Message processing method and device, processor core, system on chip and network equipment

Abstract

The embodiment of the invention provides a message processing method and device, a processor core, a system on chip and network equipment, and relates to the technical field of network security, in the method, the SOC comprises a first processor core and a plurality of second processor cores. The first processor core receives an IPSec VPN message from the VPN tunnel, marks a tunnel number of the VPN tunnel to which the IPSec VPN message belongs and a sequence number in the message transmitted in the VPN tunnel to which the IPSec VPN message belongs for the received IPSec VPN message, and obtains a first system message; the plurality of second processor cores decrypt the first system message to obtain a second system message, and the second system message comprises a tunnel number and a sequence number in the corresponding first system message; and the first processor core processes the obtained second system message according to the sequence of the VPN tunnel transmission message and the tunnel number and the sequence number included in the second system message. According to the scheme, on the basis of ensuring the sequence of the messages, the processing capability of a multiprocessor core can be fully exerted.

Description

Technical Field

[0001] This application relates to the field of network security technology, and in particular to a message processing method, apparatus, processor core, system-on-a-chip, and network device. Background Technology

[0002] Data transmission between a company's branches and headquarters is conducted via a Virtual Private Network (VPN) using Internet Protocol Security (IPSec). Specifically, encrypted user packets are encapsulated within IPSec VPN packets and transmitted through an IPSec VPN tunnel.

[0003] In IPSec VPN scenarios, user packets are hidden in ciphertext within the IPSec VPN packets. Network devices cannot obtain the actual user information until the ciphertext is decrypted. To avoid out-of-order packet distribution and subsequent application problems, network devices need to distribute received IPSec VPN packets to the same Central Processing Unit (CPU) core for decryption. This cannot fully utilize the processing power of multiple CPU cores. Summary of the Invention

[0004] The purpose of this application is to provide a message processing method, apparatus, processor core, system-on-a-chip, and network device to fully utilize the processing power of a multi-processor core while ensuring message order. The specific technical solution is as follows:

[0005] In a first aspect, embodiments of this application provide a message processing method applied to a first processor core included in a system-on-a-chip, wherein the system-on-a-chip further includes multiple second processor cores, and the method includes:

[0006] Receive IPSec VPN packets from the VPN tunnel;

[0007] The first system message is obtained by marking the tunnel number of the VPN tunnel to which the received IPSec VPN message belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs;

[0008] The obtained first system message is sequentially sent to the plurality of second processor cores, so that the plurality of second processor cores decrypt the obtained first system message to obtain a second system message, the second system message including the tunnel number and sequence number in the corresponding first system message;

[0009] According to the order of VPN tunnel transmission messages, the obtained second system messages are processed based on the tunnel number and sequence number included in the obtained second system messages.

[0010] In some embodiments, each second processor core corresponds to a receive queue;

[0011] The step of sequentially sending the obtained first system message into the plurality of second processor cores includes: sequentially writing the obtained first system message into the receiving queue corresponding to the plurality of second processor cores, so that the plurality of second processor cores read the first system message from the corresponding receiving queue;

[0012] And / or,

[0013] Each second processor core corresponds to a first transmission queue; the first transmission queue is used to cache the second system messages obtained by the corresponding second processor core.

[0014] The step of processing the second system message according to the order of VPN tunnel transmission messages and based on the tunnel number and sequence number included in the obtained second system message includes: polling the first sending queue corresponding to the plurality of second processor cores to obtain the current second system message; if the system message corresponding to the previous sequence number included in the current second system message has been processed, then processing the current second system message.

[0015] In some embodiments, the first system message further includes a first user message; the second system message further includes a second user message and a discard flag or outgoing interface flag added by the second processor core; the second user message is the plaintext corresponding to the first user message;

[0016] The step of processing the obtained second system message according to the order of VPN tunnel transmission messages, based on the tunnel number and sequence number included in the obtained second system message, includes:

[0017] According to the order of VPN tunnel transmission messages, the second system message to be processed is determined based on the tunnel number and sequence number included in the obtained second system message;

[0018] If the second system message to be processed carries the discard flag, then the second system message to be processed is discarded;

[0019] If the second system message to be processed carries the current outgoing interface identifier, then the second user message included in the second system message to be processed is written into the second sending queue corresponding to the current outgoing interface identifier, so that the network interface corresponding to each outgoing interface identifier reads the second user message from the corresponding second sending queue and sends it.

[0020] In some embodiments, the first processor core is a microprocessor core, and the second processor core is a general-purpose processor core.

[0021] Secondly, embodiments of this application provide a message processing method, applied to any one of a plurality of second processor cores included in a system-on-a-chip, wherein the system-on-a-chip further includes a first processor core, and the method includes:

[0022] The first system message is obtained from the first processor core. The first system message is the system message obtained by the first processor core after marking the tunnel number of the VPN tunnel to which the IPSec VPN message from the VPN tunnel belongs, and the sequence number in the transmission message of the VPN tunnel.

[0023] The first system message is decrypted to obtain the second system message, which includes the tunnel number and sequence number from the first system message.

[0024] The second system message is sent to the first processor core, so that the first processor core processes the second system message according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the second system message.

[0025] In some embodiments, each second processor core corresponds to a receive queue; the receive queue is used to buffer first system messages from the first processor core.

[0026] The step of obtaining the first system message from the first processor core includes: reading the first system message from the receive queue corresponding to any of the second processor cores; and / or

[0027] Each second processor core corresponds to a first transmission queue;

[0028] The step of sending the second system message into the first processor core includes: writing the second system message into the first transmission queue corresponding to any second processor core, so that the first processor core reads the second system message from the first transmission queue corresponding to any second processor core.

[0029] In some embodiments, the first system message further includes a first user message;

[0030] The step of decrypting the first system message to obtain the second system message includes:

[0031] The first system message is decrypted to obtain the third system message, which includes the second user message, the tunnel number and sequence number in the first system message, and the second user message is the plaintext corresponding to the first user message.

[0032] If the second user message is a message processed locally by the on-chip system or an illegal message, then a discard flag is added to the third system message to obtain the second system message;

[0033] If the second user message is a message processed by other devices, then the outgoing interface identifier corresponding to the second user message is added to the third system message to obtain the second system message.

[0034] In some embodiments, the first processor core is a microprocessor core, and the second processor core is a general-purpose processor core.

[0035] Thirdly, embodiments of this application provide a message processing apparatus applied to a first processor core included in a system-on-a-chip, wherein the system-on-a-chip further includes multiple second processor cores, and the apparatus includes:

[0036] The receiving module is used to receive IPSec VPN packets from the VPN tunnel;

[0037] The tagging module is used to tag the received IPSec VPN message with the tunnel number of the VPN tunnel to which it belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs, so as to obtain the first system message;

[0038] The input module is used to sequentially send the obtained first system message to the plurality of second processor cores, so that the plurality of second processor cores can decrypt the obtained first system message to obtain a second system message, wherein the second system message includes the tunnel number and sequence number in the corresponding first system message;

[0039] The processing module is used to process the obtained second system messages according to the order of VPN tunnel transmission messages and based on the tunnel number and sequence number included in the obtained second system messages.

[0040] Fourthly, embodiments of this application provide a message processing apparatus applied to any one of a plurality of second processor cores included in a system-on-a-chip, wherein the system-on-a-chip further includes a first processor core, and the apparatus includes:

[0041] The acquisition module is used to acquire a first system message from the first processor core. The first system message is a system message obtained by the first processor core after marking the tunnel number of the VPN tunnel to which the IPSec VPN message from the VPN tunnel belongs, and the sequence number in the transmission message of the VPN tunnel.

[0042] The processing module is used to decrypt the first system message to obtain a second system message, wherein the second system message includes the tunnel number and sequence number in the first system message;

[0043] The input module is used to input the second system message into the first processor core, so that the first processor core processes the second system message according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the second system message.

[0044] Fifthly, embodiments of this application provide a processor core, including the apparatus provided in the third aspect, and / or the apparatus provided in the fourth aspect.

