Message transmission method, message transmission channel establishment method and device

Abstract

The present invention discloses a message transmission method, a message transmission channel establishment method and a device, which relate to the field of communication technology. The main purpose is to clarify the source private network of the message and the source private network device in the source private network; the message transmission method is applied to a system including a sending end device and a receiving end device, and a general routing encapsulation GRE tunnel is established between the sending end device and the receiving end device. The message transmission method includes: the sending end device sends a target message of the private network device to the receiving end device through the GRE tunnel, and the target message carries the private network address and GRE identifier corresponding to the private network device. Private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a message transmission method, a message transmission channel establishment method and a device. Background Art

[0002] Currently, to reduce the allocation of public network addresses, private network addresses within the same private network are mapped to the same public network address. When a private network device within the private network accesses an external network, a sending device, such as a NAT (Network Address Translation) device, translates the private network address in outgoing packets to its mapped public network address. After the NAT device translates the address, the receiving device can only locate the private network from which the packet originated based on the public network address, but cannot pinpoint the specific private network device within the private network from which the packet originated. Summary of the Invention

[0003] In view of this, the present invention proposes a message transmission method, a message transmission channel establishment method and an apparatus, the main purpose of which is to clarify the source private network of the message and the source private network device in the source private network.

[0004] In order to achieve the above object, the present invention mainly provides the following technical solutions:

[0005] In a first aspect, the present invention provides a message transmission method, applied to a system including a sending end device and a receiving end device, wherein a Generic Routing Encapsulation (GRE) tunnel is established between the sending end device and the receiving end device, the method comprising:

[0006] The sending device sends the target message of the private network device to the receiving device through the GRE tunnel, wherein the target message carries the private network address and GRE identifier corresponding to the private network device. Private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique.

[0007] In a second aspect, the present invention provides a method for establishing a message transmission channel, which is applied to a system including a sending end device and a receiving end device, and the method includes:

[0008] Establishing a GRE tunnel between the sending device and the receiving device;

[0009] Configure the GRE tunnel application mechanism of the sending device, wherein the GRE tunnel application mechanism is used to limit the sending end to transmit the target message of the private network device to the receiving device through the GRE tunnel, wherein the target message carries the private network address and GRE identifier corresponding to the private network device, and private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique.

[0010] In a third aspect, the present invention provides a device for establishing a message transmission channel, which is applied to a system including a sending end device and a receiving end device, and the device includes:

[0011] An establishing unit, configured to establish a GRE tunnel between the sending end device and the receiving end device;

[0012] A configuration unit is used to configure a GRE tunnel application mechanism of the sending end device, wherein the GRE tunnel application mechanism is used to limit the sending end to transmit the target message of the private network device to the receiving end device through the GRE tunnel, wherein the target message carries the private network address and GRE identifier corresponding to the private network device, and private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique.

[0013] In a fourth aspect, the present invention provides a computer-readable storage medium, which includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the message transmission method described in the first aspect, and / or execute the message transmission channel establishment method described in the second aspect.

[0014] The message transmission method, message transmission channel establishment method and device provided by the present invention are such that a sending end device sends a target message carrying a private network address and a GRE identifier to a receiving end device through a GRE tunnel, so that the receiving end device decapsulates the target message and obtains the private network address and GRE identifier corresponding to the private network device. Since private network devices within the same private network share the same GRE identifier, and the GRE identifier is unique, the receiving end device can locate which private network the private network device corresponding to the target message originates from based on the private network address and GRE identifier it obtains, and locates which private network device in the located private network the private network device is, so that the receiving end device can perform specific business operations on the located private network device. It can be seen that the solution provided by the embodiment of the present invention enables the receiving end device to clearly identify the source private network of the message and the source private network device in the source private network.

[0015] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0017] Figure 1 A flowchart of a message transmission method provided by an embodiment of the present invention is shown;

[0018] Figure 2 A schematic diagram showing the connection relationship of devices involved in message transmission provided by an embodiment of the present invention;

[0019] Figure 3 A schematic diagram of a first GRE message provided by an embodiment of the present invention is shown;

[0020] Figure 4 A schematic diagram of a target message provided by an embodiment of the present invention is shown;

[0021] Figure 5 A schematic diagram showing a connection relationship of devices involved in message transmission provided by another embodiment of the present invention;

[0022] Figure 6 A schematic diagram of a second IPsec message provided by an embodiment of the present invention is shown;

[0023] Figure 7 A schematic diagram of a target message provided by another embodiment of the present invention is shown;

[0024] Figure 8 A flowchart of a method for establishing a message transmission channel provided by one embodiment of the present invention is shown;

[0025] Figure 9 A schematic structural diagram of a device for establishing a message transmission channel provided by one embodiment of the present invention is shown;

[0026] Figure 10 A schematic structural diagram of a device for establishing a message transmission channel provided by another embodiment of the present invention is shown. DETAILED DESCRIPTION

[0027] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0028] Currently, to reduce the allocation of public network addresses, private addresses within the same private network are mapped to the same public address. When a private network device within the private network accesses an external network, a sending device, such as a NAT device, translates the private network address in outgoing packets to its mapped public address. After the NAT device translates the address, the receiving device can only locate the private network from which the packet originated based on the public address, but cannot pinpoint the specific private network device within the private network from which the packet originated.

[0029] The receiving device can only locate the private network from which a message originates based on the public network address, but cannot pinpoint the specific private network device within the private network. This flaw creates some service blind spots. For example, in network security, due to the address translation operation of NAT devices, the Internet behavior audit system acting as the receiving device can only locate the private network from which a private network device originated based on the message, but cannot locate the private network device within the targeted private network. Therefore, Internet behavior auditing of private network devices is impossible.

[0030] In order to enable the receiving device to clearly identify the source private network of the message and the source private network device in the source private network, an embodiment of the present invention provides a message transmission method, a message transmission channel establishment method and an apparatus. The message transmission method, message transmission channel establishment method and apparatus provided in the embodiment of the present invention are specifically described below.

[0031] like Figure 1 As shown, an embodiment of the present invention provides a message transmission method, which is applied to a system including a sending end device and a receiving end device, wherein a Generic Routing Encapsulation (GRE) tunnel is established between the sending end device and the receiving end device. The message transmission method includes the following steps 101:

[0032] 101. The sending device sends a target message from the private network device to the receiving device through the GRE tunnel. The target message carries the private network address and GRE identifier corresponding to the private network device. Private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique.

