WO2023093381A1 - 报文防重放的方法和装置 - Google Patents

报文防重放的方法和装置 Download PDF

Info

Publication number
WO2023093381A1
WO2023093381A1 PCT/CN2022/126120 CN2022126120W WO2023093381A1 WO 2023093381 A1 WO2023093381 A1 WO 2023093381A1 CN 2022126120 W CN2022126120 W CN 2022126120W WO 2023093381 A1 WO2023093381 A1 WO 2023093381A1
Authority
WO
WIPO (PCT)
Prior art keywords
replay
message
value
traffic selector
information
Prior art date
Application number
PCT/CN2022/126120
Other languages
English (en)
French (fr)
Inventor
贺奇
陈小兰
范斌
郑佳
Original Assignee
华为技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 华为技术有限公司 filed Critical 华为技术有限公司
Publication of WO2023093381A1 publication Critical patent/WO2023093381A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/50—Queue scheduling
    • H04L47/62—Queue scheduling characterised by scheduling criteria
    • H04L47/6295—Queue scheduling characterised by scheduling criteria using multiple queues, one for each individual QoS, connection, flow or priority
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/36—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols with means for detecting characters not meant for transmission
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the embodiment of the present application relates to the communication field, and, more specifically, relates to a method and device for preventing replay of a message.
  • IPsec Internet Protocol Security
  • IETF Internet Engineering Task Force
  • Replay means that the attacker intercepts and copies the message, sends the copied message to the receiving end, and denial of service (DoS) to the receiving end without deciphering the ciphertext (encrypted message). Attack, the attacker does not need to know the specific content of the replayed information.
  • DoS denial of service
  • the anti-replay service provided by the IPSec protocol blocks this attack through a monotonically increasing serial number and a "sliding" window mechanism.
  • Each IPsec security association maintains an independent anti-replay window (corresponding to the above-mentioned "sliding" window).
  • the sequence number (sequence number, SN) of the encapsulated security payload (ESP)/authentication header (authentication header, AH) of the high-priority message may be much greater than the sequence number of the subsequent low-priority message.
  • the leading edge of the anti-replay window is pulled to the sequence number of the high-priority packet, resulting in the sequence number of the low-priority packet falling outside the trailing edge of the anti-replay window during subsequent packet transmission, that is, These subsequent low-priority packets are forced to become obsolete packets and are rejected by the receiving end, causing packet loss.
  • the embodiment of the present application provides a method and device for message anti-replay, which can enable different types of messages to be processed in different anti-replay windows under the same IPsec security association, and avoid triggering sequence numbers of messages due to out-of-order Packets dropped outside the trailing edge of the anti-replay window.
  • a packet anti-replay method is provided.
  • the method may be executed by the first device, or may also be executed by a component configured in the first device (such as a chip or a chip system, etc.).
  • the method includes: the first device receives an Internet security protocol IPsec message, the IPsec message includes a first field, the first field carries the value of the first information, and determines the first N anti-replay window according to the first mapping relationship
  • An anti-replay window the first mapping relationship includes the corresponding relationship between N anti-replay windows and N value sets of first information, and the value of the first information carried by the first field belongs to the first anti-replay window
  • the first anti-replay window is used to process the IPsec packet, the N anti-replay windows correspond to the same IPsec security association, and N is an integer greater than or equal to 2.
  • one IPsec security association at the receiving end of the IPsec message corresponds to multiple anti-replay windows, so that the receiving end of the IPsec message can determine the priority of the IPsec message according to the first field in the IPsec message, and according to Priority selects the corresponding anti-replay window to process the IPsec message, so that IPsec messages with different priorities are processed in different anti-replay windows, and the messages processed by each anti-replay window have the same priority, so it can It avoids packet loss caused by out-of-sequence, and also avoids cost increases such as increased system resource consumption caused by newly added IPsec security associations generated by the parallel IPsec security association scheme proposed in Section 4.1 of the RFC4301 standard.
  • the first information includes a differentiated services code point (DSCP) or a flow label.
  • DSCP differentiated services code point
  • the N anti-replay windows are generated according to the first information.
  • IPsec packets include ESP packets and AH packets
  • IPsec packets include ESP packets and AH packets
  • high priority packets and low priority packets Files can be processed in different anti-replay windows to avoid packet loss of low-priority packets.
  • the flow label values of different IPsec packets represent different services, and different services may be mapped to different service qualities during transmission.
  • services corresponding to different service qualities can be in Independent processing in different anti-replay windows can avoid packet loss of low-priority packets.
  • the N anti-replay windows are statically configured locally by the first device.
  • the N anti-replay windows are generated through negotiation between the first device and the second device according to the first information, specifically including: sending the first message, the first A message includes a value set of the first information expected by the first device, and a second message is received, the second message includes a value set of the first information negotiated by the second device based on the first message, and according to the first message The value set of the first information in the second message generates the N anti-replay windows.
  • the second message includes a traffic selector type field and an extension field, and when the value of the traffic selector type field is a predetermined value, the extension field is parsed, and the The extension type included in the extension field is the range of the first information, and the extension field also includes at least one start value of the first information and at least one end value of the first information, and the start value of the at least one first information and at least one The end value of the first information is used to determine M value sets of the first information, where M is an integer greater than or equal to 1.
  • the first packet and/or the second packet is an Internet key exchange packet including a traffic selector payload.
  • the traffic selector type field includes: a traffic selector Internet Protocol version IPv6 address range and an extended traffic selector IPv6 address range, or, a traffic selector IPv4 address range and extended traffic selector IPv4 address range.
  • this application adds an extended traffic selector IPv4 or IPv6 address range based on the existing traffic selector IPv4 or IPv6 address range field, which is compatible with devices that support negotiation to generate multiple anti-replay windows and those that do not For a device that generates multiple anti-replay windows through negotiation, when the device that supports negotiation to generate multiple anti-replay windows sends the first packet, it can place the IPv4 address range field of the traffic selector with the same address range and the The extended traffic selector IPv4 address range field, or the traffic selector IPv6 address range field and the extended traffic selector IPv6 address range field of the same address range are placed in the traffic selector payload.
  • the device that supports negotiation to generate multiple anti-replay windows determines that the traffic selector type field in the traffic selector payload in the second message is the same address range as the traffic selector IPv4 address range and When the extended traffic selector IPv4 address range, or the traffic selector IPv6 and extended traffic selector IPv6 address range of the same address range, only the extended traffic selector IPv4/IPv6 address range can be resolved.
  • a device that does not support negotiation to generate multiple anti-replay windows receives the second packet, it cannot recognize the extended traffic selector IPv4/IPv6 address range field, so it only parses the traffic selector IPv4/IPv6 address range field.
  • a method for preventing replay of packets is provided.
  • the method may be executed by the second device, or may also be executed by a component configured in the second device (such as a chip or a chip system, etc.).
  • the method includes: the second device sends an Internet security protocol IPsec message, and the IPsec message includes a first field, the first field carries the value of the first information, and the first field is used to determine from N anti-replay windows
  • the first anti-replay window the value of the first information carried by the first field belongs to the value set of the first information corresponding to the first anti-replay window, and the first anti-replay window is used to process the IPsec message,
  • the N anti-replay windows correspond to the same IPsec security association, and N is an integer greater than or equal to 2.
  • one IPsec security association at the receiving end of the IPsec message corresponds to multiple anti-replay windows, so that the receiving end of the IPsec message can determine the priority of the IPsec message according to the first field in the IPsec message, and according to Priority selects the corresponding anti-replay window to process the IPsec message, so that IPsec messages with different priorities are processed in different anti-replay windows, and the messages processed by each anti-replay window have the same priority, so it can It avoids packet loss caused by out-of-sequence, and also avoids cost increases such as increased system resource consumption caused by newly added IPsec security associations generated by the parallel IPsec security association scheme proposed in Section 4.1 of the RFC4301 standard.
  • the first information includes a differentiated services code point (DSCP) or a flow label.
  • DSCP differentiated services code point
  • the DSCP values of different IPsec packets represent different priorities. Based on the solution provided by this application, high-priority packets and low-priority packets can be processed in different anti-replay windows, which can Avoid packet loss of low-priority packets.
  • the flow label values of different IPsec packets represent different services, and different services may be mapped to different service qualities during transmission.
  • services corresponding to different service qualities can be in Independent processing in different anti-replay windows can avoid packet loss of low-priority packets.
  • the first message is received, the first message includes a value set of the first information expected by the first device, and the second message is sent, and the second message The message includes a value set of the first information negotiated by the second device based on the first message, and the value set of the first information in the second message is used to generate the N anti-replay windows.
  • the first message includes a traffic selector type field and an extension field, and when the value of the traffic selector type field is a predetermined value, the extension field is parsed, and the The extension type included in the extension field is the range of the first information, and the extension field also includes at least one start value of the first information and at least one end value of the first information.
  • the first packet and/or the second packet is an Internet key exchange packet including a traffic selector payload.
  • the traffic selector type field includes: a traffic selector Internet Protocol version IPv6 address range and an extended traffic selector IPv6 address range, or, a traffic selector IPv4 address Ranges and extended traffic selector IPv4 address ranges.
  • this application adds an extended traffic selector IPv4 or IPv6 address range based on the existing traffic selector IPv4 or IPv6 address range field, which is compatible with devices that support negotiation to generate multiple anti-replay windows and those that do not A device that supports negotiation to generate multiple anti-replay windows, after receiving the first packet, determines that the traffic selector type field in the traffic selector payload in the first packet is The traffic selector IPv4 address range and the extended traffic selector IPv4 address range of the same address range, or the traffic selector IPv6 address range of the same address range and the extended traffic selector IPv6 address range, at this time, only the extended traffic selector can be parsed The server IPv4/IPv6 address range.
  • a device that does not support negotiation to generate multiple anti-replay windows receives the first packet, it cannot recognize the extended IPv4/IPv6 address range field of the traffic selector, so it only parses the IPv4/IPv6 address range field of the traffic selector.
  • a message anti-replay device may be the first device, or may also be a component configured in the first device (such as a chip or a chip system, etc.).
  • the device includes: a transceiver unit, configured to receive an Internet security protocol IPsec message, the IPsec message includes a first field, the first field carries the value of the first information, and a processing unit, configured to select from N
  • the first anti-replay window is determined in the anti-replay window, the first mapping relationship includes the corresponding relationship between N anti-replay windows and N value sets of the first information, and the value of the first information carried by the first field belongs to
  • the value set of the first information corresponding to the first anti-replay window, the first anti-replay window is used to process the IPsec message, the N anti-replay windows correspond to the same IPsec security association, and N is greater than or equal to Integer of 2.
  • one IPsec security association at the receiving end of the IPsec message corresponds to multiple anti-replay windows, so that the receiving end of the IPsec message can determine the priority of the IPsec message according to the first field in the IPsec message, and according to Priority selects the corresponding anti-replay window to process the IPsec message, so that IPsec messages with different priorities are processed in different anti-replay windows, and the messages processed by each anti-replay window have the same priority, so it can It avoids packet loss caused by out-of-sequence, and also avoids cost increases such as increased system resource consumption caused by newly added IPsec security associations generated by the parallel IPsec security association scheme proposed in Section 4.1 of the RFC4301 standard.
  • the first information includes a differentiated services code point (DSCP) or a flow label.
  • DSCP differentiated services code point
  • the DSCP values of different IPsec packets represent different priorities. Based on the solution provided by this application, high-priority packets and low-priority packets can be processed in different anti-replay windows, which can Avoid packet loss of low-priority packets.
  • the flow label values of different IPsec packets represent different services, and different services may be mapped to different service qualities during transmission.
  • services corresponding to different service qualities can be in Independent processing in different anti-replay windows can avoid packet loss of low-priority packets.
  • the processing unit is further configured to generate the N anti-replay windows according to the first information.
  • the N anti-replay windows are locally statically configured.
  • the N anti-replay windows are generated through negotiation between the first device and the second device according to the value of the first information
  • the transceiver unit is further configured to send the first A message, the first message includes a value set of the first information expected by the first device, and the transceiver unit is also used to receive a second message, the second message includes the second device based on the first message
  • the negotiated first information value set the processing unit is further configured to generate the N anti-replay windows according to the first information value set in the second packet.
  • the second message includes a traffic selector type field and an extension field
  • the processing unit further uses For parsing the extension field, the extension type included in the extension field is the range of the first information, the extension field also includes at least one start value of the first information and at least one end value of the first information, and the at least one DSCP start value
  • M is an integer greater than or equal to 1.
  • the first packet and/or the second packet is an Internet key exchange packet including a traffic selector payload.
  • the traffic selector type field includes: the traffic selector Internet Protocol version IPv6 address range and the extended traffic selector IPv6 address range, or the traffic selector IPv4 address range and extended traffic selector IPv4 address range.
  • this application adds an extended traffic selector IPv4 or IPv6 address range based on the existing traffic selector IPv4 or IPv6 address range field, which is compatible with devices that support negotiation to generate multiple anti-replay windows and those that do not For a device that generates multiple anti-replay windows through negotiation, when the device that supports negotiation to generate multiple anti-replay windows sends the first packet, it can place the IPv4 address range field of the traffic selector with the same address range and the The extended traffic selector IPv4 address range field, or the traffic selector IPv6 address range field and the extended traffic selector IPv6 address range field of the same address range are placed in the traffic selector payload.
  • the device that supports negotiation to generate multiple anti-replay windows determines that the traffic selector type field in the traffic selector payload in the second message is the same address range as the traffic selector IPv4 address range and When the extended traffic selector IPv4 address range, or the traffic selector IPv6 and extended traffic selector IPv6 address range of the same address range, only the extended traffic selector IPv4/IPv6 address range can be resolved.
  • a device that does not support negotiation to generate multiple anti-replay windows receives the second packet, it cannot recognize the extended traffic selector IPv4/IPv6 address range field, so it only parses the traffic selector IPv4/IPv6 address range field.
  • a message anti-replay device may be the second device, or may also be a component configured in the second device (such as a chip or a chip system, etc.).
  • the device includes: a transceiver unit and a processing unit, the transceiver unit is used to send an Internet security protocol IPsec message, the IPsec message includes a first field, the first field carries the value of the first information, and the first field is used for
  • the first anti-replay window is determined among the N anti-replay windows, the value of the first information carried by the first field belongs to the value set of the first information corresponding to the first anti-replay window, and the first anti-replay window
  • the N anti-replay windows correspond to the same IPsec security association, and N is an integer greater than or equal to 2.
  • one IPsec security association at the receiving end of the IPsec message corresponds to multiple anti-replay windows, so that the receiving end of the IPsec message can determine the priority of the IPsec message according to the first field in the IPsec message, and according to Priority selects the corresponding anti-replay window to process the IPsec message, so that IPsec messages with different priorities are processed in different anti-replay windows, and the messages processed by each anti-replay window have the same priority, so it can It avoids packet loss caused by out-of-sequence, and also avoids cost increases such as increased system resource consumption caused by newly added IPsec security associations generated by the parallel IPsec security association scheme proposed in Section 4.1 of the RFC4301 standard.
  • the first information includes a differentiated services code point (DSCP) or a flow label.
  • DSCP differentiated services code point
  • the DSCP values of different IPsec packets represent different priorities. Based on the solution provided by this application, high-priority packets and low-priority packets can be processed in different anti-replay windows, which can Avoid packet loss of low-priority packets.
  • the flow label values of different IPsec packets represent different services, and different services may be mapped to different service qualities during transmission.
  • services corresponding to different service qualities can be in Independent processing in different anti-replay windows can avoid packet loss of low-priority packets.
  • the transceiver unit is further configured to receive a first message, where the first message includes a value set of first information expected by the first device, and send the second message, the second message includes a value set of the first information negotiated by the second device based on the first message, and the value set of the first information in the second message is used to generate the N anti-replay window.
  • the first message includes a traffic selector type field and an extension field
  • the processing unit when the value of the traffic selector type field is a predetermined value, the processing unit is configured to The extension field is parsed, the extension type included in the extension field is the range of the first information, and the extension field further includes at least one start value of the first information and at least one end value of the first information.
  • the first packet and/or the second packet is an Internet key exchange packet including a traffic selector payload.
  • the traffic selector type field includes: the traffic selector Internet Protocol version IPv6 address range and the extended traffic selector IPv6 address range, or, the traffic selector IPv4 address Ranges and extended traffic selector IPv4 address ranges.
  • this application adds an extended traffic selector IPv4 or IPv6 address range based on the existing traffic selector IPv4 or IPv6 address range field, which is compatible with devices that support negotiation to generate multiple anti-replay windows and those that do not A device that supports negotiation to generate multiple anti-replay windows, after receiving the first packet, determines that the traffic selector type field in the traffic selector payload in the first packet is The traffic selector IPv4 address range and the extended traffic selector IPv4 address range of the same address range, or the traffic selector IPv6 address range of the same address range and the extended traffic selector IPv6 address range, at this time, only the extended traffic selector can be parsed The server IPv4/IPv6 address range.
  • a device that does not support negotiation to generate multiple anti-replay windows receives the first packet, it cannot recognize the extended IPv4/IPv6 address range field of the traffic selector, so it only parses the IPv4/IPv6 address range field of the traffic selector.
  • a communication device the device includes a processor, the processor is coupled to a memory, and can be used to execute instructions in the memory, so as to implement the above first aspect or any possible implementation manner in the first aspect Methods.
  • the device further includes a memory, and the memory and the processor may be deployed separately or in a centralized manner.
  • the device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication interface may be a transceiver, or an input/output interface.
  • the device is a component of the first device.
  • the communication interface may be an input/output interface, interface circuit, output circuit, input circuit, pins or related circuits, etc.
  • the processor may also be embodied as a processing circuit or logic circuit.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the above-mentioned processor can be one or more chips
  • the input circuit can be an input pin
  • the output circuit can be an output pin
  • the processing circuit can be a transistor, a gate circuit, a flip-flop and various logic circuits, etc. .
  • the input signal received by the input circuit may be received and input by the receiver, but the signal output by the output circuit may be but not limited to be output to the transmitter and transmitted by the transmitter, and the input circuit and the output circuit may be The same circuit, which is used as an input circuit and an output circuit at different times.
  • the embodiment of the present application does not limit the specific implementation manners of the processor and various circuits.
  • a communication device the device includes a processor, the processor is coupled to a memory, and can be used to execute instructions in the memory, so as to realize the above second aspect, or any possible implementation manner in the second aspect Methods.
  • the device further includes a memory, and the memory and the processor may be deployed separately or in a centralized manner.
  • the device further includes a communication interface, and the processor is coupled to the communication interface.
  • the communication interface may be a transceiver, or an input/output interface.
  • the device is a component in the second device.
  • the communication interface may be an input/output interface, interface circuit, output circuit, input circuit, pins or related circuits, etc.
  • the processor may also be embodied as a processing circuit or logic circuit.
  • the transceiver may be a transceiver circuit.
  • the input/output interface may be an input/output circuit.
  • the above-mentioned processor can be one or more chips
  • the input circuit can be an input pin
  • the output circuit can be an output pin
  • the processing circuit can be a transistor, a gate circuit, a flip-flop and various logic circuits, etc. .
  • the input signal received by the input circuit may be received and input by the receiver, but the signal output by the output circuit may be but not limited to be output to the transmitter and transmitted by the transmitter, and the input circuit and the output circuit may be The same circuit, which is used as an input circuit and an output circuit at different times.
  • the embodiment of the present application does not limit the specific implementation manners of the processor and various circuits.
  • a communication device which includes a logic circuit, the logic circuit is used to couple with an input/output interface, and transmit data through the input/output interface, so as to perform any of the above first to second aspects
  • a communication device which includes a logic circuit, the logic circuit is used to couple with an input/output interface, and transmit data through the input/output interface, so as to perform any of the above first to second aspects
  • a computer-readable storage medium stores a computer program (also referred to as code, or an instruction) which, when running on a computer, causes the computer to perform the above-mentioned first to Any aspect in the second aspect, and the method in any possible implementation manner in the first aspect to the second aspect.
  • a computer program also referred to as code, or an instruction
  • a computer program product includes: a computer program (also referred to as code, or an instruction), which, when the computer program is executed, causes the computer to perform the above-mentioned first aspect to the second aspect any one of the aspects, and the method in any one of the possible implementations of the first aspect to the second aspect.
  • a computer program also referred to as code, or an instruction
  • FIG. 1 is a schematic diagram of a communication system 100 applicable to the embodiment of the present application.
  • FIG. 2 is a schematic flow chart of a method for preventing replay of packets provided by an embodiment of the present application.
  • FIG. 3 is a schematic flowchart of negotiating multiple anti-replay windows provided by an embodiment of the present application.
  • Fig. 4 is a schematic diagram of the format of the payload of the traffic selector provided by the embodiment of the present application.
  • FIG. 5 is a schematic flow diagram of another negotiation process for multiple anti-replay windows provided by an embodiment of the present application.
  • Fig. 6 is a schematic block diagram of a communication device provided by an embodiment of the present application.
  • Fig. 7 is a schematic block diagram of another communication device provided by an embodiment of the present application.
  • FIG. 8 is a schematic structural diagram of a communication device provided by an embodiment of the present application.
  • FIG. 9 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 10 is a schematic structural diagram of another communication device provided by an embodiment of the present application.
  • FIG. 1 is a schematic diagram of a communication system 100 applicable to the embodiment of the present application.
  • the communication system 100 may include a first device, for example, the first device 110 or 120 shown in FIG. 1 .
  • the communication system 100 may further include a second device, for example, the second device 130 shown in FIG. 1 .
  • a connection can be established between the first device and the second device, and between the first device and the first device to communicate and send data packets.
  • the first device and the second device may be any terminals, base stations, hosts, switches, routers, security gateways and other nodes supporting Internet key exchange (Internet key exchange, IKE or IKEv2)/IPsec.
  • the method provided in the embodiment of this application can be applied to the transmission of data packets between the first device and the second device, but this application does not limit this, any sending end involving IPsec encryption during the transmission of data packets or The receiving end is within the protection scope of this application.
  • GSM global system for mobile communications
  • CDMA code division multiple access
  • WCDMA wideband code division multiple access
  • general packet radio service general packet radio service
  • LTE LTE frequency division duplex
  • FDD frequency division duplex
  • TDD time division duplex
  • UMTS universal mobile telecommunications system
  • WiMAX worldwide interconnection microwave access
  • 5G fifth generation, 5G
  • 5G fifth generation, 5G
  • 5G fifth generation, 5G
  • future evolution communication system vehicle to other devices
  • V2X can include vehicle to Internet (vehicle to network, V2N), vehicle to vehicle (vehicle to vehicle, V2V), vehicle to infrastructure (vehicle to infrastructure, V2I), Vehicle to pedestrian (vehicle to pedestrian, V2P), etc.
  • V2X can include vehicle to Internet (vehicle to network, V2N), vehicle to vehicle (vehicle to vehicle, V2V), vehicle to infrastructure (vehicle to infrastructure, V2I), Vehicle to pedestrian (vehicle to pedestrian, V
  • the base stations in the embodiment of the present application include but are not limited to: evolved Node B (evolved Node B, eNB), radio network controller (radio network controller, RNC), Node B (node B, NB), base station controller (base station controller, BSC), base transceiver station (base transceiver station, BTS), home base station (for example, home evolved nodeB, or Home Node B, HNB), base band unit (base band unit, BBU), wireless fidelity (wireless fidelity, WIFI) system access point (access point, AP), wireless relay node, wireless backhaul node, transmission point (transmission point, TP) or sending and receiving point (transmission and reception point, TRP), etc., can also be 5G, such as, NR, gNB in the system, or, transmission point (TRP or TP), one or a group (including multiple antenna panels) antenna panels of the base station in the 5G system, or, can also be constituted gNB or transmission point A point network node, such
  • a gNB may include a centralized unit (CU) and a DU.
  • the gNB may also include an active antenna unit (active antenna unit, AAU for short).
  • the CU implements some functions of the gNB, and the DU implements some functions of the gNB.
  • the CU is responsible for processing non-real-time protocols and services, and realizing the functions of radio resource control (radio resource control, RRC) and packet data convergence protocol (packet data convergence protocol, PDCP) layer.
  • the DU is responsible for processing physical layer protocols and real-time services, realizing the functions of the radio link control (radio link control, RLC) layer, media access control (media access control, MAC) layer and physical (physical, PHY) layer.
  • the AAU implements some physical layer processing functions, radio frequency processing and related functions of active antennas. Since the information of the RRC layer will eventually become the information of the PHY layer, or be transformed from the information of the PHY layer, under this architecture, high-level signaling, such as RRC layer signaling, can also be considered to be sent by the DU , or, sent by DU+AAU.
  • the network device may be a device including one or more of a CU node, a DU node, and an AAU node.