[0045] Sixthly, embodiments of this application provide a system-on-a-chip, including a first processor core and a plurality of second processor cores;

[0046] The first processor core receives IPSec VPN packets from a VPN tunnel; marks the received IPSec VPN packet with the tunnel number of the VPN tunnel to which it belongs, as well as the sequence number in the transmission packets of the VPN tunnel, to obtain a first system packet; and sequentially sends the obtained first system packet to the plurality of second processor cores.

[0047] The plurality of second processor cores decrypt the obtained first system message to obtain a second system message, the second system message including the tunnel number and sequence number in the corresponding first system message; and send the obtained second system message into the first processor core;

[0048] The first processor core processes the obtained second system message according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the obtained second system message.

[0049] In some embodiments, the system-on-chip further includes a message parser and a network interface;

[0050] The network interface receives network packets and sends the received network packets to the packet parser.

[0051] The packet parser parses the received network packets, identifies IPSec VPN packets from the VPN tunnel, and sends the IPSec VPN packets to the first processor core.

[0052] In some embodiments, each second processor core corresponds to a receive queue, and each second processor core corresponds to a first transmit queue;

[0053] The first processor core sequentially writes the obtained first system message into the receiving queue corresponding to the plurality of second processor cores;

[0054] The plurality of second processor cores read the first system message from the corresponding receive queue; and write the obtained second system message into the corresponding first send queue.

[0055] The first processor core polls the first transmission queue corresponding to the plurality of second processor cores to obtain the current second system message; if the system message corresponding to the previous sequence number of the current second system message has been processed, then the current second system message is processed.

[0056] In some embodiments, the system-on-a-chip further includes a network interface; the first system message further includes a first user message;

[0057] The plurality of second processor cores decrypt the obtained first system message to obtain a third system message. The third system message includes a second user message, a tunnel number and a sequence number from the corresponding first system message, and the second user message is the plaintext corresponding to the first user message. If the second user message is a message processed locally by the on-chip system, a discard flag is added to the third system message to obtain the second system message. If the second user message is a message processed by other devices, an outgoing interface flag corresponding to the second user message is added to the third system message to obtain the second system message.

[0058] The first processor core determines the second system message to be processed according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the obtained second system message; if the second system message to be processed carries the discard flag, the second system message to be processed is discarded; if the second system message to be processed carries the current outgoing interface flag, the second user message included in the second system message to be processed is written into the second sending queue corresponding to the current outgoing interface flag.

[0059] The network interface reads the second user message from the corresponding second transmission queue and sends it.

[0060] In a seventh aspect, embodiments of this application provide a network device, including any of the System-on-a-Chip (SoC) provided in the sixth aspect.

[0061] This application also provides a computer program product containing instructions that, when run on a computer, cause the computer to perform any of the methods provided in the first aspect or any of the methods provided in the second aspect.

[0062] Beneficial effects of the embodiments in this application:

[0063] In the technical solution provided in this application embodiment, a first processor core and multiple second processor cores are integrated on a System on a Chip (SOC). The first processor core marks the tunnel number of the VPN tunnel to which the IPSec VPN packet belongs, as well as the sequence number in the transmission packets of the VPN tunnel, and sequentially sends the obtained first system packets to the multiple second processor cores. In this way, the multiple second processor cores can decrypt and process IPSec VPN packets (i.e., first system packets) from the same VPN tunnel in parallel, fully utilizing the processing capabilities of multiple second processor cores (such as CPU cores).

[0064] Since the IPSec VPN packets processed by multiple second processor cores and the subsequent IPSec VPN packets processed by the first processor core all carry tunnel numbers and sequence numbers, and for IPSec VPN packets from the same VPN tunnel, their transmission order within the VPN tunnel represents their order within their respective flows, the first processor core further processes the decrypted IPSec VPN packets (i.e., the second system packets) according to the order in which the packets are transmitted within the VPN tunnel, based on the tunnel number and sequence number, thus ensuring the packet order. Therefore, in this embodiment, by utilizing the first processor core to number and distribute IPSec VPN packets and to further process the decrypted IPSec VPN packets, the processing power of the multi-processor core is fully utilized while ensuring the packet order.

[0065] Of course, implementing any product or method of this application does not necessarily require achieving all of the advantages described above at the same time. Attached Figure Description

[0066] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other embodiments can be obtained based on these drawings.

[0067] Figure 1 A schematic diagram illustrating data transmission between branches and headquarters;

[0068] Figure 2 A schematic diagram of the structure of an IPSec VPN packet;

[0069] Figure 3 This is a schematic diagram of an existing IPSec VPN packet processing scheme.

[0070] Figure 4 This is a schematic diagram of a first structure of a SOC provided in an embodiment of this application;

[0071] Figure 5 A schematic diagram of a first type of message processing method provided in an embodiment of this application;

[0072] Figure 6 This is a first schematic diagram of a message processing flow provided in an embodiment of this application;

[0073] Figure 7a A schematic diagram of a first system message provided in an embodiment of this application;

[0074] Figure 7b Based on Figure 7a The diagram shows a first type of schematic diagram of the second system message obtained from the first system message.

[0075] Figure 7c Based on Figure 7a The diagram shows a second type of schematic diagram of the second system message obtained from the first system message.

[0076] Figure 8 This is a schematic diagram of a second structure of the SOC provided in the embodiments of this application;

[0077] Figure 9 A second flowchart illustrating the message processing method provided in the embodiments of this application;

[0078] Figure 10 A third flowchart illustrating the message processing method provided in the embodiments of this application;

[0079] Figure 11 A fourth flowchart illustrating the message processing method provided in the embodiments of this application;

[0080] Figure 12 This is a second schematic diagram of the message processing flow provided in the embodiments of this application;

[0081] Figure 13 A fifth flowchart illustrating the message processing method provided in this application embodiment;

[0082] Figure 14 A sixth flowchart illustrating the message processing method provided in this application embodiment;

[0083] Figure 15 A schematic diagram of a first structure of a message processing apparatus provided in an embodiment of this application;

[0084] Figure 16 This is a schematic diagram of a second structure of the message processing apparatus provided in an embodiment of this application. Detailed Implementation

[0085] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those skilled in the art based on this application are within the scope of protection of this application.

[0086] For ease of understanding, the terms appearing in the embodiments of this application are explained below.

[0087] Internet Protocol Security (IPSec) is an open network protocol (IP) layer security framework developed by the Internet Engineering Task Force (IETF). It provides high-quality, cryptographically-based security guarantees for data transmitted over a network by establishing IPsec tunnels between specific communicating parties. IPsec is a traditional security technology for implementing Layer 3 Virtual Private Networks (VPNs).

[0088] System on a Chip (SOC): This is a technology that integrates core components such as a general-purpose central processing unit (such as a CPU), memory, business processor, and peripheral interfaces onto a single chip. It is widely used in fields such as smart cars, network equipment, and consumer electronics.

[0089] IPSec VPNs are widely used for data transmission between corporate branches and headquarters, such as Figure 1 As shown, with enterprise digital transformation and the acceleration and reduction of operator bandwidth, enterprises are increasingly leasing more operator bandwidth. This necessitates that IPSec VPN network devices possess stronger performance. IPSec VPN network devices are network devices that process IPSec VPN packets.

[0090] The structure of an IPSec VPN data packet (i.e., an IPSec VPN packet) is as follows: Figure 2As shown, an IPSec VPN packet includes an Ethernet (ETH) header, a VPN IP header, an Encapsulating Security Payload (ESP) header, a VPN payload, and an ESP trailer. When an IPSec VPN packet is transmitted over the network, the VPN payload is ciphertext, i.e., an encrypted user packet. This user packet includes a user IP header and a user payload; that is, the ciphertext is obtained by encrypting the user packet, and this ciphertext is encapsulated as the VPN payload within the IPSec VPN packet.

[0091] User messages are hidden in encrypted form within IPSec VPN packets. Network devices cannot obtain the actual user information until the IPSec VPN packets are decrypted. If the network device distributes the IPSec VPN packets to different CPU cores for processing, it will cause packet out-of-order delivery, leading to application problems. However, if the network device distributes the IPSec VPN packets to a single CPU core for decryption, while solving the packet out-of-order problem, it cannot fully utilize the processing power of multiple CPU cores.