[0033] The message transmission method provided in an embodiment of the present invention is applied to a system including a transmitting device and a receiving device. A GRE tunnel is established between the transmitting device and the receiving device. The GRE tunnel is a virtual direct link between the transmitting device and the receiving device, and is used to encapsulate messages using one routing protocol within messages using another protocol.

[0034] The sending device has a corresponding private network and is used to send a target message from a private network device within the corresponding private network to the receiving device through a GRE tunnel. The target message carries the private network address of the private network device and a GRE identifier. The GRE identifier indicates the private network from which the target message originates, and the private network address indicates the private network device within the private network with the GRE identifier.

[0035] The following explains the principles for setting GRE identifiers: In practice, the Internet Assigned Numbers Authority (IANA), the Internet address allocation organization, allocates three address ranges, 10.0.0.0–10.255.255.255, 172.16.0.0–172.31.255.255, and 192.168.0.0–192.168.255.255, as private addresses. These private addresses can only be used by private network devices within private networks, such as enterprise and campus networks, and are not allocated to external networks. However, the same private address can be reused across different private networks. Therefore, to distinguish the private network from which a private address originates, private network devices within the same network must share the same GRE identifier. Furthermore, GRE identifiers must be unique, meaning that the same GRE identifier cannot be reused across different private networks.

[0036] When a private network device within a private network accesses an external network, it sends a data packet based on the access request. This data packet carries not only the private network address and GRE identifier corresponding to the private network device, but also the network data associated with the access request. This network data reflects the private network device's online behavior. The target message is derived from the data packet, so it carries not only the private network address and GRE identifier corresponding to the private network device, but also the network data associated with the access request. It should be noted that because the sending device sends the target message from the private network device to the receiving device via the GRE tunnel, the target message is encapsulated through the GRE tunnel.

[0037] After receiving the target message from the private network device, the sending device sends it to the receiving device through the GRE tunnel. The specific process of sending the target message from the private network device to the receiving device through the GRE tunnel is as follows: the sending device sends the target message to the receiving device based on the transport address corresponding to the GRE tunnel.

[0038] In the message transmission method provided by the embodiment of the present invention, the sending end device sends the target message carrying the private network address and GRE identifier to the receiving end device through the GRE tunnel, and the receiving end device decapsulates the target message to obtain the private network address and GRE identifier corresponding to the private network device. Since the private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique, the receiving end device can locate which private network the private network device corresponding to the target message comes from based on the private network address and GRE identifier it obtains, and locate which private network device in the located private network is the private network, so that the receiving end device can perform specific business operations on the located private network device. It can be seen that the solution provided by the embodiment of the present invention enables the receiving end device to clearly identify the source private network of the message and the source private network device in the source private network.

[0039] Furthermore, after the sending end device sends the target message of the private network device to the receiving end device through the GRE tunnel in the above step 101, the message transmission method further includes the following step 102:

[0040] 102. The receiving device decapsulates the target message to obtain the private network address and GRE identifier.

[0041] The receiving device is a device that performs specific services based on the private network address and GRE identifier carried in the target message. The specific service type can be determined based on service requirements. For example, the receiving device is an Internet behavior auditing system. Based on the GRE identifier carried in the target message, the receiving device locates the private network from which the private network device corresponding to the target message originated. Furthermore, based on the private network address carried in the target message, the receiving device locates the private network device corresponding to the target message within the located private network. After locating the private network device, the receiving device performs an Internet behavior audit on the private network device corresponding to the target message based on the network data carried in the target message.

[0042] When the receiving device receives the target message, it decapsulates the target message according to the decapsulation method corresponding to the GRE tunnel. After decapsulation, the private network address, GRE identifier and network data can be obtained.

[0043] After the receiving device unpacks the target message to obtain the private network address and GRE identifier, in order to better manage the Internet access behavior of the private network device, the message transmission method may also include the following process: the receiving device extracts the network data carried by the target message, and the receiving device audits the Internet access behavior of the private network device corresponding to the private network address and GRE identifier based on the network data.

[0044] Network data describes the network access content of private network devices, reflecting their online behavior. It can serve as a basis for managing their online behavior. Therefore, the receiving device needs to extract the network data carried by the target message and audit the online behavior of the private network devices corresponding to the private network addresses and GRE identifiers based on the network data.

[0045] When the receiving device finds that the Internet access behavior of the private network device corresponding to the private network address and GRE identifier is compliant, it can forward the network data according to the Internet access needs of the private network device so that the Internet access behavior corresponding to the network data can be realized. Figure 2 and Figure 5 As shown, when the receiving device 24 audits that the Internet access behavior of the private network device corresponding to the private network address and GRE identifier is compliant, it can forward the network data to the Internet 30 through the firewall 27, switch 28 and border firewall 29 according to the Internet access needs of the private network device, so that the Internet access behavior corresponding to the network data can be realized in the Internet 30.

[0046] When the receiving device audits that the Internet access behavior of the private network device corresponding to the private network address and GRE identifier is not compliant, it intercepts the network data so that the Internet access behavior corresponding to the network data cannot be realized, and sends a prompt of non-compliant Internet access behavior to the private network device corresponding to the private network address and GRE identifier.

[0047] Furthermore, the method for determining the target message involved in step 101 is related to the specific structure of the system in which the sending end device and the receiving end device are located. This is specifically described below through the following examples 1 and 2:

[0048] Example 1, as Figure 2 As shown, the sending device consists of a first device 21 and a second device 22. The first device 21 is connected to multiple private network devices 23 within the same private network. A GRE channel 25 is established between the first device 21 and the receiving device 24, and an Internet Protocol security (IPsec) tunnel 26 is established between the first device 21 and the second device 22. The specific execution process of the above step 101 may include the following steps 201 to 203:

[0049] 201. A first device performs GRE tunnel encapsulation on a data message sent by a private network device to form a first GRE message, wherein the data message carries a private network address and a GRE identifier corresponding to the private network device.