  • the CU can be divided into network devices in an access network (radio access network, RAN), and the CU can also be divided into network devices in a core network (core network, CN), which is not limited in this application.
  • IPsec mainly consists of the following protocols:
  • AH Authentication header
  • ESP Encapsulating Security Payload
  • IPsec security association which provides algorithms and data packets, and provides parameters required for AH and ESP operations.
  • Internet key exchange Internet key exchange, IKE or IKEv2
  • IKE Internet key exchange
  • IKEv2 Internet key exchange, IKE or IKEv2
  • the sender of the IPSec message includes a sequence number field at the header of each IPSec message (the IPSec message includes an ESP message and an AH message), and when creating a new IPSec security association , the serial number counter will be initialized to 0, and whenever a data message is sent on this IPSec security association, the value of the serial number counter is increased by 1 and the value of the serial number field is set to the value of the counter. The value of the counter increases monotonously. When the value of the counter is close to 232 , a new IPSec security association should be established. At this time, the length of the serial number is 32 bits. Or, when using an extended sequence (extended sequence), the length of the sequence number can also be 64 bits.
  • the length of the sequence number is 64 bits
  • a new IPSec security association should be established when the value of the counter is close to 264. It should be understood that , the length of the future serial number can also be 128 or 256 bits, which is not limited in this application.
  • An anti-replay window is established at the receiving end of the IPSec message.
  • the width of the anti-replay window is W. Assuming that W is 64, it means that the width of the anti-replay window is 64 consecutive messages.
  • the leading edge of the window corresponds to the sequence number P of the IPSec packet at the starting position of the window, and the trailing edge of the window corresponds to the lowest sequence number P-W+1 of the receivable IPSec packet.
  • serial number of the received IPSec message falls outside the rear edge of the anti-replay window, that is, the serial number is less than P-W+1, it means that the message is an expired message, and the message is discarded.
  • the S1 data plane link is mapped to an IPSec security association, and an IPSec security association maintains an anti-replay window.
  • GTPECHOREQUEST packets and GTP ECHO REPLY packets are high-priority packets, and ordinary data packets with large traffic are low-priority packets.
  • the anti-replay feature may be disabled at the receiving end, sacrificing the security level to guarantee services.
  • anti-replay is a basic security feature of IPsec. If the anti-replay feature is disabled, the system will not be able to resist replay attacks, and the security problem cannot be solved.
  • Another possible implementation mode is to maintain multiple IPsec security associations between the sending end and the receiving end.
  • This solution is described in chapter 4.1 of the RFC4301 standard, that is, for the same traffic selector (traffic selector, TS), based on the differential service code point (differentiated services code point, DSCP) generates multiple IPsec security associations, each IPsec security association maintains an anti-replay window and targets one/a segment of DSCP value, which increases system consumption while solving security problems.
  • the embodiment of the present application provides a method and device for message anti-replay, which can enable messages with different priorities to be processed independently in different anti-replay windows under the same IPsec security association, avoiding messages due to Out-of-order trigger sequence numbers fall outside the trailing edge of the anti-replay window and cause packet loss.
  • the solution provided by the embodiment of the present application can save costs.
  • FIG. 2 is a schematic flow chart of a method for preventing replay of packets provided by an embodiment of the present application.
  • the method 200 shown in FIG. 2 includes:
  • step S210 the second device sends an IPsec packet to the first device, where the IPsec packet includes a first field, and the first field carries a value of the first information.
  • the first device receives the IPsec packet.
  • the first field includes a DSCP field or a flow label field, that is, the first information is a DSCP or a flow label.
  • IP header of the message includes a flow label (flowlabel, FL) field and a DSCP field
  • flow label flowlabel, FL
  • DSCP DSCP field
  • Step S220 the first device determines the first anti-replay window from the N anti-replay windows according to the first mapping relationship, the first mapping relationship includes the correspondence between the N anti-replay windows and the N value sets of the first information relationship, the value of the first information carried by the first field belongs to the value set of the first information corresponding to the first anti-replay window, the first anti-replay window is used to process the IPsec message, and the N anti-replay The window corresponds to the same IPsec security association, and N is an integer greater than or equal to 2.
  • one IPsec security association corresponds to multiple anti-replay windows, and there is a first mapping relationship between multiple anti-replay windows and multiple first information value sets, and the first mapping relationship may be an anti-replay
  • the playback window corresponds to a value set of the first information, or an anti-replay window corresponds to multiple value sets of the first information, or multiple anti-replay windows corresponds to a value set of the first information.
  • different anti-replay windows may correspond to different DSCP values or flow label values
  • the first device may determine from multiple anti-replay windows according to the DSCP value or flow label value in the IP header of the IPsec message, and The anti-replay window corresponding to the DSCP value or flow label value processes the IPsec message.
  • an IPsec security association corresponds to three anti-replay windows, which are anti-replay window #1 corresponding to the set of DSCP values [32, 47], [48, 48], and other values , anti-replay window #2, anti-replay window #3, wherein, anti-replay window #1 processes the message with the DSCP value of 32-47 in the IP header, and anti-replay window #2 processes the DSCP in the IP header For packets with a value of 48, the anti-replay window #3 processes packets with DSCP values other than 32-48 in the IP header.
  • the value set in this application may be a continuous value range, such as a value set [32, 47], or a discontinuous value set, such as a value set other than 32-48. This is not limited.
  • the IPv4 message is processed in the anti-replay window #2. Assuming that the first device receives an IPv4 message, and the DSCP value in the IP header of the message is 50, the IPv4 message is processed in the anti-replay window #3.
  • the sequence number counter will be initialized to 0, and whenever a data packet is sent on this IPsec security association, the value of the sequence number counter will be increased by 1 and the value of the sequence number field will be Set to the value of the counter.
  • the value of the counter increases monotonously, and when it is close to the maximum value, a new IPsec security association should be established, that is, a rekey (rekey) should be triggered.
  • a rekey rekey
  • the rekey process can also be triggered in other ways, such as starting from the establishment of a new IPsec security association, starting the timer, and triggering when the timer is close to the negotiation time.
  • rekey process When the rekey process is triggered, the serial number counter is initialized to 0, and the value of the serial number counter is incremented by 1 each time a packet is sent, and the serial number of the first packet sent on the IPsec security association is 1. It should be understood that during this process, the anti-replay window will also be reset, because in the process of processing the message, the N anti-replay windows will slide along with the processing process, so after the rekey process is triggered, the N anti-replay windows need to be reset. Put windows to reset.
  • the first device before receiving the IPsec packet, the first device generates N anti-replay windows according to the DSCP value or flow label value.
  • the first device may also generate N anti-replay windows according to other values used to indicate priorities, which is not limited in the present application.
  • the first device statically configures N anti-replay windows locally.
  • N anti-replay windows are manually and statically configured locally (static configuration means that they can be directly configured locally without negotiating with the second device), the anti-replay windows and DSCP corresponding to the same IPsec security association can be arbitrarily configured.
  • Value (or flow label value) correspondence taking DSCP value as an example, the first device statically configures three anti-replay windows locally, the DSCP value corresponding to anti-replay window #1 is [46], and the anti-replay window # The DSCP value corresponding to 2 is [48], and the DSCP value corresponding to anti-replay window #3 is other values except 46 and 48.
  • the first device negotiates with the second device to generate N anti-replay windows.
  • Fig. 3 is a schematic flow chart of negotiating multiple anti-replay windows through DSCP values provided by an embodiment of the present application.
  • the method 300 shown in FIG. 3 includes:
  • step S310 the first device sends a first packet to the second device, where the first packet includes a value set of first information expected by the first device, and the first information is DSCP.
  • the second device receives the first packet.
  • the first message includes a traffic selector payload
  • the traffic selector payload includes a traffic selector type field and an extension field.
  • the traffic selector type field is a predetermined value
  • the second device parses the extension field, and the extension field
  • the included extension type is DSCP range, and the extension field also includes at least one DSCP start value and at least one DSCP end value.
  • the first packet includes DSCP value set information expected by the first device.
  • the traffic selector payload includes one or more individual (individual) traffic selector payloads, and the format of the individual traffic selector payload is shown in Figure 4.
  • the currently defined traffic selector type (TS Type) field traffic The value of the selector IPv4 address range (TS_IPV4_ADDR_RANGE) is 7, and the value of the traffic selector IPv6 address range (TS_IPV6_ADDR_RANGE) is 8.
  • This application extends the traffic selector type field, for example, the traffic selector type field is expanded to: the value of the extended traffic selector IPv4 address range (TS_EXT_IPV4_ADDR_RANGE) is X, and the value of the traffic selector type field is defined in the existing protocol as 0 -9 (where 0-6 are reserved values, and 7-9 are defined), therefore, X can take any value from 10-255.
  • T_EXT_IPV4_ADDR_RANGE the value of the traffic selector type field is defined in the existing protocol as 0 -9 (where 0-6 are reserved values, and 7-9 are defined), therefore, X can take any value from 10-255.
  • the extension field includes an extension type (extension type), an extension length ( extension length), start value (start value), end value (end value).
  • extension type can be DSCP range, the extension length is DSCP length, the start value is the DSCP start value, and the end value is the DSCP end value.
  • the length of the extension type is 1 byte, and the value range is 0-255, indicating that there are 256 kinds of extension types, one of which can be INDEP_ANTIREPLAY_DSCP_RANGE, and the extension type can take any value from 0-255.
  • the application does not limit this; the length of the extension is 1 byte, and the value range is 0-255; the length and value range of the initial value are different, depending on the extension type, for example, when the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, The length is 1 byte, the value range is 0-63, and the upper 2 bits are fixed to all 0; the length and value range of the end value are different, depending on the extension type, for example, when the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the length is 1 bytes, the value range is 0-63, the upper 2 bits are all 0, and the end value should be greater than or equal to the start value.
  • step S320 the second device sends a second message to the first device, where the second message includes a set of DSCP values negotiated by the second device based on the first message.
  • the first device receives the second packet.
  • the first packet includes DSCP value set information expected by the first device
  • the second packet includes a DSCP value set negotiated by the second device based on the DSCP value set information in the first packet.
  • the second message includes a traffic selector type field and an extension field.
  • the first device parses the extension field.
  • the extension type included in the extension field is the DSCP range, and the extension field It also includes at least one DSCP start value and at least one DSCP end value, the at least one DSCP start value and at least one DSCP end value are used to determine M DSCP value sets, where M is an integer greater than or equal to 1.
  • the DSCP start value and DSCP end value in the extension field may determine two sets of DSCP values, and the first device may generate three anti-replay windows or two anti-replay windows according to the two sets of DSCP values , or generate one anti-replay window, that is to say, the above M may be less than, or equal to, or greater than N, which is not limited in this application.
  • predetermined value is the same as that described in step S310, and will not be repeated here.
  • Step S330 the first device generates N anti-replay windows according to the DSCP value set in the second packet.
  • the first message and/or the second message is an Internet key exchange (internet key exchange, IKE) message including a traffic selector payload.
  • IKE Internet key exchange
  • the first packet and/or the second packet are IKE_AUTH or CREATE_CHILD_SA packets.
  • first packet and/or the second packet may also be other packets including the payload of the traffic selector, which is not limited in this application.
  • the traffic selector type field includes: a traffic selector IPv4 address range and an extended traffic selector IPv4 address range, or a traffic selector IPv6 address range and an extended traffic selector IPv6 address range.
  • the traffic selector type field in the first/second message includes both the traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or includes both the traffic selector IPv6 address range and the extended traffic selector IPv6 address range, it is compatible with devices that support negotiation to generate multiple anti-replay windows and devices that do not support negotiation to generate multiple anti-replay windows.
  • the traffic selector type field in the traffic selector payload in the first/second message is the traffic selector IPv4 address range of the same address range and the extended traffic selector IPv4 address range, or the traffic selection of the same address range
  • the IPv6 and extended traffic selector IPv6 address ranges are used, only the extended traffic selector IPv4/IPv6 address range can be resolved.
  • a device that does not support negotiation to generate multiple anti-replay windows receives the first/second packet, it cannot recognize the extended IPv4/IPv6 address range field of the traffic selector, so it only parses the IPv4/IPv6 address range field of the traffic selector.
  • Fig. 5 is a schematic flowchart of negotiating multiple anti-replay windows through flow label values provided by an embodiment of the present application.
  • the method 400 shown in FIG. 5 includes:
  • Step S410 the first device sends a third packet to the second device, where the third packet includes a value set of first information expected by the first device, where the first information is a flow label.
  • the second device receives the third packet.
  • the third packet includes flow label value set information expected by the first device.
  • the third message includes a traffic selector payload
  • the traffic selector payload includes a traffic selector type field and an extension field.
  • the second device parses the extension field, and the extension field
  • the included extension type is flow label range, and the extension field also includes at least one flow label start value and at least one flow label end value.
  • the traffic selector payload includes one or more individual (individual) traffic selector payloads, and the format of the individual traffic selector payload is similar to that in Figure 4.
  • the currently defined traffic selector type (TS Type) field traffic selection The value of the IPv4 address range (TS_IPV4_ADDR_RANGE) of the traffic selector is 7, and the value of the IPv6 address range of the traffic selector (TS_IPV6_ADDR_RANGE) is 8.
  • This application extends the traffic selector type field, for example, the traffic selector type field is expanded to: the value of the extended traffic selector IPv6 address range (TS_EXT_IPV6_ADDR_RANGE) is Y, and the value of the traffic selector type field is defined in the existing protocol as 0 -9 (where 0-6 are reserved values, and 7-9 are defined), therefore, Y can take any value from 10-255, and Y and the above-mentioned X take different values.
  • T_EXT_IPV6_ADDR_RANGE the value of the traffic selector type field is defined in the existing protocol as 0 -9 (where 0-6 are reserved values, and 7-9 are defined)
  • the extension field includes an extension type (extension type), an extension length (extension length), start value (start value), end value (end value).
  • extension type can be the range of the flow label
  • the extension length is the length of the flow label
  • the start value is the start value of the flow label
  • the end value is the end value of the flow label.
  • the length of the extension type is 1 byte, and the value range is 0-255, indicating that there are 256 types of extension types, one of which can be INDEP_ANTIREPLAY_FLOWLABEL_RANGE, and the extension type can take any value from 0-255.
  • the application does not limit this; the length of the extension is 1 byte, and the value range is 0-255; the length and value range of the initial value are different, depending on the extension type, for example, when the extension type is INDEPENDENT_ANTIREPLAY_FLOWLABEL_RANGE, The length is 2.5 bytes, and the value range is 0-(2 20 -1); the length and value range of the end value are different, depending on the extension type, for example, when the extension type is INDEPENDENT_ANTIREPLAY_FLOWLABEL_RANGE, the length is 2.5 bytes , the value range is 0-(2 20 -1), and the end value should be greater than or equal to the start value.
  • Figure 4 illustrates the format of the payload of an individual traffic selector in a message based on DSCP negotiation.
  • the format of the payload of an individual traffic selector is similar to that in Figure 4, but The start value and end value occupy 2.5 bytes, which is different from Figure 4.
  • step S420 the second device sends a fourth packet to the first device, where the fourth packet includes a set of determined flow label values negotiated by the second device based on the third packet.
  • the first device receives the fourth packet.
  • the third packet includes flow label value set information expected by the first device, and the second packet includes a flow label value set negotiated by the second device based on the flow label value set information in the third packet.
  • the fourth message includes a traffic selector type field and an extension field, and when the value of the traffic selector type field is a predetermined value, the first device parses the extension field, and the extension type included in the extension field is a flow label range,
  • the extension field also includes at least one flow label start value and at least one flow label end value, and the at least one flow label start value and at least one flow label end value are used to determine M flow label value sets, where M is greater than or An integer equal to 1.
  • the flow label start value and the flow label end value in the extension field can determine 2 flow label value sets, and the first device can generate 3 anti-replay windows according to the 2 flow label value sets, or generate 2
  • the anti-replay window, or generate one anti-replay window that is to say, the above M can be less than, or equal to, or greater than N, and this application does not limit it.
  • predetermined value is the same as that described in step S410, and will not be repeated here.
  • Step S430 the first device generates N anti-replay windows according to the set of flow label values in the fourth packet.
  • the third packet and/or the fourth packet is an IKE packet including a traffic selector payload.
  • the third packet and/or the fourth packet are IKE_AUTH or CREATE_CHILD_SA packets.
  • the third packet and/or the fourth packet may also be other packets including the payload of the traffic selector, which is not limited in this application.
  • the traffic selector type field includes: traffic selector IPv6 address range and extended traffic selector IPv6 address range.
  • the traffic selector type field in the third/fourth packet includes both the IPv6 address range of the traffic selector and the extended IPv6 address range of the traffic selector, it is compatible with devices that support negotiation to generate multiple anti-replay windows and those that do not support negotiation
  • the device that generates multiple anti-replay windows when the device that supports negotiation to generate multiple anti-replay windows receives the third/fourth message, determines the traffic selector in the traffic selector payload in the third/fourth message
  • the type field is the same address range of the traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or the same address range of the traffic selector IPv6 and the extended traffic selector IPv6 address range, only the extended traffic selection can be parsed
  • the server IPv4/IPv6 address range is the same address range of the traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or the same address range of the traffic selector IPv6 and the extended traffic selector IPv6 address range, only the extended traffic
  • the first device is configured to allow multiple anti-replay windows to be generated based on DSCP, and the first device is configured with multiple DSCP values, and the second device is configured to allow multiple anti-replay windows to be generated based on DSCP, and
  • the DSCP value configured on the second device end is ANY (that is, the DSCP value is any value in 0-63).
  • the IKE message interaction process and anti-replay window generation process are as follows:
  • the traffic selector payload carried in the first message sent by the first device to the second device includes an extension field, wherein the traffic selector type is TS_EXT_IPV6_ADDR_RANGE (indicated by EXT_IPV6 in the traffic selector payload example, the traffic that appears later
  • the selector load example is also represented by EXT_IPV6, which will not be repeated)
  • the traffic selector length is 56
  • the extension type is INDEP_ANTIREPLAY_DSCP_RANGE (in the traffic selector load example, it is represented by DSCP_RANGE, and the traffic selector load examples that appear later are also represented by DSCP_RANGE means, no more details)
  • the extension length is 8
  • the DSCP range is [32, 47] and [48, 63].
  • a specific traffic selector payload example is as follows:
  • TS_Type EXT_IPv6
  • TS_Len 56
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • TS_Type EXT_IPv6
  • TS_Len 56
  • Str_Addr 2::0
  • End Addr 2::FFFF
  • the initiator the end that initiates the message first is called the initiator, and the responder is called the responder. Therefore, the traffic selector sent by the initiator is called TSi (traffic selector–initiator), and the traffic selector sent by the responder is called TSr ( traffic selector–responder).
  • TSi traffic selector–initiator
  • TSr traffic selector–responder
  • the traffic selector payload carried in the second packet responded by the second device includes an extension field, where the traffic selector type is TS_IPV6_ADDR_RANGE, the traffic selector length is 56, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP interval is [32, 47] and [48, 63]
  • a specific traffic selector payload example is as follows:
  • TS_Type EXT_IPv6
  • TS_Len 56
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • TS_Type EXT_IPv6
  • TS_Len 56
  • Str_Addr 2::0
  • End Addr 2::FFFF
  • the first device and the second device can Generate 3 anti-replay windows.
  • the DSCP value corresponding to anti-replay window #1 is 32-47
  • the DSCP value corresponding to anti-replay window #2 is 48-63
  • the DSCP value corresponding to anti-replay window #3 is Other values than [32, 47] and [48, 63].
  • the IPsec security association negotiation is completed, and the IPsec message of the security association is processed by the anti-replay window corresponding to the DSCP value in the IPsec message in the receiving direction.
  • the first device is configured to allow multiple anti-replay windows to be generated based on DSCP, and the DSCP value configured on the first device is ANY (that is, the DSCP value is any value in 0-63), and the second device is configured as Multiple anti-replay windows are allowed to be generated based on DSCP, and multiple DSCP values are configured on the second device side.
  • the IKE message interaction process and anti-replay window generation process are as follows:
  • the traffic selector payload carried in the first message sent by the first device to the second device includes an extension field, where the traffic selector type is TS_EXT_IPV6_ADDR_RANGE, the traffic selector length is 48, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, and the extension length is 8 , the DSCP interval is [0, 63].
  • a specific traffic selector payload example is as follows:
  • TS_Type EXT_IPv6
  • TS_Len 48
  • Str_Addr ::
  • End Addr FFFF::FFFF
  • TS_Type EXT_IPv6
  • TS_Len 48
  • Str_Addr ::
  • End Addr FFFF::FFFF
  • the traffic selector payload carried in the second packet responded by the second device includes an extension field, where the traffic selector type is TS_IPV6_ADDR_RANGE, the traffic selector length is 56, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP interval is [32, 47] and [48, 63]
  • a specific traffic selector payload example is as follows:
  • TS_Type EXT_IPv6
  • TS_Len 56
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • TS_Type EXT_IPv6
  • TS_Len 56
  • Str_Addr 2::0
  • End Addr 2::FFFF
  • the first device and the second device can Generate 3 anti-replay windows.
  • the DSCP value corresponding to anti-replay window #1 is 32-47
  • the DSCP value corresponding to anti-replay window #2 is 48-63
  • the DSCP value corresponding to anti-replay window #3 is Other values than [32, 47] and [48, 63].
  • the IPsec security association negotiation is completed, and the IPsec message of the security association is processed by the anti-replay window corresponding to the DSCP value in the IPsec message in the receiving direction.
  • the first device is configured to allow multiple anti-replay windows to be generated based on DSCP, and the first device is configured with multiple DSCP values, the second device is configured to allow multiple anti-replay windows to be generated based on DSCP, and the first Multiple DSCP values are also configured on the second device side.
  • the IKE message interaction process and anti-replay window generation process are as follows:
  • the traffic selector payload carried in the first message sent by the first device to the second device includes an extension field, where the traffic selector type is TS_EXT_IPV6_ADDR_RANGE, the traffic selector length is 48, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, and the extension length is 8 , the DSCP interval is [32, 63].
  • a specific traffic selector payload example is as follows:
  • TS_Type EXT_IPv6
  • TS_Len 48
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • TS_Type EXT_IPv6
  • TS_Len 48
  • Str_Addr 2::0
  • End Addr 2::FFFF
  • the traffic selector payload carried in the second packet responded by the second device includes an extension field, where the traffic selector type is TS_IPV6_ADDR_RANGE, the traffic selector length is 56, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP interval is [46, 46] and [48, 48]
  • a specific traffic selector payload example is as follows:
  • TS_Type EXT_IPv6
  • TS_Len 56
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • TS_Type EXT_IPv6
  • TS_Len 56
  • Str_Addr 2::0
  • End Addr 2::FFFF
  • the first device and the second device can Generate 3 anti-replay windows, for example, the DSCP value corresponding to anti-replay window #1 is 46, the DSCP value corresponding to anti-replay window #2 is 48, and the DSCP value corresponding to anti-replay window #3 is divided by 46 and 48 other values than .
  • the IPsec security association negotiation is completed, and the IPsec message of the security association is processed by the anti-replay window corresponding to the DSCP value in the IPsec message in the receiving direction.
  • the first device is configured to allow multiple anti-replay windows to be generated based on DSCP
  • the second device is configured to not allow multiple anti-replay windows to be generated based on DSCP.
  • the second device is configured not to allow generating multiple anti-replay windows based on DSCP. It can be understood that the second device supports generating multiple anti-replay windows based on DSCP (the second device can recognize the extended traffic selector field), but the second device It is configured not to allow multiple anti-replay windows to be generated based on DSCP (the second packet responded by the second device includes a traffic selector field instead of an extended traffic selector field).
  • the IKE message interaction process and anti-replay window generation process are as follows:
  • the traffic selector payload carried in the first message sent by the first device to the second device includes an extension field, where the traffic selector type is TS_EXT_IPV6_ADDR_RANGE, the traffic selector length is 48, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, and the extension length is 8 , the DSCP interval is [32, 63].
  • a specific traffic selector payload example is as follows:
  • TS_Type EXT_IPv6
  • TS_Len 48
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • TS_Type EXT_IPv6
  • TS_Len 48
  • Str_Addr 2::0
  • End Addr 2::FFFF
  • the traffic selector payload carried in the second packet responded by the second device does not include the extension field, because the second device can recognize the extended traffic selector, but because the configuration does not allow multiple anti-replay windows to be generated based on DSCP, therefore The non-extended traffic selector is included in the second packet of the response.
  • a specific traffic selector payload example is as follows:
  • TS_Type IPv6
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • TS_Type IPv6
  • Str_Addr 2::0
  • End Addr 2::FFFF
  • the first device and the second device After passing the first message and the second message, if the first device and the second device fail to negotiate a DSCP interval, the first device and the second device generate a default anti-replay window.
  • the first device is configured to allow the generation of multiple anti-replay windows based on DSCP
  • the second device is configured to not support the generation of multiple anti-replay windows based on DSCP
  • Scenario 5 is a compatible scenario.
  • the first device is configured to allow the generation of multiple anti-replay windows based on DSCP, but the first device does not know whether the second device supports the generation of multiple anti-replay windows based on DSCP, so the traffic sent is selected
  • the device includes 2 groups, 1 group is non-extended traffic selector, 1 group is extended traffic selector, and the address range of 2 groups is the same.
  • Case 1 When the second device supports the generation of multiple anti-replay windows based on DSCP, the second device can recognize the extended traffic selector. Since the address ranges of the two groups of traffic selectors are the same, the second device only processes the extended traffic selector. traffic selector.
  • the second case when the second device does not support generating multiple anti-replay windows based on DSCP, the second device cannot recognize the extended traffic selector, so it only needs to process the non-extended traffic selector, and the Can guarantee the success of the negotiation.
  • Compatibility Scenario 5 describes the backward compatibility between devices supporting this application (traffic selectors that can recognize extensions) and devices that do not support this application, so as to avoid basic negotiation failure.
  • the IKE message interaction process and anti-replay window generation process are as follows:
  • the traffic selector payload carried in the first message sent by the first device to the second device includes an extension field, where the traffic selector types are TS_IPV6_ADDR_RANGE and TS_EXT_IPV6_ADDR_RANGE, where the length of the non-extended traffic selector is 40, and the length of the extended traffic selector
  • the traffic selector length is 48
  • the extension type is INDEP_ANTIREPLAY_DSCP_RANGE
  • the extension length is 8
  • the DSCP interval is [32, 63].
  • a specific traffic selector payload example is as follows:
  • TS_Type EXT_IPv6
  • TS_Len 48
