreement), symmetric encryption algorithm Enc (for information encryption) and information digest Mac (for integrity verification).
  • TLS transport layer security
  • server_hello returns the negotiated information result for the server, including the selected protocol version (version), selected cipher suite (cipher suite), selected compression algorithm (compression method), random number (random_S), etc., where the random number is used for the subsequent key negotiation.
  • server_certificates configure the corresponding certificate chain for the server side, which is used for authentication and key exchange.
  • server_hello_done used to notify the client that the server_hello message has been sent.
  • client_key_exchange after the legality verification is passed, the client calculates and generates a random number "Pre-master", encrypts it with the certificate public key, and sends it to the server.
  • the client has obtained all the information needed to calculate the negotiation key, including: two plaintext random numbers random_C and random_S, the Pre-master generated by its own calculation, and the calculated negotiation key.
  • the client notifies the server that subsequent communications will be encrypted using the negotiated communication key and encryption algorithm.
  • encrypted_handshake_message combined with the hash (hash) value of all communication parameters and other relevant information to generate a piece of data, encrypted with the negotiated key session secret and algorithm, and then sent to the server for data and handshake verification.
  • change_cipher_spec after the verification is passed, the server also sends change_cipher_spec to inform the client that the subsequent communication will use the negotiated key and algorithm for encrypted communication.
  • the server also combines all current communication parameter information to generate a piece of data and encrypts it with the negotiated key session secret and algorithm and sends it to the client.
  • Each network security protocol has its own control plane key agreement protocol (SA producer) and data plane encryption protocol (SA consumer).
  • SA producer uses MKA to negotiate SA
  • IPSec uses IKE to negotiate SA.
  • SA producer uses the control plane key negotiation protocol (SA producer) to negotiate SA
  • SA consumer uses the data plane encryption protocol (SA consumer) in this connection to encrypt the transmitted data . That is, the SA negotiated for a connection can only protect the communication data on the data plane of this link. Therefore, there is currently a strong binding between SA negotiation management on the control plane and SA usage on the data plane, complex management, poor scalability, and difficulty in adding new encryption features (eg, double encryption).
  • the embodiment of the present application provides a network architecture 100 , including: a first device 101 and a second device 102 , and there is a communication connection between the first device 101 and the second device 102 .
  • both the first device 101 and the second device 102 are located in a communication network, and the first device 101 establishes a communication connection with the second device 102 in the communication network, so as to realize the communication between the first device 101 and the second device.
  • Device 102 communicates.
  • there are other ways to implement communication between the first device 101 and the second device 102 which will not be listed here.
  • the first device 101 has a corresponding first SA database 103, and the first SA database 103 is used to store N pieces of SA information, where N is a natural number greater than 0.
  • each piece of SA information includes an address, an SA identifier, and a security parameter.
  • the first SA database 103 further includes attribute information corresponding to the N pieces of SA information.
  • the first SA database 103 includes a correspondence between SA information and attribute information, and for each SA information in the N pieces of SA information, the correspondence is used to store each SA information and the attribute information corresponding to each SA information.
  • this SA information is referred to as the first SA information
  • the attribute information corresponding to the first SA information includes one or more data planes that can use the first SA information Security Protocol.
  • the first device 101 includes at least one data plane security processing module, and the first device 101 uses the SA information to perform first security processing on the message sent by the first device 101 to the second device.
  • the destination address of the message to be sent is the address of the second device 102
  • the first data plane security processing module in the first device 101 uses the security parameters included in the m pieces of SA information to treat The payload of the sent message is subjected to first security processing.
  • m is an integer greater than 0 and less than or equal to N
  • the m pieces of SA information are SA information in the first SA database 103 and the address included in the m pieces of SA information is the address of the second device 102 .
  • the first data plane security processing module is any one of at least one data plane security processing module included in the first device 101, and adds the SA identifiers of the m pieces of SA information to the message to be sent to obtain the first message, the first The payload of a message is the payload after the first security processing. Then the communication interface of the first device 101 sends the first packet to the second device 102 .
  • the first device 101 includes multiple data plane security processing modules, that is, the first device 101 includes two data plane security processing modules or more than two data plane security processing modules. At least two data plane security processing modules in the plurality of data plane security processing modules have permission to access the first SA database 103 .
  • the first data plane security processing module in the first device 101 corresponds to at least one data plane security protocol.
  • Data plane security protocols corresponding to each data plane security processing module in the first device 101 may be different.
  • the data plane security protocol corresponding to the first data plane security processing module is configured by a network administrator. After the network administrator configures the data plane security protocol corresponding to the first data plane security processing module, the network administrator may also modify the data plane security protocol corresponding to the first data plane security processing module.
  • the data plane security protocol includes but is not limited to one or more of the following: IPSec, MACSec, segment routing internet protocol version 6 security (segment routing internet protocol version 6 security, SRv6Sec) or SSL.
  • the detailed process of processing the packet to be sent by the first device 101 will be described later in the embodiment shown in FIG. 10 , and will not be described in detail here.
  • the second device 102 has a corresponding second SA database 104, and the second SA database 104 is used to store M pieces of SA information.
  • the part of SA information existing in the first SA database 103 is the same as the part of SA information existing in the second SA database 104 , the number of identical SA information is greater than or equal to m, and M is a natural number greater than or equal to m.
  • the second SA database 104 further includes attribute information corresponding to the M pieces of SA information.
  • the second SA database 104 includes a correspondence between SA information and attribute information, and the correspondence is used to store each piece of SA information among the M pieces of SA information and the attribute information corresponding to each piece of SA information.
  • the second device 102 includes at least one data plane security processing module, and after the first device 101 sends the first message, the communication interface of the second device 102 receives the first message.
  • the second data plane security processing module in the second device 102 acquires m SA information corresponding to the m SA identifiers from the second SA database 104 based on the m SA identifiers included in the first message, and based on the m SA identifiers, The security parameters included in the information perform the second security processing on the payload included in the first packet.
  • the second data plane security processing module is any one of at least one data plane security processing module included in the second device 102 .
  • the second device 102 includes multiple data plane security processing modules, that is, the second device 102 includes two data plane security processing modules or more than two data plane security processing modules. At least two data plane security processing modules in the plurality of data plane security processing modules have permission to access the second SA database 104 .
  • the second data plane security processing module in the second device 102 corresponds to at least one data plane security protocol.
  • Data plane security protocols corresponding to each data plane security processing module in the second device 102 may be different.
  • the data plane security protocol corresponding to the second data plane security processing module is configured by the network administrator. After the network administrator configures the data plane security protocol corresponding to the second data plane security processing module, the network administrator may also modify the data plane security protocol corresponding to the second data plane security processing module.
  • the detailed process of processing the first packet by the second device 102 will be described later in the embodiment shown in FIG. 11 , and will not be described in detail here.
  • the first device 101 and the second device 102 use the same SA information between the first SA database 103 and the second SA database 104 to perform security processing on the message sent by the first device 101 to the second device 102, thereby improving the transmission efficiency. message security.
  • the same SA information includes first SA information
  • the security parameters included in the first SA information are parameters required by the first device 101 to perform the first security process and the second device 102 to perform the second security process.
  • the security parameter includes information such as a security processing algorithm and parameters required by the security processing algorithm
  • the security processing algorithm is an algorithm for implementing the first security processing and the second security processing.
  • the first security processing includes, but is not limited to, one or more of the following: encryption processing, authentication processing, anti-tampering processing, or anti-replay processing.
  • the second security processing includes but is not limited to one or more of the following: decryption processing, authentication processing, anti-tampering processing or anti-replay processing.
  • the security parameters include information such as encryption and decryption algorithms and parameters required by the encryption and decryption algorithms.
  • the first security processing implemented by the encryption and decryption algorithm is encryption processing
  • the second security processing implemented by the encryption and decryption algorithm is decryption processing.
  • the parameters required by the encryption and decryption algorithm include parameters such as keys and/or key lengths.
  • the first security processing includes encryption processing and authentication processing
  • the second security processing includes decryption processing and authentication processing. That is to say, after the first device 101 encrypts the payload of the message to be sent, it also calculates the encrypted payload to obtain the first information digest, wherein the first message sent by the first device 101 also includes the first information Summary.
  • the second device 102 calculates the payload in the first message to obtain the second information digest, compares the first information digest and the second information digest, and if the comparison shows that the first information digest and the second information digest are the same, then the first The packet authentication is passed, and the payload in the first packet is decrypted.
  • the security processing algorithm includes an encryption and decryption algorithm and an algorithm for calculating information digests
  • the security parameters include encryption and decryption algorithms, an algorithm for calculating information digests, the Information such as the parameters required by the encryption and decryption algorithm and the parameters required by the algorithm used to calculate the information digest.
  • the first SA information further includes, but is not limited to, one or more items of the following information: aging time or security mode.
  • the security mode includes, but is not limited to, one or more of the following modes: encryption mode, authentication mode, and the like.
  • the first security process and/or the second security process is a process for increasing the security of data transmitted between the first device 101 and the second device 102 .
  • the first device 101 is a terminal device or a routing device, etc.
  • the second device 102 is a terminal device or a routing device, etc.
  • the routing device is a device such as a router, a switch, or a gateway.
  • the first device 101 and the second device 102 are two edge routing devices of an untrusted network, and the first device 101 sends a message to the second device 102 through the network. Since the network is untrustworthy, the first device 101 and the second device 102 need to perform security processing on the packet.
  • the first device 101 includes a first SA database 103, or the device where the first SA database 103 is located is a different device from the first device 101, for example, the first SA database 103 is located on a storage device .
  • the second device 102 includes the second SA database 104, or the device where the second SA database 104 is located is a different device from the second device 102, for example, the second SA database 104 is located on a storage device .
  • the first SA database 103 and the second SA database 104 are located on the same storage device, the first SA database 103 and the second SA database 104 are the same SA database, and the SA database and the first device The address of 101 is bound to the address of the second device 102.
  • the embodiment of the present application provides various schemes for negotiating and generating an SA database corresponding to each communication peer device.
  • one of the solutions is to adopt a centralized SA negotiation solution.
  • FIG. 5 there is a dedicated negotiation management device in the network, which is used to generate each device for each device in at least three devices.
  • the SA information required by the peer device for communication with each device, the at least three devices include the first device 101 and the second device 102 .
  • each communication peer device has a corresponding negotiation device.
  • the first negotiating device corresponding to the first device 101 negotiates for the first device 101 the SA information required by the first device 101 and the communication peer device.
  • the network architecture 100 further includes a third device 105 , and the third device 105 communicates with the first device 101 and the second device 102 respectively.
  • the third device is a negotiation management device, configured to generate SA information for multiple devices in the network according to security capabilities and security policies of the multiple devices in the centralized SA negotiation solution shown in FIG. 5 .
  • the third device 105 is located in a communication network, and the third device 105 establishes a communication connection with the first device 101 in the communication network, so as to realize communication with the first device 101 .
  • the third device 105 establishes a communication connection with the second device 102 in the communication network, so as to realize communication with the second device 102 .
  • the third device 105 is configured to generate, for each of at least three devices, SA information required by each device and a communication peer device of each device, the at least three devices including the first device 101 .
  • the communication peer device of the first device 101 is the second device 102 .
  • the third device 105 generates at least one piece of SA information based on the security policy between the first device 101 and the second device 102 , the security capability of the first device 101 , and the security capability of the second device 102 . Save at least one piece of SA information in the first SA database 103 , and/or save at least one piece of SA information in the second SA database 104 .
  • the third device 105 generates the at least one SA information correspondence attribute information. In this way, the third device 105 saves each SA information and the attribute information corresponding to each SA information in the corresponding relationship between the SA information and the attribute information included in the first SA database 103, and/or stores each SA information and each The attribute information corresponding to the SA information is stored in the correspondence between the SA information and the attribute information included in the second SA database 104 .
  • the security capability of the first device includes at least one security processing algorithm supported by the first device and/or at least one data plane security protocol supported by the first device, etc.
  • the security capability of the second device includes at least one Content such as a security processing algorithm and/or at least one data plane security protocol supported by the second device.
  • the security policy is used to indicate a target security processing algorithm and/or a target data plane security protocol.
  • the third device 105 includes but is not limited to one or more of the following devices: a controller 1051, a network management device 1052, a quantum key distribution (quantum key distribution, QKD) device 1053 or a data plane security
  • the control plane device corresponding to the protocol is a manual (Manual) control plane device 1054 corresponding to SSL, and the like.
  • the network architecture 100 further includes a first negotiating device 106 corresponding to the first device 101 and a second negotiating device 107 corresponding to the second device 102, the first negotiating device 106 communicates with the first device 101 and the The second negotiating device 107 communicates, and the second negotiating device 107 also communicates with the second device 102 .
  • the first negotiating device 106 and the second negotiating device 107 are located in a communication network, and the first negotiating device 106 respectively establishes a communication connection with the first device 101 and the second negotiating device 107 in the communication network , so as to realize communication with the first device 101 and the second negotiation device 107; the second negotiation device 107 establishes a communication connection with the second device 102 in the communication network, so as to realize communication with the second device 102.
  • the first negotiating device 106 is configured to negotiate for the first device 101 SA information required by the first device 101 and the communication peer device.
  • the second negotiating device 107 is configured to negotiate for the second device 102 SA information required by the second device 102 and the communication peer device.
  • the first device 101 and the first negotiating device 106 are different physical devices, and the second device 102 and the second negotiating device 107 are different physical devices.
  • This situation may be applied to a scenario where the first device 101 and the second device 102 are located in different regions (such as different countries).
  • the first device 101 and the first negotiating device 106 are located in the same area (this area is called the first area), and the second device 102 and the second negotiating device 107 are located in the same area (this area is called the second area).
  • the first negotiating device 106 and the second negotiating device 107 negotiate to generate SA information required by the first device 101 and the second device 102 .
  • the first negotiating device 106 can negotiate and generate SA information required by each device and a communication peer device of each device for each device in the first area.
  • the second negotiating device 107 can negotiate and generate SA information required by each device and its communication peer device for each device in the second area.
  • the first device 101 and the first negotiating device 106 are integrated into the same physical device, and the second device 102 and the second negotiating device 107 are integrated into the same physical device.
  • the first negotiating device 106 is a negotiating module in the first device 101
  • the second negotiating device 107 is a negotiating module in the second device 102 .
  • the first negotiating device 106 is a server or a control plane device corresponding to a data plane security protocol
  • the second negotiating device 107 is a server or a control plane device corresponding to a data plane security protocol.
  • the first negotiating device 106 is an MKA control plane device corresponding to MACSec, and the second negotiating device 107 is also an MKA control plane device.
  • the first negotiating device 106 is an IKE control plane device corresponding to IPSec, and the second negotiating device 107 is also an IKE control plane device.
  • the centralized mode is applied to the network architecture 100 shown in FIG. 5 or FIG. 6 , and in the centralized mode, the third device generates at least one piece of SA information. Save the at least one SA information in a first SA database (such as the first SA database 103 shown in FIG. 5 or FIG. 6 ), and/or save the at least one SA information in a second SA database (such as the first SA database 103 shown in FIG. 5 Or in the second SA database 104 shown in FIG. 6).
  • a first SA database such as the first SA database 103 shown in FIG. 5 or FIG. 6
  • a second SA database such as the first SA database 103 shown in FIG. 5 Or in the second SA database 104 shown in FIG. 6.
  • the centralized mode is realized through the following steps 501 to 505 during implementation.
  • the process in the centralized mode shown in steps 501 to 505 includes steps 501-505.
  • Step 501 The first device reports the security capability of the first device to the third device.
  • the security capability of the first device includes at least one security processing algorithm supported by the first device and/or at least one data plane security protocol supported by the first device, etc. .
  • the at least one secure processing algorithm supported by the first device is a secure processing algorithm included in the first device.
  • the first device includes at least one data plane security processing module, and each data plane security processing module corresponds to at least one data plane security protocol. Therefore, the first device acquires the data plane security protocol corresponding to each data plane security processing module it includes, so as to obtain at least one data plane security protocol supported by the first device.
  • the data plane security processing module may call one or more security processing algorithms in the first device, and use the called security processing algorithm to implement the first security processing.
  • the security processing algorithm used to implement the encryption processing is an encryption and decryption algorithm.
  • the first device includes one or more encryption and decryption algorithms, and the data plane security processing module calls the encryption and decryption algorithms in the first device, and uses the called encryption and decryption algorithms to implement encryption processing.
  • the first security processing includes encryption processing and authentication processing
  • the first device includes one or more encryption and decryption algorithms, and one or more algorithms for calculating information digests
  • the data plane security processing module calls the first
  • the encryption and decryption algorithm in the device and the algorithm for calculating the information summary, and the encryption and decryption algorithm and the algorithm for calculating the information summary are used to realize encryption processing and authentication processing.
  • the security processing algorithm corresponds to the data plane security protocol
  • the first device uses the security processing algorithm to implement security based on the data plane. Protocol's first security handle.
  • the data plane security protocols supported by the first device include one or more of the following: MACSec, IPSec, SSL, or SRv6Sec.
  • the first device may include an encryption and decryption algorithm corresponding to IPSec and/or an algorithm for calculating information digests, and the first device uses the encryption and decryption algorithms and/or an algorithm for calculating information digests to implement encryption based on IPSec Processing and/or Authentication Processing.
  • the first device may also include an encryption and decryption algorithm corresponding to MACSec and/or an algorithm for calculating an information digest, and the first device uses the encryption and decryption algorithm and/or an algorithm for calculating an information digest to implement MACSec encryption processing and/or authentication processing.
  • the first device sends the first device information to the third device, where the first device information includes the algorithm identification of at least one security processing algorithm supported by the first device and/or at least one data plane security algorithm supported by the first device Protocol identification and other information of the protocol, so as to report the security capability of the first device to the third device.
  • the first device includes an encryption and decryption algorithm corresponding to MACSec and the address of the first device is "192.168.178.5", and the data plane security protocol supported by the first device includes MACSec.
  • the first device sends the first device information to the third device.
  • the first device information includes the algorithm identifier "ID-MACEncy" of the encryption and decryption algorithm supported by the first device and the protocol identifier "ID-MACEncy" of the data plane security protocol supported by the first device.
  • MAC the algorithm identifier "ID-MACEncy" of the encryption and decryption algorithm supported by the first device and the protocol identifier "ID-MACEncy" of the data plane security protocol supported by the first device.
  • Step 502 The second device reports the security capability of the second device to the third device.
  • the security capability of the second device includes at least one security processing algorithm supported by the second device and/or at least one data plane security protocol supported by the second device, etc. .
  • the second device includes at least one data plane security processing module, and each data plane security processing module corresponds to at least one data plane security protocol. Therefore, the second device obtains the data plane security protocol corresponding to each data plane security processing module it includes, so as to obtain at least one data plane security protocol supported by the second device.
  • the second device also includes at least one security processing algorithm.
  • the data plane security processing module can call one or more security processing algorithms in the second device, using the called security processing algorithm to implement the second security processing.
  • the second security processing includes decryption processing
  • the security processing algorithm used to implement the decryption processing is an encryption and decryption algorithm
  • the second device includes one or more encryption and decryption algorithms
  • the data plane security processing module calls the second device Encryption and decryption algorithm in , use the encryption and decryption algorithm called to realize the decryption process.
  • the second device includes one or more encryption and decryption algorithms, and one or more algorithms for calculating information digests
  • the data plane security processing module calls the second The encryption and decryption algorithm in the device and the algorithm for calculating the information digest use the invoked encryption and decryption algorithm and the algorithm for calculating the information digest to implement decryption processing and authentication processing.
  • the security processing algorithm corresponds to the data plane security protocol
  • the second device uses the security processing algorithm to implement the second security processing algorithm based on the data plane security protocol. Safe handling.
  • the second device sends the second device information to the third device, where the second device information includes an algorithm identification of at least one security processing algorithm supported by the second device and/or at least one data plane security algorithm supported by the second device Protocol identification and other information of the protocol, so as to report the security capability of the second device to the third device.
  • the second device includes an encryption and decryption algorithm corresponding to MACSec and the address of the second device is "192.168.1.4", and the data plane security protocol supported by the second device includes MACSec.
  • the second device sends the second device information to the third device.
  • the second device information includes the algorithm identifier "ID-MACEncy" of the encryption and decryption algorithm supported by the second device and the protocol identifier "ID-MACEncy" of the data plane security protocol supported by the second device.
  • MAC the protocol identifier
  • Step 503 The third device obtains a security policy, the security policy includes a first address, a second address and security requirement information, the first address is the address of the second device, and the second address is the address of the first device.
  • the security requirement information is used to indicate the target security processing and the target data plane security protocol, and the security requirement information essentially indicates that target security processing based on the target data plane security protocol needs to be performed on the message sent by the first device to the second device.
  • the security requirement information includes the processing type of the target security process and the protocol identifier of the target data plane security protocol.
  • the first address is the destination address of the message, and the second address is the source address of the message.
  • the security policy includes the first address as "192.168.1.4”, the second address as "192.168.178.5", the target security processing type includes encryption, and the protocol identification of the target data plane security protocol includes "ID-MAC” and "ID-MAC”.
  • -SRv6 "ID-SRv6” is the protocol identifier of SRv6Sec.
  • 192.168.1.4 is the address of the second device
  • 192.168.178.5 is the address of the first device.
  • This security policy is used to indicate that the message of the second device needs to be sent to the first device, and encryption processing based on SRv6Sec is performed, and/ Or, perform encryption processing based on IPSec.
  • the third device displays an input interface, and network administrators input the security policy in the input interface, and the third device acquires the security policy from the input interface.
  • the network management personnel input the security policy on their corresponding network management equipment, the network management equipment sends the security policy to the third device, and the third device receives the security policy.
  • step 501 may be executed first, then step 502, and then step 503 may be executed; or, step 502 may be executed first, then step 501, Then step 503 is executed; or, step 503 may be executed first, then step 501 is executed, and then step 502 is executed; or, step 501, step 502, and step 503 may be executed simultaneously.
  • the execution order among step 501 , step 502 and step 503 may have other orders besides the several orders listed above, which will not be listed here.
  • Step 504 The third device obtains the security capability of the first device and the security capability of the second device, and generates at least one piece of SA information based on the security capability of the first device, the security capability of the second device and the security policy.
  • the third device further generates attribute information corresponding to at least one piece of SA information based on the security capability of the first device, the security capability of the second device, and the security policy.
  • the third device receives the first device information and the second device information, so as to obtain the security capability of the first device and the security capability of the second device.
  • the SA information is referred to as first SA information
  • the first SA information includes content such as a first address, an SA identifier, and a security parameter.
  • the security parameter is a parameter required by the first device to perform the first security process and the second device to perform the second security process, and the first security process needs to be implemented using a security process algorithm. Therefore, the security parameter includes information such as a security processing algorithm and parameters required by the security processing algorithm.
  • the security parameter is a parameter specified by a security policy and is a parameter supported by both the security capability of the first device and the capability of the second device.
  • the first SA information further includes one or more of the following information: an aging time of the first SA information, a security mode corresponding to the first SA information, and the like.
  • the security mode includes an authentication mode and/or an encryption mode and the like.
  • the aging time is the effective time for the existence of the first SA information.
  • the first SA information includes the first address "192.168.1.4", SA identifier "ID-SA1", security parameters, aging time "24 hours” and encryption mode.
  • the security parameters include the encryption and decryption algorithm and the key "secret key” required by the encryption and decryption algorithm.
  • the first SA information indicates that the first device uses the encryption and decryption algorithm to encrypt the message sent by the first device to the second device, and the second device uses the encryption and decryption algorithm to decrypt the message when receiving the message .
  • the attribute information includes one or more data plane security protocols that can use the first SA information.
  • the attribute information also includes the source of the first SA information.
  • the source of SA information refers to the producer of SA.
  • the source of the first SA information is the third device.
  • step 504 the SA information and the attribute information corresponding to the SA information are generated through the following 5041-5044 operations.
  • the operations of the 5041-5044 are respectively:
  • the third device acquires a protocol set based on the first device information, the second device information, and the security requirement information, where the protocol set is the data plane security protocol supported by the first device, the data plane security protocol supported by the second device, and the protocol set. The intersection of the data plane security protocols indicated by the security requirement information.
  • the third device acquires first device information including the second address and second device information including the first address from received device information based on the first address and the second address in the security policy.
  • the third device determines at least one data plane security protocol supported by the first device based on the protocol identifier of the at least one data plane security protocol supported by the first device included in the first device information.
  • Determine at least one data plane security protocol supported by the second device based on the protocol identifier of the at least one data plane security protocol supported by the second device included in the second device information.
  • the target data plane security protocol indicated by the security requirement information is determined.
  • the at least one data plane security protocol supported by the first device, the at least one data plane security protocol supported by the second device, and the target data plane security protocol indicated by the security requirement information are intersected to obtain a protocol set.
  • the third device obtains the first device information including "192.168.178.5" based on the second address "192.168.178.5" and obtains the second device information including "192.168.1.4" based on the first address "192.168.1.4” .
  • the protocol identifier "ID-MAC” included in the first device information it is determined that the data plane security protocol supported by the first device is MACSec.