[0092] Existing technology provides an IPSec VPN packet processing solution by adding a logic chip to the network device, such as... Figure 3 The network device shown adds a Field-Programmable Gate Array (FPGA) chip (i.e., a logic chip) outside the CPU. The FPGA chip integrates packet parsing, decryption, and traffic splitting functions. The FPGA chip parses packets from the network (Internet) to obtain IPSec VPN packets (i.e., IPSec VPN ciphertext), and then decrypts the IPSec VPN ciphertext, decrypting the encrypted packets (i.e., encrypted user packets) in the VPN payload into plaintext (i.e., decrypted packets), obtaining the IPSec VPN plaintext. Based on the user information (such as a 5-tuple) included in the decrypted packets, the network is split, and the IPSec VPN plaintext is sent to the CPU cores corresponding to the user information in CPU cores 1 to N for processing.

[0093] This approach requires additional logic chips in network devices, increasing their cost. Furthermore, logic chips are less flexible and struggle to adapt to various IPSec VPN encapsulation methods, such as Internet Protocol Version 4 (IPv4), Internet Protocol Version 6 (IPv6), Segment Routing Header (SRH), and Layer 2 Tunneling Protocol (L2TP).

[0094] To address the aforementioned issues, while ensuring message order, fully leveraging the processing power of multi-processor cores, reducing network equipment costs, and flexibly adapting to various IPSec VPN encapsulation methods, embodiments of this application provide a System-on-a-Chip (SOC), such as... Figure 4 As shown, the SOC 400 includes a first processor core 401 and multiple second processor cores 402.

[0095] In some embodiments, the first processor core 401 and the second processor core 402 can both be general-purpose processor cores, such as CPU cores. This scheme can fully utilize the processing power of multiple general-purpose processor cores serving as the second processor core 402, achieving high-performance IPSec VPN interconnection.

[0096] In some embodiments, the first processor core 401 can be a microprocessor core, and the second processor core 402 can be a general-purpose processor core. The first processor core 401 is implemented using a lower-cost microprocessor core, which reduces the cost of the SoC while fully utilizing the processing power of multiple general-purpose processor cores.

[0097] based on Figure 4 As shown in the SOC 400, this application embodiment provides a message processing method, such as... Figure 5 As shown, it includes the following steps:

[0098] Step S501: The first processor core 401 receives an IPSec VPN packet from the VPN tunnel;

[0099] In step S502, the first processor core 401 marks the tunnel number of the VPN tunnel to which the received IPSec VPN message belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs, and obtains the first system message.

[0100] In step S503, the first processor core 401 sequentially sends the obtained first system message to multiple second processor cores 402;

[0101] In step S504, multiple second processor cores decrypt the obtained first system message to obtain a second system message, which includes the tunnel number and sequence number from the corresponding first system message.

[0102] In step S505, multiple second processor cores 402 send the obtained second system message to the first processor core 401;

[0103] In step S506, the first processor core 401 processes the obtained second system message according to the order of the VPN tunnel transmission messages and the tunnel number and sequence number included in the obtained second system message.

[0104] In the technical solution provided in this application embodiment, a first processor core and multiple second processor cores are integrated on the SOC. The first processor core marks the tunnel number of the VPN tunnel to which the IPSec VPN packet belongs, as well as the sequence number in the transmission packet of the VPN tunnel, and sequentially sends the obtained first system packet to the multiple second processor cores. In this way, the multiple second processor cores can decrypt and process IPSec VPN packets (i.e., first system packets) from the same VPN tunnel in parallel, fully utilizing the processing capabilities of multiple second processor cores (such as CPU cores).

[0105] Since the IPSec VPN packets processed by multiple second processor cores and the subsequent IPSec VPN packets processed by the first processor core all carry tunnel numbers and sequence numbers, and for IPSec VPN packets from the same VPN tunnel, their transmission order within the VPN tunnel represents their order within their respective flows, the first processor core further processes the decrypted IPSec VPN packets (i.e., the second system packets) according to the order in which the packets are transmitted within the VPN tunnel, based on the tunnel number and sequence number, thus ensuring the packet order. Therefore, in this embodiment, by utilizing the first processor core to number and distribute IPSec VPN packets and to further process the decrypted IPSec VPN packets, the processing power of the multi-processor core is fully utilized while ensuring the packet order.

[0106] Furthermore, the technical solution provided in this application does not require additional logic chips, reducing network equipment costs; and the entire packet processing process is implemented using programmable software, making the mechanism flexible and easy to maintain, and adaptable to various IPSec VPN encapsulation methods such as IPv4, IPv6, SRH, and L2TP. This achieves a simple and efficient IPSec VPN packet processing solution, as well as a low-cost, high-performance, and flexible IPSec VPN network device.

[0107] In step S501 above, the VPN tunnel is a tunnel for transmitting IPSec VPN packets. There can be one or more VPN tunnels. The first processor core receives IPSec VPN packets through one or more VPN tunnels.

[0108] In step S502 above, the first system message is a system message that the second processor core can recognize.

[0109] For each received IPSec VPN packet, the first processor core can obtain the packet characteristics, such as the Security Parameter Index (SPI) in the ESP header, and the source and destination IP addresses in the VPN IP header. Using these extracted characteristics, it determines the VPN tunnel to which the IPSec VPN packet belongs and its sequence number within that tunnel's transmission. It then adds the tunnel number and sequence number to the IPSec VPN packet. The IPSec VPN packet with the added tunnel number and sequence number is the first system packet. The tunnel number can be identified using the SPI in the ESP header plus the source and destination IP addresses in the VPN IP header (i.e., the outer source and destination IP addresses of the tunnel), or it can be a unique identifier assigned by the first processor core.

[0110] In this embodiment of the application, the first processor core can obtain the first system message in the following manner.

[0111] Method 1: The first processor core adds a system header to the IPSec VPN packet. This system header includes the tunnel number and sequence number. The IPSec VPN packet with the added system header is the first system packet.

[0112] This method does not change the structure of the original IPSec VPN packet, making it easier for the subsequent second processor core to correctly process the IPSec VPN packet.

[0113] Method 2: The first processor core adds a system header to the IPSec VPN packet and adds a tunnel number and sequence number to the ESP tail included in the IPSec VPN packet. The IPSec VPN packet with the added system header, tunnel number and sequence number is the first system packet.

[0114] This method eliminates the need to adjust the information carried in the system header, making it easier for the first processor core to correctly process IPSec VPN packets.

[0115] In step S503 above, the first processor core can be pre-configured with the order of multiple second processor cores. According to this order, the first processor core determines the second processor core to which the currently obtained first system message needs to be sent, and then sends the currently obtained first system message to that second processor core.

[0116] For example Figure 6 The packet processing flow shown is as follows: VPN tunnel 1 transmits IPSec VPN packets 1 through 3, and VPN tunnel 2 transmits IPSec VPN packets 4 through 6. Processor core 1 (i.e., the first processor core) receives IPSec VPN packets in the following order: IPSec VPN packet 1, IPSec VPN packet 2, IPSec VPN packet 4, IPSec VPN packet 5, IPSec VPN packet 6, IPSec VPN packet 3. Processor core 1 adds a system header to each received IPSec VPN packet to mark the tunnel number and sequence number, obtaining the first system packet, such as... Figure 6 The system header for each IPSec VPN packet includes two XY numbers, where X represents the tunnel number (1 or 2) and Y represents the sequence number (1 to 3).

[0117] The processor cores 2 through 4 (i.e., the second processor cores) operate in the following order: processor core 2, processor core 3, and processor core 4. After obtaining the first system packet corresponding to IPSec VPN packet 1, processor core 1 sends the first system packet to processor core 2 in the order of processor cores 2 through 4. After obtaining the first system packet corresponding to IPSec VPN packet 2, it sends the first system packet to processor core 3 in the same order. Similarly, after obtaining the first system packet corresponding to IPSec VPN packet 4, it sends the first system packet to processor core 4 in the same order, and so on. Processor core 1 also sends IPSec VPN packets 5, 6, and 3 to processor cores 2 through 4 in that order. In this way, processor core 2 processes IPSec VPN packet 1 and IPSec VPN packet 5 in sequence, processor core 3 processes IPSec VPN packet 2 and IPSec VPN packet 6 in sequence, and processor core 4 processes IPSec VPN packet 4 and IPSec VPN packet 3 in sequence.