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • TS_Type EXT_IPv6
  • TS_Len 48
  • Str_Addr 1::0
  • End Addr 1::FFFF
  • the traffic selector payload carried in the second packet responded by the second device does not include the extension field.
  • a specific traffic selector payload example is as follows:
  • the first device and the second device After passing the first message and the second message, if the first device and the second device fail to negotiate a DSCP interval, the first device and the second device generate a default anti-replay window.
  • the solution provided by this application has strong scalability, and the extension type can have 256 different values.
  • the specific content of determining multiple anti-replay windows through flow label negotiation is similar to determining multiple anti-replay windows through DSCP negotiation.
  • the negotiation process is the same, and the only difference is in field names and specific values, which will not be described here.
  • Scenario 6 The first device locally statically configures at least one anti-replay window
  • scenarios 1-5 describe how the first device generates multiple anti-replay windows through DSCP value negotiation
  • scenario 6 introduces that the first device does not need to negotiate with the second device, and configures it locally according to the DSCP value or flow label value. At least one anti-replay window.
  • the following mainly takes the first device locally statically configuring at least one anti-replay window according to the DSCP value as an example.
  • the process of the first device locally statically configuring at least one anti-replay window according to the flow label value is similar and will not be described again.
  • the first device is configured to allow multiple anti-replay windows to be generated based on DSCP.
  • one IPsec security association can correspond to one anti-replay window (the default anti-replay window).
  • at least one anti-replay window may also be statically configured on the first device.
  • the first device statically configures two anti-replay windows locally based on the DSCP value, wherein the DSCP value corresponding to the anti-replay window #1 is [46], and the anti-replay window #2 corresponds to The DSCP value of is [48], and the DSCP value corresponding to anti-replay window #3 (the default anti-replay window) is other than 46 and 48.
  • the local static configuration of at least one anti-replay window by the first device is completed.
  • the first device receives the IPsec message, it selects the corresponding anti-replay window according to the DSCP value in the IPsec message. For example, if the DSCP value in the IPsec message is 48, the IPsec message is blocked by the anti-replay window. #2 processing.
  • the local multiple anti-replay windows of the first device have priorities, that is to say, after the first device receives the IPsec message, it sequentially selects the multiple anti-replay windows according to the priorities of the multiple anti-replay windows The corresponding DSCP value is compared with the DSCP value in the IPsec message until an anti-replay window corresponding to the DSCP value in the IPsec message is found, and the IPsec message is processed through the anti-replay window.
  • the first device statically configures two anti-replay windows locally based on the DSCP value, and the anti-replay window #1 (the corresponding DSCP value is [46]) in descending order of priority, the anti-replay Window #2 (the corresponding DSCP value is [48]), anti-replay window #3 (the default anti-replay window, the corresponding DSCP value is other than 46 and 48).
  • the DSCP value of IPsec packet #1 received by the first device subsequently is 48
  • the first anti-replay window selected according to the priority is anti-replay window #1
  • the DSCP value of anti-replay window #1 is 48.
  • the value does not match 48, and then the anti-replay window #2 is selected according to the priority, and the DSCP value of the anti-replay window #2 matches 48, so the IPsec message #1 is processed in the anti-replay window #2.
  • the DSCP value of the subsequent IPsec packet #2 received by the first device is 47
  • the first anti-replay window selected according to the priority is anti-replay window #1
  • the DSCP value of the anti-replay window #1 is 47.
  • the value does not match 47
  • the anti-replay window #2 is selected according to the priority.
  • the DSCP value of the anti-replay window #2 still does not match 47, so the IPsec message #2 is processed in the anti-replay window #3.
  • execution subject mentioned in the above method embodiment is only an example, and the execution subject may also be a chip, a chip system, or a processor that supports the execution subject to implement the above method embodiment, and this application does not limit this .
  • the methods and operations implemented by the first device may also be implemented by components (such as chips or circuits) that can be used in the first device, and implemented by the second device.
  • the methods and operations can also be implemented by components (such as chips or circuits) that can be used in the second device.
  • each network element such as a transmitting end device or a receiving end device, includes a corresponding hardware structure and/or software module for performing each function in order to realize the above functions.
  • the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed by hardware or computer software drives hardware depends on the specific application and design constraints of the technical solution. Skilled artisans may use different methods to implement the described functions for each specific application, but such implementation should not be regarded as exceeding the scope of the present application.
  • the embodiment of the present application can divide the functional modules of the transmitting end device or the receiving end device according to the above method example, for example, each functional module can be divided corresponding to each function, or two or more functions can be integrated into one processing module middle.
  • the above-mentioned integrated modules can be implemented in the form of hardware or in the form of software function modules. It should be noted that the division of modules in the embodiment of the present application is schematic, and is only a logical function division, and there may be other division methods in actual implementation. In the following, description will be made by taking the division of each functional module corresponding to each function as an example.
  • Fig. 6 is a schematic block diagram of an apparatus for processing data provided by an embodiment of the present application.
  • the device 500 includes a transceiver unit 510 and a processing unit 520 .
  • the transceiver unit 510 can communicate with the outside, and the processing unit 520 is used for data processing.
  • the transceiver unit 510 may also be called a communication interface or a communication unit.
  • the apparatus 500 may further include a storage unit, which may be used to store instructions and/or data, and the processing unit 520 may read instructions or and/or data in the storage unit.
  • a storage unit which may be used to store instructions and/or data
  • the processing unit 520 may read instructions or and/or data in the storage unit.
  • the apparatus 500 may be the first device in the data exchange network, the transceiver unit 510 is used to perform the receiving or sending operation of the first device in the method embodiment above, and the processing unit 520 is used to perform the above The internal processing operation of the first device in the method embodiment.
  • the apparatus 500 may be a device including the first device.
  • the apparatus 500 may be a component configured in the first device, for example, a chip in the first device.
  • the transceiver unit 510 may be an interface circuit, a pin, and the like.
  • the interface circuit may include an input circuit and an output circuit
  • the processing unit 520 may include a processing circuit.
  • the transceiver unit 510 is configured to receive an Internet security protocol IPsec message, the IPsec message includes a first field, the first field carries the value of the first information, and the processing unit 520 is configured to Determine the first anti-replay window from the N anti-replay windows, the first mapping relationship includes the corresponding relationship between the N anti-replay windows and the N value sets of the first information, and the first information carried by the first field
  • the value belongs to the value set of the first information corresponding to the first anti-replay window
  • the first anti-replay window is used to process the IPsec message
  • the N anti-replay windows correspond to the same IPsec security association
  • N is An integer greater than or equal to 2.
  • one IPsec security association at the receiving end of the IPsec message corresponds to multiple anti-replay windows, so that the receiving end of the IPsec message can determine the priority of the IPsec message according to the first field in the IPsec message, and according to Priority selects the corresponding anti-replay window to process the IPsec message, so that IPsec messages with different priorities are processed in different anti-replay windows, and the messages processed by each anti-replay window have the same priority, so it can It avoids packet loss caused by out-of-sequence, and also avoids cost increases such as increased system resource consumption caused by newly added IPsec security associations generated by the parallel IPsec security association scheme proposed in Section 4.1 of the RFC4301 standard.
  • the first information includes a differentiated services code point DSCP or a flow label.
  • the DSCP values of different IPsec packets represent different priorities. Based on the solution provided by this application, high-priority packets and low-priority packets can be processed in different anti-replay windows, which can Avoid packet loss of low-priority packets.
  • the flow label values of different IPsec packets represent different services, and different services may be mapped to different service qualities during transmission.
  • services corresponding to different service qualities can be in Independent processing in different anti-replay windows can avoid packet loss of low-priority packets.
  • the processing unit 520 is further configured to generate the N anti-replay windows according to the first information.
  • the N anti-replay windows are statically configured locally.
  • the N anti-replay windows are generated through negotiation between the first device and the second device according to the value of the first information
  • the transceiver unit 510 is further configured to send a first message, and the first message Including a value set of the first information expected by the first device
  • the transceiver unit 510 is further configured to receive a second message, the second message includes a value set of the first information negotiated by the second device based on the first message
  • the processing unit 520 is further configured to generate the N anti-replay windows according to the value set of the first information in the second packet.
  • the second message includes a traffic selector type field and an extension field
  • the processing unit 520 is further configured to parse the extension field
  • the extension field The extension type included is the range of the first information
  • the extension field also includes at least one start value of the first information and at least one end value of the first information, the start value of the at least one first information and at least one first
  • the end value of the information is used to determine M value sets of the first information, where M is an integer greater than or equal to 1.
  • the first packet and/or the second packet is an Internet key exchange packet including a traffic selector payload.
  • the traffic selector type field includes: the IP version IPv6 address range of the traffic selector and the extended IPv6 address range of the traffic selector, or, the IPv4 address range of the traffic selector and the extended IPv4 address range of the traffic selector .
  • this application adds an extended traffic selector IPv4 or IPv6 address range based on the existing traffic selector IPv4 or IPv6 address range field, which is compatible with devices that support negotiation to generate multiple anti-replay windows and those that do not For devices that negotiate to generate multiple anti-replay windows, when the device that supports negotiation to generate multiple anti-replay windows receives the second packet, when the device that supports negotiation to generate multiple anti-replay windows sends the first packet,
  • a traffic selector IPv4 address range field and an extended traffic selector IPv4 address range field of the same address range can be placed in the traffic selector payload, or a traffic selector IPv6 address range field of the same address range can be placed in the traffic selector payload Extended traffic selector IPv6 address range field.
  • the traffic selector type field in the traffic selector payload in the second packet is the same address range of the traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or the same address range of the traffic selector IPv6 and extended Only the extended traffic selector IPv4/IPv6 address range can be parsed when the traffic selector IPv6 address range is specified.
  • a device that does not support negotiation to generate multiple anti-replay windows receives the second packet, it cannot recognize the extended traffic selector IPv4/IPv6 address range field, so it only parses the traffic selector IPv4/IPv6 address range field.
  • Fig. 7 is a schematic block diagram of an apparatus for processing data provided by an embodiment of the present application.
  • the device 600 includes a transceiver unit 610 and a processing unit 620 .
  • the transceiver unit 610 can communicate with the outside, and the processing unit 620 is used for data processing.
  • the transceiver unit 610 may also be called a communication interface or a communication unit.
  • the apparatus 600 may further include a storage unit 630, which may be used to store instructions and/or data, and the processing unit 620 may read instructions or and/or data in the storage unit 630.
  • a storage unit 630 which may be used to store instructions and/or data
  • the processing unit 620 may read instructions or and/or data in the storage unit 630.
  • the apparatus 600 may be the second device in the data exchange network, the transceiver unit 610 is used to perform the receiving or sending operation of the second device in the method embodiment above, and the processing unit 620 is used to perform the above Operations of internal processing of the second device in the method embodiment.
  • the apparatus 600 may be a device including the second device.
  • the apparatus 600 may be a component configured in the second device, for example, a chip in the second device.
  • the transceiver unit 610 may be an interface circuit, a pin, and the like.
  • the interface circuit may include an input circuit and an output circuit
  • the processing unit 620 may include a processing circuit.
  • the transceiving unit 610 is configured to send an Internet security protocol IPsec message, the IPsec message includes a first field, the first field carries the value of the first information, and the first field is used to select from N
  • the first anti-replay window is determined in the anti-replay window, the value of the first information carried by the first field belongs to the value set of the first information corresponding to the first anti-replay window, and the first anti-replay window is used for
  • the N anti-replay windows correspond to the same IPsec SA, where N is an integer greater than or equal to 2.
  • one IPsec security association at the receiving end of the IPsec message corresponds to multiple anti-replay windows, so that the receiving end of the IPsec message can determine the priority of the IPsec message according to the first field in the IPsec message, and according to Priority selects the corresponding anti-replay window to process the IPsec message, so that IPsec messages with different priorities are processed in different anti-replay windows, and the messages processed by each anti-replay window have the same priority, so it can It avoids packet loss caused by out-of-sequence, and also avoids cost increases such as increased system resource consumption caused by newly added IPsec security associations generated by the parallel IPsec security association scheme proposed in Section 4.1 of the RFC4301 standard.
  • the first information includes a differentiated services code point DSCP or a flow label.
  • IPsec DSCP values represent different priorities. Based on the solution provided by this application, high-priority packets and low-priority packets can be processed in different anti-replay windows, which can avoid low Priority packets are lost.
  • the flow label values of different IPsec packets represent different services, and different services may be mapped to different service qualities during transmission.
  • services corresponding to different service qualities can be in Independent processing in different anti-replay windows can avoid packet loss of low-priority packets.
  • the transceiver unit 610 is further configured to receive a first message, where the first message includes a value set of first information expected by the first device, and send a second message, where the second message includes The second device negotiates a value set of the first information based on the first packet, and the value set of the first information in the second packet is used to generate the N anti-replay windows.
  • the first message includes a traffic selector type field and an extension field
  • the processing unit 620 when the value of the traffic selector type field is a predetermined value, the processing unit 620 is configured to parse the extension field, and the extension field includes The extension type of is the range of the first information, and the extension field further includes at least one start value of the first information and at least one end value of the first information.
  • the first packet and/or the second packet is an Internet key exchange packet including a traffic selector payload.
  • the traffic selector type field includes: the IP version IPv6 address range of the traffic selector and the extended IPv6 address range of the traffic selector, or, the IPv4 address range of the traffic selector and the extended IPv4 address of the traffic selector scope.
  • this application adds an extended traffic selector IPv4 or IPv6 address range based on the existing traffic selector IPv4 or IPv6 address range field, which is compatible with devices that support negotiation to generate multiple anti-replay windows and those that do not A device that supports negotiation to generate multiple anti-replay windows, after receiving the first packet, determines that the traffic selector type field in the traffic selector payload in the first packet is The traffic selector IPv4 address range and the extended traffic selector IPv4 address range of the same address range, or the traffic selector IPv6 address range of the same address range and the extended traffic selector IPv6 address range, at this time, only the extended traffic selector can be parsed The server IPv4/IPv6 address range.
  • a device that does not support negotiation to generate multiple anti-replay windows receives the first packet, it cannot recognize the extended IPv4/IPv6 address range field of the traffic selector, so it only parses the IPv4/IPv6 address range field of the traffic selector.
  • the embodiment of the present application further provides an apparatus 700 for processing data.
  • the device 700 includes a processor 710, the processor 710 is coupled with a memory 720, the memory 720 is used to store computer programs or instructions and/or data, and the processor 710 is used to execute the computer programs or instructions and/or data stored in the memory 720, The methods in the above method embodiments are executed.
  • the apparatus 700 includes one or more processors 710 .
  • the apparatus 700 may further include a memory 720 .
  • the apparatus 700 may include one or more memories 720 .
  • the memory 720 may be integrated with the processor 710, or set separately.
  • the apparatus 700 may further include a transceiver 730 and/or a communication interface, and the transceiver 730 and/or the communication interface are used for receiving and/or sending signals.
  • the processor 710 is configured to control the transceiver 730 and/or the communication interface to receive and/or send signals.
  • the apparatus 700 is used to implement the operations performed by the first device in the above method embodiments.
  • the processor 710 is used to implement the operations performed internally by the first device in the above method embodiments
  • the transceiver 730 is used to implement the receiving or sending operations performed by the first device in the above method embodiments.
  • the processing unit 520 in the apparatus 500 may be the processor in FIG. 8
  • the transceiver unit 510 may be the transceiver in FIG. 8 .
  • the embodiment of the present application further provides an apparatus 800 for processing data.
  • the device 800 includes a processor 810, the processor 810 is coupled with a memory 820, the memory 820 is used to store computer programs or instructions or and/or data, and the processor 810 is used to execute the computer programs or instructions and/or data stored in the memory 820, The methods in the above method embodiments are executed.
  • the apparatus 800 includes one or more processors 810 .
  • the apparatus 800 may further include a memory 820 .
  • the apparatus 800 may include one or more memories 820 .
  • the memory 820 may be integrated with the processor 810, or set separately.
  • the apparatus 800 may further include a transceiver 830 and/or a communication interface, and the transceiver 830 and/or the communication interface are used for receiving and/or sending signals.
  • the processor 810 is configured to control the transceiver 830 to receive and/or send signals.
  • the apparatus 800 is used to implement the operations performed by the second device in the above method embodiments.
  • the processor 810 is configured to implement the operations performed internally by the second device in the above method embodiments
  • the transceiver 830 is configured to implement the receiving or sending operations performed by the second device in the above method embodiments.
  • the processing unit 620 in the apparatus 600 may be the processor in FIG. 9
  • the transceiver unit 610 may be the transceiver and/or the communication interface in FIG. 9 .
  • the operations performed by the processor 810 reference may be made to the description of the processing unit 620 above, and for the operations performed by the transceiver 830, reference may be made to the description of the transceiver unit 610, which will not be repeated here.
  • the embodiment of the present application also provides a device for processing data, including a processor, the processor is coupled with the input/output interface, and the data is transmitted through the input/output interface, and the processor is used to execute the method in any one of the above method embodiments. method.
  • the embodiment of the present application also provides an apparatus 900 for processing data.
  • the device 900 includes a logic circuit 910 and an input/output interface (input/output interface) 920 .
  • the logic circuit 910 may be a processing circuit in the device 900 .
  • the logic circuit 910 may be coupled to the storage unit, and invoke instructions in the storage unit, so that the device 900 can implement the methods and functions of the various embodiments of the present application.
  • the input/output interface 920 may be an input/output circuit in the device 900, which outputs information processed by the device 900, or inputs data or signaling information to be processed into the device 900 for processing.
  • the apparatus 900 is used to implement the operations performed by the first device in the above method embodiments.
  • the logic circuit 910 is used to implement the processing-related operations performed by the first device in the above method embodiments
  • the input/output interface 920 is used to implement the sending and/or receiving operations performed by the first device in the above method embodiments related operations.
  • the operations performed by the logic circuit 910 refer to the above description of the processing unit 520
  • the operations performed by the input/output interface 920 refer to the above description for the transceiver unit 510 , which will not be repeated here.
  • the apparatus 900 is configured to implement the operations performed by the second device in the foregoing method embodiments.
  • the logic circuit 910 is used to implement the processing-related operations performed by the second device in the above method embodiments
  • the input/output interface 920 is used to implement the sending and/or reception performed by the second device in the above method embodiments related operations.
  • the operations performed by the logic circuit 910 refer to the description of the processing unit 620 above
  • the operations performed by the input/output interface 920 refer to the description of the transceiver unit 610 above, and details are not repeated here.
  • the above-mentioned device may be one or more chips.
  • the device may be a field programmable gate array (field programmable gate array, FPGA), may be an application specific integrated circuit (ASIC), may also be a system chip (system on chip, SoC), or may be
  • the central processing unit central processor unit, CPU), can also be a network processor (network processor, NP), can also be a digital signal processing circuit (digital signal processor, DSP), can also be a microcontroller (micro controller unit, MCU), it can also be a programmable logic device (programmable logic device, PLD) or other integrated chips.
  • each step of the above method can be completed by an integrated logic circuit of hardware in a processor or an instruction in the form of software.
  • the steps of the methods disclosed in connection with the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware. To avoid repetition, no detailed description is given here.
  • the processor in the embodiment of the present application may be an integrated circuit chip, which has a signal processing capability.
  • each step of the above-mentioned method embodiments may be completed by an integrated logic circuit of hardware in a processor or instructions in the form of software.
  • the above-mentioned processor may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components .
  • DSP digital signal processor
  • ASIC application-specific integrated circuit
  • FPGA field-programmable gate array
  • a general-purpose processor may be a microprocessor, or the processor may be any conventional processor, or the like.
  • the steps of the method disclosed in connection with the embodiments of the present application may be directly implemented by a hardware decoding processor, or implemented by a combination of hardware and software modules in the decoding processor.
  • the software module can be located in a mature storage medium in the field such as random access memory, flash memory, read-only memory, programmable read-only memory or electrically erasable programmable memory, register.
  • the storage medium is located in the memory, and the processor reads the information in the memory, and completes the steps of the above method in combination with its hardware.
  • the memory in the embodiments of the present application may be a volatile memory or a nonvolatile memory, or may include both volatile and nonvolatile memories.
  • the non-volatile memory can be read-only memory (read-only memory, ROM), programmable read-only memory (programmable ROM, PROM), erasable programmable read-only memory (erasable PROM, EPROM), electrically programmable Erases programmable read-only memory (electrically EPROM, EEPROM) or flash memory.
  • Volatile memory can be random access memory (RAM), which acts as external cache memory.
  • RAM random access memory
  • SRAM static random access memory
  • DRAM dynamic random access memory
  • DRAM synchronous dynamic random access memory
  • SDRAM double data rate synchronous dynamic random access memory
  • ESDRAM enhanced synchronous dynamic random access memory
  • SLDRAM direct memory bus random access memory
  • direct rambus RAM direct rambus RAM
  • An embodiment of the present application also provides a data exchange system, and the system includes a first device and a second device.
  • the present application also provides a computer-readable medium, the computer-readable medium stores program code, and when the program code is run on the computer, the computer is made to execute the method of the above-mentioned embodiment .
  • the computer program when executed by a computer, the computer can implement the method executed by the first device or the method executed by the second device in the above method embodiments.
  • the embodiments of the present application also provide a computer program product including instructions, which, when executed by a computer, enable the computer to implement the method executed by the first device or the method executed by the second device in the above method embodiments.
  • all or part of them may be implemented by software, hardware, firmware or any combination thereof.
  • software When implemented using software, it may be implemented in whole or in part in the form of a computer program product.
  • the computer program product includes one or more computer instructions. When the computer instructions are loaded and executed on the computer, the processes or functions according to the embodiments of the present application will be generated in whole or in part.
  • the computer can be a general purpose computer, a special purpose computer, a computer network, or other programmable devices.
  • the computer instructions may be stored in or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from a website, computer, server or data center Transmission to another website site, computer, server or data center by wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.).
  • the computer-readable storage medium may be any available medium that can be accessed by a computer, or a data storage device such as a server or a data center integrated with one or more available media.
  • the available medium may be a magnetic medium (for example, a floppy disk, a hard disk, a magnetic tape), an optical medium (for example, a high-density digital video disc (digital video disc, DVD)), or a semiconductor medium (for example, a solid state disk (solid state disc, SSD)) etc.
  • a magnetic medium for example, a floppy disk, a hard disk, a magnetic tape
  • an optical medium for example, a high-density digital video disc (digital video disc, DVD)
  • a semiconductor medium for example, a solid state disk (solid state disc, SSD)
  • the network equipment and terminal equipment in the above-mentioned various apparatus embodiments correspond to the network equipment and terminal equipment in the method embodiments, and corresponding steps are performed by corresponding modules or units, for example, the communication unit (transceiver) performs the receiving or receiving in the method embodiments.
  • the communication unit transmits the receiving or receiving in the method embodiments.
  • other steps besides sending and receiving may be performed by a processing unit (processor).
  • processors for the functions of the specific units, reference may be made to the corresponding method embodiments. Wherein, there may be one or more processors.
  • a component may be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and/or a computer.
  • an application running on a computing device and the computing device can be components.
  • One or more components can reside within a process and/or thread of execution and a component can be localized on one computer and/or distributed between two or more computers.
  • these components can execute from various computer readable media having various data structures stored thereon.
  • a component may, for example, be based on a signal having one or more packets of data (e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems). Communicate through local and/or remote processes.
  • packets of data e.g., data from two components interacting with another component between a local system, a distributed system, and/or a network, such as the Internet via a signal interacting with other systems.
  • the disclosed systems, devices and methods may be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components can be combined or May be integrated into another system, or some features may be ignored, or not implemented.
  • the mutual coupling or direct coupling or communication connection shown or discussed may be through some interfaces, and the indirect coupling or communication connection of devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or may be distributed to multiple network units. Part or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in each embodiment of the present application may be integrated into one processing unit, each unit may exist separately physically, or two or more units may be integrated into one unit.
  • the functions described above are realized in the form of software function units and sold or used as independent products, they can be stored in a computer-readable storage medium.
  • the technical solution of the present application is essentially or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (Read-Only Memory, ROM), random access memory (Random Access Memory, RAM), magnetic disk or optical disc and other media that can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Computer And Data Communications (AREA)

