Method and apparatus for preventing packet replay

Abstract

The embodiment of the present application provides a message anti-replay method and device, the method comprises the following steps: a first device receives an Internet security protocol (IPsec) message, the IPsec message comprises a first field (carrying a value of first information), a first anti-replay window is determined from N anti-replay windows according to a first mapping relationship, the first mapping relationship comprises the corresponding relationship between the N anti-replay windows and the value set of the N first information, and the first anti-replay window is used for processing the IPsec message; the N anti-replay windows correspond to the same IPsec security alliance, and N is an integer greater than or equal to 2. Through the message anti-replay method and device of the embodiment of the present application, different types of messages can be processed in different anti-replay windows under the same IPsec security alliance, so that the message is prevented from being discarded due to the fact that the sequence number falls outside the rear end of the anti-replay window because of disorder.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the field of communications, and more particularly, to a method and apparatus for message anti-replay. BACKGROUND

[0002] Internet Protocol Security (IPsec) is a three-layer tunnel encryption protocol formulated by the Internet Engineering Task Force (IETF), which provides security guarantee for data transmitted over the Internet. IPsec provides security services such as encryption and data source authentication for both communication parties, including anti-replay, i.e., the receiving end of an IPSec message can detect and reject outdated or duplicate messages.

[0003] Replay refers to an attacker intercepting a message and copying it, and then sending the copied message to the receiving end, thereby performing a denial of service (DoS) attack on the receiving end without breaking the ciphertext (encrypted message), and the attacker does not need to know the specific content of the replayed information. The anti-replay service provided by the IPSec protocol blocks such attacks through a monotonically increasing sequence number and a "sliding" window mechanism.

[0004] Each IPsec security association (SA) maintains an independent anti-replay window (corresponding to the "sliding" window described above), and in the process of message transmission, high-priority messages are processed first. When the messages arrive at the receiving end, the encapsulate security payload (ESP) / authentication header (AH) header sequence number (SN) of the high-priority message can be much larger than the sequence number of subsequent low-priority messages, at which time the leading edge of the anti-replay window is pulled to the sequence number of the high-priority message, causing the sequence numbers of the low-priority messages to fall outside the trailing edge of the anti-replay window during subsequent message transmission, i.e., these low-priority messages are forced to become outdated messages and are rejected by the receiving end, resulting in packet loss. SUMMARY

[0005] Embodiments of the present application provide a method and apparatus for message anti-replay, which can enable different types of messages to be processed in different anti-replay windows under the same IPsec security association, thereby avoiding packet loss caused by out-of-order messages triggering sequence numbers to fall outside the trailing edge of the anti-replay window.

[0006] In a first aspect, a method for packet anti-replay is provided. The method can be performed by a first device or a component (e.g., a chip or a chip system) configured in the first device. The method includes: receiving, by the first device, an Internet Protocol Security (IPsec) packet, the IPsec packet including a first field carrying a value of first information, determining a first anti-replay window from N anti-replay windows according to a first mapping relationship, the first mapping relationship including a correspondence between the N anti-replay windows and N sets of values of the first information, the value of the first information carried by the first field belonging to a set of values of the first information corresponding to the first anti-replay window, the first anti-replay window being used for processing the IPsec packet, the N anti-replay windows corresponding to a same IPsec security association, N being an integer greater than or equal to 2.

[0007] According to the above scheme, one IPsec security association of a receiving end of the IPsec packet corresponds to multiple anti-replay windows, so that the receiving end of the IPsec packet can determine a priority of the IPsec packet according to the first field in the IPsec packet, and select a corresponding anti-replay window to process the IPsec packet according to the priority, so as to realize processing of IPsec packets of different priorities in different anti-replay windows, and the IPsec packets processed by each anti-replay window are of the same priority, thereby avoiding packet loss caused by out-of-order, and avoiding the problem of increased system resource consumption caused by the newly added IPsec security association in the parallel IPsec security association scheme proposed in chapter 4.1 of the RFC4301 standard.

[0008] In combination with the first aspect, in some implementations of the first aspect, the first information includes a Differentiated Services Code Point (DSCP) or a flow label.

[0009] In combination with the first aspect, in some implementations of the first aspect, the N anti-replay windows are generated according to the first information.

[0010] In the case of the same IPsec security association, the DSCP values of different IPsec packets (including ESP packets and AH packets) represent different priorities. According to the scheme provided in the present application, high-priority packets and low-priority packets can be processed in different anti-replay windows, and packet loss of low-priority packets can be avoided.

[0011] In the case of the same IPsec security association, the flow label values of different IPsec packets represent different services, and different services can map different quality of service in the transmission process. According to the scheme provided in the present application, services corresponding to different quality of service can be independently processed in different anti-replay windows, and packet loss of low-priority packets can be avoided.

[0012] With reference to the first aspect, in some implementations of the first aspect, the N anti-replay windows are statically configured locally for the first device.

[0013] With reference to the first aspect, in some implementations of the first aspect, the N anti-replay windows are generated by the first device and the second device based on the first information, specifically including: sending a first packet, the first packet including a value set of the first information expected by the first device, receiving a second packet, the second packet including a value set of the first information negotiated by the second device based on the first packet, and generating the N anti-replay windows based on the value set of the first information in the second packet.

[0014] With reference to the first aspect, in some implementations of the first aspect, the second packet includes a traffic selector type field and an extension field, the extension field is parsed when the traffic selector type field takes a predetermined value, the extension field includes an extension type of a range of the first information, the extension field further includes at least one start value of the first information and at least one end value of the first information, the at least one start value of the first information and the at least one end value of the first information are used to determine a value set of M first information, M is an integer greater than or equal to 1.

[0015] With reference to the first aspect, in some implementations of the first aspect, the first packet and / or the second packet is an Internet Key Exchange packet including a traffic selector payload.

[0016] With reference to the first aspect, in some implementations of the first aspect, the traffic selector type field includes: a traffic selector Internet Protocol version 6 (IPv6) address range and an extended traffic selector IPv6 address range, or a traffic selector IPv4 address range and an extended traffic selector IPv4 address range.

[0017] Based on the above scheme, the application adds an extended traffic selector IPv4 or IPv6 address range on the basis of the existing traffic selector IPv4 or IPv6 address range field, and can compatibly support devices that can negotiate to generate multiple anti-replay windows and devices that cannot negotiate to generate multiple anti-replay windows. When the device that can negotiate to generate multiple anti-replay windows sends a first message, the same address range traffic selector IPv4 address range field and the extended traffic selector IPv4 address range field can be placed in the traffic selector payload, or the same address range traffic selector IPv6 address range field and the extended traffic selector IPv6 address range field can be placed in the traffic selector payload. When the device that can negotiate to generate multiple anti-replay windows receives a second message, if the traffic selector type field in the traffic selector payload of the second message is the same address range traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or the same address range traffic selector IPv6 and the extended traffic selector IPv6 address range, the extended traffic selector IPv4 / IPv6 address range can be parsed only. When the device that cannot negotiate to generate multiple anti-replay windows receives the second message, the extended traffic selector IPv4 / IPv6 address range field cannot be recognized, and therefore only the traffic selector IPv4 / IPv6 address range field is parsed.

[0018] In a second aspect, a message anti-replay method is provided. The method can be executed by a second device, or can also be executed by a component (such as a chip or a chip system, etc.) configured in the second device. The method comprises: a second device sends an Internet security protocol (IPsec) message, the IPsec message includes a first field, the first field carries a value of first information, the first field is used to determine a first anti-replay window from N anti-replay windows, the value of the first information carried by the first field belongs to a first information value set corresponding to the first anti-replay window, and the first anti-replay window is used to process the IPsec message. The N anti-replay windows correspond to the same IPsec security alliance, and N is an integer greater than or equal to 2.

[0019] Based on the above scheme, one IPsec security association at the receiving end of the IPsec packet corresponds to multiple anti-replay windows, so that the receiving end of the IPsec packet can determine the priority of the IPsec packet according to the first field in the IPsec packet, and select the corresponding anti-replay window to process the IPsec packet according to the priority, so as to realize processing of IPsec packets of different priorities in different anti-replay windows. The messages processed by each anti-replay window are of the same priority, so that the problem of packet loss caused by out-of-order can be avoided, and the problem of increased system resource consumption caused by the newly added IPsec security association in the parallel IPsec security association scheme proposed in chapter 4.1 of the RFC4301 standard can also be avoided.

[0020] In combination with the second aspect, in some implementations of the second aspect, the first information includes a differentiated services code point (DSCP) or a flow label.

[0021] In the case of the same IPsec security association, the DSCP values of different IPsec packets represent different priorities. Based on the scheme provided in the present application, high-priority packets and low-priority packets can be processed in different anti-replay windows, so that packet loss of low-priority packets can be avoided.

[0022] In the case of the same IPsec security association, the flow label values of different IPsec packets represent different services. Different services may map different quality of service in the transmission process. Based on the scheme provided in the present application, services corresponding to different quality of service can be independently processed in different anti-replay windows, so that packet loss of low-priority packets can be avoided.

[0023] In combination with the second aspect, in some implementations of the second aspect, a first message is received, the first message including a value set of first information expected by a first device, and a second message is sent, the second message including a value set of the first information negotiated by a second device based on the first message, the value set of the first information in the second message being used to generate the N anti-replay windows.

[0024] In combination with the second aspect, in some implementations of the second aspect, the first message includes a traffic selector type field and an extension field, when the traffic selector type field takes a predetermined value, the extension field is parsed, the extension field includes an extension type of the first information, and the extension field further includes at least one start value of the first information and at least one end value of the first information.

[0025] In combination with the second aspect, in some implementations of the second aspect, the first message and / or the second message is an Internet Key Exchange message including a traffic selector payload.

[0026] In some implementations of the second aspect, in conjunction with the second aspect, the traffic selector type field includes: a traffic selector Internet Protocol version 6 (IPv6) address range and an extended traffic selector IPv6 address range, or a traffic selector IPv4 address range and an extended traffic selector IPv4 address range.

[0027] Based on the above scheme, the application adds an extended traffic selector IPv4 or IPv6 address range to the existing traffic selector IPv4 or IPv6 address range field, and can be compatible with devices that support negotiation to generate multiple anti-replay windows and devices that do not support negotiation to generate multiple anti-replay windows. When a device that supports negotiation to generate multiple anti-replay windows receives a first message, it determines that the traffic selector type field in the traffic selector payload in the first message is a traffic selector IPv4 address range and an extended traffic selector IPv4 address range of the same address range, or a traffic selector IPv6 address range and an extended traffic selector IPv6 address range of the same address range. At this time, only the extended traffic selector IPv4 / IPv6 address range can be parsed. When a device that does not support negotiation to generate multiple anti-replay windows receives the first message, it cannot recognize the extended traffic selector IPv4 / IPv6 address range field, and therefore only parses the traffic selector IPv4 / IPv6 address range field.

[0028] In a third aspect, a device for anti-replay of a message is provided. The device can be a first device, or a component (such as a chip or a chip system, etc.) configured in the first device. The device includes: a transceiver unit configured to receive an Internet Protocol Security (IPsec) message, the IPsec message including a first field carrying a value of a first information; and a processing unit configured to determine a first anti-replay window from N anti-replay windows according to the first field, the first mapping relationship including a correspondence between the N anti-replay windows and a set of values of the first information, the value of the first information carried by the first field belonging to a set of values of the first information corresponding to the first anti-replay window, the first anti-replay window being used to process the IPsec message, the N anti-replay windows corresponding to a same IPsec security association, and N being an integer greater than or equal to 2.

