Packet forwarding method, apparatus, and network device

Abstract

The application relates to the technical field of communication, and provides a message forwarding method, device and network equipment. The device comprises a transceiving module, an analysis module, an encryption and decryption module and a DMA connected through a bus. The transceiving module identifies the received message, marks the message as plaintext if the message is identified as plaintext to obtain a message to be encrypted, and sends the message to the DMA through the analysis module to store the message to a storage module, so that a CPU encapsulates the message to be encrypted to obtain an encapsulated message, obtains a target encryption index value according to the encapsulated message, and sends the encapsulated message and the target encryption index value to the encryption and decryption module through the DMA. The encryption and decryption module obtains a target encryption parameter according to the target encryption index value, encrypts and authenticates the encapsulated message to obtain an encrypted message, and forwards the encrypted message through the transceiving module. The encryption and decryption module is arranged between the transceiving module and the DMA, the interaction with the CPU is reduced to once, on-the-fly processing is realized, resources are saved, and the time delay is reduced through hardware encryption.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and more specifically, to a message forwarding method, apparatus 5, and network device. Background Technology

[0002] With the advent of the big data era, the security requirements for communication data transmission are becoming increasingly stringent. Currently, encryption and decryption of communication data are generally done through pure software, but this can lead to…

[0003] Significant latency. Although hardware encryption and decryption methods exist, they often require multiple interactions with the CPU, resulting in excessive resource consumption and high CPU usage. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a message forwarding method, apparatus and network device.

[0005] To achieve the above objectives, the technical solution adopted by the present invention is as follows: 5. In a first aspect, the present invention provides a message forwarding method applied to a message forwarding device of a network device, the device comprising a transceiver module, a parsing module, an encryption / decryption module, and a DMA connected via a bus, wherein the DMA is communicatively connected to a CPU and a storage module in the network device, and the CPU is communicatively connected to the storage module; the method includes:

[0006] The transceiver module identifies the received message. If the message is identified as plaintext, it marks the message with a flag to be encrypted to obtain the message to be encrypted and sends it to the parsing module.

[0007] The parsing module sends the message to be encrypted to the DMA;

[0008] The DMA stores the message to be encrypted in the storage module, so that the CPU can obtain the message to be encrypted from the storage module, and after performing a packaging operation on the message to be encrypted to obtain a packaged message and obtaining the target encryption index value based on the packaged message, the packaged message is stored in the storage module and the target encryption index value is sent to the DMA.

[0009] The DMA sends the target encrypted index value and the encapsulated message obtained from the storage module to the encryption / decryption module;

[0010] The encryption / decryption module obtains the target encryption parameters based on the target encryption index value, and performs encryption and authentication operations on the encapsulated message based on the target encryption parameters to obtain an encrypted message, and then sends the encrypted message to the transceiver module.

[0011] The transceiver module forwards the encrypted message.

[0012] In an optional implementation, the CPU stores a plaintext feature table and a plaintext index table. The plaintext feature table includes multiple plaintext feature values ​​and their corresponding plaintext index values. The plaintext index table includes an encryption index value and encapsulation rules corresponding to each plaintext index value.

[0013] The CPU performs an encapsulation operation on the message to be encrypted to obtain an encapsulated message and obtains the target encryption index value based on the encapsulated message, including:

[0014] Extract the plaintext feature value of the message to be encrypted, and obtain the initial plaintext index value corresponding to the plaintext feature value of the message to be encrypted according to the plaintext feature table;

[0015] The target encapsulation rule corresponding to the initial plaintext index value is obtained according to the plaintext index table;

[0016] The message to be encrypted is encapsulated according to the target encapsulation rule to obtain the encapsulated message.

[0017] Extract the plaintext feature value of the encapsulated message, and obtain the target plaintext index value corresponding to the plaintext feature value of the encapsulated message according to the plaintext feature table;

[0018] Obtain the target encrypted index value corresponding to the target plaintext index value according to the plaintext index table.

[0019] In an optional implementation, the encryption / decryption module includes multiple encrypted storage blocks storing encryption parameters, and the address of one of the encrypted storage blocks corresponds to one of the encrypted index values;

[0020] The encryption / decryption module obtains the target encryption parameters based on the target encryption index value, including:

[0021] The target encrypted storage block is determined from all encrypted storage blocks, and the address of the target encrypted storage block corresponds to the target encrypted index value;

[0022] Obtain the encryption parameters from the target encrypted storage block to obtain the target encryption parameters.

[0023] In an optional implementation, after the transceiver module identifies the received message, the method further includes:

[0024] If the message is identified as ciphertext, the message is marked with a decryption identifier to obtain the message to be decrypted. The ciphertext feature value of the message to be decrypted and the target decryption index information are obtained based on the ciphertext feature value of the message to be decrypted. The target decryption index information and the message to be decrypted are then sent to the parsing module.

[0025] The parsing module parses the target decryption index information to obtain the target decryption index value, and sends the target decryption index value and the message to be decrypted to the encryption / decryption module;

[0026] The encryption / decryption module obtains the target decryption parameters based on the target decryption index value, and performs authentication and decryption operations on the message to be decrypted based on the target decryption parameters to obtain a decrypted message, and then sends the decrypted message to the DMA.

[0027] The DMA stores the decrypted message in the storage module, so that the CPU can obtain the decrypted message from the storage module, perform an editing operation on the decrypted message to obtain an edited message, and then store the edited message in the storage module.

[0028] The DMA will send the edited message obtained from the storage module to the transceiver module;

[0029] The transceiver module forwards the edited message.

[0030] In an optional implementation, the transceiver module stores a ciphertext feature table, which includes multiple ciphertext feature values ​​and their corresponding ciphertext index values. The transceiver module includes multiple storage blocks storing decryption index information, and the address of one storage block corresponds to one ciphertext index value.

[0031] The transceiver module obtains the target decryption index information based on the ciphertext feature value of the message to be decrypted, including:

[0032] Obtain the target ciphertext index value corresponding to the ciphertext feature value of the message to be decrypted based on the ciphertext feature table;

[0033] The target storage block is determined among all storage blocks, and the address of the target storage block corresponds to the target ciphertext index value;

[0034] Obtain the decryption index information in the target storage block to obtain the target decryption index information.

