WO2023197925A1 - 处理报文的方法及装置 - Google Patents

处理报文的方法及装置 Download PDF

Info

Publication number
WO2023197925A1
WO2023197925A1 PCT/CN2023/086502 CN2023086502W WO2023197925A1 WO 2023197925 A1 WO2023197925 A1 WO 2023197925A1 CN 2023086502 W CN2023086502 W CN 2023086502W WO 2023197925 A1 WO2023197925 A1 WO 2023197925A1
Authority
WO
WIPO (PCT)
Prior art keywords
field
message
fragmented
associated processing
path
Prior art date
Application number
PCT/CN2023/086502
Other languages
English (en)
French (fr)
Inventor
曹淋
Original Assignee
支付宝(杭州)信息技术有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 支付宝(杭州)信息技术有限公司 filed Critical 支付宝(杭州)信息技术有限公司
Publication of WO2023197925A1 publication Critical patent/WO2023197925A1/zh

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0464—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload using hop-by-hop encryption, i.e. wherein an intermediate entity decrypts the information and re-encrypts it before forwarding it
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/12—Applying verification of the received information
    • H04L63/123—Applying verification of the received information received data contents, e.g. message integrity

Definitions

  • the present disclosure relates to the field of computer network technology, and in particular, to a method and device for processing messages.
  • the associated processing node Before the packet leaves the source device and reaches the destination device, the associated processing node can perform associated processing on the packet.
  • the associated processing may include, for example, encryption and/or decryption processing.
  • On-path processing may cause the packet length to increase. If the length of the packet processed along the route exceeds the specified limit, the packet processing node needs to fragment or reassemble the packet. Fragmentation or reorganization will increase the processing overhead of the associated processing nodes.
  • the present disclosure provides a method and device for processing messages to reduce the overhead of fragmentation processing by associated processing nodes.
  • a method for processing a message is provided.
  • the method is executed by a first associated processing node.
  • the first associated processing node is communicatively connected to a second associated processing node.
  • the method includes: receiving the first message; performing the first path-associated processing on the first message; adding a first field to the data portion of the first message after the first path-associated processing to obtain the second message, so
  • the first field includes additional information obtained through the first path-associated processing;
  • the second message is fragmented to obtain multiple fragmented messages, and the multiple fragmented messages include the first fragmented message.
  • the first fragment message includes the first field; and the first fragment message is sent to the second associated path processing node.
  • the first field is located at the end of the second message.
  • the first field includes a first protocol number field, and the first protocol number field is used to record the original protocol number of the first message.
  • the method further includes: converting the first message The second protocol number field in the header is modified to a first protocol number, and the first protocol number is used to indicate that the first field is added to the data part of the first message.
  • the first field includes a length field
  • the length field is used to indicate the length of the data part of the first message after the first associated processing, so that the second associated processing node determines the reception Whether the received fragmented message is complete.
  • the first field includes a sequence number field and a fragment number field
  • the sequence number field and the fragment number field are respectively used to record the sequence number and fragment number of the second message, so that The second associated path processing node determines the first fragmented message of the second message.
  • the first field includes an identification field, and the identification field is used to mark that the first field is located in the first fragmented message.
  • the first associated processing node is a network card
  • the first associated processing is encryption processing
  • the accompanying processing is decryption processing.
  • a method for processing messages is provided.
  • the method is executed by a second associated processing node.
  • the second associated processing node is communicatively connected to the first associated processing node.
  • the method includes: receiving The first fragmented message sent by the first associated processing node, the first fragmented message belongs to multiple fragmented messages, the first fragmented message includes a first field; parsing the first fragmented message A fragmented message to obtain the first field; reassemble the plurality of fragmented messages to obtain a second message; delete the first field in the data part of the second message; According to the first field, perform second on-path processing on the second message with the first field deleted to obtain a first message, where the first field includes the first on-path processing node’s response to the third
  • the additional information obtained by performing the first path-associated processing on a packet, and the second path-associated processing is determined by the additional information.
  • the method further includes: adding the first fragmented message to a doubly linked list; wherein the doubly linked list includes at least one fragmented message with equal source addresses and equal sequence numbers.
  • the first field is located at the end of the second message.
  • the first field includes a first protocol number field
  • the first protocol number field is used to record the original protocol number of the first message.
  • the method further includes: converting the first message
  • the second protocol number field in the header is modified to the original protocol number.
  • the first field includes a length field
  • the length field is used to indicate the length of the data part of the first message after the first path associated processing
  • the method further includes: according to the length field to determine whether the received fragmented message is complete.
  • the first field includes a sequence number field and a fragment number field
  • the sequence number field and the fragment number field are respectively used to record the sequence number and fragment number of the second message
  • the method further includes: determining the first fragmented message of the second message according to the sequence number field and the fragment number field.
  • the first field includes an identification field, and the identification field is used to mark that the first field is located in the first fragmented message.
  • the second path-associated processing node is a network card
  • the first path-associated processing is encryption processing
  • the second path-associated processing is decryption processing
  • a device for processing messages runs a first associated processing node, and the first associated processing node is communicatively connected to a second associated processing node.
  • the device includes: a network processing chip, Used to receive the first message; the path-associated processing chip is used to perform the first path-associated processing on the first message, and, in the data part of the first message after the first path-associated processing Add a first field to obtain a second message, where the first field includes additional information obtained through the first accompanying process; the network processing chip is also used to fragment the second message to obtain A plurality of fragmented messages, the plurality of fragmented messages include a first fragmented message, the first fragmented message includes the first field, and is sent to the second associated path processing node The first fragmented message.
  • the first field is located at the end of the second message.
  • the first field includes a first protocol number field
  • the first protocol number field is used to record the original protocol number of the first message
  • the network processing chip is also used to: convert the third The second protocol number field in the header of a message is modified to a first protocol number, and the first protocol number is used to indicate that the first field is added to the data part of the first message.
  • the first field includes a length field
  • the length field is used to indicate the length of the data part of the first message after the first associated processing, so that the second associated processing node determines the reception Whether the received fragmented message is complete.
  • the first field includes a sequence number field and a fragment number field
  • the sequence number field and the fragment number field are respectively used to record the sequence number and fragment number of the second message, so that The second associated path processing node determines the first fragmented message of the second message.
  • the first field includes an identification field, and the identification field is used to mark that the first field is located in the first fragmented message.
  • the device is a network card
  • the associated processing chip is an encryption and decryption chip
  • the first associated processing is encryption processing
  • the second associated processing is decryption processing.
  • a device for processing messages runs a second associated processing node, and the second associated processing node is communicatively connected to the first associated processing node.
  • the device includes: network processing A chip configured to receive a first fragmented message, the first fragmented message belonging to multiple fragmented messages, the first fragmented message including a first field, and parsing the first fragmented message.
  • an associated processing chip is used to delete the data portion of the second message a first field, and perform a second accompanying process on the second message with the first field deleted according to the first field to obtain a first message, where the first field includes the first accompanying process Additional information obtained by the node performing a first path accompanying process on the first message, and the second path accompanying process is determined by the additional information.
  • the network processing chip is further configured to: add the first fragmented message to a doubly linked list; wherein the doubly linked list includes at least one fragmented message with equal source addresses and equal sequence numbers.
  • the first field is located at the end of the second message.
  • the first field includes a first protocol number field
  • the first protocol number field is used to record the original protocol number of the first message
  • the network processing chip is also used to: convert the third The second protocol number field in the header of a message is modified to the original protocol number.
  • the first field includes a length field
  • the length field is used to indicate the length of the data part of the first message after the first path associated processing
  • the network processing chip is also used to: according to The length field is used to determine whether the received fragmented message is complete.
  • the first field includes a sequence number field and a fragment number field
  • the sequence number field and the fragment number field are respectively used to record the sequence number and fragment number of the second message
  • the network processing chip described above is also used for: According to The sequence number field and the fragment number field determine the first fragmented message of the second message.
  • the first field includes an identification field, and the identification field is used to mark that the first field is located in the first fragmented message.
  • the device is a network card
  • the associated processing chip is an encryption and decryption chip
  • the first associated processing is encryption processing
  • the second associated processing is decryption processing.
  • a computer program product including executable code.
  • executable code When the executable code is executed, the method described in the first or second aspect can be implemented.
  • the present disclosure can avoid the process of data copying of the first field during the fragmentation process, thereby improving the efficiency of fragmentation and reorganization of the along-the-way processing, thereby reducing the cost of the along-the-way processing.
  • the processing overhead of the node can avoid the process of data copying of the first field during the fragmentation process, thereby improving the efficiency of fragmentation and reorganization of the along-the-way processing, thereby reducing the cost of the along-the-way processing.
  • Figure 1 is an example diagram of a message fragmentation method.
  • Figure 2 is a schematic flow chart of a method for processing messages provided by an embodiment of the present disclosure.
  • Figure 3 is an example diagram of fragmenting a second message provided by an embodiment of the present disclosure.
  • Figure 4 is a schematic diagram of another method of processing messages provided by an embodiment of the present disclosure.
  • Figure 5 is a schematic flow chart of a method for reassembling messages provided by an embodiment of the present disclosure.
  • FIG. 6 is a schematic structural diagram of a device for processing messages provided by an embodiment of the present disclosure.
  • FIG. 7 is a schematic structural diagram of another device for processing messages provided by an embodiment of the present disclosure.
  • Network devices may include, for example, source devices, destination devices, intermediate devices, etc. Data can be carried in messages.
  • the source device processes the data, forms packets (such as IP packets) that can be transmitted in the network, and transmits the packets to the network. After the packet leaves the source device, it can pass through the intermediate device and reach the destination device.
  • Source devices may include devices such as source hosts or source host systems.
  • the destination device may include a destination host or a destination host system.
  • Intermediate devices can include network cards and other devices.
  • Intermediary devices can perform additional processing on packets.
  • the intermediate device can encrypt, decrypt, compress or decompress the message.
  • This additional processing by intermediate devices may be called on-the-fly processing. It can be understood that path-associated processing is processing performed outside the source device or destination device. Therefore, the user of the source device or the destination device will not perceive the on-path processing, which can improve the user experience.
  • the on-path processing that the security network card can implement includes: encryption processing and/or decryption processing.
  • the security network card can include encryption and decryption chips and network processing chips.
  • the encryption and decryption chip can be used to implement encryption processing and/or decryption processing.
  • Network processing chips can be used to implement processing related to message transmission. Packets sent by the source device can pass through the first security network card.
  • the first security network card can encrypt messages and send the encrypted messages through the network. Before the encrypted packet reaches the destination device, it can pass through the second security network card.
  • the second security network card can decrypt the encrypted packets and transmit the decrypted packets to the destination device.
  • the intermediary device may be referred to as an on-path processing device.
  • the network node that performs path-associated processing may be called a path-associated processing node.
  • On-the-fly processing nodes can run on intermediate devices.
  • the sending end can fragment (or cut) the message to form multiple smaller fragmented messages, and then transmission.
  • the receiving end can reassemble the fragmented message to restore the original message.
  • the intermediate device can fragment or reassemble the packets.
  • the network card used for encryption can fragment the message, and the user's network card for decryption can reassemble the message.
  • the message received by the intermediate device may be a fragmented message, and the intermediate device may perform secondary fragmentation on the fragmented message.
  • the intermediate device can perform on-path processing on the fragmented message. After the on-path processing, if the length of the fragmented message is greater than the specified value, the intermediate device can perform secondary fragmentation on the fragmented message.
  • Messages can include headers and data.
  • the header of the message can be used to indicate the information required for message transmission.
  • the header of the message may include one or more of the following information: protocol number, sequence number, fragment number, message length, destination address, source address, etc.
  • the protocol number can be used to indicate the type or version of the transport protocol.
  • the sequence number can be used to indicate the original data packet to which the fragmented packet belongs. During the reassembly process, fragmented packets with the same sequence number can be merged into one packet.