[0029] Based on the above scheme, one IPsec security association of the receiving end of the IPsec packet corresponds to multiple anti-replay windows, so that the receiving end of the IPsec packet can determine the priority of the IPsec packet according to the first field in the IPsec packet, and select the corresponding anti-replay window to process the IPsec packet according to the priority, so as to realize processing of IPsec packets of different priorities in different anti-replay windows. The messages processed by each anti-replay window are of the same priority, so that the problem of packet loss caused by out-of-order can be avoided, and the problem of increased system resource consumption caused by the newly added IPsec security association in the parallel IPsec security association scheme proposed in chapter 4.1 of the RFC4301 standard can also be avoided.

[0030] In some implementations of the third aspect, the first information includes a differentiated services code point (DSCP) or a flow label.

[0031] In the case of the same IPsec security association, the DSCP values of different IPsec packets represent different priorities. Based on the scheme provided in the present application, high-priority packets and low-priority packets can be processed in different anti-replay windows, so that packet loss of low-priority packets can be avoided.

[0032] In the case of the same IPsec security association, the flow label values of different IPsec packets represent different services. Different services may map different quality of service in the transmission process. Based on the scheme provided in the present application, services corresponding to different quality of service can be independently processed in different anti-replay windows, so that packet loss of low-priority packets can be avoided.

[0033] In some implementations of the third aspect, the processing unit is further configured to generate the N anti-replay windows according to the first information.

[0034] In some implementations of the third aspect, the N anti-replay windows are locally statically configured.

[0035] In some implementations of the third aspect, the N anti-replay windows are generated by the first device and the second device according to the value of the first information. The transceiver is further configured to send a first message, the first message including a set of values of the first information expected by the first device. The transceiver is further configured to receive a second message, the second message including a set of values of the first information negotiated by the second device based on the first message. The processing unit is further configured to generate the N anti-replay windows according to the set of values of the first information in the second message.

[0036] In some implementations of the third aspect, the second packet includes a traffic selector type field and an extension field, and when the traffic selector type field has a predetermined value, the processing unit is further configured to parse the extension field, the extension field includes a range of the first information, and the extension field further includes a start value of the at least one first information and an end value of the at least one first information, the start value of the at least one first information and the end value of the at least one first information are used to determine a value set of M first information, and M is an integer greater than or equal to 1.

[0037] In some implementations of the third aspect, the first packet and / or the second packet is an Internet Key Exchange packet including a traffic selector payload.

[0038] In some implementations of the third aspect, the traffic selector type field includes a traffic selector Internet Protocol version 6 (IPv6) address range and an extended traffic selector IPv6 address range, or a traffic selector IPv4 address range and an extended traffic selector IPv4 address range.

[0039] Based on the above scheme, the present application adds an extended traffic selector IPv4 or IPv6 address range to the existing traffic selector IPv4 or IPv6 address range field, and can be compatible with devices that support negotiation to generate multiple anti-replay windows and devices that do not support negotiation to generate multiple anti-replay windows. When the device that supports negotiation to generate multiple anti-replay windows sends the first packet, the same address range traffic selector IPv4 address range field and the extended traffic selector IPv4 address range field can be placed in the traffic selector payload, or the same address range traffic selector IPv6 address range field and the extended traffic selector IPv6 address range field can be placed in the traffic selector payload. When the device that supports negotiation to generate multiple anti-replay windows receives the second packet, if the traffic selector type field in the traffic selector payload of the second packet is the same address range traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or the same address range traffic selector IPv6 and the extended traffic selector IPv6 address range, the extended traffic selector IPv4 / IPv6 address range can be parsed only. When the device that does not support negotiation to generate multiple anti-replay windows receives the second packet, the extended traffic selector IPv4 / IPv6 address range field cannot be recognized, and therefore only the traffic selector IPv4 / IPv6 address range field is parsed.

[0040] In a fourth aspect, a device for packet anti-replay is provided. The device can be a second device or a component (e.g., a chip or a chip system) configured in the second device. The device includes a transceiver and a processing unit. The transceiver is configured to send an Internet Protocol Security (IPsec) packet. The IPsec packet includes a first field. The first field carries a value of first information. The first field is used to determine a first anti-replay window from N anti-replay windows. The value of the first information carried by the first field belongs to a set of values of the first information corresponding to the first anti-replay window. The first anti-replay window is used to process the IPsec packet. The N anti-replay windows correspond to a same IPsec security association. N is an integer greater than or equal to 2.

[0041] According to the above scheme, one IPsec security association of a receiving end of the IPsec packet corresponds to multiple anti-replay windows. Therefore, the receiving end of the IPsec packet can determine a priority of the IPsec packet according to the first field in the IPsec packet, and select a corresponding anti-replay window to process the IPsec packet according to the priority. Different priorities of the IPsec packet are processed in different anti-replay windows. The IPsec packet processed in each anti-replay window is of the same priority. Therefore, packet loss caused by out-of-order can be avoided. In addition, the problem of increased system resource consumption caused by the parallel IPsec security association scheme proposed in section 4.1 of the RFC4301 standard can also be avoided.

[0042] In some implementations of the fourth aspect, the first information includes a Differentiated Services Code Point (DSCP) or a flow label.

[0043] In the case of the same IPsec security association, the DSCP values of different IPsec packets represent different priorities. According to the scheme provided in the present application, high-priority packets and low-priority packets can be processed in different anti-replay windows. Packet loss of low-priority packets can be avoided.

[0044] In the case of the same IPsec security association, the flow label values of different IPsec packets represent different services. Different services can map different quality of service (QoS) in the transmission process. According to the scheme provided in the present application, services corresponding to different QoS can be independently processed in different anti-replay windows. Packet loss of low-priority packets can be avoided.

[0045] In some implementations of the fourth aspect, the transceiver is further configured to receive a first packet. The first packet includes a set of values of first information expected by a first device. The transceiver is further configured to send a second packet. The second packet includes a set of values of the first information negotiated by a second device based on the first packet. The set of values of the first information in the second packet is used to generate the N anti-replay windows.

[0046] In some implementations of the fourth aspect, the first message includes a traffic selector type field and an extension field, and the processing unit is configured to parse the extension field when the traffic selector type field has a predetermined value, the extension field including a range of the first information, and the extension field further including a start value of the at least one first information and an end value of the at least one first information.

[0047] In some implementations of the fourth aspect, the first message and / or the second message is an Internet Key Exchange message including a traffic selector payload.

[0048] In some implementations of the fourth aspect, the traffic selector type field includes a traffic selector Internet Protocol version 6 (IPv6) address range and an extended traffic selector IPv6 address range, or a traffic selector IPv4 address range and an extended traffic selector IPv4 address range.

[0049] Based on the above scheme, the application adds an extended traffic selector IPv4 or IPv6 address range to the existing traffic selector IPv4 or IPv6 address range field, and can be compatible with devices that support negotiation to generate multiple anti-replay windows and devices that do not support negotiation to generate multiple anti-replay windows. When a device that supports negotiation to generate multiple anti-replay windows receives the first message, it determines that the traffic selector type field in the traffic selector payload in the first message is a traffic selector IPv4 address range and an extended traffic selector IPv4 address range of the same address range, or a traffic selector IPv6 address range and an extended traffic selector IPv6 address range of the same address range. At this time, the extended traffic selector IPv4 / IPv6 address range can be parsed only. When a device that does not support negotiation to generate multiple anti-replay windows receives the first message, it cannot recognize the extended traffic selector IPv4 / IPv6 address range field, and therefore only parses the traffic selector IPv4 / IPv6 address range field.

[0050] In a fifth aspect, a communication apparatus is provided. The apparatus includes a processor coupled with a memory and configured to execute instructions in the memory to implement the method in the first aspect or any possible implementation of the first aspect. Optionally, the apparatus further includes the memory, which can be deployed separately from the processor or can be deployed centrally. Optionally, the apparatus further includes a communication interface, and the processor is coupled with the communication interface.

[0051] In an implementation form, the communication interface can be a transceiver, or an input / output interface.

[0052] In another implementation, the apparatus is a component in the first device, and the apparatus is a chip, the communication interface can be an input / output interface, an interface circuit, an output circuit, an input circuit, a pin or related circuit on the chip or chip system, etc. The processor can also be embodied as a processing circuit or a logic circuit.

[0053] Optionally, the transceiver can be a transceiving circuit. Optionally, the input / output interface can be an input / output circuit.

[0054] In the implementation, the processor can be one or more chips, the input circuit can be an input pin, the output circuit can be an output pin, the processing circuit can be a transistor, a gate circuit, a flip-flop and various logic circuits, etc. The input received by the input circuit can be but is not limited to the signal received and input by the receiver, the output output by the output circuit can be but is not limited to the signal output to and transmitted by the transmitter, and the input circuit and the output circuit can be the same circuit which is used as the input circuit and the output circuit at different times. The embodiments of the present application do not limit the specific implementation of the processor and various circuits.

[0055] In a sixth aspect, a communication apparatus is provided, which comprises a processor coupled with a memory, and configured to execute instructions in the memory to implement the method in the second aspect or any possible implementation of the second aspect. Optionally, the apparatus further comprises the memory, which can be deployed separately or centrally with the processor. Optionally, the apparatus further comprises a communication interface, and the processor is coupled with the communication interface.

[0056] In an implementation, the communication interface can be a transceiver, or an input / output interface.

[0057] In another implementation, the apparatus is a component in the second device, and the apparatus is a chip, the communication interface can be an input / output interface, an interface circuit, an output circuit, an input circuit, a pin or related circuit on the chip or chip system, etc. The processor can also be embodied as a processing circuit or a logic circuit.

[0058] Optionally, the transceiver can be a transceiving circuit. Optionally, the input / output interface can be an input / output circuit.

[0059] In the implementation process, the processor can be one or more chips, the input circuit can be an input pin, the output circuit can be an output pin, and the processing circuit can be a transistor, a gate circuit, a flip-flop, and various logic circuits. The input signal received by the input circuit can be, but is not limited to, a signal received and input by a receiver, the output signal output by the output circuit can be, but is not limited to, a signal output to and transmitted by a transmitter, and the input circuit and the output circuit can be the same circuit, which is used as the input circuit and the output circuit at different times. The embodiments of the present application do not limit the specific implementation of the processor and various circuits.

[0060] In a seventh aspect, a communication apparatus is provided, which comprises a logic circuit configured to be coupled with an input / output interface through which data is transmitted to perform any one of the first aspect to the second aspect and the method in any possible implementation of the first aspect to the second aspect.

[0061] In an eighth aspect, a computer-readable storage medium is provided, which stores a computer program (also referred to as code or instructions) that, when executed on a computer, causes the computer to perform any one of the first aspect to the second aspect and the method in any possible implementation of the first aspect to the second aspect.

[0062] In a ninth aspect, a computer program product is provided, which comprises a computer program (also referred to as code or instructions) that, when executed, causes a computer to perform any one of the first aspect to the second aspect and the method in any possible implementation of the first aspect to the second aspect.

[0063] The beneficial effects brought by the fifth aspect to the ninth aspect can refer to the description of the beneficial effects of the first aspect to the second aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0064] Figure 1 FIG. 1 is a schematic diagram of a communication system 100 suitable for embodiments of the present application.

[0065] Figure 2 FIG. 4 is a flowchart of a method for packet anti-replay provided by embodiments of the present application.

