IPsec tunnel processing method and device

Abstract

The present application provides an IPsec tunnel processing method and device, which relates to the field of communication technology. The method is: before performing the second-stage IPsec negotiation, check the address information of each local current IPsec tunnel; if there are at least two first target IPsec tunnels with the same address information, determine whether the actions of protecting the data stream of the at least two target IPsec tunnels are the same; if there are at least two second target IPsec tunnels with the same actions of protecting the data stream, determine whether the address information of the protected data stream of the at least two second target IPsec tunnels meets the merging condition; if the merging condition is met, merge the at least two second target IPsec tunnels. The above method not only reduces the number of IPsec tunnels negotiated in the second stage, but also saves processing resources and memory resources.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to an IPsec tunnel processing method and device. Background Art

[0002] IPsec (IP security) is a three-layer tunnel encryption protocol developed by IETF. It provides high-quality cryptographic-based security guarantees for data transmitted on the Internet. It is a traditional security technology for implementing a three-layer VPN (Virtual Private Network). IPsec protects user data transmitted between specific communication parties by establishing a "channel" between them (for example, between two security gateways). This channel is usually called an IPsec tunnel.

[0003] The IPsec protocol is not a separate protocol. It provides a complete security architecture for network data security on the IP layer, including security protocols AH (Authentication Header) and ESP (Encapsulating Security Payload), IKE (Internet Key Exchange), and some algorithms for network authentication and encryption. SA (Security Association) is the basis of IPsec and the essence of IPsec. IPsec provides secure communication between two endpoints, which are called IPsec peers. Establishing an IPsec tunnel for communication requires two phases of negotiation, namely the first phase of IKE SA and the second phase of IPSec SA. In the process of negotiating the establishment of an IPSec VPN tunnel, the second phase of IPSec SA negotiation can only be initiated after the first phase of IKE SA negotiation is completed.

[0004] The negotiation of the traffic rules that need to be protected is in the two-phase IPSec SA negotiation stage. When multiple protection traffic rules are configured, a two-phase IPSec SA negotiation is established for each pair of protection traffic rules. Each two-phase IPSec SA negotiation will create a two-phase state to manage the dynamic negotiation information of each successful two-phase negotiation. The number of two-phase IPSec SA negotiations is large, and the number of message sending and receiving is large, which will cause performance consumption. In addition, the IPsec process will create a new state structure for each two-phase negotiation, resulting in more resource usage and memory waste. The process is very cumbersome and cannot play a good role in negotiation, and is inefficient. Summary of the invention

[0005] In view of this, the present application provides an IPsec tunnel processing method and device.

[0006] Specifically, the present application is implemented through the following technical solutions:

[0007] According to a first aspect of the present application, there is provided an IPsec tunnel processing method, comprising:

[0008] Before the second phase of IPsec negotiation, check the address information of each local IPsec tunnel;

[0009] If there are at least two first target IPsec tunnels with the same address information, determining whether the actions of protecting data flows of the at least two target IPsec tunnels are the same;

[0010] If there are at least two second target IPsec tunnels with the same action of protecting the data flow, determining whether the address information of the protected data flow of the at least two second target IPsec tunnels meets the merging condition;

[0011] If the merging condition is met, the at least two second target IPsec tunnels are merged.

[0012] According to a second aspect of the present application, there is provided an IPsec tunnel processing device, including:

[0013] A checking module is used to check the address information of each local current IPsec tunnel before performing the second-stage IPsec negotiation;

[0014] A first judging module, configured to judge whether the actions of protecting data flows of the at least two target IPsec tunnels are the same if the checking module detects that there are at least two first target IPsec tunnels with the same address information;

[0015] A second judgment module, configured to judge whether the address information of the protected data flows of the at least two second target IPsec tunnels meets the merging condition if the judgment result of the first judgment module is that there are at least two second target IPsec tunnels with the same action of protecting the data flows;

[0016] The tunnel merging module is used to merge the at least two second target IPsec tunnels if the judgment result of the second judgment module is that the merging condition is met.