  • the fragment number can also be called an offset, which is used to indicate the offset of the data part of the fragmented message in the original message, that is, the number of the fragmented message.
  • the location of the data base relative to the original message During the reassembly process, the fragmented message can be restored to the appropriate location based on the fragment number. Fragmentation and reassembly can be implemented, for example, according to methods specified by standard IP protocols.
  • Figure 1 is an example diagram of a message fragmentation method. The following describes the method of packet fragmentation with reference to Figure 1.
  • the first packet 100 can be cut into fragmented packets 110 ⁇ 140.
  • the longer data part 1 is divided into four shorter parts, namely data part 2, data part 3, data part 4 and data part 5.
  • Data part 2, data part 3, data part 4 and data part 5 constitute the data parts of fragmented messages 110 to 140 respectively. It can be understood that the total length of data portion 2 to data portion 5 is equal to the length of data portion 1 .
  • Most of the information in the header of the fragmented message can be copied from header 1 of the first message 100 .
  • the protocol number, sequence number, destination address, source address and other information in the header of the fragmented message can be copied from header 1 of the first message 100, that is, these fields can be consistent with the corresponding fields in header 1.
  • Fragmented packets may differ in a few fields. For example, different fragmented packets may have different fragment numbers.
  • the fragment numbers of different fragmented messages can be determined based on the position of the data part of the fragmented message in the first fragmented message.
  • the fragmented message 110 is the first fragmented message of the first message 100, then the offset between the fragmented message 110 and the first message 100 is 0, then the fragmented message
  • the fragment number of message 110 is the same as that of first message 100.
  • the first message 100 may be a fragmented message of a certain message, that is, the fragment number of the first message 100 may not be 0.
  • the fragment number of the first packet 100 is 175, then the fragment number of the fragmented packet 110 may also be 175.
  • the fragmented message 140 is the last fragmented message of the first message 100. If the offset of the data part of the fragmented message 140 relative to the first message 100 is 525, then the fragmented message 140 The fragment number can be the fragment number of the first packet 110 plus 525.
  • the receiving end can reassemble the received fragmented messages.
  • multiple fragmented messages fragmented from the same message can form a linked list.
  • fragmented packets with the same source address and sequence number can form a one-way list with fragment numbers from low to high.
  • Reassembly can only be achieved when the fragmented message received by the receiving end is complete. In other words, only when the receiving end receives all fragmented messages, the message can be reassembled.
  • the related technology can perform a reassembly trial every time a fragmented message is received. If the reassembly attempt is successful, it means that the receiving end has received all the fragmented messages, and the receiving end can merge all the fragmented messages to restore the original message. For example, merging can be implemented starting from the first fragmented message based on a one-way linked list.
  • on-path processing may cause the packet length to increase. If the length of the packet processed along the route exceeds the specified limit, the packet processing node associated with the route needs to fragment the packet. It is understandable that shard processing will increase the processing overhead of the associated processing nodes.
  • Figure 2 is a schematic flow chart of a method for processing messages provided by an embodiment of the present disclosure.
  • the method shown in Figure 2 may be executed by a first associated processing node and a second associated processing node.
  • the first associated processing node may be communicatively connected with the second associated processing node.
  • the method shown in Figure 2 may include steps S210 to S290. Among them, steps S210 to S250 may be performed by the first associated processing section. Click Execute, steps S250 to S290 may be executed by the second associated processing node.
  • the first associated processing node or the second associated processing node may be an intermediate device, such as a network card.
  • Step S210 Receive the first message.
  • the sender of the first message may be the source device.
  • the first message may include a header and a data part.
  • S may be used to indicate the first packet
  • IP may be used to indicate the header of the first packet
  • DATA may be used to indicate the data part of the first packet.
  • S can be expressed as IP+DATA.
  • the first packet may be a packet that has been encapsulated by the source device and can be transmitted in the network.
  • the first packet may be an IP packet.
  • Step S220 Perform first channel accompanying processing on the first packet.
  • the first associated processing may be the associated processing performed by the first associated processing node on the first packet.
  • the first path-associated processing may be encryption processing.
  • the second path-associated processing node may perform the second path-associated processing corresponding to the first path-associated processing.
  • the second associated processing may be decryption processing.
  • the first packet that has undergone the first path-associated processing can be represented as Sp. It can be understood that after the first path-associated processing, the data part of the first message may change. For example, after the first path processing, DATA can be changed into DATAp, that is, Sp can be expressed as IP+DATAp.
  • Step S230 Add a first field to the data part of the first message after the first channel association processing to obtain a second message.
  • the first field may include additional information obtained through the first path-associated processing.
  • the additional information may be expressed as PI, for example.
  • the additional information may include information on how to perform decryption.
  • the first field can be added anywhere in the DATAp.
  • the first field can be added at the beginning, at the end of the DATAp, or anywhere in between. That is to say, the first field may be located at the beginning, end or middle of the data part of the second message. As shown in Figure 3, the first field may be located at the end of the second message 300.
  • the first field when the first field is located at the end of the second message, when adding the first field, the first field can be added directly at the end of the DATAp. That is to say, there is no need to insert the first field at an insertion point in the middle of Sp, nor to move the bits after the insertion point backward, so there is no need for the underlying hardware to support scatter/gather read and write functions, and thus The hardware structure of the first associated processing node is simplified.
  • the message length in the header of the second message can also be adaptively modified.
  • the message length in the header of the second message can be modified to the total length of the data portion of the second message obtained after the first message is processed by the first path and the first field is added.
  • the first field may also be called a network transmission header (network transmission header, NTH) field.
  • NTH network transmission header
  • Step S240 Fragment the second message to obtain multiple fragmented messages.
  • step S240 may be performed to fragment the second message. If the length of the second message is not greater than the specified value, the second message can be sent directly.
  • the prescribed value may be, for example, a maximum transmission unit (maximum transmission unit, MTU).
  • the plurality of fragmented messages may include a first fragmented message, and the first fragmented message may include the first field. It can be understood that the first field may be divided into at least one fragmented message, that is, the first fragmented message may include all or part of the first field.
  • fragmentation can be performed through the fragmentation method of the standard IP protocol.
  • Figure 3 is an example diagram of fragmenting a second message provided by an embodiment of the present disclosure.
  • the first field is located at the end of the second message 300.
  • the second packet 300 may be cut into multiple fragmented packets 310-340.
  • the fragmented message 340 may be the last fragmented message of the second message 300.
  • the first field may be divided into the fragmented message 340, that is, the first fragmented message may be the fragmented message 340.
  • Step S250 The first associated processing node sends the first fragmented message to the second associated processing node.
  • the first fragmented message may be directly sent by the first associated processing node to the second associated processing node.
  • the first fragmented message may also be sent to the second associated processing node after passing through one or more network devices.
  • Step S260 Parse the first fragmented message to obtain the first field.
  • the second associated processing node may determine whether the entire content of the first field is in the first fragmented message. If all the contents of the first field are in the first fragmented message, the first field can be directly taken out. If the first fragmented message includes part of the first field, it can be combined with other fragmented messages to obtain the first field.
  • Step S270 Reassemble the multiple fragmented messages to obtain a second message.
  • This disclosure does not limit the method of reassembling multiple fragmented messages. For example, you can use the reassembly method of the standard IP protocol to reassemble multiple fragmented packets.
  • Step S280 Delete the first field in the data part of the second message.
  • the content included in the first field is not the actual transmitted user data.
  • the data part of the second message may contain the actual transmitted data content.
  • Step S290 Perform second processing on the second message with the first field deleted according to the first field to obtain the first message. arts.
  • the second processing corresponds to the first path-associated processing, that is to say, after the first message is processed through the first path-associated processing and the second process, it is still in the original form of the first message.
  • the first field includes additional information obtained through the first path accompanying processing. Therefore, the second path accompanying processing node can delete the first field in the first field based on the additional information in the first path accompanying processing.
  • the second message is subjected to second processing, thereby obtaining the first message originally received by the first associated processing node.
  • the second path-associated processing node can implement corresponding path-associated processing according to the first field.
  • the first field may include additional information obtained through the first path-associated processing.
  • the second associated processing node may perform a second process on the reassembled message based on the first associated processing additional information, thereby restoring the message to the first message received by the first associated processing node.
  • the first path-associated processing may be encryption processing
  • the second processing may be decryption processing.
  • the additional information may be encrypted or decrypted additional information.
  • the second associated processing node can perform second processing based on the encrypted and decrypted additional information, thereby decrypting and restoring the message.
  • the present disclosure can avoid the process of data copying of the first field during the fragmentation process, thereby improving the efficiency of processing fragmentation and reorganization along the way. , thereby reducing the processing overhead of the associated path processing nodes.
  • the second associated processing node can also implement reassembly of fragmented messages based on the first field. For example, the second associated processing node may merge the fragmented messages after receiving the fragmented message including the first field (ie, the first fragmented message). That is to say, before receiving the first fragmented message, the second associated processing node may not attempt to reassemble the fragmented message.
  • the first field may be located at the end of the second message, and the first fragmented message including the first field may be the last fragmented message of the second message. In some cases, the last fragmented packet may reach the second associated processing node last.
  • the second associated processing node receives the last fragmented message, it has already received most of the fragmented messages, or has received all the fragmented messages. In this case, the probability of successful reassembly is higher. . Therefore, the method shown in Figure 3 can also achieve rapid packet reassembly, avoid multiple retrieval attempts, and thus achieve efficient packet reorganization.
  • the first field may include one or more of the following fields: a first protocol number field, a length field, a sequence number field, a fragment number field, and an identification field.
  • the first protocol number field may be used to record the original protocol number of the first message.
  • the first protocol number may record the protocol number recorded in the second protocol number field in the header of the first message.
  • the method shown in Figure 3 may also include modifying the second protocol number field in the header of the first message to the first protocol number.
  • the first protocol number is used to indicate that the first field is added to the data part.
  • the first protocol number can be represented by nth, for example. After the first packet is fragmented, the protocol numbers indicated in the headers of the generated multiple fragmented packets can all be nth.
  • the second path-associated processing node After the second path-associated processing node receives the fragmented message, if it detects that the protocol number contained in the header is the first protocol number, it can determine that the first field is added to the first message data portion, so that it can process the received fragmented message. Fragmented packets are processed accordingly.
  • the length field may be used to indicate the length of the data part of the first message after the first path associated processing.
  • the length field may directly record the length of the data part of the first message after the first path associated processing.
  • the length field may record the length of the first message in other processing stages.
  • the length field can record the length of other parts of the first message.
  • the second path-associated processing node can calculate the length of the data part of the first message after the first path-associated processing through the length field.
  • the second path-associated processing node can determine whether the received message is complete (that is, whether all fragmented messages have been received) according to the indication of the length field. For example, the second path-associated processing node may calculate the total length of the data portion of fragmented packets with the same source address and sequence number in the header. If the total length is equal to the length recorded in the length field, it can be determined that all fragmented messages have been received, and then all fragmented messages are merged. It can be understood that, according to the indication of the length field and the total length of the data part of the message received by the second associated processing node, the fragmented messages are then merged and reorganized, so that the fragmented message can be reorganized quickly without the need to repeatedly try to reassemble. , thus making the recombination more efficient.
  • the sequence number field and the fragment number field may be used to record the sequence number and fragment number of the second message respectively. It can be understood that the second message is generated from the first message, the sequence number of the second message is the same as the sequence number of the first message, and the fragmentation number of the second message is the same as the fragmentation number of the first message. The number is the same. Therefore, the sequence number field and the fragment number field can also be used to record the sequence number and fragment number of the first message respectively.
  • the second associated processing node can determine which fragmented message among the multiple received fragmented messages is the first fragmented message based on the sequence number field and the fragment number field. For example, if the sequence number and fragment number in the header of the second fragmented message are the same as the contents stored in the sequence number field and fragment number field, it can be determined that the second fragmented message is the first fragmented message. .
  • the identification field can be used to mark the first fragmented message where the first field is located.