[0066] Figure 3 FIG. 6 is a flowchart of a method for negotiating multiple anti-replay windows provided by embodiments of the present application.

[0067] Figure 4 FIG. 7 is a format diagram of a traffic selector payload provided by embodiments of the present application.

[0068] Figure 5is another flowchart of negotiating multiple anti-replay windows provided by an embodiment of the present application.

[0069] Figure 6 is a schematic block diagram of a communication device provided by an embodiment of the present application.

[0070] Figure 7 is another schematic block diagram of a communication device provided by an embodiment of the present application.

[0071] Figure 8 is a structural schematic diagram of a communication device provided by an embodiment of the present application.

[0072] Figure 9 is another structural schematic diagram of a communication device provided by an embodiment of the present application.

[0073] Figure 10 is yet another structural schematic diagram of a communication device provided by an embodiment of the present application. DETAILED DESCRIPTION

[0074] The technical solutions in the embodiments of the present application will be described below with reference to the drawings.

[0075] Figure 1 is a schematic diagram of a communication system 100 applicable to an embodiment of the present application.

[0076] As shown in Figure 1 , the communication system 100 can include a first device, for example, the first device 110 or 120 as shown in Figure 1 . The communication system 100 can also include a second device, for example, the second device 130 as shown in Figure 1 . A connection can be established between the first device and the second device, between the first device and the first device, for communication and transmission of data packets. For example, when data packets are transmitted between the first device 120 and the second device 130, or between the first device 110 and the second device 130, the data packets need to be encrypted by IPsec. The first device and the second device can be any terminal, base station, host, switch, router, security gateway, etc. supporting internet key exchange (IKE or IKEv2) / IPsec. The method provided by the embodiments of the present application can be applied to the transmission of data packets between the first device and the second device, but the present application does not limit this. Any sending end or receiving end involved in the process of transmitting data packets by IPsec encryption is within the protection scope of the present application.

[0077] The technical solutions of the embodiments of the present application can be applied to various communication systems, for example: a global system for mobile communications (GSM) system, a code division multiple access (CDMA) system, a wideband code division multiple access (WCDMA) system, a general packet radio service (GPRS), an LTE system, an LTE frequency division duplex (FDD) system, an LTE time division duplex (TDD), a universal mobile telecommunication system (UMTS), a worldwide interoperability for microwave access (WiMAX) communication system, a 5th generation (5G) system or a future evolved communication system, vehicle-to-X (V2X), wherein V2X can include vehicle to network (V2N), vehicle to vehicle (V2V), vehicle to infrastructure (V2I), vehicle to pedestrian (V2P), etc., LTE-V (long term evolution-vehicle), Internet of Vehicles, machine type communication (MTC), Internet of Things (IoT), long term evolution-machine (LTE-M), machine to machine (M2M), device to device (D2D), etc.

[0078] The base station in the embodiments of the present application includes but is not limited to: an evolved Node B (eNB), a radio network controller (RNC), a Node B (NB), a base station controller (BSC), a base transceiver station (BTS), a home base station (for example, a home evolved node B, or a Home Node B, HNB), a baseband unit (BBU), an access point (AP) in a wireless fidelity (WIFI) system, a wireless relay node, a wireless backhaul node, a transmission point (TP), or a transmission and reception point (TRP), and the like, and can also be a gNB or a transmission point (TRP or TP) in a 5G, such as an NR, system, one or a group (including multiple antenna panels) of antenna panels of a base station in a 5G system, or a network node constituting a gNB or a transmission point, such as a baseband unit (BBU), or a distributed unit (DU), and the like.

[0079] In some deployments, a gNB can include a centralized unit (CU) and a DU. A gNB can also include an active antenna unit (AAU). The CU implements part of the functions of the gNB, and the DU implements part of the functions of the gNB. For example, the CU is responsible for processing non-real-time protocols and services, implements the radio resource control (RRC), and the functions of the packet data convergence protocol (PDCP) layer. The DU is responsible for processing the physical layer protocol and real-time services, and implements the functions of the radio link control (RLC) layer, the media access control (MAC) layer, and the physical (PHY) layer. The AAU implements part of the physical layer processing functions, radio frequency processing, and related functions of the active antenna. Since the information of the RRC layer eventually becomes the information of the PHY layer, or is transformed from the information of the PHY layer, in this architecture, high-layer signaling, such as RRC layer signaling, can also be considered as being sent by the DU, or by the DU+AAU. It can be understood that the network device can be a device including one or more of the CU node, the DU node, and the AAU node. In addition, the CU can be divided into a network device in a radio access network (RAN), or can be divided into a network device in a core network (CN), which is not limited in the present application.

[0080] IPsec is mainly composed of the following protocols:

[0081] One, authentication header (AH), provides connectionless data integrity, message authentication, and protection against replay attacks for IP datagrams;

[0082] Two, encapsulating security payload (ESP), provides confidentiality, data source authentication, connectionless integrity, protection against replay, and limited traffic-flow confidentiality;

[0083] Three, IPsec security association (SA), provides algorithms and data packets, and provides parameters required for AH and ESP operations.

[0084] Internet key exchange (IKE or IKEv2) is an online protocol belonging to the IPsec protocol family, which is used to create an IPsec security association.

[0085] In one embodiment, the sender of IPSec packets includes a sequence number field in the header of each IPSec packet (including ESP and AH packets). When a new IPSec security association is created, the sequence number counter is initialized to 0. Each time a packet is sent on this IPSec security association, the sequence number counter is incremented by 1 and the value of the sequence number field is set to the value of the counter. The counter value monotonically increases, and when the counter value approaches 2 32 31, a new IPSec security association should be established. The length of the sequence number is 32 bits. Alternatively, the length of the sequence number can be 64 bits using an extended sequence. When the length of the sequence number is 64 bits, a new IPSec security association should be established when the counter value approaches 2 64 31. It is understood that the length of the sequence number can be 128 or 256 bits in the future, and the present application is not limited in this regard.

[0086] A replay protection window of width W is established at the receiver of the IPSec packets. Assuming W is 64, it means that the replay protection window is 64 consecutive packets wide. The front of the window corresponds to the sequence number P of the first packet in the window, and the back of the window corresponds to the lowest sequence number P-W+1 that can be received. Each time an IPSec packet is received, the receiver processes it according to the following rules:

[0087] 1. If the sequence number of the received IPSec packet falls within the replay protection window and has not been received before, the packet is accepted and marked as received. If the packet has been received before, it is a replay packet and is discarded.

[0088] 2. If the sequence number of the received IPSec packet falls outside the back of the replay protection window, i.e., the sequence number is less than P-W+1, the packet is an expired packet and is discarded.

[0089] 3. If the sequence number of the received IPSec packet falls outside the front of the replay protection window, i.e., the sequence number is greater than P, the replay protection window is moved forward so that the front of the replay protection window just contains the sequence number of the packet.

[0090] In a secure backhaul scenario of a base station, that is, when transmitting data packets between the base station and a serving gateway (S-GW), an S1 data plane link maps an IPSec security association, and one IPSec security association maintains one anti-replay window. In the S1 data plane link, GTPECHOREQUEST packets and GTP ECHO REPLY packets are high-priority packets, and large-flow ordinary data packets are low-priority packets. When the GTP ECHO packets arrive at the base station in advance because of the high priority, and the sequence numbers are much higher than those of the subsequent ordinary data packets, the anti-replay window is pulled to the front edge to the sequence number of the GTP ECHO packet, so that the IPSec packets corresponding to the ordinary data fall outside the trailing edge of the anti-replay window, and become outdated packets, which are discarded by the receiving end.

[0091] In view of the above problems, a possible implementation can close the anti-replay feature at the receiving end, sacrificing the security level to protect the service. However, anti-replay is a basic security feature of IPsec, and if the anti-replay feature is closed, the system will be unable to resist replay attacks, and the security problem cannot be solved.

[0092] Another possible implementation maintains multiple IPsec security associations between the sending end and the receiving end. This scheme is described in section 4.1 of the RFC4301 standard, that is, multiple IPsec security associations are generated based on differentiated services code points (DSCPs) for the same traffic selector (TS), each IPsec security association maintains an anti-replay window and is directed to one / one segment of the DSCP value. This scheme solves the security problem while increasing the consumption of the system.

[0093] In view of this, the embodiments of the present application provide a message anti-replay method and device, which can enable different priority messages to be independently processed in different anti-replay windows under the same IPsec security association, and avoid packet loss caused by out-of-order triggering of the sequence number falling outside the trailing edge of the anti-replay window. Compared with the scheme of maintaining multiple IPsec security associations, the scheme provided by the embodiments of the present application can save costs.

[0094] Figure 2 FIG. 1 is a flowchart of a message anti-replay method provided by an embodiment of the present application. Figure 2 The method 200 shown includes the following steps.

[0095] In step S210, the second device sends an IPsec packet to the first device, and the IPsec packet includes a first field carrying a value of first information. Correspondingly, the first device receives the IPsec packet.

[0096] Optionally, the first field comprises a DSCP field or a flow label field, i.e., the first information is a DSCP or a flow label.

[0097] For example, for an internet protocol version 6 (IPv6) packet, the IP header of the packet comprises a flow label (FL) field and a DSCP field, and for an IPv4 packet, the IP header of the packet only comprises a DSCP field.

[0098] In step S220, the first device determines a first anti-replay window from the N anti-replay windows according to a first mapping relationship, the first mapping relationship comprising a correspondence between the N anti-replay windows and N value sets of the first information, the value of the first information carried by the first field belonging to a value set of the first information corresponding to the first anti-replay window, the first anti-replay window being used to process the IPsec packet, the N anti-replay windows corresponding to a same IPsec security association, N being an integer greater than or equal to 2.

[0099] On the first device side, one IPsec security association corresponds to multiple anti-replay windows, and a first mapping relationship exists between the multiple anti-replay windows and multiple value sets of the first information, the first mapping relationship being that one anti-replay window corresponds to one value set of the first information, or one anti-replay window corresponds to multiple value sets of the first information, or multiple anti-replay windows correspond to one value set of the first information.

[0100] For example, different anti-replay windows can correspond to different DSCP values or flow label values, and the first device can determine, from the multiple anti-replay windows, an anti-replay window corresponding to a DSCP value or a flow label value in the IP header of the IPsec packet, the anti-replay window corresponding to the DSCP value or the flow label value processing the IPsec packet.

[0101] For example, on the first device side, one IPsec security association corresponds to three anti-replay windows, namely anti-replay window #1, anti-replay window #2, and anti-replay window #3 corresponding to DSCP value sets [32, 47], [48, 48], and other values respectively, wherein the anti-replay window #1 processes a packet with a DSCP value of 32-47 in the IP header, the anti-replay window #2 processes a packet with a DSCP value of 48 in the IP header, and the anti-replay window #3 processes a packet with other values in the IP header except for 32-48.

[0102] It should be understood that the value set in the present application can be a continuous value interval, such as the value set [32, 47], or a set of discontinuous values, such as other values except for 32-48, and the present application does not limit this.

[0103] Assume that the first device receives an IPv4 packet, and the DSCP value in the IP header of the packet is 48, then the IPv4 packet is processed in the anti-replay window #2. Assume that the first device receives an IPv4 packet, and the DSCP value in the IP header of the packet is 50, then the IPv4 packet is processed in the anti-replay window #3.