Abstract

本申请实施例提供了一种报文防重放的方法和装置，该方法包括：第一设备接收互联网安全协议IPsec报文，该IPsec报文包括第一字段(承载第一信息的值)，根据第一映射关系从N个防重放窗口中确定第一防重放窗口，该第一映射关系包括N个防重放窗口与N个第一信息的值集合的对应关系，该第一防重放窗口用于处理该IPsec报文，该N个防重放窗口对应相同的IPsec安全联盟，N为大于或等于2的整数。通过本申请实施例的报文防重放的方法和装置，能够在同一IPsec安全联盟下，使得不同类型的报文在不同的防重放窗口进行处理，避免报文因为乱序触发序列号落在防重放窗口后沿之外而丢包。

Description

报文防重放的方法和装置
本申请要求于2021年11月26日提交中国国家知识产权局、申请号为202111421943.8、申请名称为“报文防重放的方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请实施例涉及通信领域，并且，更具体地，涉及报文防重放的方法和装置。
背景技术
互联网安全协议(internet protocolsecurity，IPsec)是国际互联网工程任务组(the Internet engineering task force，IETF)制定的三层隧道加密协议，它为互联网上传输的数据提供了安全保证。IPsec为通信双方提供了加密与数据源认证等安全服务，其中包括防重放(anti-replay)，即IPSec报文的接收端可检测并拒绝接收过时或重复的报文。
重放是指攻击者截取报文并进行复制后，将复制的报文发送给接收端，在不破解密文(加密后的报文)的前提下对接收端进行拒绝服务(denial ofservice，DoS)攻击，攻击者并不需要知道所重放信息的具体内容。IPSec协议提供的防重放服务，通过单调递增的序列号和“滑动”窗口机制来阻挡这种攻击。
每个IPsec安全联盟(security association，SA)维护独立的防重放窗口(对应上述“滑动”窗口)，在报文传输过程中，高优先级的报文被优先处理，当报文到达接收端时，高优先级报文的封装安全载荷(encapsulate security payload，ESP)/认证头(authentication header，AH)头部序列号(sequence number，SN)可能远大于后续低优先级报文的序列号，此时防重放窗口的前沿被拉动至高优先级的报文序列号处，导致在后续报文传输过程中，低优先级报文的序列号落在防重放窗口的后沿之外，即后续的这些低优先级报文被迫成为过时报文，被接收端拒收，造成丢包问题。
发明内容
本申请实施例提供一种报文防重放的方法和装置，能够在同一IPsec安全联盟下，使得不同类型的报文在不同的防重放窗口进行处理，避免报文因为乱序触发序列号落在防重放窗口后沿之外而丢包。
第一方面，提供了一种报文防重放的方法。该方法可以由第一设备执行，或者，也可以由配置在第一设备中的部件(如芯片或芯片系统等)执行。该方法包括：第一设备接收互联网安全协议IPsec报文，该IPsec报文包括第一字段，该第一字段承载第一信息的值，根据第一映射关系从N个防重放窗口中确定第一防重放窗口，该第一映射关系包括N个防重放窗口与N个第一信息的值集合的对应关系，该第一字段承载的第一信息的值属于该第一防重放窗口对应的第一信息的值集合，该第一防重放窗口用于处理该IPsec报文，该 N个防重放窗口对应相同的IPsec安全联盟，N为大于或等于2的整数。
基于上述方案，IPsec报文的接收端的一个IPsec安全联盟对应多个防重放窗口，从而IPsec报文的接收端可以根据IPsec报文中的第一字段确定该IPsec报文的优先级，并根据优先级选择对应的防重放窗口处理该IPsec报文，实现不同优先级的IPsec报文在不同的防重放窗口内处理，每个防重放窗口处理的报文为相同优先级，因此可以避免因乱序导致的丢包，同时也避免了按照RFC4301标准4.1章节提出的平行IPsec安全联盟方案产生的新增的IPsec安全联盟而引发增大系统资源消耗等成本增加问题。
结合第一方面，在第一方面的某些实现方式中，该第一信息包括差分服务代码点DSCP或者流标签。
结合第一方面，在第一方面的某些实现方式中，根据第一信息生成该N个防重放窗口。
相同IPsec安全联盟情况下，不同IPsec报文(IPsec报文包括ESP报文和AH报文)的DSCP值代表了不同优先级，基于本申请提供的方案，高优先级报文和低优先级报文可以在不同的防重放窗口内处理，可以避免低优先级报文丢包。
相同IPsec安全联盟情况下，不同IPsec报文的流标签值代表了不同的业务，不同的业务可能在传输过程中映射不同的服务质量，基于本申请提供的方案，对应不同服务质量的业务可以在不同的防重放窗口内独立处理，可以避免低优先级报文丢包。
结合第一方面，在第一方面的某些实现方式中，该N个防重放窗口为第一设备本地静态配置的。
结合第一方面，在第一方面的某些实现方式中，该N个防重放窗口为第一设备和第二设备根据第一信息协商生成的，具体包括：发送第一报文，该第一报文包括第一设备期望的第一信息的值集合，接收第二报文，该第二报文包括第二设备基于第一报文进行协商后的第一信息的值集合，根据该第二报文中的第一信息的值集合生成该N个防重放窗口。
结合第一方面，在第一方面的某些实现方式中，该第二报文包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，解析该扩展字段，该扩展字段包括的扩展类型为第一信息的范围，该扩展字段还包括至少一个第一信息的起始值和至少一个第一信息的结束值，该至少一个第一信息的起始值和至少一个第一信息的结束值用于确定M个第一信息的值集合，M为大于或等于1的整数。
结合第一方面，在第一方面的某些实现方式中，第一报文，和/或第二报文为包括流量选择器载荷的因特网密钥交换报文。
结合第一方面，在第一方面的某些实现方式中，流量选择器类型字段包括：流量选择器互联网协议版本IPv6地址范围和扩展的流量选择器IPv6地址范围，或，流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围。
基于上述方案，本申请在现有流量选择器IPv4或IPv6地址范围字段基础上新增了扩展的流量选择器IPv4或IPv6地址范围，可兼容支持协商生成多个防重放窗口的设备和不支持协商生成多个防重放窗口的设备，当支持协商生成多个防重放窗口的设备发送第一报文时，可以在流量选择器载荷中放置相同地址范围的流量选择器IPv4地址范围字段和扩展的流量选择器IPv4地址范围字段，或者在流量选择器载荷中放置相同地址范围的流量选择器IPv6地址范围字段和扩展的流量选择器IPv6地址范围字段。当支持协商生成多个防重放窗口的设备接收到第二报文后，确定第二报文中的流量选择器载荷中的流量选择器 类型字段为相同地址范围的流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围，或者相同地址范围的流量选择器IPv6和扩展的流量选择器IPv6地址范围时，可仅解析扩展的流量选择器IPv4/IPv6地址范围。当不支持协商生成多个防重放窗口的设备接收到第二报文后，不能识别扩展的流量选择器IPv4/IPv6地址范围字段，因此只解析流量选择器IPv4/IPv6地址范围字段。
第二方面，提供了一种报文防重放的方法。该方法可以由第二设备执行，或者，也可以由配置在第二设备中的部件(如芯片或芯片系统等)执行。该方法包括：第二设备发送互联网安全协议IPsec报文，该IPsec报文包括第一字段，该第一字段承载第一信息的值，该第一字段用于从N个防重放窗口中确定第一防重放窗口，该第一字段承载的第一信息的值属于该第一防重放窗口对应的第一信息的值集合，该第一防重放窗口用于处理该IPsec报文，该N个防重放窗口对应相同的IPsec安全联盟，N为大于或等于2的整数。
基于上述方案，IPsec报文的接收端的一个IPsec安全联盟对应多个防重放窗口，从而IPsec报文的接收端可以根据IPsec报文中的第一字段确定该IPsec报文的优先级，并根据优先级选择对应的防重放窗口处理该IPsec报文，实现不同优先级的IPsec报文在不同的防重放窗口内处理，每个防重放窗口处理的报文为相同优先级，因此可以避免因乱序导致的丢包，同时也避免了按照RFC4301标准4.1章节提出的平行IPsec安全联盟方案产生的新增的IPsec安全联盟而引发增大系统资源消耗等成本增加问题。
结合第二方面，在第二方面的某些实现方式中，该第一信息包括差分服务代码点DSCP或者流标签。
相同IPsec安全联盟情况下，不同IPsec报文的DSCP值代表了不同优先级，基于本申请提供的方案，高优先级报文和低优先级报文可以在不同的防重放窗口内处理，可以避免低优先级报文丢包。
相同IPsec安全联盟情况下，不同IPsec报文的流标签值代表了不同的业务，不同的业务可能在传输过程中映射不同的服务质量，基于本申请提供的方案，对应不同服务质量的业务可以在不同的防重放窗口内独立处理，可以避免低优先级报文丢包。
结合第二方面，在第二方面的某些实现方式中，接收第一报文，该第一报文包括第一设备期望的第一信息的值集合，发送第二报文，该第二报文包括第二设备基于第一报文进行协商后的第一信息的值集合，该第二报文中的第一信息的值集合用于生成该N个防重放窗口。
结合第二方面，在第二方面的某些实现方式中，该第一报文包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，解析该扩展字段，该扩展字段包括的扩展类型为第一信息的范围，该扩展字段还包括至少一个第一信息的起始值和至少一个第一信息的结束值。
结合第二方面，在第二方面的某些实现方式中，第一报文，和/或第二报文为包括流量选择器载荷的因特网密钥交换报文。
结合第二方面，在第二方面的某些实现方式中，该流量选择器类型字段包括：流量选择器互联网协议版本IPv6地址范围和扩展的流量选择器IPv6地址范围，或，流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围。
基于上述方案，本申请在现有流量选择器IPv4或IPv6地址范围字段基础上新增了扩 展的流量选择器IPv4或IPv6地址范围，可兼容支持协商生成多个防重放窗口的设备和不支持协商生成多个防重放窗口的设备，当支持协商生成多个防重放窗口的设备接收到第一报文后，确定第一报文中的流量选择器载荷中的流量选择器类型字段为相同地址范围的流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围，或者相同地址范围的流量选择器IPv6地址范围和扩展的流量选择器IPv6地址范围，此时可仅解析扩展的流量选择器IPv4/IPv6地址范围。当不支持协商生成多个防重放窗口的设备接收到第一报文后，不能识别扩展的流量选择器IPv4/IPv6地址范围字段，因此只解析流量选择器IPv4/IPv6地址范围字段。
第三方面，提供了一种报文防重放的装置。该装置可以是第一设备，或者，也可以是配置在第一设备中的部件(如芯片或芯片系统等)。该装置包括：收发单元，用于接收互联网安全协议IPsec报文，该IPsec报文包括第一字段，该第一字段承载第一信息的值，处理单元，用于根据该第一字段从N个防重放窗口中确定第一防重放窗口，该第一映射关系包括N个防重放窗口与N个第一信息的值集合的对应关系，该第一字段承载的第一信息的值属于该第一防重放窗口对应的第一信息的值集合，该第一防重放窗口用于处理该IPsec报文，该N个防重放窗口对应相同的IPsec安全联盟，N为大于或等于2的整数。
基于上述方案，IPsec报文的接收端的一个IPsec安全联盟对应多个防重放窗口，从而IPsec报文的接收端可以根据IPsec报文中的第一字段确定该IPsec报文的优先级，并根据优先级选择对应的防重放窗口处理该IPsec报文，实现不同优先级的IPsec报文在不同的防重放窗口内处理，每个防重放窗口处理的报文为相同优先级，因此可以避免因乱序导致的丢包，同时也避免了按照RFC4301标准4.1章节提出的平行IPsec安全联盟方案产生的新增的IPsec安全联盟而引发增大系统资源消耗等成本增加问题。
结合第三方面，在第三方面的某些实现方式中，该第一信息包括差分服务代码点DSCP或者流标签。
相同IPsec安全联盟情况下，不同IPsec报文的DSCP值代表了不同优先级，基于本申请提供的方案，高优先级报文和低优先级报文可以在不同的防重放窗口内处理，可以避免低优先级报文丢包。
相同IPsec安全联盟情况下，不同IPsec报文的流标签值代表了不同的业务，不同的业务可能在传输过程中映射不同的服务质量，基于本申请提供的方案，对应不同服务质量的业务可以在不同的防重放窗口内独立处理，可以避免低优先级报文丢包。
结合第三方面，在第三方面的某些实现方式中，该处理单元，还用于根据第一信息生成该N个防重放窗口。
结合第三方面，在第三方面的某些实现方式中，该N个防重放窗口为本地静态配置的。
结合第三方面，在第三方面的某些实现方式中，该N个防重放窗口为第一设备和第二设备根据第一信息的值协商生成的，该收发单元，还用于发送第一报文，该第一报文包括第一设备期望的第一信息的值集合，该收发单元，还用于接收第二报文，该第二报文包括第二设备基于第一报文进行协商后的第一信息值集合，该处理单元，还用于根据该第二报文中的第一信息的值集合生成该N个防重放窗口。
结合第三方面，在第三方面的某些实现方式中，该第二报文包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，该处理单元，还用于解析该扩展字 段，该扩展字段包括的扩展类型为第一信息的范围，该扩展字段还包括至少一个第一信息的起始值和至少一个第一信息的结束值，该至少一个DSCP起始值和至少一个第一信息的结束值用于确定M个第一信息的值集合，M为大于或等于1的整数。
结合第三方面，在第三方面的某些实现方式中，第一报文，和/或第二报文为包括流量选择器载荷的因特网密钥交换报文。
结合第三方面，在第三方面的某些实现方式中，流量选择器类型字段包括：流量选择器互联网协议版本IPv6地址范围和扩展的流量选择器IPv6地址范围，或，流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围。
基于上述方案，本申请在现有流量选择器IPv4或IPv6地址范围字段基础上新增了扩展的流量选择器IPv4或IPv6地址范围，可兼容支持协商生成多个防重放窗口的设备和不支持协商生成多个防重放窗口的设备，当支持协商生成多个防重放窗口的设备发送第一报文时，可以在流量选择器载荷中放置相同地址范围的流量选择器IPv4地址范围字段和扩展的流量选择器IPv4地址范围字段，或者在流量选择器载荷中放置相同地址范围的流量选择器IPv6地址范围字段和扩展的流量选择器IPv6地址范围字段。当支持协商生成多个防重放窗口的设备接收到第二报文后，确定第二报文中的流量选择器载荷中的流量选择器类型字段为相同地址范围的流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围，或者相同地址范围的流量选择器IPv6和扩展的流量选择器IPv6地址范围时，可仅解析扩展的流量选择器IPv4/IPv6地址范围。当不支持协商生成多个防重放窗口的设备接收到第二报文后，不能识别扩展的流量选择器IPv4/IPv6地址范围字段，因此只解析流量选择器IPv4/IPv6地址范围字段。
第四方面，提供了一种报文防重放的装置。该装置可以是第二设备，或者，也可以是配置在第二设备中的部件(如芯片或芯片系统等)。该装置包括：收发单元和处理单元，该收发单元用于发送互联网安全协议IPsec报文，该IPsec报文包括第一字段，该第一字段承载第一信息的值，该第一字段用于从N个防重放窗口中确定第一防重放窗口，该第一字段承载的第一信息的值属于该第一防重放窗口对应的第一信息的值集合，该第一防重放窗口用于处理该IPsec报文，该N个防重放窗口对应相同的IPsec安全联盟，N为大于或等于2的整数。
基于上述方案，IPsec报文的接收端的一个IPsec安全联盟对应多个防重放窗口，从而IPsec报文的接收端可以根据IPsec报文中的第一字段确定该IPsec报文的优先级，并根据优先级选择对应的防重放窗口处理该IPsec报文，实现不同优先级的IPsec报文在不同的防重放窗口内处理，每个防重放窗口处理的报文为相同优先级，因此可以避免因乱序导致的丢包，同时也避免了按照RFC4301标准4.1章节提出的平行IPsec安全联盟方案产生的新增的IPsec安全联盟而引发增大系统资源消耗等成本增加问题。
结合第四方面，在第四方面的某些实现方式中，该第一信息包括差分服务代码点DSCP或者流标签。
相同IPsec安全联盟情况下，不同IPsec报文的DSCP值代表了不同优先级，基于本申请提供的方案，高优先级报文和低优先级报文可以在不同的防重放窗口内处理，可以避免低优先级报文丢包。
相同IPsec安全联盟情况下，不同IPsec报文的流标签值代表了不同的业务，不同的 业务可能在传输过程中映射不同的服务质量，基于本申请提供的方案，对应不同服务质量的业务可以在不同的防重放窗口内独立处理，可以避免低优先级报文丢包。
结合第四方面，在第四方面的某些实现方式中，该收发单元，还用于接收第一报文，该第一报文包括第一设备期望的第一信息的值集合，发送第二报文，该第二报文包括第二设备基于第一报文进行协商后的第一信息的值集合，该第二报文中的第一信息的值集合用于生成该N个防重放窗口。
结合第四方面，在第四方面的某些实现方式中，该第一报文包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，该处理单元，用于解析该扩展字段，该扩展字段包括的扩展类型为第一信息的范围，该扩展字段还包括至少一个第一信息的起始值和至少一个第一信息的结束值。
结合第四方面，在第四方面的某些实现方式中，第一报文，和/或第二报文为包括流量选择器载荷的因特网密钥交换报文。
结合第四方面，在第四方面的某些实现方式中，该流量选择器类型字段包括：流量选择器互联网协议版本IPv6地址范围和扩展的流量选择器IPv6地址范围，或，流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围。
基于上述方案，本申请在现有流量选择器IPv4或IPv6地址范围字段基础上新增了扩展的流量选择器IPv4或IPv6地址范围，可兼容支持协商生成多个防重放窗口的设备和不支持协商生成多个防重放窗口的设备，当支持协商生成多个防重放窗口的设备接收到第一报文后，确定第一报文中的流量选择器载荷中的流量选择器类型字段为相同地址范围的流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围，或者相同地址范围的流量选择器IPv6地址范围和扩展的流量选择器IPv6地址范围，此时可仅解析扩展的流量选择器IPv4/IPv6地址范围。当不支持协商生成多个防重放窗口的设备接收到第一报文后，不能识别扩展的流量选择器IPv4/IPv6地址范围字段，因此只解析流量选择器IPv4/IPv6地址范围字段。
第五方面，提供一种通信装置，该装置包括处理器，该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第一方面或，第一方面中任一种可能实现方式中的方法。可选地，该装置还包括存储器，该存储器与处理器可能是分离部署的，也可能是集中部署的。可选地，该装置还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该装置为第一设备中的部件，该装置为芯片时，该通信接口可以是该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。该处理器也可以体现为处理电路或逻辑电路。
可选地，该收发器可以为收发电路。可选地，所述输入/输出接口可以为输入/输出电路。
在具体实现过程中，上述处理器可以为一个或多个芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是但不限于接收器接收并输入的，输出电路所输出的信号可以是但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请实施例对处理器及各种电 路的具体实现方式不做限定。
第六方面，提供一种通信装置，该装置包括处理器，该处理器与存储器耦合，可用于执行存储器中的指令，以实现上述第二方面，或第二方面中任一种可能实现方式中的方法。可选地，该装置还包括存储器，该存储器与处理器可能是分离部署的，也可能是集中部署的。可选地，该装置还包括通信接口，处理器与通信接口耦合。
在一种实现方式中，该通信接口可以是收发器，或，输入/输出接口。
在另一种实现方式中，该装置为第二设备中的部件，该装置为芯片时，该通信接口可以是该芯片或芯片系统上的输入/输出接口、接口电路、输出电路、输入电路、管脚或相关电路等。该处理器也可以体现为处理电路或逻辑电路。
可选地，该收发器可以为收发电路。可选地，所述输入/输出接口可以为输入/输出电路。
在具体实现过程中，上述处理器可以为一个或多个芯片，输入电路可以为输入管脚，输出电路可以为输出管脚，处理电路可以为晶体管、门电路、触发器和各种逻辑电路等。输入电路所接收的输入的信号可以是但不限于接收器接收并输入的，输出电路所输出的信号可以是但不限于输出给发射器并由发射器发射的，且输入电路和输出电路可以是同一电路，该电路在不同的时刻分别用作输入电路和输出电路。本申请实施例对处理器及各种电路的具体实现方式不做限定。
第七方面，提供一种通信装置，该装置包括逻辑电路，该逻辑电路用于与输入/输出接口耦合，通过该输入/输出接口传输数据，以执行上述第一方面至第二方面中的任一方面，以及第一方面至第二方面中任一种可能实现方式中的方法。
第八方面，提供了一种计算机可读存储介质，该计算机可读存储介质存储有计算机程序(也可以称为代码，或指令)当其在计算机上运行时，使得计算机执行上述第一方面至第二方面中的任一方面，以及第一方面至第二方面中任一种可能实现方式中的方法。
第九方面，提供了一种计算机程序产品，该计算机程序产品包括：计算机程序(也可以称为代码，或指令)，当该计算机程序被运行时，使得计算机执行上述第一方面至第二方面中的任一方面，以及第一方面至第二方面中任一种可能实现方式中的方法。
上述第五方面至第九方面带来的有益效果具体可以参考第一方面至第二方面中有益效果的描述，此处不再赘述。
附图说明
图1是适用于本申请实施例的通信系统100的示意图。
图2是本申请实施例提供的一种报文防重放的方法的流程示意图。