[0118] In step S504 above, for each second processor core, after receiving the first system message sent by the first processor core, the second processor core decrypts the first system message to obtain the plaintext second system message.

[0119] In this embodiment of the application, the structure of the first system message can be found in [reference needed]. Figure 7a As shown, the data includes a system header and an IPSec VPN message. The system header includes the tunnel number and sequence number. The IPSec VPN message includes encrypted messages (such as the first user message). The IPSec VPN message also includes an ETH header, an ESP header, etc. For details, please refer to [link to relevant documentation]. Figure 2 As shown.

[0120] The second processor core decrypts the first system message, including the first user message within the first system message. In this case, the structure of the second system message can be found in [reference needed]. Figure 7b As shown, the packet includes a system header and an IPSec VPN message. The system header includes the tunnel number and sequence number. The IPSec VPN message includes a decrypted message (such as the second user message), and also includes an ETH header, an ESP header, etc. The second user message is the plaintext corresponding to the first user message.

[0121] The second processor core decrypts the first system message. This includes decrypting the first user message within the first system message, and may also include table lookup and decapsulation operations. In this case, the structure of the second system message can be found in [reference needed]. Figure 7c As shown, it includes a system header and a second user message. The system header includes a tunnel number and a sequence number, and the second user message is the plaintext corresponding to the first user message.

[0122] In step S505 above, for each second processor core, after obtaining the second system message, the second processor core will send the second system message to the first processor core.

[0123] In step S506 above, the first processor core can obtain second system messages from multiple second processor cores. The second system messages carry tunnel numbers and sequence numbers. Based on the tunnel numbers and sequence numbers included in the second system messages, the VPN tunnel corresponding to the second system messages and the transmission order within that VPN tunnel can be determined.

[0124] For each VPN tunnel, the first processor core processes the second system messages corresponding to that VPN tunnel sequentially, according to the order in which the VPN tunnel transmits messages, and in combination with the tunnel number and sequence number included in the second system messages.

[0125] Still with Figure 6Let's take an example. After processing the second system packet (with system header 11) corresponding to IPSec VPN packet 1, processor core 1 obtains the second system packet (with system header 22) corresponding to IPSec VPN packet 5. In VPN tunnel 2, IPSec VPN packet 4 is transmitted before IPSec VPN packet 5. Since processor core 1 has not processed the second system packet (with system header 21) corresponding to IPSec VPN packet 4, it will not process the second system packet corresponding to IPSec VPN packet 5. After processing the second system packet (with system header 21) corresponding to IPSec VPN packet 4, it then processes the second system packet (with system header 22) corresponding to IPSec VPN packet 5.

[0126] In some embodiments, such as Figure 8 As shown, the SOC 400 may also include a packet parser 403 and a network interface 404. The packet parser 403 can be a service processor, and the SOC 400 may include one or more network interfaces 404, without limitation. Figure 8 As shown in the SOC 400, this application embodiment provides a message processing method, such as... Figure 9 As shown, it may include the following steps:

[0127] Step S901: Network interface 404 receives network packets and sends the received network packets to packet parser 403.

[0128] In this embodiment, network packets include IPSec VPN packets from the VPN tunnel, as well as other packets. The SOC's network interface receives various network packets and sends each received network packet to the packet parser.

[0129] In step S902, the packet parser 403 parses the received network packets to determine that the IPSec VPN packet comes from the VPN tunnel.

[0130] In this embodiment, the packet parser receives network packets sent from the network interface and performs simple classification of the network packets based on the packet structure (such as including VPN IP header and ESP header), the SPI in the ESP header, the security protocol identifier in the VPN IP header, and other packet characteristics. The received network packets are divided into IPSec VPN packets and non-IPSec VPN packets. In other words, IPSec VPN packets and non-IPSec VPN packets are found from the received network packets.

[0131] In step S903, the packet parser 403 sends the IPSec VPN packet to the first processor core 401;

[0132] The packet parser sends the found IPSec VPN packets to the first processor core for further processing. For non-IPSec VPN packets, the packet parser can directly send them to the second processor core for processing.

[0133] In step S904, the first processor core 401 marks the tunnel number of the VPN tunnel to which the received IPSec VPN message belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs, and obtains the first system message.

[0134] In step S905, the first processor core 401 sequentially sends the obtained first system message to multiple second processor cores 402;

[0135] In step S906, multiple second processor cores 402 decrypt the obtained first system message to obtain a second system message. The second system message includes the tunnel number and sequence number from the corresponding first system message.

[0136] In step S907, multiple second processor cores 402 send the obtained second system message to the first processor core 401;

[0137] In step S908, the first processor core 401 processes the obtained second system message according to the order of the VPN tunnel transmission messages and the tunnel number and sequence number included in the obtained second system message.

[0138] Steps S904 to S908 are the same as steps S502 to S506, and will not be repeated here.

[0139] In this embodiment, the packet parser performs simple classification of the received network packets. The packet parser has a simple structure and does not increase the equipment cost excessively. Furthermore, the simple classification of network packets by the packet parser allows the first processor core to focus on processing IPSec VPN packets, simplifying the complexity of the programming software in the first processor core and making it easier to maintain.

[0140] based on Figure 4 or Figure 8 As shown in the SOC 400, this application embodiment provides a message processing method, such as... Figure 10 As shown. In this method, each second processor core corresponds to a receive queue, and each second processor core corresponds to a first transmit queue. The method may include the following steps:

[0141] Step S1001: The first processor core 401 receives an IPSec VPN packet from the VPN tunnel;

[0142] The first processor core can obtain IPSec VPN packets through steps S901-S902 described above. The first processor core can also receive network packets through the network interface and locate the IPSec VPN packet from the VPN tunnel within the received network packets.

[0143] In step S1002, the first processor core 401 marks the tunnel number of the VPN tunnel to which the received IPSec VPN message belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs, and obtains the first system message.

[0144] The steps S1001 to S1002 described above are the same as the steps S501 to S502 described above.

[0145] In step S1003, the first processor core 401 sequentially writes the obtained first system message into the receiving queues corresponding to multiple second processor cores 402.

[0146] In step S1004, multiple second processor cores 402 read the first system message from the corresponding receive queue;

[0147] In this embodiment, the SOC 400 pre-configures a corresponding receive queue for each second processor core, with a one-to-one correspondence between the second processor core and the receive queue. The receive queue is used to buffer the first system messages.

[0148] The first processor core determines which second processor core the first system message it has acquired needs to be sent to, and then writes the first system message into the receive queue corresponding to the second processor core. The second processor core then reads the first system message from the corresponding receive queue.

[0149] In step S1005, multiple second processor cores 402 decrypt the obtained first system message to obtain a second system message. The second system message includes the tunnel number and sequence number from the corresponding first system message. Step S1005 is the same as step S504.

[0150] In step S1006, multiple second processor cores 402 write the obtained second system message into the corresponding first transmission queue;

[0151] In this embodiment, the SOC 400 pre-configures a corresponding transmission queue (i.e., a first transmission queue) for each second processor core, with a one-to-one correspondence between the second processor core and the first transmission queue. The first transmission queue is used to buffer second system messages. After obtaining a second system message, a second processor core writes the second system message into the corresponding first transmission queue.

[0152] Step S1007: The first processor core 401 polls the first transmission queues corresponding to multiple second processor cores to obtain the current second system message;

[0153] Step S1008: If the system message corresponding to the previous sequence number of the current second system message has been processed, then the first processor core 401 processes the current second system message.

[0154] In this embodiment of the application, the first processor core polls multiple first transmission queues, and the second system message located at the top of the stack in the currently polled first transmission queue is the current second system message.

[0155] The first processor core detects whether the current second system message is a second system message to be processed, that is, whether the second system message with the previous sequence number corresponding to the same VPN tunnel has been processed. If the second system message with the previous sequence number has been processed, then the current second system message is a second system message to be processed. The first processor core reads the current second system message from the currently polled first sending queue and processes the current second system message.