[0104] It should be understood that the sequence number counter is initialized to 0 each time a new IPsec security association is established, and the value of the sequence number counter is incremented by 1 each time a packet is sent over the IPsec security association, and the value of the sequence number field is set to the value of the counter. The value of the counter is monotonically increasing, and when the value of the counter is close to the maximum value, a new IPsec security association should be established, i.e., the rekey procedure is triggered. The above example is that the rekey procedure is triggered when the value of the counter is close to the maximum value, and of course, the rekey procedure can be triggered in other ways, for example, a timer is started when a new IPsec security association is established, and when the timer is close to the negotiation time, the rekey procedure is triggered. When the rekey procedure is triggered, the sequence number counter is initialized to 0, and the value of the sequence number counter is incremented by 1 each time a packet is sent, and the sequence number of the first packet sent over the IPsec security association is 1. It should be understood that during this process, the N anti-replay windows are also reset, because the N anti-replay windows slide with the processing progress during the processing of the packet, and therefore the N anti-replay windows need to be reset after the rekey procedure is triggered.

[0105] Optionally, the first device generates the N anti-replay windows according to the DSCP values or the flow label values before receiving the IPsec packet.

[0106] It should be understood that the first device can also generate the N anti-replay windows according to other values for indicating priority, which are not limited in the present application.

[0107] In a possible implementation, the first device locally statically configures the N anti-replay windows.

[0108] It should be understood that when the N anti-replay windows are manually statically configured locally (static configuration means that the configuration is directly made locally without negotiation with the second device), the correspondence between the anti-replay windows corresponding to the same IPsec security association and the DSCP values (or the flow label values) can be configured arbitrarily, taking the DSCP values as an example, the first device locally statically configures 3 anti-replay windows, the DSCP value corresponding to the anti-replay window #1 is

[46] , the DSCP value corresponding to the anti-replay window #2 is

[48] , and the DSCP value corresponding to the anti-replay window #3 is another value except 46 and 48.

[0109] In a possible implementation, the first device negotiates with the second device to generate the N anti-replay windows.

[0110] Figure 3 is a flow diagram of a method for negotiating multiple anti-replay windows by DSCP value provided by an embodiment of the present application. Figure 3 The method 300 shown includes:

[0111] At step S310, the first device sends a first packet to the second device, the first packet including a set of values of first information expected by the first device, the first information being DSCP. Correspondingly, the second device receives the first packet.

[0112] Optionally, the first packet includes a traffic selector payload, the traffic selector payload including a traffic selector type field and an extension field, the second device parsing the extension field when the traffic selector type field takes a predetermined value, the extension field including an extension type of DSCP range, the extension field further including at least one DSCP start value and at least one DSCP end value.

[0113] Optionally, the first packet includes a set of DSCP value information expected by the first device.

[0114] It should be understood that the traffic selector payload includes one or more individual traffic selector payloads, the format of the individual traffic selector payload being as shown in Figure 4 As shown, the existing defined traffic selector type (TS Type) field: traffic selector IPv4 address range (TS_IPV4_ADDR_RANGE) takes a value of 7, and traffic selector IPv6 address range (TS_IPV6_ADDR_RANGE) takes a value of 8.

[0115] The present application extends the traffic selector type field, for example, the traffic selector type field is extended to: extended traffic selector IPv4 address range (TS_EXT_IPV4_ADDR_RANGE) takes a value of X, the existing protocol defines traffic selector type field values 0-9 (where 0-6 are reserved values, 7-9 are defined), therefore, X can take any value from 10-255.

[0116] When the traffic selector type field takes a predetermined value, i.e. the traffic selector type field takes a value of X, the second device parses the extension field, as shown in Figure 4 As shown, the extension field includes an extension type, an extension length, a start value, and an end value. The extension type can be a DSCP range, the extension length is a DSCP length, the start value is a DSCP start value, and the end value is a DSCP end value.

[0117] For example, the length of the extension type is 1 byte, the value range is 0-255, indicating that there are 256 extension types, one of which can be INDEP_ANTIREPLAY_DSCP_RANGE, and the extension type can take any value from 0-255, which is not limited in the present application; the length of the extension length is 1 byte, the value range is 0-255; the length and value range of the start value are not equal, which is determined by the extension type, for example, when the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the length is 1 byte, the value range is 0-63, and the high 2 bits are fixed as all 0; the length and value range of the end value are not equal, which is determined by the extension type, for example, when the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the length is 1 byte, the value range is 0-63, the high 2 bits are all 0, and the end value should be greater than or equal to the start value.

[0118] It should be understood that the name of the above-mentioned traffic selector type extension field, and the name of the extension type field are only examples, which are not limited in the present application.

[0119] In step S320, the second device sends a second packet to the first device, the second packet including a DSCP value set negotiated by the second device based on the first packet. Correspondingly, the first device receives the second packet.

[0120] For example, the first packet includes DSCP value set information expected by the first device, and the second packet includes a DSCP value set negotiated by the second device based on the DSCP value set information in the first packet.

[0121] Optionally, the second packet includes a traffic selector type field and an extension field, when the traffic selector type field takes a predetermined value, the first device parses the extension field, the extension type included in the extension field is DSCP range, and the extension field further includes at least one DSCP start value and at least one DSCP end value, the at least one DSCP start value and the at least one DSCP end value are used to determine M DSCP value sets, M is an integer greater than or equal to 1.

[0122] For example, the DSCP start value and the DSCP end value in the extension field can determine 2 DSCP value sets, the first device can generate 3 anti-replay windows, or 2 anti-replay windows, or 1 anti-replay window according to the 2 DSCP value sets, that is, the above-mentioned M can be less than, or equal to, or greater than N, which is not limited in the present application.

[0123] It should be understood that the predetermined value is described in step S310, which is not described here.

[0124] S330, the first device generates N anti-replay windows according to the DSCP value set in the second packet.

[0125] Optionally, the first packet and / or the second packet is an internet key exchange (IKE) packet including a traffic selector payload.

[0126] For example, the first packet and / or the second packet is an IKE_AUTH or CREATE_CHILD_SA packet.

[0127] It should be understood that the first packet and / or the second packet can also be other packets including a traffic selector payload, and the present application does not make any limitation in this regard.

[0128] Optionally, the traffic selector type field includes a traffic selector IPv4 address range and an extended traffic selector IPv4 address range, or a traffic selector IPv6 address range and an extended traffic selector IPv6 address range.

[0129] When the traffic selector type field in the first / second packet includes a traffic selector IPv4 address range and an extended traffic selector IPv4 address range at the same time, or includes a traffic selector IPv6 address range and an extended traffic selector IPv6 address range at the same time, devices supporting negotiation of multiple anti-replay windows and devices not supporting negotiation of multiple anti-replay windows can be compatible. When the device supporting negotiation of multiple anti-replay windows receives the first / second packet, and determines that the traffic selector type field in the traffic selector payload in the first / second packet is a traffic selector IPv4 address range and an extended traffic selector IPv4 address range of the same address range, or a traffic selector IPv6 and an extended traffic selector IPv6 address range of the same address range, the extended traffic selector IPv4 / IPv6 address range can be parsed only. When the device not supporting negotiation of multiple anti-replay windows receives the first / second packet, the extended traffic selector IPv4 / IPv6 address range field cannot be recognized, and thus only the traffic selector IPv4 / IPv6 address range field is parsed.

[0130] Figure 5 is a flowchart of a process of negotiating multiple anti-replay windows through a flow label value provided by an embodiment of the present application. Figure 5 The method 400 shown includes:

[0131] S410, the first device sends a third packet to the second device, the third packet including a value set of first information expected by the first device, the first information being a flow label. Correspondingly, the second device receives the third packet.

[0132] Optionally, the third message includes the set of flow label value information expected by the first device.

[0133] Optionally, the third message includes a traffic selector payload, the traffic selector payload including a traffic selector type field and an extension field, the second device parsing the extension field when the traffic selector type field takes a predetermined value, the extension field including an extension type of flow label range, the extension field further including at least one flow label start value and at least one flow label end value.

[0134] It should be understood that the traffic selector payload includes one or more individual traffic selector payloads, the format of the individual traffic selector payload being the same as Figure 4 Similarly, the existing defined traffic selector type (TS Type) field: traffic selector IPv4 address range (TS_IPV4_ADDR_RANGE) takes value 7, and traffic selector IPv6 address range (TS_IPV6_ADDR_RANGE) takes value 8.

[0135] The present application extends the traffic selector type field, for example, the traffic selector type field is extended to: extended traffic selector IPv6 address range (TS_EXT_IPV6_ADDR_RANGE) takes value Y, the existing protocol defines traffic selector type field values 0-9 (where 0-6 are reserved values, and 7-9 are defined), therefore, Y can take any value from 10-255, and Y and the above X take different values.

[0136] When the traffic selector type field takes a predetermined value, i.e., the traffic selector type field takes value Y, the second device parses the extension field, and with Figure 4 Similarly, the extension field includes an extension type, an extension length, a start value, and an end value. The extension type can be a flow label range, the extension length is a flow label length, the start value is a flow label start value, and the end value is a flow label end value.

[0137] For example, the length of the extension type is 1 byte, the value range is 0-255, indicating that there are 256 extension types, one of which can be INDEP_ANTIREPLAY_FLOWLABEL_RANGE, and the extension type can take any value from 0-255, which is not limited in the present application; the length of the extension length is 1 byte, and the value range is 0-255; the length and value range of the start value are not equal, which is determined by the extension type, for example, when the extension type is INDEPENDENT_ANTIREPLAY_FLOWLABEL_RANGE, the length is 2.5 bytes, and the value range is 0-(2 20 -1); the length and value range of the end value are not equal, which is determined by the extension type, for example, when the extension type is INDEPENDENT_ANTIREPLAY_FLOWLABEL_RANGE, the length is 2.5 bytes, and the value range is 0-(2 20 -1), and the end value should be greater than or equal to the start value.

[0138] It should be noted that, Figure 4 For example, the format of the individual flow selector payload in the message based on DSCP negotiation is similar to the format of the individual flow selector payload in the message based on flow label negotiation, but the bytes occupied by the start value and the end value are 2.5, which is different from Figure 4 . Figure 4 .

[0139] It should be understood that the name of the above-mentioned flow selector type extension field, and the name of the extension type field are only examples, which are not limited in the present application.

[0140] Step S420, the second device sends a fourth message to the first device, the fourth message including a determined flow label value set negotiated by the second device based on the third message. Correspondingly, the first device receives the fourth message.

[0141] For example, the third message includes the flow label value set information expected by the first device, and the second message includes the flow label value set negotiated by the second device based on the flow label value set information in the third message.

[0142] Optionally, the fourth message includes a flow selector type field and an extension field, when the flow selector type field takes a predetermined value, the first device parses the extension field, the extension type included in the extension field is a flow label range, the extension field further includes at least one flow label start value and at least one flow label end value, and the at least one flow label start value and the at least one flow label end value are used to determine M flow label value sets, M is an integer greater than or equal to 1.

[0143] For example, the flow label start value and the flow label end value in the extension field can determine two sets of flow label values, and the first device can generate three anti-replay windows according to the two sets of flow label values, or generate two anti-replay windows, or generate one anti-replay window, that is, the above-mentioned M can be less than, equal to, or greater than N, and the present application does not limit this.

[0144] It should be understood that the predetermined value is described in step S410, which will not be repeated here.

[0145] In step S430, the first device generates N anti-replay windows according to the flow label value set in the fourth message.