[0050] The first device is connected to the private network devices in the same private network, and is responsible for the network connection and traffic diversion of all private network devices in the private network. In other words, each private network has its own dedicated first device. Figure 2 As shown, private network A has its own exclusive first device 21, and the first device 21 exclusive to private network A is connected to the private network device 23 in private network A. The specific type of the first device is not specifically limited in this embodiment. For example, the first device is CPE (Customer Premise Equipment). The second device is connected to the first device, and is responsible for the networking and drainage of one or more first devices, that is, it can be responsible for the networking and drainage of the first devices corresponding to multiple private networks. In order to improve the security of message transmission, an IPsec tunnel is established between the first device and the second device to securely transmit messages through the IPsec tunnel. As Figure 2 As shown, an IPsec tunnel 26 is established between the first device 21 and the second device 22. In order to enable the receiving device to clearly identify the source private network of the message and the source private network device in the source private network, a GRE tunnel is established between the first device and the receiving device. Figure 2 As shown, a GRE tunnel 25 is established between the first device 21 and the receiving device 24. The GRE identifier of the GRE tunnel 25 is "GRE identifier 0", which is a GRE tunnel dedicated to the private network A.

[0051] The first device is configured to obtain a data packet sent by a private network device within its corresponding private network. After obtaining the data packet, the first device performs GRE tunnel encapsulation on the data packet without performing address translation, thereby preserving the private network address and GRE identifier corresponding to the private network device in the data packet. The specific process of the first device performing GRE tunnel encapsulation on the data packet of the private network device includes the following steps 201A to 201C:

[0052] 201A. The first device generates a first GRE protocol packet header based on the protocol corresponding to the GRE tunnel and the protocol corresponding to the data packet.

[0053] To ensure that the data message, after being encapsulated through the GRE tunnel, can be transmitted to the receiving device through the GRE tunnel and that the receiving device can decapsulate the received target message, the first device needs to generate a first GRE protocol header based on the protocol corresponding to the GRE tunnel and the protocol corresponding to the data message. For example, if the protocol corresponding to the GRE tunnel is 0X0800 and the protocol corresponding to the data message is IP, the generated first GRE protocol header will contain "GRE header, protocol type 0X0800, payload protocol identification: IP."

[0054] 201B. The first device generates a first address packet header based on the source address and destination address of the GRE tunnel, where the source address is the address of the first device and the destination address is the address of the receiving device.

[0055] The source address is the starting address of the GRE tunnel, which is used to inform the first device that it is the starting point of the GRE tunnel, so that the first device can perform routing verification based on it. The target address is the end address of the GRE tunnel, which is used to inform the receiving device that it is the end point of the GRE tunnel, so that the receiving device can perform routing verification based on it. Therefore, the first device generates a first address header based on the source address and the destination address of the GRE tunnel. For example, the address of the first device is "101.1.1.1 / 24", and the address of the receiving device is "101.1.1.2 / 24". The generated first address header contains "GRE encapsulated new IP address information, source address: 101.1.1.1 / 24, destination address: 101.1.1.2 / 24".

[0056] 201C. The first device sequentially adds a first GRE protocol header and a first address header to the data message to form a first GRE message.

[0057] When the receiving device unpacks the received message, it needs to first unpack the address, and then confirm that it is the destination according to the unpacked target address before further unpacking. Therefore, when the first device encapsulates the data message, it needs to add the first GRE protocol header and the first address header to the data message in sequence. That is to say, the message obtained after encapsulation has the first address header on the outermost side, followed by the first GRE protocol header, and finally the data message.

[0058] like Figure 3 As shown, Figure 3 Figure 2 illustrates a first GRE packet. 2A represents the network data in the packet. 2B represents the GRE identifier in the packet. 2C represents the source address information in the packet, which includes "Original IP address information, Source address: private network address, Destination address: address to be accessed by the private network device." 2D represents the first GRE protocol header. 2E represents the first address header.

[0059] 202. The first device performs IPsec tunnel encapsulation on the first GRE message, and sends the encapsulated first IPsec message to the second device through the IPsec tunnel.

[0060] An IPsec tunnel is established between the first device and the second device, and a GRE tunnel is established between the first device and the receiving device. The main purpose of this tunnel establishment method is: in actual applications, the existing version of the second device may not support the conversion of IPsec tunnel transmission into GRE tunnel transmission. Therefore, in order to reduce the time cost brought by the upgrade of the second device, this tunnel establishment method is adopted. This tunnel establishment method can encapsulate the data message of the private device through the GRE tunnel, and encrypt and transmit the encapsulated message through the IPSec tunnel to ensure the security of the message.

[0061] The IPsec tunnel has an interest flow identification mechanism, which can perform IPsec tunnel encapsulation on the first GRE message according to the identifier of the first GRE message after the first GRE message is formed but before it is transmitted to the receiving end device.

[0062] The specific process of the first device performing IPsec tunnel encapsulation on the first GRE message includes the following steps 202A to 202C:

[0063] 202A. The first device generates a first IPsec header based on the content included in the first GRE message.

[0064] The first GRE message includes the network data, the private network address, and the GRE identifier. The first device generates the first IPsec header based on the first GRE message by performing an operation on the first GRE message using the MD5 algorithm or the SHA1 algorithm, and generating the first IPsec header based on the operation result.

[0065] 202B. The first device generates a second address header based on the source address and destination address of the IPsec tunnel, where the source address is the address of the first device and the destination address is the address of the second device.

[0066] The source address is the starting address of the IPsec tunnel, which is used to inform the first device that it is the starting point of the IPsec tunnel. The destination address is the ending address of the IPsec tunnel, which is used to inform the second device that it is the ending point of the IPsec tunnel. Therefore, the first device generates a second address header based on the source address and destination address of the IPsec tunnel. For example, the address of the first device is "101.1.1.1 / 24" and the address of the second device is "101.1.1.3 / 24". The generated second address header contains "IPsec encapsulated new IP address information, source address: 101.1.1.1 / 24, destination address: 101.1.1.3 / 24".

[0067] 202C. Add a first IPsec header and a second address header to the first GRE message in sequence.

[0068] The message obtained after encapsulation is the target message, with the second address header on the outermost side, followed by the first IPsec header, which is adjacent to the first address header in the first GRE message. Figure 4 As shown, 2F represents the first IPsec header, 2G represents the second address header, 2F is adjacent to 2E "first address header", and 2F is located outside 2E "first address header".

[0069] 203. The second device sends the first IPsec message as the target message to the receiving device.

[0070] After receiving the first IPsec message, the second device parses the first GRE message encapsulated within the first IPsec message and, based on the information contained in the first address header of the first GRE message, sends the first IPsec message to the receiving device via the GRE tunnel. The information contained in the first address header is the source address (the address of the first device) and the destination address (the address of the receiving device). Based on these source and destination addresses, the second device determines the transport address corresponding to the GRE tunnel and sends the target message as the target message to the receiving device using the determined transport address.