[0035] In an optional implementation, the encryption / decryption module includes multiple decryption storage blocks storing decryption parameters, and the address of one of the decryption storage blocks corresponds to one of the decryption index values;

[0036] The step of the encryption / decryption module obtaining the target decryption parameter based on the target decryption index value includes:

[0037] The target decryption storage block is determined from all decryption storage blocks, and the address of the target decryption storage block corresponds to the target decryption index value;

[0038] Obtain the decryption parameters from the target decryption storage block to obtain the target decryption parameters.

[0039] In an optional implementation, the transceiver module identifies the received messages, including:

[0040] Identify the received messages;

[0041] If the message is identified to have preset plaintext characteristics, the message is identified as plaintext; wherein, the plaintext characteristics include network protocol type, source IP address, destination IP address, source port number and destination port number;

[0042] If the message is found to have preset ciphertext features, the message is identified as ciphertext; wherein the ciphertext features include network protocol type, destination port number and encryption protocol type.

[0043] In a second aspect, the present invention provides a message forwarding device, the device comprising a transceiver module, a parsing module, an encryption / decryption module and a DMA connected via a bus, wherein the DMA is communicatively connected to a CPU and a storage module in a network device, and the CPU is communicatively connected to the storage module.

[0044] The transceiver module is used to identify the received message. If the message is identified as plaintext, the message is marked with a code to be encrypted to obtain the message to be encrypted and sent to the parsing module.

[0045] The parsing module is used to send the message to be encrypted to the DMA;

[0046] The DMA is used to store the message to be encrypted in the storage module, so that the CPU can obtain the message to be encrypted from the storage module, obtain the target encryption index value based on the message to be encrypted, and perform an encapsulation operation on the message to be encrypted to obtain an encapsulated message, then store the encapsulated message in the storage module and send the target encryption index value to the DMA.

[0047] The DMA is used to send the target encrypted index value and the encapsulated message obtained from the storage module to the encryption / decryption module;

[0048] The encryption / decryption module is used to obtain the target encryption parameters based on the target encryption index value, and then perform encryption and authentication operations on the encapsulated message based on the target encryption parameters to obtain an encrypted message, and then send the encrypted message to the transceiver module.

[0049] The transceiver module is used to forward the encrypted message.

[0050] In an optional implementation, the transceiver module is further configured to:

[0051] Identify the received messages;

[0052] If the message is identified to have preset plaintext characteristics, the message is identified as plaintext; wherein, the plaintext characteristics include network protocol type, source IP address, destination IP address, source port number and destination port number;

[0053] If the message is found to have preset ciphertext features, the message is identified as ciphertext; wherein the ciphertext features include network protocol type, destination port number and encryption protocol type.

[0054] Thirdly, the present invention provides a network device, including a CPU and a storage module connected in communication, and a message forwarding device as described in any of the foregoing embodiments, wherein the CPU and the storage module are both connected in communication with the DMA in the message forwarding device.

[0055] The present invention provides a message forwarding method, apparatus, and network device. The message forwarding apparatus includes a transceiver module, a parsing module, an encryption / decryption module, and a DMA connected via a bus. The DMA is communicatively connected to the CPU and storage module in the network device, and the CPU is communicatively connected to the storage module. The transceiver module identifies the received message. If the message is identified as plaintext, it marks the message with a flag to be encrypted to obtain a message to be encrypted and sends it to the DMA via the parsing module. The DMA stores the message to be encrypted in the storage module, so that the CPU can retrieve the message to be encrypted from the storage module, encapsulate the message to be encrypted to obtain an encapsulated message, and obtain a target encryption index value based on the encapsulated message. The CPU then stores the encapsulated message in the storage module so that the CPU can send the target encryption index value and the encapsulated message to the encryption / decryption module via the DMA. The encryption / decryption module obtains the target encryption parameters based on the target encryption index value, and performs encryption and authentication operations on the encapsulated message based on the target encryption parameters to obtain an encrypted message. The encrypted message is then sent to the transceiver module for forwarding. The transceiver module, encryption / decryption module, and DMA are connected via a bus. The encryption / decryption module is positioned between the transceiver module and the DMA. Communication between the CPU and the encryption / decryption module is achieved through the DMA, reducing the number of interactions with the CPU to one, enabling on-path processing and saving CPU resources. Furthermore, hardware encryption of messages by the encryption / decryption module reduces latency and improves processing efficiency.

[0056] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, preferred embodiments are described below in detail with reference to the accompanying drawings. Attached Figure Description

[0057] To more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention and should not be regarded as a limitation on the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0058] Figure 1 An example diagram of a prior art message forwarding method is shown;

[0059] Figure 2 An example diagram of another message forwarding method in the prior art is shown;

[0060] Figure 3 A block diagram of a network device provided in an embodiment of the present invention is shown;

[0061] Figure 4 This invention provides a schematic flowchart of a message forwarding method according to an embodiment of the invention.

[0062] Figure 5 An example diagram of a message forwarding method provided in an embodiment of the present invention is shown;

[0063] Figure 6 This illustration shows another flowchart of the message forwarding method provided in an embodiment of the present invention;

[0064] Figure 7 This diagram illustrates yet another example of the message forwarding method provided in this embodiment of the invention.

[0065] Icons: 10-Message forwarding device; 20-CPU; 30-Storage module; 110-Bus; 120-Transceiver module; 130-Parselation module; 150-Encryption / decryption module; 170-DMA. Detailed Implementation

[0066] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. The components of the embodiments of the present invention described and shown in the accompanying drawings can generally be arranged and designed in various different configurations.

[0067] Therefore, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely to illustrate selected embodiments of the invention. All other embodiments obtained by those skilled in the art based on the embodiments of the invention without inventive effort are within the scope of protection of the invention.

[0068] It should be noted that relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0069] With the advent of the big data era, the requirements for the security of communication data transmission are becoming increasingly stringent. For example... Figure 1The diagram shows an example of encryption during message forwarding using pure software. The transceiver module sends the received plaintext message to the DMA (Direct Memory Access) module, which then sends the plaintext message to the CPU. The CPU encrypts the plaintext message using software to obtain the ciphertext message, and then sends the ciphertext message back to the transceiver module via the DMA for forwarding. However, this pure software encryption and decryption method generates significant latency, and since encryption and decryption are performed by the CPU, it consumes excessive CPU resources.