[0146] Optionally, the third message and / or the fourth message is an IKE message including a traffic selector payload.

[0147] For example, the third message and / or the fourth message is an IKE_AUTH or CREATE_CHILD_SA message.

[0148] It should be understood that the third message and / or the fourth message can also be other messages including a traffic selector payload, and the present application does not limit this.

[0149] Optionally, the traffic selector type field includes a traffic selector IPv6 address range and an extended traffic selector IPv6 address range.

[0150] When the traffic selector type field in the third / fourth message includes both the traffic selector IPv6 address range and the extended traffic selector IPv6 address range, devices that support negotiation to generate multiple anti-replay windows and devices that do not support negotiation to generate multiple anti-replay windows can be compatible. When the device that supports negotiation to generate multiple anti-replay windows receives the third / fourth message, it determines that the traffic selector type field in the traffic selector payload in the third / fourth message is the same address range traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or the same address range traffic selector IPv6 and the extended traffic selector IPv6 address range, and can only parse the extended traffic selector IPv4 / IPv6 address range. When the device that does not support negotiation to generate multiple anti-replay windows receives the third / fourth message, it cannot identify the extended traffic selector IPv4 / IPv6 address range field, so it only parses the traffic selector IPv4 / IPv6 address range field.

[0151] The following describes how to determine multiple anti-replay windows through DSCP negotiation by way of examples of specific scenarios.

[0152] Scenario 1: The first device is configured to allow multiple anti-replay windows based on DSCP, and the first device is configured with multiple DSCP values, and the second device is configured to allow multiple anti-replay windows based on DSCP, and the second device is configured with DSCP value of ANY (i.e. DSCP value is any value in 0-63).

[0153] The IKE message interaction process and the anti-replay window generation process are as follows:

[0154] The first message sent by the first device to the second device carries a traffic selector payload including an extension field, wherein the traffic selector type is TS_EXT_IPV6_ADDR_RANGE (EXT_IPV6 in the traffic selector payload example, and the traffic selector payload example appearing hereinafter is also denoted as EXT_IPV6, and details are not repeated), the traffic selector length is 56, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE (DSCP_RANGE in the traffic selector payload example, and the traffic selector payload example appearing hereinafter is also denoted as DSCP_RANGE, and details are not repeated), the extension length is 8, and the DSCP interval is [32, 47] and [48, 63].

[0155] A specific traffic selector payload example is as follows:

[0156] TSi payload:

[0157] TS_Type = EXT_IPv6, TS_Len = 56, Str_Addr = 1 :: 0, End Addr = 1 :: FFFF,

[0158] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 47

[0159] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 48, End Val = 63

[0160] TSr payload:

[0161] TS_Type = EXT_IPv6, TS_Len = 56, Str_Addr = 2 :: 0, End Addr = 2 :: FFFF,

[0162] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 47

[0163] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 48, End Val = 63

[0164] It should be understood that in the process of IKE message interaction, the one that initiates the message first is called initiator, and the one that responds is called responder, so the traffic selector sent by the initiator is called TSi (traffic selector-initiator), and the traffic selector sent by the responder is called TSr (traffic selector-responder).

[0165] The traffic selector carried in the second message responded by the second device includes an extension field in the traffic selector payload, wherein the traffic selector type is TS_IPV6_ADDR_RANGE, the traffic selector length is 56, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP interval is [32, 47] and [48, 63]

[0166] A specific traffic selector payload is as follows:

[0167] TSi payload:

[0168] TS_Type = EXT_IPv6, TS_Len = 56, Str_Addr = 1 :: 0, End Addr = 1 :: FFFF,

[0169] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 47

[0170] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 48, End Val = 63

[0171] TSr payload:

[0172] TS_Type = EXT_IPv6, TS_Len = 56, Str_Addr = 2 :: 0, End Addr = 2 :: FFFF,

[0173] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 47

[0174] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 48, End Val = 63

[0175] After the first message and the second message, the DSCP range negotiated by the first device and the second device is [32, 47], [48, 63] and others, and the first device and the second device can generate three anti-replay windows according to the above range, for example, the anti-replay window #1 corresponds to the DSCP value of 32-47, the anti-replay window #2 corresponds to the DSCP value of 48-63, and the anti-replay window #3 corresponds to the DSCP value of other values except [32, 47] and [48, 63].

[0176] At this point, the IPsec security alliance negotiation is completed, and the IPsec message of the security alliance is processed in the receiving direction by the anti-replay window corresponding to the DSCP value in the IPsec message.

[0177] Scenario 2: The first device is configured to allow multiple anti-replay windows to be generated based on DSCP, and the DSCP value configured by the first device is ANY (i.e., the DSCP value is any value in 0-63), and the second device is configured to allow multiple anti-replay windows to be generated based on DSCP, and the second device is configured with multiple DSCP values.

[0178] The IKE message interaction process and the anti-replay window generation process are as follows:

[0179] The first message sent by the first device to the second device carries a traffic selector payload including an extension field, wherein the traffic selector type is TS_EXT_IPV6_ADDR_RANGE, the traffic selector length is 48, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP range is [0, 63].

[0180] A specific traffic selector payload is as follows:

[0181] TSi payload:

[0182] TS_Type = EXT_IPv6, TS_Len = 48, Str_Addr = ::, End Addr = FFFF::FFFF,

[0183] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 0, End Val = 255

[0184] TSr payload:

[0185] TS_Type = EXT_IPv6, TS_Len = 48, Str_Addr = ::, End Addr = FFFF::FFFF,

[0186] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 47

[0187] The traffic selector payload in the second packet responded by the second device includes an extension field in the traffic selector, where the traffic selector type is TS_IPV6_ADDR_RANGE, the traffic selector length is 56, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP range is [32, 47] and [48, 63].

[0188] A specific traffic selector payload is as follows:

[0189] TSi payload:

[0190] TS_Type = EXT_IPv6, TS_Len = 56, Str_Addr = 1 :: 0, End Addr = 1 :: FFFF,

[0191] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 47

[0192] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 48, End Val = 63

[0193] TSr payload:

[0194] TS_Type = EXT_IPv6, TS_Len = 56, Str_Addr = 2 :: 0, End Addr = 2 :: FFFF,

[0195] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 47

[0196] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 48, End Val = 63

[0197] After the first packet and the second packet, the DSCP ranges negotiated by the first device and the second device are [32, 47], [48, 63], and others, and then the first device and the second device can generate three anti-replay windows according to the ranges, for example, the anti-replay window #1 corresponds to the DSCP value of 32-47, the anti-replay window #2 corresponds to the DSCP value of 48-63, and the anti-replay window #3 corresponds to the DSCP value of other values except [32, 47] and [48, 63].

[0198] At this point, the IPsec security association negotiation is completed, and the IPsec packet of the security association is processed by the anti-replay window corresponding to the DSCP value in the IPsec packet in the receiving direction.

[0199] Scenario 3: The first device end is configured to allow multiple anti-replay windows to be generated based on DSCP, and the first device end is configured with multiple DSCP values, and the second device is configured to allow multiple anti-replay windows to be generated based on DSCP, and the second device end is also configured with multiple DSCP values.

[0200] The IKE message interaction process and the anti-replay window generation process are as follows:

[0201] The traffic selector payload carried in the first message sent by the first device to the second device includes an extension field, wherein the traffic selector type is TS_EXT_IPV6_ADDR_RANGE, the traffic selector length is 48, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP interval is [32, 63].

[0202] A specific traffic selector payload is as follows:

[0203] TSi payload:

[0204] TS_Type = EXT_IPv6, TS_Len = 48, Str_Addr = 1 :: 0, End Addr = 1 :: FFFF,

[0205] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 63

[0206] TSr payload:

[0207] TS_Type = EXT_IPv6, TS_Len = 48, Str_Addr = 2 :: 0, End Addr = 2 :: FFFF,

[0208] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 63

[0209] The traffic selector payload carried in the second message in response of the second device includes an extension field, wherein the traffic selector type is TS_IPV6_ADDR_RANGE, the traffic selector length is 56, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP interval is [46, 46] and [48, 48]

[0210] A specific traffic selector load example is as follows:

[0211] TSi load:

[0212] TS_Type = EXT_IPv6, TS_Len = 56, Str_Addr = 1 :: 0, End Addr = 1 :: FFFF,

[0213] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 46, End Val = 46

[0214] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 48, End Val = 48

[0215] TSr load:

[0216] TS_Type = EXT_IPv6, TS_Len = 56, Str_Addr = 2 :: 0, End Addr = 2 :: FFFF,

[0217] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 46, End Val = 46

[0218] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 48, End Val = 48

[0219] After the first message and the second message, the DSCP intervals negotiated by the first device and the second device are [46, 46], [48, 48] and others, and the first device and the second device can generate three anti-replay windows according to the above intervals, for example, the anti-replay window #1 corresponds to the DSCP value 46, the anti-replay window #2 corresponds to the DSCP value 48, and the anti-replay window #3 corresponds to the DSCP value other than 46 and 48.

[0220] At this point, the IPsec security alliance negotiation is completed, and the IPsec message of the security alliance is processed in the receiving direction by the anti-replay window corresponding to the DSCP value in the IPsec message.

[0221] Scenario 4: The first device is configured to allow multiple anti-replay windows to be generated based on DSCP, and the second device is configured not to allow multiple anti-replay windows to be generated based on DSCP.

[0222] The second device configured to not allow multiple anti-replay windows based on DSCP can be understood as that the second device supports multiple anti-replay windows based on DSCP (the second device can identify the extended traffic selector field), but the second device is configured to not allow multiple anti-replay windows based on DSCP (the second device includes the traffic selector field instead of the extended traffic selector field in the second message in response).

[0223] The IKE message interaction process and the anti-replay window generation process are as follows:

[0224] The traffic selector payload carried in the first message sent by the first device to the second device includes the extended field, where the traffic selector type is TS_EXT_IPV6_ADDR_RANGE, the traffic selector length is 48, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP interval is [32, 63].

[0225] A specific traffic selector payload is as follows:

[0226] TSi payload:

[0227] TS_Type = EXT_IPv6, TS_Len = 48, Str_Addr = 1::0, End Addr = 1::FFFF,

[0228] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 63

[0229] TSr payload:

[0230] TS_Type = EXT_IPv6, TS_Len = 48, Str_Addr = 2::0, End Addr = 2::FFFF,

[0231] Ext_Type = DSCP_RANGE, Ext_Len = 8, Str Val = 32, End Val = 63

[0232] The traffic selector payload carried in the second message in response of the second device does not include the extended field, because the second device can identify the extended traffic selector, but because it is configured to not allow multiple anti-replay windows based on DSCP, the non-extended traffic selector is included in the second message in response.

[0233] A specific traffic selector payload is as follows:

[0234] TSi payload:

[0235] TS_Type = IPv6, TS_Len = 40, Str_Addr = 1 :: 0, End Addr = 1 :: FFFF,

[0236] TSr payload:

[0237] TS_Type = IPv6, TS_Len = 40, Str_Addr = 2 :: 0, End Addr = 2 :: FFFF,

[0238] After the first message and the second message, the first device and the second device do not negotiate the DSCP range, and the first device and the second device generate a default anti-replay window.

[0239] At this point, the IPsec security alliance negotiation is completed, and the IPsec message of the security alliance is processed by the default anti-replay window in the receiving direction.