  • an identification field can be marked with a magic number.
  • the identification field may also be called a magic field.
  • the second path-associated processing node may receive multiple fragmented messages, and the first field exists in some of the multiple fragmented messages (including the first fragmented message).
  • the second associated processing node can determine which of the multiple fragmented messages is the first fragmented message through the identification field, thereby further acquiring all fragmented messages including the first field based on the first fragmented message. , and then obtain the first field.
  • the identification field can be at the end of the first field.
  • the first fragmented message marked by the identification field is the last fragmented message containing the first field. If the first field in the first fragment is not complete, the remaining first field can be retrieved from the previous fragmented message or several previous fragmented messages, thereby obtaining the complete first field.
  • the second associated processing unit can construct a doubly linked list.
  • the doubly linked list includes at least one fragmented message with the same source address and equal sequence number. After receiving the fragmented message, the second associated processing unit can add the fragmented message to in the corresponding doubly linked list.
  • a doubly linked list can be constructed based on the order of shard numbers. For example, a doubly linked list can be constructed based on the shard number from low to high. Based on the order of fragment numbers from low to high, the doubly linked list can be expressed as Next List. Alternatively, based on the order of fragment numbers from high to low, the doubly linked list can be expressed as a Prev List.
  • a doubly linked list enables fragmented packets to search forward and/or backward for other fragmented packets. For example, starting from the first fragmented message, you can search in two directions to determine the length of the doubly linked list, thereby obtaining the total length of the fragmented messages that have been received. Alternatively, starting from the first fragmented message, you can search forward and initially determine the first fragmented message based on parameters such as the length of the message.
  • Figure 4 is a schematic diagram of another method of processing messages provided by an embodiment of the present disclosure.
  • the method shown in Figure 4 can be executed by the source device, the first associated processing node, the second associated processing node and the destination device.
  • the first associated processing node or the second associated processing node may run on the network card.
  • the first associated processing node may include a first associated processing unit and a first associated processing network unit.
  • the second associated processing node may include a second associated processing unit and a second associated processing network unit.
  • the method shown in Figure 4 may include steps S410 to S490.
  • Step S410 The source device sends the first message S.
  • S can include the header IP and the data part DATA.
  • the first associated processing node receives the first message S.
  • the first associated processing network unit of the first associated processing node may receive the first message S.
  • Step S420 The first associated processing node delivers the first message S to the first associated processing unit for processing.
  • the first associated processing unit may perform first associated processing on the first packet S.
  • the data part of the first message processed by the first path may be represented by DATAp. That is to say, the first packet after the first path-associated processing is IP+DATAp.
  • the first link processing unit can add the first field NTH to the last part of S, and modify the IP packet length information. Then the first message S becomes the second message Sp, and Sp includes IP+DATAp+NTH.
  • the NTH field may include: additional information PI generated by the first associated processing unit by the first associated processing unit, a sequence number field, a fragment number field, a first protocol number field, a length field and an identification field.
  • the sequence number field, the fragment number field and the first protocol number field can be obtained from the IP partial information IP.INFO in the message S.
  • the length field can be the length of DTATp, that is, DATAp.len.
  • the identification field can be a magic field.
  • the NTH field can be represented as PI+IP.INFO+DATAp.len+magic.
  • Step S430 Deliver the second packet Sp to the first associated processing network unit.
  • Step S440 The first path associated processing network unit may modify the protocol information in the header IP in the second message Sp to nth.
  • the modified IP can be represented by IPn.
  • the modified second message may be expressed as Spn.
  • Spn can be expressed as IPn+DATAp+NTH.
  • the first associated processing network unit can determine whether the size of the SPN exceeds the specified limit. If the size of the SPN does not exceed the specified limit, the first associated processing network unit can directly send the SPN. If the size of the Spn exceeds the specified limit, the first associated processing network element may fragment the Spn.
  • the first path-associated processing network unit can fragment the Spn according to the standard IP protocol to obtain multiple fragmented messages.
  • Multiple fragmented messages can be expressed as Spn-1: IPn1+DATA1, Spn-2: IPn2+DATA2, ..., Spn-(e-1): IPn(e-1)+DATA(e-1) and Spn-e: IPne+DATAe.
  • Spn-1 is the first fragmented message
  • Spn-e is the last fragmented message. It can be understood that Spn-e can be the first fragmented message, NTH at least exists in Spn-e, and the magic field belongs to Spn-e.
  • Step S450 The second associated processing node receives multiple fragmented messages.
  • the second associated processing node can determine whether the received message is a fragmented message. If it is a fragmented message, step S460 can be performed. If the received message is not a fragmented message, the second process can be performed without entering the reassembly process. As an implementation manner, if the message received by the second path-associated processing node is not a fragmented message, the protocol number in the header of the message may be modified to the protocol number recorded in the protocol field in the first field.
  • Step S460 For the received fragmented message, the second path-associated processing network unit can use the fragmented message with the same source address and sequence number in the header to construct a two-way linked list Next/Prev based on the fragment number from low to high. List.
  • the second path-associated processing network unit may reassemble the received multiple fragmented messages to obtain the second message Sp.
  • Step S470 The second associated processing network unit delivers the second packet Sp to the second associated processing unit.
  • the second path associated processing unit obtains additional information PI from the NTH of the second message Sp.
  • the second associated processing unit performs second processing on the DATAp according to the additional information PI.
  • NTH is removed and the IP packet length in Sp is modified.
  • the second message Sp can become the first message S.
  • Step S480 The second associated processing unit delivers the first message S to the second associated processing network unit.
  • Step S490 The second path-associated processing node sends the first message S to the target device.
  • Figure 5 is a schematic flow chart of a method for reassembling messages provided by an embodiment of the present disclosure.
  • the second associated processing node receives a fragmented message Spn-X, it can execute the method shown in Figure 5 to achieve reorganization of the original message (ie, the second message) to which Spn-X belongs.
  • the method shown in Figure 5 includes steps S510 to S590.
  • Step S510 Determine whether the end of Spn-X is a magic field.
  • Spn-X is the magic field, since the magic field is located at the end of the second packet, it can be determined that Spn-X is the last fragmented packet Spn-e.
  • step S520 can be performed.
  • step S590 can be performed, that is, waiting to receive subsequent fragmented messages.
  • Step S520 determine whether Spn-X includes the entire content of the NTH field.
  • step S530 If Spn-X does not include all the contents of the NTH field, the NTH field still exists in other fragmented packets, and step S530 can be performed. If Spn-S includes the entire content of the NTH field, step S540 may be performed.
  • Step S530 Starting from Spn-X, follow the order of the Prev List of the doubly linked list to determine whether multiple consecutive fragmented messages can construct a complete NTH.
  • step S540 can be performed.
  • step S530 if the complete NTH field cannot be constructed, step S590 can be performed, that is, waiting for subsequent fragmented messages.
  • Step S540 Extract the content in the NTH field. For example, one or more of the length field, sequence number field, and fragment number field in the NTH field can be extracted.
  • Step S550 Calculate the total length of all fragmented messages in the doubly linked list.
  • Step S560 Determine whether the total length of all fragmented messages in the doubly linked list is equal to the content indicated by the length field in the NTH.
  • step S590 is executed.
  • Step S570 Determine whether the sequence number and fragment number in the first fragment message header in the doubly linked list are equal to the indications in the sequence number field and fragment number field in the NTH.
  • step S580 If the sequence number and fragment number of the first fragmented message in the doubly linked list are equal to the indications in the sequence number field and fragment number field in the NTH, it can be further determined that the fragmented message in the doubly linked list is complete ( That is, the fragmented messages in the doubly linked list are all fragmented messages in the second message), and step S580 is executed. If the sequence number and fragment number of the first fragmented message in the doubly linked list are not equal to the indications in the sequence number field and fragment number field in the NTH, then the fragmented message in the doubly linked list is not the second fragmented message in the doubly linked list. For all fragmented messages, step S590 can be performed, that is, waiting to receive subsequent fragmented messages.
  • Step S580 Merge the fragmented messages in the doubly linked list.
  • the fragmented messages Spn-1 to Spn-e can be merged into the second message Sp according to the reassembly method of the standard IP protocol.
  • Figure 6 is a schematic structural diagram of a device 600 for processing messages provided by an embodiment of the present disclosure. Handle the report The device 600 of this document may run a first associated processing node, and the first associated processing node is communicatively connected with the second associated processing node.
  • the device 600 may include: a network processing chip 610 and a path associated processing chip 620.
  • the network processing chip 610 may be used to receive the first message.
  • the path-associated processing chip 620 may be configured to perform a first path-associated processing on the first message, and add a first field to the data part of the first message after the first path-associated processing to obtain a third In the second message, the first field includes additional information obtained through the first path associated processing.
  • the network processing chip 610 is also used to fragment the second message to obtain multiple fragmented messages.
  • the multiple fragmented messages include a first fragmented message.
  • the first fragmented message including the first field, and sending the first fragmentation message to the second associated path processing node.
  • the first field is located at the end of the second message.
  • the first field includes a first protocol number field, and the first protocol number field is used to record the original protocol number of the first message.
  • the network processing chip 610 is also used to: convert the The second protocol number field in the header of the first message is modified to a first protocol number, and the first protocol number is used to indicate that the first field is added to the data portion of the first message.
  • the first field includes a length field
  • the length field is used to indicate the length of the data part of the first message after the first associated processing, so that the second associated processing node determines the reception Whether the received fragmented message is complete.
  • the first field includes a sequence number field and a fragment number field, and the sequence number field and the fragment number are respectively used to record the sequence number and fragment number of the second message, so that the The second path associated processing node determines the first fragmented message of the second message.
  • the first field includes an identification field, and the identification field is used to mark that the first field is located in the first fragmented message.
  • the device 600 is a network card
  • the associated processing chip 620 is an encryption and decryption chip
  • the first associated processing is encryption processing
  • the second processing is decryption processing.
  • FIG. 7 is a schematic structural diagram of another device 700 for processing messages provided by an embodiment of the present disclosure.
  • the device 700 for processing messages may run a second associated processing node, and the first associated processing node is communicatively connected to the second associated processing node.
  • the device 700 may include: a network processing chip 710 and a path associated processing chip 720.
  • the network processing chip 710 may be configured to receive a first fragmented message, the first fragmented message belongs to multiple fragmented messages, the first fragmented message includes a first field, and parse the first fragmented message. Fragment the message to obtain the first field, and reassemble the multiple fragmented messages to obtain the second message;
  • the associated processing chip 720 may be used to delete the first field in the data part of the second message, and perform second processing on the second message with the first field deleted according to the first field. , get the first message, so
  • the first field includes additional information obtained by the first associated processing node performing a first associated processing on the first packet, and the second processing is determined by the additional information.
  • the network processing chip 710 is also configured to: add the first fragmented message to a doubly linked list; wherein the doubly linked list includes at least one fragmented message with equal source addresses and equal sequence numbers.
  • the first field is located at the end of the second message.
  • the first field includes a first protocol number field
  • the first protocol number field is used to record the original protocol number of the first message
  • the network processing chip 710 is also used to: convert the The second protocol number field in the header of the first message is modified to the original protocol number.
  • the first field includes a length field
  • the length field is used to indicate the length of the data part of the first message after the first path associated processing
  • the network processing chip 710 is also used to: According to the length field, it is determined whether the received fragmented message is complete.
  • the first field includes a sequence number field and a fragment number field, and the sequence number field and the fragment number are respectively used to record the sequence number and fragment number of the second message.
  • the network processing chip 710 is also configured to determine the first fragmented message of the second message according to the sequence number field and the fragment number field.
  • the first field includes an identification field, and the identification field is used to mark that the first field is located in the first fragmented message.
  • the device is a network card
  • the associated processing chip is an encryption and decryption chip
  • the first associated processing is encryption processing
  • the second processing is decryption processing.
  • the disclosed systems, devices and methods can be implemented in other ways.
  • the device embodiments described above are only illustrative.
  • the division of the units is only a logical function division. In actual implementation, there may be other division methods.
  • multiple units or components may be combined or can be integrated into another system, or some features can be ignored, or not implemented.
  • the coupling or direct coupling or communication connection between each other shown or discussed may be through some interfaces, and the indirect coupling or communication connection of the devices or units may be in electrical, mechanical or other forms.
  • the units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place, or they may be distributed to multiple network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the solution of this embodiment.
  • each functional unit in various embodiments of the present disclosure may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit.

