Message processing method, client device, server device and medium

Abstract

The present disclosure provides a packet processing method applied to a client device, the client device comprising a client, the method comprising: in response to a first service packet sent from the client to a server, replacing a source address of the first service packet with a corresponding encrypted client segment identifier; encrypting the source address and a destination address of the first service packet using a server public key according to the encrypted server segment identifier, and sending the encrypted first service packet to the server; in response to a second service packet sent by the server, decrypting the source address and the destination address of the second service packet using a client private key, and replacing the destination address of the second service packet with an address of the client. The present disclosure also provides a packet processing method applied to a server device, a client device, a server device and a computer readable medium.

Description

TECHNICAL FIELD

[0001] The present disclosure relates to the field of communication technology, and in particular to a message processing method, a client device, a server device and a computer readable medium. BACKGROUND

[0002] As a network forwarding technology, Segment Routing IPv6 (SRv6) architecture is designed based on the concept of source routing, and by means of the forwarding mechanism of Internet Protocol version 6 (IPv6), the forwarding of IPv6 data packets is realized by new extensions in its IP extension header, and the newly added extension part is called Segment Routing Header (SRH). The Segment Routing Header contains an IPv6 address stack, and the destination address is updated by the intermediate nodes in sequence, thereby completing the hop-by-hop forwarding of the message in the network.

[0003] At present, in the process of message transmission, the intermediate nodes in the link can obtain the network element information of the source end and the destination end by analyzing the message, and thus there is a possibility that a third party intercepts the message by improper means and obtains the information of the host and the server by analysis, and the security of message transmission cannot be guaranteed. SUMMARY

[0004] The present disclosure aims to at least solve one of the technical problems existing in the prior art, and proposes a message processing method, a client device, a server device and a computer readable medium.

[0005] To achieve the above-mentioned purpose, in a first aspect, the embodiments of the present disclosure provide a message processing method applied to a client device, wherein the client device comprises a client, and the method comprises:

[0006] replacing the source address of the first service message with the corresponding encrypted client segment identifier in response to the first service message sent from the client to the server end, wherein the destination address of the first service message is the encrypted server end segment identifier corresponding to the server end;

[0007] encrypting the source address and the destination address of the first service message using a server end public key according to the encrypted server end segment identifier, and sending the encrypted first service message to the server end;

[0008] In response to the second service packet sent by the server end, a destination address of the second service packet is decrypted using a client private key, and the destination address of the second service packet is replaced with an address of the client, wherein the destination address of the second service packet is the encrypted client segment identifier encrypted by the server end using a client public key.

[0009] In a second aspect, the embodiments of the present disclosure further provide a packet processing method, applied to a server end device, the server end device comprising a server end, comprising:

[0010] In response to a first service packet sent by a client, a destination address of the first service packet is decrypted using a server end private key, and the destination address of the first service packet is replaced with an address of the server end, wherein the destination address of the first service packet is the encrypted server end segment identifier encrypted by the client device using a server end public key;

[0011] In response to a second service packet sent from the server end to the client, a source address of the second service packet is replaced with the encrypted server end segment identifier, wherein the destination address of the second service packet is the encrypted client segment identifier corresponding to the client;

[0012] The source address and the destination address of the second service packet are encrypted using a client public key according to the encrypted client segment identifier, and the second service packet after encryption is sent to the client.

[0013] In a third aspect, the embodiments of the present disclosure further provide a client device, comprising:

[0014] one or more processors;

[0015] a memory for storing one or more programs;

[0016] When the one or more programs are executed by the one or more processors, the one or more processors implement the packet processing method according to the first aspect.

[0017] In a fourth aspect, the embodiments of the present disclosure further provide a server end device, comprising:

[0018] one or more processors;

[0019] a memory for storing one or more programs;

[0020] When the one or more programs are executed by the one or more processors, the one or more processors implement the packet processing method according to the second aspect.

[0021] In a fifth aspect, the embodiments of the present disclosure further provide a computer readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps in the packet processing method according to the first aspect.

[0022] In a sixth aspect, the embodiments of the present disclosure further provide a computer readable medium having a computer program stored thereon, wherein the program, when executed by a processor, implements the steps in the packet processing method according to the second aspect.

[0023] The present disclosure has the following beneficial effects:

[0024] The embodiments of the present disclosure provide a packet processing method, a client device, a server device and a computer readable medium. In the process of service packet transmission, for the client device and the server device, the sending end in the two devices replaces the source address of a service packet to be sent, which is of a specific type of segment identifier corresponding to the opposite end, with a specific type of segment identifier corresponding to the local end, and encrypts the source address and the destination address of the service packet according to the specific type of segment identifier, and then sends the service packet. The receiving end receives the packet and decrypts the destination address of the packet, and replaces the destination address of the packet with the address corresponding to the local side, thereby protecting the network element information of the packet sending and receiving parties, and effectively solving the security problem of service packet transmission in the network. BRIEF DESCRIPTION OF DRAWINGS

[0025] Figure 1 A structural schematic diagram of a network architecture is provided for the embodiments of the present disclosure.