[0240] Scenario 5: The first device is configured to allow multiple anti-replay windows based on DSCP, and the second device is configured to not support multiple anti-replay windows based on DSCP

[0241] Scenario 5 is a compatible scenario, the first device is configured to allow multiple anti-replay windows based on DSCP, but the first device does not know whether the second device supports multiple anti-replay windows based on DSCP, so the traffic selector sent includes two groups, one group is a non-extended traffic selector, and one group is an extended traffic selector, and the address ranges of the two groups are the same.

[0242] The first case: when the second device supports multiple anti-replay windows based on DSCP, the second device can recognize the extended traffic selector, and since the address ranges of the two traffic selectors are the same, the second device only processes the extended traffic selector.

[0243] The second case: when the second device does not support multiple anti-replay windows based on DSCP, the second device cannot recognize the extended traffic selector, so it only processes the non-extended traffic selector, and in this process, the negotiation can also be successful.

[0244] Therefore, compatible scenario 5 describes the downward compatibility of devices supporting the present application (which can recognize extended traffic selectors) and devices not supporting the present application, avoiding basic negotiation failure.

[0245] The IKE message interaction process and the anti-replay window generation process are as follows:

[0246] The traffic selector payload carried in the first message sent by the first device to the second device includes an extension field, wherein the traffic selector type is TS_IPV6_ADDR_RANGE and TS_EXT_IPV6_ADDR_RANGE, the non-extended traffic selector length is 40, the extended traffic selector length is 48, the extension type is INDEP_ANTIREPLAY_DSCP_RANGE, the extension length is 8, and the DSCP interval is [32, 63].

[0247] A specific traffic selector payload is as follows:

[0248] TSi payload:

[0249] TS_Type=IPv6, TS_Len=40, Str_Addr=1::0, End Addr=1::FFFF;

[0250] TS_Type=EXT_IPv6, TS_Len=48, Str_Addr=1::0, End Addr=1::FFFF,

[0251] Ext_Type=DSCP_RANGE, Ext_Len=8, Str Val=32, End Val=63

[0252] TSr payload:

[0253] TS_Type=IPv6, TS_Len=40, Str_Addr=2::0, End Addr=2::FFFF;

[0254] TS_Type=EXT_IPv6, TS_Len=48, Str_Addr=1::0, End Addr=1::FFFF,

[0255] Ext_Type=DSCP_RANGE, Ext_Len=8, Str Val=32, End Val=63

[0256] The second device does not support generating multiple anti-replay windows based on DSCP, and therefore only analyzes the field TS_Type=IPv6 in the first message, does not analyze the field TS_Type=EXT_IPv6, and the extension field. The traffic selector payload carried in the second message sent by the second device in response does not include an extension field.

[0257] A specific traffic selector payload is as follows:

[0258] TSi payload:

[0259] TS_Type = IPv6, TS_Len = 40, Str_Addr = 1 :: 0, End Addr = 1 :: FFFF;

[0260] TSr payload:

[0261] TS_Type = IPv6, TS_Len = 40, Str_Addr = 2 :: 0, End Addr = 2 :: FFFF;

[0262] After the first message and the second message, the first device and the second device do not negotiate the DSCP range, and then the first device and the second device generate a default anti-replay window.

[0263] At this point, the IPsec security alliance negotiation is completed, and the IPsec message of the security alliance is processed by the default anti-replay window in the receiving direction.

[0264] The scheme provided in the application has strong expansibility, and the expansion type can have 256 different values. Ext_Type = "INDEP_ANTIREPLAY_DSCP" and "INDEP_ANTIREPLAY_FLOWLABEL" defined in the embodiments of the application only occupy two values, and other values can be extended for other characteristics.

[0265] The specific content of the multiple anti-replay windows determined by the flow label negotiation is similar to the multiple anti-replay windows determined by the DSCP negotiation, the negotiation process is the same, and only the field name and specific value are different, which will not be repeated here.

[0266] Scenario 6: The first device locally statically configures at least one anti-replay window

[0267] It should be understood that scenarios 1-5 introduce how the first device generates multiple anti-replay windows through DSCP value negotiation, and scenario 6 introduces that the first device does not need to negotiate with the second device and statically configures at least one anti-replay window according to the DSCP value or the flow label value locally.

[0268] In the following, the first device statically configures at least one anti-replay window according to the DSCP value locally is mainly taken as an example, and the process of the first device statically configuring at least one anti-replay window according to the flow label value locally is similar, which will not be repeated here.

[0269] For example, the first device is configured to allow generating multiple anti-replay windows based on DSCP, and according to prior art, one IPsec security association can correspond to one anti-replay window (default anti-replay window), and on this basis, the first device can further statically configure at least one anti-replay window corresponding to the IPsec security association. For example, the first device statically configures 2 anti-replay windows based on DSCP values locally corresponding to one IPsec security association, wherein anti-replay window #1 corresponds to a DSCP value of

[46] , anti-replay window #2 corresponds to a DSCP value of

[48] , and anti-replay window #3 (default anti-replay window) corresponds to a DSCP value other than 46 and 48.

[0270] At this point, the first device completes the local static configuration of at least one anti-replay window. Subsequently, after the first device receives an IPsec packet, the first device selects a corresponding anti-replay window according to a DSCP value in the IPsec packet. For example, the DSCP value in the IPsec packet is 48, and the IPsec packet is processed by anti-replay window #2.

[0271] Optionally, the multiple anti-replay windows of the first device have priorities, that is, after the first device receives an IPsec packet, the first device compares the DSCP value in the IPsec packet with the DSCP value corresponding to each anti-replay window in turn according to the priorities of the multiple anti-replay windows, until the anti-replay window corresponding to the DSCP value in the IPsec packet is found, and the IPsec packet is processed by the anti-replay window.

[0272] For example, the first device statically configures 2 anti-replay windows based on DSCP values locally, and the priorities of the anti-replay windows from high to low are anti-replay window #1 (corresponding to a DSCP value of

[46] ), anti-replay window #2 (corresponding to a DSCP value of

[48] ), and anti-replay window #3 (default anti-replay window, corresponding to a DSCP value other than 46 and 48).

[0273] For example, the DSCP value of an IPsec packet #1 received by the first device subsequently is 48, the first anti-replay window selected according to the priorities is anti-replay window #1, but the DSCP value of anti-replay window #1 does not match 48, the next anti-replay window selected according to the priorities is anti-replay window #2, the DSCP value of anti-replay window #2 matches 48, and therefore the IPsec packet #1 is processed by anti-replay window #2.

[0274] For example, the DSCP value of the IPsec packet #2 received by the subsequent first device is 47, the first anti-replay window selected according to the priority is the anti-replay window #1, but the DSCP value of the anti-replay window #1 does not match 47, the next anti-replay window selected according to the priority is the anti-replay window #2, and the DSCP value of the anti-replay window #2 still does not match 47, so the IPsec packet #2 is processed in the anti-replay window #3.

[0275] It should be understood that the method provided by the embodiments of the present application can be used alone or in combination, and the present application does not make any limitation in this regard.

[0276] It should be noted that the execution subject mentioned in the above method embodiments is only an example, and the execution subject can also be a chip, a chip system, or a processor supporting the execution subject to implement the above method embodiments, and the present application does not make any limitation in this regard.

[0277] The above describes the method embodiments of the embodiments of the present application in combination with the accompanying Figure 3 and 5 The device embodiments of the embodiments of the present application are described below. It can be understood that the description of the method embodiments and the description of the device embodiments can correspond to each other, and therefore, the parts not described can be referred to the foregoing method embodiments.

[0278] It can be understood that the above Figure 3 and 5 In the embodiments shown in the above, the method and operation implemented by the first device can also be implemented by a component (such as a chip or a circuit) available for the first device, and the method and operation implemented by the second device can also be implemented by a component (such as a chip or a circuit) available for the second device.

[0279] The above mainly introduces the scheme provided by the embodiments of the present application from the perspective of the interaction between nodes. It can be understood that each network element, such as a transmitting end device or a receiving end device, contains a hardware structure and / or a software module for executing each function in order to implement the above functions. Those skilled in the art should be aware that, in combination with the units and algorithm steps of the examples described in the embodiments disclosed herein, the present application can be realized in the form of hardware or a combination of hardware and computer software. Whether a certain function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical scheme. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0280] The embodiments of the present application can divide the function modules of the transmitting end device or the receiving end device according to the above method examples. For example, each function module can be divided according to each function, or two or more functions can be integrated in one processing module. The integrated module can be realized in the form of hardware or in the form of a software function module. It should be noted that the division of the modules in the embodiments of the present application is illustrative, and is only a logical function division. In actual implementation, another division mode can be used. The following will be described by taking the division of each function module according to each function as an example.

[0281] Figure 6 FIG. 5 is a schematic block diagram of a device for processing data provided by an embodiment of the present application. The device 500 includes a transceiver unit 510 and a processing unit 520. The transceiver unit 510 can communicate with the outside, and the processing unit 520 is used for data processing. The transceiver unit 510 can also be referred to as a communication interface or a communication unit.

[0282] Optionally, the device 500 can further include a storage unit, which can be used to store instructions or and / or data. The processing unit 520 can read the instructions or and / or data in the storage unit.

[0283] In one design, the device 500 can be a first device in a data exchange network. The transceiver unit 510 is used to perform the receiving or sending operations of the first device in the above method embodiments, and the processing unit 520 is used to perform the internal processing operations of the first device in the above method embodiments.

[0284] In another design, the device 500 can be a device including the first device. Alternatively, the device 500 can be a component configured in the first device, for example, a chip in the first device. In this case, the transceiver unit 510 can be an interface circuit, a pin, etc. Specifically, the interface circuit can include an input circuit and an output circuit, and the processing unit 520 can include a processing circuit.

[0285] In one possible implementation, the transceiver unit 510 is used to receive an Internet security protocol (IPsec) packet, the IPsec packet including a first field, the first field carrying a value of first information, and the processing unit 520 is used to determine a first anti-replay window from N anti-replay windows according to a first mapping relationship, the first mapping relationship including a corresponding relationship between the N anti-replay windows and N sets of values of the first information, the value of the first information carried by the first field belonging to a set of values of the first information corresponding to the first anti-replay window, the first anti-replay window being used to process the IPsec packet, the N anti-replay windows corresponding to a same IPsec security alliance, N being an integer greater than or equal to 2.

[0286] Based on the above scheme, one IPsec security association of the receiving end of the IPsec packet corresponds to multiple anti-replay windows, so that the receiving end of the IPsec packet can determine the priority of the IPsec packet according to the first field in the IPsec packet, and select the corresponding anti-replay window to process the IPsec packet according to the priority, so as to realize processing of IPsec packets of different priorities in different anti-replay windows. The packets processed by each anti-replay window are of the same priority, so that the problem of packet loss caused by out-of-order can be avoided, and the problem of increased system resource consumption caused by the newly added IPsec security association in the parallel IPsec security association scheme proposed in chapter 4.1 of the RFC4301 standard can also be avoided.

[0287] In a possible implementation, the first information includes a differentiated services code point (DSCP) or a flow label.

[0288] In the case of the same IPsec security association, the DSCP values of different IPsec packets represent different priorities. Based on the scheme provided in the present application, high-priority packets and low-priority packets can be processed in different anti-replay windows, so that packet loss of low-priority packets can be avoided.

[0289] In the case of the same IPsec security association, the flow label values of different IPsec packets represent different services. Different services can map different qualities of service in the transmission process. Based on the scheme provided in the present application, services corresponding to different qualities of service can be independently processed in different anti-replay windows, so that packet loss of low-priority packets can be avoided.