图3是本申请实施例提供的一种协商多个防重放窗口的流程示意图。
图4是本申请实施例提供的流量选择器载荷的格式示意图。
图5是本申请实施例提供的另一种协商多个防重放窗口的流程示意图。
图6是本申请实施例提供的一种通信装置的示意性框图。
图7是本申请实施例提供的另一种通信装置的示意性框图。
图8是本申请实施例提供的一种通信装置的结构示意图。
图9是本申请实施例提供的另一种处通信装置的结构示意图。
图10是本申请实施例提供的又一种通信装置的结构示意图。
具体实施方式
下面将结合附图，对本申请实施例中的技术方案进行描述。
图1是适用于本申请实施例的通信系统100的示意图。
如图1所示，该通信系统100可以包括第一设备，例如，图1所示的第一设备110或120。该通信系统100还可以包括第二设备，例如，图1所示的第二设备130。第一设备与第二设备之间，第一设备与第一设备之间可以建立连接进行通信，发送数据报文。例如，第一设备120与第二设备130之间传输数据报文，或第一设备110与第二设备130之间传输数据报文时，该数据报文需进行IPsec加密。第一设备和第二设备可以是支持因特网密钥交换(internet key exchange，IKE或IKEv2)/IPsec的任何终端、基站、主机、交换机、路由器、安全网关等节点。本申请实施例提供的方法可应用于第一设备和第二设备之间的数据报文传输，但本申请对此不做限制，任何在传输数据报文的过程中涉及IPsec加密的发送端或者接收端都在本申请保护范围内。
本申请实施例的技术方案可以应用于各种通信系统，例如：全球移动通信(global system formobile communications，GSM)系统、码分多址(code division multiple access，CDMA)系统、宽带码分多址(wideband code division multiple access，WCDMA)系统、通用分组无线业务(general packet radio service，GPRS)、LTE系统、LTE频分双工(frequency division duplex，FDD)系统、LTE时分双工(time division duplex，TDD)、通用移动通信系统(universal mobile telecommunication system，UMTS)、全球互联微波接入(worldwide interoperability for microwave access，WiMAX)通信系统、第五代(5th generation，5G)系统或未来演进的通信系统，车到其它设备(vehicle-to-X V2X)，其中V2X可以包括车到互联网(vehicle to network，V2N)、车到车(vehicle to vehicle，V2V)、车到基础设施(vehicle to infrastructure，V2I)、车到行人(vehicle to pedestrian，V2P)等、车间通信长期演进技术(long term evolution-vehicle，LTE-V)、车联网、机器类通信(machine type communication，MTC)、物联网(Internet of things，IoT)、机器间通信长期演进技术(long term evolution-machine，LTE-M)，机器到机器(machine to machine，M2M)，设备到设备(deviceto device，D2D)等。
本申请实施例中基站包括但不限于：演进型节点B(evolved Node B，eNB)、无线网络控制器(radio network controller，RNC)、节点B(node B，NB)、基站控制器(base station controller，BSC)、基站收发台(base transceiver station，BTS)、家庭基站(例如，home evolved nodeB，或Home Node B，HNB)、基带单元(base band unit，BBU)，无线保真(wireless fidelity，WIFI)系统中的接入点(access point，AP)、无线中继节点、无线回传节点、传输点(transmission point，TP)或者发送接收点(transmission and reception point，TRP)等，还可以为5G，如，NR，系统中的gNB，或，传输点(TRP或TP)，5G系统中的基站的一个或一组(包括多个天线面板)天线面板，或者，还可以为构成gNB或传输点的网络节点，如基带单元(BBU)，或，分布式单元(distributed unit，DU)等。
在一些部署中，gNB可以包括集中式单元(centralized unit，CU)和DU。gNB还可以包括有源天线单元(active antenna unit，简称AAU)。CU实现gNB的部分功能，DU 实现gNB的部分功能。比如，CU负责处理非实时协议和服务，实现无线资源控制(radio resource control，RRC)，分组数据汇聚层协议(packet data convergence protocol，PDCP)层的功能。DU负责处理物理层协议和实时服务，实现无线链路控制(radio link control，RLC)层、媒体接入控制(media access control，MAC)层和物理(physical，PHY)层的功能。AAU实现部分物理层处理功能、射频处理及有源天线的相关功能。由于RRC层的信息最终会变成PHY层的信息，或者，由PHY层的信息转变而来，因而，在这种架构下，高层信令，如RRC层信令，也可以认为是由DU发送的，或者，由DU+AAU发送的。可以理解的是，网络设备可以为包括CU节点、DU节点、AAU节点中一项或多项的设备。此外，可以将CU划分为接入网(radio access network，RAN)中的网络设备，也可以将CU划分为核心网(core network，CN)中的网络设备，本申请对此不做限定。
IPsec主要由以下协议组成：
一、认证头(AH)，为IP数据报文提供无连接数据完整性、消息认证以及防重放攻击保护；
二、封装安全载荷(ESP)，提供机密性、数据源认证、无连接完整性、防重放和有限的传输流(traffic-flow)机密性；
三、IPsec安全联盟(SA)，提供算法和数据包，提供AH、ESP操作所需的参数。
因特网密钥交换(internet key exchange，IKE或IKEv2)是一种网上协议，归属于IPsec协议族之下，用以创建IPsec安全联盟。
在一种实施方式中，IPSec报文的发送端，在每个IPSec报文(IPSec报文包括ESP报文和AH报文)头部包括一个序列号字段，当创建一个新的IPSec安全联盟时，序列号计数器便会初始化为0，每当在这一IPSec安全联盟上发送一个数据报文，序列号计数器的值加1并将序列号字段的值设置成计数器的值。计数器的值单调递增，当计数器的值接近2 32时，应建立一个新的IPSec安全联盟，此时序列号的长度是32位。或者，使用扩展的序列(extended sequence)时，序列号的长度也可以是64位，当序列号的长度为64位时，计数器的值接近2 64时应建立一个新的IPSec安全联盟，应理解，未来序列号的长度还可以是128或256位，本申请对此不做限制。
在IPSec报文的接收端建立防重放窗口，防重放窗口的宽度为W，假设W为64，则表示防重放窗口的宽度是64个连续的报文。窗口前沿对应于窗口起始位置IPSec报文的序列号P，而窗口后沿对应于可接收的IPSec报文的最低序列号P-W+1。每收到一个IPSec报文，接收端按如下原则进行处理：
1、如果收到的IPSec报文的序列号落在防重放窗口之内，并且先前没有接收过，则接收该报文并标记该报文为已接收；若先前接收过，则该报文是重放报文，丢弃该报文。
2、如果收到的IPSec报文的序列号落在防重放窗口的后沿之外，即序列号小于P-W+1，说明该报文是过期报文，则丢弃该报文。
3、如果收到的IPSec报文的序列号落在防重放窗口的前沿之外，即序列号大于P，则向前移动防重放窗口，使防重放窗口的前沿刚好包含该报文的序列号。
在基站的安全回传场景中，即基站与服务网关(serving gateway，S-GW)之间传输数据报文时，S1数据平面链路映射一个IPSec安全联盟，一个IPSec安全联盟维护一个防重放窗口。S1数据平面链路中，GTPECHOREQUEST报文和GTP ECHO REPLY报文是高 优先级报文，大流量的普通数据报文是低优先级报文，当GTP ECHO报文因为高优先级而提前到达基站，且序列号远高于后续的普通数据报文，则会将防重放窗口向前沿方向拉动至GTP ECHO报文序列号处，使得普通数据对应的IPsec报文落在防重放窗口的后沿之外，成为过时报文，被接收端丢弃。
鉴于上述问题，一种可能的实施方式，可以在接收端关闭防重放特性，牺牲安全等级来保障业务。但是防重放是IPsec的基本安全特性，如果关闭了防重放特性，系统将无法抵抗重放攻击，安全问题无法解决。
另一种可能的实施方式，发送端和接收端之间维护多个IPsec安全联盟，该方案在RFC4301标准4.1章节描述，即针对相同的流量选择器(traffic selector，TS)，基于差分服务代码点(differentiated services code point，DSCP)产生多条IPsec安全联盟，每条IPsec安全联盟维护一个防重放窗口且针对一个/一段DSCP值，在解决安全问题的同时，增加了系统的消耗。
鉴于此，本申请实施例提供一种报文防重放的方法和装置，能够在同一IPsec安全联盟下，使得不同优先级的报文在不同的防重放窗口内独立处理，避免报文因乱序触发序列号落在防重放窗口后沿之外而丢包，相较于维护多个IPsec安全联盟的方案而言，本申请实施例提供的方案能够节约成本。
图2是本申请实施例提供的一种报文防重放的方法的流程示意图。图2所示的方法200包括：
步骤S210，第二设备向第一设备发送IPsec报文，该IPsec报文包括第一字段，该第一字段承载第一信息的值。对应的，第一设备接收该IPsec报文。
可选地，第一字段包括DSCP字段或者流标签字段，即第一信息为DSCP或流标签。
示例地，对于互联网协议版本6(internet protocolversion 6，IPv6)报文而言，该报文的IP头中包括流标签(flowlabel，FL)字段和DSCP字段，对于IPv4报文而言，该报文的IP头中只包括DSCP字段。
步骤S220，第一设备根据第一映射关系从N个防重放窗口中确定第一防重放窗口，该第一映射关系包括N个防重放窗口与N个第一信息的值集合的对应关系，该第一字段承载的第一信息的值属于该第一防重放窗口对应的第一信息的值集合，该第一防重放窗口用于处理该IPsec报文，该N个防重放窗口对应相同的IPsec安全联盟，N为大于或等于2的整数。
第一设备端，一个IPsec安全联盟对应多个防重放窗口，且多个防重放窗口与多个第一信息的值集合之间存在第一映射关系，第一映射关系可以是一个防重放窗口对应一个第一信息的值集合，或者一个防重放窗口对应多个第一信息的值集合，或者多个防重放窗口对应一个第一信息的值集合。
示例地，不同的防重放窗口可对应不同的DSCP值或流标签值，第一设备可根据IPsec报文的IP头中的DSCP值或流标签值从多个防重放窗口中确定，与该DSCP值或流标签值对应的防重放窗口处理该IPsec报文。
示例地，第一设备端，一个IPsec安全联盟对应3个防重放窗口，分别是对应于DSCP值集合为[32，47]，[48，48]，和其他值的防重放窗口#1，防重放窗口#2，防重放窗口#3，其中，防重放窗口#1处理IP头中的DSCP值为32-47的报文，防重放窗口#2处理IP头中 的DSCP值为48的报文，防重放窗口#3处理IP头中的DSCP值为32-48之外的其他值的报文。
应理解，本申请的值集合可以是连续的值区间，例如值集合[32，47]，也可以是不连续的值的集合，例如值集合为32-48之外的其他值，本申请对此不做限制。
假设第一设备接收到IPv4报文，该报文的IP头中的DSCP值为48，则在防重放窗口#2中处理该IPv4报文。假设第一设备接收到IPv4报文，该报文的IP头中的DSCP值为50，则在防重放窗口#3中处理该IPv4报文。
应理解，每建立一个新的IPsec安全联盟，序列号计数器便会初始化为0，每当在这一IPsec安全联盟上发送一个数据报文，序列号计数器的值加1并将序列号字段的值设置成计数器的值。计数器的值单调递增，当接近最大值时，应建立一个新的IPsec安全联盟，也就是触发更新密钥(rekey)。上述举例是计数器的值接近最大值时，触发rekey流程，当然，还可通过其他方式触发rekey流程，例如从建立一个新的IPsec安全联盟开始，开启计时器，当计时器接近协商时间后，触发rekey流程。当触发rekey流程后，序列号计数器初始化为0，每发一个报文，序列号计数器的值加1，IPsec安全联盟上发送的第一个报文的序列号是1。应理解，在此过程中，防重放窗口也会重置，因在处理报文的过程中，N个防重放窗口会随着处理进程滑动，因此触发rekey流程后需要将N个防重放窗口重置。
可选地，第一设备在收到IPsec报文前，根据DSCP值或流标签值生成N个防重放窗口。
应理解，第一设备还可以根据其他用于表示优先级的值生成N个防重放窗口，本申请对此不做限制。
一种可能的实施方式，第一设备在本地静态配置N个防重放窗口。
应理解，本地手动静态配置(静态配置是指不通过与第二设备协商，可以直接在本地配置)N个防重放窗口时，可任意配置同一个IPsec安全联盟对应的防重放窗口与DSCP值(或流标签值)的对应关系，以DSCP值举例，第一设备在本地静态配置3个防重放窗口，防重放窗口#1对应的DSCP值为[46]，防重放窗口#2对应的DSCP值为[48]，防重放窗口#3对应的DSCP值为除46和48之外的其他值。
一种可能的实施方式，第一设备与第二设备协商生成N个防重放窗口。
图3是本申请实施例提供的一种通过DSCP值协商多个防重放窗口的流程示意图。图3示出的方法300包括：
步骤S310，第一设备向第二设备发送第一报文，该第一报文包括第一设备期望的第一信息的值集合，第一信息为DSCP。对应的，第二设备接收该第一报文。
可选地，第一报文包括流量选择器载荷，流量选择器载荷包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，第二设备解析扩展字段，扩展字段包括的扩展类型为DSCP范围，该扩展字段还包括至少一个DSCP起始值和至少一个DSCP结束值。
可选地，第一报文包括第一设备期望的DSCP值集合信息。
应理解，流量选择器载荷包括1个或多个个体(individual)流量选择器载荷，个体流量选择器载荷的格式如图4所示，现有定义的流量选择器类型(TS Type)字段：流量选择器IPv4地址范围(TS_IPV4_ADDR_RANGE)取值为7，流量选择器IPv6地址范围 (TS_IPV6_ADDR_RANGE)取值为8。
本申请对流量选择器类型字段进行扩展，例如，流量选择器类型字段扩展为：扩展的流量选择器IPv4地址范围(TS_EXT_IPV4_ADDR_RANGE)取值为X，现有协议中定义了流量选择器类型字段值0-9(其中0-6保留值，7-9为已定义)，因此，X可以取10-255中任意值。
当流量选择器类型字段取值为预定值，即流量选择器类型字段取值为X时，第二设备解析扩展字段，如图4所示，扩展字段包括扩展类型(extension type)，扩展长度(extension length)，起始值(start value)，结束值(end value)。其中扩展类型可以是DSCP范围，扩展长度为DSCP长度，起始值为DSCP起始值，结束值为DSCP结束值。
示例地，扩展类型的长度为1个字节，取值范围为0-255，表示扩展类型有256种，其中一种扩展类型可以为INDEP_ANTIREPLAY_DSCP_RANGE，扩展类型可以取0-255中的任意值，本申请对此不做限制；扩展长度的长度为1个字节，取值范围为0-255；起始值的长度和取值范围不等，根据扩展类型而定，例如扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE时，长度为1个字节，取值范围为0-63，高位2比特固定为全0；结束值的长度和取值范围不等，根据扩展类型而定，例如扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE时，长度为1个字节，取值范围为0-63，高位2比特为全0，并且结束值应当大于或等于起始值。
应理解，上述流量选择器类型扩展字段的名称，以及扩展类型字段的名称仅为示例，本申请对此不做限制。
步骤S320，第二设备向第一设备发送第二报文，该第二报文包括第二设备基于第一报文进行协商后的DSCP值集合。对应的，第一设备接收该第二报文。
示例地，第一报文包括第一设备期望的DSCP值集合信息，第二报文包括第二设备基于第一报文中的DSCP值集合信息进行协商后的DSCP值集合。
可选地，第二报文包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，第一设备解析扩展字段，扩展字段包括的扩展类型为DSCP范围，扩展字段还包括至少一个DSCP起始值和至少一个DSCP结束值，所述至少一个DSCP起始值和至少一个DSCP结束值用于确定M个DSCP值集合，M为大于或等于1的整数。
示例地，扩展字段中的DSCP起始值和DSCP结束值可以确定2个DSCP值集合，第一设备可根据该2个DSCP值集合生成3个防重放窗口，或者生成2个防重放窗口，或者生成1个防重放窗口，也就是说上述M可以小于，或等于，或大于N，本申请对此不做限制。
应理解，预定值同步骤S310中所述，在此不做赘述。
步骤S330，第一设备根据第二报文中的DSCP值集合生成N个防重放窗口。
可选地，第一报文，和/或第二报文为包括流量选择器载荷的因特网密钥交换(internet key exchange，IKE)报文。
示例地，第一报文，和/或第二报文为IKE_AUTH或CREATE_CHILD_SA报文。
应理解，第一报文，和/或第二报文还可以是其他包括流量选择器载荷的报文，本申请对此不做任何限制。
可选地，流量选择器类型字段包括：流量选择器IPv4地址范围和扩展的流量选择器 IPv4地址范围，或流量选择器IPv6地址范围和扩展的流量选择器IPv6地址范围。
当第一/二报文中的流量选择器类型字段同时包括流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围时，或同时包括流量选择器IPv6地址范围和扩展的流量选择器IPv6地址范围时，可兼容支持协商生成多个防重放窗口的设备和不支持协商生成多个防重放窗口的设备，当支持协商生成多个防重放窗口的设备接收到第一/二报文后，确定第一/二报文中的流量选择器载荷中的流量选择器类型字段为相同地址范围的流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围，或者相同地址范围的流量选择器IPv6和扩展的流量选择器IPv6地址范围时，可仅解析扩展的流量选择器IPv4/IPv6地址范围。当不支持协商生成多个防重放窗口的设备接收到第一/二报文后，不能识别扩展的流量选择器IPv4/IPv6地址范围字段，因此只解析流量选择器IPv4/IPv6地址范围字段。
图5是本申请实施例提供的一种通过流标签值协商多个防重放窗口的流程示意图。图5示出的方法400包括：
步骤S410，第一设备向第二设备发送第三报文，该第三报文包括第一设备期望的第一信息的值集合，第一信息为流标签。对应的，第二设备接收该第三报文。
可选地，第三报文包括第一设备期望的流标签值集合信息。
可选地，第三报文包括流量选择器载荷，流量选择器载荷包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，第二设备解析扩展字段，扩展字段包括的扩展类型为流标签范围，该扩展字段还包括至少一个流标签起始值和至少一个流标签结束值。
应理解，流量选择器载荷包括1个或多个个体(individual)流量选择器载荷，个体流量选择器载荷的格式与图4类似，现有定义的流量选择器类型(TS Type)字段：流量选择器IPv4地址范围(TS_IPV4_ADDR_RANGE)取值为7，流量选择器IPv6地址范围(TS_IPV6_ADDR_RANGE)取值为8。
本申请对流量选择器类型字段进行扩展，例如，流量选择器类型字段扩展为：扩展的流量选择器IPv6地址范围(TS_EXT_IPV6_ADDR_RANGE)取值为Y，现有协议中定义了流量选择器类型字段值0-9(其中0-6保留值，7-9为已定义)，因此，Y可以取10-255中任意值，且Y和上述X取不同值。
当流量选择器类型字段取值为预定值，即流量选择器类型字段取值为Y时，第二设备解析扩展字段，与图4类似，扩展字段包括扩展类型(extension type)，扩展长度(extension length)，起始值(start value)，结束值(end value)。其中扩展类型可以是流标签范围，扩展长度为流标签长度，起始值为流标签起始值，结束值为流标签结束值。
示例地，扩展类型的长度为1个字节，取值范围为0-255，表示扩展类型有256种，其中一种扩展类型可以为INDEP_ANTIREPLAY_FLOWLABEL_RANGE，扩展类型可以取0-255中的任意值，本申请对此不做限制；扩展长度的长度为1个字节，取值范围为0-255；起始值的长度和取值范围不等，根据扩展类型而定，例如扩展类型为INDEPENDENT_ANTIREPLAY_FLOWLABEL_RANGE时，长度为2.5个字节，取值范围为0-(2 20-1)；结束值的长度和取值范围不等，根据扩展类型而定，例如扩展类型为INDEPENDENT_ANTIREPLAY_FLOWLABEL_RANGE时，长度为2.5个字节，取值范围为0-(2 20-1)，并且结束值应当大于或等于起始值。
应注意，图4示例的是基于DSCP协商的报文中的个体流量选择器载荷的格式，对于基于流标签协商的报文而言，其中个体流量选择器载荷的格式与图4类似，但起始值和结束值所占字节为2.5，与图4不同。
应理解，上述流量选择器类型扩展字段的名称，以及扩展类型字段的名称仅为示例，本申请对此不做限制。
步骤S420，第二设备向第一设备发送第四报文，该第四报文包括第二设备基于第三报文进行协商后的确定流标签值集合。对应的，第一设备接收该第四报文。
示例地，第三报文包括第一设备期望的流标签值集合信息，第二报文包括第二设备基于第三报文中的流标签值集合信息进行协商后的流标签值集合。