[0071] Example 2, as Figure 5 As shown, the sending end device is composed of a first device 21 and a second device 22. The first device 21 is used to connect to multiple private network devices 23 in the same private network. An IPsec tunnel 26 is established between the first device 21 and the second device 22, and a GRE channel 25 is established between the second device 22 and the receiving end device 24. The specific execution process of the above step 101 may include the following steps 301 to 302:

[0072] 301. A first device performs IPsec tunnel encapsulation on a data message sent by a private network device, and sends a second IPsec message formed after encapsulation to a second device through the IPsec tunnel. The data message carries a private network address and a GRE identifier corresponding to the private network device.

[0073] The first device is connected to the private network devices in the same private network, and is responsible for the network connection and traffic diversion of all private network devices in the private network. In other words, each private network has its own dedicated first device. Figure 5As shown, private network B has its own exclusive first device 21, and the first device 21 exclusive to private network B is connected to the private network device 23 in private network B. Private network C has its own exclusive first device 21, and the first device 21 exclusive to private network C is connected to the private network device 23 in private network C. The specific type of the first device is not specifically limited in this embodiment. For example, the first device is CPE (Customer Premise Equipment). The second device is connected to the first device, which is responsible for the networking and drainage of one or more first devices, that is, it can be responsible for the networking and drainage of the first devices corresponding to multiple private networks. As shown Figure 5 As shown, the second device 22 is responsible for networking and diverting the first device 21 corresponding to the private network B and the first device 22 corresponding to the private network C through SD-WAN (Software Defined Wide Area Network). In order to improve the security of message transmission, an IPsec tunnel is established between the first device and the second device to securely transmit the message through the IPsec tunnel. Figure 5 As shown, an IPsec tunnel 26 is established between the first device 21 and the second device 22. In order to enable the receiving device to clearly identify the source private network of the message and the source private network device in the source private network, a GRE tunnel is established between the second device and the receiving device. Figure 5 As shown, two GRE tunnels 25 are established between the second device 22 and the receiving device 24. One GRE tunnel 25 has a GRE identifier "GRE identifier 1" and is a GRE tunnel dedicated to private network B. The other GRE tunnel 25 has a GRE identifier "GRE identifier 2" and is a GRE tunnel dedicated to private network C.

[0074] An IPsec tunnel is established between the first device and the second device, and a GRE tunnel is established between the second device and the receiving device. The main purpose of this tunnel establishment method is that the existing version of the second device supports converting IPsec tunnel transmission into GRE tunnel transmission, so this tunnel establishment method is adopted. This tunnel establishment method can encapsulate the data message of the private device through the GRE tunnel, and encrypt and transmit the encapsulated message through the IPSec tunnel, thereby ensuring the security of message transmission.

[0075] The specific process of the first device performing IPsec tunnel encapsulation on the data message of the private network device includes the following steps 301A to 301C:

[0076] 301A. The first device generates a second IPsec header based on the content included in the data packet.

[0077] The data message includes the network data, the private network address, and the GRE identifier. The first device generates the second IPsec header based on the data message content by performing an operation on the data message content using the MD5 algorithm or the SHA1 algorithm, and generating the second IPsec header based on the operation result.

[0078] 301B. The first device generates a fourth address header based on the source address and destination address of the IPsec tunnel, where the source address is the address of the first device and the destination address is the address of the second device.

[0079] The source address is the starting address of the IPsec tunnel, which is used to inform the first device that it is the starting point of the IPsec tunnel. The destination address is the ending address of the IPsec tunnel, which is used to inform the second device that it is the ending point of the IPsec tunnel. Therefore, the first device generates a fourth address header based on the source address and destination address of the IPsec tunnel. For example, the address of the first device is "101.1.1.1 / 24" and the address of the second device is "101.1.1.3 / 24". The generated fourth address header contains "IPsec encapsulated new IP address information, source address: 101.1.1.1 / 24, destination address: 101.1.1.3 / 24".

[0080] 301C. Add a second IPsec header and a fourth address header to the data message in sequence.

[0081] The message obtained after encapsulation is the second IPsec message, with the fourth address header on the outermost side, followed by the second IPsec header, which is adjacent to the original data message. Figure 6 As shown, Figure 6 Figure 3 illustrates a second IPsec packet. 3A represents the network data in the data packet. 3B represents the GRE identifier in the data packet. 3C represents the original address information in the data packet, which includes "original IP address information, source address: private network address, destination address: address to be accessed by the private network device." 3D represents the second IPsec header. 3E represents the fourth address header.

[0082] 302. The second device performs GRE tunnel encapsulation on the second IPsec message to form a target message, and sends the target message to the receiving device.

[0083] The specific process of the second device performing GRE tunnel encapsulation on the second IPsec message to form a target message includes the following steps 302A to 302C:

[0084] 302A. The second device generates a second GRE protocol header based on the protocol corresponding to the GRE tunnel and the protocol corresponding to the second IPsec packet.

[0085] To ensure that the data message, after being encapsulated through the GRE tunnel, can be transmitted to the receiving device through the GRE tunnel and that the receiving device can decapsulate the received target message, the second device is required to generate a second GRE protocol header based on the protocol corresponding to the GRE tunnel and the protocol corresponding to the data message. For example, if the protocol corresponding to the GRE tunnel is 0X0800 and the protocol corresponding to the data message is IP, the generated first GRE protocol header will contain "GRE header, protocol type 0X0800, indicating that the payload protocol is IP."

[0086] 302B. The second device generates a third address header based on the source address and destination address of the GRE tunnel, where the source address is the address of the second device and the destination address is the address of the receiving device.

[0087] The source address is the starting address of the GRE tunnel, used to inform the second device that it is the starting point of the GRE tunnel. The destination address is the ending address of the GRE tunnel, used to inform the receiving device that it is the end point of the GRE tunnel. Therefore, the second device generates a third address header based on the source and destination addresses of the GRE tunnel. The third address header contains "GRE encapsulated new IP address information, source address: second device's address, destination address: receiving device's address."

[0088] 302C. The second device sequentially adds a second GRE protocol header and a third address header to the second IPsec message.

