Data processing method, device and apparatus and readable storage medium

Abstract

The invention discloses a data processing method, device and apparatus and a readable storage medium. The method comprises the steps of receivin fragment packets of a data packet; judging whether the fragmented packets are the first fragmented packets or not; if yes, storing first fragment packet flow information in the fragment packets into a hash chain table; if not, acquiring first fragment packet flow information corresponding to the fragment packets from the hash chain table; processing the fragmented packets by using a security processing strategy corresponding to the first packet flow information, wherein the security processing strategy is a security strategy in an IPSec protocol. According to the method, the matched security processing strategy can be directly determined based on the flow information of the first fragment packets without waiting for all fragment packets or recombining the fragment packets, so that the time for waiting for the fragment packets, the recombining of the fragment packets and the re-fragment processing step after the recombining of the fragment packets are saved, the effect of immediately processing after the fragment packets are received can be realized, the fragmented packet processing efficiency can be accelerated, the packet loss rate can be reduced, and the reliability of data transmission can be ensured.

Description

technical field [0001] The present invention relates to the technical field of information security, in particular to a data processing method, device, equipment and readable storage medium. Background technique [0002] The IPSec protocol is a set of architecture that implements network data security at the IP layer, and the data flow realizes the protection of IP data packets by matching the rules of the security policy SP. The rules of the security policy SP are composed of five tuples (source IP, destination IP, source port, destination port, protocol). When the TCP / UDP packet is not fragmented, it has complete quintuple information and can directly match the security policy SP to realize data protection. [0003] When the TCP / UDP packet is a fragmented packet, only the first fragmented packet has complete quintuple information, and the remaining fragmented packets do not have complete quintuple information and cannot be matched to the security policy SP. After the pro...

AI Technical Summary

Problems solved by technology

However, it will take a lot of time for the data packet to be reassembled and fragmented in the protocol stack, which will affect the transmission delay of the data packet and even cause a high packet loss rate

Images