[0017] According to the third aspect of the present application, an electronic device is provided, including a processor and a machine-readable storage medium, the machine-readable storage medium storing a computer program that can be executed by the processor, and the processor is prompted by the computer program to execute the method provided in the first aspect of the embodiment of the present application.

[0018] According to the fourth aspect of the present application, a machine-readable storage medium is provided, which stores a computer program. When called and executed by a processor, the computer program prompts the processor to execute the method provided in the first aspect of the embodiment of the present application.

[0019] Beneficial effects of the embodiments of the present application:

[0020] The IPsec tunnel processing method provided by the embodiment of the present application checks the address information of each local current IPsec tunnel before performing the second-stage IPsec negotiation; if there are at least two first target IPsec tunnels with the same address information, it is determined whether the actions of protecting the data stream of the at least two target IPsec tunnels are the same; if there are at least two second target IPsec tunnels with the same actions of protecting the data stream, it is determined whether the address information of the protected data stream of the at least two second target IPsec tunnels meets the merging conditions; if the merging conditions are met, the at least two second target IPsec tunnels are merged. By executing the above process, the IPsec tunnels that meet the above conditions are merged, thereby reducing the number of IPsec tunnels in the network security device, thereby reducing the number of IPsec SA negotiations and the number of messages in the second stage, and reducing the processing resources occupied by the IPsec tunnel, saving memory resources, improving the negotiation speed, and also improving the performance of the device. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] Figure 1 It is a flowchart of an IPsec tunnel processing method provided in an embodiment of the present application;

[0022] Figure 2 It is a structural schematic diagram of an IPsec tunnel processing device provided in an embodiment of the present application;

[0023] Figure 3 It is a hardware structure diagram of an electronic device for implementing an IPsec tunnel processing method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0024] Here, exemplary embodiments will be described in detail, and examples thereof are shown in the accompanying drawings. When the following description refers to the accompanying drawings, unless otherwise indicated, the same numbers in different drawings represent the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with the present application. Instead, they are only examples of devices and methods consistent with some aspects of the present application.

[0025] The terms used in this application are only for the purpose of describing specific embodiments and are not intended to limit this application. The singular forms of "a", "said" and "the" used in this application are also intended to include plural forms, unless the context clearly indicates other meanings. It should also be understood that the term "and / or" used in this article refers to and includes any or all possible combinations of one or more corresponding listed items.

[0026] It should be understood that although the terms first, second, third, etc. may be used in the present application to describe various information, these information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other. For example, without departing from the scope of the present application, the first information may also be referred to as the second information, and similarly, the second information may also be referred to as the first information. Depending on the context, the word "if" as used herein may be interpreted as "at the time of" or "when" or "in response to determining".

[0027] The IPsec tunnel processing method provided by this application is described in detail below.

[0028] See also Figure 1 , Figure 1 This is a flow chart of a message processing method provided by the present application, which can be applied to, but not limited to, a network security device, which can be, but not limited to, a gateway, a firewall device, etc. When the network security device implements the above method, it can include the following steps:

[0029] S101. Before performing the second-phase IPsec negotiation, check the address information of each local IPsec tunnel currently in use.

[0030] In this step, after the first-phase IKE SA negotiation, the network security device will establish more IPsec tunnels to manage the protected data flows in the network security device. In order to solve the problem of excessive redundancy of IPspec tunnels, the network security device can use the IPsec tunnel processing method provided in the present application to process the current IPsec tunnel in the network security device before conducting the second-phase IPsec negotiation, that is, before conducting the second-phase IPsec SA negotiation, that is, first check the address information of each current local IPsec tunnel.

[0031] Specifically, when checking the address information of each IPsec tunnel, a traversal method may be used, or a pairwise comparison may be performed, or other checking methods may be used, as long as it is possible to find out whether there is an IPsec tunnel with the same address information.