[0089] When the receiving device unpacks the received message, it needs to first unpack the address, and then perform further unpacking when confirming that it is the destination according to the unpacked target address. Therefore, when the second device encapsulates the data message, it needs to add the second GRE protocol header and the third address header to the data message in sequence. That is to say, the message obtained after encapsulation has the third address header on the outermost side, followed by the second GRE protocol header, and finally the second IPsec message.

[0090] After the second device performs GRE tunnel encapsulation on the second IPsec message to form a target message, the second device determines a transmission address corresponding to the GRE tunnel, and sends the target message to the receiving device through the determined transmission address.

[0091] like Figure 7 As shown, Figure 7 3G represents the third address header, 3F represents the second GRE protocol header, 3F is adjacent to 3E "the fourth address header", and 3F is located outside 3E "the fourth address header".

[0092] Furthermore, both the first and second embodiments involve establishing an IPsec tunnel between the first device and the second device. Therefore, the message transmission method provided in the embodiment of the present invention further includes the following process of establishing the IPsec tunnel, which includes the following steps 401 to 402:

[0093] 401. A first device sends an IPsec tunnel establishment request carrying the address of the first device to a second device, where the address of the first device serves as the source address of the IPsec tunnel.

[0094] The first device serves as the starting point of the IPsec tunnel. Therefore, the first device sends an IPsec tunnel establishment request containing the first device's address to the second device, informing the second device that an IPsec tunnel needs to be established between it and the first device. The purpose of sending the first device's address to the second device is to inform the second device of the starting point address of the IPsec tunnel.

[0095] 402. The first device receives an IPsec tunnel establishment acceptance response returned by the second device, and extracts the address of the second device from the IPsec tunnel establishment acceptance response.

[0096] When the second device receives the IPsec tunnel establishment request and accepts the establishment of the IPsec tunnel with the first device, it configures the first device's address as the source address of the IPsec tunnel and responds to the first device with an IPsec tunnel establishment acceptance response. The first device receives the IPsec tunnel establishment acceptance response from the second device and extracts the second device's address from the IPsec tunnel establishment acceptance response.

[0097] 403. The first device configures the address of the second device as the target address of the IPsec tunnel.

[0098] The first device configures the second device's address as the destination address of the IPsec tunnel, indicating the IPsec tunnel between the first and second devices. The source address of the IPsec tunnel is the address of the first device, which the first device uses to verify the IPsec tunnel's routing when encapsulating packets. The destination address of the IPsec tunnel is the address of the second device, which the second device uses to verify the IPsec tunnel's routing when receiving packets.

[0099] Furthermore, the above embodiments all involve establishing a GRE tunnel between the transmitting device and the receiving device. Therefore, the message transmission method provided in the embodiment of the present invention also includes the following process of establishing the GRE tunnel, which includes the following steps 501 to 502:

[0100] 501. A transmitting device sends a GRE tunnel establishment request carrying the address of the transmitting device to a receiving device, wherein the address of the transmitting device serves as the source address of the GRE tunnel.

[0101] The sending device serves as the starting point of the GRE tunnel. Therefore, the sending device sends a GRE tunnel establishment request containing the sending device's address to the receiving device, informing the receiving device that a GRE tunnel needs to be established between it and the sending device. The purpose of sending the sending device's address to the receiving device is to inform the receiving device of the starting point address of the GRE tunnel.

[0102] 502. The transmitting device receives the GRE tunnel establishment acceptance response returned by the receiving device, and extracts the address of the receiving device from the GRE tunnel establishment acceptance response.

[0103] When the receiving device receives the GRE tunnel establishment request and accepts the GRE tunnel establishment with the sending device, it configures the sending device's address as the source address of the GRE tunnel and sends a GRE tunnel establishment acceptance response to the sending device. The sending device receives the GRE tunnel establishment acceptance response from the receiving device and extracts the receiving device's address from the GRE tunnel establishment acceptance response.

[0104] 503. The sending device configures the address of the receiving device as the destination address of the GRE tunnel.

[0105] The sending device configures the receiving device's address as the destination address of the GRE tunnel, indicating a GRE tunnel between the sending and receiving devices. The source address of the GRE tunnel is the sending device's address, which the sending device uses to verify the GRE tunnel's route when encapsulating packets. The destination address of the GRE tunnel is the receiving device's address, which the receiving device uses to verify the GRE tunnel's route when receiving packets.

[0106] Furthermore, another embodiment of the present invention further provides a message transmission channel establishment method, which is applied to a system including a sending end device and a receiving end device, such as Figure 8 As shown, the message transmission channel establishment method includes the following steps:

[0107] 601. Establish a GRE tunnel between the transmitting device and the receiving device.

[0108] For the specific process of establishing the GRE tunnel between the transmitting device and the receiving device, please refer to the detailed description of steps 501 to 502 above, which will not be repeated here.

[0109] 602. Configure the GRE tunnel application mechanism of the sending device, where the GRE tunnel application mechanism is used to limit the sending device to transmit the target message of the private network device to the receiving device through the GRE tunnel, where the target message carries the private network address and GRE identifier corresponding to the private network device. Private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique.

[0110] The GRE tunnel established between the sending device and the receiving device is a virtual direct link that realizes the connection between the sending device and the receiving device, and is used to encapsulate a message using one routing protocol in a message using another protocol.

[0111] The sending device has a corresponding private network. Configuring the GRE tunnel application mechanism on the sending device mainly enables the sending device to send target packets from the private network device in its corresponding private network to the receiving device through the GRE tunnel.

[0112] The target message carries the private network address and GRE identifier corresponding to the private network device. The GRE identifier indicates the private network to which the target message corresponds, and the private network address indicates which private network device within the private network with the GRE identifier corresponds to the target message. Therefore, after receiving the target message, the receiving device can decapsulate the target message according to the decapsulation method corresponding to the GRE tunnel. After decapsulation, the private network address and GRE identifier are obtained. Based on the private network address and GRE identifier, the receiving device can locate the private network to which the target message corresponds, as well as the private network device within the private network it has located.

[0113] The method for establishing a message transmission channel provided by an embodiment of the present invention establishes a GRE tunnel between a sending device and a receiving device, and configures the GRE tunnel application mechanism of the sending device. Therefore, the sending device can send a target message carrying a private network address and a GRE identifier to the receiving device through the GRE tunnel, and the receiving device decapsulates the target message to obtain the private network address and GRE identifier corresponding to the private network device. Since private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique, the receiving device can locate which private network the private network device corresponding to the target message comes from based on the private network address and GRE identifier it obtains, and locate which private network device in the located private network is the private network, so that the receiving device can perform specific business operations on the located private network device. It can be seen that the solution provided by the embodiment of the present invention enables the receiving device to clearly identify the source private network of the message and the source private network device in the source private network.