[0026] Figure 2 A flowchart of a packet processing method is provided for the embodiments of the present disclosure.

[0027] Figure 3 A flowchart of another packet processing method is provided for the embodiments of the present disclosure.

[0028] Figure 4 A flowchart of still another packet processing method is provided for the embodiments of the present disclosure.

[0029] Figure 5 A flowchart of a specific implementation method for step S2 in the embodiments of the present disclosure is provided.

[0030] Figure 6 A flowchart of still another packet processing method is provided for the embodiments of the present disclosure.

[0031] Figure 7 A flowchart of still another packet processing method is provided for the embodiments of the present disclosure.

[0032] Figure 8A flowchart of another message processing method provided by an embodiment of the present disclosure is shown in FIG. 6;

[0033] Figure 9 A flowchart of a specific implementation method of step S9 in an embodiment of the present disclosure is shown in FIG. 7;

[0034] Figure 10 A flowchart of another message processing method provided by an embodiment of the present disclosure is shown in FIG. 8;

[0035] Figure 11 A flowchart of another message processing method provided by an embodiment of the present disclosure is shown in FIG. 9;

[0036] Figure 12 A flowchart of another message processing method provided by an embodiment of the present disclosure is shown in FIG. 10;

[0037] Figure 13 A flowchart of another message processing method provided by an embodiment of the present disclosure is shown in FIG. 11;

[0038] Figure 14 A structural schematic diagram of a client device provided by an embodiment of the present disclosure is shown in FIG. 12;

[0039] Figure 15 A structural schematic diagram of a server device provided by an embodiment of the present disclosure is shown in FIG. 13;

[0040] Figure 16 A structural schematic diagram of a computer readable medium provided by an embodiment of the present disclosure is shown in FIG. 14;

[0041] Figure 17 A structural schematic diagram of another computer readable medium provided by an embodiment of the present disclosure is shown in FIG. 15. DETAILED DESCRIPTION

[0042] In order to enable those skilled in the art to better understand the technical solutions of the present disclosure, the message processing method, the client device, the server device and the computer readable medium provided by the present disclosure will be described in detail below with reference to the accompanying drawings.

[0043] In the following, the example embodiments will be described more fully with reference to the accompanying drawings, in which example embodiments can be embodied in different forms and should not be construed as limited to the embodiments set forth herein. Rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art.

[0044] The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the disclosure. As used herein, the singular forms "a", "an" and "the" are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising," when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0045] It will be understood that, although the terms first, second, etc. can be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. Thus, a first element discussed below could be termed a second element without departing from the teachings of the present disclosure.

[0046] Unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as commonly understood by one of ordinary skill in the art. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and the present disclosure and will not be interpreted in an overly literal or overly formal sense unless expressly so defined herein.

[0047] The packet processing method, client device, server device and computer readable medium provided by the present disclosure, in the process of transmitting service packets, for the client device and the server device, the sending end of which replaces the source address of the service packet to be sent with the specific type of segment identifier corresponding to the local end, and encrypts the source address and the destination address of the service packet according to the specific type of segment identifier before sending, and the receiving end receives the packet, decrypts the destination address of the packet, and replaces the destination address of the packet with the address corresponding to the local side, thereby protecting the network element information of the packet transmitting and receiving parties, and effectively solving the security problem of service packet transmission in the network.

[0048] Figure 1 A structural schematic diagram of a network architecture is provided for the embodiments of the present disclosure. As shown in Figure 1 The network includes a client device, an intermediate node, a server device and a service management controller.

[0049] The network architecture is a Segment Routing IPv6 (SRv6) architecture, and the client device and the server device perform message transmission through an intermediate node, which is a Segment Routing node. Specifically, the client device includes a client and a client gateway, the client is a device that accesses the network through the client gateway and needs to communicate with the server, including a personal computer, a tablet, a mobile terminal, and the like; the server device includes a server and a server gateway, the server can access the network through the server gateway; a service management controller is a control layer, used for managing and controlling the service communication of the server and the client; in some embodiments, the Segment Routing node can include a Provider, a Provider Edge (PE), an Autonomous System Boundary Router (ASBR), an Area Border Router (ABR), and the like.

[0050] Figure 2 A flowchart of a message processing method provided by the embodiment of the disclosure is shown in FIG. 1. As shown in FIG. 1, the method is applied to a client device, and the method includes the following steps. Figure 2

[0051] In step S1, in response to a first service message sent from the client to the server, the source address of the first service message is replaced with a corresponding encrypted client segment identifier.

[0052] The client device includes a client, and the method flow is executed by the client; or in some embodiments, the client device further includes a client gateway corresponding to the client, and the method flow can be executed by the client gateway.