[0032] In addition, when checking the address information of the IPsec tunnel, the address information corresponding to the IPsec tunnel, that is, the address information of the interface used by the IPsec tunnel, can be obtained from the tunnel configuration information of each IPsec tunnel. Then, it is confirmed whether there are at least two IPsec tunnels with the same address information, and the at least two IPsec tunnels with the same address information that are checked can be recorded as the above-mentioned first target IPsec tunnel.

[0033] It should be noted that when checking address information, multiple groups of first target IPsec tunnels with the same address information may be checked, for example, a group of first target IPsec tunnels corresponding to address information 1, a first target IPsec tunnel corresponding to address information 2, and so on are screened out.

[0034] S102. If there are at least two first target IPsec tunnels with the same address information, determine whether the actions of protecting the data flow of the at least two target IPsec tunnels are the same; if the judgment result is that there are at least two second target IPsec tunnels with the same action of protecting the data flow, execute step S103; if the judgment result is that there are not at least two second target IPsec tunnels with the same action of protecting the data flow, execute step S105.

[0035] In this step, when it is checked that the address information of at least two first target IPsec tunnels is the same, it indicates that the communication channels used by the at least two first target IPsec tunnels are the same when providing communication services, and there is a possibility of tunnel merging. On this basis, in order to further confirm whether the tunnel merging can be performed, further processing can be performed: determine whether the actions of protecting the data flow of the at least two first target IPsec tunnels are the same, and then select the first target IPsec tunnels with the same action from the at least two first target IPsec tunnels. For the convenience of description, the first target IPsec tunnels with the same action are recorded as the second target IPsec tunnels.

[0036] If there are at least two second target IPsec tunnels, it indicates that the second target IPsec tunnels have the same address information and serve the same action of protecting data flows, further indicating that the aforementioned second target IPsec tunnels may be merged.

[0037] If the actions of protecting the data flows served by the first target IPsec tunnels are all different, step S105 is executed, and the first target IPsec tunnels are not merged. Since multiple groups of first target IPsec tunnels with the same address information may be screened out when step S101 is executed, if the actions of protecting the data flows of any first target IPsec tunnel with the same address information (such as address information 1) are all different, the tunnel merging operation is not performed on the first target IPsec tunnel with the address information, and then the IPsec tunnel processing method provided by the present application is performed on other first target IPsec tunnels with the same address information (such as address information 2).

[0038] Specifically, the action of protecting the data flow of the first target IPsec tunnel can be obtained by the following method: obtaining the action of protecting the data flow from the policy configuration of the first target IPsec tunnel. In addition, the policy configuration may include source IP address, destination IP address, protocol and action, etc. in addition to the action.

[0039] Optionally, the actions in the above policy configuration may include protection and non-protection, etc. On this basis, when determining whether the actions of protecting the data flows of at least two target IPsec tunnels are the same, the following process may be used to implement: whether the actions of protecting the data flows of at least two target IPsec tunnels are both protection actions. That is, the second target IPsec tunnel whose actions of protecting the data flows are all protection actions is selected from the first target IPsec tunnel.

[0040] S103, determine whether the address information of the protected data flows of the at least two second target IPsec tunnels meets the merging condition. If the determination result is that the merging condition is met, execute step S104; if the determination result is that the merging condition is not met, execute step S105.

[0041] In this step, after determining that there are at least two second target IPsec tunnels, in order to further ensure that the subsequent IPsec tunnel service is not affected after the merger, it is further determined whether the address information of the protected data flow of the at least two second target IPsec tunnels selected meets the merger condition. When the merger condition is met, it indicates that the network segments of the aforementioned second target IPsec tunnels may belong to the same network segment, based on which, step S104 is executed. When the merger condition is not met, the merger process is not performed, that is, step S105 is executed.

[0042] S104: Merge the at least two second target IPsec tunnels.