[0070] like Figure 2 The diagram illustrates a current hardware-based encryption method for packet forwarding. The transceiver module sends the received plaintext packet to the first DMA, which then sends it to the CPU. The CPU sends the plaintext packet to the encryption / decryption module via a second DMA. The encryption / decryption module encrypts the plaintext packet using various hardware components to obtain ciphertext, and sends the ciphertext to the CPU via the second DMA. The CPU then sends the ciphertext to the transceiver module via the first DMA for forwarding. It can be seen that this method involves two interactions with the CPU, resulting in excessive resource consumption and high CPU overhead. In other words, current methods of encryption / decryption during packet forwarding suffer from high latency and excessive CPU resource consumption. Therefore, this invention provides a packet forwarding method to address these issues.

[0071] Please refer to Figure 3 This is a block diagram of a network device provided in an embodiment of the present invention. The network device includes a packet forwarding device 10, a CPU 20, and a storage module 30. The packet forwarding device 10 includes a transceiver module 120, a parsing module 130, an encryption / decryption module 150, and a DMA 170 connected via a bus 110.

[0072] The transceiver module 120 is used to receive and forward messages. The parsing module 130 can parse out some information in the message. The encryption / decryption module 150 is used to encrypt and decrypt messages. The DMA 170 is communicatively connected to the CPU 20 and the storage module 30, and is used to realize data transmission between the message forwarding device 10 and the CPU 20.

[0073] CPU20 is an integrated circuit chip with signal processing capabilities, capable of encapsulating and editing messages. Storage module 30 can be either DDR (Double Data Rate) or SRAM (Static Random-Access Memory).

[0074] Understandable Figure 3 The structure shown is only a schematic diagram of a network device; the network device may also include components that are larger than those shown. Figure 3 The more or fewer components shown, or having the same Figure 3 The different configurations shown. Figure 3 The components shown can be implemented using hardware, software, or a combination thereof.

[0075] The network device provided in this embodiment of the invention is a dedicated hardware device for constructing an information communication network. It may be a router, a switch, etc., and this embodiment of the invention does not limit it.

[0076] The above-mentioned message forwarding device 10 will be used as the execution subject to execute the various steps in the various methods provided in the embodiments of the present invention and achieve the corresponding technical effects.

[0077] Please see Figure 4 , Figure 4 This is a flowchart illustrating a message forwarding method provided in an embodiment of the present invention.

[0078] In step S202, the transceiver module identifies the received message. If the message is identified as plaintext, it marks the message with a flag to be encrypted to obtain the message to be encrypted and sends it to the parsing module.

[0079] Step S204: The parsing module sends the message to be encrypted to the DMA;

[0080] In this embodiment, the identifier to be encrypted can be understood as a tag used to indicate that the message needs to be encrypted. The identifier to be encrypted can be set according to the actual application, and this embodiment of the invention does not impose any limitations.

[0081] The network device receives messages sent by other devices through the transceiver module 120, and the transceiver module 120 identifies the received messages to determine whether they are plaintext or ciphertext. If the transceiver module 120 identifies the received message as plaintext, it marks the message with a "to be encrypted" identifier to indicate that the message needs to be encrypted, thus obtaining the message to be encrypted and sending it to the parsing module 130.

[0082] The parsing module 130 receives the message to be encrypted, then parses some key information of the message to be encrypted to obtain information such as the receiving timestamp, receiving port information, and message type (flowid), and then sends the message to be encrypted and some key information to DMA170.

[0083] In step S206, the DMA stores the message to be encrypted to the storage module, so that the CPU can obtain the message to be encrypted from the storage module, and perform a packaging operation on the message to be encrypted to obtain a packaged message and obtain the target encryption index value based on the packaged message. Then, the packaged message is stored in the storage module and the target encryption index value is sent to the DMA.

[0084] In step S208, the DMA sends the target encrypted index value and the encapsulated message obtained from the storage module 30 to the encryption / decryption module;

[0085] In this embodiment, the DMA170 includes a receive channel (RX) and a transmit channel (TX), both of which have ring buffers. The ring buffer of the receive channel can be represented by the RX Ring, and the ring buffer of the transmit channel can be represented by the TX Ring. Each pointer in the RX Ring points to each RX direction descriptor, and each pointer in the TX Ring points to each TX direction descriptor. The packet descriptor is used to express the state of the message and is a hardware-dependent data structure.

[0086] The storage module 30 includes a buffer unit, such as a Packet Buffer, for caching messages. The DMA170 stores the received message to be encrypted into the Packet Buffer in the storage module 30 and uses an RX direction descriptor to record the status of the message to be encrypted. For example, the RX direction descriptor records information such as the receive timestamp, receive port information, message type, and the address of the message to be encrypted in the storage space.

[0087] Then, CPU20 retrieves the message to be encrypted from storage module 30 using the address in the RX direction descriptor, performs encapsulation on the message to be encrypted to obtain an encapsulated message, obtains the target encryption index value based on the encapsulated message, stores the encapsulated message in storage module 30, and updates the address of the encapsulated message in storage module 30 and the target encryption index value in the TX direction descriptor.

[0088] The DMA170 obtains the target encrypted index value through the TX direction descriptor, retrieves the encapsulated message from the storage module 30 according to the address in the TX direction descriptor, and then sends the encapsulated message and the target encrypted index value to the encryption / decryption module 150.

[0089] In step S210, the encryption / decryption module obtains the target encryption parameters based on the target encryption index value, and performs encryption and authentication operations on the encapsulated message based on the target encryption parameters to obtain the encrypted message, and then sends the encrypted message to the transceiver module.

[0090] Step S212: The transceiver module forwards the encrypted message;

[0091] In this embodiment, the encryption / decryption module 150 obtains the target encryption parameters based on the received target encryption index value, and performs encryption and authentication operations on the encapsulated message according to the target encryption parameters to obtain the encrypted message. The encrypted message is then sent to the transceiver module 120 so that the transceiver module 120 can forward the encrypted message to other devices.

[0092] It should be understood that the encryption / decryption module 150 may perform only encryption, only authentication, or encryption followed by authentication, or authentication followed by encryption, or no operation at all. In other words, the operations performed by the encryption / decryption module 150 can be configured according to the actual application, and this embodiment of the invention does not impose any limitations.