[0053] In step S1, the destination address of the first service message is an encrypted server segment identifier corresponding to the server. Specifically, in the Segment Routing IPv6 (SRv6) architecture, a corresponding segment identifier (Segment ID, SID) is configured for a network address, the segment identifier has an explicit indication function, and is a network instruction (Instruction); when a corresponding message passes through an intermediate node, the intermediate node reads the segment identifier carried in the Segment Routing message header and a corresponding series of instruction operations (also referred to as segment operations), and according to the segment identifier and the instruction operations, completes a corresponding forwarding action to perform message forwarding, and the instruction operations are used to indicate the routing and transmission of data in the network.

[0054] ​In step S1, the encryption client segment identifier and the encryption server segment identifier are segmented and identified for the client device and the server respectively preconfigured, a specific type of segment identifier provided by the present disclosure, which is different from other types of segment identifiers in the prior art. The specific type of segment identifier is not used to indicate the existing forwarding action, but is used to indicate the encryption forwarding action, that is, the encryption client segment identifier and the encryption server segment identifier indicate that the source address and the destination address of the corresponding message need to be encrypted in addition to indicating the routing and transmission of data in the network. Therefore, the encryption client segment identifier and the encryption server segment identifier do not mean that the segment identifier itself is encrypted, but are used to refer to the encryption forwarding action described above.

[0055] In some embodiments, the specific type of segment identifier can be marked using the type field "END.S.DECI". In some embodiments, the mapping relationship between the specific type of segment identifier and the address of the corresponding device can be established by configuration or in the service authorization process based on the routing protocol.

[0056] Step S2, according to the encryption server segment identifier, the source address and the destination address of the first service message are encrypted using the server public key, and the encrypted first service message is sent to the server.

[0057] According to the encryption forwarding action indicated by the encryption server segment identifier, the source address and the destination address of the first service message are encrypted using the server public key and sent, and the encrypted first service message indicates that the source address and the destination address of the first service message have been encrypted. Specifically, in some embodiments, the parameter part of the source address and the destination address is encrypted.

[0058] The server public key belongs to a public-private key pair of the server, which can be preconfigured by the server or preconfigured by the service management controller and delivered to the server, and the client device obtains the server public key in advance.

[0059] Step S3, in response to the second service message sent by the server, the source address and the destination address of the second service message are decrypted using the client private key, and the destination address of the second service message is replaced with the address of the client.

[0060] The destination address of the second service message is the encryption client segment identifier encrypted by the server using the client public key; the client private key belongs to a public-private key pair of the client, which can be preconfigured by the client or preconfigured by the service management controller and delivered to the client, and the server device obtains the client public key in advance.

[0061] In some embodiments, it also includes: using the client private key to decrypt the source address of the second business message; specifically, the source address of the second business message is the encrypted server-side segment identifier encrypted by the server using the client public key.

[0062] In some embodiments, the client gateway may perform corresponding decryption, replace the destination address of the second service message with the address of the client, and then send the second service message to the client.

[0063] The embodiment of the present disclosure provides a message processing method, which can be used for, during the process of business message transmission, a client device replaces the source address of a business message to be sent, whose destination address is a specific type of segmentation identifier corresponding to the other end, with a specific type of segmentation identifier corresponding to the local end, and encrypts the source address and destination address of the business message according to the specific type of segmentation identifier before sending; for a business message returned by a server-side device, decrypts the destination address of the message and replaces the destination address of the message with the address corresponding to the local side, thereby realizing the protection of network element information of both the sender and receiver of the message, and effectively solving the security problem of business message transmission in the network.

[0064] Figure 3 Flowchart of another message processing method provided by the embodiment of the present disclosure. Figure 3 As shown, this method is based on Figure 2 A specific optional implementation of the method shown. Specifically, the method includes not only steps S1 to S3, but also steps S01 and S02 before step S1, in response to a first service message sent from the client to the server, replacing the source address of the first service message with the corresponding encrypted client segment identifier. Only steps S01 and S02 are described in detail below.

[0065] Step S01: In response to a service authorization request sent from a client to a server, an encrypted client segment identifier is configured, and a mapping relationship between the encrypted client segment identifier and the client address is established.

[0066] The client sends a service authorization request to the server to pre-establish a service communication relationship. In some embodiments, the client may also send a service authorization request to the service management controller to perform service authorization.

[0067] Specifically, the segment identifier includes a locator field (Locator), a function field (Function) and an optional parameter field (Argument); the locator field mainly undertakes the routing function and is unique within the segment routing domain; the function field is used to identify the function of the device, such as forwarding function and business function; and for the specific type of segment identifier provided in this application, in some embodiments, at least part of the optional parameter field can be used as a reference field to establish a mapping relationship between the reference field and the client's address, so as to establish a mapping relationship between the encrypted client segment identifier and the client's address.