[0043] In this step, when the above judgment conditions are met, it means that the address information of the aforementioned second target IPsec tunnel is the same, the action of protecting the data flow served and the network segment of the served data flow meet the merging conditions, then the second target IPsec tunnels whose network segments meet the merging conditions in at least two second target IPsec tunnels can be merged, and only one second target IPsec tunnel is retained, and then the network segments are merged. In this way, the number of IPsec tunnels in the network security device is reduced, and then the number of second-stage IPsec SA negotiations and the number of messages are reduced, while reducing the processing resources and memory resources occupied by the IPsec tunnel.

[0044] S105. Keep the second target IPsec tunnel unchanged.

[0045] By implementing the IPsec tunnel processing method provided by the present application, before performing the second-stage IPsec negotiation, the address information of each local current IPsec tunnel is checked; if there are at least two first target IPsec tunnels with the same address information, it is determined whether the actions of protecting the data stream of the at least two target IPsec tunnels are the same; if there are at least two second target IPsec tunnels with the same actions of protecting the data stream, it is determined whether the address information of the protected data stream of the at least two second target IPsec tunnels meets the merging conditions; if the merging conditions are met, the at least two second target IPsec tunnels are merged. By executing the above process, the IPsec tunnels that meet the above conditions are merged, thereby reducing the number of IPsec tunnels in the network security device, thereby reducing the number of IPsec SA negotiations and the number of messages in the second stage, and reducing the processing resources occupied by the IPsec tunnel, saving memory resources, improving the negotiation speed, and also improving the performance of the device.

[0046] When the merging condition is not met, the current second IPsec tunnel is kept unchanged, that is, the tunnel configuration information, policy configuration and other information of the second target IPsec tunnel are kept unchanged.

[0047] Optionally, based on the above embodiments, in this embodiment, the step of determining whether the address information of the protected data streams of the at least two second target IPsec tunnels meets the merging conditions in step S103 can be performed according to the following method: if the network segments of the protected data streams of the at least two second target IPsec tunnels are in an inclusion relationship, or the network segments of the protected data streams of the at least two second target IPsec tunnels are continuous network segments, it is determined that the merging conditions are met; if they are not in an inclusion relationship and are not continuous network segments, it is determined that the merging conditions are not met.

[0048] Specifically, taking two second target IPsec tunnels as examples, the second target IPsec tunnel 1 and the second target IPsec tunnel 2, the address range 1 of the second target IPsec tunnel 1 is [address 1, address 2]; the address range 2 of the second target IPsec tunnel 2 is [address 3, address 4], then based on the address range 1, the network segment 1 of the second target IPsec tunnel 1 can be determined, and based on the address range 2, the network segment 2 of the second target IPsec tunnel 2 can be determined. If it is determined that network segment 1 and network segment 2 are continuous network segments, that is, continuous network segments, network segment 1 and network segment 2 meet the merging condition. When determining the inclusion relationship, in one example, if address 1 is less than address 3 and address 2 is greater than address 4, it means that network segment 2 falls into network segment 1, then it can be determined that network segment 1 and network segment 2 belong to the inclusion relationship, that is, the merging condition is met.

[0049] On this basis, the address information of the above-mentioned protected data flow includes an address range; then the network segments of the protected data flows of the at least two second target IPsec tunnels can be determined to belong to an inclusion relationship according to the following process: when the address ranges of the protected flows of the at least two second target IPsec tunnels have an intersection, determine the mask value of the network segment of each second target IPsec tunnel; determine the mask value based on the protected data flows of each second target IPsec tunnel, and determine whether the network segments of the protected data flows of the at least two second target IPsec tunnels belong to an inclusion relationship.