[0290] In a possible implementation, the processing unit 520 is further configured to generate the N anti-replay windows according to the first information.

[0291] In a possible implementation, the N anti-replay windows are locally statically configured.

[0292] In a possible implementation, the N anti-replay windows are generated by the first device and the second device according to values of the first information. The transceiver 510 is further configured to send a first packet, where the first packet includes a value set of the first information expected by the first device. The transceiver 510 is further configured to receive a second packet, where the second packet includes a value set of the first information negotiated by the second device based on the first packet. The processing unit 520 is further configured to generate the N anti-replay windows according to the value set of the first information in the second packet.

[0293] In a possible implementation, the second packet includes a traffic selector type field and an extension field, and when the traffic selector type field takes a predetermined value, the processing unit 520 is further configured to parse the extension field, the extension field includes a range of the first information, and the extension field further includes at least one start value of the first information and at least one end value of the first information, the at least one start value of the first information and the at least one end value of the first information are used to determine a value set of M first information, and M is an integer greater than or equal to 1.

[0294] In a possible implementation, the first packet and / or the second packet is an Internet Key Exchange packet including a traffic selector payload.

[0295] In a possible implementation, the traffic selector type field includes: a traffic selector Internet Protocol version 6 (IPv6) address range and an extended traffic selector IPv6 address range, or a traffic selector IPv4 address range and an extended traffic selector IPv4 address range.

[0296] Based on the above scheme, the present application adds an extended traffic selector IPv4 or IPv6 address range to the existing traffic selector IPv4 or IPv6 address range field, and can be compatible with devices that support negotiation to generate multiple anti-replay windows and devices that do not support negotiation to generate multiple anti-replay windows. When the device that supports negotiation to generate multiple anti-replay windows receives the second packet, when the device that supports negotiation to generate multiple anti-replay windows sends the first packet, the same address range traffic selector IPv4 address range field and the extended traffic selector IPv4 address range field can be placed in the traffic selector payload, or the same address range traffic selector IPv6 address range field and the extended traffic selector IPv6 address range field can be placed in the traffic selector payload. When the traffic selector type field in the traffic selector payload in the second packet is determined to be the same address range traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or the same address range traffic selector IPv6 and the extended traffic selector IPv6 address range, only the extended traffic selector IPv4 / IPv6 address range can be parsed. When the device that does not support negotiation to generate multiple anti-replay windows receives the second packet, the extended traffic selector IPv4 / IPv6 address range field cannot be recognized, and therefore only the traffic selector IPv4 / IPv6 address range field is parsed.

[0297] Figure 7is a schematic block diagram of an apparatus for processing data provided by an embodiment of the present application. The apparatus 600 comprises a transceiver unit 610 and a processing unit 620. The transceiver unit 610 can communicate with the outside, and the processing unit 620 is configured to process data. The transceiver unit 610 can also be referred to as a communication interface or a communication unit.

[0298] Optionally, the apparatus 600 can further comprise a storage unit 630, which can be configured to store instructions or and / or data, and the processing unit 620 can read the instructions or and / or data in the storage unit 630.

[0299] In one design, the apparatus 600 can be a second device in a data exchange network, the transceiver unit 610 is configured to perform the receiving or transmitting operations of the second device in the above method embodiments, and the processing unit 620 is configured to perform the internal processing operations of the second device in the above method embodiments.

[0300] In another design, the apparatus 600 can be a device comprising the second device. Alternatively, the apparatus 600 can be a component configured in the second device, for example, a chip in the second device. In this case, the transceiver unit 610 can be an interface circuit, a pin, etc. Specifically, the interface circuit can comprise an input circuit and an output circuit, and the processing unit 620 can comprise a processing circuit.

[0301] In one possible implementation, the transceiver unit 610 is configured to send an Internet Protocol Security (IPsec) packet, the IPsec packet comprising a first field, the first field carrying a value of first information, the first field being used to determine a first anti-replay window from N anti-replay windows, the value of the first information carried by the first field belonging to a set of values of the first information corresponding to the first anti-replay window, the first anti-replay window being used to process the IPsec packet, the N anti-replay windows corresponding to a same IPsec security association, N being an integer greater than or equal to 2.

[0302] Based on the above scheme, one IPsec security association of the receiving end of the IPsec packet corresponds to multiple anti-replay windows, so that the receiving end of the IPsec packet can determine the priority of the IPsec packet according to the first field in the IPsec packet, and select the corresponding anti-replay window to process the IPsec packet according to the priority, so as to realize the processing of IPsec packets of different priorities in different anti-replay windows. The packets processed by each anti-replay window are of the same priority, so that the problem of increased system resource consumption caused by the newly added IPsec security association in the parallel IPsec security association scheme proposed in Chapter 4.1 of RFC4301 standard can be avoided.

[0303] In a possible implementation, the first information includes a differentiated services code point (DSCP) or a flow label.

[0304] In the same IPsec security association, different IPsec messages have different DSCP values representing different priorities, and based on the scheme provided in the present application, high-priority messages and low-priority messages can be processed in different anti-replay windows, so that low-priority message loss can be avoided.

[0305] In the same IPsec security association, different IPsec messages have different flow label values representing different services, and different services can map to different quality of service (QoS) in the transmission process, and based on the scheme provided in the present application, services corresponding to different QoS can be independently processed in different anti-replay windows, so that low-priority message loss can be avoided.

[0306] In a possible implementation, the transceiver 610 is further configured to receive a first message including a value set of first information expected by the first device, and transmit a second message including a value set of the first information negotiated by the second device based on the first message, wherein the value set of the first information in the second message is used to generate the N anti-replay windows.

[0307] In a possible implementation, the first message includes a traffic selector type field and an extension field, and when the traffic selector type field takes a predetermined value, the processing unit 620 is configured to parse the extension field, the extension field including an extension type being a range of the first information, and the extension field further including at least one start value of the first information and at least one end value of the first information.

[0308] In a possible implementation, the first message and / or the second message is an Internet Key Exchange (IKE) message including a traffic selector payload.

[0309] In a possible implementation, the traffic selector type field includes: a traffic selector Internet Protocol version 6 (IPv6) address range and an extended traffic selector IPv6 address range, or a traffic selector IPv4 address range and an extended traffic selector IPv4 address range.

[0310] Based on the above scheme, the application adds an extended traffic selector IPv4 or IPv6 address range on the basis of the existing traffic selector IPv4 or IPv6 address range field, and can compatibly support devices that negotiate to generate multiple anti-replay windows and devices that do not support negotiation to generate multiple anti-replay windows. When the device that supports negotiation to generate multiple anti-replay windows receives the first message, it determines that the traffic selector type field in the traffic selector payload in the first message is the same address range traffic selector IPv4 address range and the extended traffic selector IPv4 address range, or the same address range traffic selector IPv6 address range and the extended traffic selector IPv6 address range. At this time, only the extended traffic selector IPv4 / IPv6 address range can be parsed. When the device that does not support negotiation to generate multiple anti-replay windows receives the first message, it cannot recognize the extended traffic selector IPv4 / IPv6 address range field, and therefore only parses the traffic selector IPv4 / IPv6 address range field.

[0311] As shown in Figure 8 , the embodiment of the application further provides a device 700 for processing data. The device 700 comprises a processor 710, and the processor 710 is coupled with a memory 720. The memory 720 is configured to store computer programs or instructions and / or data. The processor 710 is configured to execute the computer programs or instructions and / or data stored in the memory 720, so that the method in the above method embodiment is executed.

[0312] Optionally, the processor 710 included in the device 700 is one or more.

[0313] Optionally, as shown in Figure 8 , the device 700 can further comprise the memory 720.

[0314] Optionally, the memory 720 included in the device 700 is one or more.

[0315] Optionally, the memory 720 can be integrated with the processor 710 or separately arranged.

[0316] Optionally, as shown in Figure 8 , the device 700 can further comprise a transceiver 730 and / or a communication interface, and the transceiver 730 and / or the communication interface are configured to receive and / or send signals. For example, the processor 710 is configured to control the transceiver 730 and / or the communication interface to receive and / or send signals.

[0317] As an option, the apparatus 700 is configured to implement operations performed by a first device in the above method embodiments. For example, the processor 710 is configured to implement operations performed internally by the first device in the above method embodiments, and the transceiver 730 is configured to implement operations of receiving or transmitting performed by the first device in the above method embodiments. The processing unit 520 in the apparatus 500 can be the processor in the apparatus 500, and the transceiving unit 510 can be the transceiver in the apparatus 500. The operations performed by the processor 710 can refer to the above description of the processing unit 520, and the operations performed by the transceiver 730 can refer to the above description of the transceiving unit 510, which are not repeated here. Figure 8 Figure 8 The operations performed by the processor 710 can refer to the above description of the processing unit 520, and the operations performed by the transceiver 730 can refer to the above description of the transceiving unit 510, which are not repeated here.

[0318] As shown in Figure 9 , the embodiments of the present disclosure further provide an apparatus 800 for processing data. The apparatus 800 includes a processor 810, and the processor 810 is coupled with a memory 820. The memory 820 is configured to store computer programs or instructions and / or data. The processor 810 is configured to execute the computer programs or instructions and / or data stored in the memory 820, so that the method in the above method embodiments is implemented.

[0319] Optionally, the processor 810 included in the apparatus 800 is one or more.

[0320] Optionally, as shown in Figure 9 , the apparatus 800 can further include the memory 820.

[0321] Optionally, the memory 820 included in the apparatus 800 is one or more.

[0322] Optionally, the memory 820 can be integrated with the processor 810 or separately arranged.

[0323] Optionally, as shown in Figure 9 , the apparatus 800 can further include a transceiver 830 and / or a communication interface. The transceiver 830 and / or the communication interface are configured to receive and / or transmit signals. For example, the processor 810 is configured to control the transceiver 830 to receive and / or transmit signals.

[0324] As an option, the apparatus 800 is configured to implement operations performed by a second device in the above method embodiments.

[0325] For example, the processor 810 is configured to implement operations performed internally by the second device in the above method embodiments, and the transceiver 830 is configured to implement operations of receiving or transmitting performed by the second device in the above method embodiments. The processing unit 620 in the apparatus 600 can be the processor in the apparatus 600, and the transceiving unit 610 can be the transceiver in the apparatus 600. Figure 9 Figure 9 ​​The operations performed by the processor 810 can be specifically seen from the description of the processing unit 620 above, and the operations performed by the transceiver 830 can be specifically seen from the description of the transceiving unit 610 above, which are not described herein again.

[0326] The embodiment of the present application further provides a device for processing data, comprising a processor coupled with an input / output interface through which data is transmitted, and the processor is configured to execute the method in any of the method embodiments.

[0327] As Figure 10 The embodiment of the present application further provides a device 900 for processing data. The device 900 comprises a logic circuit 910 and an input / output interface 920.

[0328] The logic circuit 910 can be a processing circuit in the device 900. The logic circuit 910 can be coupled with a storage unit to call instructions in the storage unit, so that the device 900 can implement the method and function of the embodiments of the present application. The input / output interface 920 can be an input / output circuit in the device 900, which outputs the information processed by the device 900 or inputs the data or signaling information to be processed into the device 900 for processing.

[0329] As an option, the device 900 is configured to implement the operations performed by the first device in the above method embodiments.