[0093] As can be seen, by connecting the transceiver module, encryption / decryption module, and DMA via a bus, the encryption / decryption module is positioned between the transceiver module and the DMA. Communication between the CPU and the encryption / decryption module is achieved through the DMA, ensuring that the message encryption process requires only one interaction with the CPU. This reduces the number of interactions and saves CPU resources, enabling in-circuit encryption. Furthermore, the hardware encryption method employed by the encryption / decryption module reduces latency and improves processing efficiency.

[0094] As can be seen from the above steps, the message forwarding device includes a transceiver module, a parsing module, an encryption / decryption module, and a DMA connected via a bus. The DMA is communicatively connected to the CPU and storage module in the network device, and the CPU is communicatively connected to the storage module. The transceiver module identifies the received message. If the message is identified as plaintext, it marks the message with a flag to be encrypted to obtain the message to be encrypted and sends it to the DMA via the parsing module. The DMA stores the message to be encrypted in the storage module so that the CPU can retrieve the message to be encrypted from the storage module, encapsulate the message to be encrypted to obtain an encapsulated message, and obtain the target encryption index value based on the encapsulated message. The CPU then stores the encapsulated message in the storage module so that the CPU can send the target encryption index value and the encapsulated message to the encryption / decryption module via the DMA. The encryption / decryption module obtains the target encryption parameters based on the target encryption index value, and performs encryption and authentication operations on the encapsulated message based on the target encryption parameters to obtain an encrypted message. The encrypted message is then sent to the transceiver module for forwarding. The transceiver module, encryption / decryption module, and DMA are connected via a bus. The encryption / decryption module is positioned between the transceiver module and the DMA. Communication between the CPU and the encryption / decryption module is achieved through the DMA, reducing the number of interactions with the CPU to one, enabling on-path processing and saving CPU resources. Furthermore, hardware encryption of messages by the encryption / decryption module reduces latency and improves processing efficiency.

[0095] Optionally, regarding the process of the transceiver module identifying the received message in step 202 above, this embodiment of the invention provides a possible implementation method, namely:

[0096] The received message is identified; if the message is identified as having preset plaintext characteristics, the message is identified as plaintext; the plaintext characteristics include network protocol type, source IP address, destination IP address, source port number, and destination port number; if the message is identified as having preset ciphertext characteristics, the message is identified as ciphertext; the ciphertext characteristics include network protocol type, destination port number, and encryption protocol type.

[0097] In this embodiment, both plaintext and ciphertext features are preset. Plaintext features can be network protocol type, source IP address, destination IP address, source port number, and destination port number; that is, plaintext features can be the five-tuple information of the message.

[0098] The ciphertext features can be network protocol type, such as represented by ipProtocol[7:0], destination port number, such as represented by 14DestPort[15:0], and encryption protocol type, such as represented by spi[31:0]. It should be understood that both plaintext and ciphertext features can be set according to actual applications, and the embodiments of the present invention do not impose any limitations.

[0099] The transceiver module 120 parses the received messages using hardware parsing and then identifies the messages. If the message contains plaintext characteristics, such as network protocol type, source IP address, destination IP address, source port number, and destination port number, it is identified as plaintext for subsequent encryption. If the message contains ciphertext characteristics, such as network protocol type, destination port number, and encryption protocol type, it is identified as ciphertext for subsequent decryption.

[0100] Optionally, for the process described above where the CPU performs encapsulation operations on the message to be encrypted to obtain an encapsulated message and obtains the target encryption index value based on the encapsulated message, this embodiment of the invention provides a possible implementation, namely:

[0101] Extract the plaintext feature value of the message to be encrypted, and obtain the initial plaintext index value corresponding to the plaintext feature value of the message to be encrypted according to the plaintext feature table; obtain the target encapsulation rule corresponding to the initial plaintext index value according to the plaintext index table; encapsulate the message to be encrypted according to the target encapsulation rule to obtain the encapsulated message; extract the plaintext feature value of the encapsulated message, and obtain the target plaintext index value corresponding to the plaintext feature value of the encapsulated message according to the plaintext feature table; obtain the target encryption index value corresponding to the target plaintext index value according to the plaintext index table.

[0102] In this embodiment, the CPU20 stores a plaintext feature table and a plaintext index table. The plaintext feature table includes multiple plaintext feature values ​​and their corresponding plaintext index values; the plaintext index table includes an encryption index value and encapsulation rules corresponding to each plaintext index value. The plaintext feature values ​​are the values ​​of the plaintext features, and the encapsulation rules include security policies, encapsulation strategies, etc. It should be understood that the plaintext feature values, plaintext index values, encryption index values, and encapsulation rules can be set according to actual applications, and this embodiment of the invention does not impose any limitations.

[0103] After CPU20 obtains the message to be encrypted from storage module 30, it parses it to extract the plaintext feature value, i.e., the 5-tuple information value, of the message to be encrypted. Then, it retrieves the plaintext index value corresponding to the plaintext feature value of the message to be encrypted from the plaintext feature table, thus obtaining the initial plaintext index value, such as adindex1. Then, it retrieves the encapsulation rule corresponding to the initial plaintext index value adindex1 from the plaintext index table, thus obtaining the target encapsulation rule, such as rule1. Finally, it performs encapsulation operations on the message to be encrypted according to the target encapsulation rule rule1, such as encapsulating the inner route of the message to be encrypted, adding a Tunnel header, and adding a checksum of all zeros, iv, etc., thus obtaining the encapsulated message.

[0104] Next, the plaintext feature value, i.e. the quintuple information value, of the encapsulated message is extracted, and the plaintext index value corresponding to the plaintext feature value of the encapsulated message is obtained from the plaintext feature table, i.e., the target plaintext index value such as adindex1' is obtained; finally, the encrypted index value corresponding to the target plaintext index value adindex1' is obtained from the plaintext index table, i.e., the target encrypted index value such as saindex1 is obtained.

[0105] Optionally, for the process in step S210 above where the encryption / decryption module obtains the target encryption parameter based on the target encryption index value, this embodiment of the invention provides a possible implementation, namely:

[0106] The target encrypted storage block is identified among all encrypted storage blocks, and the address of the target encrypted storage block corresponds to the target encrypted index value; the encryption parameters in the target encrypted storage block are obtained to obtain the target encryption parameters.