  • the protocol identifier "ID-MAC” included in the second device information it is determined that the data plane security protocol supported by the second device is MACSec.
  • the target data plane security protocol includes MACSec and SRv6Sec.
  • the MACSec supported by the first device, the MACSec supported by the second device, and the target data plane security protocols MACSec and SRv6Sec are intersected to obtain a protocol set, and the protocol set includes MACSec.
  • the third device acquires an algorithm set based on the first device information and the second device information, where the algorithm set is the intersection of the security processing algorithms supported by the first device and the security processing algorithms supported by the second device.
  • the third device determines at least one security processing algorithm supported by the first device based on the algorithm identifier of the at least one security processing algorithm supported by the first device included in the first device information. Based on the algorithm identifier of the at least one secure processing algorithm supported by the second device included in the second device information, at least one secure processing algorithm supported by the second device is determined. An intersection of at least one security processing algorithm supported by the first device and at least one security processing algorithm supported by the second device is performed to obtain an algorithm set.
  • the encryption and decryption algorithm ENcryption supported by the first device determines the encryption and decryption algorithm ENcryption supported by the first device
  • the encryption and decryption algorithm ENcryption supported by the second device determines the encryption and decryption algorithm ENcryption supported by the second device.
  • Encryption and decryption algorithm Encryption The encryption and decryption algorithm Encryption supported by the first device and the encryption and decryption algorithm Encryption supported by the second device are intersected to obtain an algorithm set, where the algorithm set includes the encryption and decryption algorithm Encryption.
  • the third device generates at least one piece of SA information based on the protocol set, the algorithm set, and the target security process indicated by the security requirement information.
  • the third device determines the target security processing corresponding to the target security processing type, selects one or more security processing algorithms to realize the target security processing from the algorithm set, and the data plane security corresponding to each selected security processing algorithm protocol is the protocol in this collaboration collection.
  • the third device further assigns an aging time to the SA information, and/or determines a security mode based on the target security process, and the SA information also includes the aging time and/or security mode and other content.
  • the target security processing type includes encryption
  • the encryption and decryption algorithm Encryption for implementing encryption is selected from the encryption and decryption algorithm Encryption included in the algorithm set.
  • Based on the encryption and decryption algorithm Encryption configure the key "secret key" required by the encryption and decryption algorithm Encryption.
  • the assigned SA identifier is "ID-SA1”
  • the assigned aging time is 24 hours
  • the security mode determined based on the target security processing type is encryption, thus obtaining an SA information.
  • the SA information includes a first address "192.168.1.4", an SA identifier "ID-SA1", a security parameter, an aging time of "24 hours” and an encryption mode.
  • the security parameters include the encryption and decryption algorithm Encryption and the key "secret key”.
  • the third device selects a security processing algorithm from the algorithm set for multiple times, and the security processing algorithm selected each time is different, so as to generate multiple pieces of SA information.
  • the third device generates attribute information corresponding to each SA information based on each security processing algorithm in each SA information.
  • the attribute information corresponding to the SA information includes a data plane security protocol corresponding to each security processing algorithm in the SA information, and the data plane security protocol in the attribute information is a protocol in the protocol set.
  • the data plane security protocol corresponding to the encryption and decryption algorithm Encryption included in the SA information is MACSec, and MACSec belongs to the protocol in the algorithm set, so the attribute information corresponding to the SA information includes MACSec.
  • the attribute information corresponding to each piece of SA information also includes a source type, where the source type is the device type of the third device.
  • Step 505 the third device saves the at least one SA information in the first SA database, and saves the at least one SA information in the second SA database.
  • the third device also generates attribute information corresponding to the at least one SA information, the third device saves each SA information and the attribute information corresponding to each SA information in the first SA database, and saves the attribute information corresponding to each SA information in the second SA database.
  • Each SA information and attribute information corresponding to each SA information are stored in the database.
  • the third device For the situation that the first SA database is located in the first device, the third device writes (write) interface to the first SA database in the first device based on the second address included in the security policy (as shown in Fig. 5 or the first SA database 103 in FIG. 6) stores each SA information and attribute information corresponding to each SA information.
  • the third device writes to the second SA database in the second device (such as accompanying drawing 4, accompanying drawing 5 or accompanying drawing 6) through the write interface based on the first address included in the security policy.
  • the second SA database 104) stores each SA information and attribute information corresponding to each SA information.
  • the third device determines on the storage device that the first address and the second address are related to the first address and the second address included in the security policy.
  • the SA database bound to the second address saves each SA information and attribute information corresponding to each SA information to the SA database through the write interface.
  • the SA information generated by the third device includes the first address "192.168.1.4", the SA identifier "ID-SA1", security parameters (encryption algorithm Encryption and key "secret key”), The aging time "24 hours", the encryption mode, and the attribute information corresponding to the generated SA information include MACSec.
  • the third device saves the SA information and the attribute information in the first SA database and/or the second SA database, as shown in Table 1 below.
  • the device For the device where the first SA database or the second SA database is located (the first device, the second device or the storage device), when the storage duration of a certain SA information in the device exceeds the aging duration included in the SA information, in order to facilitate Note that the SA information is still referred to as first SA information, and the device sends a notification event to the third device, where the notification event includes the SA identifier of the first SA information.
  • the third device receives the notification event and generates second SA information.
  • the address included in the first SA information is the same as the address included in the second SA information.
  • the SA identifier included in the first SA information may be the same as the SA identifier included in the second SA information.
  • the security parameters included in the first SA information are different from the security parameters included in the second SA information.
  • the third device updates the first SA information in the first SA database and/or the second SA database to the second SA information.
  • the security parameters in the first SA information include a security processing algorithm and a first parameter required by the security processing algorithm
  • the security parameters in the second SA information include a security processing algorithm and a second parameter required by the security processing algorithm.
  • the security processing algorithms in the two security parameters are the same, and the first parameter and the second parameter are different.
  • the network manager can also configure SA information and attribute information corresponding to the SA information in the first SA database and/or the second SA database, and the source of the attribute information included is network manager configuration.
  • the third device after the third device generates the SA information, it saves the SA information in the first SA database or the second SA database, so that the first device needs to send data to the second device when establishing a connection with the second device , the first device may obtain SA information from the first SA database, use the SA information to perform first security processing on the data, and the second device obtains SA information from the second SA database, and use the SA information to perform the first security processing on the received data.
  • Second safe handling In this way, the first device and the second device do not need to first negotiate SA information after establishing a connection each time, thereby improving security processing efficiency and saving network resource overhead.
  • the SA information and the attribute information corresponding to the SA information are uniformly generated by the third device, so that the first device and the second device do not need to generate, saving computing resources of the first device and the second device.
  • the attribute information corresponding to the SA information includes one or more data plane security protocols that can use the SA information
  • the data plane security processing module corresponding to the one or more data plane security protocols can use the SA information to make the control plane SA information.
  • FIG. 9 uses the first device and the second device to negotiate and generate SA information as an example to describe the distributed method in detail.
  • the first negotiating device is a negotiating module in the first device
  • the second negotiating device is a negotiating module in the second device
  • the negotiating module in the first device and the negotiating module in the second device negotiateate and generate SA information required by the first device and the second device (as shown in FIG. 7 ).
  • the negotiating subject is described by the first device and the second device.
  • the distributed mode is realized through the following steps 601 to 608 during implementation.
  • Step 601 The first device acquires a security policy between the first device and the second device, where the security policy is used to indicate a target security process and a target data plane security protocol.
  • the security policy includes a first address, a second address, and security requirement information
  • the first address is the address of the second device
  • the second address is the address of the first device
  • the security requirement information includes target security processing The processing type and the protocol identification of the target data plane security protocol.
  • the first device displays an input interface, and network administrators input the security policy on the input interface displayed by the first device.
  • the first device obtains the security policy from the input interface.
  • network administrators input the security policy on their corresponding network management equipment, the network management equipment sends the security policy to the first device, and the first device receives the security policy.
  • the second device also obtains the security policy, and the manner in which the second device obtains the security policy is the same as the manner in which the first device obtains the security policy, which will not be described in detail here.
  • Step 602 The second device reports the security capability of the second device to the first device, where the security capability includes at least one security processing algorithm supported by the second device and/or at least one data plane security protocol supported by the second device.
  • step 602 the second device reports the security capability of the second device to the first device in the following two ways.
  • the two methods are:
  • the second device sends the second device information to the first device, the second device information includes the algorithm identification of at least one security processing algorithm supported by the second device and/or the protocol of at least one data plane security protocol supported by the second device logo.
  • Mode 2 The second device obtains a second algorithm set based on the security policy, the second algorithm set includes the intersection of at least one data plane security protocol supported by the second device and the target data plane security protocol indicated by the security requirement information, and sends the first The device sends the second protocol set and an algorithm identifier of at least one security processing algorithm supported by the second device.
  • the first device also performs the operation of step 602 in the same way as the second device, that is, the first device reports the security capability of the first device to the second device.
  • Step 603 The first device obtains the security capability of the second device, and obtains the first set of protocols and the set of algorithms based on the security capability of the second device.
  • the first device receives the second device information, and determines at least one data plane security protocol supported by the second device based on the protocol identifier of the at least one data plane security protocol supported by the second device included in the second device information. Based on the protocol identification of the target data plane security protocol included in the security policy, the target data plane security protocol is determined.
  • the first protocol set is obtained by intersecting at least one data plane security protocol supported by the first device, at least one data plane security protocol supported by the second device, and a target data plane security protocol.
  • Based on the algorithm identifier of the at least one secure processing algorithm supported by the second device included in the second device information at least one secure processing algorithm supported by the second device is determined.
  • An algorithm set is obtained by intersecting at least one security processing algorithm supported by the second device and at least one security processing algorithm supported by the first device.
  • the first device receives the algorithm identification of the second protocol set and at least one security processing algorithm supported by the second device; the at least one data plane security protocol supported by the first device and the second protocol set Intersection is performed to obtain the first protocol set. Based on the algorithm identification of the at least one security processing algorithm supported by the second device, determine at least one security processing algorithm supported by the second device, and combine the at least one security processing algorithm supported by the second device with the at least one security processing algorithm supported by the first device Intersect to get the algorithm set.
  • the first device generates at least one piece of SA information and attribute information corresponding to each SA information based on the first capability set, the algorithm set, and the security policy, and implements according to the following steps 605-608.
  • Step 604 The first device allocates an SA identifier, and generates security parameters based on the first set of protocols, the set of algorithms, and the target security process indicated by the security policy.
  • the first device also generates attribute information.
  • the first device determines the target security processing corresponding to the processing type, selects one or more security processing algorithms that implement the target security processing from the algorithm set, and selects
  • the data plane security protocol corresponding to the security processing algorithm is a protocol in the first protocol set. Configuring parameters required by the security processing algorithm based on the selected security processing algorithm to obtain security parameters, where the security parameters include the security processing algorithm and parameters required by the security processing algorithm. Allocating an SA identifier, and generating attribute information based on the first protocol set and the security processing algorithm, the attribute information including the data plane security protocol corresponding to the security processing algorithm, and the data plane security protocol in the attribute information is the first protocol set agreement in .
  • Step 605 the first device sends a confirmation request to the second device, where the confirmation request includes the SA identifier and the security parameter.
  • the confirmation request also includes the attribute information.
  • Step 606 The second device receives the confirmation request, confirms the SA identifier and security parameters, and sends a confirmation response to the first device after the confirmation is passed.
  • the second device acquires SA information, where the SA information includes the first address (its own address), the SA identifier and security parameters.
  • the second device uses the attribute information as attribute information corresponding to the SA information.
  • the second device When the second SA database (the second SA database 104 shown in FIG. 7 ) is located in the second device, the second device saves the SA information to the second SA database in the second device through the write interface, or saves the SA information and attribute information corresponding to the SA information.
  • the second SA database the second SA database 104 shown in FIG. 7
  • Step 607 The first device receives the confirmation response, and obtains SA information based on the confirmation response, where the SA information includes the first address, the SA identifier, and security parameters.
  • the first device uses the attribute information as the attribute information corresponding to the SA information.
  • the second device may also perform the above-mentioned processes of 603-607 to generate SA information and attribute information corresponding to the SA information.
  • Step 608 the first device saves the SA information in the first SA database.
  • the first device When the first device also generates the attribute information corresponding to the SA information, the first device saves the SA information and the attribute information corresponding to the SA information in a first SA database (the first SA database 103 shown in FIG. 7 ).
  • the first device When the first SA database is located in the first device, the first device saves the SA information and attribute information corresponding to the SA information to the first SA database in the first device through a write interface.
  • the first device determines the first address and the second address on the storage device based on the first address and the second address included in the security policy.
  • the SA database bound to the two addresses saves the SA information and the attribute information corresponding to the SA information to the SA database through the write interface.
  • the first device For a certain SA information in the first SA database, when the storage time of the SA information in the first SA database exceeds the aging time included in the SA information, for the convenience of explanation, the SA information is still referred to as the first SA information, The first device generates second SA information.
  • the address included in the first SA information is the same as the address included in the second SA information.
  • the security parameters included in the first SA information are different from the security parameters included in the second SA information.
  • the first SA information includes The SA identifier in the second SA information may be the same as or different from the SA identifier included in the second SA information.
  • the first device updates the first SA information in the first SA database to the second SA information, and simultaneously notifies the second device to also update the first SA information in the second SA database to the second SA information.
  • the second device also performs the above operation as the first device.
  • the network architecture 100 shown in FIG. 7 includes that the first device and the first negotiating device are two different devices, the second device and the second negotiating device are two different devices, and the first negotiating device The negotiating device communicates, and the second negotiating device also communicates with the second device. The first device reports the security capability of the first device to the first negotiating device, and the second device reports the security capability of the second device to the second negotiating device.
  • the first negotiation device obtains the security capability of the first device
  • the second negotiation device obtains the security capability of the second device. Then replace the first device in the above steps 601-608 with the first negotiating device, replace the second device with the second negotiating device, and generate the first negotiating device and the second negotiating device according to the process of the above steps 601-608 SA information and attribute information corresponding to the SA information.
  • the first device after the first device negotiates with the second device to generate SA information, the first device saves the SA information in the first SA database, and the second device saves the SA information in the second SA database, so that the first device
  • the first device can obtain SA information from the first SA database, use the SA information to perform first security processing on the data
  • the second device can obtain SA information from the second SA database.
  • the SA information is acquired from the SA database, and the received data is used to perform second security processing on the received data. In this way, the first device and the second device do not need to first negotiate SA information after establishing a connection each time, thereby improving security processing efficiency and saving network resource overhead.
  • the first device and the second device generate the SA information and the attribute information corresponding to the SA information in a distributed manner, so that a third device does not need to be separately deployed to generate the SA information, which saves costs.
  • the attribute information corresponding to the SA information includes one or more data plane security protocols that can use the SA information
  • the data plane security processing module corresponding to the one or more data plane security protocols can use the SA information to make the control plane SA information.
  • the SA information in the first SA database or the second SA database can be used to perform security processing on the message sent by the first device to the second device.
  • the first SA data or the SA information in the second database is generated through the method 500 shown in FIG. 8 , or generated through the method 600 shown in FIG. 9 .
  • the embodiment of the present application provides a method 700 for processing packets.
  • the method 700 is applied to the network architecture 100 shown in FIG. 4 , FIG. 5 or FIG. 6 , and includes the following steps 701-704.
  • Step 701 The first data plane security processing module in the first device acquires m pieces of SA information from the first SA database based on the first address, where m is a natural number greater than 0 and less than or equal to N.
  • the first data security processing module is any data plane security processing module in the first device, and the first address is the address of the second device.
  • Step 702 The first data plane security processing module in the first device obtains the message to be sent, and the destination address of the message to be sent is the first address.
  • the message to be sent is a message received by the first device or a message generated by the first device.
  • Step 703 The first data plane security processing module in the first device performs first security processing on the payload of the message to be sent based on the security parameters included in the m pieces of SA information, and adds The SA identifiers of the m pieces of SA information are used to obtain the first packet, and the payload of the first packet is the payload after the first security processing.
  • Step 704 The communication interface of the first device sends the first packet to the second device.
  • the first SA database is an SA database shared by at least one data plane security processing module of the first device
  • all data plane security processing modules in the first device can access the first SA database.
  • the data plane security processing module in the first device obtains m pieces of SA information from the first SA database based on the first address, and uses the m pieces of SA information to perform first security processing on the payload of the message to be sent.
  • both the first device and the second device need to re-negotiate to generate data for safe processing of data. SA.
  • the first device when the first device establishes a connection with the second device and needs to send data each time, the first device and the second device do not need to first negotiate to generate SA information, but the first device based on the first address
  • the m pieces of SA information are obtained from the first SA database, and the message to be sent is safely processed through the m pieces of SA information, thereby improving security processing efficiency and saving network resource overhead.
  • the first SA database includes correspondence between SA information and attribute information
  • the first data plane security processing module acquires m pieces of SA information from the first SA database based on the first address and filter conditions.
  • Each of the m pieces of SA information includes a first address
  • the filter condition includes a data plane security protocol required by the first data plane security processing module
  • the attribute information corresponding to the m pieces of SA information satisfies the filter condition.
  • the filter condition includes the data plane security protocol required by the first data plane security processing module
  • the SA information corresponding to the data plane security protocol required by different data plane security processing modules can be obtained from the first SA database, so that the use of SA information It unbinds with the negotiation management of SA information, simplifies the management of network security protocols, and improves scalability.
  • the attribute information corresponding to the SA information satisfies the filter condition means that the attribute information corresponding to the SA information includes the data plane security protocol required by the first data plane security processing module in the filter condition.
  • step 701 after receiving the message to be sent, the first device extracts the destination address from the message to be sent as the first address, or, the first device receives a processing event, and the processing event includes the first address. After the first address is obtained, m pieces of SA information are obtained based on the first address and the filter condition.
  • the first device can obtain m pieces of SA information in advance based on the first address in the processing event, so that when the first device receives a message with the destination address as the first address, it directly uses the m pieces of SA information to secure the message. processing, further improving the efficiency of security processing.
  • the processing event may be sent by the network management device.
  • the network management device needs the first device and the second device to perform secure processing on the message sent by the first device to the second device
  • the network management device The address of the second device is used as the first address, and a processing event including the first address is sent to the first device.
  • the first device first obtains m pieces of SA information, and when the first device receives a message whose destination address is the first address, uses the m pieces of SA information to perform first security processing on the message.
  • the filtering condition includes one or more data plane security protocols, where the one or more data plane security protocols are the data plane security protocols corresponding to the first data plane security processing module, or are The first data plane security processing module determines by itself.
  • the data plane security protocol in the filter condition corresponds to the first data plane security processing module, or the first data plane security processing module determines based on its own internal logic to enrich the way to obtain the filter condition.
  • the data plane security protocols in the filtering condition include but are not limited to one or more of the following: MACSec, IPSec, SRv6Sec, or SSL.
  • the filter condition further includes a source of SA information required by the first data plane security processing module.
  • the first data plane security processing module according to the first address, and the data plane security protocol required by the first data plane security processing module contained in the filter condition and the SA information required by the first data plane security processing module
  • the source of m SA information is acquired from the first SA database.
  • the first data plane security processing module has requirements on the source of SA information. Since the filter condition includes the source of the SA information required by the first data plane security processing module, it is possible to obtain SA information required by the module.
  • the first data plane security processing module may first obtain x pieces of SA information from the first SA database, where x is a natural number greater than or equal to m and less than or equal to N; then based on a random method or In the polling mode, m pieces of SA information are selected from the x pieces of SA information.
  • the first data plane security processing module can obtain more than m pieces of SA information from the first SA database, that is, obtain x pieces of SA information, so that whenever the first data plane security processing module needs to send a message whose destination address is the first address When sending a message, m pieces of SA information are selected from the x pieces of SA information based on a random method or a polling method. In this way, the security processing module of the first data plane does not need to frequently query the first SA database, which reduces the consumption of computing resources and improves the efficiency of security processing.
  • the first data plane security processing module acquires the m pieces of SA information from the first SA database through a public interface.
  • the public interface includes a publish/subscribe (publish/subscribe, Pub/Sub) interface and the like.
  • the communication interface of the first device receives a message to be sent
  • the destination address of the message to be sent is 192.168.1.4
  • the data plane security protocol required by the first data plane security processing module is MACSec, that is, the filter condition includes MACSec.
  • the SA information includes the security processing algorithm and the parameters required by the security processing algorithm, etc.
  • the first data plane security processing module calls the security processing module from the first device A processing algorithm, based on the parameter, performs first security processing on the message to be sent through the security processing algorithm.
  • the first data plane security processing module performs first security processing on the payload of the message to be sent, replaces the payload in the message to be sent with the processed payload, and Add the SA identifiers of the m pieces of SA information to the sending message to obtain the first message.
  • the first security processing is encryption processing
  • the first data plane security processing module encrypts the payload of the message to be sent, replaces the payload in the message to be sent with the ciphertext obtained after processing, and
  • the SA identifiers of the m pieces of SA information are added to the text to obtain the first packet.
  • the first data plane security processing module performs first security processing on the payload of the message to be sent, and adds the processing result and the SA identification of the m pieces of SA information to the message to be sent , to get the first message.
  • the first security processing is authentication processing
  • the first data plane security processing module calculates the information summary of the payload of the message to be sent, and adds the information summary and the SA identification of the m SA information to the message to be sent, to get the first message.
  • the SA information acquired by the first data plane security processing module includes the SA identifier "ID-SA1" and security parameters (encryption algorithm Encryption and key "secret key”).
  • the security processing module of the first data plane is based on the key "secret key”, and uses the encryption and decryption algorithm Encryption to encrypt the payload in the message to be sent. payload in the text, and add the SA identifier "ID-SA1" to the message to be sent to obtain the first message.
  • the communication interface of the first device sends the first packet to the second device.
  • the first SA database is a database shared by at least one data plane security processing module of the first device, all data plane security processing modules in the first device can access the first SA database. Since the attribute information corresponding to each SA information in the first SA database includes one or more data plane security protocols, the data plane security processing module in the first device is based on the first address and the data plane security protocol in the filter condition , acquire m pieces of SA information from the first SA database, and use the m pieces of SA information to perform first security processing on the payload of the message to be sent.
  • each SA information in the first SA database is unbound from the network security protocol
  • each data plane security processing module in the first device can obtain SA information from the first SA database, that is, the control plane SA
  • the negotiation management of information and the use of SA information on the data plane are unbound, which simplifies the management of network security protocols and improves scalability, so that new encryption features can be added to the data plane, such as adding new features such as SRv6sec and/or double encryption .
  • an embodiment of the present application provides a method 800 for processing packets.
  • the method 800 is applied to the network architecture 100 shown in FIG. 4 , FIG. 5 or FIG. 6 , and includes the following steps 801-803.
  • Step 801 The communication interface of the second device receives a first packet, where the first packet includes m SA identifiers and a payload.
  • the communication interface of the second device receives the first packet, and the first packet includes the SA identifier "ID-SA1" and ciphertext, where the ciphertext is the payload of the first packet.
  • Step 802 The first data plane security processing module of the second device acquires m pieces of SA information corresponding to the m SA identities from the second SA database based on the m SA identities.
  • At least one data plane security processing module in the second device includes a first data plane security processing module.
  • step 802 the first data plane security processing module of the second device acquires m SA information corresponding to the m SA identifiers from the second SA database through a public interface.
  • the public interface includes a Pub/Sub interface and the like.
  • the first data plane security processing module acquires SA information from the second SA database shown in Table 1.
  • the SA information includes the address "192.168.1.4”, the SA identifier "ID-SA1” SA1", security parameters (encryption and decryption algorithm Encryption and key "secret key”), aging time "24 hours” and encryption mode.
  • Step 803 The first data plane security processing module of the second device performs second security processing on the payload of the first message based on the security parameters included in the m pieces of SA information.
  • the security parameters in the SA information include the security processing algorithm and the parameters required by the security processing algorithm, etc.