[0068] In some embodiments, the method further includes: publishing a route for the encrypted client segment identifier via an Interior Gateway Protocol (IGP).

[0069] Step S02: Send the service authorization request to the server, and receive the service authorization response fed back by the server.

[0070] The service authorization response includes an encrypted server segment identifier, whereby the client device obtains the encrypted server segment identifier corresponding to the server address, and the encrypted server segment identifier can actually be used as the server address on the client device side.

[0071] Figure 4 Flowchart of another message processing method provided by the embodiment of the present disclosure. Figure 4 As shown, this method is based on Figure 2 A specific optional implementation of the method shown. Specifically, the method includes not only steps S1 to S3, but also steps S4 to S6. Only steps S4 to S6 are described in detail below.

[0072] Step S4: Establish a mapping relationship between the encrypted client segment identifier encrypted using the server public key and the client address, and establish a mapping relationship between the encrypted server segment identifier encrypted using the server public key and the encrypted server segment identifier.

[0073] In some embodiments, the step of encrypting the specific type of segment identifier using the server public key includes encrypting the reference field of the specific type of segment identifier using the server public key. Thus, in some embodiments, similar to the step of establishing a mapping relationship based on the reference field in step S01, in step S4, a mapping relationship is established between the reference field encrypted using the server public key and the client address, thereby establishing a mapping relationship between the specific type of segment identifier encrypted using the server public key and the client address.

[0074] Step S5, in response to the third service message sent from the client to the server, replacing the source address of the third service message with the encrypted client segment identifier encrypted using the server public key, and replacing the destination address of the third service message with the encrypted server segment identifier encrypted using the server public key.

[0075] The destination address of the third service message is the encrypted server segment identifier; in step S5, the client device side establishes a mapping relationship between the encrypted specific type of segment identifier and the corresponding address in advance, and directly replaces when sending or forwarding the message, thereby reducing the response delay.

[0076] Step S6, sending the third service message to the server.

[0077] Figure 5 A specific implementation method flowchart for step S2 in the embodiment of the present disclosure. Specifically, the client device further includes a client gateway; as shown in Figure 5 The step S2 of sending the first service message to the server includes:

[0078] Step S201, generating a tunnel header and a segment routing extension header outside the first service message according to the client gateway address, the address of the intermediate node in the link and the corresponding server gateway address of the server, and sending the first service message to the server gateway.

[0079] In step S201, the first service message is sent to the server through the client gateway and the segment routing node in the communication link, and the first service message is encapsulated outside according to the client gateway address, the address of the segment routing node and the server gateway address, and a tunnel header and a segment routing extension header are added. Therefore, in the foregoing method, the destination address is replaced based on the segment routing protocol mechanism when the message passes through the segment routing node, and in the present embodiment, the outer destination address is replaced based on the segment routing protocol mechanism when the message passes through the segment routing node after the message is encapsulated outside the tunnel.

[0080] The embodiment of the present disclosure provides a message processing method, which can be used to protect message transmission by tunnel technology and setting a specific type of segment identifier.

[0081] Figure 6 A flowchart of another message processing method provided by the embodiment of the present disclosure. As shown in Figure 6 The method is applied to a server device, and the server device includes a server. The method includes:

[0082] Step S7, in response to the first service message sent by the client, the source address and the destination address of the first service message are decrypted using the server-side private key, and the destination address of the first service message is replaced with the address of the server side.

[0083] The source address of the first service message is an encrypted client segment identifier encrypted by the server-side public key, and the destination address of the first service message is an encrypted server-side segment identifier encrypted by the server-side public key. The server-side private key belongs to a public-private key pair of the server side, which can be pre-configured by the server side or pre-configured by the service management controller and delivered to the server side. The server-side public key is obtained in advance by the client device.

[0084] The server-side device includes the server side, and the method flow is executed by the server side. In some embodiments, the server-side device also includes a server-side gateway corresponding to the server side, and the method flow can be executed by the server-side gateway.

[0085] In some embodiments, the source address of the first service message is an encrypted client segment identifier encrypted by the server-side public key.

[0086] In some embodiments, the method flow can be executed by the server-side gateway. The server-side gateway can perform corresponding decryption, replace the destination address of the first service message with the address of the server side, and then send the first service message to the server side.

[0087] Step S8, in response to the second service message sent from the server side to the client, the source address of the second service message is replaced with the encrypted server-side segment identifier.

[0088] The destination address of the second service message is the encrypted client segment identifier corresponding to the client.

[0089] Step S9, according to the encrypted client segment identifier, the source address and the destination address of the second service message are encrypted using the client public key, and the encrypted second service message is sent to the client.

[0090] In this embodiment, according to the encryption forwarding action indicated by the encryption client segment identifier, the source address and destination address of the second service message are encrypted using the client public key and then sent. The encrypted second service message represents a second service message whose source address and destination address are both encrypted. The client public key belongs to the client's public-private key pair, which can be pre-configured by the client or pre-configured and issued to the client by the service management controller. The server-side device obtains the client public key in advance. Specifically, in some embodiments, the parameter portion of the source address and destination address is encrypted.