[0156] If the second system message with the previous sequence number has not been processed, the first processor core may temporarily not process the current second system message and continue to execute step S1007 to poll multiple first sending queues.

[0157] In the technical solution provided in this application embodiment, each second processor core corresponds to a receive queue and a first send queue. The receive queue buffers the first system packets that need to be processed by the second processor core, so that packets will not be lost due to processing timeouts when the second processor core is busy. The first send queue buffers the second system packets obtained after processing by the second processor core. After the second processor core finishes processing the IPSec VPN packets, it does not need to wait for the second system packets to finish processing and can continuously execute other tasks, thereby improving the utilization rate of the second processor core resources.

[0158] In addition, the first processor core sequentially writes the first system messages into each receive queue and sequentially reads the second system messages from each first send queue, further ensuring the message order.

[0159] In this embodiment, the SOC 400 may be configured with only a receive queue, only a first transmit queue, or neither a receive queue nor a first transmit queue. For example, the SOC 400 may not be configured with a receive queue and a first transmit queue, but instead allocates a first cache space and a second cache space to multiple second processor cores; the first processor core writes the obtained first system message into the first cache space; the multiple second processor cores read the first system message from the first cache space in the order of writing time, and after obtaining the second system message, write the second system message into the second cache space; the first processor core reads the second system message from the second cache space in the order of writing time.

[0160] based on Figure 4 or Figure 8 As shown in the SOC 400, this application embodiment provides a message processing method, such as... Figure 11 As shown. In this method, each network interface corresponds to a second transmission queue, and the first system message also includes a first user message. The method may include the following steps:

[0161] Step S1101: The first processor core 401 receives an IPSec VPN packet from the VPN tunnel;

[0162] In step S1102, the first processor core 401 marks the tunnel number of the VPN tunnel to which the received IPSec VPN message belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs, and obtains the first system message.

[0163] In step S1103, the first processor core 401 sequentially sends the obtained first system message to multiple second processor cores 402;

[0164] The steps S1101 to S1103 above are the same as the steps S501 to S503 above.

[0165] In step S1104, multiple second processor cores 402 decrypt the obtained first system message to obtain a third system message. The third system message includes a second user message, the tunnel number and sequence number from the corresponding first system message, and the second user message is the plaintext corresponding to the first user message. If the second user message is a message processed locally by the on-chip system or an illegal message, then step S1105 is executed; if the second user message is a message processed by other devices, then step S1106 is executed.

[0166] In step S1105, multiple second processor cores 402 add a discard flag to the third system message to obtain the second system message; the second system message also includes the tunnel number and sequence number from the corresponding first system message;

[0167] In step S1106, multiple second processor cores 402 add the outgoing interface identifier corresponding to the second user message to the third system message to obtain the second system message; the second system message also includes the tunnel number and sequence number from the corresponding first system message;

[0168] For each second processor core, after receiving the first system message sent by the first processor core, the second processor core can decrypt the first user message in the first system message, and perform operations such as table lookup and decapsulation to obtain the plaintext third system message. The third system message includes the second user message, the tunnel number and the sequence number in the first system message.

[0169] For each second processor core, after obtaining the third system message, if the second processor core determines that the second user message included in the third system message is a message to be processed locally by the on-chip system, it can continue to process the second user message locally, and at the same time, mark the third system message with a discard flag to obtain the second system message.

[0170] For each second processor core, after receiving the third system message, if the second processor core determines that the second user message included in the third system message is a message that other devices on the chip need to process, i.e., the second user message needs to be forwarded, then it marks the outgoing interface identifier corresponding to the second user message on the third system message, thus obtaining the second system message. The outgoing interface identifier corresponding to the second user message can be obtained by the second processor core through a table lookup; the outgoing interface identifier is the identifier of the network interface.

[0171] In this embodiment of the application, the discard flag and the outgoing interface flag can be marked in the system header or in the message tail, and there is no limitation on this.

[0172] In step S1107, multiple second processor cores 402 send the obtained second system message to the first processor core 401; step S1107 is the same as step S505 above.

[0173] In step S1108, the first processor core 401 determines the second system message to be processed according to the order of the VPN tunnel transmission messages and the tunnel number and sequence number included in the obtained second system message; if the second system message to be processed carries a discard flag, then step S1109 is executed; if the second system message to be processed carries a current outgoing interface flag, then step S1110 is executed.

[0174] The first processor core can determine the second system message to be processed through the above steps S1006 to S1008, or it can use other methods, which are not limited.

[0175] Step S1109: The first processor core 401 discards the second system message to be processed;

[0176] In step S1110, the first processor core 401 writes the second user message included in the second system message to be processed into the second sending queue corresponding to the current outgoing interface identifier;

[0177] In this embodiment of the application, each network interface is configured with a corresponding sending queue, namely the second sending queue. The second sending queue is used to buffer the second user packets.

[0178] After the first processor core identifies the second system message to be processed, it checks the processing identifier carried by the second system message. If the processing identifier is a discard identifier, the first processor core discards the second system message; if the processing identifier is an outgoing interface identifier (i.e., the current outgoing interface identifier), the first processor core removes the system header of the second system message to obtain the second user message included in the second system message, and writes the second user message into the second transmission queue corresponding to the current outgoing interface identifier, that is, writes the second user message into the second transmission queue corresponding to the network interface indicated by the current outgoing interface identifier.

[0179] In some embodiments, the first processor core can determine the second system message to be processed through steps S1006 to S1008, which is the current second system message whose sequence number corresponds to the previous sequence number and has already been processed. In this case, the first processor core processes the second system message to be processed, which is to process the current second system message, including: if the current second system message carries a discard flag, then discard the current second system message; if the current second system message carries a current outgoing interface flag, then write the second user message included in the current second system message into the second transmission queue corresponding to the current outgoing interface flag.

[0180] In step S1111, network interface 404 reads the second user message from the corresponding second transmission queue and sends it.

[0181] In this embodiment, the SOC 400 may include multiple network interfaces. One network interface may read a second user message from its corresponding second transmit queue and transmit the read second user message.

[0182] In the technical solution provided in this application embodiment, the second processor core adds corresponding processing identifiers to the locally processed packets and the packets processed by other devices, and sends them to the first processor core. The first processor core can obtain all packets from the VPN tunnel and process the packets sequentially, avoiding the problem that the first processor core cannot process packets smoothly because some second system packets with certain sequence numbers are not sent to the first processor core.

[0183] The following is combined Figure 12The message processing flow shown illustrates the message processing method provided in this application embodiment. The SOC includes a network interface, a message parser, a microprocessor core (i.e., a first processor core), and general-purpose processor cores 1 to N. General-purpose processor cores 1 to N are respectively configured with receive queues 1 to N and send queues 1 to N.

[0184] Step a: The network interface receives network packets and sends them to the packet parser.

[0185] In step b, the packet parser identifies the IPSec VPN packet based on the packet characteristics of the network packet and sends the identified IPSec VPN packet to the microprocessor core. The IPSec VPN packet includes an encrypted packet (i.e., the first user packet).

[0186] Step c: The microprocessor core determines the VPN tunnel corresponding to the IPSec VPN packet based on the packet characteristics of the IPSec VPN packet, sequentially numbers the IPSec VPN packets in the same VPN tunnel, and then marks the tunnel number and sequence number of the VPN tunnel on the IPSec VPN packet to obtain the first system packet, and sends the first system packet sequentially into the receive queue 1 to receive queue N.

[0187] Step d: General-purpose processor cores 1 through N read the first system message from their respective receive queues, perform table lookup, decryption, and decapsulation operations, add a discard flag to the locally processed message, and add an outgoing interface flag to the message processed by other devices (i.e., forwarded message), thus obtaining the second system message. The second system message is then sent to the corresponding send queue; for example, general-purpose processor core 1 sends the second system message to send queue 1, and general-purpose processor core N sends the second system message to send queue N. The second system message includes the decrypted message (i.e., the second user message).