  • the first data plane security processing module uses the security processing algorithm based on the parameters Perform second security processing on the payload of the first packet.
  • the first data plane security processing module decrypts the ciphertext in the first message through the encryption and decryption algorithm Encryption based on the key "secret key” to obtain the plaintext.
  • the second SA database is an SA database shared by at least one data plane security processing module of the second device, all data plane security processing modules in the second device can access the second SA database.
  • the data plane security processing module in the second device acquires m pieces of SA information from the second SA database based on the m pieces of SA identification, so as to use the m pieces of SA information to perform second security processing on the payload of the first message.
  • the first device obtains the SA information from the SA database, uses the SA information to process the first message, and the first device and the second Devices do not need to negotiate to generate SA information first, thereby improving security processing efficiency and saving network resource overhead.
  • the negotiation management of SA information is unbound from the use of SA information through the second SA database, which simplifies the management of network security protocols and improves scalability.
  • this embodiment of the present application provides a device 900 for processing packets.
  • the device 900 is applied to the network architecture 100 shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 .
  • the device 900 is the first device provided in any of the above embodiments, for example, the first device 101 in the network architecture 100 shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 , or the method 500 shown in FIG. 8
  • the first device in the method 600 shown in FIG. 9 or the first device in the method 700 shown in FIG. 10 .
  • the device 900 includes: a processor 901 , a memory 902 and an internal connection 903 .
  • the processor 901 and the memory 902 are connected through an internal connection 903.
  • the memory 902 stores an operating system and program codes.
  • the at least one processor 901 reads the operating system from the memory 902 and runs the operating system.
  • internal connection 903 includes a bus.
  • At least one processor 901 reads program codes from the memory 902, and processes messages by running the program codes in the operating system.
  • the device 900 further includes a network interface 904, and the network interface 904 is connected to the processor 901 and the memory 902 through an internal connection 903.
  • the network interface 904 can communicate with the second device 102 in the network architecture 100 shown in FIG. 4, FIG. 5, FIG. 6 or FIG.
  • the device 105 communicates, or the network interface 904 is capable of communicating with the first negotiating device 106 in the network architecture 100 shown in FIG. 7 .
  • the device 900 further includes an input device 905 connected to the internal connection 903 .
  • the processor 901 can receive input commands or data, etc. through the input device 905 .
  • the device 900 further includes a display device 906, and the display device 906 can be used to display an intermediate result and/or a final result of the packet processing process performed by the processor 901, and the like.
  • the processor 901 may be a general-purpose central processing unit (central processing unit, CPU), network processor (network processor, NP), microprocessor, application-specific integrated circuit (application-specific integrated circuit, ASIC) , or one or more integrated circuits used to control the execution of the programs of this application.
  • CPU central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the internal connection 904 includes a path for transferring information between the above-mentioned components.
  • the internal connection 904 may be a single board or a bus.
  • the above-mentioned memory 902 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM) or other types that can store information and instructions. type of dynamic storage device, and may also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by Any other medium accessed by a computer, but not limited to.
  • the memory may exist independently and be connected to the processor by a bus. Memory may also be integrated with the processor.
  • the processor 901 may include one or more CPUs, for example, CPU0 and CPU1 in FIG. 12 .
  • the detection device 900 may include multiple processors, for example, the processor 901 and the processor 907 in FIG. 12 .
  • Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the process of processing packets may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product, for example, the computer product is a software for processing messages, and is used to install the software shown in Fig. 4, Fig. 5, Fig. 6 or Fig. 7 The first device 101 of .
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, and the like.
  • the computer instructions may be transmitted or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • Digital Subscriber Line Digital Subscriber Line, DSL
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (solid state disk, SSD)), etc.
  • this embodiment of the present application provides a device 1000 for processing packets.
  • the device 1000 is applied to the network architecture 100 shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 .
  • the device 1000 is the second device provided in any of the above embodiments, for example, the second device 102 in the network architecture 100 shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 , or the method 500 shown in FIG. 8
  • the device 1000 includes: a processor 1001 , a memory 1002 and an internal connection 1003 .
  • the processor 1001 and the memory 1002 are connected through an internal connection 1003.
  • the memory 1002 stores an operating system and program codes.
  • the at least one processor 1001 reads the operating system from the memory 1002 and runs the operating system.
  • internal connection 1003 includes a bus.
  • At least one processor 1001 reads program codes from the memory 1002, and processes messages by running the program codes in the operating system.
  • the device 1000 further includes a network interface 1004, and the network interface 1004 is connected to the processor 1001 and the memory 1002 through an internal connection 1003.
  • the network interface 1004 can communicate with the first device 101 in the network architecture 100 shown in FIG. 4, FIG. 5, FIG. 6 or FIG.
  • the device 105 communicates, or the network interface 1004 can communicate with the second negotiating device 107 in the network architecture 100 shown in FIG. 7 .
  • the device 1000 further includes an input device 1005 connected to the internal connection 1003 .
  • the processor 1001 can receive input commands or data, etc. through the input device 1005 .
  • the device 1000 further includes a display device 1006, and the display device 1006 can be used to display an intermediate result and/or a final result of the processor 1001 executing a packet processing process.
  • the processor 1001 may be a general-purpose central processing unit (central processing unit, CPU), network processor (network processor, NP), microprocessor, application-specific integrated circuit (application-specific integrated circuit, ASIC) , or one or more integrated circuits used to control the execution of the programs of this application.
  • CPU central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the internal connection 1004 includes a path for transferring information between the above-mentioned components.
  • the internal connection 1004 may be a single board or a bus.
  • the above-mentioned memory 1002 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, random access memory (random access memory, RAM) or other types that can store information and instructions type of dynamic storage device, and may also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by Any other medium accessed by a computer, but not limited to.
  • the memory may exist independently and be connected to the processor by a bus. Memory may also be integrated with the processor.
  • the processor 1001 may include one or more CPUs, such as CPU0 and CPU1 in FIG. 13 .
  • the detection device 1000 may include multiple processors, such as the processor 1001 and the processor 1007 in FIG. 13 .
  • processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the process of detecting the file to be detected may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • software it can be implemented in whole or in part in the form of a computer program product, for example, the computer product is a software for processing messages, and is used to install the software shown in Fig. 4, Fig. 5, Fig. 6 or Fig. 7 The second device 102 .
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, and the like.
  • the computer instructions may be transmitted or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • Digital Subscriber Line Digital Subscriber Line, DSL
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (solid state disk, SSD)), etc.
  • the embodiment of the present application provides a device 1100 for acquiring SA information.
  • the device 1100 is applied in the network architecture 100 shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 .
  • the device 1100 is the first device, the second device, the third device, the first negotiating device or the second negotiating device provided in any of the above embodiments, such as FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7
  • the device 1100 includes: a processor 1101 , a memory 1102 and an internal connection 1103 .
  • the processor 1101 and the memory 1102 are connected through an internal connection 1103.
  • the memory 1102 stores an operating system and program codes.
  • the at least one processor 1101 reads the operating system from the memory 1102 and runs the operating system.
  • internal connection 1103 includes a bus.
  • At least one processor 1101 reads program codes from the memory 1102, and acquires SA information by running the program codes in the operating system.
  • the device 1100 further includes a network interface 1104 , and the network interface 1104 is connected to the processor 1101 and the memory 1102 through an internal connection 1103 .
  • the network interface 1104 can communicate with the first device 101 or the second device 102 in the network architecture 100 shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 .
  • the device 1100 further includes an input device 1105 connected to the internal connection 1103 .
  • the processor 1101 can receive input commands or data, etc. through the input device 1105 .
  • the device 1100 further includes a display device 1106, and the display device 1106 can be used to display an intermediate result and/or a final result of the process of acquiring SA information executed by the processor 1101.
  • the processor 1101 may be a general-purpose central processing unit (central processing unit, CPU), network processor (network processor, NP), microprocessor, application-specific integrated circuit (application-specific integrated circuit, ASIC) , or one or more integrated circuits used to control the execution of the programs of this application.
  • CPU central processing unit
  • NP network processor
  • ASIC application-specific integrated circuit
  • the internal connection 1104 includes a path for transferring information between the above components.
  • the internal connection 1104 may be a single board or a bus.
  • the above-mentioned memory 1102 may be a read-only memory (read-only memory, ROM) or other types of static storage devices that can store static information and instructions, a random access memory (random access memory, RAM) or other types that can store information and instructions type of dynamic storage device, and may also be electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compact discs, laser discs, optical discs, digital versatile discs, blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or can be used to carry or store desired program code in the form of instructions or data structures and can be used by Any other medium accessed by a computer, but not limited to.
  • the memory may exist independently and be connected to the processor by a bus. Memory may also be integrated with the processor.
  • the processor 1101 may include one or more CPUs, for example, CPU0 and CPU1 in FIG. 14 .
  • the detection device 1100 may include multiple processors, for example, the processor 1101 and the processor 1107 in FIG. 14 .
  • Each of these processors may be a single-core (single-CPU) processor or a multi-core (multi-CPU) processor.
  • a processor herein may refer to one or more devices, circuits, and/or processing cores for processing data (eg, computer program instructions).
  • the process of detecting the file to be detected may be implemented in whole or in part by software, hardware, firmware or any combination thereof.
  • the computer product is a software for obtaining SA information, which is used to install the software shown in Figure 4, Figure 5, Figure 6 or Figure 7
  • the first device 101 or the second device 102 is installed in the third device shown in FIG. 5 or FIG. 6 , or installed in the first negotiating device or the second negotiating device shown in FIG. 7 .
  • the computer program product includes one or more computer instructions.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk, and the like.
  • the computer instructions may be transmitted or transmitted from one computer-readable storage medium to another computer-readable storage medium.
  • Digital Subscriber Line Digital Subscriber Line, DSL
  • wireless such as infrared, wireless, microwave, etc.
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (such as a floppy disk, a hard disk, or a magnetic tape), an optical medium (such as a DVD), or a semiconductor medium (such as a solid state disk (solid state disk, SSD)), etc.
  • this embodiment of the present application provides an apparatus 1200 for processing packets.
  • the apparatus 1200 is applied in the network architecture 100 as shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 .
  • the apparatus 1200 is deployed on the first device provided in any of the above embodiments, for example, the first device 101 deployed in the network architecture 100 shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG.
  • the first device in the method 500 shown in FIG. 9 the first device in the method 600 shown in FIG. 9 , or the first device in the method 700 shown in FIG. 10 .
  • the device 1200 shown in FIG. 15 includes at least one data plane security processing module and a communication module.
  • the security association SA database corresponding to the device 1200 includes N pieces of SA information, where N is a natural number greater than 0. Among the N pieces of SA information Each SA information includes address, SA identifier and security parameters respectively,
  • the first data plane security processing module 1201 is configured to acquire m pieces of SA information from the SA database based on the first address, where m is a natural number greater than 0 and less than or equal to N, the first address is the address of the second device, and the Each SA information in the m pieces of SA information includes a first address, and the first data plane security processing module 1201 is a data plane security processing module in at least one data plane security processing module included in the device 1200;
  • the first data plane security processing module 1201 is also used to obtain the message to be sent, and the destination address of the message to be sent is the first address;
  • the first data plane security processing module 1201 is further configured to perform first security processing on the payload of the message to be sent based on the security parameters included in the m pieces of SA information, and add the information of the m pieces of SA information to the message to be sent SA mark, to obtain the first message, the payload of the first message is the payload after the first security processing;
  • a communication module 1202 configured to send the first packet to the second device.
  • the SA database corresponding to the device 1200 further includes attribute information corresponding to N security association SA information, and the attribute information corresponding to the first SA information among the N SA information includes an attribute information that can use the first SA information. or multiple data plane security protocols,
  • the first data plane security processing module 1201 is configured to obtain m pieces of SA information from the SA database according to the first address and the filter condition, the attribute information of each SA information in the m pieces of SA information satisfies the filter condition, and the filter
  • the conditions include data plane security protocols required by the first data plane security processing module 1201 .
  • the first data plane security processing module 1201 to obtain m SA information according to the first address and filter conditions, refer to the relevant content in step 701 of the method 700 shown in FIG. 10 above, which will not be detailed here. illustrate.
  • the attribute information corresponding to the first SA information among the N pieces of SA information also includes the source of the first SA information
  • the filter condition also includes the source of the SA information required by the first data plane security processing module 1201
  • the first data plane security processing module 1201 is configured to process according to the first address and the data plane security protocol required by the first data plane security processing module 1201 and the SA information required by the first data plane security processing module 1201 contained in the filter condition source, obtain m SA information from the SA database.
  • the first data plane security processing module 1201 obtains m pieces of SA information according to the first address, the data plane security protocol required by the first data plane security processing module, and the source. For details, refer to the method 700 shown in FIG. 10 above. Relevant content in step 701 will not be described in detail here.
  • the communication module 1202 is further configured to report the security capability of the apparatus 1200, where the security capability includes at least one supported security processing algorithm and/or supported at least one data plane security protocol, so as to support the third device based on the first
  • the security capability of the second device, the security capability of the apparatus 1200, and the security policy between the apparatus 1200 and the second device generate at least one piece of SA information, and save at least one piece of SA information in the SA database,
  • the security policy is used to indicate the target security processing and the target data plane security protocol
  • the address included in each SA information in at least one SA information is the address of the second device
  • the SA identifier in each SA information is assigned by the third device Yes
  • the security parameter in each SA message is a parameter specified by a security policy and is a parameter supported by both the security capability of the apparatus 1200 and the capability of the second device.
  • the third device is a management device, or a negotiation device corresponding to the apparatus 1200, where the management device is configured to generate, for each of the at least three devices, each device and each device's communication peer SA information required by the device, at least three devices including the device 1200 and a second device, the negotiation device corresponding to the device 1200 is used to negotiate the SA required by the device 1200 and the communication peer device for the device 1200 information.
  • the data plane security protocol includes: Media Access Control Security MACSec, Internet Protocol Security IPSec, Segment Routing Internet Protocol Version 6 Security SRv6Sec or Secure Sockets SSL.
  • the apparatus 1200 includes multiple data plane security processing modules, and the SA database is an SA database to which at least two data plane security processing modules among the multiple data plane security processing modules have access rights.
  • the first data plane security processing module 1201 is configured to obtain m pieces of SA information from the SA database through a public interface.
  • the public interface includes a publish/subscribe Pub/Sub interface.
  • the first security processing includes one or more of the following: encryption processing, authentication processing, anti-tampering processing or anti-replay processing.
  • the embodiment of the device 1200 described in FIG. 15 is only schematic.
  • the division of the modules is only a logical function division. In actual implementation, there may be other division methods.
  • multiple modules can be combined or can be Integrate into another system, or some features may be ignored, or not implemented.
  • Each functional module in each embodiment of the present application may be integrated into one module, each module may exist separately physically, or two or more modules may be integrated into one module.
  • the above-mentioned modules in FIG. 15 can be implemented in the form of hardware or in the form of software functional units.
  • the above-mentioned first data plane security processing module 1201 and communication module 1202 may be software function modules generated by at least one processor 901 in FIG.
  • the above-mentioned modules in FIG. 15 may also be implemented by different hardware in the device 900.
  • the first data plane security processing module 1201 is processed by a part of at least one processor 901 in FIG. 12 (for example, one of the multi-core processors core), and the communication module 1202 is implemented by the network interface 904 of FIG. Gate Array, FPGA), or coprocessor and other programmable devices to complete.
  • the above-mentioned functional modules can also be implemented by a combination of software and hardware.
  • the communication module 1202 is implemented by a hardware programmable device, and the first data plane security processing module 1201 is read by the CPU after the program code stored in the memory 902, Generated software function modules.
  • the first data plane security processing module in the device 1200 can access the SA database.
  • the first data plane security processing module obtains m pieces of SA information from the SA database based on the first address, and uses the m pieces of SA information to perform first security processing on the payload of the message to be sent.
  • both the apparatus 1200 and the second device need to renegotiate to generate an SA information.
  • the device 1200 when the device 1200 establishes a connection with the second device and needs to send data each time, the device 1200 and the second device do not need to first negotiate to generate SA information, but the first data plane security processing module Based on the first address, m pieces of SA information are obtained from the SA database, and the message to be sent is safely processed through the m pieces of SA information, thereby improving security processing efficiency and saving network resource overhead. Since the SA database is shared by at least one data plane security processing module in the device 1200, all data plane security processing modules in the device 1200 can access the SA database.
  • the data plane security processing module in the device 1200 is based on the first address and the data plane security protocol in the filter condition, Acquire m pieces of SA information from the SA database, and use the m pieces of SA information to perform first security processing on the payload of the message to be sent.
  • each SA information in the SA database is unbound from the network security protocol
  • each data plane security processing module in the device 1200 can obtain SA information from the SA database, that is, the control plane SA information Negotiation management is unbound from the use of SA information on the data plane, which simplifies the management of network security protocols and improves scalability.
  • this embodiment of the present application provides an apparatus 1300 for processing packets.
  • the apparatus 1300 is applied in the network architecture 100 as shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 .
  • the apparatus 1300 is deployed on the second device provided in any of the above embodiments, for example, the second device 102 deployed in the network architecture 100 shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG.
  • the device 1300 shown in FIG. 16 includes at least one data plane security processing module and a communication module.
  • the security association SA database corresponding to the device 1300 includes M pieces of SA information, where M is a natural number greater than 0. Each of the M pieces of SA information
  • Each SA information includes SA identification and security parameters,
  • the communication module 1301 is configured to receive a first message, where the first message includes m SA identifiers and payloads, where m is a natural number greater than 0 and less than or equal to M;
  • the second data plane security processing module 1302 is configured to acquire m SA information corresponding to the m SA identities from the SA database based on the m SA identities, and the second data plane security processing module 1302 is included in the device 1300 A data plane security processing module in at least one data plane security processing module;
  • the second data plane security processing module 1302 is further configured to perform second security processing on the payload of the first message based on the security parameters included in the m pieces of SA information.
  • the second data plane security processing module 1302 to acquire m pieces of SA information, refer to the relevant content in step 802 of the method 800 shown in FIG. 11 above, and will not be detailed here.
  • the second data plane security processing module 1302 performing the second security processing on the payload of the first message, refer to the relevant content in step 803 of the method 800 shown in FIG. Detailed description.
  • the communication module 1301 is further configured to report the security capability of the apparatus 1300 to the third device, where the security capability includes at least one supported security processing algorithm and/or supported at least one data plane security protocol, so as to support the first
  • the third device generates at least one SA information based on the security capability of the first device, the security capability of the apparatus 1300, and the security policy between the first device and the apparatus 1300, and saves the at least one SA information in the SA database.
  • the security policy is used to indicate the target security processing and the target data plane security protocol
  • the SA identifier in each SA information is assigned by the third device
  • the security parameter in each SA information is the parameter specified by the security policy and is the first Parameters supported by both the security capability of the device and the capability of the apparatus 1300.
  • the third device is a management device, or a negotiation device corresponding to the apparatus 1300, where the management device is configured to generate, for each of the at least three devices, each device and each device's communication peer SA information required by the device, at least three devices including the first device and the device 1300, the negotiation device corresponding to the device 1300 is used to negotiate the SA required by the device 1300 and the communication peer device for the device 1300 information.
  • the second data plane security processing module 1302 is configured to obtain m pieces of SA information corresponding to the m SA identities from the SA database through a public interface based on the m SA identities.
  • the public interface includes a publish/subscribe Pub/Sub interface.
  • the second security processing includes one or more of the following: decryption processing, authentication processing, anti-tampering processing or anti-replay processing.
  • the embodiment of the device 1300 described in FIG. 16 is only schematic.
  • the division of the modules is only a logical function division.
  • there may be other division methods for example, multiple modules can be combined or can be Integrate into another system, or some features may be ignored, or not implemented.
  • Each functional module in each embodiment of the present application may be integrated into one module, each module may exist separately physically, or two or more modules may be integrated into one module.
  • the above-mentioned modules in FIG. 16 can be implemented in the form of hardware or in the form of software functional units.
  • the above-mentioned second data plane security processing module 1302 and communication module 1301 may be software function modules generated by at least one processor 1001 in FIG.
  • the second data plane security processing module 1302 is processed by a part of at least one processor 1001 in FIG. 13 (for example, one of the multi-core processors core), and the communication module 1301 is implemented by the network interface 1004 of FIG. Gate Array, FPGA), or coprocessor and other programmable devices to complete.
  • the above-mentioned functional modules can also be implemented by combining software and hardware.
  • the communication module 1301 is implemented by a hardware programmable device, and the second data plane security processing module 1302 is read by the CPU after the program code stored in the memory 1002, Generated software function modules.
  • the second data plane security processing module in the device 1300 obtains m pieces of SA information from the SA database based on the m pieces of SA identification, so as to use the m pieces of SA information to process the payload of the first message. Second safe handling. In this way, each time the device 1300 establishes a connection with the first device and receives the first message, the second data plane security processing module acquires SA information from the SA database, uses the SA information to process the first message, and the device 1300 and the first device do not need to first negotiate to generate SA information, thereby improving security processing efficiency and saving network resource overhead.
  • an embodiment of the present application provides an apparatus 1400 for acquiring SA information.
  • the apparatus 1400 is applied in the network architecture 100 as shown in FIG. 4 , FIG. 5 , FIG. 6 or FIG. 7 .
  • the apparatus 1400 is deployed on the first device, the second device, the third device, the first negotiating device, or the second negotiating device provided in any of the foregoing embodiments.
  • the device 1400 includes:
  • An acquiring unit 1401 configured to acquire the security capability of the first device, the security capability of the second device, and the security policy between the first device and the second device, the security capability of the first device includes the security processing algorithm supported by the first device and /or the data plane security protocol supported by the first device, the security capability of the second device includes the security processing algorithm supported by the second device and/or the data plane security protocol supported by the second device, and the security policy is used to indicate the target security processing and target Data plane security protocol;
  • the processing unit 1402 is configured to generate at least one piece of SA information based on the security capability of the first device, the security capability of the second device, and the security policy, where each piece of SA information in the at least one piece of SA information includes a first address, an SA identifier, and a security policy.
  • a parameter; a security parameter is a parameter specified by a security policy and is a parameter supported by both the security capability of the first device and the security capability of the second device.
  • the obtaining unit 1401 obtains the security capability of the first device, the security capability of the second device, and the detailed implementation process of the security policy between the first device and the second device, refer to step 503 of the method 500 shown in FIG. 8 above. Relevant content in , and relevant content in steps 601 and 603 of the above-mentioned method 600 shown in FIG. 9 will not be described in detail here.
  • processing unit 1402 is also used for:
  • At least one attribute information corresponding to SA information is generated, and the attribute information corresponding to the first SA information in the at least one SA information includes the ability to use the first SA.
  • One or more data plane security protocols for information are generated.
  • processing unit 1402 is configured to:
  • the security capabilities and security policies of the second device Based on the security capabilities of the first device, the security capabilities and security policies of the second device, obtain a protocol set and an algorithm set, the protocol set is the data plane security protocol supported by the first device, the data plane security protocol supported by the second device, and the target An intersection of data plane security protocols, where the algorithm set is the intersection of the security processing algorithms supported by the first device and the security processing algorithms supported by the second device;
  • At least one piece of SA information is generated.
  • the processing unit 1402 obtains the detailed implementation process of the protocol set and the algorithm set, refer to the relevant content in steps 5041-5042 of the method 500 shown in FIG. 8 above, and the relevant content in step 603 of the method 600 shown in FIG. 9 above. , which will not be described in detail here.
  • processing unit 1402 is also used for:
  • the embodiment of the device 1400 described in FIG. 17 is only schematic.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units can be combined or can be Integrate into another system, or some features may be ignored, or not implemented.
  • Each functional unit in each embodiment of the present application may be integrated into one unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the above-mentioned units in FIG. 17 can be implemented in the form of hardware or in the form of software functional units.
  • the acquisition unit 1401 and the processing unit 1402 may be implemented by software function modules generated by at least one processor 1101 in FIG. 14 after reading the program code stored in the memory 1102 .
  • the above-mentioned units in FIG. 17 may also be implemented by different hardware in the device 1100.
  • the acquisition unit 1401 is implemented by a part of processing resources (such as a core in a multi-core processor) in at least one processor 1101 in FIG. 14, and
  • the processing unit 1402 is processed by the rest of the at least one processor 1101 of FIG. 4 (such as other cores in the multi-core processor), or uses a Field-Programmable Gate Array (Field-Programmable Gate Array, FPGA), or co-processing Programmable devices such as devices to complete.
  • the above-mentioned functional units can also be implemented by combining software and hardware.
  • the acquisition unit 1401 is implemented by a hardware programmable device
  • the processing unit 1402 is a software function module generated by the CPU after reading the program code stored in the memory 1102. .
  • the apparatus 1400 obtains the security capability of the first device, the security capability of the second device, and the security policy between the first device and the second device. Based on the security capability of the first device, the security capability of the second device and the security policy, at least one piece of SA information is generated, and the SA information is saved in the SA database. Every time the first device establishes a connection with the second device and needs to send data, the first device and the second device do not need to first negotiate to generate SA information, but the first data plane security processing module in the first device based on the first The address acquires m pieces of SA information from the SA database, and securely processes the message to be sent through the m pieces of SA information, thereby improving security processing efficiency and saving network resource overhead.
  • An embodiment of the present application provides a system for processing packets, as shown in FIGS. 4-7 .
  • the system includes the device 900 shown in FIG. 12 and the device 1000 shown in FIG. 13 , or, includes the device 1200 shown in FIG. 15 and the device 1300 shown in FIG. 16 .
  • the device 900 shown in FIG. 12 or the device 1200 shown in FIG. 15 is the first device in FIGS. 4-7 , such as the device 1000 shown in FIG. 13 or the device 1300 shown in FIG. 16 It is the second device 1502 in Figs. 4-7.
  • the system further includes an apparatus 1100 as shown in FIG. 14 or an apparatus 1400 as shown in FIG. 17 .
  • the apparatus 1100 shown in FIG. 14 or the apparatus 1400 shown in FIG. 17 is the third device in FIG. 5 .
  • the third device is the first negotiating device corresponding to the first device in FIG. 7 , or is the second negotiating device corresponding to the second device.
  • the program can be stored in a computer-readable storage medium.
  • the above-mentioned The storage medium mentioned may be a read-only memory, a magnetic disk or an optical disk, and the like.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