[0091] An embodiment of the present disclosure provides a message processing method, which can be used to replace the source address of a business message to be sent, whose destination address is a specific type of segmentation identifier corresponding to the other end, with the specific type of segmentation identifier corresponding to the local end, and encrypt the source address and destination address of the business message according to the specific type of segmentation identifier before sending; for the business message returned by the other end, decrypt the destination address of the message and replace the destination address of the message with the address corresponding to the local side, thereby realizing the protection of the network element information of both the sender and receiver of the message, and effectively solving the security problem of business message transmission in the network.

[0092] Figure 7 Flowchart of another message processing method provided by the embodiment of the present disclosure. Figure 7 As shown, this method is based on Figure 6 A specific optional implementation of the method shown. Specifically, the method includes not only steps S7 to S9 but also, before step S7, in which, in response to a first service message sent by the client, the server uses the private key to decrypt the source and destination addresses of the first service message, step S7a. Only step S7a will be described in detail below.

[0093] Step S7a: In response to the service registration request sent from the server to the service management controller, configure the encrypted server segment identifier and establish a mapping relationship between the encrypted server segment identifier and the server address.

[0094] The service registration request includes a server identifier, such as a service ID, a server ID, and the like.

[0095] In some embodiments, a mapping relationship between the encrypted server-side segment identifier and the address of the server can be established by using at least part of the optional parameter field of the encrypted server-side segment identifier as a reference field.

[0096] Step S7b: Send the service registration request to the service management controller, and receive the service registration response fed back by the service management controller.

[0097] In step S7b, receiving a service registration response fed back by the service management controller indicates that the service registration on the server side is successful.

[0098] Figure 8 Flowchart of another message processing method provided by the embodiment of the present disclosure. Figure 8 As shown, this method is based on Figure 6 A specific optional implementation of the method shown. Specifically, the method includes not only steps S7 to S9, but also steps S10 to S12. Only steps S10 to S12 are described in detail below.

[0099] Step S10: Establish a mapping relationship between the encrypted client segment identifier encrypted using the client public key and the encrypted client segment identifier, and establish a mapping relationship between the encrypted server segment identifier encrypted using the client public key and the server address.

[0100] In some embodiments, the step of encrypting the specific type of segment identifier using the client public key includes encrypting the reference field of the specific type of segment identifier using the client public key. Thus, in some embodiments, similar to the step of establishing a mapping relationship based on the reference field in step S7a, in step S10, a mapping relationship is established between the reference field encrypted using the client public key and the server address, thereby establishing a mapping relationship between the specific type of segment identifier encrypted using the server public key and the client address.

[0101] Step S11: In response to the fourth business message sent from the server to the client, the source address of the fourth business message is replaced with the encrypted server segment identifier encrypted using the client public key, and the destination address of the fourth business message is replaced with the encrypted client segment identifier encrypted using the client public key.

[0102] Among them, the destination address of the fourth business message is the encrypted client segment identifier; in step S11, the server side establishes a mapping relationship between the encrypted specific type of segment identifier and the corresponding address in advance, and directly replaces it when sending or forwarding the message to reduce response delay.

[0103] Step S12: Send a fourth service message to the client.

[0104] Figure 9 This is a flow chart of a specific implementation method of step S9 in the embodiment of the present disclosure. Figure 9 As shown, specifically, the server-side device further includes a server-side gateway; step S9, the step of sending the second service message to the client, includes:

[0105] Step S901: Generate a tunnel header and a segment routing extension header in the outer layer of the second service message according to the server gateway address, the intermediate node address in the link and the client gateway address corresponding to the client, and send the second service message to the client gateway.

[0106] In step S901, the second service message is sent to the client via the server-side gateway and a segment routing node in the communication link. The second service message is encapsulated using the client gateway address, the segment routing node address, and the server-side gateway address, adding a tunnel header and a segment routing extension header. Thus, in the aforementioned method, the destination address of the message is replaced based on the segment routing protocol mechanism when passing through the segment routing node. However, in this embodiment, after the message is encapsulated through the tunnel outer layer, the outer destination address of the message is replaced based on the segment routing protocol mechanism when passing through the segment routing node.

[0107] The message processing method provided by the present disclosure is described in detail below in combination with practical applications.

[0108] Figure 10 A signaling diagram of another message processing method provided by an embodiment of the present disclosure. Figure 10 As shown, in the interaction process between a client device and a server device, the client device includes a client, the server device includes a server, and there may be one or more intermediate nodes (not shown in the figure). The method includes:

[0109] BZ01. The server prepares to send a service registration request to the service management controller (not shown in the figure), configures an encrypted server segment identifier, and establishes a mapping relationship between the encrypted server segment identifier and the server address.