[0107] In this embodiment, the encryption / decryption module 150 includes a storage unit such as SRAM. The SRAM includes multiple encrypted storage blocks that store encryption parameters. The address of an encrypted storage block corresponds to an encrypted index value. A first address table, such as SRAM1 table, can be used to record the mapping relationship between the address of each encrypted storage block and each encrypted index value.

[0108] After receiving the encapsulated message and the target encrypted index value, the encryption / decryption module 150 determines the first target address corresponding to the target encrypted index value according to the SRAM1 table, and determines the encrypted storage block it points to in all encrypted storage blocks based on this first target address, that is, determines the target encrypted storage block.

[0109] Then, the encryption parameters in the target encrypted storage block are obtained, i.e., the target encryption parameters are obtained. Based on these target encryption parameters, the encapsulated message is encrypted and authenticated. For example, based on the target encryption parameters and the length of the encrypted message, the length of the encrypted content and the length of the authenticated content are obtained. The encrypted and authenticated messages are then encrypted and authenticated according to the preset encryption and authentication algorithms. Finally, the verification value obtained from the authentication operation is used to replace the all-zero verification value generated by CPU20, i.e., the encrypted message is obtained.

[0110] For ease of understanding, an example diagram is provided in this embodiment of the invention. Please refer to it. Figure 5 The following will combine Figure 5 Explain the process of encrypting messages.

[0111] The transceiver module 120 identifies the received message and determines that the message contains plaintext features, i.e., 5-tuple information. If the message is identified as plaintext, the module marks the message with a flag to be encrypted to obtain the message to be encrypted and sends it to the parsing module 130.

[0112] The parsing module 130 sends the parsed key information and the message to be encrypted to the DMA170.

[0113] The DMA170 stores the received message to be encrypted into the cache unit in the storage module 30, and uses the RX direction descriptor to record the status of the message to be encrypted, including the address of the message to be encrypted in the storage module 30.

[0114] CPU20 retrieves the message to be encrypted from storage module 30 and extracts its plaintext feature value using the address in the RX direction descriptor. Then, it obtains the target encapsulation rule based on the plaintext feature table and plaintext index table, and encapsulates the message to be encrypted according to the target encapsulation rule to obtain the encapsulated message. After obtaining the target encryption index value based on the encapsulated message, it stores the encapsulated message in the cache unit of storage module 30. Then, it updates the target encryption index value, the address of the encapsulated message in storage module 30, the length of the encapsulated message, the forwarding exit information of the encapsulated message, the start flag and end flag of the encapsulated message, and other information to the TX direction descriptor.

[0115] The DMA170 uses the TX direction descriptor to transcode and parse the information therein to obtain the target encrypted index value and the address of the encapsulated message in the storage module 30, and retrieves the encapsulated message from the storage module 30 according to this address; then it sends the target encrypted index value and the encapsulated message to the encryption / decryption module 150.

[0116] The encryption / decryption module 150 obtains the target encryption parameters from the corresponding target encryption storage block based on the target encryption index value and the first address table, and performs encryption and authentication operations on the encapsulated message according to the target encryption parameters to obtain the encrypted message, and then sends it to the transceiver module 120 so that the transceiver module 120 can forward the encrypted message.

[0117] Optionally, if the transceiver module identifies the received message as ciphertext, this embodiment of the invention provides an implementation method for decrypting the message. Please refer to [link to relevant documentation]. Figure 6 .

[0118] Step S214: If the message is identified as ciphertext, the message is marked with a decryption identifier to obtain the message to be decrypted. The ciphertext feature value of the message to be decrypted and the target decryption index information are obtained based on the ciphertext feature value of the message to be decrypted. The target decryption index information and the message to be decrypted are then sent to the parsing module.

[0119] Step S216: The parsing module parses the target decryption index information to obtain the target decryption index value, and sends the target decryption index value and the message to be decrypted to the encryption / decryption module;

[0120] In this embodiment, the identifier to be encrypted can be understood as a tag used to indicate that the message needs to be decrypted. The identifier to be decrypted can be set according to the actual application, and this embodiment of the invention does not impose any limitations.

[0121] If the transceiver module 120 identifies the received message as ciphertext, it marks the message with a decryption identifier to indicate that the message needs to be decrypted, thus obtaining the message to be decrypted. It then extracts the ciphertext feature value of the message to be decrypted to obtain the target decryption index information based on the ciphertext feature value, and then sends the target decryption index information and the message to be decrypted to the parsing module 130.

[0122] After receiving the target decryption index information and the message to be decrypted, the parsing module 130 parses the target decryption index information to obtain the target decryption index value, and parses some key information of the message to be decrypted to obtain information such as the receiving timestamp, receiving port information, message type and message length. Then, it sends the target decryption index value, the message to be encrypted and these key information to the encryption / decryption module 150.

[0123] In step S218, the encryption / decryption module obtains the target decryption parameters based on the target decryption index value, performs authentication and decryption operations on the message to be decrypted based on the target decryption parameters to obtain the decrypted message, and then sends the decrypted message to the DMA.

[0124] In this embodiment, the encryption / decryption module 150 obtains the target decryption parameters based on the received target decryption index value, and performs authentication and decryption operations on the message to be decrypted based on the target decryption parameters to obtain the decrypted message and then sends it to the DMA170.

[0125] It should be understood that the encryption / decryption module 150 may perform only decryption, only authentication, or decryption followed by authentication, or authentication followed by decryption, or perform no operation at all. In other words, the operations performed by the encryption / decryption module 150 can be configured according to the actual application, and this embodiment of the invention does not impose any limitations.

[0126] In step S220, the DMA stores the decrypted message to the storage module, so that the CPU can obtain the decrypted message from the storage module, and after editing the decrypted message to obtain the edited message, it stores the edited message to the storage module.

[0127] In step S222, the DMA sends the edited message obtained from the storage module to the transceiver module;

[0128] Step S224: The transceiver module forwards the edited message;

[0129] In this embodiment, the DMA170 stores the received decrypted message in the cache unit of the storage module 30, and uses an RX direction descriptor to record the status of the decrypted message. For example, the descriptor records information such as the receiving timestamp, receiving port information, message type, address of the decrypted message in the storage module 30, whether decryption was successful, and whether verification passed.