Abstract

本公开提供了一种处理报文的方法及装置，所述方法由第一随路处理节点执行，所述第一随路处理节点与第二随路处理节点通信连接，所述方法包括：接收第一报文；对所述第一报文进行第一随路处理；在经过所述第一随路处理后的第一报文的数据部中添加第一字段，得到第二报文，所述第一字段包括经过所述第一随路处理得到的附加信息；对所述第二报文进行分片，得到多个分片报文，所述多个分片报文包括第一分片报文，所述第一分片报文包括所述第一字段；向所述第二随路处理节点发送所述第一分片报文。

Description

处理报文的方法及装置 技术领域
本公开涉及计算机网络技术领域，尤其涉及一种处理报文的方法及装置。
背景技术
在报文离开源设备到达目的设备之前，随路处理节点可以对报文进行随路处理。随路处理例如可以包括加密和/或解密处理。随路处理可能会导致报文长度增加。如果随路处理后的报文长度超过规定限制，则随路处理节点需要将报文进行分片或重组。分片或重组会增加随路处理节点的处理开销。
发明内容
有鉴于此，本公开提供了一种处理报文的方法及装置，以降低随路处理节点进行分片处理的开销。
第一方面，提供了一种处理报文的方法，所述方法由第一随路处理节点执行，所述第一随路处理节点与第二随路处理节点通信连接，所述方法包括：接收第一报文；对所述第一报文进行第一随路处理；在经过所述第一随路处理后的第一报文的数据部中添加第一字段，得到第二报文，所述第一字段包括经过所述第一随路处理的得到的附加信息；对所述第二报文进行分片，得到多个分片报文，所述多个分片报文包括第一分片报文，所述第一分片报文包括所述第一字段；向所述第二随路处理节点发送所述第一分片报文。
可选地，所述第一字段位于所述第二报文的末端。
可选地，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述方法还包括：将所述第一报文的首部中的第二协议号字段修改为第一协议号，所述第一协议号用于指示所述第一字段添加在所述第一报文的数据部。
可选地，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后第一报文的数据部的长度以使得所述第二随路处理节点判断接收到的分片报文是否完整。
可选地，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号字段分别用于记录所述第二报文的序列号和分片号，以便所述第二随路处理节点确定所述第二报文的第一个分片报文。
可选地，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
可选地，所述第一随路处理节点为网卡，所述第一随路处理为加密处理，所述第二 随路处理为解密处理。
第二方面，提供了一种处理报文的方法，所述方法由第二随路处理节点执行，所述第二随路处理节点与第一随路处理节点通信连接，所述方法包括：接收所述第一随路处理节点发送的第一分片报文，所述第一分片报文属于多个分片报文，所述第一分片报文包括第一字段；解析所述第一分片报文，以得到所述第一字段；对所述多个分片报文进行重组，得到第二报文；在所述第二报文的数据部中删除所述第一字段；根据所述第一字段，对删除所述第一字段的第二报文进行第二随路处理，得到第一报文，所述第一字段包括所述第一随路处理节点对所述第一报文进行第一随路处理得到的附加信息，所述第二随路处理由所述附加信息确定。
可选地，所述方法还包括：将所述第一分片报文添加至双向链表；其中，所述双向链表包括至少一个源地址相等且序列号相等的分片报文。
可选地，所述第一字段位于所述第二报文的末端。
可选地，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述方法还包括：将所述第一报文的首部中的第二协议号字段修改为所述原始协议号。
可选地，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后的第一报文的数据部的长度，所述方法还包括：根据所述长度字段，判断接收到的分片报文是否完整。
可选地，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号字段分别用于记录所述第二报文的序列号和分片号，所述方法还包括：根据所述序列号字段和所述分片号字段，确定所述第二报文的第一个分片报文。
可选地，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
可选地，所述第二随路处理节点为网卡，所述第一随路处理为加密处理，所述第二随路处理为解密处理。
第三方面，提供一种处理报文的装置，所述装置运行有第一随路处理节点，所述第一随路处理节点与第二随路处理节点通信连接，装置包括：网络处理芯片，用于接收第一报文；随路处理芯片，用于对所述第一报文进行第一随路处理，以及，在经过所述第一随路处理后的第一报文的数据部中添加第一字段，得到第二报文，所述第一字段包括经过所述第一随路处理得到的附加信息；所述网络处理芯片还用于对所述第二报文进行分片，得到多个分片报文，所述多个分片报文包括第一分片报文，所述第一分片报文包括所述第一字段，以及，向所述第二随路处理节点发送所述第一分片报文。
可选地，所述第一字段位于所述第二报文的末端。
可选地，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述网络处理芯片还用于：将所述第一报文的首部中的第二协议号字段修改为第一协议号，所述第一协议号用于指示所述第一字段添加在所述第一报文的数据部。
可选地，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后第一报文的数据部的长度以使得所述第二随路处理节点判断接收到的分片报文是否完整。
可选地，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号字段分别用于记录所述第二报文的序列号和分片号，以便所述第二随路处理节点确定所述第二报文的第一个分片报文。
可选地，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
可选地，所述装置为网卡，所述随路处理芯片为加解密芯片，所述第一随路处理为加密处理，所述第二随路处理为解密处理。
第四方面，提供一种处理报文的装置，所述装置运行有第二随路处理节点，所述第二随路处理节点与第一随路处理节点通信连接，所述装置包括：网络处理芯片，用于接收第一分片报文，所述第一分片报文属于多个分片报文，所述第一分片报文包括第一字段，以及解析所述第一分片报文，以得到所述第一字段，并对所述多个分片报文进行重组，得到第二报文；随路处理芯片，用于在所述第二报文的数据部中删除所述第一字段，并根据所述第一字段，对删除所述第一字段的第二报文进行第二随路处理，得到第一报文，所述第一字段包括所述第一随路处理节点对所述第一报文进行第一随路处理得到的附加信息，所述第二随路处理由所述附加信息确定。
可选地，所述网络处理芯片还用于：将所述第一分片报文添加至双向链表；其中，所述双向链表包括至少一个源地址相等且序列号相等的分片报文。
可选地，所述第一字段位于所述第二报文的末端。
可选地，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述网络处理芯片还用于：将所述第一报文的首部中的第二协议号字段修改为所述原始协议号。
可选地，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后的第一报文的数据部的长度，所述网络处理芯片还用于：根据所述长度字段，判断接收到的分片报文是否完整。
可选地，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号字段分别用于记录所述第二报文的序列号和分片号，所述网络处理芯片还用于：根据 所述序列号字段和所述分片号字段，确定所述第二报文的第一个分片报文。
可选地，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
可选地，所述装置为网卡，所述随路处理芯片为加解密芯片，所述第一随路处理为加密处理，所述第二随路处理为解密处理。
第五方面，提供一种计算机程序产品，包括可执行代码，当所述可执行代码被执行时，能够实现如第一方面或第二方面所述的方法。
可以理解的是，如果将包含经过第一随路处理得到的附加信息的第一字段添加至报文的首部，会导致分片过程中，多次拷贝第一字段。本公开通过将第一字段添加至第一报文的数据部，可以在分片过程中避免第一字段的数据拷贝的过程，从而可以提高随路处理分片重组的效率，进而降低随路处理节点的处理开销。
附图说明
图1为一种报文分片的方法示例图。
图2为本公开实施例提供的一种处理报文的方法的示意性流程图。
图3为本公开实施例提供的一种对第二报文进行分片的示例图。
图4为本公开实施例提供的另一种处理报文的方法的示意图。
图5为本公开实施例提供的一种重组报文的方法的示意性流程图。
图6为本公开实施例提供的一种处理报文的装置的示意性结构图。
图7为本公开实施例提供的另一种处理报文的装置的示意性结构图。
具体实施方式
下面将结合本公开实施例的附图，对本公开实施例中的技术方案进行清楚、完整地描述，显然，所描述的实施例仅是本公开一部分实施例，而不是全部的实施例。
随路处理