[0050] Specifically, the policy configuration of each second target IPsec tunnel will store the address range to be protected, that is, the protected data stream falling within the address range needs to be protected. In order to further ensure that the merged IPsec tunnel will not affect the normal processing of the protected data stream, the above-mentioned judgment process of the inclusion relationship is proposed in this embodiment. For the sake of convenience of understanding, the above-mentioned second target IPsec tunnel 1 and second target IPsec tunnel 2 are still used as examples for explanation. First, the policy configurations of the two second target IPsec tunnels are obtained, and then the address range 1 and address range 2 are obtained from the policy configurations of the two second target IPsec tunnels respectively. If address 1 is less than address 3, and address 2 is greater than address 3, it can be determined that address range 1 and address range 2 have an intersection. On this basis, two mask values ​​can be calculated based on network segment 1 and network segment 2, respectively, to obtain mask value 1 of network segment 1 and mask value 2 of network segment 2; at this time, mask value 1 and mask value 2 can be compared. Since the smaller the mask value, the larger the address range of the corresponding network segment, based on this, the smaller mask value of the two mask values ​​can be determined, and then it is determined whether network segment 1 of the second target IPsec tunnel 1 and network segment 2 of the second target IPsec tunnel 2 are in a containment relationship. For example, if the difference between mask value 1 and mask value 2 is within the set range, it can be determined that network segment 1 of the second target IPsec tunnel 1 and network segment 2 of the second target IPsec tunnel 2 are in a containment relationship; otherwise, they are not in a containment relationship. Of course, other methods can also be used based on the mask value to determine whether network segment 1 and network segment 2 are in a containment relationship, which will not be described in detail here.

[0051] In addition, if it is determined that it is not an inclusion relationship, such as an intersection relationship, tunnel merging processing will not be performed.

[0052] Based on any of the above embodiments, the address information of the IPsec tunnel in this embodiment includes a local address and a peer address. On this basis, the following method can be used to determine whether there are at least two first target IPsec tunnels with the same address information: if the local addresses of at least two first target IPsec tunnels in the IPsec tunnels are the same and the peer addresses are the same, then it is determined that there are at least two first target IPsec tunnels with the same address information. By implementing this determination method, it is possible to accurately determine whether there are first target IPsec tunnels with the same address information.

[0053] Based on any of the above embodiments, in this embodiment, step S104 may be performed according to the following method: merging the network segments of the at least two second target IPsec tunnels.

[0054] Specifically, when tunnel merging is performed, the tunnel configuration information and policy configuration information of the second target IPsec tunnel that meets the merging conditions can be merged, and then only one second target IPsec tunnel that meets the merging conditions is retained. In this way, the number of IPsec tunnels in the network security device is reduced, and then the number and number of IPsec tunnels used for the second phase negotiation are reduced; at the same time, the negotiation speed is improved and the CPU processing resources and memory usage of the IPsec process are reduced.

[0055] Based on the same inventive concept, the present application also provides an IPsec tunnel processing device corresponding to the above IPsec tunnel processing method. The implementation of the IPsec tunnel processing device can refer to the above description of the IPsec tunnel processing method, which will not be discussed here one by one.

[0056] See also Figure 2 , Figure 2 An IPsec tunnel processing device provided by an exemplary embodiment of the present application includes:

[0057] A checking module 201, used for checking the address information of each local current IPsec tunnel before performing the second phase IPsec negotiation;

[0058] A first judging module 202 is configured to judge whether the actions of protecting data flows of the at least two target IPsec tunnels are the same if the checking module 201 finds that there are at least two first target IPsec tunnels with the same address information;

[0059] A second judgment module 203 is configured to judge whether the address information of the protected data flows of the at least two second target IPsec tunnels meets the merging condition if the judgment result of the first judgment module 202 is that there are at least two second target IPsec tunnels with the same action of protecting the data flows;

[0060] The tunnel merging module 204 is configured to merge the at least two second target IPsec tunnels if the determination result of the second determination module 203 is that a merging condition is met.

[0061] Optionally, based on the above embodiments, the second judgment module 202 in this embodiment is specifically used to determine that the merging condition is met if the network segments of the protected data streams of the at least two second target IPsec tunnels are in an inclusion relationship, or the network segments of the protected data streams of the at least two second target IPsec tunnels are continuous network segments; if they are not in an inclusion relationship and are not continuous network segments, it is determined that the merging condition is not met.