可选地，第四报文包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，第一设备解析扩展字段，该扩展字段包括的扩展类型为流标签范围，该扩展字段还包括至少一个流标签起始值和至少一个流标签结束值，所述至少一个流标签起始值和至少一个流标签结束值用于确定M个流标签值集合，M为大于或等于1的整数。
示例地，扩展字段中的流标签起始值和流标签结束值可以确定2个流标签值集合，第一设备可根据该2个流标签值集合生成3个防重放窗口，或者生成2个防重放窗口，或者生成1个防重放窗口，也就是说上述M可以小于，或等于，或大于N，本申请对此不做限制。
应理解，预定值同步骤S410中所述，在此不做赘述。
步骤S430，第一设备根据第四报文中的流标签值集合生成N个防重放窗口。
可选地，第三报文，和/或第四报文为包括流量选择器载荷的IKE报文。
示例地，第三报文，和/或第四报文为IKE_AUTH或CREATE_CHILD_SA报文。
应理解，第三报文，和/或第四报文还可以是其他包括流量选择器载荷的报文，本申请对此不做任何限制。
可选地，流量选择器类型字段包括：流量选择器IPv6地址范围和扩展的流量选择器IPv6地址范围。
当第三/四报文中的流量选择器类型字段同时包括流量选择器IPv6地址范围和扩展的流量选择器IPv6地址范围时，可兼容支持协商生成多个防重放窗口的设备和不支持协商生成多个防重放窗口的设备，当支持协商生成多个防重放窗口的设备接收到第三/四报文后，确定第三/四报文中的流量选择器载荷中的流量选择器类型字段为相同地址范围的流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围，或者相同地址范围的流量选择器IPv6和扩展的流量选择器IPv6地址范围时，可仅解析扩展的流量选择器IPv4/IPv6地址范围。当不支持协商生成多个防重放窗口的设备接收到第三/四报文后，不能识别扩展的流量选择器IPv4/IPv6地址范围字段，因此只解析流量选择器IPv4/IPv6地址范围字段。
下面通过具体场景的示例介绍如何通过DSCP协商确定多个防重放窗口。
场景1：第一设备端配置为允许基于DSCP生成多个防重放窗口，且第一设备端配置了多个DSCP值，第二设备端配置为允许基于DSCP生成多个防重放窗口，且第二设备端配置的DSCP值为ANY(即DSCP值为0-63中的任意值)。
IKE消息交互过程和防重放窗口生成过程如下：
第一设备向第二设备发送的第一报文中携带的流量选择器载荷中包括扩展字段，其中， 流量选择器类型为TS_EXT_IPV6_ADDR_RANGE(在流量选择器载荷示例中以EXT_IPV6表示，后文出现的流量选择器载荷示例的也是以EXT_IPV6表示，不再赘述)，流量选择器长度为56，扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE(在流量选择器载荷示例中以DSCP_RANGE表示，后文出现的流量选择器载荷示例的也是以DSCP_RANGE表示，不再赘述)，扩展长度为8，DSCP区间为[32，47]和[48，63]。
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝EXT_IPv6、TS_Len＝56、Str_Addr＝1::0、End Addr＝1::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝47
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝48、End Val＝63
TSr载荷：
TS_Type＝EXT_IPv6、TS_Len＝56、Str_Addr＝2::0、End Addr＝2::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝47
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝48、End Val＝63
应理解，在IKE报文交互过程中，先发起报文的一端叫做initiator，响应端叫做responder，因此initiator发出的流量选择器叫做TSi(traffic selector–initiator)，responder发出的流量选择器叫做TSr(traffic selector–responder)。
第二设备响应的第二报文中携带的流量选择器载荷中包括扩展字段，其中，流量选择器类型为TS_IPV6_ADDR_RANGE，流量选择器长度为56，扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE，扩展长度为8，DSCP区间为[32，47]和[48，63]
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝EXT_IPv6、TS_Len＝56、Str_Addr＝1::0、End Addr＝1::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝47
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝48、End Val＝63
TSr载荷：
TS_Type＝EXT_IPv6、TS_Len＝56、Str_Addr＝2::0、End Addr＝2::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝47
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝48、End Val＝63
通过第一报文和第二报文后，第一设备和第二设备协商的DSCP区间为[32，47]，[48，63]和其他，则第一设备和第二设备可根据上述区间生成3个防重放窗口，例如防重放窗口#1对应的DSCP值为32-47，防重放窗口#2对应的DSCP值为48-63，防重放窗口#3对应的DSCP值为除[32，47]和[48，63]之外的其他值。
至此，IPsec安全联盟协商完毕，该安全联盟的IPsec报文在接收方向被该IPsec报文中的DSCP值对应的防重放窗口处理。
场景2：第一设备端配置为允许基于DSCP生成多个防重放窗口，且第一设备端配置的DSCP值为ANY(即DSCP值为0-63中的任意值)，第二设备配置为允许基于DSCP生成多个防重放窗口，且第二设备端配置了多个DSCP值。
IKE消息交互过程和防重放窗口生成过程如下：
第一设备向第二设备发送的第一报文中携带的流量选择器载荷中包括扩展字段，其中，流量选择器类型为TS_EXT_IPV6_ADDR_RANGE，流量选择器长度为48，扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE，扩展长度为8，DSCP区间为[0，63]。
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝EXT_IPv6、TS_Len＝48、Str_Addr＝::、End Addr＝FFFF::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝0、End Val＝255
TSr载荷：
TS_Type＝EXT_IPv6、TS_Len＝48、Str_Addr＝::、End Addr＝FFFF::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝0、End Val＝255
第二设备响应的第二报文中携带的流量选择器载荷中包括扩展字段，其中，流量选择器类型为TS_IPV6_ADDR_RANGE，流量选择器长度为56，扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE，扩展长度为8，DSCP区间为[32，47]和[48，63]
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝EXT_IPv6、TS_Len＝56、Str_Addr＝1::0、End Addr＝1::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝47
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝48、End Val＝63
TSr载荷：
TS_Type＝EXT_IPv6、TS_Len＝56、Str_Addr＝2::0、End Addr＝2::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝47
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝48、End Val＝63
通过第一报文和第二报文后，第一设备和第二设备协商的DSCP区间为[32，47]，[48，63]和其他，则第一设备和第二设备可根据上述区间生成3个防重放窗口，例如防重放窗口#1对应的DSCP值为32-47，防重放窗口#2对应的DSCP值为48-63，防重放窗口#3对应的DSCP值为除[32，47]和[48，63]之外的其他值。
至此，IPsec安全联盟协商完毕，该安全联盟的IPsec报文在接收方向被该IPsec报文中的DSCP值对应的防重放窗口处理。
场景3：第一设备端配置为允许基于DSCP生成多个防重放窗口，且第一设备端配置了多个DSCP值，第二设备配置为允许基于DSCP生成多个防重放窗口，且第二设备端也配置了多个DSCP值。
IKE消息交互过程和防重放窗口生成过程如下：
第一设备向第二设备发送的第一报文中携带的流量选择器载荷中包括扩展字段，其中，流量选择器类型为TS_EXT_IPV6_ADDR_RANGE，流量选择器长度为48，扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE，扩展长度为8，DSCP区间为[32，63]。
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝EXT_IPv6、TS_Len＝48、Str_Addr＝1::0、End Addr＝1::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝63
TSr载荷：
TS_Type＝EXT_IPv6、TS_Len＝48、Str_Addr＝2::0、End Addr＝2::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝63
第二设备响应的第二报文中携带的流量选择器载荷中包括扩展字段，其中，流量选择器类型为TS_IPV6_ADDR_RANGE，流量选择器长度为56，扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE，扩展长度为8，DSCP区间为[46，46]和[48，48]
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝EXT_IPv6、TS_Len＝56、Str_Addr＝1::0、End Addr＝1::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝46、End Val＝46
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝48、End Val＝48
TSr载荷：
TS_Type＝EXT_IPv6、TS_Len＝56、Str_Addr＝2::0、End Addr＝2::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝46、End Val＝46
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝48、End Val＝48
通过第一报文和第二报文后，第一设备和第二设备协商的DSCP区间为[46，46]，[48，48]和其他，则第一设备和第二设备可根据上述区间生成3个防重放窗口，例如防重放窗口#1对应的DSCP值为46，防重放窗口#2对应的DSCP值为48，防重放窗口#3对应的DSCP值为除46和48之外的其他值。
至此，IPsec安全联盟协商完毕，该安全联盟的IPsec报文在接收方向被该IPsec报文中的DSCP值对应的防重放窗口处理。
场景4：第一设备端配置为允许基于DSCP生成多个防重放窗口，第二设备配置为不允许基于DSCP生成多个防重放窗口。
第二设备配置为不允许基于DSCP生成多个防重放窗口可以理解为第二设备支持基于DSCP生成多个防重放窗口(第二设备能识别扩展的流量选择器字段)，但第二设备被配置为不允许基于DSCP生成多个防重放窗口(第二设备响应的第二报文中包括流量选择器字段，而不是扩展的流量选择器字段)。
IKE消息交互过程和防重放窗口生成过程如下：
第一设备向第二设备发送的第一报文中携带的流量选择器载荷中包括扩展字段，其中，流量选择器类型为TS_EXT_IPV6_ADDR_RANGE，流量选择器长度为48，扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE，扩展长度为8，DSCP区间为[32，63]。
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝EXT_IPv6、TS_Len＝48、Str_Addr＝1::0、End Addr＝1::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝63
TSr载荷：
TS_Type＝EXT_IPv6、TS_Len＝48、Str_Addr＝2::0、End Addr＝2::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝63
第二设备响应的第二报文中携带的流量选择器载荷中不包括扩展字段，因第二设备能 识别扩展流量选择器，但是由于配置为不允许基于DSCP生成多个防重放窗口，因此响应的第二报文中包括非扩展流量选择器。
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝IPv6、TS_Len＝40、Str_Addr＝1::0、End Addr＝1::FFFF、
TSr载荷：
TS_Type＝IPv6、TS_Len＝40、Str_Addr＝2::0、End Addr＝2::FFFF、
通过第一报文和第二报文后，第一设备和第二设备没有协商出DSCP区间，则第一设备和第二设备生成1个默认防重放窗口。
至此，IPsec安全联盟协商完毕，该安全联盟的IPsec报文在接收方向被默认的防重放窗口处理。
场景5：第一设备端配置为允许基于DSCP生成多个防重放窗口，第二设备配置为不支持基于DSCP生成多个防重放窗口
场景5是一个兼容场景，第一设备配置为允许基于DSCP生成多个防重放窗口，但是第一设备并不知道第二设备是否支持基于DSCP生成多个防重放窗口，因此发送的流量选择器里包括2组，1组是非扩展的流量选择器，1组是扩展的流量选择器，2组的地址范围相同。
第一种情况：当第二设备支持基于DSCP生成多个防重放窗口时，第二设备能识别扩展的流量选择器，由于2组流量选择器的地址范围相同，第二设备仅处理扩展的流量选择器。
第二种情况：当第二设备不支持基于DSCP生成多个防重放窗口时，第二设备无法识别扩展的流量选择器，因此仅处理非扩展的流量选择器即可，在此过程中也能保证协商成功。
因此兼容场景5描述了支持本申请的设备(可识别扩展的流量选择器)和不支持本申请的设备的向下兼容，避免基本协商失败。
IKE消息交互过程和防重放窗口生成过程如下：
第一设备向第二设备发送的第一报文中携带的流量选择器载荷中包括扩展字段，其中，流量选择器类型为TS_IPV6_ADDR_RANGE和TS_EXT_IPV6_ADDR_RANGE，其中，非扩展的流量选择器长度为40，扩展的流量选择器长度为48，扩展类型为INDEP_ANTIREPLAY_DSCP_RANGE，扩展长度为8，DSCP区间为[32，63]。
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝IPv6、TS_Len＝40、Str_Addr＝1::0、End Addr＝1::FFFF；
TS_Type＝EXT_IPv6、TS_Len＝48、Str_Addr＝1::0、End Addr＝1::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝63
TSr载荷：
TS_Type＝IPv6、TS_Len＝40、Str_Addr＝2::0、End Addr＝2::FFFF；
TS_Type＝EXT_IPv6、TS_Len＝48、Str_Addr＝1::0、End Addr＝1::FFFF、
Ext_Type＝DSCP_RANGE、Ext_Len＝8、Str Val＝32、End Val＝63
第二设备不支持基于DSCP生成多个防重放窗口，因此只解析第一报文中的字段TS_Type＝IPv6，不解析字段TS_Type＝EXT_IPv6，以及扩展字段。第二设备响应的第二报文中携带的流量选择器载荷中不包括扩展字段。
具体的流量选择器载荷示例如下：
TSi载荷：
TS_Type＝IPv6、TS_Len＝40、Str_Addr＝1::0、End Addr＝1::FFFF；
TSr载荷：
TS_Type＝IPv6、TS_Len＝40、Str_Addr＝2::0、End Addr＝2::FFFF；
通过第一报文和第二报文后，第一设备和第二设备没有协商出DSCP区间，则第一设备和第二设备生成1个默认防重放窗口。
至此，IPsec安全联盟协商完毕，该安全联盟的IPsec报文在接收方向被默认的防重放窗口处理。
本申请提供的方案，扩展性强，扩展类型可以有256个不同值，本申请实施例定义的Ext_Type＝“INDEP_ANTIREPLAY_DSCP”与“INDEP_ANTIREPLAY_FLOWLABEL”仅占其中2个值，后续其他值可扩展为其他特性所用。
通过流标签协商确定多个防重放窗口的具体内容与通过DSCP协商确定多个防重放窗口类似，协商流程相同，仅在字段名称和具体取值方面有所不同，在此不做赘述。
场景6：第一设备本地静态配置至少一个防重放窗口
应理解，场景1-5介绍的是第一设备如何通过DSCP值协商生成多个防重放窗口，场景6介绍第一设备无需与第二设备协商，在本地根据DSCP值或流标签值静态配置至少一个防重放窗口。
下面主要以第一设备在本地根据DSCP值静态配置至少一个防重放窗口为例，第一设备在本地根据流标签值静态配置至少一个防重放窗口的过程与之类似，不再赘述。
示例地，第一设备被配置为允许基于DSCP生成多个防重放窗口，按照现有技术，一个IPsec安全联盟可对应一个防重放窗口(默认的防重放窗口)，在此基础上，对应于该IPsec安全联盟，在第一设备还可以静态配置至少一个防重放窗口。例如，对应于一个IPsec安全联盟，第一设备在本地基于DSCP值静态配置了2个防重放窗口，其中防重放窗口#1对应的DSCP值为[46]，防重放窗口#2对应的DSCP值为[48]，防重放窗口#3(默认的防重放窗口)对应的DSCP值为除46和48之外的其他值。
至此，第一设备本地静态配置至少一个防重放窗口完成。后续，第一设备接收到IPsec报文后，根据IPsec报文中的DSCP值选择对应的防重放窗口，例如，IPsec报文中的DSCP值为48，则该IPsec报文被防重放窗口#2处理。
可选地，第一设备本地的多个防重放窗口有优先级，也就是说第一设备接收到IPsec报文后，按照该多个防重放窗口的优先级，依次将防重放窗口对应的DSCP值与IPsec报文中的DSCP值比较，直至找到IPsec报文中的DSCP值对应的防重放窗口，通过该防重放窗口处理该IPsec报文。
示例地，第一设备在本地基于DSCP值静态配置了2个防重放窗口，按照优先级从高到低依次是防重放窗口#1(对应的DSCP值为[46])，防重放窗口#2(对应的DSCP值为[48])，防重放窗口#3(默认的防重放窗口，对应的DSCP值为除46和48之外的其他值)。
例如，后续第一设备接收到的IPsec报文#1的DSCP值为48，按照优先级首先选择的第一个防重放窗口为防重放窗口#1，但是防重放窗口#1的DSCP值与48不匹配，接下来按照优先级选防重放窗口#2，防重放窗口#2的DSCP值与48匹配，因此该IPsec报文#1在防重放窗口#2处理。
例如，后续第一设备接收到的IPsec报文#2的DSCP值为47，按照优先级首先选择的第一个防重放窗口为防重放窗口#1，但是防重放窗口#1的DSCP值与47不匹配，接下来按照优先级选防重放窗口#2，防重放窗口#2的DSCP值依然与47不匹配，因此该IPsec报文#2在防重放窗口#3处理。
应理解，本申请实施例提供的方法可以单独使用，也可以结合使用，本申请对此不做限制。
需注意的是，上述方法实施例中提及的执行主体仅为示例，该执行主体也可以是支持该执行主体实现上述方法实施例的芯片、芯片系统、或处理器，本申请对此不作限制。
上文结合附图3和5描述了本申请实施例的方法实施例，下面描述本申请实施例的装置实施例。可以理解，方法实施例的描述与装置实施例的描述可以相互对应，因此，未描述的部分可以参见前面方法实施例。
可以理解的是，上述图3和5所示的实施例中，由第一设备实现的方法和操作，也可以由可用于第一设备的部件(例如芯片或者电路)实现，由第二设备实现的方法和操作，也可以由可用于第二设备的部件(例如芯片或者电路)实现。
上述主要从节点之间交互的角度对本申请实施例提供的方案进行了介绍。可以理解的是，各个网元，例如发射端设备或者接收端设备，为了实现上述功能，其包含了执行各个功能相应的硬件结构和/或软件模块。本领域技术人员应该可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，本申请能够以硬件或硬件和计算机软件的结合形式来实现。某个功能究竟以硬件还是计算机软件驱动硬件的方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