[0110] BZ02. The server sends a service registration request to the service management controller; wherein the service registration request includes a server identifier.

[0111] BZ03. The service management controller saves the server ID and completes the service registration on the server side.

[0112] BZ04. The service management controller sends a service registration response to the server.

[0113] BZ05. The client prepares to send a service authorization request to the server, configures the encrypted client segment identifier, and establishes a mapping relationship between the encrypted client segment identifier and its own address.

[0114] BZ06. The client sends a service authorization request to the server via the intermediate node.

[0115] BZ07, the server side performs service authorization (not shown in the figure), and sends a service authorization response to the client via the intermediate node, wherein the service authorization response includes the encrypted server side segment identifier.

[0116] At this point, the service registration of the server side and the service authorization of the client are completed.

[0117] Figure 11 A signaling diagram of another message processing method provided by an embodiment of the present disclosure is shown in FIG. 6. Figure 11 As shown in FIG. 6, the method is applied to the interaction process between a client device and a server side, the client device includes a client, the server side device includes a server side, and the intermediate node can be one or more (not shown in the figure). The method includes the following steps.

[0118] BZ101, the client replaces the source address of the first service message to be sent to the server side with the encrypted client side segment identifier; wherein the destination address of the first service message is the encrypted server side segment identifier of the server side.

[0119] BZ102, the client encrypts the source address and the destination address of the first service message using the server side public key based on the encryption forwarding action indicated by the encrypted server side segment identifier, and then sends the first service message to the server side via the intermediate node.

[0120] BZ2, the server side decrypts the source address and the destination address of the first service message using the server side private key, and replaces the destination address of the first service message with the address of the server side.

[0121] BZ301, the server side replaces the source address of the second service message to be sent to the client with the encrypted server side segment identifier; wherein the destination address of the second service message is the encrypted client side segment identifier.

[0122] BZ302, the server side encrypts the source address and the destination address of the second service message using the client public key based on the encryption forwarding action indicated by the encrypted client side segment identifier, and then sends the second service message to the client via the intermediate node.

[0123] BZ4, the client decrypts the source address and the destination address of the second service message using the client private key, and replaces the destination address of the second service message with the address of the client.

[0124] At this point, the message mutual transmission between the client and the server side is completed.

[0125] Figure 12 A signaling diagram of another message processing method provided by an embodiment of the present disclosure is shown in FIG. 6. Figure 12As shown, the method is applied to an interaction process between a client device and a server device, the client device includes a client and a client gateway, the server device includes a server and a server gateway, one or more intermediate nodes (not shown in the figure) can be provided, and the method includes the following steps:

[0126] BZ081, the server sends a service registration request to the server gateway; wherein the service registration request is prepared to be sent to a service management controller.

[0127] BZ082, the server gateway configures an encrypted server segment identifier, and establishes a mapping relationship between the encrypted server segment identifier and the address of the server.

[0128] BZ083, the server gateway sends a service registration request to the service management controller; wherein the service registration request includes a server identifier.

[0129] BZ09, the service management controller saves the server identifier, and completes the service registration of the server.

[0130] BZ0101, the service management controller sends a service registration response to the server gateway.

[0131] BZ0102, the server gateway sends a service registration response to the server.

[0132] BZ0111, the client sends a service authorization request to the client gateway; wherein the service authorization request is prepared to be sent to the server.

[0133] BZ0112, the client gateway configures an encrypted client segment identifier, and establishes a mapping relationship between the encrypted client segment identifier and the address of the client.

[0134] BZ0113, the client gateway sends a service authorization request to the server via the intermediate node and the server gateway.

[0135] BZ012, the server performs service authorization (not shown in the figure), and sends a service authorization response to the client gateway via the server gateway and the intermediate node; wherein the service authorization response includes an encrypted server segment identifier.

[0136] BZ0131, the client gateway saves the encrypted server segment identifier.

[0137] BZ0132, the client gateway sends a service authorization response to the client.

[0138] Thus, the service registration of the server and the service authorization of the client are completed.

[0139] Figure 13 A signaling diagram of another packet processing method provided by the embodiment of the disclosure. As shown in the figure, the method is applied to an interaction process between a client device and a server device, the client device includes a client and a client gateway, the server device includes a server and a server gateway, one or more intermediate nodes (not shown in the figure) can be provided, and the method includes the following steps:Figure 13 As shown, in the interactive process applied to the client device and the server end, the client device includes a client and a client gateway, the server end device includes a server end and a server end gateway, the intermediate node can be one or more (not shown in the figure), and the method includes:

[0140] BZ501, the client sends a first service message to the client gateway; wherein the first service message is prepared to be sent to the server end.

[0141] BZ502, the client gateway replaces the source address of the first service message with the corresponding encrypted client segment identifier.