在基于网络的数据传输中，数据可以在网络设备之间传输。网络设备例如可以包括源端设备、目的设备、中间设备等。数据可以承载于报文中。源端设备对数据进行处理，形成可以在网络中传输的报文(例如IP报文)，并将报文传输至网络。报文离开源端设备后，可以经过中间设备，从而到达目的设备。源端设备可以包括源端主机或源端主机系统等设备。目的设备可以包括目的主机或目的主机系统等设备。中间设备可以包括网卡等设备。
中间设备可以对报文进行额外的处理。例如，中间设备可以对报文进行加密、解密、压缩或解压缩等处理。这些由中间设备进行的额外处理可以称为随路处理。可以理解的是，随路处理是在源端设备或目的设备外部进行的处理。因此，源端设备或目的设备的用户不会感知到随路处理，从而可以提高用户的使用体验。
以中间设备为安全网卡为例，安全网卡可以实现的随路处理包括：加密处理和/或解密处理。安全网卡可以包括加解密芯片和网络处理芯片。加解密芯片可以用于实现包括加密处理和/或解密处理。网络处理芯片可以用于实现与报文传输相关的处理。源端设备发送的报文可以经过第一安全网卡。第一安全网卡可以对报文进行加密处理，并将加密后的报文通过网络发送出去。在加密后的报文到达目的设备之前，可以经过第二安全网卡。第二安全网卡可以对加密后的报文进行解密处理，并将解密后的报文传输至目的设备。可以理解的是，通过安全网卡的加解密，可以实现数据的安全传输。用户通过源端设备发送的报文是未加密的，并且用于通过目的设备接收的报文也是未加密的。也就是说，用户在通过安全网卡进行数据的安全传输时，不会感受到加解密的过程。因此，通过安全网卡进行随路处理，可以提高用户的体验感。
在一些实施例中，中间设备可以称为随路处理设备。进行随路处理的网络节点可以称为随路处理节点。随路处理节点可以运行在中间设备上。
分片和重组
数据传输中，如果报文的长度大于规定值时，发送端(包括源设备和中间设备)可以对报文进行分片(或切割)，以形成多个较小的分片报文，再进行传输。接收端(包括中间设备和目的设备)可以对分片报文进行重组，从而恢复原始报文。
可以理解的是，在随路处理过程中，可以在报文中增加一些字段或者信息，这会导致报文的长度增加。当经过随路处理的报文的长度超过规定值时，中间设备可以对报文进行分片或重组。例如，用于加密的网卡可以对报文进行分片，用户解密的网卡可以对报文进行重组。
可以理解的是，中间设备接收到的报文可以为分片报文，中间设备可以对该分片报文进行二次分片。例如，中间设备可以对该分片报文进行随路处理，随路处理后，该分片报文的长度大于规定值，则中间设备可以对该分片报文进行二次分片。
报文可以包括首部和数据部。报文的首部可以用于指示报文传输所需要的信息。例如报文的首部可以包括以下信息中的一个或多个：协议号、序列号、分片号、报文长度、目的地址以及源地址等。
协议号可以用于指示传输协议的类型或版本。序列号可以用于指示分片报文所属的原数据报文。在重组的过程中，序列号相同的分片报文可以被合并为一个报文。分片号也可以称为偏移量，用于指示分片报文的数据部在原报文中的偏移，即该分片报文的数 据部相对于原报文的位置。在重组的过程中，可以根据分片号将分片报文还原到合适的位置。分片和重组的例如可以根据标准IP协议规定的方法实现。
图1为一种报文分片的方法示例图。下面结合图1说明报文分片的方法。
如图1所示，第一报文100可以被切割为分片报文110～分片报文140。由图中可以看出，较长的数据部1被分割成了4个较短的部分，分别为数据部2、数据部3、数据部4和数据部5。数据部2、数据部3、数据部4和数据部5分别构成了分片报文110～分片报文140的数据部。可以理解的是，数据部2～数据部5的总长度等于数据部1的长度。
分片报文的首部中的大多数信息均可以拷贝自第一报文100的首部1。例如，分片报文的首部中的协议号、序列号、目的地址以及源地址等信息均可以拷贝自第一报文100的首部1，即这些字段可以与首部1中的对应字段保持一致。分片报文的少数字段会存在差异，例如，不同分片报文的分片号可以不同。
不同的分片报文的分片号可以根据分片报文的数据部在第一分片报文中的位置确定。以图1为例，分片报文110为第一报文100的第一个分片报文，则分片报文110与第一报文100之间的偏移为0，则分片报文110与第一报文100的分片号一致。例如，第一报文100的分片号为0，则分片报文110的分片号也为0。或者，第一报文100可以是某一报文的分片报文，即第一报文100的分片号可以不为0。例如，第一报文100的分片号为175，则分片报文110的分片号也可以为175。分片报文140为第一报文100的最后一个分片报文，如果分片报文140的数据部相对于第一报文100的偏移量为525，则分片报文140的分片号可以为第一报文110的分片号加上525。
接收端可以对接收到的分片报文进行重组。在接收端，由同一报文分片的多个分片报文可以组成一个链表。例如，源地址以及序列号相等的分片报文可以构成一个分片号由低到高的单向列表。接收端接收到的分片报文是完整的，才可以实现重组。也就是说，只有在接收端接收到了所有的分片报文的情况下，才可以实现报文的重组。相关技术可以在每接收到一个分片报文时，进行一次试重组。如果试重组成功了，即说明接收端接收到了所有的分片报文，则接收端可以对所有分片报文进行合并，从而恢复原报文。例如，可以根据单向链表，从第一个分片报文开始实现合并。
由上文可知，随路处理可能会导致报文长度增加。如果随路处理后的报文长度超过规定限制，则随路处理节点需要将报文进行分片处理。可以理解的是，分片处理会增加随路处理节点的处理开销。
针对上述问题，本公开提出了一种处理报文的方法。图2为本公开实施例提供的一种处理报文的方法的示意性流程图。图2所示的方法可以由第一随路处理节点和第二随路处理节点执行。第一随路处理节点可以和第二随路处理节点通信连接。图2所示的方法可以包括步骤S210～步骤S290。其中，步骤S210～步骤S250可以由第一随路处理节 点执行，步骤S250～步骤S290可以由第二随路处理节点执行。第一随路处理节点或第二随路处理节点可以为中间设备，例如网卡。
步骤S210，接收第一报文。
本公开不限制第一报文的发送方。以第一随路处理节点为网卡为例，第一报文的发送方可以为源端设备。
第一报文可以包括首部和数据部。例如，S可以用于指示第一报文，IP可以用于指示第一报文的首部，DATA可以用于指示第一报文的数据部。也就是说，S可以表示为IP+DATA。
第一报文可以是源端设备已经封装好且能够在网络中传输的报文。例如，第一报文可以是IP报文。
步骤S220，对第一报文进行第一随路处理。
第一随路处理可以为第一随路处理节点对第一报文进行的随路处理。例如，第一随路处理可以为加密处理。第二随路处理节点可以进行与第一随路处理对应的第二随路处理。例如，第二随路处理可以为解密处理。
经过第一随路处理的第一报文可以表示为Sp。可以理解的是，经过第一随路处理，第一报文的数据部可以发生变化。例如，经过第一随路处理，DATA可以变为DATAp，即Sp可以表示为IP+DATAp。
步骤S230，在经过第一随路处理后的第一报文的数据部添加第一字段，得到第二报文。
第一字段可以包括经过第一随路处理得到的附加信息。附加信息例如可以表示为PI。以第一随路处理为加密处理为例，附加信息可以包括如何进行解密的信息。
第一字段可以添加在DATAp的任意位置。例如，第一字段可以添加在DATAp的最开始部分、最后部分或中间任意位置。也就是说，第一字段可以位于第二报文的数据部的首端、末端或中部。如图3所示，第一字段可以位于第二报文300的末端。
可以理解的是，对于第一字段位于第二报文的末端的情况，在添加第一字段时，可以直接在DATAp的末端添加第一字段。也就是说，不需要在Sp的中间的某一插入点插入第一字段，也不需要将插入点后的比特向后移动，从而不需要底层硬件支持分散(scatter/gather)读写功能，进而简化了第一随路处理节点的硬件结构。
可以理解的是，由第一报文形成第二报文的过程中，报文的数据部长度发生了变化。因此，第二报文的首部中的报文长度也可以进行适应性修改。例如，第二报文的首部中的报文长度可以修改为第一报文经过第一随路处理并添加第一字段后得到第二报文的数据部的总长度。
在一些实施例中，第一字段也可以称为网络传输头(network transmission header，NTH)字段。
步骤S240，对第二报文进行分片，得到多个分片报文。
可以理解的是，如果第二报文的长度大于规定值，则可以执行步骤S240，从而对第二报文进行分片。如果第二报文的长度没有大于规定值，则可以直接将第二报文发送出去。其中，规定值例如可以为最大传输单元(maximum transmission unit，MTU)。
多个分片报文可以包括第一分片报文，第一分片报文可以包括第一字段。可以理解的是，第一字段可以被分在至少一个分片报文中，即第一分片报文可以包括全部或部分的第一字段。
本公开不限制对第二报文进行分片使用的分片方法。例如，可以通过标准IP协议的分片方法进行分片。
图3为本公开实施例提供的一种对第二报文进行分片的示例图。如图3所示，第一字段位于第二报文300的末端。第二报文300可以被切割为多个分片报文310～340。分片报文340可以为第二报文300的最后一个分片报文。第一字段可以被分割到分片报文340中，即第一分片报文可以为分片报文340。
可以理解的是，由第二报文分片产生的多个分片报文的首部的源地址、目的地址、序列号均是相同的。
步骤S250，第一随路处理节点将第一分片报文发送至第二随路处理节点。
第一分片报文可以直接由第一随路处理节点发送至第二随路处理节点。第一分片报文也可以经过一个或多个网络设备后发送至第二随路处理节点。
步骤S260，解析第一分片报文，以得到第一字段。