[0188] In step e, the microprocessor core sequentially polls transmission queues 1 through N. If the second system message at the top of the stack in the polled transmission queue is a message to be processed and includes a discard flag, then the second system message is a message to be discarded and is discarded. If the second system message at the top of the stack in the polled transmission queue is a message to be processed and includes an outgoing interface flag, then the second system message is a message to be forwarded and the plaintext message included in the second system message is sent to the transmission queue (i.e., the second transmission queue) of the network interface corresponding to the outgoing interface flag.

[0189] If there are no messages in sending queues 1 through N, the microprocessor core waits for messages to be written to sending queues 1 through N before processing the messages written to those queues.

[0190] The above-mentioned pending messages are the second system messages that have been processed in the previous sequence number of the corresponding VPN tunnel (second system messages).

[0191] In step f, the network interface reads plaintext packets from its own sending queue and sends them.

[0192] After that, the plaintext message is transmitted on the line.

[0193] In this embodiment, without adding any additional chip devices, a microprocessor core is used to distribute and maintain the order of IPSec VPN packets. While ensuring the order of encrypted packets, this fully utilizes the processing power of a general-purpose processor core, resulting in a simple and efficient IPSec VPN packet processing solution. The entire processing is implemented in programmable software, making the mechanism flexible and easy to maintain.

[0194] Corresponding to the above message processing method, this application embodiment also provides a message processing method, such as... Figure 13 As shown, the method applies to a first processor core included in a System-on-a-Chip (SOC), which also includes multiple second processor cores. The method includes the following steps:

[0195] Step S1301: Receive IPSec VPN packets from the VPN tunnel;

[0196] Step S1302: Mark the tunnel number of the VPN tunnel to which the received IPSec VPN message belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs, and obtain the first system message;

[0197] Step S1303: The obtained first system message is sequentially sent to multiple second processor cores so that the multiple second processor cores can decrypt the obtained first system message to obtain a second system message. The second system message includes the tunnel number and sequence number in the corresponding first system message.

[0198] Step S1304: Process the obtained second system message according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the obtained second system message.

[0199] In some embodiments, each second processor core corresponds to a receiving queue; step S1303 may include: sequentially writing the obtained first system message into the receiving queues corresponding to multiple second processor cores, so that multiple second processor cores read the first system message from the corresponding receiving queues.

[0200] In some embodiments, each second processor core corresponds to a first transmission queue; the first transmission queue is used to cache the second system message obtained by the corresponding second processor core; step S1304 may include: polling the first transmission queues corresponding to multiple second processor cores to obtain the current second system message; if the system message corresponding to the previous sequence number of the current second system message has been processed, then process the current second system message.

[0201] In some embodiments, the first system message further includes a first user message; the second system message further includes a second user message and a discard flag or outgoing interface flag added by the second processor core; the second user message is plaintext corresponding to the first user message; step S1304 may include: determining the second system message to be processed according to the order of VPN tunnel transmission messages, based on the tunnel number and sequence number included in the obtained second system message; if the second system message to be processed carries a discard flag, then discard the second system message to be processed; if the second system message to be processed carries a current outgoing interface flag, then write the second user message included in the second system message to be processed into the second sending queue corresponding to the current outgoing interface flag, so that the network interface corresponding to each outgoing interface flag reads the second user message from the corresponding second sending queue and sends it.

[0202] In some embodiments, the first processor core is a microprocessor core and the second processor core is a general-purpose processor core.

[0203] In the technical solution provided in this application embodiment, a first processor core and multiple second processor cores are integrated on the SOC. The first processor core marks the tunnel number of the VPN tunnel to which the IPSec VPN packet belongs, as well as the sequence number in the transmission packet of the VPN tunnel, and sequentially sends the obtained first system packet to the multiple second processor cores. In this way, the multiple second processor cores can decrypt and process IPSec VPN packets (i.e., first system packets) from the same VPN tunnel in parallel, fully utilizing the processing capabilities of multiple second processor cores (such as CPU cores).

[0204] Since the IPSec VPN packets processed by multiple second processor cores and the subsequent IPSec VPN packets processed by the first processor core all carry tunnel numbers and sequence numbers, and for IPSec VPN packets from the same VPN tunnel, their transmission order within the VPN tunnel represents their order within their respective flows, the first processor core further processes the decrypted IPSec VPN packets (i.e., the second system packets) according to the order in which the packets are transmitted within the VPN tunnel, based on the tunnel number and sequence number, thus ensuring the packet order. Therefore, in this embodiment, by utilizing the first processor core to number and distribute IPSec VPN packets and to further process the decrypted IPSec VPN packets, the processing power of the multi-processor core is fully utilized while ensuring the packet order.

[0205] Corresponding to the above message processing method, this application embodiment also provides a message processing method, such as... Figure 14 As shown, the method is applied to any one of the multiple second processor cores included in a System-on-a-Chip (SOC), which also includes a first processor core. The method includes the following steps:

[0206] Step S1401: Obtain the first system message from the first processor core. The first system message is a system message obtained by the first processor core after marking the tunnel number of the VPN tunnel to which the IPSec VPN message from the VPN tunnel belongs, and the sequence number in the transmission message of the VPN tunnel to which it belongs.

[0207] Step S1402: Decrypt the first system message to obtain the second system message. The second system message includes the tunnel number and sequence number from the first system message.

[0208] Step S1403: The second system message is sent to the first processor core so that the first processor core processes the obtained second system message according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the second system message.

[0209] In some embodiments, each second processor core corresponds to a receive queue; the receive queue is used to buffer the first system message from the first processor core; step S1401 may include: reading the first system message from the receive queue corresponding to any second processor core.

[0210] In some embodiments, each second processor core corresponds to a first transmission queue; step S1403 may: write the second system message into the first transmission queue corresponding to any second processor core, so that the first processor core reads the second system message from the first transmission queue corresponding to any second processor core.

[0211] In some embodiments, the first system message further includes a first user message; step S1402 may include: decrypting the first system message to obtain a third system message, the third system message including a second user message, a tunnel number and a sequence number in the first system message, the second user message being the plaintext corresponding to the first user message; if the second user message is a message processed locally by the on-chip system or an illegal message, then a discard flag is added to the third system message to obtain the second system message; if the second user message is a message processed by other devices, then an outgoing interface flag corresponding to the second user message is added to the third system message to obtain the second system message.

[0212] In some embodiments, the first processor core is a microprocessor core and the second processor core is a general-purpose processor core.

[0213] In the technical solution provided in this application embodiment, a first processor core and multiple second processor cores are integrated on the SOC. The first processor core marks the tunnel number of the VPN tunnel to which the IPSec VPN packet belongs, as well as the sequence number in the transmission packet of the VPN tunnel, and sequentially sends the obtained first system packet to the multiple second processor cores. In this way, the multiple second processor cores can decrypt and process IPSec VPN packets (i.e., first system packets) from the same VPN tunnel in parallel, fully utilizing the processing capabilities of multiple second processor cores (such as CPU cores).

[0214] Since the IPSec VPN packets processed by multiple second processor cores and the subsequent IPSec VPN packets processed by the first processor core all carry tunnel numbers and sequence numbers, and for IPSec VPN packets from the same VPN tunnel, their transmission order within the VPN tunnel represents their order within their respective flows, the first processor core further processes the decrypted IPSec VPN packets (i.e., the second system packets) according to the order in which the packets are transmitted within the VPN tunnel, based on the tunnel number and sequence number, thus ensuring the packet order. Therefore, in this embodiment, by utilizing the first processor core to number and distribute IPSec VPN packets and to further process the decrypted IPSec VPN packets, the processing power of the multi-processor core is fully utilized while ensuring the packet order.

[0215] Corresponding to the above message processing method, this application also provides a message processing apparatus, such as... Figure 15 As shown, the device is applied to a first processor core included in the SOC, and the SOC also includes multiple second processor cores.

[0216] The receiving module 1501 is used to receive IPSec VPN packets from the VPN tunnel;

[0217] The tagging module 1502 is used to tag the tunnel number of the VPN tunnel to which the received IPSec VPN message belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs, and to obtain the first system message;

[0218] The input module 1503 is used to sequentially send the obtained first system message to multiple second processor cores so that the multiple second processor cores can decrypt the obtained first system message to obtain a second system message. The second system message includes the tunnel number and sequence number in the corresponding first system message.