[0062] Furthermore, the address information of the protected data stream in this embodiment includes an address range;

[0063] The above-mentioned second judgment module 202 is specifically used to determine whether the network segments of the protected data flows of the at least two second target IPsec tunnels belong to an inclusion relationship according to the following method: when the address ranges of the protected flows of the at least two second target IPsec tunnels have an intersection, determine the mask value of the network segment of each second target IPsec tunnel; determine the mask value based on the protected data flows of each second target IPsec tunnel, and determine whether the network segments of the protected data flows of the at least two second target IPsec tunnels belong to an inclusion relationship.

[0064] Optionally, based on any of the above embodiments, the address information of the IPsec tunnel in this embodiment includes a local end address and a remote end address;

[0065] The above-mentioned inspection module 201 is specifically used to determine the existence of at least two first target IPsec tunnels with the same address information according to the following method: if the local addresses of at least two first target IPsec tunnels in the IPsec tunnels are the same and the opposite end addresses are the same, it is determined that there are at least two first target IPsec tunnels with the same address information.

[0066] Optionally, based on any of the above embodiments, the tunnel merging module 204 in this embodiment is specifically configured to merge the network segments of the at least two second target IPsec tunnels.

[0067] By providing the above-mentioned IPsec tunnel processing device, before the second-stage IPsec negotiation is carried out, the address information of each local current IPsec tunnel is checked; if there are at least two first target IPsec tunnels with the same address information, it is determined whether the actions of protecting the data stream of the at least two target IPsec tunnels are the same; if there are at least two second target IPsec tunnels with the same actions of protecting the data stream, it is determined whether the address information of the protected data stream of the at least two second target IPsec tunnels meets the merging condition; if the merging condition is met, the at least two second target IPsec tunnels are merged. By executing the above-mentioned process, the IPsec tunnels that meet the above-mentioned conditions are merged, thereby reducing the number of IPsec tunnels in the network security device, thereby reducing the number of IPsec SA negotiations and the number of messages in the second stage, and reducing the processing resources occupied by the IPsec tunnel, saving memory resources, improving the negotiation speed, and also improving the performance of the device.

[0068] Based on the same inventive concept, an embodiment of the present application provides an electronic device, which can be but is not limited to the above-mentioned network security device. Figure 3As shown, the electronic device includes a processor 301 and a machine-readable storage medium 302, the machine-readable storage medium 302 stores a computer program that can be executed by the processor 301, and the processor 301 is prompted by the computer program to execute the IPsec tunnel processing method provided by any embodiment of the present application. In addition, the electronic device also includes a communication interface 303 and a communication bus 304, wherein the processor 301, the communication interface 303, and the machine-readable storage medium 302 communicate with each other through the communication bus 304.

[0069] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0070] The communication interface is used for communication between the above electronic device and other devices.

[0071] The machine-readable storage medium 302 may be a memory, which may include a random access memory (RAM), a DDR SRAM (Double Data Rate Synchronous Dynamic Random Access Memory), or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the processor.

[0072] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0073] As for the electronic device and machine-readable storage medium embodiments, since the method contents involved are basically similar to the aforementioned method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0074] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0075] The implementation process of the functions and effects of each unit / module in the above-mentioned device is specifically described in the implementation process of the corresponding steps in the above-mentioned method, and will not be repeated here.

[0076] For the device embodiments, since they basically correspond to the method embodiments, the relevant parts can refer to the partial description of the method embodiments. The device embodiments described above are merely schematic, wherein the units / modules described as separate components may or may not be physically separated, and the components displayed as units / modules may or may not be physical units / modules, that is, they may be located in one place, or they may be distributed on multiple network units / modules. Some or all of the units / modules may be selected according to actual needs to achieve the purpose of the present application. A person of ordinary skill in the art can understand and implement it without creative work.

[0077] The above description is only a preferred embodiment of the present application and is not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A method for processing an IPsec tunnel, characterized in that: include: Before the second phase of IPsec negotiation, check the address information of each local IPsec tunnel; If there are at least two first target IPsec tunnels with the same address information, determine whether the actions of protecting the data flow of the at least two first target IPsec tunnels are the same, and record the first target IPsec tunnel with the same action as the second target IPsec tunnel; If there are at least two second target IPsec tunnels with the same action of protecting the data flow, determining whether the address information of the protected data flow of the at least two second target IPsec tunnels meets the merging condition; If the merging condition is met, the at least two second target IPsec tunnels are merged.

