A method, device, system and storage medium for detecting packet loss

Abstract

The invention discloses a method, device, system and storage medium for detecting message loss. The method includes: when sending a first negotiation message to the responding party, constructing a detection message; wherein, the detection message uses To detect whether the multiple fragmented messages obtained after the first negotiation message is fragmented at the IP layer during transmission are lost; use a preset algorithm to calculate the first negotiation message to obtain the the first characteristic value of the first negotiation packet, and add the first characteristic value to the detection packet; send the first negotiation packet and the detection packet to the responder, for the responder to assemble the multiple received fragmented packets of the first negotiation packet into a second negotiation packet, and use the preset algorithm to calculate the first negotiation packet of the second negotiation packet. Two eigenvalues, judging whether the first eigenvalue is consistent with the second eigenvalue to determine whether there is a fragmented packet loss.

Description

technical field [0001] The invention relates to the technical field of the Internet, in particular to a method, device, system and storage medium for detecting packet loss. Background technique [0002] The key exchange protocol based on the national secret algorithm is defined in the "IPSec VPN Technical Specifications"; the key exchange protocol stipulates the use of encryption and signature separation of the double secret certificate for key negotiation and identity authentication; The encryption certificate is used for key negotiation and identity authentication, which not only enhances the security of the key exchange protocol, but also increases the length of the negotiation message. The negotiation message is very easy to exceed the interface MTU (Maximum Transmission Unit, the maximum transmission unit). Cause IP layer fragmentation; because some firewalls in the fragmented network will consider fragmented packets as fragmented attacks and prevent fragmented packets ...

AI Technical Summary

Problems solved by technology

[0002] The key exchange protocol based on the national secret algorithm is defined in the "IPSec VPN Technical Specifications"; the key exchange protocol stipulates the use of encryption and signature separation of the double secret certificate for key negotiation and identity authentication; The encryption certificate is used for key negotiation and identity authentication, which not only enhances the security of the key exchange protocol, but also increases the length of the negotiation message. The negotiation message is very easy to exceed the interface MTU (Maximum Transmission Unit, the maximum transmission unit). Cause IP layer fragmentation; because some firewalls in the fragmented network will consider fragmented packets as fragmented attacks and prevent fragmented packets from passing through, if the responder cannot obtain all fragmented packets, the key negotiation cannot succeed. As a result, IPSec (Internet Protocol Security, Internet Security Protocol) tunnels cannot be established; in key negotiation, large negotiation messages often occur, but due to the particularity of the national secret network, the relevant IP does not allow PING (Packet Internet Groper, Internet packet Explorer) detection, so it is impossible to troubleshoot the discarding of fragmented packets; in the existing technical specifications, no corresponding processing suggestions are provided for the loss of fragmented packets caused by IP layer fragmentation; Therefore, how to detect whether there is a fragmented packet loss during the key negotiation process of the national secret VPN (Virtual Private Network, virtual private network) has become a technical problem that those skilled in the art need to solve urgently

Images