[0114] Furthermore, the transmitting device is composed of a first device and a second device, wherein the first device is connected to multiple private network devices in the same private network, and the second device is connected to the first device and the receiving device respectively. The specific process of establishing the GRE tunnel between the transmitting device and the receiving device in step 601 includes the following steps 601A to 601C:

[0115] 601A. Determine whether the second device supports converting IPsec tunnel transmission into GRE tunnel transmission; if not, execute step 601B; if yes, execute step 601C.

[0116] The first device is connected to the private network devices in the same private network and is responsible for network traffic diversion for all private network devices in the private network. In other words, each private network has its own dedicated first device. The specific type of the first device is not specifically limited in this embodiment. Exemplarily, the first device is CPE (Customer Premise Equipment). The second device is connected to the first device and is responsible for network traffic diversion for one or more first devices. In other words, it can be responsible for network traffic diversion for first devices corresponding to multiple private networks. Exemplarily, the second device is VCPE (Virtual Customer Premise Equipment).

[0117] In actual applications, the existing version of the second device may not support the conversion of IPsec tunnel transmission into GRE tunnel transmission. Therefore, it is necessary to determine whether the second device supports the conversion of IPsec tunnel transmission into GRE tunnel transmission. The basis for executing the judgment can be the version information of the second device. When the version information is the target version information, it is determined that the second device supports the conversion of IPsec tunnel transmission into GRE tunnel transmission. Otherwise, it is determined that the second device does not support the conversion of IPsec tunnel transmission into GRE tunnel transmission.

[0118] 601B. Establish a GRE tunnel between the first device and the sending device.

[0119] If it is determined that the second device does not support converting IPsec tunnel transmission into GRE tunnel transmission, in order to reduce the time cost brought by upgrading the second device, a GRE tunnel is established between the first device and the sending device. This tunnel establishment method can encapsulate the data packets of the private device through the GRE tunnel.

[0120] 601C. Establish a GRE tunnel between the second device and the receiving device.

[0121] It is determined that the second device supports conversion of IPsec tunnel transmission into GRE tunnel transmission, and a GRE tunnel is established between the second device and the receiving device. This tunnel establishment method can encapsulate data packets of the private device through the GRE tunnel.

[0122] Furthermore, to ensure the security of message transmission, an IPsec tunnel is established between the first device and the second device. The specific process of establishing the IPsec tunnel between the first device and the second device is described in detail in steps 401 to 403 above and will not be repeated here.

[0123] When a GRE tunnel is established between the second device and the receiving device, data packets sent by the private network device are encapsulated and transmitted through the IPsec tunnel between the first and second devices before reaching the second device. The second device then performs GRE tunnel encapsulation on the received packets to form the target packets, which are then transmitted to the receiving device via the GRE tunnel.

[0124] When establishing a GRE tunnel between the first device and the transmitting device, the message transmission channel establishment method further includes the following steps: configuring the first device to perform GRE tunnel encapsulation on a data message sent by the private network device, forming a first GRE message, and then performing IPsec tunnel encapsulation on the first GRE message; wherein the data message carries the private network address and GRE identifier corresponding to the private network device. The above configuration scheme is intended to ensure message security. Under this configuration scheme, the first device performs GRE tunnel encapsulation on the data message sent by the private network device, forming a first GRE message. The first device then performs IPsec tunnel encapsulation on the first GRE message. The message after IPsec tunnel encapsulation is the target message and is transmitted to the receiving device.

[0125] Furthermore, according to the above method embodiment, another embodiment of the present invention further provides a message transmission channel establishment device, which is applied to a system including a sending end device and a receiving end device, such as Figure 9 As shown, the device includes:

[0126] An establishing unit 71 is configured to establish a GRE tunnel between the transmitting device and the receiving device;

[0127] Configuration unit 72 is used to configure the GRE tunnel application mechanism of the sending device, wherein the GRE tunnel application mechanism is used to limit the sending device to transmit the target message of the private network device to the receiving device through the GRE tunnel, wherein the target message carries the private network address and GRE identifier corresponding to the private network device, and private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique.

[0128] The message transmission channel establishment device provided by the embodiment of the present invention establishes a GRE tunnel between the sending device and the receiving device, and configures the GRE tunnel application mechanism of the sending device. Therefore, the sending device can send the target message carrying the private network address and GRE identifier to the receiving device through the GRE tunnel, and the receiving device decapsulates the target message to obtain the private network address and GRE identifier corresponding to the private network device. Since the private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique, the receiving device can locate which private network the private network device corresponding to the target message comes from based on the private network address and GRE identifier it obtains, and locate which private network the private network is in the located private network, so that the receiving device can perform specific business operations on the located private network device. It can be seen that the solution provided by the embodiment of the present invention enables the receiving device to clearly identify the source private network of the message and the source private network device in the source private network.

[0129] Optional, such as Figure 10 As shown, the system includes a first device and a second device, wherein the first device is connected to multiple private network devices in the same private network, and the second device is connected to the first device and the receiving device respectively, and the establishing unit 71 includes:

[0130] The judgment module 711 is used to determine whether the second device supports converting IPsec tunnel transmission into GRE tunnel transmission; if not, the first establishment module 712 is triggered to establish a GRE tunnel between the first device and the receiving device; if supported, the second establishment module 713 is triggered to establish a GRE tunnel between the second device and the receiving device.

[0131] Optional, such as Figure 10 As shown, the establishing unit 71 is further configured to establish an IPsec tunnel between the first device and the second device.

[0132] Optional, such as Figure 10 As shown, the configuration unit 72 is also used to configure the first device to perform GRE tunnel encapsulation on the data packet sent by the private network device when establishing a GRE tunnel between the first device and the receiving device, and after forming the first GRE packet, perform IPsec tunnel encapsulation on the first GRE packet; wherein the data packet carries the private network address and GRE identifier corresponding to the private network device.

[0133] In the message transmission channel establishment device provided by the embodiment of the present invention, the detailed description of the message transmission channel establishment method adopted during the operation of each functional module can be found in the corresponding method detailed description of the above method embodiment, which will not be repeated here.