一种处理报文、获取SA信息的方法、装置、系统及介质，属于通信领域。所述方法应用于第一设备，第一设备对应的SA数据库包括N个SA信息，每个SA信息分别包括地址、SA标识和安全参数。第一设备中的第一数据面安全处理模块基于第一地址，从SA数据库中获取m个SA信息，第一地址为第二设备的地址，m个SA信息中的每个SA信息包括第一地址。基于m个SA信息包括的安全参数，对待发送报文的净荷进行第一安全处理，并在待发送报文中添加m个SA信息的SA标识，以得到第一报文，第一报文的净荷是第一安全处理后的净荷。第一设备的通信接口向第二设备发送所述第一报文。本申请能够提高安全处理的效率，节省网络资源的开销。

Description

处理报文、获取SA信息的方法、装置、系统及介质
本申请要求于2021年8月24日提交的申请号为202110971846.X、发明名称为“一种网络加密的方法及相关装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。本申请要求于2021年11月4日提交的申请号为202111302023.4、发明名称为“处理报文、获取SA信息的方法、装置、系统及介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及通信领域，特别涉及一种处理报文、获取SA信息的方法、装置、系统及介质。
背景技术
通常数据在链路上传输时可能存在泄密和/或篡改等安全性问题，为了提高数据在网络传输的安全性，在发送端发送数据时，采用网络安全协议对该数据进行加密等处理，向接收端发送处理后的数据。
目前发送端建立与接收端之间的通信连接时，发送端和接收端通过网络安全协议协商产生安全联盟(security association，SA)信息；发送端基于该SA信息，对需要发送的数据进行加密和/或认证等安全处理，向接收端发送处理后的数据。数据发送结束后，发送端断开与接收端之间的通信连接。当再次有数据发送需求，发送端在重新建立与接收端之间的通信连接时，发送端和接收端重新协商产生新SA信息，并使用新SA信息来发送数据。
目前在发送端与接收端每次建立通信连接时，都需要重新协商产生SA信息，不仅导致安全处理的效率低，还导致网络资源的开销大。
发明内容
本申请提供了一种处理报文、获取SA信息的方法、装置、系统及介质，以提高安全处理的效率，节省网络资源的开销。所述技术方案如下：
第一方面，本申请提供了一种处理报文的方法，所述方法应用于第一设备，第一设备包括至少一个数据面安全处理模块，第一设备对应的安全联盟SA数据库包括N个SA信息，N为大于0的自然数，该N个SA信息中的每个SA信息分别包括地址、SA标识和安全参数。其中，在所述方法中，第一数据面安全处理模块基于第一地址，从该SA数据库中获取m个SA信息，m是大于0且小于或等于N的自然数，第一地址为第二设备的地址，该m个SA信息中的每个SA信息包括第一地址，第一数据面安全处理模块是第一设备包括的至少一个数据面安全模块中的一个数据面安全处理模块。第一数据面安全处理模块获取待发送报文，待发送报文的目的地址为第一地址。第一数据面安全处理模块基于该m个SA信息包括的安全参数，对待发送报文的净荷进行第一安全处理，并在待发送报文中添加该m个SA信息的SA标识，以得到第一报文，第一报文的净荷是第一安全处理后的净荷。第一设备的通信接口 向第二设备发送第一报文。
由于第一设备对应的SA数据库包括N个SA信息，这样第一数据面安全模块基于第一地址从该SA数据库中获取包括第一地址的m个SA信息。如此在第一设备每次与第二设备建立连接并需要发送数据时，第一设备和第二设备不需要先协商产生SA信息，而是第一设备基于第一地址从第一SA数据库中获取m个SA信息，通过该m个SA信息对待发送报文进行安全处理，从而提高安全处理效率，节省了网络资源的开销。
在一种可能的实现方式中，第一设备对应的SA数据库还包括N个安全联盟SA信息分别对应的属性信息，该N个SA信息中的第一SA信息对应的属性信息包括能够使用第一SA信息的一个或多个数据面安全协议。第一数据面安全处理模块根据第一地址以及过滤条件，从该SA数据库中获取m个SA信息，该m个SA信息中的每个SA信息的属性信息满足该过滤条件，该过滤条件包括第一数据面安全处理模块需要的数据面安全协议。
由于该过滤条件包括第一数据面安全处理模块需要的数据面安全协议，这样能够从该SA数据库中获取不同数据面安全处理模块需要的数据面安全协议对应的SA信息，使SA信息的使用与SA信息的协商管理解绑定，简化网络安全协议的管理，提高扩展性。
在另一种可能的实现方式中，该N个SA信息中的第一SA信息对应的属性信息还包括第一SA信息的来源，该过滤条件还包括第一数据面安全处理模块需要的SA信息的来源。第一数据面安全处理模块根据第一地址、以及该过滤条件中包含的第一数据面安全处理模块需要的数据面安全协议和第一数据面安全处理模块需要的SA信息的来源，从该SA数据库中获取m个SA信息。在一些场景中，第一数据面安全处理模块对SA的来源有要求，由于过滤条件包括第一数据面安全模块要求的来源，这样能够获取到满足第一数据面安全处理模块要求的SA信息。
在另一种可能的实现方式中，第一数据面安全处理模块基于第一地址，从该SA数据库中获取x个SA信息，x为大于或等于m且小于或等于N的自然数。第一数据面安全处理模块基于随机方式或轮询方式从该x个SA信息中，选择m个SA信息。其中，x个SA信息是SA数据库中包括第一地址的各SA信息，这样每当第一数据面安全处理模块需要发送目的地址为第一地址的报文，从该x个SA信息中选择m个SA信息，这样不用频繁查询SA数据库。
在另一种可能的实现方式中，第一设备向第三设备上报第一设备的安全能力，该安全能力包括支持的至少一个安全处理算法和/或支持的至少一个数据面安全协议，以支持第三设备基于第二设备的安全能力、第一设备的安全能力和第一设备与第二设备之间的安全策略生成至少一个SA信息，并在该SA数据库中保存至少一个SA信息。其中，安全策略用于指示目标安全处理和目标数据面安全协议，至少一个SA信息中的每个SA信息包括的地址为第二设备的地址，每个SA信息中的SA标识是第三设备分配的，每个SA信息中的安全参数是安全策略指定的参数且是第一设备的安全能力和第二设备的能力均支持的参数。
在另一种可能的实现方式中，第三设备是管理设备、管理设备用于为至少三个设备中的 每个设备分别生成每个设备与每个设备的通信对端设备所需的SA信息，该至少三个设备包括第一设备和第二设备。如此，通过第三设备集中式地为第一设备和第二设备生成SA信息，第一设备和第二设备不用部署用于协商生成SA信息的协商模块，节省第一设备和第二设备的计算资源。
在另一种可能的实现方式中，第三设备是第一设备对应的协商设备，其中，第一设备对应的协商设备用于为第一设备协商第一设备与通信对端设备所需的SA信息。如此在第一设备和第一设备的对端通信设备是不同区域(如不同国家)的设备，这样通过协商设备为第一设备协商生成SA信息，保证第一设备能够得到SA信息。
在另一种可能的实现方式中，第一设备对应的协商设备与第一设备集成于同一个物理设备中。这样第一设备能够直接协商生成SA信息，实现分布式协商，并且不需要部署单独的用于统计产生SA信息的第三设备，节省成本。
在另一种可能的实现方式中，数据面安全协议包括：媒体接入控制安全MACSec、互联网协议安全IPSec、分段路由互联网协议第六版安全SRv6Sec或安全套接字SSL。
在另一种可能的实现方式中，第一数据面安全处理模块与至少一个数据面安全协议相对应。
在另一种可能的实现方式中，第一设备包括多个数据面安全处理模块，该SA数据库是多个数据面安全处理模块中的至少两个数据面安全处理模块具有访问权限的SA数据库。这样该SA数据库是该至少两个数据面安全处理模块的共享数据库，这样不同数据库安全处理模块能够共享该SA数据库中的SA信息，使得SA信息的管理与使用解绑定。
在另一种可能的实现方式中，第一SA信息还包括老化时长。第一设备当第一SA信息在该SA数据库中的存储时长超过该老化时长时，获取第二SA信息并将第一SA信息替换为第二SA信息，第二SA信息包括的地址与第一SA信息包括的地址相同，第二SA信息包括的安全参数和第一SA信息包括的安全参数不同。这样每隔一段时间更新第一SA信息，防止第一SA信息被长时间攻破，提高安全性。
在另一种可能的实现方式中，第一SA信息的安全参数包括安全处理算法和安全处理算法需要的第一参数，第二SA信息的安全参数包括安全处理算法和安全处理算法需要的第二参数，第一参数和第二参数不同。这样每隔一段时间更新该安全处理算法需要的参数，防止第一参数被长时间攻破，提高安全性。
在另一种可能的实现方式中，第一数据面安全处理模块通过公共接口从SA数据库中获取所述m个SA信息。这样每个数据面安全处理模块通过公共接口访问SA数据库，使得不同数据库安全处理模块能够共享该SA数据库中的SA信息，使得SA信息的管理与使用解绑 定。
在另一种可能的实现方式中，公共接口包括发布/订阅Pub/Sub接口。
在另一种可能的实现方式中，第一安全处理包括以下一项或多项：加密处理、认证处理，防篡改处理或防重放处理。
第二方面，本申请提供了一种处理报文的方法，所述方法应用于第二设备，第二设备包括至少一个数据面安全处理模块，第二设备对应的安全联盟SA数据库包括M个SA信息，M为大于0的自然数，该M个SA信息中的每个SA信息包括SA标识和安全参数。在所述方法中，第二设备接收第一报文，第一报文包括m个SA标识和净荷，m是大于0且小于或等于M的自然数。第二数据面安全处理模块基于该m个SA标识，从SA数据库中获取该m个SA标识对应的m个SA信息，第二数据面安全处理模块是第二设备包括的至少一个数据面安全处理模块中的一个数据面安全处理模块。第二数据面安全处理模块基于该m个SA信息包括的安全参数，对第一报文的净荷进行第二安全处理。
由于第二设备对应的SA数据库包括M个SA信息，第二设备接收的第一报文包括m个SA标识，第二数据面安全模块基于该m个SA标识，从该SA数据库中m个SA信息。如此在第二设备每次与第一设备建立连接后并接收到报文时，第二设备和第一设备不需要先协商产生SA信息，而是第二设备基于接收的报文中的SA标识从该SA数据库中获取m个SA信息，通过该m个SA信息对接收的报文进行安全处理，从而提高安全处理效率，节省了网络资源的开销。
在一种可能的实现方式中，第二设备向第三设备上报第二设备的安全能力，该安全能力包括支持的至少一个安全处理算法和/或支持的至少一个数据面安全协议，以支持第三设备基于第一设备的安全能力、第二设备的安全能力和第一设备与所述第二设备之间的安全策略生成至少一个SA信息，并在SA数据库中保存至少一个SA信息。其中，该安全策略用于指示目标安全处理和目标数据面安全协议，每个SA信息中的SA标识是第三设备分配的，每个SA信息中的安全参数是该安全策略指定的参数且是第一设备的安全能力和第二设备的能力均支持的参数。
在另一种可能的实现方式中，第三设备是管理设备，管理设备用于为至少三个设备中的每个设备分别生成每个设备与每个设备的通信对端设备所需的SA信息，至少三个设备包括第一设备和第二设备，所述第二设备对应的协商设备用于为所述第二设备协商所述第二设备与通信对端设备所需的SA信息。如此，通过第三设备集中式地为第一设备和第二设备生成SA信息，第一设备和第二设备不用部署用于协商生成SA信息的协商模块，节省第一设备和第二设备的计算资源。
在另一种可能的实现方式中，第三设备是第二设备对应的协商设备，第二设备对应的协商设备用于为第二设备协商第二设备与通信对端设备所需的SA信息。如此在第二设备和第 二设备的对端通信设备是不同区域(如不同国家)的设备，这样通过协商设备为第二设备协商生成SA信息，保证第二设备能够得到SA信息。
在另一种可能的实现方式中，第一SA信息还包括老化时长。第二设备当第一SA信息在SA数据库中的存储时长超过老化时长时，获取第二SA信息并将第一SA信息替换为第二SA信息，第二SA信息包括的地址与第一SA信息包括的地址相同，第二SA信息包括的安全参数和第一SA信息包括的安全参数不同。这样每隔一段时间更新第一SA信息，防止第一SA信息被长时间攻破，提高安全性。
在另一种可能的实现方式中，第一SA信息的安全参数包括安全处理算法和安全处理算法需要的第一参数，第二SA信息的安全参数包括安全处理算法和安全处理算法需要的第二参数，第一参数和第二参数不同。这样每隔一段时间更新该安全处理算法需要的参数，防止第一参数被长时间攻破，提高安全性。
在另一种可能的实现方式中，第二数据面安全处理模块基于m个SA标识，通过公共接口从SA数据库中获取m个SA标识对应的m个SA信息。这样每个数据面安全处理模块通过公共接口访问SA数据库，使得不同数据库安全处理模块能够共享该SA数据库中的SA信息，使得SA信息的管理与使用解绑定。
在另一种可能的实现方式中，公共接口包括发布/订阅Pub/Sub接口。
在另一种可能的实现方式中，第二安全处理包括以下一项或多项：解密处理、认证处理，防篡改处理或防重放处理。
第三方面，本申请提供了一种获取安全联盟SA信息的方法，在所述方法中：获取第一设备的安全能力、第二设备的安全能力以及第一设备和所述第二设备之间的安全策略。第一设备的安全能力包括第一设备支持的安全处理算法和/或第一设备支持的数据面安全协议，第二设备的安全能力包括第二设备支持的安全处理算法和/或第二设备支持的数据面安全协议，安全策略用于指示目标安全处理和目标数据面安全协议。基于第一设备的安全能力、第二设备的安全能力和所述安全策略，生成至少一个SA信息，至少一个SA信息中的每个SA信息包括第一地址、SA标识和安全参数；安全参数是安全策略指定的参数且是第一设备的安全能力和第二设备的安全能力均支持的参数。
通过获取第一设备的安全能力、第二设备的安全能力以及第一设备和所述第二设备之间的安全策略，基于第一设备的安全能力、第二设备的安全能力和所述安全策略，生成至少一个SA信息，如此能够为第一设备和第二设备统一生成SA信息。这样第一设备和第二设备不用包括协商模块，从而节省第一设备和第二设备的计算资源。
在一种可能的实现方式中，基于第一设备的安全能力、第二设备的安全能力和安全策略，生成至少一个SA信息对应的属性信息，至少一个SA信息中的第一SA信息对应的属性信息 包括能够使用第一SA信息的一个或多个数据面安全协议。由于第一SA对应的属性信息包括能够使用第一SA信息的一个或多个数据面安全协议，数据面安全处理模块获取SA信息的过滤条件包括该数据面安全处理模块需要的数据面安全协议，如此不同数据面安全处理模块基于过滤条件获取到不同数据面安全处理模块需要的数据面安全协议对应的SA信息，使SA信息的使用与SA信息的协商管理解绑定，简化网络安全协议的管理，提高扩展性。
在另一种可能的实现方式中，基于第一设备的安全能力、第二设备的安全能力和安全策略，获取协议集合和算法集合。协议集合是第一设备支持的数据面安全协议、第二设备支持的数据面安全协议和目标数据面安全协议的交集，算法集合是所述第一设备支持的安全处理算法和所述第二设备支持的安全处理算法的交集。基于协议集合、算法集合和目标安全处理，生成至少一个SA信息。
在另一种可能的实现方式中，第一SA信息中的安全参数包括第一安全处理算法和第一安全处理算法需要的参数，第一安全处理算法是算法集合中的算法且第一安全处理算法对应的数据面安全协议是协议集合中的协议。
在另一种可能的实现方式中，在第一设备对应的SA数据库中保存至少一个SA信息，和/或，在第二设备对应的SA数据库中保存至少一个SA信息。
第四方面，本申请提供了一种处理报文的装置，用于执行第一方面或第一方面的任意一种可能的实现方式中的方法。具体地，所述装置包括用于执行第一方面或第一方面的任意一种可能的实现方式中的方法的单元。
第五方面，本申请提供了一种处理报文的装置，用于执行第二方面或第二方面的任意一种可能的实现方式中的方法。具体地，所述装置包括用于执行第二方面或第二方面的任意一种可能的实现方式中的方法的单元。
第六方面，本申请提供了一种获取安全联盟SA信息的装置，用于执行第三方面或第三方面的任意一种可能的实现方式中的方法。具体地，所述装置包括用于执行第三方面或第三方面的任意一种可能的实现方式中的方法的单元。
第七方面，本申请提供了一种处理报文的设备，所述设备包括处理器和存储器。其中，所述处理器以及所述存储器之间可以通过内部连接相连。所述存储器用于存储程序，所述处理器用于执行所述存储器中的程序，使得所述设备完成第一方面或第一方面的任意可能的实现方式中的方法。
第八方面，本申请提供了一种处理报文的设备，所述设备包括处理器和存储器。其中，所述处理器以及所述存储器之间可以通过内部连接相连。所述存储器用于存储程序，所述处理器用于执行所述存储器中的程序，使得所述设备完成第二方面或第二方面的任意可能的实 现方式中的方法。
第九方面，本申请提供了一种获取安全联盟SA信息的设备，所述设备包括处理器和存储器。其中，所述处理器以及所述存储器之间可以通过内部连接相连。所述存储器用于存储程序，所述处理器用于执行所述存储器中的程序，使得所述设备完成第三方面或第三方面的任意可能的实现方式中的方法。
第十方面，本申请提供了一种计算机程序产品，所述计算机程序产品包括在计算机可读存储介质中存储的计算机程序，并且所述计算程序通过处理器进行加载来实现上述第一方面、第二方面、第三方面、第一方面任意可能的实现方式、第二方面任意可能的实现方式或第三方面任意可能的实现方式的方法。
第十一方面，本申请提供了一种计算机可读存储介质，用于存储计算机程序，所述计算机程序通过处理器进行加载来执行上述第一方面、第二方面、第三方面、第一方面任意可能的实现方式、第二方面任意可能的实现方式或第三方面任意可能的实现方式的方法。
第十二方面，本申请提供了一种芯片，包括存储器和处理器，存储器用于存储计算机指令，处理器用于从存储器中调用并运行该计算机指令，以执行上述第一方面、第二方面、第三方面、第一方面任意可能的实现方式、第二方面任意可能的实现方式或第三方面任意可能的实现方式的方法。
第十三方面，本申请提供了一种处理报文的设备，包括存储器和处理器，存储器用于存储计算机指令，处理器用于从存储器中调用并运行该计算机指令，以执行上述第一方面、第二方面、第一方面任意可能的实现方式或第二方面任意可能的实现方式的方法。
第十四方面，本申请提供了一种获取安全联盟SA信息的设备，包括存储器和处理器，存储器用于存储计算机指令，处理器用于从存储器中调用并运行该计算机指令，以执行上述第三方面或第三方面任意可能的实现方式的方法。
第十五方面，本申请提供了一种处理报文的系统，包括第四方面所述的装置和第五方面所述的装置，或者，包括第七方面所述的装置和第八方面所述的装置。
在一种可能的实现方式中，所述系统还包括第六方面所述的装置或第九方面所述的装置。
附图说明
图1是本申请实施例提供的协商生成密钥的流程图；
图2是本申请实施例提供的SA协商建立的流程图；
图3是本申请实施例提供的协商密钥交换的流程图；
图4是本申请实施例提供的一种网络架构的示意图；
图5是本申请实施例提供的另一种网络架构的示意图；
图6是本申请实施例提供的另一种网络架构的示意图；
图7是本申请实施例提供的另一种网络架构的示意图；
图8是本申请实施例提供的一种集中式获取SA信息的方法流程图；
图9是本申请实施例提供的一种分布式获取SA信息的方法流程图；
图10是本申请实施例提供的一种处理报文的方法流程图；
图11是本申请实施例提供的另一种处理报文的方法流程图；
图12是本申请实施例提供的一种处理报文的设备结构示意图；
图13是本申请实施例提供的另一种处理报文的设备结构示意图；
图14是本申请实施例提供的一种获取SA信息的设备结构示意图；
图15是本申请实施例提供的一种处理报文的装置结构示意图；
图16是本申请实施例提供的另一种处理报文的装置结构示意图；
图17是本申请实施例提供的一种获取SA信息的装置结构示意图。
具体实施方式
下面将结合附图对本申请实施方式作进一步地详细描述。
通常，跨网络链路是不安全的，小到个人的隐私，大到国家机密，数据要从互联网的这头传到那头，就会面临网络安全问题。为了提高数据传输的安全性，发送端使用SA信息对需要发送的数据进行安全处理，向接收端发送经过安全处理的数据。
在网络中，无论是物理层、数据链路层、网络层，还是上层的对话层和应用层，每一层协议中都包含安全处理方案。这些安全处理方案包括媒体接入控制安全(media access control security，MACSec)、因特网协议安全(internet protocol security，IPSec)和/或安全套接字(secure sockets layer，SSL)等。
MACSec定义了基于IEEE 802局域网络的数据安全通信的方法。MACSec能够为用户提供安全的MAC层数据发送和接收服务，包括用户数据加解密、数据帧完整性检查、数据源真实性校验以及重播保护。MACSec中的MACsec密钥协商协议(MACSec key agreement，MKA)定义了密钥管理协议，以及定义了协议报文仍采用802.1X报文格式。MACSec是对原有802.1X协议的改善和扩展。使用MKA协议协商生成的密钥对已认证的用户数据进行加密和完整性检查，避免端口处理未认证设备的报文或者未认证设备篡改的报文。MACSec使用二层加密技术，提供逐跳的数据安全传输。
参见图1所示的MACSec使用MKA协议协商生成的密钥(即为SA信息)流程。MKA定义设备之间使用配置的预共享密钥(Pre-Shared Key，PSK)作为安全连接关联密钥(secure Connectivity Association Key，CAK)，通过EAPOL-MKA报文协商会话(其中，EAPOL为基于局域网的扩展认证协议，EAPOL的英文全称为：extensible authentication protocol over LAN)。MKA将多个设备间优先级较高的端口选举为密钥服务器(Key Server)，Key Server负责生成和分发安全关联密钥(secure association key，SAK)。其中，图1中的MI(member identifier)是成员标识符，MN(Message Number)是消息编号。CA1和CA2为同一个安全链接关联上的证书颁发机构(certificate authority，CA)成员。
IPsec是国际互联网工程任务组(the internet engineering task force，IETF)提出的三层隧道加密协议，为因特网(Internet)上传输的数据提供了高质量的、可互操作的、基于密码学的安全保证。特定的通信方之间在IP层通过加密与数据源认证等方式，提供了以下的安全服务：数据机密性，数据完整性，数据来源认证，防重放。IPSec中的因特网密钥交换(internet key exchange，IKE)可实现密钥的自动协商功能，减少了密钥协商的开销。可以通过IKE建立和维护SA的服务，简化了IPsec的使用和管理。
参见图2，因特网密钥交换第二版(internet key exchange version 2，IKEv2)通过初始交换就能够完成第一对IPSec SA的协商建立。在图5中，消息①和②属于第一次交换(称为IKE_SA_INIT交换)，以明文方式完成IKE SA的参数协商，包括协商加密和验证算法，交换临时随机数和迪菲-赫尔曼(diffie-hellman，DH)交换。IKE_SA_INIT交换后生成一个共享密钥材料，通过这个共享密钥材料可以衍生出IPSec SA的所有密钥。
消息③和④属于第二次交换(称为IKE_AUTH交换)，以加密方式完成身份认证、对前两条信息的认证和IPSec SA的参数协商。IKEv2支持非对称加密(RSA)签名认证、预共享密钥认证以及扩展认证方法(extensible authentication protocol，EAP)。EAP认证是作为附加的IKE_AUTH交换在IKE中实现的，发起者通过在消息3中省去认证载荷来表明需要使用EAP认证。
SSL是解决万维网安全性问题的，位于应用层和传输层之间。SSL理论上能够为所有基于传输控制协议(transmission control protocol，TCP)等可靠连接的应用层协议提供安全性保证。SSL也是利用数据加密、身份验证和消息完整性验证机制来保证网络上传输数据的安全性的。SSL已成为网络中用来鉴别站点和网页浏览者身份，在浏览器使用者及网页服务器(webserver)之间进行加密通信的全球化标准。SSL协议已被集成到大部分的浏览器中，如因特网浏览器(internet explore)、谷歌浏览器(chrome)、火狐浏览器(Firefox)等。这就意味着任意一台装有浏览器的计算机都支持SSL连接。不需要安装额外的客户端(client)软件。SSL握手协议用来协商通信过程中使用的加密套件(加密算法、密钥交换算法和MAC算法等)、在server和client之间安全地交换密钥、以及实现server和client的身份验证。
参见图3所示的SSL协商密钥交换过程，该过程包括如下1-5步。
1.client_hello
client_hello，为客户端发起的请求，以明文传输请求信息，包含版本信息，加密套件候选列表，压缩算法候选列表，随机数，扩展字段等信息。客户端支持的加密套件(cipher suites)列表，每个加密套件对应前面传输层安全(transport layer security，TLS)原理中的四个功能的组合：认证算法Au(用于身份验证)、密钥交换算法KeyExchange(用于密钥协商)、对称加密算法Enc(用于信息加密)和信息摘要Mac(用于完整性校验)。
2.server_hello+server_certificate+sever_hello_done
server_hello，为服务端返回协商的信息结果，包括选择使用的协议版本(version)，选择的加密套件(cipher suite)，选择的压缩算法(compression method)、随机数(random_S)等，其中随机数用于后续的密钥协商。
server_certificates，为服务器端配置对应的证书链，用于身份验证与密钥交换。
server_hello_done，用于通知客户端server_hello信息发送结束。
3.证书校验
4.client_key_exchange+change_cipher_spec+encrypted_handshake_message
client_key_exchange，合法性验证通过之后，客户端计算产生随机数字“Pre-master”，并用证书公钥加密，发送给服务器。此时客户端已经获取全部的计算协商密钥需要的信息，包括：两个明文随机数random_C和random_S，自己计算产生的Pre-master，以及计算得到协商密钥，协商密钥为：enc_key＝Fuc(random_C,random_S,Pre-Master)。
change_cipher_spec，客户端通知服务器后续的通信都采用协商的通信密钥和加密算法进行加密通信。
encrypted_handshake_message，结合已得到所有通信参数的哈希(hash)值与其它相关信息生成一段数据，采用协商密钥session secret与算法进行加密，然后发送给服务器用于数据与握手验证。
5.change_cipher_spec+encrypted_handshake_message
服务器用私钥解密加密Pre-master数据，基于已交换的两个明文随机数random_C和random_S，计算得到协商密钥：enc_key＝Fuc(random_C,random_S,Pre-Master)；计算所有已接收信息的hash值，然后解密客户端发送的encrypted_handshake_message，验证数据和密钥正确性。
change_cipher_spec,验证通过之后，服务器同样发送change_cipher_spec以告知客户端后续的通信都采用协商的密钥与算法进行加密通信。
encrypted_handshake_message,服务器也结合所有当前的通信参数信息生成一段数据并采用协商密钥session secret与算法加密并发送到客户端。