本申请实施例可以根据上述方法示例对发射端设备或者接收端设备进行功能模块的划分，例如，可以对应各个功能划分各个功能模块，也可以将两个或两个以上的功能集成在一个处理模块中。上述集成的模块既可以采用硬件的形式实现，也可以采用软件功能模块的形式实现。需要说明的是，本申请实施例中对模块的划分是示意性的，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式。下面以采用对应各个功能划分各个功能模块为例进行说明。
图6是本申请实施例提供的处理数据的装置的示意性框图。该装置500包括收发单元510和处理单元520。收发单元510可以与外部进行通信，处理单元520用于进行数据处理。收发单元510还可以称为通信接口或通信单元。
可选地，该装置500还可以包括存储单元，该存储单元可以用于存储指令或者和/或数据，处理单元520可以读取存储单元中的指令或者和/或数据。
在一种设计中，该装置500可以为数据交换网络中的第一设备，收发单元510用于执行上文方法实施例中第一设备的接收或发送的操作，处理单元520用于执行上文方法实施例中第一设备内部处理的操作。
在另一种设计中，该装置500可以为包括第一设备的设备。或者，该装置500可以为配置在第一设备中的部件，例如，第一设备中的芯片。这种情况下，收发单元510可以为接口电路、管脚等。具体地，接口电路可以包括输入电路和输出电路，处理单元520可以包括处理电路。
一种可能的实现方式，收发单元510用于接收互联网安全协议IPsec报文，该IPsec报文包括第一字段，该第一字段承载第一信息的值，处理单元520用于根据第一映射关系从N个防重放窗口中确定第一防重放窗口，该第一映射关系包括N个防重放窗口与N个第一信息的值集合的对应关系，该第一字段承载的第一信息的值属于该第一防重放窗口对应的第一信息的值集合，该第一防重放窗口用于处理该IPsec报文，该N个防重放窗口对应相同的IPsec安全联盟，N为大于或等于2的整数。
基于上述方案，IPsec报文的接收端的一个IPsec安全联盟对应多个防重放窗口，从而IPsec报文的接收端可以根据IPsec报文中的第一字段确定该IPsec报文的优先级，并根据优先级选择对应的防重放窗口处理该IPsec报文，实现不同优先级的IPsec报文在不同的防重放窗口内处理，每个防重放窗口处理的报文为相同优先级，因此可以避免因乱序导致的丢包，同时也避免了按照RFC4301标准4.1章节提出的平行IPsec安全联盟方案产生的新增的IPsec安全联盟而引发增大系统资源消耗等成本增加问题。
一种可能的实现方式，该第一信息包括差分服务代码点DSCP或者流标签。
相同IPsec安全联盟情况下，不同IPsec报文的DSCP值代表了不同优先级，基于本申请提供的方案，高优先级报文和低优先级报文可以在不同的防重放窗口内处理，可以避免低优先级报文丢包。
相同IPsec安全联盟情况下，不同IPsec报文的流标签值代表了不同的业务，不同的业务可能在传输过程中映射不同的服务质量，基于本申请提供的方案，对应不同服务质量的业务可以在不同的防重放窗口内独立处理，可以避免低优先级报文丢包。
一种可能的实现方式，该处理单元520还用于根据第一信息生成该N个防重放窗口。
一种可能的实现方式，该N个防重放窗口为本地静态配置的。
一种可能的实现方式，该N个防重放窗口为第一设备和第二设备根据第一信息的值协商生成的，该收发单元510还用于发送第一报文，该第一报文包括第一设备期望的第一信息的值集合，该收发单元510还用于接收第二报文，该第二报文包括第二设备基于第一报文进行协商后的第一信息的值集合，该处理单元520还用于根据该第二报文中的第一信息的值集合生成该N个防重放窗口。
一种可能的实现方式，该第二报文包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，该处理单元520还用于解析该扩展字段，该扩展字段包括的扩展类型为第一信息的范围，该扩展字段还包括至少一个第一信息的起始值和至少一个第一信息的结束值，该至少一个第一信息的起始值和至少一个第一信息的结束值用于确定M个第一信息的值集合，M为大于或等于1的整数。
一种可能的实现方式，第一报文，和/或第二报文为包括流量选择器载荷的因特网密钥交换报文。
一种可能的实现方式，流量选择器类型字段包括：流量选择器互联网协议版本IPv6地址范围和扩展的流量选择器IPv6地址范围，或，流量选择器IPv4地址范围和扩展的流 量选择器IPv4地址范围。
基于上述方案，本申请在现有流量选择器IPv4或IPv6地址范围字段基础上新增了扩展的流量选择器IPv4或IPv6地址范围，可兼容支持协商生成多个防重放窗口的设备和不支持协商生成多个防重放窗口的设备，当支持协商生成多个防重放窗口的设备接收到第二报文后，当支持协商生成多个防重放窗口的设备发送第一报文时，可以在流量选择器载荷中放置相同地址范围的流量选择器IPv4地址范围字段和扩展的流量选择器IPv4地址范围字段，或者在流量选择器载荷中放置相同地址范围的流量选择器IPv6地址范围字段和扩展的流量选择器IPv6地址范围字段。确定第二报文中的流量选择器载荷中的流量选择器类型字段为相同地址范围的流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围，或者相同地址范围的流量选择器IPv6和扩展的流量选择器IPv6地址范围时，可仅解析扩展的流量选择器IPv4/IPv6地址范围。当不支持协商生成多个防重放窗口的设备接收到第二报文后，不能识别扩展的流量选择器IPv4/IPv6地址范围字段，因此只解析流量选择器IPv4/IPv6地址范围字段。。
图7是本申请实施例提供的处理数据的装置的示意性框图。该装置600包括收发单元610和处理单元620。收发单元610可以与外部进行通信，处理单元620用于进行数据处理。收发单元610还可以称为通信接口或通信单元。
可选地，该装置600还可以包括存储单元630，该存储单元630可以用于存储指令或者和/或数据，处理单元620可以读取存储单元630中的指令或者和/或数据。
在一种设计中，该装置600可以为数据交换网络中的第二设备，收发单元610用于执行上文方法实施例中第二设备的接收或发送的操作，处理单元620用于执行上文方法实施例中第二设备内部处理的操作。
在另一种设计中，该装置600可以为包括第二设备的设备。或者，该装置600可以为配置在第二设备中的部件，例如，第二设备中的芯片。这种情况下，收发单元610可以为接口电路、管脚等。具体地，接口电路可以包括输入电路和输出电路，处理单元620可以包括处理电路。
一种可能的实现方式，该收发单元610用于发送互联网安全协议IPsec报文，该IPsec报文包括第一字段，该第一字段承载第一信息的值，该第一字段用于从N个防重放窗口中确定第一防重放窗口，该第一字段承载的第一信息的值属于该第一防重放窗口对应的第一信息的值集合，该第一防重放窗口用于处理该IPsec报文，该N个防重放窗口对应相同的IPsec安全联盟，N为大于或等于2的整数。
基于上述方案，IPsec报文的接收端的一个IPsec安全联盟对应多个防重放窗口，从而IPsec报文的接收端可以根据IPsec报文中的第一字段确定该IPsec报文的优先级，并根据优先级选择对应的防重放窗口处理该IPsec报文，实现不同优先级的IPsec报文在不同的防重放窗口内处理，每个防重放窗口处理的报文为相同优先级，因此可以避免因乱序导致的丢包，同时也避免了按照RFC4301标准4.1章节提出的平行IPsec安全联盟方案产生的新增的IPsec安全联盟而引发增大系统资源消耗等成本增加问题。
一种可能的实现方式，该第一信息包括差分服务代码点DSCP或者流标签。
相同IPsec安全联盟情况下，不同IPsec的DSCP值代表了不同优先级，基于本申请提供的方案，高优先级报文和低优先级报文可以在不同的防重放窗口内处理，可以避免低 优先级报文丢包。
相同IPsec安全联盟情况下，不同IPsec报文的流标签值代表了不同的业务，不同的业务可能在传输过程中映射不同的服务质量，基于本申请提供的方案，对应不同服务质量的业务可以在不同的防重放窗口内独立处理，可以避免低优先级报文丢包。
一种可能的实现方式，该收发单元610还用于接收第一报文，该第一报文包括第一设备期望的第一信息的值集合，发送第二报文，该第二报文包括第二设备基于第一报文进行协商后的第一信息的值集合，该第二报文中的第一信息的值集合用于生成该N个防重放窗口。
一种可能的实现方式，该第一报文包括流量选择器类型字段和扩展字段，当流量选择器类型字段取值为预定值时，该处理单元620用于解析该扩展字段，该扩展字段包括的扩展类型为第一信息的范围，该扩展字段还包括至少一个第一信息的起始值和至少一个第一信息的结束值。
一种可能的实现方式，第一报文，和/或第二报文为包括流量选择器载荷的因特网密钥交换报文。
一种可能的实现方式，该流量选择器类型字段包括：流量选择器互联网协议版本IPv6地址范围和扩展的流量选择器IPv6地址范围，或，流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围。
基于上述方案，本申请在现有流量选择器IPv4或IPv6地址范围字段基础上新增了扩展的流量选择器IPv4或IPv6地址范围，可兼容支持协商生成多个防重放窗口的设备和不支持协商生成多个防重放窗口的设备，当支持协商生成多个防重放窗口的设备接收到第一报文后，确定第一报文中的流量选择器载荷中的流量选择器类型字段为相同地址范围的流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围，或者相同地址范围的流量选择器IPv6地址范围和扩展的流量选择器IPv6地址范围，此时可仅解析扩展的流量选择器IPv4/IPv6地址范围。当不支持协商生成多个防重放窗口的设备接收到第一报文后，不能识别扩展的流量选择器IPv4/IPv6地址范围字段，因此只解析流量选择器IPv4/IPv6地址范围字段。
如图8所示，本申请实施例还提供一种处理数据的装置700。该装置700包括处理器710，处理器710与存储器720耦合，存储器720用于存储计算机程序或指令或者和/或数据，处理器710用于执行存储器720存储的计算机程序或指令和/或者数据，使得上文方法实施例中的方法被执行。
可选地，该装置700包括的处理器710为一个或多个。
可选地，如图8所示，该装置700还可以包括存储器720。
可选地，该装置700包括的存储器720可以为一个或多个。
可选地，该存储器720可以与该处理器710集成在一起，或者分离设置。
可选地，如图8所示，该装置700还可以包括收发器730和/或通信接口，收发器730和/或通信接口用于信号的接收和/或发送。例如，处理器710用于控制收发器730和/或通信接口进行信号的接收和/或发送。
作为一种方案，该装置700用于实现上文方法实施例中由第一设备执行的操作。例如，处理器710用于实现上文方法实施例中由第一设备内部执行的操作，收发器730用于实现 上文方法实施例中由第一设备执行的接收或发送的操作。装置500中的处理单元520可以为图8中的处理器，收发单元510可以为图8中的收发器。处理器710执行的操作具体可以参见上文对处理单元520的说明，收发器730执行的操作可以参见对收发单元510的说明，这里不再赘述。
如图9所示，本申请实施例还提供一种处理数据的装置800。该装置800包括处理器810，处理器810与存储器820耦合，存储器820用于存储计算机程序或指令或者和/或数据，处理器810用于执行存储器820存储的计算机程序或指令和/或者数据，使得上文方法实施例中的方法被执行。
可选地，该装置800包括的处理器810为一个或多个。
可选地，如图9所示，该装置800还可以包括存储器820。
可选地，该装置800包括的存储器820可以为一个或多个。
可选地，该存储器820可以与该处理器810集成在一起，或者分离设置。
可选地，如图9所示，该装置800还可以包括收发器830和/或通信接口，收发器830和/或通信接口用于信号的接收和/或发送。例如，处理器810用于控制收发器830进行信号的接收和/或发送。
作为一种方案，该装置800用于实现上文方法实施例中由第二设备执行的操作。
例如，处理器810用于实现上文方法实施例中由第二设备内部执行的操作，收发器830用于实现上文方法实施例中由第二设备执行的接收或发送的操作。装置600中的处理单元620可以为图9中的处理器，收发单元610可以为图9中的收发器和/或通信接口。处理器810执行的操作具体可以参见上文对处理单元620的说明，收发器830执行的操作可以参见对收发单元610的说明，这里不再赘述。
本申请实施例还提供了一种处理数据的装置，包括处理器，该处理器与输入/输出接口耦合，通过该输入/输出接口传输数据，该处理器用于执行上述任一方法实施例中的方法。
如图10，本申请实施例还提供了一种处理数据的装置900。该装置900包括逻辑电路910以及输入/输出接口(input/output interface)920。
其中，逻辑电路910可以为装置900中的处理电路。逻辑电路910可以耦合连接存储单元，调用存储单元中的指令，使得装置900可以实现本申请各实施例的方法和功能。输入/输出接口920，可以为装置900中的输入输出电路，将装置900处理好的信息输出，或将待处理的数据或信令信息输入装置900进行处理。
作为一种方案，该装置900用于实现上文各个方法实施例中由第一设备执行的操作。
例如，逻辑电路910用于实现上文方法实施例中由第一设备执行的处理相关的操作，输入/输出接口920用于实现上文方法实施例中由第一设备执行的发送和/或接收相关的操作。逻辑电路910执行的操作具体可以参见上文对处理单元520的说明，输入/输出接口920执行的操作可以参见上文对收发单元510的说明，这里不再赘述。
作为另一种方案，该装置900用于实现上文各个方法实施例中由第二设备执行的操作。
例如，逻辑电路910用于实现上文方法实施例中由第二设备执行的处理相关的操作，输入/输出接口920用于实现上文方法实施例中由第二设备执行的发送和/或接收相关的操作。逻辑电路910执行的操作具体可以参见上文对处理单元620的说明，输入/输出接口 920执行的操作可以参见上文对收发单元610的说明，这里不再赘述。
应理解，上述装置可以是一个或多个芯片。例如，该装置可以是现场可编程门阵列(field programmable gate array，FPGA)，可以是专用集成芯片(application specific integrated circuit，ASIC)，还可以是系统芯片(system on chip，SoC)，还可以是中央处理器(central processor unit，CPU)，还可以是网络处理器(network processor，NP)，还可以是数字信号处理电路(digital signal processor，DSP)，还可以是微控制器(micro controller unit，MCU)，还可以是可编程控制器(programmable logic device，PLD)或其他集成芯片。
在实现过程中，上述方法的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。结合本申请实施例所公开的方法的步骤可以直接体现为硬件处理器执行完成，或者用处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。为避免重复，这里不再详细描述。
应注意，本申请实施例中的处理器可以是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法实施例的各步骤可以通过处理器中的硬件的集成逻辑电路或者软件形式的指令完成。上述的处理器可以是通用处理器、数字信号处理器(DSP)、专用集成电路(ASIC)、现场可编程门阵列(FPGA)或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件。可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者该处理器也可以是任何常规的处理器等。结合本申请实施例所公开的方法的步骤可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于随机存储器，闪存、只读存储器，可编程只读存储器或者电可擦写可编程存储器、寄存器等本领域成熟的存储介质中。该存储介质位于存储器，处理器读取存储器中的信息，结合其硬件完成上述方法的步骤。
可以理解，本申请实施例中的存储器可以是易失性存储器或非易失性存储器，或可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(read-only memory，ROM)、可编程只读存储器(programmable ROM，PROM)、可擦除可编程只读存储器(erasable PROM，EPROM)、电可擦除可编程只读存储器(electrically EPROM，EEPROM)或闪存。易失性存储器可以是随机存取存储器(random access memory，RAM)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(static RAM，SRAM)、动态随机存取存储器(dynamic RAM，DRAM)、同步动态随机存取存储器(synchronous DRAM，SDRAM)、双倍数据速率同步动态随机存取存储器(double data rate SDRAM，DDR SDRAM)、增强型同步动态随机存取存储器(enhanced SDRAM，ESDRAM)、同步连接动态随机存取存储器(synchlink DRAM，SLDRAM)和直接内存总线随机存取存储器(direct rambus RAM，DR RAM)。应注意，本文描述的系统和方法的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
本申请实施例还提供一种数据交换系统，该系统包括第一设备和第二设备。
根据本申请实施例提供的方法，本申请还提供一种计算机可读介质，该计算机可读介质存储有程序代码，当该程序代码在计算机上运行时，使得该计算机执行上文实施例的方 法。例如，该计算机程序被计算机执行时，使得该计算机可以实现上述方法实施例中由第一设备执行的方法，或由第二设备执行的方法。
本申请实施例还提供一种包含指令的计算机程序产品，该指令被计算机执行时使得该计算机实现上述方法实施例中由第一设备执行的方法，或由第二设备执行的方法。
上述提供的任一种数据处理装置中相关内容的解释及有益效果均可参考上文提供的对应的方法实施例，此处不再赘述。
在上述实施例中，可以全部或部分地通过软件、硬件、固件或者其任意组合来实现。当使用软件实现时，可以全部或部分地以计算机程序产品的形式实现。所述计算机程序产品包括一个或多个计算机指令。在计算机上加载和执行所述计算机指令时，全部或部分地产生按照本申请实施例所述的流程或功能。所述计算机可以是通用计算机、专用计算机、计算机网络、或者其他可编程装置。所述计算机指令可以存储在计算机可读存储介质中，或者从一个计算机可读存储介质向另一个计算机可读存储介质传输，例如，所述计算机指令可以从一个网站站点、计算机、服务器或数据中心通过有线(例如同轴电缆、光纤、数字用户线(digital subscriber line，DSL))或无线(例如红外、无线、微波等)方式向另一个网站站点、计算机、服务器或数据中心进行传输。所述计算机可读存储介质可以是计算机能够存取的任何可用介质或者是包含一个或多个可用介质集成的服务器、数据中心等数据存储设备。所述可用介质可以是磁性介质(例如，软盘、硬盘、磁带)、光介质(例如，高密度数字视频光盘(digital video disc，DVD))、或者半导体介质(例如，固态硬盘(solid state disc，SSD))等。
上述各个装置实施例中的网络设备和终端设备与方法实施例中的网络设备和终端设备对应，由相应的模块或单元执行相应的步骤，例如通信单元(收发器)执行方法实施例中接收或发送的步骤，除发送、接收外的其它步骤可以由处理单元(处理器)执行。具体单元的功能可以参考相应的方法实施例。其中，处理器可以为一个或多个。
在本说明书中使用的术语“部件”、“模块”、“系统”等用于表示计算机相关的实体、硬件、固件、硬件和软件的组合、软件、或执行中的软件。例如，部件可以是但不限于，在处理器上运行的进程、处理器、对象、可执行文件、执行线程、程序和/或计算机。通过图示，在计算设备上运行的应用和计算设备都可以是部件。一个或多个部件可驻留在进程和/或执行线程中，部件可位于一个计算机上和/或分布在两个或更多个计算机之间。此外，这些部件可从在上面存储有各种数据结构的各种计算机可读介质执行。部件可例如根据具有一个或多个数据分组(例如来自与本地系统、分布式系统和/或网络间的另一部件交互的二个部件的数据，例如通过信号与其它系统交互的互联网)的信号通过本地和/或远程进程来通信。
本领域普通技术人员可以意识到，结合本文中所公开的实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本申请的范围。
所属领域的技术人员可以清楚地了解到，为描述的方便和简洁，上述描述的系统、装置和单元的具体工作过程，可以参考前述方法实施例中的对应过程，在此不再赘述。
在本申请所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本申请各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
所述功能如果以软件功能单元的形式实现并作为独立的产品销售或使用时，可以存储在一个计算机可读取存储介质中。基于这样的理解，本申请的技术方案本质上或者说对现有技术做出贡献的部分或者该技术方案的部分可以以软件产品的形式体现出来，该计算机软件产品存储在一个存储介质中，包括若干指令用以使得一台计算机设备(可以是个人计算机，服务器，或者网络设备等)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(Read-Only Memory，ROM)、随机存取存储器(Random Access Memory，RAM)、磁碟或者光盘等各种可以存储程序代码的介质。
以上所述，仅为本申请的具体实施方式，但本申请的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本申请揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本申请的保护范围之内。因此，本申请的保护范围应以所述权利要求的保护范围为准。