[0142] BZ503, the client gateway encrypts the source address and the destination address of the first service message using the server end public key based on the encryption forwarding action indicated by the encrypted server end segment identifier, and then sends the first service message to the server end gateway via the intermediate node.

[0143] BZ601, the server end gateway decrypts the source address and the destination address of the first service message using the server end private key, and replaces the destination address of the first service message with the address of the server end.

[0144] BZ602, the server end gateway sends the first service message processed by BZ701 to the server end.

[0145] BZ701, the server end sends a second service message to the server end gateway; wherein the second service message is prepared to be sent to the client.

[0146] BZ702, the server end gateway replaces the source address of the second service message with the encrypted server end segment identifier; wherein the destination address of the second service message is the encrypted client segment identifier.

[0147] BZ703, the server end gateway encrypts the source address and the destination address of the second service message using the client public key based on the encryption forwarding action indicated by the encrypted client segment identifier, and then sends the second service message to the client gateway via the intermediate node.

[0148] BZ801, the client gateway decrypts the source address and the destination address of the second service message using the client private key, and replaces the destination address of the second service message with the address of the client.

[0149] BZ802, the client gateway sends the second service message processed by BZ901 to the client.

[0150] Thus, the mutual transmission of messages between the client and the server end is completed.

[0151] Figure 14A structural schematic diagram of a client device is provided for the embodiments of the present disclosure. As shown in Figure 14 The client device includes:

[0152] one or more processors 101;

[0153] a memory (device) 102, on which one or more programs are stored, when the one or more programs are executed by the one or more processors, so that the one or more processors implement the packet processing method applied to the client device in any of the above embodiments;

[0154] one or more I / O interfaces 103 connected between the processor and the memory, configured to realize the information interaction of the processor and the memory.

[0155] The processor 101 is a device with data processing capability, including but not limited to a central processing unit (CPU) and the like; the memory 102 is a device with data storage capability, including but not limited to a random access memory (RAM, more specifically SDRAM, DDR, etc.), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory (FLASH); the I / O interface (read-write interface) 103 is connected between the processor 101 and the memory 102, and can realize the information interaction of the processor 101 and the memory 102, including but not limited to a data bus (Bus) and the like.

[0156] In some embodiments, the processor 101, the memory 102 and the I / O interface 103 are connected with each other through a bus 104, and further connected with other components of the computing device.

[0157] In some embodiments, the client device further includes a client and a client gateway.

[0158] Figure 15 A structural schematic diagram of a server device is provided for the embodiments of the present disclosure. As shown in Figure 15 The server device includes:

[0159] one or more processors 201;

[0160] a memory 202, on which one or more programs are stored, when the one or more programs are executed by the one or more processors, so that the one or more processors implement the packet processing method applied to the server in any of the above embodiments;

[0161] one or more I / O interfaces 203 connected between the processor and the memory, configured to realize the information interaction of the processor and the memory.

[0162] The processor 201 is a device with data processing capability, including but not limited to a central processing unit (CPU) and the like; the memory 202 is a device with data storage capability, including but not limited to a random access memory (RAM, more specifically SDRAM, DDR, etc.), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory (FLASH); the I / O interface (read-write interface) 203 is connected between the processor 201 and the memory 202, and can realize information interaction between the processor 201 and the memory 202, including but not limited to a data bus (Bus) and the like.

[0163] In some embodiments, the processor 201, the memory 202 and the I / O interface 203 are connected to each other through the bus 204, and further connected to other components of the computing device.

[0164] In some embodiments, the server-side device further includes a server-side and a server-side gateway.

[0165] Figure 16 A structural diagram of a computer readable medium provided by an embodiment of the present disclosure is provided. The computer readable medium stores a computer program, wherein the program is executed by a processor to implement the steps in the packet processing method applied to the client-side device in any of the above embodiments.

[0166] Figure 17 Another structural diagram of a computer readable medium provided by an embodiment of the present disclosure is provided. The computer readable medium stores a computer program, wherein the program is executed by a processor to implement the steps in the packet processing method applied to the server-side in any of the above embodiments.

[0167] Those of ordinary skill in the art will realize and understand that all or some of the steps in the methods disclosed above and the functional modules / units in the apparatuses can be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Some or all of the physical components can be implemented as software executed by a processor, such as a central processing unit, a digital signal processor, or a microprocessor, or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on computer-readable media, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tapes, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by a computer. Furthermore, it is common knowledge to those of ordinary skill in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media.

[0168] Example embodiments have been disclosed herein and, although the use of specific terms is expressly used herein, they are intended in a generic sense only and are not intended to limit the scope of the present disclosure. In some instances, it will be apparent to those skilled in the art that features, characteristics or / and elements described in connection with a particular embodiment can be used in conjunction with other embodiments unless otherwise explicitly stated. As such, those skilled in the art will appreciate that various changes can be made in form and detail without departing from the scope of the disclosure as set forth in the appended claims.