其中，每种网络安全协议都有自己的控制面密钥协商协议(SA的生产者)和数据面加密协议(SA的消费者)，例如，MACSec使用MKA协商SA，IPSec使用IKE协商SA。当前在一个链接中，通信双方使用控制面秘钥协商协议(SA生产者)协商SA，并且协商出的AS只能用于本连接中数据面加密协议(SA消费者)对传输的数据进行加密。即一个连接协商出的SA只能保护本链接数据面的通信数据。所以目前控制面SA协商管理和数据面SA使用之间强绑定，管理复杂，扩展性差，添加新的加密特性(例如：双重加密)困难。
参见图4，本申请实施例提供了一种网络架构100，包括：第一设备101和第二设备102，第一设备101与第二设备102之间存在通信连接。
在一些实施例中，第一设备101和第二设备102均位于通信网络中，第一设备101在通信网络中建立与第二设备102之间的通信连接，以实现第一设备101与第二设备102通信。当然，还有其他实现第一设备101与第二设备102通信的方式，在此不再一一列举。
其中，第一设备101存在对应的第一SA数据库103，第一SA数据库103用于存储N个SA信息，N为大于0的自然数。对于该N个SA信息中的每个SA信息，每个SA信息包括地址、SA标识和安全参数。
可选地，在一些实施例中，第一SA数据库103还包括该N个SA信息对应的属性信息。第一SA数据库103包括SA信息与属性信息的对应关系，对于该N个SA信息中的每个SA信息，该对应关系用于保存每个SA信息和每个SA信息对应的属性信息。
对于该N个SA信息中的任一个SA信息，为了便于说明，将该SA信息称为第一SA信息，第一SA信息对应的属性信息包括能够使用第一SA信息的一个或多个数据面安全协议。
第一设备101包括至少一个数据面安全处理模块，第一设备101使用SA信息对第一设备101发送给第二设备的报文进行第一安全处理。在实现时：
对于待发送给第二设备102的报文，待发送报文的目的地址为第二设备102的地址，第一设备101中的第一数据面安全处理模块使用m个SA信息包括的安全参数对待发送报文的净荷进行第一安全处理。m为大于0且小于或等于N的整数，该m个SA信息是第一SA数据库103中的SA信息且该m个SA信息包括的地址为第二设备102的地址。第一数据面安全处理模块为第一设备101包括的至少一个数据面安全处理模块中的任一个，在待发送报文中添加该m个SA信息的SA标识，以得到第一报文，第一报文的净荷是第一安全处理后的净荷。然后第一设备101的通信接口向第二设备102发送第一报文。
可选地，在一些实施例中，第一设备101包括多个数据面安全处理模块，即第一设备101包括两个数据面安全处理模块或两个以上的数据面安全处理模块。该多个数据面安全处理模块中的至少两个数据面安全处理模块具有访问第一SA数据库103的权限。
可选地，在一些实施例中，在第一设备101中的第一数据面安全处理模块与至少一个数据面安全协议相对应。第一设备101中的每个数据面安全处理模块对应的数据面安全协议可能不同。
可选地，在一些实施例中，第一数据面安全处理模块对应的数据面安全协议是网络管理员配置的。在网络管理员配置第一数据面安全处理模块对应的数据面安全协议后，网络管理员还可能修改与第一数据面安全处理模块相对应的数据面安全协议。
在一些实施例中，数据面安全协议包括但不限于如下一个或多个：IPSec、MACSec、分段路由互联网协议第六版安全(segment routing internet protocol version 6 security，SRv6Sec)或SSL等。
在一些实施例中，第一设备101对待发送报文进行处理的详细过程，将在后续图10所示实施例进行说明，在此先不详细介绍。
其中，第二设备102存在对应的第二SA数据库104，第二SA数据库104用于存储M个SA信息。第一SA数据库103中存在部分SA信息和第二SA数据库104中存在部分SA信息相同，相同的SA信息的个数大于或等于m，M为大于或等于m的自然数。
可选地，在一些实施例中，第二SA数据库104还包括该M个SA信息对应的属性信息。第二SA数据库104包括SA信息与属性信息的对应关系，该对应关系用于保存该M个SA信息中的每个SA信息和该每个SA信息对应的属性信息。
第二设备102包括至少一个数据面安全处理模块，在第一设备101发送第一报文后，第二设备102的通信接口接收第一报文。第二设备102中的第二数据面安全处理模块基于第一报文包括的m个SA标识，从第二SA数据库104中获取该m个SA标识对应的m个SA信息，基于该m个SA信息包括的安全参数对第一报文包括的净荷进行第二安全处理。第二数据面安全处理模块为第二设备102包括的至少一个数据面安全处理模块中的任一个。
可选地，在一些实施例中，第二设备102包括多个数据面安全处理模块，即第二设备102包括两个数据面安全处理模块或两个以上的数据面安全处理模块。该多个数据面安全处理模块中的至少两个数据面安全处理模块具有访问第二SA数据库104的权限。
在一些实施例中，在第二设备102中的第二数据面安全处理模块与至少一个数据面安全协议相对应。第二设备102中的每个数据面安全处理模块对应的数据面安全协议可能不同。
在一些实施例中，第二数据面安全处理模块对应的数据面安全协议是网络管理员配置。在网络管理员配置第二数据面安全处理模块对应的数据面安全协议后，网络管理员还可能修改与第二数据面安全处理模块相对应的数据面安全协议。
在一些实施例中，第二设备102对第一报文进行处理的详细过程，将在后续图11所示实施例进行说明，在此先不详细介绍。
其中，第一设备101和第二设备102使用第一SA数据库103和第二SA数据库104之间的相同SA信息对第一设备101发送给第二设备102的报文进行安全处理，从而提高发送报文的安全性。
假设，该相同SA信息包括第一SA信息，第一SA信息包括的安全参数是第一设备101执行第一安全处理和第二设备102执行第二安全处理所需要的参数。
在一些实施例中，该安全参数包括安全处理算法和该安全处理算法所需要的参数等信息，该安全处理算法是用于实现第一安全处理和第二安全处理的算法。
例如，第一安全处理包括但不限于如下一项或多项：加密处理、认证处理、防篡改处理或防重放处理等。第二安全处理包括但不限于如下一项或多项：解密处理、认证处理、防篡改处理或防重放处理。
假设，第一安全处理包括加密处理，第二安全处理为解密处理，则该安全参数包括加解密算法和该加解密算法需要的参数等信息。该加解密算法实现的第一安全处理为加密处理，该加解密算法实现的第二安全处理为解密处理，该加解密算法需要的参数包括密钥和/或密钥长度等参数。
再假设，第一安全处理包括加密处理和认证处理，第二安全处理为解密处理和认证处理。也就是说，第一设备101对待发送报文的净荷进行加密后，还对加密后的净荷进行计算得到第一信息摘要，其中第一设备101发送的第一报文还包括第一信息摘要。第二设备102对第一报文中的净荷进行计算得到第二信息摘要，比较第一信息摘要和第二信息摘要，如果比较出第一信息摘要和第二信息摘要相同，则对第一报文认证通过，并对第一报文中的净荷进行解密。所以对于实现第一安全处理和第二安全处理的安全处理算法，该安全处理算法包括加解密算法和用于计算信息摘要的算法，该安全参数包括加解密算法、用于计算信息摘要算法、该加解密算法需要的参数和用于计算信息摘要算法需要的参数等信息。
可选地，在一些实施例中，第一SA信息还包括但不限于如下一项或多项信息：老化时长或安全模式等。
在一些实施例中，该安全模式包括但不限于如下一项或多项模式：加密模式或认证模式等。
在一些实施例中，第一安全处理和/或第二安全处理是用于增加第一设备101和第二设备102之间传输数据安全性的处理。
在一些实施例中，第一设备101为终端设备或路由设备等，第二设备102为终端设备或路由设备等，路由设备为路由器、交换机或网关等设备。例如，第一设备101和第二设备102为不可信网络的两个边缘路由设备，第一设备101通过该网络向第二设备102发送报文。由于该网络不可信，所以第一设备101和第二设备102需要对该报文进行安全处理。
可选地，在一些实施例中，第一设备101包括第一SA数据库103，或者，第一SA数据库103所在设备与第一设备101是不同设备，例如，第一SA数据库103位于存储设备上。
可选地，在一些实施例中，第二设备102包括第二SA数据库104，或者，第二SA数据库104所在设备与第二设备102是不同设备，例如，第二SA数据库104位于存储设备上。
可选地，在一些实施例中，第一SA数据库103和第二SA数据库104位于同一存储设备上，第一SA数据库103和第二SA数据库104为同一SA数据库，该SA数据库与第一设备101的地址和第二设备102的地址绑定。
本申请实施例提供了多种方案用以协商并生成各通信对端设备对应的SA数据库。可选地，其中一种方案是采用集中式的SA协商方案，如附图5所示，网络中有一个专用的协商管理设备，用以为至少三个设备中的每个设备分别生成每个设备与每个设备的通信对端设备所需的SA信息，该至少三个设备包括第一设备101和第二设备102。
另一种方案是采用分布式的SA协商方案，如图7所示，各通信对端设备分别有一个对应的协商设备。例如第一设备101对应的第一协商设备，第一协商设备为第一设备101协商第一设备101与通信对端设备所需的SA信息。
可选地，参见图5，该网络架构100还包括第三设备105，第三设备105分别与第一设备101和第二设备102通信。第三设备是协商管理设备，用于在图5所示的集中式的SA协商方案中根据网络中的多个设备的安全能力和安全策略，为该多个设备生成SA信息。
在一些实施例中，第三设备105位于通信网络中，第三设备105在该通信网络中建立与第一设备101的通信连接，以实现与第一设备101通信。第三设备105在该通信网络中建立与第二设备102的通信连接，以实现与第二设备102通信。
第三设备105用于为至少三个设备中的每个设备分别生成每个设备与每个设备的通信对端设备所需的SA信息，该至少三个设备包括第一设备101。
例如，第一设备101的通信对端设备为第二设备102。第三设备105基于第一设备101与第二设备102之间的安全策略、第一设备101的安全能力和第二设备102的安全能力，生成至少一个SA信息。将至少一个SA信息保存在第一SA数据库103中，和/或，将至少一个SA信息保存在第二SA数据库104中。
在一些实施例中，第三设备105还基于第一设备101与第二设备102之间的安全策略、第一设备101的安全能力和第二设备102的安全能力，生成该至少一个SA信息对应的属性信息。这样第三设备105将每个SA信息和每个SA信息对应的属性信息保存在第一SA数据库103包括的SA信息与属性信息的对应关系中，和/或，将每个SA信息和每个SA信息对应的属性信息保存在第二SA数据库104包括的SA信息与属性信息的对应关系中。
其中，第一设备的安全能力包括第一设备支持的至少一个安全处理算法和/或第一设备支持的至少一个数据面安全协议等内容，第二设备的安全能力包括第二设备支持的至少一个安全处理算法和/或第二设备支持的至少一个数据面安全协议等内容。该安全策略用于指示目标安全处理算法和/或目标数据面安全协议。
其中，第三设备105生成SA信息的详细过程，将在后续图8所示实施例进行说明，在此先不详细介绍。
在一些实施例中，参见图6，第三设备105包括但不限于如下一个或多个设备：控制器1051、网管设备1052、量子密钥分发(quantum key distribution，QKD)设备1053或数据面 安全协议对应的控制面设备。例如，参见图6，该数据面安全协议对应的控制面设备为SSL对应的手册(Manual)控制面设备1054等。
可选地，参见图7，该网络架构100还包括第一设备101对应的第一协商设备106和第二设备102对应的第二协商设备107，第一协商设备106分别与第一设备101和第二协商设备107通信，第二协商设备107还与第二设备102通信。
在一些实施例中，第一协商设备106和第二协商设备107位于通信网络中，第一协商设备106在该通信网络中分别建立与第一设备101和第二协商设备107之间的通信连接，以实现与第一设备101和第二协商设备107通信；第二协商设备107在该通信网络中建立与第二设备102的通信连接，以实现与第二设备102通信。
第一协商设备106用于为第一设备101协商第一设备101与通信对端设备所需的SA信息。第二协商设备107用于为第二设备102协商第二设备102与通信对端设备所需的SA信息。
可选地，参见图7，第一设备101和第一协商设备106为不同物理设备，第二设备102和第二协商设备107为不同物理设备。此情况可能应用于如下场景，该场景为第一设备101和第二设备102位于不同的区域(如不同国家)。第一设备101和第一协商设备106位于同一区域(将该区域称为第一区域)，第二设备102和第二协商设备107位于同一区域(将该区域称为第二区域)。第一协商设备106和第二协商设备107协商生成第一设备101和第二设备102所需的SA信息。可选地，在此场景下，第一协商设备106能够为第一区域内的各设备协商生成各设备与各设备的通信对端设备所需的SA信息。第二协商设备107能够为第二区域内的各设备协商生成各设备与各设备的通信对端设备所需的SA信息。
可选地，第一设备101和第一协商设备106集成在同一物理设备中，第二设备102和第二协商设备107集成在同一物理设备中。第一协商设备106是第一设备101中的协商模块，第二协商设备107是第二设备102中的协商模块。
第一协商设备106为服务器或数据面安全协议对应的控制面设备，第二协商设备107为服务器或数据面安全协议对应的控制面设备。
例如，第一协商设备106为MACSec对应的MKA控制面设备，第二协商设备107也为MKA控制面设备。或者，第一协商设备106为IPSec对应的IKE控制面设备，第二协商设备107也为IKE控制面设备。
对于上述第一SA数据库中保存的SA信息和属性信息的对应关系，第二SA数据库中保存的SA信息和属性信息的对应关系，接下来详细列举了几种向第一SA数据库和/或向第二SA数据库中保存SA信息和属性信息的对应关系的方式。该几种方式分别为集中式方式和分布式方式。
对于集中式方式，集中式方式应用于图5或图6所示的网络架构100，在集中式方式中，第三设备生成至少一个SA信息。将该至少一个SA信息保存在第一SA数据库(如图5或图6所示的第一SA数据库103)中，和/或，将该至少一个SA信息保存在第二SA数据库(如图5或图6所示的第二SA数据库104)中。
参见图8，在实现时通过如下步骤501至步骤505的流程来实现集中式方式。该步骤501至步骤505所示集中式方式的流程包括步骤501-505。
步骤501：第一设备向第三设备上报第一设备的安全能力，第一设备的安全能力包括第一设备支持的至少一个安全处理算法和/或第一设备支持的至少一个数据面安全协议等。
第一设备支持的至少一个安全处理算法是第一设备中包括的安全处理算法。
在步骤501中，第一设备包括至少一个数据面安全处理模块，每个数据面安全处理模块对应至少一个数据面安全协议。所以第一设备获取其包括的每个数据面安全处理模块对应的数据面安全协议，以得到第一设备支持的至少一个数据面安全协议。
对于第一设备中的任一个数据面安全处理模块，该数据面安全处理模块可以调用第一设备中的一个或多个安全处理算法，使用调用的安全处理算法来实现第一安全处理。
例如，假设第一安全处理包括加密处理的情况，用于实现加密处理的安全处理算法为加解密算法。第一设备包括一种或多种加解密算法，该数据面安全处理模块调用第一设备中的加解密算法，使用调用的加解密算法来实现加密处理。
再假设第一安全处理包括加密处理和认证处理的情况，第一设备包括一种或多种加解密算法，以及一种或多种用于计算信息摘要算法，该数据面安全处理模块调用第一设备中的加解密算法和用于计算信息摘要算法，使用调用的加解密算法和用于计算信息摘要算法来实现加密处理和认证处理。
可选地，在一些实施例中，对于第一设备中的每个安全处理算法，该安全处理算法与数据面安全协议相对应，第一设备使用该安全处理算法，来实现基于该数据面安全协议的第一安全处理。
例如，第一设备支持的数据面安全协议包括如下一个或多个：MACSec、IPSec、SSL或SRv6Sec等。以IPSec为例，第一设备中可能包括IPSec对应的加解密算法和/或用于计算信息摘要算法，第一设备使用该加解密算法和/或用于计算信息摘要算法，来实现基于IPSec加密处理和/或认证处理。再以MACSec为例，第一设备中还可能包括MACSec对应的加解密算法和/或用于计算信息摘要算法，第一设备使用该加解密算法和/或用于计算信息摘要算法，来实现基于MACSec加密处理和/或认证处理。
在一些实施例中，第一设备向第三设备发送第一设备信息，第一设备信息包括第一设备支持的至少一个安全处理算法的算法标识和/或第一设备支持的至少一个数据面安全协议的协议标识等信息，以实现向第三设备上报第一设备的安全能力。
例如，假设第一设备包括与MACSec相对应的加解密算法以及第一设备的地址为“192.168.178.5”，第一设备支持的数据面安全协议包括MACSec。第一设备向第三设备发送第一设备信息，第一设备信息包括第一设备支持的加解密算法的算法标识“ID-MACEncy”和第一设备支持的数据面安全协议的协议标识“ID-MAC”。
步骤502：第二设备向第三设备上报第二设备的安全能力，第二设备的安全能力包括第二设备支持的至少一个安全处理算法和/或第二设备支持的至少一个数据面安全协议等。
在步骤502中，第二设备包括至少一个数据面安全处理模块，每个数据面安全处理模块对应至少一个数据面安全协议。所以第二设备获取其包括的每个数据面安全处理模块对应的数据面安全协议，以得到第二设备支持的至少一个数据面安全协议。
第二设备也包括至少一个安全处理算法，对于第二设备中的任一个数据面安全处理模块，该数据面安全处理模块可以调用第二设备中的一个或多个安全处理算法，使用调用的安全处理算法来实现第二安全处理。
例如，假设第二安全处理包括解密处理的情况，用于实现解密处理的安全处理算法为加解密算法，第二设备包括一种或多种加解密算法，该数据面安全处理模块调用第二设备中的加解密算法，使用调用的加解密算法来实现解密处理。
再假设第二安全处理包括解密处理和认证处理的情况，第二设备包括一种或多种加解密算法，以及一种或多种用于计算信息摘要算法，该数据面安全处理模块调用第二设备中的加解密算法和用于计算信息摘要算法，使用调用的加解密算法和用于计算信息摘要算法来实现解密处理和认证处理。
在一些实施例中，对于第二设备中的每个安全处理算法，该安全处理算法与数据面安全协议相对应，第二设备使用该安全处理算法，来实现基于该数据面安全协议的第二安全处理。
在一些实施例中，第二设备向第三设备发送第二设备信息，第二设备信息包括第二设备支持的至少一个安全处理算法的算法标识和/或第二设备支持的至少一个数据面安全协议的协议标识等信息，以实现向第三设备上报第二设备的安全能力。
例如，假设第二设备包括与MACSec相对应的加解密算法以及第二设备的地址为“192.168.1.4”，第二设备支持的数据面安全协议包括MACSec。第二设备向第三设备发送第二设备信息，第二设备信息包括第二设备支持的加解密算法的算法标识“ID-MACEncy”和第二设备支持的数据面安全协议的协议标识“ID-MAC”。
步骤503：第三设备获取安全策略，该安全策略包括第一地址、第二地址和安全需求信息，第一地址为第二设备的地址，第二地址为第一设备的地址。
该安全需求信息用于指示目标安全处理和目标数据面安全协议，该安全需求信息实质表示需要对第一设备发送给第二设备的报文执行基于目标数据面安全协议的目标安全处理。
在一些实施例中，该安全需求信息包括目标安全处理的处理类型和目标数据面安全协议的协议标识。第一地址是该报文的目的地址，第二地址是该报文的源地址。
例如，假设安全策略包括第一地址为“192.168.1.4”，第二地址为“192.168.178.5”，目标安全处理类型包括加密，目标数据面安全协议的协议标识包括“ID-MAC”和“ID-SRv6”，“ID-SRv6”为SRv6Sec的协议标识。其中，192.168.1.4为第二设备的地址，192.168.178.5为第一设备的地址，该安全策略用于表示需要对第一设备发送第二设备的报文，执行基于SRv6Sec的加密处理，和/或，执行基于IPSec的加密处理。
在一些实施例中，第三设备显示输入界面，网管人员在该输入界面中输入该安全策略，第三设备从输入界面中获取该安全策略。
在一些实施例中，网管人员在其对应的网管设备上输入该安全策略，网管设备向第三设备发送该安全策略，第三设备接收该安全策略。
其中，上述步骤501、步骤502和步骤503之间的执行顺序不分先后，可以先执行步骤501、再执行步骤502、之后执行步骤503；或者，也可以先执行步骤502、再执行步骤501、之后执行步骤503；或者，还可以先执行步骤503、再执行步骤501、之后执行步骤502；或者，可以同时执行步骤501、步骤502和步骤503。步骤501、步骤502和步骤503之间的执行顺序除了上述列举的几种顺序外，还可以有其他的顺序，在此不再一一列举。
步骤504：第三设备获取第一设备的安全能力、第二设备的安全能力，基于第一设备的安全能力、第二设备的安全能力和该安全策略，生成至少一个SA信息。
在步骤504中，第三设备还基于第一设备的安全能力、第二设备的安全能力和该安全策 略，生成至少一个SA信息对应的属性信息。
第三设备接收第一设备信息和第二设备信息，以实现获取第一设备的安全能力和第二设备的安全能力。
对于任一个SA信息，为了便于说明，将该SA信息称为第一SA信息，第一SA信息包括第一地址、SA标识和安全参数等内容。该安全参数是第一设备执行第一安全处理以及第二设备执行第二安全处理所需要的参数，第一安全处理需要使用安全处理算法来实现。所以，该安全参数包括安全处理算法和该安全处理算法需要的参数等信息。其中，该安全参数是安全策略指定的参数且是第一设备的安全能力和第二设备的能力均支持的参数。
在一些实施例中，第一SA信息还包括以下一项或多项信息：第一SA信息的老化时长或第一SA信息对应的安全模式等。该安全模式包括认证模式和/或加密模式等。该老化时长是第一SA信息存在的有效时间长度。
例如，以第一安全处理为加密处理，第二安全处理为解密处理为例，第一SA信息包括第一地址“192.168.1.4”、SA标识“ID-SA1”、安全参数、老化时长“24小时”和加密模式。该安全参数包括加解密算法和该加解密算法需要的密钥“secret key”。第一SA信息表示第一设备使用该加解密算法对第一设备发送给第二设备的报文进行加密处理，以及第二设备接收该报文时使用该加解密算法对该报文进行解密处理。
对于第一SA信息对应的属性信息，该属性信息包括能够使用第一SA信息的一个或多个数据面安全协议。
在一些实施例中，该属性信息还包括第一SA信息的来源。SA信息的来源是指SA的生产者。例如在本实施例中第一SA信息的来源为第三设备。
在步骤504中，通过如下5041-5044的操作来生成SA信息和SA信息对应的属性信息。该5041-5044的操作分别为：
5041：第三设备基于第一设备信息、第二设备信息和该安全需求信息，获取协议集合，该协议集合是第一设备支持的数据面安全协议、第二设备支持的数据面安全协议和该安全需求信息指示的数据面安全协议的交集。
在5041中，第三设备基于该安全策略中的第一地址和第二地址，从接收的设备信息中获取包括第二地址的第一设备信息和包括第一地址的第二设备信息。第三设备基于第一设备信息包括的第一设备支持的至少一个数据面安全协议的协议标识，确定第一设备支持的至少一个数据面安全协议。基于第二设备信息包括的第二设备支持的至少一个数据面安全协议的协议标识，确定第二设备支持的至少一个数据面安全协议。基于安全需求信息包括的目标数据面安全协议的协议标识，确定该安全需求信息指示的目标数据面安全协议。对第一设备支持的至少一个数据面安全协议、第二设备支持的至少一个数据面安全协议和该安全需求信息指示的目标数据面安全协议进行交集，得到协议集合。
例如，第三设备基于第二地址“192.168.178.5”，获取包括“192.168.178.5”的第一设备信息以及基于第一地址“192.168.1.4”，获取包括“192.168.1.4”的第二设备信息。基于第一设备信息包括的协议标识“ID-MAC”，确定第一设备支持的数据面安全协议为MACSec。基于第二设备信息包括的协议标识“ID-MAC”，确定第二设备支持的数据面安全协议为MACSec。基于目标数据面安全协议的协议标识“ID-MAC”和“ID-SRv6”，确定目标数据面安全协议包括MACSec和SRv6Sec。对于第一设备支持的MACSec、第二设备支持的MACSec和目标数据面安全协 议MACSec、SRv6Sec进行交集，得到协议集合，该协议集合包括MACSec。
5042：第三设备基于第一设备信息和第二设备信息，获取算法集合，该算法集合是第一设备支持的安全处理算法和第二设备支持的安全处理算法的交集。
第三设备基于第一设备信息包括的第一设备支持的至少一个安全处理算法的算法标识，确定第一设备支持的至少一个安全处理算法。基于第二设备信息包括的第二设备支持的至少一个安全处理算法的算法标识，确定第二设备支持的至少一个安全处理算法。对第一设备支持的至少一个安全处理算法和第二设备支持的至少一个安全处理算法进行交集，得到算法集合。
例如，基于第一设备信息包括的算法标识“ID-MACEncy”，确定第一设备支持的加解密算法ENcryption，以及基于第二设备信息包括的算法标识“ID-MACEncy”，确定第二设备支持的加解密算法Encryption。对于第一设备支持的加解密算法Encryption和第二设备支持的加解密算法Encryption进行交集，得到算法集合，该算法集合包括加解密算法Encryption。
其中，上述操作5041和5042之间的执行顺序不分先后，即可先执行5041再执行5042，或者，先执行5042再执行5041，或者，同时执行5042和5041。
5043：第三设备基于该协议集合、该算法集合和该安全需求信息指示的目标安全处理，生成至少一个SA信息。
在5043中，第三设备确定目标安全处理类型对应的目标安全处理，从该算法集合中选择实现目标安全处理的一个或多个安全处理算法，且选择的每个安全处理算法对应的数据面安全协议是该协作集合中的协议。基于选择的安全处理算法配置该安全处理算法需要的参数，以得到安全参数，该安全参数包括该安全处理算法和该安全处理算法需要的参数。分配SA标识，如此得到一个SA信息，该SA信息包括第一地址、该SA标识和该安全参数。
在一些实施例中，第三设备还为该SA信息分配老化时长，和/或，基于目标安全处理确定安全模式，该SA信息还包括该老化时长和/或安全模式等内容。
例如，接下来列举一个生成SA信息的示例，目标安全处理类型包括加密，从该算法集合包括的加解密算法Encryption，选择实现加密的加解密算法Encryption。基于加解密算法Encryption配置该加解密算法Encryption需要的密钥“secret key”。分配SA标识为“ID-SA1”，分配老化时长为24小时，基于目标安全处理类型确定的安全模式为加密，如此得到一个SA信息。该SA信息包括第一地址“192.168.1.4”、SA标识“ID-SA1”、安全参数、老化时长“24小时”和加密模式。该安全参数包括加解密算法Encryption和密钥“secret key”。
在5043中，第三设备从该算法集合中多次选择安全处理算法，且每次选择的安全处理算法不同，从而可以生成出多个SA信息。
5044：第三设备基于每个SA信息中的每个安全处理算法，分别生成每个SA信息对应的属性信息。
对于每个SA信息，该SA信息对应的属性信息包括该SA信息中的每个安全处理算法对应的数据面安全协议，且该属性信息中的数据面安全协议是该协议集合中的协议。
例如，对于上述列举的示例，假设SA信息包括的加解密算法Encryption对应的数据面安全协议为MACSec，且MACSec属于算法集合中的协议，所以该SA信息对应的属性信息包括MACSec。