Claims (21)

  1. 一种报文防重放的方法，其特征在于，包括：
    第一设备接收互联网安全协议IPsec报文，所述IPsec报文包括第一字段，所述第一字段承载第一信息的值；
    所述第一设备根据第一映射关系从N个防重放窗口中确定第一防重放窗口，所述第一映射关系包括N个防重放窗口与N个所述第一信息的值集合的对应关系，所述第一字段承载的所述第一信息的值属于所述第一防重放窗口对应的所述第一信息的值集合，所述第一防重放窗口用于处理所述IPsec报文，所述N个防重放窗口对应相同的IPsec安全联盟，所述N为大于或等于2的整数。
  2. 根据权利要求1所述的方法，其特征在于，所述方法还包括：
    所述第一设备根据所述第一信息生成所述N个防重放窗口。
  3. 根据权利要求2所述的方法，其特征在于，所述第一设备根据所述第一信息生成所述N个防重放窗口，包括：
    所述第一设备发送第一报文，所述第一报文包括所述第一设备期望的所述第一信息的值集合；
    所述第一设备接收第二报文，所述第二报文包括第二设备基于所述第一报文进行协商后的所述第一信息的值集合；
    所述第一设备根据所述第二报文中的所述第一信息的值集合生成所述N个防重放窗口。
  4. 根据权利要求3所述的方法，其特征在于，所述第二报文包括流量选择器类型字段和扩展字段，所述方法还包括：
    当流量选择器类型字段取值为预定值时，所述第一设备解析所述扩展字段，所述扩展字段包括的扩展类型为所述第一信息的范围，所述扩展字段还包括至少一个所述第一信息的起始值和至少一个所述第一信息的结束值，所述至少一个所述第一信息的起始值和至少一个所述第一信息的结束值用于确定M个所述第一信息的值集合，所述M为大于或等于1的整数。
  5. 根据权利要求4所述的方法，其特征在于，所述流量选择器类型字段包括：流量选择器互联网协议版本IPv6地址范围和扩展的流量选择器IPv6地址范围，或，流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围。
  6. 根据权利要求3至5中任一项所述的方法，其特征在于，所述第一报文，和/或所述第二报文为包括流量选择器载荷的因特网密钥交换报文。
  7. 根据权利要求1至6中任一项所述的方法，其特征在于，所述第一信息包括差分服务代码点DSCP或者流标签。
  8. 根据权利要求1至7中任一项所述的方法，其特征在于，所述N个防重放窗口是在本地静态配置的。
  9. 一种报文防重放的方法，其特征在于，包括：
    第二设备生成互联网安全协议IPsec报文，所述IPsec报文包括第一字段，所述第一 字段承载第一信息的值，所述第一字段用于从N个防重放窗口中确定第一防重放窗口，所述第一字段承载的所述第一信息的值属于所述第一防重放窗口对应的所述第一信息的值集合，所述第一防重放窗口用于处理所述IPsec报文，所述N个防重放窗口对应相同的IPsec安全联盟，所述N为大于或等于2的整数；
    所述第二设备发送所述IPsec报文。
  10. 根据权利要求9所述的方法，其特征在于，所述方法还包括：
    所述第二设备接收第一报文，所述第一报文包括第一设备期望的所述第一信息的值集合；
    所述第二设备发送第二报文，所述第二报文包括所述第二设备基于所述第一报文进行协商后的所述第一信息的值集合，所述第二报文中的所述第一信息的值集合用于生成所述N个防重放窗口。
  11. 根据权利要求10所述的方法，其特征在于，所述第一报文包括流量选择器类型字段和扩展字段，所述方法还包括：
    当流量选择器类型字段取值为预定值时，所述第二设备解析所述扩展字段，所述扩展字段包括的扩展类型为所述第一信息的范围，所述扩展字段还包括至少一个所述第一信息的起始值和至少一个所述第一信息的结束值。
  12. 根据权利要求11所述的方法，其特征在于，所述流量选择器类型字段包括：流量选择器互联网协议版本IPv6地址范围和扩展的流量选择器IPv6地址范围，或，流量选择器IPv4地址范围和扩展的流量选择器IPv4地址范围。
  13. 根据权利要求10至12中任一项所述的方法，其特征在于，所述第一报文，和/或所述第二报文为包括流量选择器载荷的因特网密钥交换报文。
  14. 根据权利要求9至13中任一项所述的方法，其特征在于，所述第一字段包括差分服务代码点DSCP字段或者流标签字段。
  15. 一种通信装置，其特征在于，包括：
    用于实现权利要求1至8中任意一项所述的方法的单元；或者
    用于实现权利要求9至14中任意一项所述的方法的单元。
  16. 一种通信装置，其特征在于，所述装置包括处理器，所述处理器与存储器耦合，所述存储器存储有指令，所述指令被所述处理器运行时，
    使得所述处理器执行如权利要求1至8中任意一项所述的方法，或者
    使得所述处理器执行如权利要求9至14中任意一项所述的方法。
  17. 一种通信装置，其特征在于，所述装置包括逻辑电路，所述逻辑电路用于与输入/输出接口耦合，通过所述输入/输出接口传输数据，以执行如权利要求1至8中任一项所述的方法，或者，以执行如权利要求9至14中任一项所述的方法。
  18. 一种计算机可读存储介质，其特征在于，所述计算机可读存储介质用于存储计算机程序，当所述计算机程序在计算机上运行时，使得所述计算机执行如权利要求1至8中任一项所述的方法，或使得所述计算机执行如权利要求9至14中任一项所述的方法。
  19. 一种计算机程序产品，其特征在于，所述计算机程序产品包括：计算机程序代码，当所述计算机程序代码被运行时，实现如权利要求1至8中任一项所述的方法，或实现如权利要求9至14中任一项所述的方法。
  20. 一种芯片，其特征在于，包括处理器和通信接口，所述处理器用于读取指令以执行如权利要求1至8中任一项所述的方法，或，执行如权利要求9至14中任一项所述的方法。
  21. 一种通信系统，其特征在于，包括第一设备和第二设备，所述第一设备用于执行如权利要求1至8中任一项所述的方法，所述第二设备用于执行如权利要求9至14中任一项所述的方法。
PCT/CN2022/126120 2021-11-26 2022-10-19 报文防重放的方法和装置 WO2023093381A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111421943.8 2021-11-26
CN202111421943.8A CN116192412A (zh) 2021-11-26 2021-11-26 报文防重放的方法和装置

Publications (1)

Publication Number Publication Date
WO2023093381A1 true WO2023093381A1 (zh) 2023-06-01

Family

ID=86433118

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/126120 WO2023093381A1 (zh) 2021-11-26 2022-10-19 报文防重放的方法和装置

Country Status (2)

Country Link
CN (1) CN116192412A (zh)
WO (1) WO2023093381A1 (zh)

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101917294A (zh) * 2010-08-24 2010-12-15 杭州华三通信技术有限公司 主备切换时更新防重放参数的方法和设备
CN102769572A (zh) * 2012-07-30 2012-11-07 福建星网锐捷网络有限公司 报文防重放方法及装置、网络设备
CN104038505A (zh) * 2014-06-24 2014-09-10 杭州华三通信技术有限公司 一种IPSec防重放的方法和装置
US20190141019A1 (en) * 2017-07-31 2019-05-09 Cisco Technology, Inc. Ipsec anti-replay window with quality of service

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101917294A (zh) * 2010-08-24 2010-12-15 杭州华三通信技术有限公司 主备切换时更新防重放参数的方法和设备
CN102769572A (zh) * 2012-07-30 2012-11-07 福建星网锐捷网络有限公司 报文防重放方法及装置、网络设备
CN104038505A (zh) * 2014-06-24 2014-09-10 杭州华三通信技术有限公司 一种IPSec防重放的方法和装置
US20190141019A1 (en) * 2017-07-31 2019-05-09 Cisco Technology, Inc. Ipsec anti-replay window with quality of service

Also Published As

Publication number Publication date
CN116192412A (zh) 2023-05-30

Similar Documents

Publication Publication Date Title
US11445559B2 (en) Communication method and communications apparatus
CN106664735B (zh) 控制最大传输单元尺寸报告和发现的方法和用户设备
JP5279732B2 (ja) 移動通信システムにおけるｐｄｃｐ層の状態報告の送信方法及び受信装置
CN108366369B (zh) 一种数据安全传输的方法及接入网、终端、核心网设备
US20140040488A1 (en) Method and apparatus for initiating and maintaining sessions between endpoints
WO2021184783A1 (zh) 实现网络能力开放的方法、装置、电子设备和存储介质
JP6888099B2 (ja) 多数接続通信方法、装置、及び端末
NZ577563A (en) Method for configuring the link maximum transmission unit (mtu) in a user equipment (ue)
WO2020029922A1 (zh) 传输报文的方法和装置
US11394656B2 (en) Method and apparatus for avoiding packet fragmentation
JP2023535201A (ja) サイドリンク信号伝達無線ベアラ構成方法および通信装置
US11877251B2 (en) Time synchronization method, electronic device and storage medium
WO2020057519A1 (zh) 调度方法、设备与计算机可读存储介质
WO2023093381A1 (zh) 报文防重放的方法和装置
WO2020062091A1 (zh) 通信方法、终端设备和网络设备
WO2023000798A1 (zh) 一种通信方法和装置
WO2021056386A1 (zh) 无线通信的方法和终端设备
US11956669B2 (en) Methods and arrangements for determining indication of maximum datagram size supported without fragmentation in an IP network
RU2787511C2 (ru) Способ связи и устройство связи
WO2023001010A1 (zh) 一种通信方法以及装置
WO2022027341A1 (zh) 无线通信方法和终端设备
CN116055231A (zh) 一种传输数据的方法和通信装置
CN115918043A (zh) 用于支持通信网络中的通信路径上的延时的估计的方法和装置
WO2017101069A1 (zh) 传输数据的方法和终端设备

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22897464

Country of ref document: EP

Kind code of ref document: A1