[0130] Then, CPU20 retrieves the decrypted message from storage module 30 using the address in the RX direction descriptor, parses it, edits it according to a preset editing strategy to obtain an edited message, stores the edited message in storage module 30, and updates the address of the edited message in storage module 30 to the TX direction descriptor. DMA170 retrieves the edited message from storage module 30 using the address in the TX direction descriptor and sends it to transceiver module 120, so that transceiver module 120 can forward the encrypted message to other devices.

[0131] Optionally, for the process in step S214 above where the transceiver module obtains the target decryption index information based on the ciphertext feature value of the message to be decrypted, this embodiment of the invention provides a possible implementation, namely:

[0132] Obtain the target ciphertext index value corresponding to the ciphertext feature value of the message to be decrypted from the ciphertext feature table; determine the target storage block among all storage blocks, and the address of the target storage block corresponds to the target ciphertext index value; obtain the decryption index information in the target storage block to obtain the target decryption index information.

[0133] In this embodiment, the transceiver module 120 stores a ciphertext feature table, which includes multiple ciphertext feature values ​​and their corresponding ciphertext index values. The transceiver module 120 includes multiple storage blocks storing decryption index information. The address of one storage block corresponds to one ciphertext index value. An address table, such as an AD table, can be used to record the mapping relationship between the address of each storage block and each ciphertext index value. It should be understood that the ciphertext feature values ​​and ciphertext index values ​​can be set according to actual applications, and this embodiment of the invention does not impose any limitations.

[0134] After the transceiver module 120 extracts the ciphertext feature values ​​of the message to be decrypted, namely the network protocol type, destination port number, and encryption protocol type, it retrieves the ciphertext index value corresponding to the ciphertext feature value of the message to be decrypted from the ciphertext feature table, thus obtaining the target ciphertext index value such as adindex2. Based on the AD table, it determines the target address corresponding to the target ciphertext index value adindex2, and then determines the storage block it points to in all storage blocks based on this target address, thus determining the target storage block. Finally, it retrieves the decryption index information in the target storage block, thus obtaining the target decryption index information.

[0135] Optionally, for the process in S218 above where the encryption / decryption module obtains the target decryption parameter based on the received target decryption index value, this embodiment of the invention provides a possible implementation, namely:

[0136] The target decryption block is identified among all decryption blocks, and the address of the target decryption block corresponds to the target decryption index value; the decryption parameters in the target decryption block are obtained to obtain the target decryption parameters.

[0137] In this embodiment, the encryption / decryption module 150 includes a storage unit such as SRAM. The SRAM includes multiple decryption storage blocks storing decryption parameters. The address of one decryption storage block is associated with a decryption index.

[0138] The mapping between the address of each decrypted storage block and each decryption index value can be recorded using a second address table, such as an SRAM2 table.

[0139] After receiving the message to be decrypted and the target decryption index value, the encryption / decryption module 150 determines the second target address corresponding to the target decryption index value according to the SRAM2 table, and determines the decryption storage block it points to in all decryption storage blocks according to this second target address, that is, determines the target decryption storage block.

[0140] 0 Then, the encryption parameters in the target decryption storage block are obtained, that is, the target decryption parameters are obtained. Based on these target decryption parameters, authentication and decryption operations are performed on the message to be decrypted. For example, based on the target decryption parameters and the length of the message to be decrypted, the length of the authentication content and the length of the decryption content are obtained, and the length of the verification value is determined. Then, authentication and decryption are performed according to the preset authentication algorithm and decryption algorithm, that is, the decrypted message is obtained.

[0141] 5. For ease of understanding, an example diagram is provided in this embodiment of the invention. Please refer to it. Figure 7 The following will combine Figure 7 Explain the process of decrypting the message.

[0142] The transceiver module 120 identifies the received messages and determines that the messages contain ciphertext characteristics, namely network protocol type, destination port number, and encryption protocol type. If the message is identified as ciphertext, then...

[0143] The message is marked with a decryption identifier to obtain the message to be decrypted, and the ciphertext feature value of the message to be decrypted is extracted. Then, based on the ciphertext feature value of the message to be decrypted and the ciphertext feature table, the target decryption index information is obtained from the corresponding target storage block, and then the target decryption index information and the message to be decrypted are sent to the parsing module 130.

[0144] The parsing module 130 parses the target decryption index information to obtain the target decryption index value, and sends the target decryption index value, the message to be decrypted, and some key information to the encryption / decryption module 150. The encryption / decryption module 150 retrieves the target decryption parameters from the corresponding target decryption storage block based on the target decryption index value and the second address table, and performs authentication and decryption operations on the message to be decrypted according to the target decryption parameters to obtain the decrypted message, which is then sent to the DMA170.

[0145] The DMA170 stores the received decrypted message in the cache unit of the storage module 30 and uses the RX direction descriptor to record the status of the decrypted message, including the address of the decrypted message in the storage module 30.

[0146] CPU20 retrieves the decrypted message from storage module 30 using the address in the RX direction descriptor, performs an editing operation to obtain an edited message, stores the edited message in the cache unit of storage module 30, and updates the address of the edited message in storage module 30 to the TX direction descriptor.

[0147] The DMA170 retrieves the edited message from the storage module 30 based on the address in the TX direction descriptor and sends it to the transceiver module 120 so that the encrypted message can be forwarded through the transceiver module 120.

[0148] To perform the corresponding steps in the above embodiments and various possible methods, an implementation of the message forwarding device 10 is given below. It should be noted that the message forwarding device 10 provided in this embodiment has the same basic principle and technical effects as the above embodiments. For the sake of brevity, any parts not mentioned in this embodiment can be referred to the corresponding content in the above embodiments. The message forwarding device 10 includes:

[0149] The transceiver module 120 is used to identify the received message. If the message is identified as plaintext, the message is marked with a code to be encrypted to obtain the message to be encrypted and sent to the parsing module 130.