[0219] The processing module 1504 is used to process the obtained second system message according to the order of the VPN tunnel transmission messages and based on the tunnel number and sequence number included in the obtained second system message.

[0220] In some embodiments, each second processor core corresponds to a receiving queue; the input module 1503 is specifically used to: sequentially write the obtained first system message into the receiving queues corresponding to the multiple second processor cores, so that the multiple second processor cores can read the first system message from the corresponding receiving queues.

[0221] In some embodiments, each second processor core corresponds to a first transmission queue; the first transmission queue is used to cache the second system message obtained by the corresponding second processor core; the processing module 1504 is specifically used to: poll the first transmission queues corresponding to multiple second processor cores to obtain the current second system message; if the system message corresponding to the previous sequence number of the current second system message has been processed, then process the current second system message.

[0222] In some embodiments, the first system message further includes a first user message; the second system message further includes a second user message and a discard flag or outgoing interface flag added by the second processor core; the second user message is plaintext corresponding to the first user message; the processing module 1504 is specifically used to: determine the second system message to be processed according to the order of VPN tunnel transmission messages, based on the tunnel number and sequence number included in the obtained second system message; if the second system message to be processed carries a discard flag, then discard the second system message to be processed; if the second system message to be processed carries a current outgoing interface flag, then write the second user message included in the second system message to be processed into the second sending queue corresponding to the current outgoing interface flag, so that the network interface corresponding to each outgoing interface flag reads the second user message from the corresponding second sending queue and sends it.

[0223] In some embodiments, the first processor core is a microprocessor core and the second processor core is a general-purpose processor core.

[0224] In the technical solution provided in this application embodiment, a first processor core and multiple second processor cores are integrated on the SOC. The first processor core marks the tunnel number of the VPN tunnel to which the IPSec VPN packet belongs, as well as the sequence number in the transmission packet of the VPN tunnel, and sequentially sends the obtained first system packet to the multiple second processor cores. In this way, the multiple second processor cores can decrypt and process IPSec VPN packets (i.e., first system packets) from the same VPN tunnel in parallel, fully utilizing the processing capabilities of multiple second processor cores (such as CPU cores).

[0225] Since the IPSec VPN packets processed by multiple second processor cores and the subsequent IPSec VPN packets processed by the first processor core all carry tunnel numbers and sequence numbers, and for IPSec VPN packets from the same VPN tunnel, their transmission order within the VPN tunnel represents their order within their respective flows, the first processor core further processes the decrypted IPSec VPN packets (i.e., the second system packets) according to the order in which the packets are transmitted within the VPN tunnel, based on the tunnel number and sequence number, thus ensuring the packet order. Therefore, in this embodiment, by utilizing the first processor core to number and distribute IPSec VPN packets and to further process the decrypted IPSec VPN packets, the processing power of the multi-processor core is fully utilized while ensuring the packet order.

[0226] Corresponding to the above message processing method, this application also provides a message processing apparatus, such as... Figure 16 As shown, the device is applied to any one of a plurality of second processor cores included in the SOC, the SOC also including a first processor core, and the device comprises:

[0227] The acquisition module 1601 is used to acquire a first system message from the first processor core. The first system message is a system message obtained by the first processor core after marking the tunnel number of the VPN tunnel to which the IPSec VPN message from the VPN tunnel belongs, and the sequence number in the transmission message of the VPN tunnel.

[0228] Processing module 1602 is used to decrypt the first system message to obtain the second system message, the second system message including the tunnel number and sequence number in the first system message;

[0229] The input module 1603 is used to send the second system message into the first processor core, so that the first processor core processes the second system message according to the order of the VPN tunnel transmission messages and the tunnel number and sequence number included in the second system message.

[0230] In some embodiments, each second processor core corresponds to a receive queue; the receive queue is used to buffer the first system message from the first processor core; the acquisition module 1601 is specifically used to read the first system message from the receive queue corresponding to any second processor core.

[0231] In some embodiments, each second processor core corresponds to a first transmission queue; the input module 1603 is specifically used to write the second system message into the first transmission queue corresponding to any second processor core, so that the first processor core reads the second system message from the first transmission queue corresponding to any second processor core.

[0232] In some embodiments, the first system message further includes a first user message; the processing module 1602 is specifically used to: decrypt the first system message to obtain a third system message, the third system message including a second user message, a tunnel number and a sequence number in the first system message, the second user message being the plaintext corresponding to the first user message; if the second user message is a message processed locally by the on-chip system or an illegal message, a discard flag is added to the third system message to obtain the second system message; if the second user message is a message processed by other devices, an outgoing interface flag corresponding to the second user message is added to the third system message to obtain the second system message.

[0233] In some embodiments, the first processor core is a microprocessor core and the second processor core is a general-purpose processor core.

[0234] In the technical solution provided in this application embodiment, a first processor core and multiple second processor cores are integrated on the SOC. The first processor core marks the tunnel number of the VPN tunnel to which the IPSec VPN packet belongs, as well as the sequence number in the transmission packet of the VPN tunnel, and sequentially sends the obtained first system packet to the multiple second processor cores. In this way, the multiple second processor cores can decrypt and process IPSec VPN packets (i.e., first system packets) from the same VPN tunnel in parallel, fully utilizing the processing capabilities of multiple second processor cores (such as CPU cores).

[0235] Since the IPSec VPN packets processed by multiple second processor cores and the subsequent IPSec VPN packets processed by the first processor core all carry tunnel numbers and sequence numbers, and for IPSec VPN packets from the same VPN tunnel, their transmission order within the VPN tunnel represents their order within their respective flows, the first processor core further processes the decrypted IPSec VPN packets (i.e., the second system packets) according to the order in which the packets are transmitted within the VPN tunnel, based on the tunnel number and sequence number, thus ensuring the packet order. Therefore, in this embodiment, by utilizing the first processor core to number and distribute IPSec VPN packets and to further process the decrypted IPSec VPN packets, the processing power of the multi-processor core is fully utilized while ensuring the packet order.

[0236] This application also provides a processor core, which includes any of the devices described above for a first processor core, and / or any of the devices described above for a second processor core. When the processor core includes any of the devices described above for a first processor core, the processor core can serve as a first processor core. When the processor core includes any of the devices described above for a second processor core, the processor core can serve as a second processor core. When the processor core includes both any of the devices described above for a first processor core and any of the devices described above for a second processor core, the processor core can serve as either a first processor core or a second processor core.

[0237] This application also provides a network device, including any of the aforementioned SOCs. This network device can be a network device for a corporate headquarters or a branch office.

[0238] In another embodiment provided in this application, a computer-readable storage medium is also provided, which stores a computer program. When the computer program is executed by a processor, it implements any of the above-described message processing methods applied to the first processor core, or implements any of the above-described message processing methods applied to the second processor core.

[0239] Computer-readable storage media may include random access memory (RAM) or non-volatile memory (NVM), such as at least one disk storage device. Optionally, the computer-readable storage medium may also be at least one storage device located remotely from the aforementioned processor. The computer-readable storage medium may be integrated on a System-on-a-Chip (SoC) and communicate with the first processor core and the second processor core via a communication bus.

[0240] In another embodiment provided in this application, a computer program product containing instructions is also provided, which, when run on a computer, causes the computer to execute any of the above-described message processing methods applied to a first processor core, or to execute any of the above-described message processing methods applied to a second processor core.

[0241] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0242] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0243] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments for methods and apparatuses applied to a first processor core, a second processor core, processor cores, network devices, storage media, and program products are basically similar to the method embodiments applied to a System-on-a-Chip (SoC), and therefore the descriptions are relatively simple. Relevant parts can be referred to the descriptions of the method embodiments applied to a SoC.

[0244] The above description is merely a preferred embodiment of this application and is not intended to limit the scope of protection of this application. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application are included within the scope of protection of this application.