在一些实施例中，该每个SA信息对应的属性信息还包括来源类型，该来源类型是第三 设备的设备类型。
步骤505：第三设备在第一SA数据库中保存该至少一个SA信息，以及在第二SA数据库中保存该至少一个SA信息。
在一些实施例中，第三设备还生成该至少一个SA信息对应的属性信息，第三设备在第一SA数据库中保存每个SA信息和每个SA信息对应的属性信息，以及在第二SA数据库中保存每个SA信息和每个SA信息对应的属性信息。
对于第一SA数据库位于第一设备中的情况，第三设备基于该安全策略包括的第二地址，通过写(write)接口向第一设备中的第一SA数据库(如附图4、附图5或附图6中的第一SA数据库103)保存每个SA信息和每个SA信息对应的属性信息。在第二SA数据库位于第二设备中，第三设备基于该安全策略包括的第一地址，通过write接口向第二设备中的第二SA数据库(如附图4、附图5或附图6中的第二SA数据库104)保存每个SA信息和每个SA信息对应的属性信息。
对于第一SA数据库和第二SA数据库是同一个SA数据库且位于存储设备的情况，第三设备基于该安全策略包括的第一地址和第二地址，在该存储设备上确定与第一地址和第二地址绑定的SA数据库，通过write接口向该SA数据库保存每个SA信息和每个SA信息对应的属性信息。
例如，在上述列举的示例中，第三设备生成的SA信息包括第一地址“192.168.1.4”、SA标识“ID-SA1”、安全参数(加解密算法Encryption和密钥“secret key”)、老化时长“24小时”和加密模式，以及生成的该SA信息对应的属性信息包括MACSec。第三设备在第一SA数据库和/或第二SA数据库中保存该SA信息和该属性信息，如下表1所示。
表1
Figure PCTCN2022088290-appb-000001
对于第一SA数据库或第二SA数据库所在的设备(第一设备、第二设备或存储设备)，在某个SA信息在该设备中的存储时长超过该SA信息包括的老化时长时，为了便于说明还是将该SA信息称为第一SA信息，该设备向第三设备发送通知事件，该通知事件包括第一SA信息的SA标识。第三设备接收该通知事件，生成第二SA信息，第一SA信息包括的地址与第二SA信息包括的地址相同，第一SA信息包括的SA标识与第二SA信息包括的SA标识可能相同或不同，第一SA信息包括的安全参数与第二SA信息包括的安全参数不同。第三设备将第一SA数据库和/或第二SA数据库中的第一SA信息更新为第二SA信息。
其中，第一SA信息中的安全参数包括安全处理算法和该安全处理算法需要的第一参数，第二SA信息中的安全参数包括安全处理算法和该安全处理算法需要的第二参数，该两个安全参数中的安全处理算法相同，第一参数和第二参数不同。
在一些实施例中，网管也能够在第一SA数据库和/或第二SA数据库中配置SA信息和该SA信息对应的属性信息，该属性信息包括的来源为网管配置。
在本申请实施例中，第三设备生成SA信息后，将SA信息保存到第一SA数据库或第二SA数据库，这样第一设备在建立与第二设备的连接并需要向第二设备发送数据时，第一设备可以从第一SA数据库获取SA信息，使用该SA信息对该数据进行第一安全处理，第二设备从第二SA数据库中获取SA信息，使用该SA信息对接收的数据进行第二安全处理。如此第一设备和第二设备在每次建立连接后不需要先协商SA信息，从而提高安全处理效率，以及节省网络资源的开销。另外，由第三设备统一生成SA信息和SA信息对应的属性信息，这样第一设备和第二设备不需要生成，节省第一设备和第二设备的计算资源。由于SA信息对应的属性信息包括能够使用SA信息的一个或多个数据面安全协议，这样该一个或多个数据面安全协议对应的数据面安全处理模块能使用该SA信息，使控制面SA信息的协商管理与数据面SA信息的使用之间解绑定，简化网络安全协议的管理，提高了扩展性。
对于分布式方式，该分布式方式应用于图4或图7所示的网络架构100，接下来附图9以第一设备和第二设备协商生成SA信息为例，来对分布式方式进行详细说明。在图9所示的方法中，第一协商设备是第一设备中的协商模块，第二协商设备是第二设备中的协商模块，第一设备内的协商模块和第二设备内的协商模块协商生成第一设备和第二设备所需要的SA信息(如图7所示)。为简明起见，协商主体用第一设备、第二设备来描述。
参见图9，在实现时通过如下步骤601至步骤608的流程来实现分布式方式。
步骤601：第一设备获取第一设备和第二设备之间的安全策略，该安全策略用于指示目标安全处理和目标数据面安全协议。
在一些实施例中，该安全策略包括第一地址、第二地址和安全需求信息，第一地址为第二设备的地址，第二地址为第一设备的地址，该安全需求信息包括目标安全处理的处理类型和目标数据面安全协议的协议标识。
可选地，在一些实施例中，第一设备显示输入界面，网管人员在第一设备显示的输入界面输入该安全策略。第一设备从输入界面中获取该安全策略。
可选地，在一些实施例中，网管人员在其对应的网管设备上输入该安全策略，网管设备向第一设备发送该安全策略，第一设备接收该安全策略。
可选地，在一些实施例中，第二设备也获取该安全策略，第二设备获取该安全策略的方式同第一设备获取该安全策略的方式相同，在此不再详细说明。
步骤602：第二设备向第一设备报告第二设备的安全能力，该安全能力包括第二设备支持的至少一个安全处理算法和/或第二设备支持的至少一个数据面安全协议。
在步骤602中，第二设备采用如下两种方式向第一设备报告第二设备的安全能力。该两种方式分别为：
方式一，第二设备向第一设备发送第二设备信息，第二设备信息包括第二设备支持的至少一个安全处理算法的算法标识和/或第二设备支持的至少一个数据面安全协议的协议标识。
方式二，第二设备基于该安全策略获取第二算法集合，第二算法集合包括第二设备支持的至少一个数据面安全协议和该安全需求信息指示的目标数据面安全协议的交集，向第一设备发送第二协议集合和第二设备支持的至少一个安全处理算法的算法标识。
其中，第一设备也同第二设备一样执行上述步骤602的操作，即第一设备向第二设备报告第一设备的安全能力。
步骤603：第一设备获取第二设备的安全能力，基于第二设备的安全能力获取第一协议集合和算法集合。
在一些实施例中，第一设备接收第二设备信息，基于第二设备信息包括的第二设备支持的至少一个数据面安全协议的协议标识，确定第二设备支持的至少一个数据面安全协议。基于该安全策略包括的目标数据面安全协议的协议标识，确定目标数据面安全协议。将第一设备支持的至少一个数据面安全协议、第二设备支持的至少一个数据面安全协议和目标数据面安全协议进行交集，得到第一协议集合。基于第二设备信息包括的第二设备支持的至少一个安全处理算法的算法标识，确定第二设备支持的至少一个安全处理算法。将第二设备支持的至少一个安全处理算法和第一设备支持的至少一个安全处理算法进行交集，得到算法集合。
可选地，在一些实施例中，第一设备接收第二协议集合和第二设备支持的至少一个安全处理算法的算法标识；将第一设备支持的至少一个数据面安全协议和第二协议集合进行交集，得到第一协议集合。基于第二设备支持的至少一个安全处理算法的算法标识，确定第二设备支持的至少一个安全处理算法，将第二设备支持的至少一个安全处理算法和第一设备支持的至少一个安全处理算法进行交集，得到算法集合。
然后，第一设备基于第一能力集合、该算法集合和安全安全策略，生成至少一个SA信息和每个SA信息对应的属性信息，按如下步骤605-608过程来实现。
步骤604：第一设备分配SA标识，以及，基于第一协议集合、该算法集合和安全策略指示的目标安全处理，生成安全参数。
在步骤604中，第一设备还生成属性信息。在实现时，第一设备基于安全策略包括的目标安全处理的处理类型，确定该处理类型对应的目标安全处理，从该算法集合中选择实现目标安全处理的一个或多个安全处理算法，且选择的安全处理算法对应的数据面安全协议是第一协议集合中的协议。基于选择的安全处理算法配置该安全处理算法需要的参数，以得到安全参数，该安全参数包括该安全处理算法和该安全处理算法需要的参数。分配SA标识，以及基于第一协议集合和该安全处理算法，生成属性信息，该属性信息包括该安全处理算法对应的数据面安全协议，且该属性信息中的数据面安全协议为第一协议集合中的协议。
步骤605：第一设备向第二设备发送确认请求，该确认请求包括该SA标识和该安全参数。
在一些实施例中，该确认请求还包括该属性信息。
步骤606：第二设备接收该确认请求，对该SA标识和安全参数进行确认，并在确认通过后向第一设备发送确认响应。
第二设备确认通过后，获取SA信息，该SA信息包括第一地址(其自身的地址)、该SA标识和安全参数。
在该确认请求还包括属性信息时，第二设备将该属性信息作为该SA信息对应的属性信息。
在第二SA数据库(如图7所示的第二SA数据库104)位于第二设备中，第二设备通过write接口向第二设备中的第二SA数据库保存该SA信息，或者，保存该SA信息和该SA信息对应的属性信息。
步骤607：第一设备接收确认响应，基于该确认响应，获取SA信息，该SA信息包括第一地址、该SA标识和安全参数。
在第一设备还生成该属性信息时，第一设备将该属性信息作为该SA信息对应的属性信 息。
第二设备也可以执行上述603-607的过程，来生成SA信息和SA信息对应的属性信息。
步骤608：第一设备向第一SA数据库保存该SA信息。
在第一设备还生成该SA信息对应的属性信息时，第一设备向第一SA数据库(如图7所示的第一SA数据库103)保存该SA信息和该SA信息对应的属性信息。
在第一SA数据库位于第一设备中，第一设备通过write接口向第一设备中的第一SA数据库保存该SA信息和该SA信息对应的属性信息。
在第一SA数据库和第二SA数据库是同一个SA数据库且位于存储设备中，第一设备基于该安全策略包括的第一地址和第二地址，在该存储设备上确定与第一地址和第二地址绑定的SA数据库，通过write接口向该SA数据库保存该SA信息和该SA信息对应的属性信息。
对于第一SA数据库中的某个SA信息，在该SA信息在第一SA数据库中的存储时长超过该SA信息包括的老化时长时，为了便于说明还是将该SA信息称为第一SA信息，第一设备生成第二SA信息，第一SA信息包括的地址与第二SA信息包括的地址相同，第一SA信息包括的安全参数与第二SA信息包括的安全参数不同，第一SA信息包括的SA标识与第二SA信息包括的SA标识可能相同或不同。第一设备将第一SA数据库中的第一SA信息更新为第二SA信息，同时通知第二设备也将第二SA数据库中的第一SA信息更新为第二SA信息。同理，第二SA数据库中的某个SA信息的存储时长超过该SA信息包括的老化时长时，第二设备也同第一设备一样执行上述操作。
上述只是介绍了一种实现分布式生成SA信息的一个示例，除了上述介绍的示例外，还可能有其他实现示例。例如，如图7所示网络架构100包括第一设备和第一协商设备是两个不同设备，第二设备和第二协商设备是两个不同设备，第一协商设备与第一设备和第二协商设备通信，第二协商设备还与第二设备通信。第一设备向第一协商设备上报第一设备的安全能力，第二设备向第二协商设备上报第二设备的安全能力。
这样第一协商设备获取到第一设备的安全能力，第二协商设备获取到第二设备的安全能力。然后将上述步骤601-608中的第一设备替换为第一协商设备，将第二设备替换为第二协商设备，第一协商设备和第二协商设备并按上述步骤601-608的流程来生成SA信息和该SA信息对应的属性信息。
在本申请实施例中，第一设备与第二设备协商生成SA信息后，第一设备将SA信息保存到第一SA数据库，第二设备将SA信息保存在第二SA数据库，这样第一设备在建立与第二设备的连接并需要向第二设备发送数据时，第一设备可以从第一SA数据库获取SA信息，使用该SA信息对该数据进行第一安全处理，第二设备从第二SA数据库中获取SA信息，使用该SA信息对接收的数据进行第二安全处理。如此第一设备和第二设备在每次建立连接后不需要先协商SA信息，从而提高安全处理效率，以及节省网络资源的开销。另外，第一设备和第二设备采用分布式方式生成SA信息和SA信息对应的属性信息，这样不需要单独部署第三设备来生成SA信息，节省成本。由于SA信息对应的属性信息包括能够使用SA信息的一个或多个数据面安全协议，这样该一个或多个数据面安全协议对应的数据面安全处理模块能使用该SA信息，使控制面SA信息的协商管理与数据面SA信息的使用之间解绑定，简化网络安全协议的管理，提高了扩展性。
在第一SA数据库(如图4、图5、图6或图7所示的第一SA数据库103)和/或第二SA数据库(如图4、图5、图6或图7所示的第二SA数据库104)中保存SA信息后，就能够使用第一SA数据库或第二SA数据库中的SA信息对第一设备发送给第二设备的报文进行安全处理。
可选地，第一SA数据或第二数据库中的SA信息是通过图8所示的方法500生成的，或者，是通过图9所示的方法600生成的。
可选地，处理报文的详细处理过程，参见如下图10所示的实施例和/或图11所示的实施例。
参见图10，本申请实施例提供了一种处理报文的方法700，所述方法700应用于图4、图5或图6所示的网络架构100，包括如下步骤701-704。
步骤701：第一设备中的第一数据面安全处理模块基于第一地址，从第一SA数据库中获取m个SA信息，m是大于0且小于或等于N的自然数。
第一数据安全处理模块为第一设备中的任一个数据面安全处理模块，第一地址为第二设备的地址。
步骤702：第一设备中的第一数据面安全处理模块获取待发送报文，待发送报文的目的地址为第一地址。
待发送报文是第一设备接收的报文或者是第一设备生成的报文。
步骤703：第一设备中的第一数据面安全处理模块基于该m个SA信息包括的安全参数，对待发送报文的净荷进行第一安全处理，并在处理后的待发送报文中添加该m个SA信息的SA标识，以得到第一报文，第一报文的净荷是第一安全处理后的净荷。
步骤704：第一设备的通信接口向第二设备发送第一报文。
在本申请实施例中，由于第一SA数据库是第一设备的至少一个数据面安全处理模块共享的SA数据库，第一设备中的数据面安全处理模块均能够访问第一SA数据库。这样第一设备中的数据面安全处理模块基于第一地址，从第一SA数据库中获取m个SA信息，从而使用m个SA信息对待发送报文的净荷进行第一安全处理。在传统方案中第一设备与第二设备之间的原有通信连接断开后，重新建立连接并需要发送数据时，第一设备和第二设备都需要重新协商产生用于对数据进行安全处理的SA。本申请实施例提供的方案在第一设备每次与第二设备建立连接后并需要发送数据时，第一设备和第二设备不需要先协商产生SA信息，而是第一设备基于第一地址从第一SA数据库中获取m个SA信息，通过该m个SA信息对待发送报文进行安全处理，从而提高安全处理效率，节省了网络资源的开销。
对于上述图10所示的方法700，接下来本申请实施例结合图4-7所示的网络架构100，对所述方法700中的各步骤进行说明。
可选的，对于上述步骤701，第一SA数据库包括SA信息与属性信息的对应关系，第一数据面安全处理模块基于第一地址和过滤条件，从第一SA数据库中获取m个SA信息。
该m个SA信息中的每个SA信息包括第一地址，该过滤条件包括第一数据面安全处理模块需要的数据面安全协议，该m个SA信息对应的属性信息满足该过滤条件。
由于该过滤条件包括第一数据面安全处理模块需要的数据面安全协议，这样能够从第一 SA数据库中获取不同数据面安全处理模块需要的数据面安全协议对应的SA信息，使SA信息的使用与SA信息的协商管理解绑定，简化网络安全协议的管理，提高扩展性。
可选地，在一些实施例中，SA信息对应的属性信息满足该过滤条件是指：该SA信息对应的属性信息包括该过滤条件中的第一数据面安全处理模块需要的数据面安全协议。
在步骤701中，第一设备在接收到待发送报文，从待发送报文中提取目的地址作为第一地址，或者，第一设备接收处理事件，该处理事件包括第一地址。在得到第一地址后，基于第一地址和该过滤条件，获取m个SA信息。
第一设备基于处理事件中的第一地址能够提前获取m个SA信息，这样第一设备在接收到目的地址为第一地址的报文时，直接使用该m个SA信息对该报文进行安全处理，进一步提高安全处理的效率。
可选地，在一些实施例中，该处理事件可能为网管设备发送的，在网管设备需要第一设备和第二设备对第一设备发送给第二设备的报文进行安全处理时，网管设备将第二设备的地址作为第一地址，向第一设备发送包括第一地址的处理事件。使第一设备先获取到m个SA信息，在第一设备接收到目的地址为第一地址的报文时，使用该m个SA信息对该报文进行第一安全处理。
可选地，在一些实施例中，该过滤条件包括一个或多个数据面安全协议，该一个或多个数据面安全协议是第一数据面安全处理模块对应的数据面安全协议，或者，是第一数据面安全处理模块自己确定的。
该过滤条件中的数据面安全协议与第一数据面安全处理模块对应，或者，是第一数据面安全处理模块基于自身的内部逻辑确定，丰富得到该过滤条件的方式。
该过滤条件中的数据面安全协议包括但不限于如下一个或多个：MACSec、IPSec、SRv6Sec或SSL等。
可选地，在一些实施例中，该过滤条件还包括第一数据面安全处理模块需要的SA信息的来源。这样在步骤701中，第一数据面安全处理模块根据第一地址、以及该过滤条件中包含的第一数据面安全处理模块需要的数据面安全协议和第一数据面安全处理模块需要的SA信息的来源，从第一SA数据库中获取m个SA信息。
在一些场景中，第一数据面安全处理模块对SA信息的来源有要求，由于该过滤条件包括第一数据面安全处理模块需要的SA信息的来源，从而能够获取到满足第一数据面安全处理模块要求的SA信息。
可选地，在步骤701中，第一数据面安全处理模块可能从第一SA数据库中先获取到x个SA信息，x为大于或等于m且小于或等于N的自然数；然后基于随机方式或轮询方式从该x个SA信息中，选择m个SA信息。
第一数据面安全处理模块能够从第一SA数据库中获取到多于m个SA信息，即获取到x个SA信息，这样每当第一数据面安全处理模块需要发送目的地址为第一地址的报文时，基于随机方式或轮询方式从该x个SA信息中，选择m个SA信息。如此第一数据面安全处理模块不用频繁查询第一SA数据库，减小对计算资源的消耗，并提高安全处理的效率。
可选地，在一些实施例中，第一数据面安全处理模块通过公共接口，从第一SA数据库中获取该m个SA信息。
在一些实施例中，该公共接口包括发布/订阅(publish/subscribe，Pub/Sub)接口等。
例如，假设第一设备的通信接口接收到待发送报文，待发送报文的目的地址为192.168.1.4，第一数据面安全处理模块需要的数据面安全协议为MACSec，即过滤条件包括MACSec。基于第一地址和该过滤条件，从如表1所示的第一SA数据库中获取SA信息，该SA信息对应的属性信息包括过滤条件中的MACSec，且该SA信息包括地址“192.168.1.4”、SA标识“ID-SA1”、安全参数(加解密算法Encryption和密钥“secret key”)、老化时长“24小时”和加密模式。
对于上述步骤703：对于该m个SA信息中的每个SA信息，该SA信息包括安全处理算法和安全处理算法需要的参数等内容，第一数据面安全处理模块从第一设备中调用该安全处理算法，基于该参数，通过该安全处理算法对待发送报文进行第一安全处理。
可选地，在一些实施例中，第一数据面安全处理模块对待发送报文的净荷进行第一安全处理，用处理后得到的净荷替代待发送报文中的净荷，并在待发送报文中添加该m个SA信息的SA标识，以得到第一报文。例如，第一安全处理为加密处理，第一数据面安全处理模块对待发送报文的净荷进行加密处理，用处理后得到的密文替代待发送报文中的净荷，并在待发送报文中添加该m个SA信息的SA标识，以得到第一报文。
可选地，在一些实施例中，第一数据面安全处理模块对待发送报文的净荷进行第一安全处理，在待发送报文中添加处理得到的结果和该m个SA信息的SA标识，以得到第一报文。例如，第一安全处理为认证处理，第一数据面安全处理模块计算待发送报文的净荷的信息摘要，并在待发送报文中添加该信息摘要和该m个SA信息的SA标识，以得到第一报文。
例如，第一数据面安全处理模块获取的SA信息包括SA标识“ID-SA1”和安全参数(加解密算法Encryption和密钥“secret key”)。第一数据面安全处理模块基于密钥“secret key”，通过加解密算法Encryption，对待发送报文中的净荷进行加密处理，处理后得到的净荷为密文，用密文替代待发送报文中的净荷，并在待发送报文中添加SA标识“ID-SA1”，以得到第一报文。第一设备的通信接口向第二设备发送第一报文。
在本申请实施例中，由于第一SA数据库是第一设备的至少一个数据面安全处理模块共享的数据库，第一设备中的数据面安全处理模块均能够访问第一SA数据库。又由于第一SA数据库中的每个SA信息对应的属性信息包括一个或多个数据面安全协议，这样第一设备中的数据面安全处理模块基于第一地址和过滤条件中的数据面安全协议，从第一SA数据库中获取m个SA信息，使用m个SA信息对待发送报文的净荷进行第一安全处理。如此，第一SA数据库中的每个SA信息与网络安全协议解绑定，第一设备中的每个数据面安全处理模块均能从第一SA数据库中获取SA信息，也就是说控制面SA信息的协商管理与数据面SA信息的使用之间解绑定，简化网络安全协议的管理，提高扩展性，从而能够在数据面增加新的加密特性，如增加SRv6sec和/或双重加密等新特性。
参见图11，本申请实施例提供了一种处理报文的方法800，所述方法800应用于图4、图5或图6所示的网络架构100，包括如下步骤801-803。
步骤801：第二设备的通信接口接收第一报文，第一报文包括m个SA标识和净荷。
例如，第二设备的通信接口接收第一报文，第一报文包括SA标识“ID-SA1”和密文，该密文是第一报文的净荷。
步骤802：第二设备的第一数据面安全处理模块基于该m个SA标识，从第二SA数据库中获取该m个SA标识对应的m个SA信息。
其中，第二设备中的至少一个数据面安全处理模块包括第一数据面安全处理模块。
在步骤802中，第二设备的第一数据面安全处理模块通过公共接口，从第二SA数据库中获取该m个SA标识对应的m个SA信息。
在一些实施例中，该公共接口包括Pub/Sub接口等。
例如，第一数据面安全处理模块基于SA标识“ID-SA1”，从如表1所示的第二SA数据库中获取SA信息，该SA信息包括地址“192.168.1.4”、SA标识“ID-SA1”、安全参数(加解密算法Encryption和密钥“secret key”)、老化时长“24小时”和加密模式。
步骤803：第二设备的第一数据面安全处理模块基于该m个SA信息包括的安全参数，对第一报文的净荷进行第二安全处理。
对于该m个SA信息中的每个SA信息，该SA信息中的安全参数包括安全处理算法和安全处理算法需要的参数等内容，第一数据面安全处理模块基于该参数，通过该安全处理算法对第一报文的净荷进行第二安全处理。
例如，第一数据面安全处理模块基于密钥“secret key”，通过加解密算法Encryption对第一报文中的密文进行解密处理，得到明文。
在本申请实施例中，由于第二SA数据库是第二设备的至少一个数据面安全处理模块共享的SA数据库，第二设备中的数据面安全处理模块均能够访问第二SA数据库。这样第二设备中的数据面安全处理模块基于m个SA标识，从第二SA数据库中获取m个SA信息，从而使用m个SA信息对第一报文的净荷进行第二安全处理。如此在第二设备每次与第一设备建立连接并接收到第一报文时，第一设备通过从该SA数据库获取SA信息，使用该SA信息处理第一报文，第一设备和第二设备不需要先协商产生SA信息，从而提高安全处理效率，节省了网络资源的开销。另外，通过第二SA数据库使SA信息的协商管理与SA信息的使用解绑定，简化网络安全协议的管理，提高扩展性。
参见图12，本申请实施例提供了一种处理报文的设备900。可选地，该设备900应用于如图4、图5、图6或图7所示的网络架构100中。可选地，该设备900是上述任一实施例提供的第一设备，例如是图4、图5、图6或图7所示网络架构100中的第一设备101、图8所示方法500中的第一设备，图9所示方法600中的第一设备，或者，图10所示方法700中的第一设备。该设备900包括：处理器901、存储器902和内部连接903。
处理器901和存储器902通过内部连接903连接，存储器902中存储有操作系统和程序代码，该至少一个处理器901从存储器902中读取操作系统并运行该操作系统。可选地，内部连接903包括总线。
至少一个处理器901从该存储器902中读取程序代码，在该操作系统中通过运行程序代码来处理报文。
可选的，该设备900还包括网络接口904，网络接口904通过内部连接903与处理器901、存储器902连接。网络接口904能够与图4、图5、图6或图7所示网络架构100中的第二设备102通信，或者，网络接口904能够与图5或图6所示网络架构100中的第三设备105通信，或者，网络接口904能够与图7所示网络架构100中的第一协商设备106通信。
可选的，处理器901处理报文的详细实现过程，可以参见图10所示的实施例中的相关内容，在此不再详细说明。
可选的，该设备900还包括输入设备905，输入设备905连接到内部连接903上。处理器901能够通过输入设备905接收输入的命令或数据等。
可选的，该设备900还包括显示设备906，显示设备906能够用于显示处理器901执处理报文流程的中间结果和/或最终结果等。
可选的，上述处理器901可能是一个通用中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
上述内部连接904包括一通路，在上述组件之间传送信息。可选的，内部连接904可能是单板或总线等。
上述存储器902可能是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可能是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可能是独立存在，通过总线与处理器相连接。存储器也可能和处理器集成在一起。
在具体实现中，作为一种实施例，处理器901可能包括一个或多个CPU，例如图12中的CPU0和CPU1。
在具体实现中，作为一种实施例，该检测设备900可能包括多个处理器，例如图12中的处理器901和处理器907。这些处理器中的每一个可能是一个单核(single-CPU)处理器，也可能是一个多核(multi-CPU)处理器。这里的处理器可能指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在上述实施例中，处理报文的流程可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现，例如该计算机产品是一种处理报文的软件，用以安装于附图4、图5、图6或图7所示的第一设备101。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生在本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程设备。所述计算机指令可以存储在计算机可读存储介质中，上述提到的存储介质可能是只读存储器，磁盘或光盘等。所述计算机指令可以或者从一个计算机可读存储介质向另一个计算机可读存储介质传输例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(Digital Subscriber Line,DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者 半导体介质(例如固态硬盘(solid state disk,SSD))等。
参见图13，本申请实施例提供了一种处理报文的设备1000。可选地，该设备1000应用于如图4、图5、图6或图7所示的网络架构100中。可选地，该设备1000是上述任一实施例提供的第二设备，例如是图4、图5、图6或图7所示网络架构100中的第二设备102、图8所示方法500中的第二设备、图9所示方法600中的第二设备，或者，图11所示方法800中的第二设备。该设备1000包括：处理器1001、存储器1002和内部连接1003。