[0150] The parsing module 130 is used to send the message to be encrypted to the DMA170;

[0151] DMA170 is used to store the message to be encrypted in storage module 30, so that CPU20 can obtain the message to be encrypted from storage module 30, and perform encapsulation operation on the message to be encrypted to obtain an encapsulated message and obtain the target encryption index value based on the encapsulated message. Then, the encapsulated message is stored in storage module 30 and the target encryption index value is sent to DMA170.

[0152] DMA170 is used to send the target encrypted index value and the encapsulated message obtained from the storage module 30 to the encryption / decryption module 150;

[0153] The encryption / decryption module 150 is used to obtain the target encryption parameters based on the target encryption index value, and then perform encryption and authentication operations on the encapsulated message based on the target encryption parameters to obtain the encrypted message, and then send the encrypted message to the transceiver module 120.

[0154] The transceiver module 120 is used to forward encrypted messages.

[0155] Optionally, the CPU20 performs encapsulation operations on the message to be encrypted to obtain an encapsulated message and obtains the target encryption index value based on the encapsulated message in the following manner: extract the plaintext feature value of the message to be encrypted, and obtain the initial plaintext index value corresponding to the plaintext feature value of the message to be encrypted according to the plaintext feature table; obtain the target encapsulation rule corresponding to the initial plaintext index value according to the plaintext index table; perform encapsulation operations on the message to be encrypted according to the target encapsulation rule to obtain an encapsulated message; extract the plaintext feature value of the encapsulated message, and obtain the target plaintext index value corresponding to the plaintext feature value of the encapsulated message according to the plaintext feature table; obtain the target encryption index value corresponding to the target plaintext index value according to the plaintext index table.

[0156] Optionally, the encryption / decryption module 150 is also used to determine the target encrypted storage block among all encrypted storage blocks, the address of the target encrypted storage block corresponding to the target encrypted index value; and to obtain the encryption parameters in the target encrypted storage block to obtain the target encryption parameters.

[0157] Optionally, the transceiver module 120 is further configured to, if the message is identified as ciphertext, mark the message with a decryption identifier to obtain the message to be decrypted, extract the ciphertext feature value of the message to be decrypted and obtain the target decryption index information based on the ciphertext feature value of the message to be decrypted, and then send the target decryption index information and the message to be decrypted to the parsing module 130.

[0158] The parsing module 130 is also used to parse the target decryption index information to obtain the target decryption index value, and send the target decryption index value and the message to be decrypted to the encryption / decryption module 150;

[0159] The encryption / decryption module 150 is also used to obtain the target decryption parameters based on the target decryption index value, and after performing authentication and decryption operations on the message to be decrypted based on the target decryption parameters to obtain the decrypted message, send the decrypted message to DMA170.

[0160] DMA170 is also used to store decrypted messages to storage module 30, so that CPU 20 can obtain decrypted messages from storage module 30, and after editing the decrypted messages to obtain edited messages, store the edited messages to storage module 30.

[0161] DMA170 is also used to send edited messages obtained from storage module 30 to transceiver module 120;

[0162] The transceiver module 120 is also used to forward edited messages.

[0163] Optionally, the transceiver module 120 is further configured to obtain the target ciphertext index value corresponding to the ciphertext feature value of the message to be decrypted according to the ciphertext feature table; determine the target storage block among all storage blocks, the address of the target storage block corresponding to the target ciphertext index value; obtain the decryption index information in the target storage block, and obtain the target decryption index information.

[0164] Optionally, the encryption / decryption module 150 is also used to determine the target decryption storage block among all decryption storage blocks, the address of the target decryption storage block corresponding to the target decryption index value; and to obtain the decryption parameters in the target decryption storage block to obtain the target decryption parameters.

[0165] Optionally, the transceiver module 120 is also used to identify the received message; if the message is identified as having preset plaintext features, the message is identified as plaintext; wherein, the plaintext features include network protocol type, source IP address, destination IP address, source port number and destination port number; if the message is identified as having preset ciphertext features, the message is identified as ciphertext; wherein, the ciphertext features include network protocol type, destination port number and encryption protocol type.

[0166] This invention also provides a network device, which includes a CPU and a storage module connected in communication, as well as a message forwarding device provided in this invention. Both the CPU and the storage module are connected in communication with the DMA in the message forwarding device.

[0167] In the several embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative; for example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of the invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0168] In addition, the functional modules in the various embodiments of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0169] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0170] The above description is merely a preferred embodiment of the present invention and is not intended to limit the invention. Various modifications and variations can be made to the present invention by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention.

Claims

1. A packet forwarding method, characterized by, The application discloses a message forwarding device applied to a network device, and relates to the technical field of network devices. The transceiving module identifies the received message, and if the message is identified as plaintext, marks the message as a to-be-encrypted message and sends the to-be-encrypted message to the parsing module; The parsing module sends the to-be-encrypted message to the DMA; The DMA stores the to-be-encrypted message in the storage module, so that the CPU obtains the to-be-encrypted message from the storage module, performs an encapsulation operation on the to-be-encrypted message to obtain an encapsulated message, obtains a target encryption index value according to the encapsulated message, stores the encapsulated message in the storage module, and sends the target encryption index value to the DMA; The DMA sends the target encryption index value and the encapsulated message obtained from the storage module to the encryption and decryption module; The encryption and decryption module obtains a target encryption parameter according to the target encryption index value, performs an encryption operation and an authentication operation on the encapsulated message according to the target encryption parameter to obtain an encrypted message, and sends the encrypted message to the transceiving module; The transceiving module forwards the encrypted message; The CPU stores a plaintext feature table and a plaintext index table, the plaintext feature table comprises a plurality of plaintext feature values and corresponding plaintext index values, and the plaintext index table comprises an encryption index value and an encapsulation rule corresponding to each plaintext index value; The CPU performs an encapsulation operation on the to-be-encrypted message to obtain an encapsulated message and obtains a target encryption index value according to the encapsulated message, and the operation comprises the following steps: extracting a plaintext feature value of the to-be-encrypted message and obtaining an initial plaintext index value corresponding to the plaintext feature value of the to-be-encrypted message according to the plaintext feature table; obtaining a target encapsulation rule corresponding to the initial plaintext index value according to the plaintext index table; performing an encapsulation operation on the to-be-encrypted message according to the target encapsulation rule to obtain the encapsulated message; extracting a plaintext feature value of the encapsulated message and obtaining a target plaintext index value corresponding to the plaintext feature value of the encapsulated message according to the plaintext feature table; obtaining a target encryption index value corresponding to the target plaintext index value according to the plaintext index table.