Claims

1. A message processing method, characterized in that, The method applies to a first processor core included in a system-on-a-chip, wherein the system-on-a-chip further includes multiple second processor cores, and the method includes: Receive IPSec VPN packets from the VPN tunnel; The first system message is obtained by marking the tunnel number of the VPN tunnel to which the received IPSec VPN message belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs; The obtained first system message is sequentially sent to the plurality of second processor cores, so that the plurality of second processor cores decrypt the obtained first system message to obtain a second system message, the second system message including the tunnel number and sequence number in the corresponding first system message; According to the order of VPN tunnel transmission messages, the obtained second system messages are processed based on the tunnel number and sequence number included in the obtained second system messages.

2. The method according to claim 1, characterized in that, Each secondary processor core corresponds to one receive queue; The step of sequentially sending the obtained first system message into the plurality of second processor cores includes: sequentially writing the obtained first system message into the receiving queue corresponding to the plurality of second processor cores, so that the plurality of second processor cores read the first system message from the corresponding receiving queue; And / or, Each second processor core corresponds to a first transmission queue; the first transmission queue is used to cache the second system messages obtained by the corresponding second processor core. The step of processing the second system message according to the order of VPN tunnel transmission messages and based on the tunnel number and sequence number included in the obtained second system message includes: polling the first sending queue corresponding to the plurality of second processor cores to obtain the current second system message; if the system message corresponding to the previous sequence number included in the current second system message has been processed, then processing the current second system message.

3. The method according to claim 1, characterized in that, The first system message also includes a first user message; the second system message also includes a second user message and a discard flag or outgoing interface flag added by the second processor core; the second user message is the plaintext corresponding to the first user message; The step of processing the obtained second system message according to the order of VPN tunnel transmission messages, based on the tunnel number and sequence number included in the obtained second system message, includes: According to the order of VPN tunnel transmission messages, the second system message to be processed is determined based on the tunnel number and sequence number included in the obtained second system message; If the second system message to be processed carries the discard flag, then the second system message to be processed is discarded; If the second system message to be processed carries the current outgoing interface identifier, then the second user message included in the second system message to be processed is written into the second sending queue corresponding to the current outgoing interface identifier, so that the network interface corresponding to each outgoing interface identifier reads the second user message from the corresponding second sending queue and sends it.

4. The method according to any one of claims 1-3, characterized in that, The first processor core is a microprocessor core, and the second processor core is a general-purpose processor core.

5. A message processing method, characterized in that, The method is applied to any one of a plurality of second processor cores included in a system-on-a-chip, wherein the system-on-a-chip further includes a first processor core, and the method includes: The first system message is obtained from the first processor core. The first system message is the system message obtained by the first processor core after marking the tunnel number of the VPN tunnel to which the IPSec VPN message from the VPN tunnel belongs, and the sequence number in the transmission message of the VPN tunnel. The first system message is decrypted to obtain the second system message, which includes the tunnel number and sequence number from the first system message. The second system message is sent to the first processor core, so that the first processor core processes the second system message according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the second system message.

6. The method according to claim 5, characterized in that, Each second processor core corresponds to a receive queue; the receive queue is used to buffer the first system message from the first processor core; The step of obtaining the first system message from the first processor core includes: reading the first system message from the receive queue corresponding to any of the second processor cores; and / or Each second processor core corresponds to a first transmission queue; The step of sending the second system message into the first processor core includes: writing the second system message into the first transmission queue corresponding to any second processor core, so that the first processor core reads the second system message from the first transmission queue corresponding to any second processor core.

7. The method according to claim 5, characterized in that, The first system message also includes the first user message; The step of decrypting the first system message to obtain the second system message includes: The first system message is decrypted to obtain the third system message, which includes the second user message, the tunnel number and sequence number in the first system message, and the second user message is the plaintext corresponding to the first user message. If the second user message is a message processed locally by the on-chip system or an illegal message, then a discard flag is added to the third system message to obtain the second system message; If the second user message is a message processed by other devices, then the outgoing interface identifier corresponding to the second user message is added to the third system message to obtain the second system message.

8. The method according to any one of claims 5-7, characterized in that, The first processor core is a microprocessor core, and the second processor core is a general-purpose processor core.

9. A message processing apparatus, characterized in that, The device includes a first processor core applied to a system-on-a-chip, the system-on-a-chip further including multiple second processor cores, and the device comprises: The receiving module is used to receive IPSec VPN packets from the VPN tunnel; The tagging module is used to tag the received IPSec VPN message with the tunnel number of the VPN tunnel to which it belongs, as well as the sequence number in the transmission message of the VPN tunnel to which it belongs, so as to obtain the first system message; The input module is used to sequentially send the obtained first system message to the plurality of second processor cores, so that the plurality of second processor cores can decrypt the obtained first system message to obtain a second system message, wherein the second system message includes the tunnel number and sequence number in the corresponding first system message; The processing module is used to process the obtained second system messages according to the order of VPN tunnel transmission messages and based on the tunnel number and sequence number included in the obtained second system messages.

10. A message processing apparatus, characterized in that, The device is applied to any one of a plurality of second processor cores included in a system-on-a-chip, wherein the system-on-a-chip further includes a first processor core, and the device comprises: The acquisition module is used to acquire a first system message from the first processor core. The first system message is a system message obtained by the first processor core after marking the tunnel number of the VPN tunnel to which the IPSec VPN message from the VPN tunnel belongs, and the sequence number in the transmission message of the VPN tunnel. The processing module is used to decrypt the first system message to obtain a second system message, wherein the second system message includes the tunnel number and sequence number in the first system message; The input module is used to input the second system message into the first processor core, so that the first processor core processes the second system message according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the second system message.

11. A processor core, characterized in that, Includes the apparatus of claim 9, and / or the apparatus of claim 10.

12. A system-on-a-chip, characterized in that, Includes a first processor core and multiple second processor cores; The first processor core receives IPSec VPN packets from a VPN tunnel; marks the received IPSec VPN packet with the tunnel number of the VPN tunnel to which it belongs, as well as the sequence number in the transmission packets of the VPN tunnel, to obtain a first system packet; and sequentially sends the obtained first system packet to the plurality of second processor cores. The plurality of second processor cores decrypt the obtained first system message to obtain a second system message, the second system message including the tunnel number and sequence number in the corresponding first system message; and send the obtained second system message into the first processor core; The first processor core processes the obtained second system message according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the obtained second system message.

13. The system-on-a-chip according to claim 12, characterized in that, The system-on-a-chip also includes a message parser and a network interface; The network interface receives network packets and sends the received network packets to the packet parser. The packet parser parses the received network packets, identifies IPSec VPN packets from the VPN tunnel, and sends the IPSec VPN packets to the first processor core.

14. The system-on-a-chip according to claim 12 or 13, characterized in that, Each second processor core corresponds to a receive queue, and each second processor core corresponds to a first transmit queue; The first processor core sequentially writes the obtained first system message into the receiving queue corresponding to the plurality of second processor cores; The plurality of second processor cores read the first system message from the corresponding receive queue; Write the obtained second system message into the corresponding first sending queue; The first processor core polls the first transmission queue corresponding to the plurality of second processor cores to obtain the current second system message; if the system message corresponding to the previous sequence number of the current second system message has been processed, then the current second system message is processed.

15. The system-on-a-chip according to claim 12 or 13, characterized in that, The system-on-a-chip also includes a network interface; the first system message also includes a first user message; The plurality of second processor cores decrypt the obtained first system message to obtain a third system message. The third system message includes a second user message, a tunnel number and a sequence number from the corresponding first system message, and the second user message is the plaintext corresponding to the first user message. If the second user message is a message processed locally by the on-chip system, a discard flag is added to the third system message to obtain the second system message. If the second user message is a message processed by other devices, an outgoing interface flag corresponding to the second user message is added to the third system message to obtain the second system message. The first processor core determines the second system message to be processed according to the order of VPN tunnel transmission messages and the tunnel number and sequence number included in the obtained second system message; If the second system message to be processed carries the discard flag, then the second system message to be processed is discarded; If the second system message to be processed carries the current outgoing interface identifier, then the second user message included in the second system message to be processed is written into the second sending queue corresponding to the current outgoing interface identifier; The network interface reads the second user message from the corresponding second transmission queue and sends it.

16. A network device, characterized in that, Includes the system-on-a-chip as described in any one of claims 12-15.

Images