Claims

1. A message processing method, wherein: Applied to a client device, the client device including a client, the method comprising: In response to a first service message sent from a client to a server, a source address of the first service message is replaced with a corresponding encrypted client segment identifier, wherein the destination address of the first service message is the encrypted server segment identifier corresponding to the server; the encrypted client segment identifier and the encrypted server segment identifier are a specific type of segment identifier used to indicate routing and transmission of data in a network, and are also used to indicate that the source address and destination address of the first service message are to be encrypted; Encrypting the source address and destination address of the first service message using the server-side public key according to the encryption server-side segment identifier, and sending the encrypted first service message to the server-side; In response to the second business message sent by the server, the source address and destination address of the second business message are decrypted using the client private key, and the destination address of the second business message is replaced with the address of the client, wherein the destination address of the second business message is the encrypted client segment identifier after the server uses the client public key to encrypt it.

2. The message processing method according to claim 1, wherein: Before replacing the source address of the first service message with the corresponding encrypted client segment identifier in response to the first service message sent from the client to the server, the method further includes: In response to a service authorization request sent from the client to the server, configuring the encrypted client segment identifier and establishing a mapping relationship between the encrypted client segment identifier and the address of the client; The service authorization request is sent to the server, and a service authorization response fed back by the server is received, wherein the service authorization response includes: the encrypted server segment identifier.

3. The message processing method according to claim 1, further comprising: Establishing a mapping relationship between the encrypted client segment identifier encrypted using the server public key and the client address, and establishing a mapping relationship between the encrypted server segment identifier encrypted using the server public key and the encrypted server segment identifier; In response to a third service message sent from the client to the server, replacing the source address of the third service message with the encrypted client segment identifier encrypted using the server public key, and replacing the destination address of the third service message with the encrypted server segment identifier encrypted using the server public key, wherein the destination address of the third service message is the encrypted server segment identifier; Send the third service message to the server.

4. The message processing method according to claim 1, wherein: The client device also includes a client gateway; The sending the encrypted first service message to the server includes: A tunnel header and a segment routing extension header are generated in the outer layer of the encrypted first business message according to the client gateway address, the intermediate node address in the link and the server gateway address corresponding to the server, and the encrypted first business message is sent to the server gateway.

5. A message processing method, wherein: Applied to a server-side device, the server-side device includes a server, and the method includes: In response to a first service message sent by the client, decrypt the source address and destination address of the first service message using the server-side private key, and replace the destination address of the first service message with the server-side address, wherein the source address of the first service message is an encrypted client segment identifier encrypted by the client device using the server-side public key, and the destination address of the first service message is an encrypted server-side segment identifier encrypted by the client device using the server-side public key; the encrypted client segment identifier and the encrypted server-side segment identifier are a specific type of segment identifier used to indicate the routing and transmission of data in the network, and are also used to indicate that the source address and destination address of the first service message are encrypted; In response to a second service message sent from the server to the client, replacing a source address of the second service message with the encrypted server segment identifier, wherein the destination address of the second service message is the encrypted client segment identifier; The source address and destination address of the second service message are encrypted using the client public key according to the encrypted client segment identifier, and the encrypted second service message is sent to the client.

6. The message processing method according to claim 5, wherein: Before decrypting the source address and destination address of the first service message using the server-side private key in response to the first service message sent by the client, the method further includes: In response to a service registration request sent from the server to the service management controller, configuring the encrypted server segment identifier and establishing a mapping relationship between the encrypted server segment identifier and the address of the server; The service registration request is sent to the service management controller, and a service registration response fed back by the service management controller is received.

7. The message processing method according to claim 5, further comprising: Establishing a mapping relationship between the encrypted client segment identifier encrypted using the client public key and the encrypted client segment identifier, and establishing a mapping relationship between the encrypted server segment identifier encrypted using the client public key and the address of the server; In response to a fourth service message sent from the server to the client, replacing the source address of the fourth service message with the encrypted server segment identifier encrypted using the client public key, and replacing the destination address of the fourth service message with the encrypted client segment identifier encrypted using the client public key, wherein the destination address of the fourth service message is the encrypted client segment identifier; Send the fourth service message to the client.

8. The message processing method according to claim 5, wherein: The server-side device also includes a server-side gateway; The sending the encrypted second service message to the client includes: According to the server-side gateway address, the intermediate node address in the link and the client gateway address corresponding to the client, a tunnel header and a segment routing extension header are generated in the outer layer of the encrypted second business message, and the encrypted second business message is sent to the client gateway.

9. A client device comprising: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the message processing method according to any one of claims 1 to 4.

10. A server-side device comprising: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the message processing method as described in any one of claims 5 to 8.

11. A computer-readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the message processing method according to any one of claims 1 to 4 is implemented.

12. A computer-readable medium having a computer program stored thereon, wherein: When the program is executed by a processor, the message processing method according to any one of claims 5 to 8 is implemented.

Images