2. The method of claim 1, wherein, The encryption and decryption module comprises a plurality of encryption storage blocks storing encryption parameters, and the address of one encryption storage block corresponds to one encryption index value; The encryption and decryption module obtains a target encryption parameter according to the target encryption index value, and the operation comprises the following steps: determining a target encryption storage block in all encryption storage blocks, wherein the address of the target encryption storage block corresponds to the target encryption index value; obtaining an encryption parameter in the target encryption storage block to obtain the target encryption parameter.

3. The method of claim 1, wherein, After the transceiving module identifies the received message, the method further comprises the following steps: The transceiving module marks the message as a message to be decrypted if the message is identified as ciphertext, extracts a ciphertext characteristic value of the message to be decrypted, and obtains target decryption index information according to the ciphertext characteristic value of the message to be decrypted, and then sends the target decryption index information and the message to be decrypted to the parsing module; The parsing module parses the target decryption index information to obtain a target decryption index value, and sends the target decryption index value and the message to be decrypted to the encryption and decryption module; The encryption and decryption module obtains target decryption parameters according to the target decryption index value, performs authentication and decryption operations on the message to be decrypted according to the target decryption parameters to obtain a decrypted message, and then sends the decrypted message to the DMA; The DMA stores the decrypted message in the storage module, so that the CPU obtains the decrypted message from the storage module, performs editing operations on the decrypted message to obtain an edited message, and then stores the edited message in the storage module; The DMA sends the edited message obtained from the storage module to the transceiving module; The transceiving module forwards the edited message.

4. The method of claim 3, wherein, The transceiving module stores a ciphertext characteristic table, the ciphertext characteristic table includes a plurality of ciphertext characteristic values and corresponding ciphertext index values, and the transceiving module includes a plurality of storage blocks storing decryption index information, and the address of one storage block corresponds to one ciphertext index value; The transceiving module obtains target decryption index information according to the ciphertext characteristic value of the message to be decrypted, including: obtaining a target ciphertext index value corresponding to the ciphertext characteristic value of the message to be decrypted according to the ciphertext characteristic table; determining a target storage block in all storage blocks, the address of the target storage block corresponding to the target ciphertext index value; obtaining decryption index information in the target storage block to obtain the target decryption index information.

5. The method of claim 4, wherein, The encryption and decryption module includes a plurality of decryption storage blocks storing decryption parameters, and the address of one decryption storage block corresponds to one decryption index value; The encryption and decryption module obtains target decryption parameters according to the target decryption index value, including: determining a target decryption storage block in all decryption storage blocks, the address of the target decryption storage block corresponding to the target decryption index value; obtaining decryption parameters in the target decryption storage block to obtain the target decryption parameters.

6. The method of claim 1, wherein, The transceiving module identifies the received message, including: identifying the received message; if the message is identified as having a preset plaintext characteristic, the message is identified as plaintext; wherein the plaintext characteristic includes a network protocol type, a source IP address, a destination IP address, a source port number, and a destination port number; if the message is identified as having a preset ciphertext characteristic, the message is identified as ciphertext; wherein the ciphertext characteristic includes a network protocol type, a destination port number, and an encryption protocol type.

7. A packet forwarding device, characterized by, The device comprises a transceiving module, an analyzing module, an encryption and decryption module and a DMA connected through a bus, the DMA is in communication connection with a CPU and a storage module in a network device, and the CPU is in communication connection with the storage module; The transceiving module is used for identifying the received message, if the message is identified as plaintext, marking the message as to-be-encrypted message and sending the to-be-encrypted message to the analyzing module; The analyzing module is used for sending the to-be-encrypted message to the DMA; The DMA is used for storing the to-be-encrypted message to the storage module, so that the CPU obtains the to-be-encrypted message from the storage module, obtains a target encryption index value according to the to-be-encrypted message, performs an encapsulation operation on the to-be-encrypted message to obtain an encapsulated message, stores the encapsulated message to the storage module and sends the target encryption index value to the DMA; The DMA is used for sending the target encryption index value and the encapsulated message obtained from the storage module to the encryption and decryption module; The encryption and decryption module is used for obtaining a target encryption parameter according to the target encryption index value, performing an encryption operation and an authentication operation on the encapsulated message according to the target encryption parameter to obtain an encrypted message, and sending the encrypted message to the transceiving module; The transceiving module is used for forwarding the encrypted message; The CPU stores a plaintext feature table and a plaintext index table, the plaintext feature table comprises a plurality of plaintext feature values and corresponding plaintext index values, and the plaintext index table comprises an encryption index value and an encapsulation rule corresponding to each plaintext index value; The CPU performs an encapsulation operation on the to-be-encrypted message to obtain an encapsulated message and obtains a target encryption index value according to the encapsulated message, which comprises: extracting a plaintext feature value of the to-be-encrypted message and obtaining an initial plaintext index value corresponding to the plaintext feature value of the to-be-encrypted message according to the plaintext feature table; obtaining a target encapsulation rule corresponding to the initial plaintext index value according to the plaintext index table; performing an encapsulation operation on the to-be-encrypted message according to the target encapsulation rule to obtain the encapsulated message; extracting a plaintext feature value of the encapsulated message and obtaining a target plaintext index value corresponding to the plaintext feature value of the encapsulated message according to the plaintext feature table; obtaining a target encryption index value corresponding to the target plaintext index value according to the plaintext index table.

8. The apparatus of claim 7, wherein, The transceiving module is also used for: identifying the received message; if the message is identified as having a preset plaintext feature, the message is identified as plaintext; wherein the plaintext feature comprises a network protocol type, a source IP address, a destination IP address, a source port number and a destination port number; if the message is identified as having a preset ciphertext feature, the message is identified as ciphertext; wherein the ciphertext feature comprises a network protocol type, a destination port number and an encryption protocol type.

9. A network device, comprising: The packet forwarding device of any one of claims 7 and 8, wherein the packet forwarding device further comprises a CPU and a storage module communicatively coupled to the packet forwarding device, and the CPU and the storage module are communicatively coupled to the DMA of the packet forwarding device.

Images