处理器1001和存储器1002通过内部连接1003连接，存储器1002中存储有操作系统和程序代码，该至少一个处理器1001从存储器1002中读取操作系统并运行该操作系统。可选地，内部连接1003包括总线。
至少一个处理器1001从该存储器1002中读取程序代码，在该操作系统中通过运行程序代码来处理报文。
可选的，该设备1000还包括网络接口1004，网络接口1004通过内部连接1003与处理器1001、存储器1002连接。网络接口1004能够与图4、图5、图6或图7所示网络架构100中的第一设备101通信，或者，网络接口1004能够与图5或图6所示网络架构100中的第三设备105通信，或者，网络接口1004能够与图7所示网络架构100中的第二协商设备107通信。
可选的，处理器1001处理报文的详细实现过程，可以参见图11所示的实施例中的相关内容，在此不再详细说明。
可选的，该设备1000还包括输入设备1005，输入设备1005连接到内部连接1003上。处理器1001能够通过输入设备1005接收输入的命令或数据等。
可选的，该设备1000还包括显示设备1006，显示设备1006能够用于显示处理器1001执行处理报文流程的中间结果和/或最终结果等。
可选的，上述处理器1001可能是一个通用中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
上述内部连接1004包括一通路，在上述组件之间传送信息。可选的，内部连接1004可能是单板或总线等。
上述存储器1002可能是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可能是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可能是独立存在，通过总线与处理器相连接。存储器也可能和处理器集成在一起。
在具体实现中，作为一种实施例，处理器1001可能包括一个或多个CPU，例如图13中的CPU0和CPU1。
在具体实现中，作为一种实施例，该检测设备1000可能包括多个处理器，例如图13中 的处理器1001和处理器1007。这些处理器中的每一个可能是一个单核(single-CPU)处理器，也可能是一个多核(multi-CPU)处理器。这里的处理器可能指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在上述实施例中，检测待检测文件的流程可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现，例如该计算机产品是一种处理报文的软件，用以安装于附图4、图5、图6或图7所示的第二设备102。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生在本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程设备。所述计算机指令可以存储在计算机可读存储介质中，上述提到的存储介质可能是只读存储器，磁盘或光盘等。所述计算机指令可以或者从一个计算机可读存储介质向另一个计算机可读存储介质传输例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(Digital Subscriber Line,DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk,SSD))等。
参见图14，本申请实施例提供了一种获取安全联盟SA信息的设备1100。可选地，该设备1100应用于如图4、图5、图6或图7所示的网络架构100中。可选地，该设备1100是上述任一实施例提供的第一设备、第二设备、第三设备、第一协商设备或第二协商设备，例如是图4、图5、图6或图7所示网络架构100中的第一设备101或第二设备102、图8所示方法500中的第三设备、图9所示方法600中的第一设备，图5或图6所示网络架构100中的第三设备105，或者，图7所示网络架构100中的第一协商设备106或第二协商设备107。该设备1100包括：处理器1101、存储器1102和内部连接1103。
处理器1101和存储器1102通过内部连接1103连接，存储器1102中存储有操作系统和程序代码，该至少一个处理器1101从存储器1102中读取操作系统并运行该操作系统。可选地，内部连接1103包括总线。
至少一个处理器1101从该存储器1102中读取程序代码，在该操作系统中通过运行程序代码来获取SA信息。
可选的，该设备1100还包括网络接口1104，网络接口1104通过内部连接1103与处理器1101、存储器1102连接。网络接口1104能够与图4、图5、图6或图7所示网络架构100中的第一设备101或第二设备102通信。
可选的，处理器1101获取SA信息的详细实现过程，可以参见图8或图9所示的实施例中的相关内容，在此不再详细说明。
可选的，该设备1100还包括输入设备1105，输入设备1105连接到内部连接1103上。处理器1101能够通过输入设备1105接收输入的命令或数据等。
可选的，该设备1100还包括显示设备1106，显示设备1106能够用于显示处理器1101 执行获取SA信息流程的中间结果和/或最终结果等。
可选的，上述处理器1101可能是一个通用中央处理器(central processing unit，CPU)，网络处理器(network processor，NP)，微处理器，特定应用集成电路(application-specific integrated circuit，ASIC)，或一个或多个用于控制本申请方案程序执行的集成电路。
上述内部连接1104包括一通路，在上述组件之间传送信息。可选的，内部连接1104可能是单板或总线等。
上述存储器1102可能是只读存储器(read-only memory，ROM)或可存储静态信息和指令的其他类型的静态存储设备，随机存取存储器(random access memory，RAM)或者可存储信息和指令的其他类型的动态存储设备，也可能是电可擦可编程只读存储器(electrically erasable programmable read-only memory，EEPROM)、只读光盘(compact disc read-only memory，CD-ROM)或其他光盘存储、光碟存储(包括压缩光碟、激光碟、光碟、数字通用光碟、蓝光光碟等)、磁盘存储介质或者其他磁存储设备、或者能够用于携带或存储具有指令或数据结构形式的期望的程序代码并能够由计算机存取的任何其他介质，但不限于此。存储器可能是独立存在，通过总线与处理器相连接。存储器也可能和处理器集成在一起。
在具体实现中，作为一种实施例，处理器1101可能包括一个或多个CPU，例如图14中的CPU0和CPU1。
在具体实现中，作为一种实施例，该检测设备1100可能包括多个处理器，例如图14中的处理器1101和处理器1107。这些处理器中的每一个可能是一个单核(single-CPU)处理器，也可能是一个多核(multi-CPU)处理器。这里的处理器可能指一个或多个设备、电路、和/或用于处理数据(例如计算机程序指令)的处理核。
在上述实施例中，检测待检测文件的流程可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现，例如该计算机产品是一种获取SA信息的软件，用以安装于附图4、图5、图6或图7所示的第一设备101或第二设备102，或者，安装于图5或图6所示的第三设备，或者，安装于图7所示的第一协商设备或第二协商设备。
所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机程序指令时，全部或部分地产生在本发明实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程设备。所述计算机指令可以存储在计算机可读存储介质中，上述提到的存储介质可能是只读存储器，磁盘或光盘等。所述计算机指令可以或者从一个计算机可读存储介质向另一个计算机可读存储介质传输例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(Digital Subscriber Line,DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质，(例如，软盘、硬盘、磁带)、光介质(例如，DVD)、或者半导体介质(例如固态硬盘(solid state disk,SSD))等。
参见图15，本申请实施例提供了一种处理报文的装置1200。可选地，该装置1200应用于如图4、图5、图6或图7所示的网络架构100中。可选地，该装置1200部署在上述任一 实施例提供的第一设备上，例如部署在图4、图5、图6或图7所示网络架构100中的第一设备101、图8所示方法500中的第一设备，图9所示方法600中的第一设备，或者，图10所示方法700中的第一设备上。
图15所示的装置1200包括至少一个数据面安全处理模块和通信模块，所述装置1200对应的安全联盟SA数据库包括N个SA信息，N为大于0的自然数，所述N个SA信息中的每个SA信息分别包括地址、SA标识和安全参数，
第一数据面安全处理模块1201，用于基于第一地址，从该SA数据库中获取m个SA信息，m是大于0且小于或等于N的自然数，第一地址为第二设备的地址，该m个SA信息中的每个SA信息包括第一地址，第一数据面安全处理模块1201是所述装置1200包括的至少一个数据面安全处理模块中的一个数据面安全处理模块；
第一数据面安全处理模块1201，还用于获取待发送报文，待发送报文的目的地址为第一地址；
第一数据面安全处理模块1201，还用于基于该m个SA信息包括的安全参数，对待发送报文的净荷进行第一安全处理，并在待发送报文中添加该m个SA信息的SA标识，以得到第一报文，第一报文的净荷是第一安全处理后的净荷；
通信模块1202，用于向第二设备发送第一报文。
可选的，第一数据面安全处理模块1201获取m个SA信息的详细实现过程，参见上述图10所示方法700的步骤701中的相关内容，在此不再详细说明。
可选的，第一数据面安全处理模块1201获取待发送报文的详细实现过程，参见上述图10所示方法700的步骤702中的相关内容，在此不再详细说明。
可选的，第一数据面安全处理模块1201得到第一报文的详细实现过程，参见上述图10所示方法700的步骤703中的相关内容，在此不再详细说明。
可选的，所述装置1200对应的SA数据库还包括N个安全联盟SA信息分别对应的属性信息，该N个SA信息中的第一SA信息对应的属性信息包括能够使用第一SA信息的一个或多个数据面安全协议，
第一数据面安全处理模块1201，用于根据第一地址以及过滤条件，从SA数据库中获取m个SA信息，该m个SA信息中的每个SA信息的属性信息满足该过滤条件，该过滤条件包括第一数据面安全处理模块1201需要的数据面安全协议。
可选的，第一数据面安全处理模块1201根据第一地址和过滤条件获取m个SA信息的详细实现过程，参见上述图10所示方法700的步骤701中的相关内容，在此不再详细说明。
可选的，该N个SA信息中的第一SA信息对应的属性信息还包括第一SA信息的来源，该过滤条件还包括第一数据面安全处理模块1201需要的SA信息的来源，
第一数据面安全处理模块1201，用于根据第一地址、以及过滤条件中包含的第一数据面安全处理模块1201需要的数据面安全协议和第一数据面安全处理模块1201需要的SA信息的来源，从SA数据库中获取m个SA信息。
可选的，第一数据面安全处理模块1201根据第一地址、第一数据面安全处理模块需要的数据面安全协议和来源获取m个SA信息的详细实现过程，参见上述图10所示方法700的步骤701中的相关内容，在此不再详细说明。
可选的，通信模块1202，还用于上报所述装置1200的安全能力，该安全能力包括支持 的至少一个安全处理算法和/或支持的至少一个数据面安全协议，以支持第三设备基于第二设备的安全能力、所述装置1200的安全能力和所述装置1200与第二设备之间的安全策略生成至少一个SA信息，并在该SA数据库中保存至少一个SA信息，
其中，安全策略用于指示目标安全处理和目标数据面安全协议，至少一个SA信息中的每个SA信息包括的地址为第二设备的地址，每个SA信息中的SA标识是第三设备分配的，每个SA信息中的安全参数是安全策略指定的参数且是所述装置1200的安全能力和第二设备的能力均支持的参数。
可选的，第三设备是管理设备、或所述装置1200对应的协商设备，其中，管理设备用于为至少三个设备中的每个设备分别生成每个设备与每个设备的通信对端设备所需的SA信息，至少三个设备包括所述装置1200和第二设备，所述装置1200对应的协商设备用于为所述装置1200协商所述装置1200与通信对端设备所需的SA信息。
可选的，数据面安全协议包括：媒体接入控制安全MACSec、互联网协议安全IPSec、分段路由互联网协议第六版安全SRv6Sec或安全套接字SSL。
可选的，所述装置1200包括多个数据面安全处理模块，所述SA数据库是所述多个数据面安全处理模块中的至少两个数据面安全处理模块具有访问权限的SA数据库。
可选的，第一数据面安全处理模块1201，用于通过公共接口从SA数据库中获取m个SA信息。
可选的，公共接口包括发布/订阅Pub/Sub接口。
可选的，第一安全处理包括以下一项或多项：加密处理、认证处理，防篡改处理或防重放处理。
该装置1200处理报文的详细实现过程，可以参见图10所示的实施例中的相关内容，在此不再详细说明。
附图15所描述的装置1200实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。在本申请各个实施例中的各功能模块可以集成在一个模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。附图15中上述各个模块既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。例如，采用软件实现时，上述第一数据面安全处理模块1201和通信模块1202可以是由附图12中的至少一个处理器901读取存储器902中存储的程序代码后，生成的软件功能模块来实现。图15中上述各个模块也可以由设备900中的不同硬件分别实现，例如第一数据面安全处理模块1201由附图12中至少一个处理器901中的一部分处理资源(例如多核处理器中的一个核)实现，而通信模块1202由附图12的网络接口904和至少一个处理器901中的其余部分处理资源(例如多核处理器中的其他核)，或者采用现场可编程门阵列(Field－Programmable Gate Array，FPGA)、或协处理器等可编程器件来完成。显然上述功能模块也可以采用软件硬件相结合的方式来实现，例如通信模块1202由硬件可编程器件实现，而第一数据面安全处理模块1201是由CPU读取存储器902中存储的程序代码后，生成的软件功能模块。
在本申请实施例中，由于该装置1200中的第一数据面安全处理模块能够访问SA数据库。这样第一数据面安全处理模块基于第一地址，从该SA数据库中获取m个SA信息，使用m 个SA信息对待发送报文的净荷进行第一安全处理。在传统方案中该装置1200与第二设备之间的原有通信连接断开后，重新建立连接并需要发送数据时，该装置1200和第二设备都需要重新协商产生用于对数据进行安全处理的SA信息。本申请实施例提供的方案在该装置1200每次与第二设备建立连接后并需要发送数据时，该装置1200和第二设备不需要先协商产生SA信息，而是第一数据面安全处理模块基于第一地址从该SA数据库中获取m个SA信息，通过该m个SA信息对待发送报文进行安全处理，从而提高安全处理效率，节省了网络资源的开销。由于该SA数据库是该装置1200中的至少一个数据面安全处理模块共享的数据库，该装置1200中的数据面安全处理模块均能够访问该SA数据库。又由于该SA数据库中的每个SA信息对应的属性信息包括一个或多个数据面安全协议，这样该装置1200中的数据面安全处理模块基于第一地址和过滤条件中的数据面安全协议，从该SA数据库中获取m个SA信息，使用m个SA信息对待发送报文的净荷进行第一安全处理。如此，该SA数据库中的每个SA信息与网络安全协议解绑定，该装置1200中的每个数据面安全处理模块均能从该SA数据库中获取SA信息，也就是说控制面SA信息的协商管理与数据面SA信息的使用之间解绑定，简化网络安全协议的管理，提高扩展性。
参见图16，本申请实施例提供了一种处理报文的装置1300。可选地，该装置1300应用于如图4、图5、图6或图7所示的网络架构100中。可选地，该装置1300部署在上述任一实施例提供的第二设备上，例如部署在图4、图5、图6或图7所示网络架构100中的第二设备102、图8所示方法500中的第二设备、图9所示方法600中的第二设备，或者，图11所示方法800中的第二设备上。
图16所示的装置1300包括至少一个数据面安全处理模块和通信模块，所述装置1300对应的安全联盟SA数据库包括M个SA信息，M为大于0的自然数，该M个SA信息中的每个SA信息包括SA标识和安全参数，
通信模块1301，用于接收第一报文，第一报文包括m个SA标识和净荷，m是大于0且小于或等于M的自然数；
第二数据面安全处理模块1302，用于基于该m个SA标识，从SA数据库中获取该m个SA标识对应的m个SA信息，第二数据面安全处理模块1302是所述装置1300包括的至少一个数制面安全处理模块中的一个数据面安全处理模块；
第二数据面安全处理模块1302，还用于基于该m个SA信息包括的安全参数，对第一报文的净荷进行第二安全处理。
可选的，第二数据面安全处理模块1302获取m个SA信息的详细实现过程，参见上述图11所示方法800的步骤802中的相关内容，在此不再详细说明。
可选的，第二数据面安全处理模块1302对第一报文的净荷进行第二安全处理的详细实现过程，参见上述图11所示方法800的步骤803中的相关内容，在此不再详细说明。
可选的，通信模块1301，还用于向第三设备上报所述装置1300的安全能力，该安全能力包括支持的至少一个安全处理算法和/或支持的至少一个数据面安全协议，以支持第三设备基于第一设备的安全能力、所述装置1300的安全能力和第一设备与所述装置1300之间的安全策略生成至少一个SA信息，并在该SA数据库中保存所述至少一个SA信息，
其中，安全策略用于指示目标安全处理和目标数据面安全协议，每个SA信息中的SA标 识是第三设备分配的，每个SA信息中的安全参数是安全策略指定的参数且是第一设备的安全能力和所述装置1300的能力均支持的参数。
可选的，第三设备是管理设备、或所述装置1300对应的协商设备，其中，管理设备用于为至少三个设备中的每个设备分别生成每个设备与每个设备的通信对端设备所需的SA信息，至少三个设备包括第一设备和所述装置1300，所述装置1300对应的协商设备用于为所述装置1300协商所述装置1300与通信对端设备所需的SA信息。
可选的，第二数据面安全处理模块1302，用于基于m个SA标识，通过公共接口从所述SA数据库中获取m个SA标识对应的m个SA信息。
可选的，公共接口包括发布/订阅Pub/Sub接口。
可选的，第二安全处理包括以下一项或多项：解密处理、认证处理，防篡改处理或防重放处理。
该装置1300处理报文的详细实现过程，可以参见图11所示的实施例中的相关内容，在此不再详细说明。
附图16所描述的装置1300实施例仅仅是示意性的，例如，所述模块的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个模块可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。在本申请各个实施例中的各功能模块可以集成在一个模块中，也可以是各个模块单独物理存在，也可以两个或两个以上模块集成在一个模块中。附图16中上述各个模块既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。例如，采用软件实现时，上述第二数据面安全处理模块1302和通信模块1301可以是由附图13中的至少一个处理器1001读取存储器1002中存储的程序代码后，生成的软件功能模块来实现。图16中上述各个模块也可以由设备1000中的不同硬件分别实现，例如第二数据面安全处理模块1302由附图13中至少一个处理器1001中的一部分处理资源(例如多核处理器中的一个核)实现，而通信模块1301由附图13的网络接口1004和至少一个处理器1001中的其余部分处理资源(例如多核处理器中的其他核)，或者采用现场可编程门阵列(Field－Programmable Gate Array，FPGA)、或协处理器等可编程器件来完成。显然上述功能模块也可以采用软件硬件相结合的方式来实现，例如通信模块1301由硬件可编程器件实现，而第二数据面安全处理模块1302是由CPU读取存储器1002中存储的程序代码后，生成的软件功能模块。
在本申请实施例中，该装置1300中的第二数据面安全处理模块基于m个SA标识，从SA数据库中获取m个SA信息，从而使用m个SA信息对第一报文的净荷进行第二安全处理。如此在该装置1300每次与第一设备建立连接并接收到第一报文时，第二数据面安全处理模块通过从该SA数据库获取SA信息，使用该SA信息处理第一报文，该装置1300和第一设备不需要先协商产生SA信息，从而提高安全处理效率，节省了网络资源的开销。
参见图17，本申请实施例提供了一种获取安全联盟SA信息的装置1400。可选地，该装置1400应用于如图4、图5、图6或图7所示的网络架构100中。可选地，该装置1400部署在上述任一实施例提供的第一设备、第二设备、第三设备、第一协商设备或第二协商设备上。例如部署在图4、图5、图6或图7所示网络架构100中的第一设备101或第二设备102、图8所示方法500中的第三设备、图9所示方法600中的第一设备、图5或图6所示网络架构 100中的第三设备105、或者、图7所示网络架构100中的第一协商设备106或第二协商设备107上。该装置1400包括：
获取单元1401，用于获取第一设备的安全能力、第二设备的安全能力以及第一设备和第二设备之间的安全策略，第一设备的安全能力包括第一设备支持的安全处理算法和/或第一设备支持的数据面安全协议，第二设备的安全能力包括第二设备支持的安全处理算法和/或第二设备支持的数据面安全协议，安全策略用于指示目标安全处理和目标数据面安全协议；
处理单元1402，用于基于第一设备的安全能力、第二设备的安全能力和安全策略，生成至少一个SA信息，该至少一个SA信息中的每个SA信息包括第一地址、SA标识和安全参数；安全参数是安全策略指定的参数且是第一设备的安全能力和第二设备的安全能力均支持的参数。
可选的，获取单元1401获取第一设备的安全能力、第二设备的安全能力以及第一设备和第二设备之间的安全策略的详细实现过程，参见上述图8所示方法500的步骤503中的相关内容，上述图9所示方法600的步骤601和603中的相关内容，在此不再详细说明。
可选的，处理单元1402生成至少一个SA信息的详细实现过程，参见上述图8所示方法500的步骤504中的相关内容，上述图9所示方法600的步骤604-607中的相关内容，在此不再详细说明。
可选的，处理单元1402，还用于：
基于第一设备的安全能力、第二设备的安全能力和安全策略，生成至少一个SA信息对应的属性信息，至少一个SA信息中的第一SA信息对应的属性信息包括能够使用所述第一SA信息的一个或多个数据面安全协议。
可选的，处理单元1402生成至少一个SA信息对应的属性信息的详细实现过程，参见上述图8所示方法500的步骤504中的相关内容，上述图9所示方法600的步骤604-607中的相关内容，在此不再详细说明。
可选的，处理单元1402，用于：
基于第一设备的安全能力、第二设备的安全能力和安全策略，获取协议集合和算法集合，该协议集合是第一设备支持的数据面安全协议、第二设备支持的数据面安全协议和目标数据面安全协议的交集，该算法集合是第一设备支持的安全处理算法和第二设备支持的安全处理算法的交集；
基于该协议集合、该算法集合和目标安全处理，生成至少一个SA信息。
可选的，处理单元1402获取协议集合和算法集合的详细实现过程，参见上述图8所示方法500的步骤5041-5042中的相关内容，上述图9所示方法600的步骤603中的相关内容，在此不再详细说明。
可选的，处理单元1402生成至少一个SA信息的详细实现过程，参见上述图8所示方法500的步骤5043中的相关内容，上述图9所示方法600的步骤604-607中的相关内容，在此不再详细说明。
可选的，处理单元1402，还用于：
在第一设备对应的SA数据库中保存至少一个SA信息，和/或，在第二设备对应的SA数据库中保存至少一个SA信息。
附图17所描述的装置1400实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一 种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。在本申请各个实施例中的各功能单元可以集成在一个单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。附图17中上述各个单元既可以采用硬件的形式实现，也可以采用软件功能单元的形式实现。例如，采用软件实现时，上述获取单元1401和处理单元1402可以是由附图14中的至少一个处理器1101读取存储器1102中存储的程序代码后，生成的软件功能模块来实现。图17中上述各个单元也可以由设备1100中的不同硬件分别实现，例如获取单元1401由附图14中至少一个处理器1101中的一部分处理资源(例如多核处理器中的一个核)实现，而处理单元1402由附图4的至少一个处理器1101中的其余部分处理资源(例如多核处理器中的其他核)，或者采用现场可编程门阵列(Field－Programmable Gate Array，FPGA)、或协处理器等可编程器件来完成。显然上述功能单元也可以采用软件硬件相结合的方式来实现，例如获取单元1401由硬件可编程器件实现，而处理单元1402是由CPU读取存储器1102中存储的程序代码后，生成的软件功能模块。
在本申请实施例中，该装置1400通过获取第一设备的安全能力、第二设备的安全能力以及第一设备和所述第二设备之间的安全策略。基于第一设备的安全能力、第二设备的安全能力和所述安全策略，生成至少一个SA信息，将该SA信息保存到SA数据库中。第一设备每次与第二设备建立连接后并需要发送数据时，第一设备和第二设备不需要先协商产生SA信息，而是第一设备中的第一数据面安全处理模块基于第一地址从该SA数据库中获取m个SA信息，通过该m个SA信息对待发送报文进行安全处理，从而提高安全处理效率，节省了网络资源的开销。
本申请实施例提供了一种处理报文的系统，该系统如附图4-7中所示。所述系统包括如图12所述的装置900和如图13所述的装置1000，或者，包括如图15所示的装置1200和如图16所示的装置1300。
可选的，如图12所示的装置900或如图15所示的装置1200为附图4-7中的第一设备，如图13所示的装置1000或如图16所示的装置1300为附图4-7中的第二设备1502。
可选的，所述系统还包括如图14所示的装置1100或如图17所示的装置1400。
可选的，如图14所示的装置1100或如图17所示的装置1400为附图5中的第三设备。
可选的，第三设备为图7中第一设备对应的第一协商设备，或者，为第二设备对应的第二协商设备。
本领域普通技术人员可以理解实现上述实施例的全部或部分步骤可以通过硬件来完成，也可以通过程序来指令相关的硬件完成，所述的程序可以存储于一种计算机可读存储介质中，上述提到的存储介质可以是只读存储器，磁盘或光盘等。
以上所述仅为本申请的可选实施例，并不用以限制本申请，凡在本申请的原则之内，所作的任何修改、等同替换、改进等，均应包含在本申请的保护范围之内。