可选的，第二随路处理节点可以判断第一字段的全部内容是否在第一分片报文中。如果第一字段的全部内容均在第一分片报文中，则可以直接取出第一字段。如果第一分片报文中包括第一字段的部分内容，则可以结合其他分片报文，得到第一字段。
步骤S270，对所述多个分片报文进行重组，得到第二报文。
本公开不限制对多个分片报文进行重组的方法。例如，可以使用标准IP协议的重组方法对多个分片报文进行重组。
步骤S280，在第二报文的数据部中删除第一字段。
可以理解的是，第一字段包括的内容并非实际传输的用户数据。删除第一字段后，第二报文的数据部包含的均可以为实际传输的数据内容。
步骤S290，根据第一字段，对删除第一字段的第二报文进行第二处理，得到第一报 文。
第二处理与第一随路处理对应，也就是说，第一报文经过第一随路处理和第二处理后，依然为第一报文的原始形态。如上文所述，第一字段包括经过第一随路处理得到的附加信息，因此，第二随路处理节点可以根据第一字段中第一随路处理的附加信息，对删除第一字段的第二报文进行第二处理，从而获得第一随路处理节点原始接收到的第一报文。
第二随路处理节点可以根据第一字段实现对应的随路处理。第一字段可以包括经过第一随路处理得到的附加信息。第二随路处理节点可以根据第一随路处理附加信息对重组完成后的报文进行第二处理，从而将报文恢复为第一随路处理节点接收到的第一报文。例如，第一随路处理可以为加密处理，第二处理可以为解密处理。附加信息可以为加解密的附加信息。第二随路处理节点可以根据加解密的附加信息进行第二处理，从而将报文解密还原。
可以理解的是，如果将包含随路处理的附加信息的第一字段添加至第一报文的首部，会导致分片过程中，多次拷贝第一字段。本公开通过将第一字段添加至第一报文(即原始报文)的数据部，可以在分片过程中避免第一字段的数据拷贝的过程，从而可以提高随路处理分片重组的效率，进而降低随路处理节点的处理开销。
作为一种实现方式，第二随路处理节点还可以根据第一字段实现分片报文的重组。例如，第二随路处理节点可以在接收到包括第一字段的分片报文(即第一分片报文)后，再进行分片报文的合并。也就是说，在接收到第一分片报文前，第二随路处理节点可以不进行分片报文的试重组。例如，第一字段可以位于第二报文的末端，则包括第一字段的第一分片报文可以为第二报文的最后一个分片报文。在一些情况下，最后一个分片报文可以最后到达第二随路处理节点。因此，在第二随路处理节点收到最后一个分片报文时，已经收到了大多数分片报文，或者收到了所有的分片报文，这种情况下，重组的成功概率更高。因此，图3所示的方法还可以实现报文快速重组，避免了多次反复试重组，从而可以实现高效的报文重组。
可选地，第一字段可以包括以下字段中的一项或多项：第一协议号字段、长度字段、序列号字段、分片号字段以及标识字段。
第一协议号字段可以用于记录第一报文的原始协议号。第一协议号可以记录第一报文的首部中第二协议号字段记录的协议号。图3所示的方法还可以包括将第一报文的首部中的第二协议号字段修改为第一协议号。第一协议号用于指示第一字段添加在数据部。第一协议号例如可以通过nth表示。第一报文分片后，生成的多个分片报文的首部指示的协议号均可以为nth。第二随路处理节点接收到分片报文后，如果检测到首部中包含的协议号为第一协议号，则可以确定第一字段添加在第一报文数据部，从而可以对接收到的分片报文进行相应的处理。
长度字段可以用于指示经过第一随路处理后的第一报文的数据部的长度。长度字段可以直接记录经过第一随路处理后的第一报文的数据部的长度。或者，长度字段可以记录第一报文在其他处理阶段的长度。或者长度字段可以记录第一报文其他部分的长度。第二随路处理节点可以通过长度字段计算得到经过第一随路处理后的第一报文的数据部的长度即可。
第二随路处理节点可以根据长度字段的指示，确定接收到的报文是否完整(即是否接收到了所有分片报文)。例如，第二随路处理节点可以计算首部中源地址以及序列号相同的分片报文的数据部的总长度。如果总长度与长度字段记录的长度相等，则可以确定接收到了所有分片报文，再将所有分片报文进行合并。可以理解的是，根据长度字段的指示和第二随路处理节点接收到的报文的数据部总长度，再进行分片报文的合并重组，可以快速重组而不需要反复多次进行试重组，从而使得重组效率更高。
序列号字段和分片号字段可以分别用于记录第二报文的序列号和分片号。可以理解的是，第二报文由第一报文生成，第二报文的序列号与第一报文的序列号相同，且第二报文的分片号和第一报文的分片号相同。因此，序列号字段和分片号字段也可以分别用于记录第一报文的序列号和分片号。
由上文可知，对报文进行分片后，第一个分片报文的序列号与原报文的序列号相等，且第一个分片报文的分片号与原报文的分片号也是相等的。因此，第二随路处理节点可以根据序列号字段和分片号字段，确定接收到的多个分片报文中哪个分片报文是第一个分片报文。例如，如果第二分片报文的首部中的序列号和分片号与序列号字段和分片号字段存储的内容相同，则可以确定第二分包报文为第一个分片报文。或者，可以从最后一个分片报文开始，沿着分片报文组成的链表向前查找长度字段的长度，从而初定第一片分片报文，如果初定的第一片分片报文的首部中的序列号和分片号和第一字段中序列号字段和分片号字段的内容一致，则可以确定初定的第一片分片报文为第一个分片报文。
标识字段可以用于标记第一字段所在的第一分片报文。例如，标识字段可以通过魔法数进行标记。在一些实施例中，标识字段也可以称为魔法(magic)字段。
第二随路处理节点可以接收到多个分片报文，多个分片报文中其中的部分分片报文(包括第一分片报文)中存在第一字段。第二随路处理节点即可通过标识字段确定多个分片报文中的哪一个为第一分片报文，从而根据第一分片报文进一步获取所有包括第一字段的分片报文，进而获取第一字段。
标识字段可以位于第一字段的末尾。标识字段标记的第一分片报文为包含第一字段的最后一个分片报文。如果第一分片中的第一字段不是完整的，则可以向前一分片报文或前几个分片报文中检索剩余的第一字段，从而获取完整的第一字段。
第二随路处理单元可以构建双向链表。双向链表包括源地址相等且序列号相等的至少一个分片报文。第二随路处理单元可以在接收到分片报文后，将分片报文添加至 对应的双向链表中。双向链表可以根据分片号的顺序构建。例如，双向链表可以基于分片号由低到高构建。基于由低到高的分片号顺序，双向链表可以表示为Next List。或者，基于由高到低的分片号顺序，双向链表可以表示为Prev List。双向链表可以使得分片报文向前和/或向后检索其他分片报文。例如，从第一分片报文开始，可以向两个方向检索，以确定双向链表的长度，从而获取已经接收到的分片报文的总长度。或者，从第一分片报文开始，可以向前检索，根据报文长度等参数，初定第一个分片报文。
图4为本公开实施例提供的另一种处理报文的方法的示意图。图4所示的方法可以由源端设备、第一随路处理节点、第二随路处理节点和目的设备执行。第一随路处理节点或第二随路处理节点可以运行于网卡。第一随路处理节点可以包括第一随路处理单元和第一随路处理网络单元。第二随路处理节点可以包括第二随路处理单元和第二随路处理网络单元。图4所示的方法可以包括步骤S410～步骤S490。
步骤S410，源端设备发出第一报文S。S可以包括首部IP和数据部DATA。第一随路处理节点收到第一报文S。第一随路处理节点的第一随路处理网络单元可以接收第一报文S。
步骤S420，第一随路处理节点将第一报文S交由第一随路处理单元处理。
第一随路处理单元可以对第一报文S进行第一随路处理。经过第一随路处理的第一报文的数据部可以通过DATAp表示。也就是说，经过第一随路处理后的第一报文为IP+DATAp。
完成第一随路处理后，第一随路处理单元可以在S的最后部分添加第一字段NTH，并且修改IP的报文长度信息。则第一报文变S变为第二报文Sp，Sp包括IP+DATAp+NTH。
NTH字段可以包括：第一随路处理单元进行第一随路处理产生的附加信息PI、序列号字段、分片号字段、第一协议号字段、长度字段以及标识字段。其中，序列号字段、分片号字段以及第一协议号字段可以由报文S中IP的部分信息IP.INFO获得。长度字段可以为DTATp的长度，即DATAp.len。标识字段可以为magic字段。例如，NTH字段可以表示为PI+IP.INFO+DATAp.len+magic。
步骤S430，将第二报文Sp交由第一随路处理网络单元。
步骤S440，第一随路处理网络单元可以将第二报文Sp中首部IP中的协议信息修改为nth。修改后的IP可以通过IPn表示。修改后的第二报文可以表示为Spn。Spn可以表示为IPn+DATAp+NTH。
第一随路处理网络单元可以判断Spn的大小是否超过规定限制。如果Spn的大小没有超过规定限制，则第一随路处理网络单元可以直接将Spn发送出去。如果Spn的大小超过了规定限制，则第一随路处理网络单元可以将Spn分片。
第一随路处理网络单元可以按照标准IP协议对Spn进行分片处理，得到多个分片报文。多个分片报文可以表示为Spn-1：IPn1+DATA1、Spn-2：IPn2+DATA2、……、Spn-(e-1)：IPn(e-1)+DATA(e-1)以及Spn-e：IPne+DATAe。其中，Spn-1为第一个分片报文，Spn-e为最后一个分片报文。可以理解的是，Spn-e可以为第一分片报文，NTH至少存在在Spn-e中，并且magic字段属于Spn-e中。
步骤S450，第二随路处理节点接收多个分片报文。
第二随路处理节点接收到报文后，可以判断接收到的报文是否为分片报文。如果是分片报文，则可以进行步骤S460。如果接收到的报文不是分片报文，则可以不进入重组流程而进行第二处理。作为一种实现方式，如果第二随路处理节点接收到的报文不是分片报文，则可以修改该报文的头部中的协议号为第一字段中协议字段记录的协议号。
步骤S460，针对收到的分片报文，第二随路处理网络单元可以使用首部中源地址以及序列号相等的分片报文构建一个基于分片号由低到高的双向链表Next/Prev List。
第二随路处理网络单元可以对接收到的多个分片报文进行重组处理，得到第二报文Sp。
报文的重组方法可以参见图5。关于图5的详细介绍，可以参见下文，此处不再赘述。
步骤S470，第二随路处理网络单元将第二报文Sp交由第二随路处理单元。
第二随路处理单元从第二报文Sp的NTH获取附加信息PI。第二随路处理单元根据附加信息PI对DATAp进行第二处理。第二处理完成后，去掉NTH并修改Sp中的IP的报文长度。第二报文Sp即可变为第一报文S。
步骤S480，第二随路处理单元将第一报文S交由第二随路处理网络单元。
步骤S490，第二随路处理节点将第一报文S发送到目标设备。
图5为本公开实施例提供的一种重组报文的方法的示意性流程图。当第二随路处理节点接收到一个分片报文Spn-X时，可以执行图5所示的方法，从而实现Spn-X所属的原报文(即第二报文)的重组。图5所示的方法包括步骤S510～步骤S590。
步骤S510，判断Spn-X的尾端是否为magic字段。
如果Spn-X的尾端为magic字段，由于magic字段位于第二报文的最后，则可以确定Spn-X为最后一个分片报文Spn-e。
如果Spn-X的尾端为magic字段，则可以执行步骤S520。
如果Spn-X的尾端不是magic字段，则可以执行步骤S590，即等待接收后续分片报文。
步骤S520，判断Spn-X是否包括NTH字段的全部内容。
如果Spn-X不包括NTH字段的全部内容，则NTH字段还存在于其他分片报文中，可以执行步骤S530。如果Spn-S包括NTH字段的全部内容，则可以执行步骤S540。
步骤S530，从Spn-X开始，沿着双向链表的Prev List的顺序，判断连续的多个分片报文是否可以构建完整的NTH。
在步骤S530中，如果可以构建完整的NTH字段，则可以执行步骤S540。
在步骤S530中，如果无法构建完整的NTH字段，则可以执行步骤S590，即等待后续分片报文。
步骤S540，提取NTH字段中的内容。例如，可以提取NTH字段中的长度字段、序列号字段以及分片号字段中的一个或多个。
步骤S550，计算双向链表中所有分片报文的总长度。
步骤S560，判断双向链表中的所有分片报文的总长度是否与NTH中长度字段指示的内容相等。
可以理解的是，双向链表中的所有分片报文的总长度与NTH中长度字段指示的内容相等，则可以初步判定第二随路处理节点已经收到了第二报文的所有分片报文。如果双向链表中的所有分片报文的总长度不与NTH中长度字段指示的内容相等，则第二随路处理节点没有收到了第二报文的所有分片报文，需要继续接收分片报文，即执行步骤S590。
步骤S570，判断双向链表中的第一片分片报文首部的序列号和分片号是否与NTH中序列号字段和分片号字段的指示相等。
如果双向链表中的第一片分片报文的序列号和分片号与NTH中序列号字段和分片号字段的指示相等，则可以进一步确定双向链表中的分片报文是完整的(即双向链表中的分片报文为第二报文中的所有分片报文)，并执行步骤S580。如果双向链表中的第一片分片报文的序列号和分片号与NTH中序列号字段和分片号字段的指示不相等，则双向链表中的分片报文不是第二报文中的所有分片报文，可以执行步骤S590，即等待接收后续分片报文。
步骤S580，合并双向链表中的分片报文。例如可以按照标准IP协议的重组方法将Spn-1到Spn-e分片报文合并为第二报文Sp。
上文结合图2～图5详细介绍了本公开的方法实施例。下面结合图6～图7介绍本公开的装置实施例。可以理解的是，装置实施例与方法对应，未详细描述的部分可以参见方法实施例。
图6为本公开实施例提供的一种处理报文的装置600的示意性结构图。处理报 文的装置600可以运行有第一随路处理节点，所述第一随路处理节点与第二随路处理节点通信连接。装置600可以包括：网络处理芯片610和随路处理芯片620。
网络处理芯片610可以用于接收第一报文。
随路处理芯片620可以用于对所述第一报文进行第一随路处理，以及，在经过所述第一随路处理后的第一报文的数据部中添加第一字段，得到第二报文，所述第一字段包括经过所述第一随路处理得到的附加信息。
网络处理芯片610还用于对所述第二报文进行分片，得到多个分片报文，所述多个分片报文包括第一分片报文，所述第一分片报文包括所述第一字段，以及，向所述第二随路处理节点发送所述第一分片报文。
可选地，所述第一字段位于所述第二报文的末端。
可选地，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述网络处理芯片610还用于：将所述第一报文的首部中的第二协议号字段修改为第一协议号，所述第一协议号用于指示所述第一字段添加在所述第一报文的数据部。
可选地，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后第一报文的数据部的长度以使得所述第二随路处理节点判断接收到的分片报文是否完整。
可选地，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号分别用于记录所述第二报文的序列号和分片号，以便所述第二随路处理节点确定所述第二报文的第一个分片报文。
可选地，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
可选地，所述装置600为网卡，所述随路处理芯片620为加解密芯片，所述第一随路处理为加密处理，所述第二处理为解密处理。
图7为本公开实施例提供的另一种处理报文的装置700的示意性结构图。处理报文的装置700可以运行有第二随路处理节点，第一随路处理节点与第二随路处理节点通信连接。装置700可以包括：网络处理芯片710和随路处理芯片720。
网络处理芯片710可以用于接收第一分片报文，所述第一分片报文属于多个分片报文，所述第一分片报文包括第一字段，以及解析所述第一分片报文，以得到所述第一字段，并对所述多个分片报文进行重组，得到第二报文；
随路处理芯片720可以用于在所述第二报文的数据部中删除所述第一字段，并根据所述第一字段，对删除所述第一字段的第二报文进行第二处理，得到第一报文，所 述第一字段包括所述第一随路处理节点对所述第一报文进行第一随路处理得到的附加信息，所述第二处理由所述附加信息确定。
可选地，所述网络处理芯片710还用于：将所述第一分片报文添加至双向链表；其中，所述双向链表包括至少一个源地址相等且序列号相等的分片报文。
可选地，所述第一字段位于所述第二报文的末端。
可选地，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述网络处理芯片710还用于：将所述第一报文的首部中的第二协议号字段修改为所述原始协议号。
可选地，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后的第一报文的数据部的长度，所述网络处理芯片710还用于：根据所述长度字段，判断接收到的分片报文是否完整。
可选地，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号分别用于记录所述第二报文的序列号和分片号，所述网络处理芯片710还用于：根据所述序列号字段和所述分片号字段，确定所述第二报文的第一个分片报文。
可选地，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
可选地，所述装置为网卡，所述随路处理芯片为加解密芯片，所述第一随路处理为加密处理，所述第二处理为解密处理。
本领域普通技术人员可以意识到，结合本公开实施例描述的各示例的单元及算法步骤，能够以电子硬件、或者计算机软件和电子硬件的结合来实现。这些功能究竟以硬件还是软件方式来执行，取决于技术方案的特定应用和设计约束条件。专业技术人员可以对每个特定的应用来使用不同方法来实现所描述的功能，但是这种实现不应认为超出本公开的范围。
在本公开所提供的几个实施例中，应该理解到，所揭露的系统、装置和方法，可以通过其它的方式实现。例如，以上所描述的装置实施例仅仅是示意性的，例如，所述单元的划分，仅仅为一种逻辑功能划分，实际实现时可以有另外的划分方式，例如多个单元或组件可以结合或者可以集成到另一个系统，或一些特征可以忽略，或不执行。另一点，所显示或讨论的相互之间的耦合或直接耦合或通信连接可以是通过一些接口，装置或单元的间接耦合或通信连接，可以是电性，机械或其它的形式。
所述作为分离部件说明的单元可以是或者也可以不是物理上分开的，作为单元显示的部件可以是或者也可以不是物理单元，即可以位于一个地方，或者也可以分布到多个网络单元上。可以根据实际的需要选择其中的部分或者全部单元来实现本实施例方案的目的。
另外，在本公开各个实施例中的各功能单元可以集成在一个处理单元中，也可以是各个单元单独物理存在，也可以两个或两个以上单元集成在一个单元中。
以上所述，仅为本公开的具体实施方式，但本公开的保护范围并不局限于此，任何熟悉本技术领域的技术人员在本公开揭露的技术范围内，可轻易想到变化或替换，都应涵盖在本公开的保护范围之内。因此，本公开的保护范围应以所述权利要求的保护范围为准。
以上所述仅为本公开的较佳实施例而已，并不用以限制本公开，凡在本公开的精神和原则之内，所作的任何修改、等同替换等，均应包含在本公开的保护范围之内。

Claims (24)

  1. 一种处理报文的方法，所述方法由第一随路处理节点执行，所述第一随路处理节点与第二随路处理节点通信连接，所述方法包括：
    接收第一报文；
    对所述第一报文进行第一随路处理；
    在经过所述第一随路处理后的第一报文的数据部中添加第一字段，得到第二报文，所述第一字段包括经过所述第一随路处理得到的附加信息；
    对所述第二报文进行分片，得到多个分片报文，所述多个分片报文包括第一分片报文，所述第一分片报文包括所述第一字段；
    向所述第二随路处理节点发送所述第一分片报文。
  2. 根据权利要求1所述的方法，所述第一字段位于所述第二报文的末端。
  3. 根据权利要求1所述的方法，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述方法还包括：
    将所述第一报文的首部中的第二协议号字段修改为第一协议号，所述第一协议号用于指示所述第一字段添加在所述第一报文的数据部。
  4. 根据权利要求1所述的方法，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后第一报文的数据部的长度以使得所述第二随路处理节点判断接收到的分片报文是否完整。
  5. 根据权利要求1所述的方法，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号字段分别用于记录所述第二报文的序列号和分片号，以便所述第二随路处理节点确定所述第二报文的第一个分片报文。
  6. 根据权利要求1所述的方法，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
  7. 一种处理报文的方法，所述方法由第二随路处理节点执行，所述第二随路处理节点与第一随路处理节点通信连接，所述方法包括：
    接收所述第一随路处理节点发送的第一分片报文，所述第一分片报文属于多个分片报文，所述第一分片报文包括第一字段；
    解析所述第一分片报文，以得到所述第一字段；
    对所述多个分片报文进行重组，得到第二报文；
    在所述第二报文的数据部中删除所述第一字段；
    根据所述第一字段，对删除所述第一字段的第二报文进行第二随路处理，得到第一报文，所述第一字段包括所述第一随路处理节点对所述第一报文进行第一随路处理得到的附加信息，所述第二随路处理由所述附加信息确定。
  8. 根据权利要求7所述的方法，所述第一字段位于所述第二报文的末端。
  9. 根据权利要求7所述的方法，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述方法还包括：
    将所述第一报文的首部中的第二协议号字段修改为所述原始协议号。
  10. 根据权利要求7所述的方法，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后的第一报文的数据部的长度，所述方法还包括：
    根据所述长度字段，判断接收到的分片报文是否完整。
  11. 根据权利要求7所述的方法，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号字段分别用于记录所述第二报文的序列号和分片号，所述方法还包括：
    根据所述序列号字段和所述分片号字段，确定所述第二报文的第一个分片报文。
  12. 根据权利要求7所述的方法，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
  13. 一种处理报文的装置，所述装置运行有第一随路处理节点，所述第一随路处理节点与第二随路处理节点通信连接，装置包括：
    网络处理芯片，用于接收第一报文；
    随路处理芯片，用于对所述第一报文进行第一随路处理，以及，在经过所述第一随路处理后的第一报文的数据部中添加第一字段，得到第二报文，所述第一字段包括经过所述第一随路处理得到的附加信息；
    所述网络处理芯片还用于对所述第二报文进行分片，得到多个分片报文，所述多个分片报文包括第一分片报文，所述第一分片报文包括所述第一字段，以及，向所述第二随路处理节点发送所述第一分片报文。
  14. 根据权利要求13所述的装置，所述第一字段位于所述第二报文的末端。
  15. 根据权利要求13所述的装置，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述网络处理芯片还用于：
    将所述第一报文的首部中的第二协议号字段修改为第一协议号，所述第一协议号用于指示所述第一字段添加在所述第一报文的数据部。
  16. 根据权利要求13所述的装置，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后第一报文的数据部的长度以使得所述第二随路处理节点判断接收到的分片报文是否完整。
  17. 根据权利要求13所述的装置，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号字段分别用于记录所述第二报文的序列号和分片号，以便所述第二随路处理节点确定所述第二报文的第一个分片报文。
  18. 根据权利要求13所述的装置，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
  19. 一种处理报文的装置，所述装置运行有第二随路处理节点，所述第二随路处理节点与第一随路处理节点通信连接，所述装置包括：
    网络处理芯片，用于接收第一分片报文，所述第一分片报文属于多个分片报文，所述第一分片报文包括第一字段，以及解析所述第一分片报文，以得到所述第一字段，并 对所述多个分片报文进行重组，得到第二报文；
    随路处理芯片，用于在所述第二报文的数据部中删除所述第一字段，并根据所述第一字段，对删除所述第一字段的第二报文进行第二随路处理，得到第一报文，所述第一字段包括所述第一随路处理节点对所述第一报文进行第一随路处理得到的附加信息，所述第二随路处理由所述附加信息确定。
  20. 根据权利要求19所述的装置，所述第一字段位于所述第二报文的末端。
  21. 根据权利要求19所述的装置，所述第一字段包括第一协议号字段，所述第一协议号字段用于记录所述第一报文的原始协议号，所述网络处理芯片还用于：
    将所述第一报文的首部中的第二协议号字段修改为所述原始协议号。
  22. 根据权利要求19所述的装置，所述第一字段包括长度字段，所述长度字段用于指示经过所述第一随路处理后的第一报文的数据部的长度，所述网络处理芯片还用于：
    根据所述长度字段，判断接收到的分片报文是否完整。
  23. 根据权利要求19所述的装置，所述第一字段包括序列号字段和分片号字段，所述序列号字段和所述分片号字段分别用于记录所述第二报文的序列号和分片号，所述网络处理芯片还用于：
    根据所述序列号字段和所述分片号字段，确定所述第二报文的第一个分片报文。
  24. 根据权利要求19所述的装置，所述第一字段包括标识字段，所述标识字段用于标记所述第一字段位于所述第一分片报文中。
PCT/CN2023/086502 2022-04-12 2023-04-06 处理报文的方法及装置 WO2023197925A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202210383327.6 2022-04-12
CN202210383327.6A CN114615354A (zh) 2022-04-12 2022-04-12 处理报文的方法及装置

Publications (1)

Publication Number Publication Date
WO2023197925A1 true WO2023197925A1 (zh) 2023-10-19

Family

ID=81869708

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2023/086502 WO2023197925A1 (zh) 2022-04-12 2023-04-06 处理报文的方法及装置

Country Status (2)

Country Link
CN (1) CN114615354A (zh)
WO (1) WO2023197925A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114615354A (zh) * 2022-04-12 2022-06-10 支付宝(杭州)信息技术有限公司 处理报文的方法及装置

Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101803334A (zh) * 2007-07-23 2010-08-11 Savi技术公司 在射频识别系统中提供安全性的方法和设备
CN103595504A (zh) * 2013-11-04 2014-02-19 上海数字电视国家工程研究中心有限公司 数据包的封装方法及校验方法
JP2016092677A (ja) * 2014-11-07 2016-05-23 シャープ株式会社 通信システム及び通信装置
CN105981327A (zh) * 2013-12-15 2016-09-28 三星电子株式会社 安全通信方法和设备以及采用该方法和设备的多媒体装置
CN107065750A (zh) * 2017-05-15 2017-08-18 中国工程物理研究院计算机应用研究所 内生安全的工业控制网络动态防御方法
CN110071943A (zh) * 2019-05-28 2019-07-30 中国电子科技集团公司第三十研究所 密钥真随机变化的复合型高安全ip保密通信方法
CN111224974A (zh) * 2019-12-31 2020-06-02 北京安码科技有限公司 用于网络通信内容加密的方法、系统、电子设备及存储介质
CN112583822A (zh) * 2020-12-09 2021-03-30 海信视像科技股份有限公司 通信设备及通信方法
CN114050921A (zh) * 2021-10-29 2022-02-15 山东三未信安信息科技有限公司 一种fpga实现的基于udp的高速加密数据传输系统
CN114615354A (zh) * 2022-04-12 2022-06-10 支付宝(杭州)信息技术有限公司 处理报文的方法及装置

Patent Citations (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN101803334A (zh) * 2007-07-23 2010-08-11 Savi技术公司 在射频识别系统中提供安全性的方法和设备
CN103595504A (zh) * 2013-11-04 2014-02-19 上海数字电视国家工程研究中心有限公司 数据包的封装方法及校验方法
CN105981327A (zh) * 2013-12-15 2016-09-28 三星电子株式会社 安全通信方法和设备以及采用该方法和设备的多媒体装置
JP2016092677A (ja) * 2014-11-07 2016-05-23 シャープ株式会社 通信システム及び通信装置
CN107065750A (zh) * 2017-05-15 2017-08-18 中国工程物理研究院计算机应用研究所 内生安全的工业控制网络动态防御方法
CN110071943A (zh) * 2019-05-28 2019-07-30 中国电子科技集团公司第三十研究所 密钥真随机变化的复合型高安全ip保密通信方法
CN111224974A (zh) * 2019-12-31 2020-06-02 北京安码科技有限公司 用于网络通信内容加密的方法、系统、电子设备及存储介质
CN112583822A (zh) * 2020-12-09 2021-03-30 海信视像科技股份有限公司 通信设备及通信方法
CN114050921A (zh) * 2021-10-29 2022-02-15 山东三未信安信息科技有限公司 一种fpga实现的基于udp的高速加密数据传输系统
CN114615354A (zh) * 2022-04-12 2022-06-10 支付宝(杭州)信息技术有限公司 处理报文的方法及装置

Also Published As

Publication number Publication date
CN114615354A (zh) 2022-06-10

Similar Documents

Publication Publication Date Title
US7948921B1 (en) Automatic network optimization
CN109714292B (zh) 传输报文的方法与装置
US8416788B2 (en) Compression of data packets while maintaining endpoint-to-endpoint authentication
JP4813006B2 (ja) 安全なパケット・ベースのデータ・ブロードキャスティング・アーキテクチャ
US6970446B2 (en) Method and apparatus to provide inline encryption and decryption for a wireless station via data streaming over a fast network
US7143282B2 (en) Communication control scheme using proxy device and security protocol in combination
US7434045B1 (en) Method and apparatus for indexing an inbound security association database
US7194504B2 (en) System and method for representing and maintaining redundant data sets utilizing DNA transmission and transcription techniques
US7548532B2 (en) Method and apparatus to provide inline encryption and decryption for a wireless station via data streaming over a fast network
US20050243834A1 (en) Packet transfer method and device
WO2023197925A1 (zh) 处理报文的方法及装置
JP2002044135A (ja) 暗号装置及び暗号通信システム
JP2006524959A (ja) フレーマとネットワーク構成要素との間のインラインを処理するトランスペアレントｉｐｓｅｃ
AU2001238189A1 (en) System and method for representing and maintaining redundant data sets utilizing DNA transmission and transcription techniques
US9055039B1 (en) System and method for pipelined encryption in wireless network devices
KR100415554B1 (ko) 정보 보호 인터넷 프로토콜 패킷의 송수신 방법
CN114710558B (zh) 一种基于云存储的异步安全传输通道构建方法
US20200092268A1 (en) Decoding method and apparatus
CN111741034B (zh) 数据传输方法、第一终端和第二终端
US20060013122A1 (en) Method and apparatus for recovering a communications connection
CN106375177A (zh) 消息传输方法和装置
Mosko et al. Secure fragmentation for content centric networking
EP0464565A2 (en) Cryptography processor and method with optional status encoding
CN114629891A (zh) 文件传输方法、装置、电子设备及计算机可读存储介质
JP2010011122A (ja) 暗号化パケット処理システム

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 23787570

Country of ref document: EP

Kind code of ref document: A1