[0134] Furthermore, based on the above embodiment, another embodiment of the present invention also provides a computer-readable storage medium, wherein the storage medium includes a stored program, wherein when the program is running, the device where the storage medium is located is controlled to execute the above-mentioned message transmission method, and / or execute the above-mentioned message transmission channel establishment method.

[0135] In the above embodiments, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0136] It is understood that the relevant features of the above methods and devices can be referenced to each other. In addition, the terms "first" and "second" in the above embodiments are used to distinguish between the embodiments, and do not represent the advantages and disadvantages of the embodiments.

[0137] Those skilled in the art will clearly understand that, for the convenience and brevity of description, the specific working processes of the systems, devices and units described above can refer to the corresponding processes in the aforementioned method embodiments and will not be repeated here.

[0138] The algorithm and display provided herein are not inherently related to any particular computer, virtual system or other device. Various general-purpose systems can also be used together with the teachings based on this. According to the above description, it is obvious that the structure required for constructing this type of system. In addition, the present invention is not directed to any specific programming language. It should be understood that various programming languages ​​can be utilized to realize the content of the present invention described herein, and the above description of specific languages ​​is for the purpose of disclosing the best mode of the present invention.

[0139] In the description provided herein, numerous specific details are described. However, it is understood that embodiments of the present invention may be practiced without these specific details. In some instances, well-known methods, structures, and techniques are not shown in detail so as not to obscure the understanding of this description.

[0140] Furthermore, those skilled in the art will appreciate that although some embodiments described herein include certain features included in other embodiments but not other features, combinations of features from different embodiments are intended to be within the scope of the present invention and to form different embodiments. For example, in the claims below, any of the claimed embodiments may be used in any combination.

[0141] The various component embodiments of the present invention may be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. Those skilled in the art will appreciate that a microprocessor or digital signal processor (DSP) may be used in practice to implement some or all of the functions of some or all of the components of the operating method, apparatus, and framework of the deep neural network model according to an embodiment of the present invention. The present invention may also be implemented as a device or apparatus program (e.g., a computer program and a computer program product) for executing part or all of the methods described herein. Such a program implementing the present invention may be stored on a computer-readable medium, or may be in the form of one or more signals. Such a signal may be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

[0142] It should be noted that the above embodiments illustrate rather than limit the invention, and that those skilled in the art may devise alternative embodiments without departing from the scope of the appended claims. In the claims, any reference signs placed between brackets should not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present invention may be implemented by means of hardware comprising several different elements and by means of appropriately programmed computers. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

Claims

1. A message transmission method, characterized in that: Applied to a system including a transmitting device and a receiving device, wherein a Generic Routing Encapsulation (GRE) tunnel is established between the transmitting device and the receiving device, the method comprising: The sending device sends a target message of the private network device to the receiving device through the GRE tunnel, wherein the target message carries the private network address and GRE identifier corresponding to the private network device. Private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique. The sending end device is composed of a first device and a second device, the first device is connected to multiple private network devices in the same private network, a GRE channel is established between the first device and the receiving end device, and an Internet Protocol Security (IPsec) tunnel is established between the first device and the second device. The sending end device sends a target message from the private network device to the receiving end device through the GRE tunnel, including: The first device performs GRE tunnel encapsulation on the data message sent by the private network device to form a first GRE message, wherein the data message carries the private network address and GRE identifier corresponding to the private network device; The first device performs IPsec tunnel encapsulation on the first GRE message, and sends the encapsulated first IPsec message to the second device through the IPsec tunnel; The second device sends the first IPsec message as the target message to the receiving device.

2. The method according to claim 1, characterized in that The first device performs GRE tunnel encapsulation on the data message of the private network device, including: The first device generates a first GRE protocol header based on a protocol corresponding to the GRE tunnel and a protocol corresponding to the data message; The first device generates a first address packet header based on the source address and the destination address of the GRE tunnel, wherein the source address is the address of the first device and the destination address is the address of the receiving device; The first device sequentially adds a first GRE protocol header and a first address header to the data message.

3. The method according to claim 1, characterized in that The first device performs IPsec tunnel encapsulation on the first GRE message, including: The first device generates a first IPsec packet header based on content included in the first GRE message; The first device generates a second address header based on a source address and a destination address of the IPsec tunnel, wherein the source address is the address of the first device and the destination address is the address of the second device; A first IPsec header and a second address header are sequentially added to the first GRE message.

4. The method according to claim 1, wherein The method further comprises: The first device sends an IPsec tunnel establishment request carrying the address of the first device to the second device, wherein the address of the first device serves as the source address of the IPsec tunnel; The first device receives the IPsec tunnel establishment acceptance response returned by the second device, and extracts the address of the second device from the IPsec tunnel establishment acceptance response; The first device configures the address of the second device as a destination address of the IPsec tunnel.

5. The method according to any one of claims 1 to 3, characterized in that: After the sending end device sends the target message of the private network device to the receiving end device through the GRE tunnel, the method further includes: The receiving device decapsulates the target message to obtain the private network address and the GRE identifier.

6. The method according to claim 5, characterized in that After the receiving device decapsulates the target message to obtain the private network address and the GRE identifier, the method further includes: The receiving device extracts the network data carried by the target message; The receiving end device audits the Internet access behavior of the private network device corresponding to the private network address and the GRE identifier based on the network data.

7. The method according to any one of claims 1 to 3, characterized in that: The method further comprises: The sending end device sends a GRE tunnel establishment request carrying the address of the sending end device to the receiving end device, wherein the address of the sending end device serves as the source address of the GRE tunnel; The sending end device receives the GRE tunnel establishment acceptance response returned by the receiving end device, and extracts the address of the receiving end device from the GRE tunnel establishment acceptance response; The sending end device configures the address of the receiving end device as the target address of the GRE tunnel.

8. A message transmission method, characterized in that: Applied to a system including a transmitting device and a receiving device, wherein a Generic Routing Encapsulation (GRE) tunnel is established between the transmitting device and the receiving device, the method comprising: The sending device sends a target message of a private network device to the receiving device through the GRE tunnel, wherein the target message carries a private network address and a GRE identifier corresponding to the private network device, private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique; the sending device is composed of a first device and a second device, the first device is used to connect to multiple private network devices in the same private network, an IPsec tunnel is established between the first device and the second device, and a GRE channel is established between the second device and the receiving device, and the sending device sends the target message of the private network device to the receiving device through the GRE tunnel, including: The first device performs IPsec tunnel encapsulation on the data message sent by the private network device, and sends the second IPsec message formed after encapsulation to the second device through the IPsec tunnel, wherein the data message carries the private network address and GRE identifier corresponding to the private network device; The second device performs GRE tunnel encapsulation on the second IPsec message to form the target message, and sends the target message to the receiving device.

9. The method according to claim 8, characterized in that The second device performs GRE tunnel encapsulation on the second IPsec message, including: The second device generates a second GRE protocol header based on a protocol corresponding to the GRE tunnel and a protocol corresponding to the second IPsec message; The second device generates a third address packet header based on the source address and the destination address of the GRE tunnel, wherein the source address is the address of the second device and the destination address is the address of the receiving device; The second device sequentially adds a second GRE protocol header and a third address header to the second IPsec message.

10. The method according to claim 8, characterized in that The first device performs IPsec tunnel encapsulation on the data message of the private network device, including: The first device generates a second IPsec packet header based on content included in the data message; The first device generates a fourth address header based on a source address and a destination address of the IPsec tunnel, wherein the source address is the address of the first device and the destination address is the address of the second device; A second IPsec header and a fourth address header are sequentially added to the data message.

11. The method according to claim 8, characterized in that The method further comprises: The first device sends an IPsec tunnel establishment request carrying the address of the first device to the second device, wherein the address of the first device serves as the source address of the IPsec tunnel; The first device receives the IPsec tunnel establishment acceptance response returned by the second device, and extracts the address of the second device from the IPsec tunnel establishment acceptance response; The first device configures the address of the second device as a destination address of the IPsec tunnel.

12. The method according to any one of claims 8 to 10, characterized in that: After the sending end device sends the target message of the private network device to the receiving end device through the GRE tunnel, the method further includes: The receiving device decapsulates the target message to obtain the private network address and the GRE identifier.

13. The method according to claim 12, characterized in that After the receiving device decapsulates the target message to obtain the private network address and the GRE identifier, the method further includes: The receiving device extracts the network data carried by the target message; The receiving end device audits the Internet access behavior of the private network device corresponding to the private network address and the GRE identifier based on the network data.

14. The method according to any one of claims 8 to 10, characterized in that: The method further comprises: The sending end device sends a GRE tunnel establishment request carrying the address of the sending end device to the receiving end device, wherein the address of the sending end device serves as the source address of the GRE tunnel; The sending end device receives the GRE tunnel establishment acceptance response returned by the receiving end device, and extracts the address of the receiving end device from the GRE tunnel establishment acceptance response; The sending end device configures the address of the receiving end device as the target address of the GRE tunnel.

15. A method for establishing a message transmission channel, characterized in that: Applied to a system including a transmitting device and a receiving device, the method includes: Establishing a GRE tunnel between the sending device and the receiving device; Configuring a GRE tunnel application mechanism on the sending device, wherein the GRE tunnel application mechanism is used to limit the sending device to transmit a target message from a private network device to the receiving device through a GRE tunnel, wherein the target message carries the private network address and GRE identifier corresponding to the private network device, and private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique; The sending end device is composed of a first device and a second device, wherein the first device is connected to multiple private network devices in the same private network, and the second device is connected to the first device and the receiving end device respectively, and establishing a GRE tunnel between the sending end device and the receiving end device includes: Determining whether the second device supports converting IPsec tunnel transmission into GRE tunnel transmission; If not supported, establishing a GRE tunnel between the first device and the receiving device; when the GRE tunnel between the first device and the receiving device is established, configuring the first device to perform GRE tunnel encapsulation on the data packet sent by the private network device to form a first GRE packet, and then performing IPsec tunnel encapsulation on the first GRE packet; wherein the data packet carries the private network address and GRE identifier corresponding to the private network device; If supported, a GRE tunnel is established between the second device and the receiving device. When the GRE tunnel is established between the second device and the receiving device, the first device is configured to perform IPsec tunnel encapsulation on the data packet sent by the private network device, and the second IPsec packet formed after encapsulation is sent to the second device through the IPsec tunnel; the second device is configured to perform GRE tunnel encapsulation on the second IPsec packet to form the target packet; wherein, the data packet carries the private network address and GRE identifier corresponding to the private network device.

16. The method according to claim 15, characterized in that The method further comprises: An IPsec tunnel is established between the first device and the second device.

17. A message transmission channel establishment device, characterized in that: Applied to a system including a transmitting end device and a receiving end device, the apparatus includes: An establishing unit is configured to establish a GRE tunnel between the sending device and the receiving device; the sending device is composed of a first device and a second device, wherein the first device is connected to multiple private network devices in the same private network, and the second device is connected to the first device and the receiving device respectively, and establishing the GRE tunnel between the sending device and the receiving device includes: determining whether the second device supports converting IPsec tunnel transmission into GRE tunnel transmission; if not, establishing the GRE tunnel between the first device and the receiving device; in the case of establishing the GRE tunnel between the first device and the receiving device, 1. configuring the first device to perform GRE tunnel encapsulation on the data message sent by the private network device to form a first GRE message, and then perform IPsec tunnel encapsulation on the first GRE message; wherein, the data message carries the private network address and GRE identifier corresponding to the private network device; if supported, establishing a GRE tunnel between the second device and the receiving device, and when the GRE tunnel between the second device and the receiving device is established, configuring the first device to perform IPsec tunnel encapsulation on the data message sent by the private network device, and sending the second IPsec message formed after encapsulation to the second device through the IPsec tunnel; configuring the second device to perform GRE tunnel encapsulation on the second IPsec message to form the target message; wherein, the data message carries the private network address and GRE identifier corresponding to the private network device; A configuration unit is used to configure a GRE tunnel application mechanism of the sending device, wherein the GRE tunnel application mechanism is used to limit the sending device to transmit a target message of a private network device to the receiving device through a GRE tunnel, wherein the target message carries a private network address and a GRE identifier corresponding to the private network device, and private network devices in the same private network share the same GRE identifier, and the GRE identifier is unique.

18. A computer-readable storage medium, characterized in that The storage medium includes a stored program, wherein, when the program is running, the device where the storage medium is located is controlled to execute the message transmission method described in any one of claims 1 to claim 7, and / or the message transmission method described in any one of claims 8 to claim 14, and / or the message transmission channel establishment method described in any one of claims 15 to claim 16.

Images