2. The method according to claim 1, characterized in that Determining whether the address information of the protected data flows of the at least two second target IPsec tunnels meets the merging condition includes: If the network segments of the protected data flows of the at least two second target IPsec tunnels are in an inclusion relationship, or the network segments of the protected data flows of the at least two second target IPsec tunnels are continuous network segments, it is determined that the merging condition is met; If there is no inclusion relationship and the network segments are not continuous, it is determined that the merging condition is not met.

3. The method according to claim 2, characterized in that The address information of the protected data flow includes an address range; then the network segments of the protected data flows of the at least two second target IPsec tunnels are determined to be in an inclusion relationship according to the following method: When the address ranges of the protected data flows of the at least two second target IPsec tunnels have an intersection, determining a mask value of the network segment of each second target IPsec tunnel; A mask value is determined based on the protected data flows of each second target IPsec tunnel, and it is determined whether the network segments of the protected data flows of the at least two second target IPsec tunnels are in an inclusion relationship.

4. The method according to claim 1, characterized in that: The address information of the IPsec tunnel includes a local address and a remote address; Determine that there are at least two first target IPsec tunnels with the same address information according to the following method: If the local end addresses of at least two first target IPsec tunnels in the IPsec tunnel are the same and the opposite end addresses are the same, it is determined that there are at least two first target IPsec tunnels with the same address information.

5. The method according to claim 1, characterized in that The at least two second target IPsec tunnels are merged, comprising: The network segments of the at least two second target IPsec tunnels are merged.

6. An IPsec tunnel processing device, characterized in that: include: A checking module is used to check the address information of each local current IPsec tunnel before performing the second phase IPsec negotiation; A first judging module is configured to judge whether the actions of protecting data flows of the at least two first target IPsec tunnels are the same if the checking module detects that there are at least two first target IPsec tunnels with the same address information, and record the first target IPsec tunnels with the same actions as second target IPsec tunnels; A second judgment module, configured to judge whether the address information of the protected data flows of the at least two second target IPsec tunnels meets the merging condition if the judgment result of the first judgment module is that there are at least two second target IPsec tunnels with the same action of protecting the data flows; The tunnel merging module is used to merge the at least two second target IPsec tunnels if the judgment result of the second judgment module is that the merging condition is met.

7. The device according to claim 6, characterized in that The second judgment module is specifically used to determine that the merging condition is met if the network segments of the protected data flows of the at least two second target IPsec tunnels belong to an inclusion relationship, or the network segments of the protected data flows of the at least two second target IPsec tunnels belong to continuous network segments; If there is no inclusion relationship and the network segments are not continuous, it is determined that the merging condition is not met.

8. The device according to claim 7, characterized in that The address information of the protection data stream includes an address range; then The second judgment module is specifically used to determine whether the network segments of the protected data flows of the at least two second target IPsec tunnels belong to an inclusion relationship according to the following method: when the address ranges of the protected data flows of the at least two second target IPsec tunnels have an intersection, determine the mask value of the network segment of each second target IPsec tunnel; A mask value is determined based on the protected data flows of each second target IPsec tunnel, and it is determined whether the network segments of the protected data flows of the at least two second target IPsec tunnels are in an inclusion relationship.

9. The device according to claim 6, characterized in that The address information of the IPsec tunnel includes a local address and a remote address; The inspection module is specifically used to determine the existence of at least two first target IPsec tunnels with the same address information according to the following method: if the local addresses of at least two first target IPsec tunnels in the IPsec tunnels are the same and the opposite end addresses are the same, it is determined that there are at least two first target IPsec tunnels with the same address information.

10. The device according to claim 6, characterized in that The tunnel merging module is specifically used to merge the network segments of the at least two second target IPsec tunnels.

Images