[0330] For example, the logic circuit 910 is configured to implement the processing-related operations performed by the first device in the above method embodiments, and the input / output interface 920 is configured to implement the sending and / or receiving-related operations performed by the first device in the above method embodiments. The operations performed by the logic circuit 910 can be specifically seen from the description of the processing unit 520 above, and the operations performed by the input / output interface 920 can be specifically seen from the description of the transceiving unit 510 above, which are not described herein again.

[0331] As another option, the device 900 is configured to implement the operations performed by the second device in the above method embodiments.

[0332] For example, the logic circuit 910 is configured to implement the processing-related operations performed by the second device in the above method embodiments, and the input / output interface 920 is configured to implement the sending and / or receiving-related operations performed by the second device in the above method embodiments. The operations performed by the logic circuit 910 can be specifically seen from the description of the processing unit 620 above, and the operations performed by the input / output interface 920 can be specifically seen from the description of the transceiving unit 610 above, which are not described herein again.

[0333] It should be understood that the above device can be one or more chips. For example, the device can be a field programmable gate array (FPGA), can be an application specific integrated circuit (ASIC), can also be a system on chip (SoC), can also be a central processor unit (CPU), can also be a network processor (NP), can also be a digital signal processor (DSP), can also be a microcontroller unit (MCU), can also be a programmable logic device (PLD) or other integrated chip.

[0334] In the implementation process, each step of the above method can be completed by the integrated logic circuit of the hardware in the processor or the instructions in the form of software. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as hardware processor execution completion, or executed by hardware and software modules in the processor. The software module can be located in a mature storage medium in the field, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, register, etc. The storage medium is located in the memory, and the processor reads the information in the memory, and combines the hardware to complete the steps of the above method. To avoid repetition, it will not be described in detail here.

[0335] It should be noted that the processor in the embodiments of the present application can be an integrated circuit chip with a signal processing capability. In the implementation process, the steps of the above method embodiments can be completed by an integrated logic circuit or an instruction in the form of software in the processor. The processor described above can be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components. The disclosed methods, steps and logic block diagrams in the embodiments of the present application can be implemented or executed. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor or the like. The steps of the method disclosed in conjunction with the embodiments of the present application can be directly embodied as a hardware code processor for execution, or a combination of hardware and software modules in the code processor for execution. The software module can be located in a random access memory, a flash memory, a read-only memory, a programmable read-only memory or an electrically erasable programmable memory, a register or other mature storage medium in the art. The storage medium is located in the storage, and the processor reads the information in the storage, and combines the hardware to complete the steps of the above method.

[0336] It can be understood that the memory in the embodiments of the present application can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memories. Among them, the non-volatile memory can be a read-only memory (ROM), a programmable read-only memory (PROM), an erasable programmable read-only memory (EPROM), an electrically EPROM (EEPROM) or a flash memory. The volatile memory can be a random access memory (RAM) used as an external cache. By way of example but not limitation, many forms of RAM are available, such as static random access memory (SRAM), dynamic random access memory (DRAM), synchronous dynamic random access memory (SDRAM), double data rate synchronous dynamic random access memory (DDR SDRAM), enhanced SDRAM (ESDRAM), synchlink DRAM (SLDRAM) and direct memory bus random access memory (DRAM). It should be noted that the memory of the system and method described herein is intended to include but not limited to these and any other suitable types of memory.

[0337] The embodiment of the present application further provides a data exchange system, which comprises a first device and a second device.

[0338] According to the method provided by the embodiment of the present application, the present application further provides a computer readable medium, which stores program codes, and when the program codes are executed on a computer, the computer executes the method of the above embodiment. For example, when the computer program is executed by the computer, the computer can implement the method executed by the first device or the method executed by the second device in the above method embodiment.

[0339] The embodiment of the present application further provides a computer program product comprising instructions which, when executed by a computer, cause the computer to implement the method executed by the first device or the method executed by the second device in the above method embodiment.

[0340] The explanation and beneficial effects of the related content in any of the above provided data processing devices can refer to the corresponding method embodiments provided above, and will not be repeated here.

[0341] In the above embodiments, all or part of the embodiments can be realized by software, hardware, firmware or any combination thereof. When realized by software, all or part of the embodiments can be realized in the form of a computer program product. The computer program product comprises one or more computer instructions. When the computer instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network or other programmable device. The computer instructions can be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, the computer instructions can be transmitted from one website, computer, server or data center to another website, computer, server or data center through wired (such as coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (such as infrared, wireless, microwave, etc.) mode. The computer readable storage medium can be any available medium that can be accessed by a computer or a data storage device such as a server, data center, etc. integrated with one or more available media. The available media can be magnetic media (such as floppy disk, hard disk, magnetic tape), optical media (such as high-density digital video disc (digital video disc, DVD)) or semiconductor media (such as solid state disc (solid state disc, SSD)) and the like.

[0342] The network device and the terminal device in each of the above apparatus embodiments correspond to the network device and the terminal device in the method embodiments, and the corresponding steps are performed by the corresponding modules or units, for example, the communication unit (transceiver) performs the steps of receiving or sending in the method embodiments, and the other steps except sending and receiving can be performed by the processing unit (processor). The functions of the specific units can be referred to the corresponding method embodiments. The processor can be one or more.

[0343] The terms "component," "module," "system," and the like as used herein can refer to computer-related entities, hardware, firmware, a combination of hardware and software, software, or software in execution. For example, a component can be, but is not limited to being, a process running on a processor, a processor, an object, an executable, a thread of execution, a program, and / or a computer. By way of illustration, both an application running on a computing device and the computing device can be a component. One or more components can reside within a process and / or thread of execution and a component can be localized, co-resident, and / or distributed amongst one computer and / or across multiple computers. Also, these components can execute from various computer readable media having various data structures stored thereon. The components can communicate by way of local and / or remote processes such as in accordance with a signal having one or more data packets (e.g., data from one component interacting with another component in a local system, distributed system, and / or across a network such as the Internet with other systems via the signal).

[0344] Those skilled in the art can clearly understand that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software manner depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0345] Those skilled in the art can clearly understand that, for the convenience and brevity of the description, the specific working processes of the above-described system, apparatus and unit can refer to the corresponding processes in the foregoing method embodiments, which will not be described here.

[0346] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be implemented in other manners. For example, the described device embodiments are merely schematic. The division of the units is merely logical function division. There can be other division manners in actual implementation. For example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the displayed or discussed mutual couplings or direct couplings or communication connections can be indirect couplings or communication connections through some interfaces, devices or units, and can be in electrical, mechanical or other forms.

[0347] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, i.e., can be located in one place, or can be distributed on a plurality of network units. Some or all of the units can be selected according to actual needs to achieve the purpose of the embodiment.

[0348] In addition, each functional unit in the various embodiments of the present application can be integrated into a processing unit, or each unit can be a physically independent unit, or two or more units can be integrated into a unit.

[0349] If the functions are realized in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application can be embodied in the form of a software product, and the computer software product is stored in a storage medium, and includes a number of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The foregoing storage medium includes: a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various program code storage media.

[0350] The above is merely specific embodiments of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for message anti-replay, the method comprising: The method comprises: A first device receives an Internet Protocol Security (IPsec) packet, the IPsec packet comprising a first field carrying a value of first information, the first information comprising a Differentiated Services Code Point (DSCP) or a flow label; The first device generates N anti-replay windows according to the first information; The first device determines a first anti-replay window from the N anti-replay windows according to a first mapping relationship, the first mapping relationship comprising a correspondence between the N anti-replay windows and N sets of values of the first information, the value of the first information carried by the first field belonging to a set of values of the first information corresponding to the first anti-replay window, the first anti-replay window being used for processing the IPsec packet, the N anti-replay windows corresponding to a same IPsec security association, N being an integer greater than or equal to 2.

2. The method of claim 1, wherein, The N anti-replay windows are statically configured locally.

3. The method of claim 2, wherein, The first device generates the N anti-replay windows according to the first information, comprising: The first device sends a first packet, the first packet comprising a set of values of the first information expected by the first device; The first device receives a second packet, the second packet comprising a set of values of the first information negotiated by a second device based on the first packet; The first device generates the N anti-replay windows according to the set of values of the first information in the second packet.

4. The method of claim 3, wherein, The second packet comprises a traffic selector type field and an extension field, and the method further comprises: When the traffic selector type field takes a predetermined value, the first device parses the extension field, the extension field comprising an extension type of the first information, the extension field further comprising at least one start value of the first information and at least one end value of the first information, the at least one start value of the first information and the at least one end value of the first information being used to determine M sets of values of the first information, M being an integer greater than or equal to 1.

5. The method according to claim 3 or 4, characterized in that, The first packet and / or the second packet is an Internet Key Exchange (IKE) packet comprising a traffic selector payload.

6. The method according to claim 4 or 5, characterized in that, The traffic selector type field comprises: a traffic selector Internet Protocol version 6 (IPv6) address range and an extended traffic selector IPv6 address range, or a traffic selector IPv4 address range and an extended traffic selector IPv4 address range.

7. A method for message anti-replay, the method comprising: The method comprises: A second device sends an Internet Protocol Security (IPsec) packet, the IPsec packet comprising a first field carrying a value of first information, the first field being used to determine a first anti-replay window from N anti-replay windows, the value of the first information carried by the first field belonging to a set of values of the first information corresponding to the first anti-replay window, the first anti-replay window being used for processing the IPsec packet, the N anti-replay windows corresponding to a same IPsec security association, N being an integer greater than or equal to 2, the first field comprising a Differentiated Services Code Point (DSCP) field or a flow label field.

8. The method of claim 7, wherein, The method further comprises: The second device receives a first message, the first message including a set of values of the first information expected by the first device; The second device sends a second message, the second message including a set of values of the first information negotiated by the second device based on the first message, the set of values of the first information in the second message being used to generate the N anti-replay windows.

9. The method of claim 8, wherein, The first message includes a traffic selector type field and an extension field, and the method further includes: When the traffic selector type field takes a predetermined value, the second device parses the extension field, the extension field including an extension type that is a range of the first information, the extension field further including at least one start value of the first information and at least one end value of the first information.

10. The method according to claim 8 or 9, characterized in that, The first message, and / or the second message is an Internet Key Exchange message including a traffic selector payload.

11. The method according to claim 9 or 10, characterized in that, The traffic selector type field includes: a traffic selector Internet Protocol version 6 (IPv6) address range and an extended traffic selector IPv6 address range, or a traffic selector IPv4 address range and an extended traffic selector IPv4 address range.

12. A communications device, characterized by The method includes: A unit for implementing the method of any one of claims 1 to 6; Or A unit for implementing the method of any one of claims 7 to 11.

13. A communications device, characterized by The apparatus includes a processor coupled with a memory, the memory storing instructions that, when executed by the processor, cause the processor to perform the method of any one of claims 1 to 6, or cause the processor to perform the method of any one of claims 7 to 11.

14. A communications device, characterized by The apparatus includes a logic circuit for coupling with an input / output interface through which data is transmitted, to perform the method of any one of claims 1 to 6, or to perform the method of any one of claims 7 to 11.

15. A computer-readable storage medium, characterized in that, The computer-readable storage medium is used to store a computer program that, when executed on a computer, causes the computer to perform the method of any one of claims 1 to 6, or causes the computer to perform the method of any one of claims 7 to 11.

16. A computer program product, characterised in that, The computer program product includes computer program code that, when executed, implements the method of any one of claims 1 to 6, or implements the method of any one of claims 7 to 11.

Images