A method for encrypting and decrypting data packets

Abstract

The invention relates to a data packet encryption and decryption technology and discloses a method for carrying out encryption and decryption processing on a data packet. The method particularly comprises the following steps: S1, receiving an Ethernet frame by a physical network card, judging whether the network card which receives the Ethernet frame belongs to bridge equipment, submitting the Ethernet frame to a bridge protocol stack if yes, and submitting the Ethernet frame to an IP (Internet Protocol) protocol stack if no; S2, identifying the Ethernet frame by the bridge protocol stack, identifying an attribute of the Ethernet frame if the Ethernet frame is a unicast frame, and directly carrying out processing by the bridge protocol stack if the Ethernet frame is a non-unicast frame; S3, when the attribute of the Ethernet frame is an IP data packet, submitting the data packet to the IP protocol stack; and S4, carrying out encryption and decryption processing on the data packet submitted to the IP protocol stack. The IP data frame is identified by the bridge protocol stack; the IP data packet is submitted to an upper layer (a transmission layer) to be subjected to VPN (Virtual Private Network) encryption and decryption processing; and by utilizing different processing modes of a link layer and the transmission layer on the data frame, the effect that IPSECVPN (Internet Protocol Security Virtual Private Network) equipment utilizes the IP protocol stack to carry out encryption and decryption processing on the data frame in a network bridge mode is implemented.

Description

technical field [0001] The invention relates to the technical field of information security, in particular to a method for encrypting and decrypting data packets. Background technique [0002] There are two deployment modes for PSEC VPN devices to access the network: gateway deployment mode and bridge deployment mode. In the gateway deployment mode, the internal and external network interfaces of the IPSEC VPN device have different routes, and act as a router or NAT conversion device to realize route forwarding, internal Internet access and external service. It is generally used in a new network or where the user plans to replace the original router / firewall with a VPN gateway. In the bridge deployment mode, IPSEC VPN is connected as a bridge device between routers (firewalls) and switches (back-end services), and transparently forwards all data except VPN packets. The bridge works at the data link layer and forwards frames according to the MAC address. The IPSEC protocol...

AI Technical Summary

Problems solved by technology

The bridge works at the data link layer and forwards frames according to the MAC address. The IPSEC protocol works at the transport layer. The IPSEC VPN device deployed in bridge mode forwards all data packets with non-local destination addresses, resulting in It is difficult to encrypt and decrypt data packets, and it is very complicated to implement encryption and decryption of data frames separately at the data link layer

Images