Claims (47)

  1. 一种处理报文的方法，其特征在于，所述方法应用于第一设备，所述第一设备包括至少一个数据面安全处理模块，所述第一设备对应的安全联盟SA数据库包括N个SA信息，N为大于0的自然数，所述N个SA信息中的每个SA信息分别包括地址、SA标识和安全参数，所述方法包括：
    第一数据面安全处理模块基于第一地址，从所述SA数据库中获取m个SA信息，m是大于0且小于或等于N的自然数，所述第一地址为第二设备的地址，所述m个SA信息中的每个SA信息包括所述第一地址，所述第一数据面安全处理模块是所述第一设备包括的至少一个数据面安全模块中的一个数据面安全处理模块；
    所述第一数据面安全处理模块获取待发送报文，所述待发送报文的目的地址为所述第一地址；
    所述第一数据面安全处理模块基于所述m个SA信息包括的安全参数，对所述待发送报文的净荷进行第一安全处理，并在所述待发送报文中添加所述m个SA信息的SA标识，以得到第一报文，所述第一报文的净荷是所述第一安全处理后的净荷；
    所述第一设备的通信接口向所述第二设备发送所述第一报文。
  2. 如权利要求1所述的方法，其特征在于，所述第一设备对应的SA数据库还包括所述N个安全联盟SA信息分别对应的属性信息，所述N个SA信息中的第一SA信息对应的属性信息包括能够使用所述第一SA信息的一个或多个数据面安全协议，
    所述第一数据面安全处理模块基于第一地址，从所述SA数据库中获取m个SA信息，包括：
    所述第一数据面安全处理模块根据所述第一地址以及过滤条件，从所述SA数据库中获取m个SA信息，所述m个SA信息中的每个SA信息的属性信息满足所述过滤条件，所述过滤条件包括所述第一数据面安全处理模块需要的数据面安全协议。
  3. 如权利要求2所述的方法，其特征在于，所述N个SA信息中的第一SA信息对应的属性信息还包括所述第一SA信息的来源，所述过滤条件还包括所述第一数据面安全处理模块需要的SA信息的来源，
    所述第一数据面安全处理模块根据所述第一地址以及过滤条件，从所述SA数据库中获取m个SA信息，包括：
    所述第一数据面安全处理模块根据所述第一地址、以及所述过滤条件中包含的所述第一数据面安全处理模块需要的数据面安全协议和所述第一数据面安全处理模块需要的SA信息的来源，从所述SA数据库中获取m个SA信息。
  4. 如权利要求1所述的方法，其特征在于，所述第一数据面安全处理模块基于第一地址，从所述SA数据库中获取m个SA信息，包括：
    所述第一数据面安全处理模块基于所述第一地址，从所述SA数据库中获取x个SA信息，x为大于或等于m且小于或等于N的自然数；
    所述第一数据面安全处理模块基于随机方式或轮询方式从所述x个SA信息中，选择所述m个SA信息。
  5. 如权利要求1-4任一项所述的方法，其特征在于，所述第一数据面安全处理模块基于第一地址，从所述SA数据库中获取m个SA信息之前，还包括：
    所述第一设备向第三设备上报所述第一设备的安全能力，所述安全能力包括支持的至少一个安全处理算法和/或支持的至少一个数据面安全协议，以支持所述第三设备基于第二设备的安全能力、所述第一设备的安全能力和所述第一设备与所述第二设备之间的安全策略生成至少一个SA信息，并在所述SA数据库中保存所述至少一个SA信息，
    其中，所述安全策略用于指示目标安全处理和目标数据面安全协议，所述至少一个SA信息中的每个SA信息包括的地址为所述第二设备的地址，所述每个SA信息中的SA标识是所述第三设备分配的，所述每个SA信息中的安全参数是所述安全策略指定的参数且是所述第一设备的安全能力和所述第二设备的能力均支持的参数。
  6. 如权利要求5所述的方法，其特征在于，所述第三设备是管理设备、或所述第一设备对应的协商设备，其中，所述管理设备用于为至少三个设备中的每个设备分别生成所述每个设备与所述每个设备的通信对端设备所需的SA信息，所述至少三个设备包括所述第一设备和所述第二设备，所述第一设备对应的协商设备用于为所述第一设备协商所述第一设备与通信对端设备所需的SA信息。
  7. 如权利要求2、3、5和6任一项所述的方法，其特征在于，所述数据面安全协议包括：媒体接入控制安全MACSec、互联网协议安全IPSec、分段路由互联网协议第六版安全SRv6Sec或安全套接字SSL。
  8. 如权利要求1-7任一项所述的方法，其特征在于，所述第一设备包括多个数据面安全处理模块，所述SA数据库是所述多个数据面安全处理模块中的至少两个数据面安全处理模块具有访问权限的SA数据库。
  9. 如权利要求1-8任一项所述的方法，其特征在于，所述第一数据面安全处理模块通过公共接口从所述SA数据库中获取所述m个SA信息。
  10. 如权利要求9所述的方法，其特征在于，所述公共接口包括发布/订阅Pub/Sub接口。
  11. 如权利要求1-10任一项所述的方法，其特征在于，所述第一安全处理包括以下一项或多项：加密处理、认证处理，防篡改处理或防重放处理。
  12. 一种处理报文的方法，其特征在于，所述方法应用于第二设备，所述第二设备包括至少一个数据面安全处理模块，所述第二设备对应的安全联盟SA数据库包括M个SA信息，M为大于0的自然数，所述M个SA信息中的每个SA信息包括SA标识和安全参数，所述 方法包括：
    所述第二设备接收第一报文，所述第一报文包括m个SA标识和净荷，m是大于0且小于或等于M的自然数；
    第二数据面安全处理模块基于所述m个SA标识，从所述SA数据库中获取所述m个SA标识对应的m个SA信息，所述第二数据面安全处理模块是所述第二设备包括的至少一个数据面安全处理模块中的一个数据面安全处理模块；
    所述第二数据面安全处理模块基于所述m个SA信息包括的安全参数，对所述第一报文的净荷进行第二安全处理。
  13. 如权利要求12所述的方法，其特征在于，所述第二数据面安全处理模块基于所述m个SA标识，从所述SA数据库中获取所述m个SA标识对应的m个SA信息之前，还包括：
    所述第二设备向第三设备上报所述第二设备的安全能力，所述安全能力包括支持的至少一个安全处理算法和/或支持的至少一个数据面安全协议，以支持所述第三设备基于第一设备的安全能力、所述第二设备的安全能力和所述第一设备与所述第二设备之间的安全策略生成至少一个SA信息，并在所述SA数据库中保存所述至少一个SA信息，
    其中，所述安全策略用于指示目标安全处理和目标数据面安全协议，所述每个SA信息中的SA标识是所述第三设备分配的，所述每个SA信息中的安全参数是所述安全策略指定的参数且是所述第一设备的安全能力和所述第二设备的能力均支持的参数。
  14. 如权利要求13所述的方法，其特征在于，所述第三设备是管理设备、或所述第二设备对应的协商设备，其中，所述管理设备用于为至少三个设备中的每个设备分别生成所述每个设备与所述每个设备的通信对端设备所需的SA信息，所述至少三个设备包括所述第一设备和所述第二设备，所述第二设备对应的协商设备用于为所述第二设备协商所述第二设备与通信对端设备所需的SA信息。
  15. 如权利要求12-14任一项所述的方法，其特征在于，所述第二数据面安全处理模块基于所述m个SA标识，从所述SA数据库中获取所述m个SA标识对应的m个SA信息，包括：
    所述第二数据面安全处理模块基于所述m个SA标识，通过公共接口从所述SA数据库中获取所述m个SA标识对应的m个SA信息。
  16. 如权利要求15所述的方法，其特征在于，所述公共接口包括发布/订阅Pub/Sub接口。
  17. 如权利要求12-16任一项所述的方法，其特征在于，所述第二安全处理包括以下一项或多项：解密处理、认证处理，防篡改处理或防重放处理。
  18. 一种获取安全联盟SA信息的方法，其特征在于，所述方法包括：
    获取第一设备的安全能力、第二设备的安全能力以及所述第一设备和所述第二设备之间的安全策略，所述第一设备的安全能力包括第一设备支持的安全处理算法和/或所述第一设备 支持的数据面安全协议，所述第二设备的安全能力包括所述第二设备支持的安全处理算法和/或所述第二设备支持的数据面安全协议，所述安全策略用于指示目标安全处理和目标数据面安全协议；
    基于所述第一设备的安全能力、所述第二设备的安全能力和所述安全策略，生成至少一个SA信息，所述至少一个SA信息中的每个SA信息包括所述第一地址、SA标识和安全参数；所述安全参数是所述安全策略指定的参数且是所述第一设备的安全能力和所述第二设备的安全能力均支持的参数。
  19. 如权利要求18所述的方法，其特征在于，所述方法还包括：
    基于所述第一设备的安全能力、所述第二设备的安全能力和所述安全策略，生成所述至少一个SA信息对应的属性信息，所述至少一个SA信息中的第一SA信息对应的属性信息包括能够使用所述第一SA信息的一个或多个数据面安全协议。
  20. 如权利要求18或19所述的方法，其特征在于，所述基于所述第一设备的安全能力、所述第二设备的安全能力和所述安全策略，生成至少一个SA信息，包括：
    基于所述第一设备的安全能力、所述第二设备的安全能力和所述安全策略，获取协议集合和算法集合，所述协议集合是所述第一设备支持的数据面安全协议、所述第二设备支持的数据面安全协议和所述目标数据面安全协议的交集，所述算法集合是所述第一设备支持的安全处理算法和所述第二设备支持的安全处理算法的交集；
    基于所述协议集合、所述算法集合和所述目标安全处理，生成至少一个SA信息。
  21. 如权利要求19所述的方法，其特征在于，所述第一SA信息中的安全参数包括第一安全处理算法和所述第一安全处理算法需要的参数，所述第一安全处理算法是所述算法集合中的算法且所述第一安全处理算法对应的数据面安全协议是所述协议集合中的协议。
  22. 如权利要求18-21任一项所述的方法，其特征在于，所述方法还包括：
    在所述第一设备对应的SA数据库中保存所述至少一个SA信息，和/或，在所述第二设备对应的SA数据库中保存所述至少一个SA信息。
  23. 一种处理报文的装置，其特征在于，所述装置作为第一设备，包括至少一个数据面安全处理模块和通信模块，所述装置对应的安全联盟SA数据库包括N个SA信息，N为大于0的自然数，所述N个SA信息中的每个SA信息分别包括地址、SA标识和安全参数，
    第一数据面安全处理模块，用于基于第一地址，从所述SA数据库中获取m个SA信息，m是大于0且小于或等于N的自然数，所述第一地址为第二设备的地址，所述m个SA信息中的每个SA信息包括所述第一地址，所述第一数据面安全处理模块是所述装置包括的至少一个数据面安全处理模块中的一个数据面安全处理模块；
    所述第一数据面安全处理模块，还用于获取待发送报文，所述待发送报文的目的地址为所述第一地址；
    所述第一数据面安全处理模块，还用于基于所述m个SA信息包括的安全参数，对所述 待发送报文的净荷进行第一安全处理，并在所述待发送报文中添加所述m个SA信息的SA标识，以得到第一报文，所述第一报文的净荷是所述第一安全处理后的净荷；
    通信模块，用于向所述第二设备发送所述第一报文。
  24. 如权利要求23所述的装置，其特征在于，所述装置对应的SA数据库还包括所述N个安全联盟SA信息分别对应的属性信息，所述N个SA信息中的第一SA信息对应的属性信息包括能够使用所述第一SA信息的一个或多个数据面安全协议，
    所述第一数据面安全处理模块，用于根据所述第一地址以及过滤条件，从所述SA数据库中获取m个SA信息，所述m个SA信息中的每个SA信息的属性信息满足所述过滤条件，所述过滤条件包括所述第一数据面安全处理模块需要的数据面安全协议。
  25. 如权利要求24所述的装置，其特征在于，所述N个SA信息中的第一SA信息对应的属性信息还包括所述第一SA信息的来源，所述过滤条件还包括所述第一数据面安全处理模块需要的SA信息的来源，
    所述第一数据面安全处理模块，用于根据所述第一地址、以及所述过滤条件中包含的所述第一数据面安全处理模块需要的数据面安全协议和所述第一数据面安全处理模块需要的SA信息的来源，从所述SA数据库中获取m个SA信息。
  26. 如权利要求23-25任一项所述的装置，其特征在于，
    所述通信模块，还用于上报所述装置的安全能力，所述安全能力包括支持的至少一个安全处理算法和/或支持的至少一个数据面安全协议，以支持所述第三设备基于第二设备的安全能力、所述装置的安全能力和所述装置与所述第二设备之间的安全策略生成至少一个SA信息，并在所述SA数据库中保存所述至少一个SA信息，
    其中，所述安全策略用于指示目标安全处理和目标数据面安全协议，所述至少一个SA信息中的每个SA信息包括的地址为所述第二设备的地址，所述每个SA信息中的SA标识是所述第三设备分配的，所述每个SA信息中的安全参数是所述安全策略指定的参数且是所述装置的安全能力和所述第二设备的能力均支持的参数。
  27. 如权利要求26所述的装置，其特征在于，所述第三设备是管理设备、或所述装置对应的协商设备，其中，所述管理设备用于为至少三个设备中的每个设备分别生成所述每个设备与所述每个设备的通信对端设备所需的SA信息，所述至少三个设备包括所述装置和所述第二设备，所述装置对应的协商设备用于为所述装置协商所述装置与通信对端设备所需的SA信息。
  28. 如权利要求24-27任一项所述的装置，其特征在于，所述数据面安全协议包括：媒体接入控制安全MACSec、互联网协议安全IPSec、分段路由互联网协议第六版安全SRv6Sec或安全套接字SSL。
  29. 如权利要求23-28任一项所述的装置，其特征在于，所述装置包括多个数据面安全处 理模块，所述SA数据库是所述多个数据面安全处理模块中的至少两个数据面安全处理模块具有访问权限的SA数据库。
  30. 如权利要求23-29任一项所述的装置，其特征在于，所述第一数据面安全处理模块，用于通过公共接口从所述SA数据库中获取所述m个SA信息。
  31. 如权利要求30所述的装置，其特征在于，所述公共接口包括发布/订阅Pub/Sub接口。
  32. 如权利要求23-31任一项所述的装置，其特征在于，所述第一安全处理包括以下一项或多项：加密处理、认证处理，防篡改处理或防重放处理。
  33. 一种处理报文的装置，其特征在于，所述装置作为第二设备，包括至少一个数据面安全处理模块和通信模块，所述装置对应的安全联盟SA数据库包括M个SA信息，M为大于0的自然数，所述M个SA信息中的每个SA信息包括SA标识和安全参数，
    所述通信模块，用于接收第一报文，所述第一报文包括m个SA标识和净荷，m是大于0且小于或等于M的自然数；
    第二数据面安全处理模块，用于基于所述m个SA标识，从所述SA数据库中获取所述m个SA标识对应的m个SA信息，所述第二数据面安全处理模块是所述装置包括的至少一个数制面安全处理模块中的一个数据面安全处理模块；
    所述第二数据面安全处理模块，还用于基于所述m个SA信息包括的安全参数，对所述第一报文的净荷进行第二安全处理。
  34. 如权利要求33所述的装置，其特征在于，
    所述通信模块，还用于向第三设备上报所述装置的安全能力，所述安全能力包括支持的至少一个安全处理算法和/或支持的至少一个数据面安全协议，以支持所述第三设备基于第一设备的安全能力、所述装置的安全能力和所述第一设备与所述装置之间的安全策略生成至少一个SA信息，并在所述SA数据库中保存所述至少一个SA信息，
    其中，所述安全策略用于指示目标安全处理和目标数据面安全协议，所述每个SA信息中的SA标识是所述第三设备分配的，所述每个SA信息中的安全参数是所述安全策略指定的参数且是所述第一设备的安全能力和所述装置的能力均支持的参数。
  35. 如权利要求34所述的装置，其特征在于，所述第三设备是管理设备、或所述装置对应的协商设备，其中，所述管理设备用于为至少三个设备中的每个设备分别生成所述每个设备与所述每个设备的通信对端设备所需的SA信息，所述至少三个设备包括所述第一设备和所述装置，所述装置对应的协商设备用于为所述装置协商所述装置与通信对端设备所需的SA信息。
  36. 如权利要求33-35任一项所述的装置，其特征在于，所述第二数据面安全处理模块，用于基于所述m个SA标识，通过公共接口从所述SA数据库中获取所述m个SA标识对应 的m个SA信息。
  37. 如权利要求36所述的装置，其特征在于，所述公共接口包括发布/订阅Pub/Sub接口。
  38. 如权利要求33-37任一项所述的装置，其特征在于，所述第二安全处理包括以下一项或多项：解密处理、认证处理，防篡改处理或防重放处理。
  39. 一种获取安全联盟SA信息的装置，其特征在于，所述装置作为第三设备，包括：
    获取单元，用于获取第一设备的安全能力、第二设备的安全能力以及所述第一设备和所述第二设备之间的安全策略，所述第一设备的安全能力包括第一设备支持的安全处理算法和/或所述第一设备支持的数据面安全协议，所述第二设备的安全能力包括所述第二设备支持的安全处理算法和/或所述第二设备支持的数据面安全协议，所述安全策略用于指示目标安全处理和目标数据面安全协议；
    处理单元，用于基于所述第一设备的安全能力、所述第二设备的安全能力和所述安全策略，生成至少一个SA信息，所述至少一个SA信息中的每个SA信息包括所述第一地址、SA标识和安全参数；所述安全参数是所述安全策略指定的参数且是所述第一设备的安全能力和所述第二设备的安全能力均支持的参数。
  40. 如权利要求39所述的装置，其特征在于，所述处理单元，还用于：
    基于所述第一设备的安全能力、所述第二设备的安全能力和所述安全策略，生成所述至少一个SA信息对应的属性信息，所述至少一个SA信息中的第一SA信息对应的属性信息包括能够使用所述第一SA信息的一个或多个数据面安全协议。
  41. 如权利要求39或40所述的装置，其特征在于，所述处理单元，用于：
    基于所述第一设备的安全能力、所述第二设备的安全能力和所述安全策略，获取协议集合和算法集合，所述协议集合是所述第一设备支持的数据面安全协议、所述第二设备支持的数据面安全协议和所述目标数据面安全协议的交集，所述算法集合是所述第一设备支持的安全处理算法和所述第二设备支持的安全处理算法的交集；
    基于所述协议集合、所述算法集合和所述目标安全处理，生成至少一个SA信息。
  42. 如权利要求39-41任一项所述的装置，其特征在于，所述处理单元，还用于：
    在所述第一设备对应的SA数据库中保存所述至少一个SA信息，和/或，在所述第二设备对应的SA数据库中保存所述至少一个SA信息。
  43. 一种处理报文的系统，其特征在于，所述系统包括如权利要求23-32任一项所述的装置和如权利要求33-38任一项所述的装置。
  44. 如权利要求43所述的系统，其特征在于，所述系统还包括如权利要求39-42任一项所述的装置。
  45. 一种计算机可读存储介质，其上存储有计算机程序，其特征在于，所述计算机程序被计算机执行时，实现如权利要求1-22任一项所述的方法。
  46. 一种处理报文的设备，其特征在于，包括存储器、处理器及存储在所述存储器上的计算机程序，所述处理器执行所述计算机程序时，使得所述设备实现如权利要求1-17任一项所述的方法。
  47. 一种获取安全联盟SA信息的设备，其特征在于，包括存储器、处理器及存储在所述存储器上的计算机程序，所述处理器执行所述计算机程序时，使得所述设备实现如权利要求18-22任一项所述的方法。
PCT/CN2022/088290 2021-08-24 2022-04-21 处理报文、获取sa信息的方法、装置、系统及介质 WO2023024540A1 (zh)

Applications Claiming Priority (4)

Application Number Priority Date Filing Date Title
CN202110971846.X 2021-08-24
CN202110971846 2021-08-24
CN202111302023.4A CN115941228A (zh) 2021-08-24 2021-11-04 处理报文、获取sa信息的方法、装置、系统及介质
CN202111302023.4 2021-11-04

Publications (1)

Publication Number Publication Date
WO2023024540A1 true WO2023024540A1 (zh) 2023-03-02

Family

ID=85322339

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/088290 WO2023024540A1 (zh) 2021-08-24 2022-04-21 处理报文、获取sa信息的方法、装置、系统及介质

Country Status (1)

Country Link
WO (1) WO2023024540A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1791098A (zh) * 2004-12-13 2006-06-21 华为技术有限公司 一种实现安全联盟同步的方法
US7434045B1 (en) * 2003-04-21 2008-10-07 Cisco Technology, Inc. Method and apparatus for indexing an inbound security association database
CN102469063A (zh) * 2010-11-03 2012-05-23 中兴通讯股份有限公司 路由协议安全联盟管理方法、装置及系统
CN110891269A (zh) * 2018-09-10 2020-03-17 华为技术有限公司 一种数据保护方法、设备及系统
CN111052781A (zh) * 2017-09-08 2020-04-21 华为技术有限公司 用于协商安全性算法和完整性算法的方法和设备
CN111245862A (zh) * 2020-02-25 2020-06-05 无锡艾立德智能科技有限公司 一种物联网终端数据安全接收、发送的系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US7434045B1 (en) * 2003-04-21 2008-10-07 Cisco Technology, Inc. Method and apparatus for indexing an inbound security association database
CN1791098A (zh) * 2004-12-13 2006-06-21 华为技术有限公司 一种实现安全联盟同步的方法
CN102469063A (zh) * 2010-11-03 2012-05-23 中兴通讯股份有限公司 路由协议安全联盟管理方法、装置及系统
CN111052781A (zh) * 2017-09-08 2020-04-21 华为技术有限公司 用于协商安全性算法和完整性算法的方法和设备
CN110891269A (zh) * 2018-09-10 2020-03-17 华为技术有限公司 一种数据保护方法、设备及系统
CN111245862A (zh) * 2020-02-25 2020-06-05 无锡艾立德智能科技有限公司 一种物联网终端数据安全接收、发送的系统

Similar Documents

Publication Publication Date Title
US11792169B2 (en) Cloud storage using encryption gateway with certificate authority identification
KR102116399B1 (ko) 서비스 레이어에서의 콘텐츠 보안
US9461975B2 (en) Method and system for traffic engineering in secured networks
US8788805B2 (en) Application-level service access to encrypted data streams
US11621945B2 (en) Method and system for secure communications
CN110046507B (zh) 形成可信计算集群的方法及装置
US8418244B2 (en) Instant communication with TLS VPN tunnel management
CN111819824A (zh) 在无中间人代理的情况下解密传输层安全流量
WO2019178942A1 (zh) 一种进行ssl握手的方法和系统
CN105429962B (zh) 一种通用的面向加密数据的中间网络服务构建方法与体系
CA3066728A1 (en) Cloud storage using encryption gateway with certificate authority identification
US20160261414A1 (en) Secure authentication of remote equipment
Li et al. ME-TLS: middlebox-enhanced TLS for internet-of-things devices
Rizzardi et al. Analysis on functionalities and security features of Internet of Things related protocols
CN211352206U (zh) 基于量子密钥分发的IPSec VPN密码机
WO2012126432A2 (zh) 数据传输的方法、设备和系统
Manzoor Securing device connectivity in the industrial internet of things (IoT)
Tupakula et al. Implementation of techniques for enhancing security of southbound infrastructure in SDN
CN100499649C (zh) 一种实现安全联盟备份和切换的方法
WO2023024540A1 (zh) 处理报文、获取sa信息的方法、装置、系统及介质
Pandey et al. A system and method for authentication in wireless local area networks (wlans)
Kwon et al. Mondrian: Comprehensive Inter-domain Network Zoning Architecture.
KR101329968B1 (ko) ＩＰＳｅｃ ＶＰＮ 장치들 사이의 보안 정책을 결정하기 위한 방법 및 시스템
Alhumrani et al. Cryptographic protocols for secure cloud computing
CN115941228A (zh) 处理报文、获取sa信息的方法、装置、系统及介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22859894

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE