Anti-replay window setting method, device, storage medium and electronic device

Abstract

The present invention discloses a method, device, storage medium and electronic device for setting an anti-replay window. The method includes: receiving a target data packet; determining a target traffic throughput corresponding to the target data packet; obtaining a target window value from an analysis result table based on the target traffic throughput and a packet loss rate threshold, wherein the packet loss rate threshold is used to characterize the maximum packet loss rate corresponding to the first data packet discarded by the anti-replay window during verification of the target data packet, wherein the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window, and the anti-replay window is an IPsec VPN anti-replay window. The analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput; and setting a target anti-replay window based on the target window value. The present invention solves the technical problem in the prior art of high network failure rate caused by the inability of the anti-replay window to adapt to changes in communication traffic.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, storage medium and electronic device for setting an anti-replay window. Background Art

[0002] With the development of science and technology, the 5G era has arrived, and with it comes the interaction of massive data traffic between hosts on the Internet. However, the data traffic exposed in the network environment is always at risk of being intercepted, tampered with, and forged. IPsec VPN is a virtual private network technology that uses the IPsec (Internet Protocol Security) protocol. The IPsec protocol suite is a method of using cryptography to protect the security and confidentiality architecture of IP layer communications. The IPsec peer is an instance of the implementation of the IPsec protocol and is often deployed on security gateways in two locations. The communication traffic is encrypted and encapsulated by the IPsec peer, which protects the communication security between the hosts in the two intranets. The anti-replay function of the IPsec protocol can check and reject replay packets through the anti-replay window.

[0003] In the prior art, the anti-replay window size for IPsec VPN security devices is often configured as a configuration item by the device administrator. Once the configuration takes effect, the anti-replay window is fixed and does not change during the use of the IPsec VPN. However, the traffic volume between hosts in two locations is not constant. For example, communication between a company's two offices is more frequent during weekdays, so the traffic volume through the IPsec VPN tunnel between the two locations is relatively high. Conversely, the traffic volume through the IPsec VPN tunnel is relatively low during off-peak hours. According to the description of the anti-replay mechanism, if the configured anti-replay window is relatively small under high IPsec VPN traffic volume, a large span of ESP sequence number disorder will frequently cause ESP packets to be discarded. Severe packet loss can affect application data transmission or trigger retransmission of upper-layer application data, causing further network congestion and a high network failure rate. Conversely, if the configured anti-replay window is relatively large under low IPsec VPN traffic volume, the security device where the IPsec peer resides needs to maintain this larger anti-replay window, which incurs additional resources, such as sequence number storage space and computational overhead for sequence number lookup.

[0004] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0005] The embodiments of the present invention provide a method, device, storage medium and electronic device for setting an anti-replay window, so as to at least solve the technical problem in the prior art of high network failure rate caused by the inability of the anti-replay window to adapt to changes in communication traffic.

[0006] According to one aspect of an embodiment of the present invention, a method for setting an anti-replay window is provided, comprising: receiving a target data packet; determining a target traffic throughput corresponding to the target data packet, wherein the target traffic throughput is used to characterize the bandwidth value of a network channel for transmitting the target data packet; obtaining a target window value from an analysis result table based on the target traffic throughput and a packet loss rate threshold, wherein the packet loss rate threshold is used to characterize the maximum packet loss rate corresponding to the first data packet discarded by the anti-replay window during verification of the target data packet, the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window, the anti-replay window is an IPsec VPN anti-replay window, the analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput, the multiple traffic throughputs include at least the target traffic throughput, and the packet loss rate corresponding to the target window value is less than the packet loss rate threshold; setting a target anti-replay window based on the target window value, wherein the target anti-replay window is used to verify the target data packet.

[0007] Furthermore, before obtaining the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold, the anti-replay window setting method also includes: obtaining historical data information of multiple anti-replay windows in the target time period, wherein each anti-replay window corresponds to a window value, and the historical data information includes at least first information and second information, the first information is used to characterize the packet loss rate of the anti-replay window when checking multiple data packets, and the second information is used to characterize the traffic throughput corresponding to the data packets; performing data analysis on the historical data information to obtain analysis results, wherein the analysis results are used to characterize the correspondence between the window value of each anti-replay window, the packet loss rate of each anti-replay window, and the traffic throughput corresponding to the data packets; and generating an analysis result table based on the analysis results.

[0008] Furthermore, historical data information of multiple anti-replay windows in the target time period is obtained, including: detecting whether the first time is the target time, wherein the first time is the time when the target data packet is received, and the target time is the time for obtaining the historical data information; when the first time is the target time, historical data information of multiple anti-replay windows in the target time period is obtained, wherein the deadline of the target time period is the target time, and the duration of the target time period is the preset duration.

[0009] Furthermore, after setting the target anti-replay window based on the target window value, the method for setting the anti-replay window also includes: obtaining the first sequence number and the second sequence number corresponding to the target anti-replay window, wherein the first sequence number is greater than the second sequence number, and the difference between the first sequence number and the second sequence number is the target window value; calculating the difference between the sequence number of the target data packet and the first sequence number; detecting whether the difference is greater than the target window value; and setting a tolerance window when the difference is greater than the target window value, wherein the tolerance window is used to verify the second data packet, the sequence number of the second data packet is less than the first sequence number, and is within the sequence number range of the tolerance window.

[0010] Furthermore, when the difference is less than or equal to the target window value, the target data packet is checked.

[0011] Furthermore, when the difference is greater than the target window value, a tolerance window is set, including: obtaining a preset window value, wherein the preset window value is the window value of the tolerance window; determining the sequence number interval of the tolerance window based on the first sequence number and the preset window value; and setting the tolerance window based on the sequence number interval of the tolerance window.

[0012] According to another aspect of an embodiment of the present invention, a device for setting an anti-replay window is also provided, including: a receiving module for receiving a target data packet; a determining module for determining a target traffic throughput corresponding to the target data packet, wherein the target traffic throughput is used to characterize the bandwidth value of the network channel for transmitting the target data packet; an obtaining module for obtaining a target window value from an analysis result table based on the target traffic throughput and a packet loss rate threshold, wherein the packet loss rate threshold is used to characterize the maximum packet loss rate corresponding to the first data packet discarded by the anti-replay window during the verification of the target data packet, the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window, the anti-replay window is an IPsec VPN anti-replay window, the analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput, the multiple traffic throughputs include at least the target traffic throughput, and the packet loss rate corresponding to the target window value is less than the packet loss rate threshold; a setting module for setting a target anti-replay window based on the target window value, wherein the target anti-replay window is used to verify the target data packet.

[0013] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the above-mentioned method for setting an anti-replay window when running.

[0014] According to another aspect of an embodiment of the present invention, an electronic device is also provided, which includes one or more processors; a memory for storing one or more programs, which enables the one or more processors to run the programs when the one or more programs are executed by the one or more processors, wherein the program is set to execute the above-mentioned anti-replay window setting method during operation.

[0015] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program / instruction, which implements the above-mentioned method for setting the anti-replay window when the computer program / instruction is executed by a processor.

[0016] In an embodiment of the present invention, a target anti-replay window is set by obtaining a target window value from an analysis result table based on a target traffic throughput and a packet loss rate threshold. First, a target data packet is received; then a target traffic throughput corresponding to the target data packet is determined, wherein the target traffic throughput is used to represent the bandwidth value of the network channel for transmitting the target data packet; then, based on the target traffic throughput and the packet loss rate threshold, a target window value is obtained from the analysis result table, wherein the packet loss rate threshold is used to represent the maximum packet loss rate corresponding to the first data packet discarded during the anti-replay window verification process of the target data packet, wherein the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window, and the anti-replay window is an IPsec VPN anti-replay window. The analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput, wherein the multiple traffic throughputs include at least the target traffic throughput, and the packet loss rate corresponding to the target window value is less than the packet loss rate threshold; finally, a target anti-replay window is set based on the target window value, wherein the target anti-replay window is used to verify the target data packet.

[0017] In the above process, since the analysis result table stores the correspondence between the window value of each anti-replay window, the packet loss rate of each anti-replay window, and the traffic throughput, it is possible to obtain the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold to set the target anti-replay window, thereby achieving the effect of dynamically adjusting the window value of the anti-replay window and solving the problem of high network failure rate in the prior art due to the inability of the anti-replay window to adapt to changes in communication traffic.

[0018] It can be seen that through the technical solution of the present invention, the purpose of setting the target anti-replay window by obtaining the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold is achieved, thereby realizing the technical effect of dynamically adjusting the window value of the anti-replay window, and further solving the technical problem of high network failure rate caused by the inability of the anti-replay window to adapt to changes in communication traffic in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0020] Figure 1 is a flow chart of an optional method for setting an anti-replay window according to an embodiment of the present invention;

[0021] Figure 2 is a schematic diagram of an optional method for setting an anti-replay window according to an embodiment of the present invention;

[0022] Figure 3 is a schematic diagram of an optional device for setting an anti-replay window according to an embodiment of the present invention;

[0023] Figure 4 is a schematic diagram of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the embodiments described are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts should fall within the scope of protection of the present invention.

[0025] It should be noted that the terms "first", "second", etc. in the description and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] It should be noted that the relevant information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for display and analysis, etc.) involved in the present invention are all information and data authorized by the user or fully authorized by all parties. For example, an interface is set up between this system and the relevant user or organization. Before obtaining relevant information, it is necessary to send an acquisition request to the aforementioned user or organization through the interface, and obtain the relevant information after receiving the consent information fed back by the aforementioned user or organization.

[0027] Example 1

[0028] According to an embodiment of the present invention, an embodiment of the setting of an anti-replay window is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0029] Figure 1 FIG. 1 is a flow chart of an optional anti-replay window setting according to an embodiment of the present invention, as shown in FIG. Figure 1 As shown, the method includes the following steps:

[0030] Step S102: Receive a target data packet.

[0031] Step S104 : determining a target traffic throughput corresponding to the target data packet, wherein the target traffic throughput is used to represent a bandwidth value of a network channel for transmitting the target data packet.

[0032] Step S106: Obtain a target window value from the analysis result table based on the target traffic throughput and the packet loss rate threshold, wherein the packet loss rate threshold is used to characterize the maximum packet loss rate corresponding to the first data packet discarded by the anti-replay window during the verification of the target data packet. The sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window. The anti-replay window is an IPsec VPN anti-replay window. The analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput. The multiple traffic throughputs include at least the target traffic throughput, and the packet loss rate corresponding to the target window value is less than the packet loss rate threshold.

[0033] Step S108: setting a target anti-replay window based on the target window value, wherein the target anti-replay window is used to verify the target data packet.

[0034] Based on the scheme defined in steps S102 to S108 above, it can be seen that in an embodiment of the present invention, a target anti-replay window is set by obtaining a target window value from an analysis result table based on a target traffic throughput and a packet loss rate threshold. First, a target data packet is received; then a target traffic throughput corresponding to the target data packet is determined, where the target traffic throughput is used to represent the bandwidth value of the network channel for transmitting the target data packet; then, based on the target traffic throughput and the packet loss rate threshold, a target window value is obtained from the analysis result table, where the packet loss rate threshold is used to represent the maximum packet loss rate corresponding to the first data packet discarded during the anti-replay window verification process for the target data packet, where the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window, and the anti-replay window is an IPsec VPN anti-replay window. The analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput, where the multiple traffic throughputs include at least the target traffic throughput, and the packet loss rate corresponding to the target window value is less than the packet loss rate threshold; finally, a target anti-replay window is set based on the target window value, where the target anti-replay window is used to verify the target data packet.

[0035] It is easy to notice that in the above process, since the analysis result table stores the correspondence between the window value of each anti-replay window, the packet loss rate of each anti-replay window, and the traffic throughput, it is possible to obtain the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold to set the target anti-replay window, thereby achieving the effect of dynamically adjusting the window value of the anti-replay window, and solving the problem of high network failure rate in the prior art due to the inability of the anti-replay window to adapt to changes in communication traffic.

[0036] It can be seen that through the technical solution of the present invention, the purpose of setting the target anti-replay window by obtaining the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold is achieved, thereby realizing the technical effect of dynamically adjusting the window value of the anti-replay window, and further solving the technical problem of high network failure rate caused by the inability of the anti-replay window to adapt to changes in communication traffic in the prior art.

[0037] In step S102, the target data packet may be received based on a system, a server, an electronic device, or the like. In this embodiment, the target data packet may be received based on a system.

[0038] Optionally, the target data packet is an ESP (Encapsulation Security Payload) data packet, where ESP is a data encapsulation protocol in the IPsec system.

[0039] In step S104, the system determines the target traffic throughput corresponding to the target data packet based on the size of the target data packet, i.e., the bandwidth of the network channel transmitting the target data packet. For example, when the target data packet size is 1500MB, the target traffic throughput corresponding to the target data packet is determined to be 2Gbps; when the target data packet size is 3GB, the target traffic throughput corresponding to the target data packet is determined to be 4Gbps. The network channel may be an IPsec VPN tunnel.

[0040] In steps S106-S108, the system obtains the target window value from the analysis result table based on the target traffic throughput and the packet loss rate threshold, and sets the target anti-replay window based on the target window value. The packet loss rate threshold is the tolerance threshold for the first data packet discarded during the verification of the target data packet by the anti-replay window pre-set by the user, where the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window. For example, the tolerance threshold for the first data packet discarded during the verification of the target data packet by user A is 4‰, and the tolerance threshold for the first data packet discarded during the verification of the target data packet by user B is 6‰. The analysis result table is a pre-generated data table, as shown in Table 1.

[0041] Table 1

[0042]

[0043] Optionally, as can be seen from Table 1, when the packet loss rate threshold pre-set by the user is 4‰ and the traffic throughput corresponding to the target data packet is 8Gbps, the packet loss rate of the anti-replay window with a window value of 32 bits is 15‰ under the traffic throughput of 8Gbps, the packet loss rate of the anti-replay window with a window value of 64 bits is 10‰ under the traffic throughput of 8Gbps, and the packet loss rate of the anti-replay window with a window value of 128 bits is 4‰ under the traffic throughput of 8Gbps. Since the packet loss rates of the anti-replay windows with window values ​​of 32 bits and 64 bits are greater than the packet loss rate threshold of 4‰, the window value of 128 bits is determined as the target window value.

[0044] It should be noted that based on the target traffic throughput and packet loss rate threshold, the target window value is obtained from the analysis result table to set the target anti-replay window, thereby achieving the effect of dynamically adjusting the window value of the anti-replay window, and solving the problem of high network failure rate in the existing technology due to the inability of the anti-replay window to adapt to changes in communication traffic.

[0045] Optionally, in this embodiment, when the packet loss rates of the anti-replay windows corresponding to multiple window values ​​are all less than the packet loss rate threshold at the target traffic throughput, the smallest window value is selected as the target window value. As can be seen from Table 1, when the packet loss rate threshold preset by the user is 4‰ and the traffic throughput corresponding to the target data packet is 2Gbps, the packet loss rate of the anti-replay window with a window value of 32 bits is 2‰ at the 2Gbps traffic throughput, the packet loss rate of the anti-replay window with a window value of 64 bits is 1‰ at the 2Gbps traffic throughput, and the packet loss rate of the anti-replay window with a window value of 128 bits is 1‰ at the 2Gbps traffic throughput. Among them, the packet loss rates of the anti-replay windows with window values ​​of 32 bits, 64 bits, and 128 bits are all less than the packet loss rate threshold of 4‰. At this time, the 32-bit window value is determined as the target window value.

[0046] It should be noted that when the packet loss rates of the anti-replay windows corresponding to multiple window values ​​are all less than the packet loss rate threshold under the target traffic throughput, the smallest window value is selected as the target window value. This can solve the problem of wasting resources due to the need to spend a lot of resources to maintain the anti-replay window due to the configuration of a larger window value for a smaller traffic throughput, thereby improving resource utilization.

[0047] Furthermore, before obtaining the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold, the system obtains historical data information of multiple anti-replay windows in the target time period, wherein each anti-replay window corresponds to a window value, and the historical data information includes at least first information and second information, the first information is used to characterize the packet loss rate of the anti-replay window when checking multiple data packets, and the second information is used to characterize the traffic throughput corresponding to the data packets; data analysis is performed on the historical data information to obtain analysis results, wherein the analysis results are used to characterize the correspondence between the window value of each anti-replay window, the packet loss rate of each anti-replay window, and the traffic throughput corresponding to the data packets; and an analysis result table is generated based on the analysis results.

[0048] Furthermore, the system obtains historical data information of multiple anti-replay windows in the target time period, including: detecting whether the first time is the target time, wherein the first time is the time when the target data packet is received, and the target time is the time for obtaining the historical data information; when the first time is the target time, obtaining historical data information of multiple anti-replay windows in the target time period, wherein the deadline of the target time period is the target time, and the duration of the target time period is the preset duration.

[0049] Optionally, in this embodiment, the target time is a user-preset time for acquiring historical data information for multiple anti-replay windows. For example, the user sets the acquisition of historical data information to begin at 1-hour intervals between 1:00 AM and 12:00 PM daily. When the current time (i.e., the first time) is the target time, the system begins acquiring historical data information for multiple anti-replay windows in the target time period. For example, when the current time is 3:00 AM, the system acquires historical data information from 2:00 AM to 3:00 AM. The system then performs data analysis on the historical data information, obtains analysis results, and generates an analysis result table based on the analysis results.

[0050] Optionally, historical data information can be analyzed through stand-alone device evaluation and analysis, or it can be uploaded to the cloud for big data analysis based on information provided by devices of the same model in the same network environment.

[0051] It should be noted that by periodically obtaining historical data information of multiple anti-replay windows and performing data analysis on the historical data information of multiple anti-replay windows to obtain an analysis result table, the data in the analysis result table can be made more consistent with the current system operation status, thereby improving the accuracy of determining the analysis result table and thereby improving the accuracy of the determined target window value.

[0052] In an optional embodiment, after setting the target anti-replay window based on the target window value, the system obtains the first sequence number and the second sequence number corresponding to the target anti-replay window, wherein the first sequence number is greater than the second sequence number, and the difference between the first sequence number and the second sequence number is the target window value; calculates the difference between the sequence number of the target data packet and the first sequence number; detects whether the difference is greater than the target window value; and sets a tolerance window when the difference is greater than the target window value, wherein the tolerance window is used to verify the second data packet, the sequence number of the second data packet is less than the first sequence number, and is within the sequence number range of the tolerance window.

[0053] Furthermore, when the difference is less than or equal to the target window value, the target data packet is checked.

[0054] Optionally, after setting the target anti-replay window based on the target window value, the system starts to verify the target data packet through the target anti-replay window. Figure 2 As shown, the system first obtains the first sequence number and the second sequence number of the target anti-replay window, wherein the first sequence number corresponds to the maximum sequence number M (i.e. Figure 2 The second sequence number corresponds to the minimum sequence number of the sequence number interval corresponding to the target anti-replay window (i.e. Figure 2The difference between the first and second sequence numbers is the target window value. Then the system calculates the sequence number N of the target data packet (i.e. Figure 2 The system determines whether to set a tolerance window by checking whether the difference between the first sequence number and the target window value is greater than the target window value. When the difference is greater than the target window value, the target anti-replay window slides from position 1 to position 2. At this time, the system determines that the sliding rate of the target anti-replay window is too fast and sets a tolerance window. The direction in which the target anti-replay window slides from position 1 to position 2 is the direction in which the sequence number increases. The tolerance window is used to verify the second data packet. The sequence number of the second data packet is less than the first sequence number and is within the sequence number range of the tolerance window.

[0055] Optionally, when the difference is less than or equal to the target window value, the system determines that the sliding rate of the target anti-replay window is normal, and the system verifies the target data packet through the target anti-replay window.

[0056] Furthermore, the system may obtain a preset window value, wherein the preset window value is a window value of the tolerance window; determine a sequence number interval of the tolerance window based on the first sequence number and the preset window value; and then set the tolerance window based on the sequence number interval of the tolerance window.

[0057] Optionally, in this embodiment, the preset window value is a window value of a tolerance window preset by the user, and the tolerance window is used to verify normal data packets that are discarded when the target anti-replay window slides too fast and are within the sequence number interval of the tolerance window, such as Figure 2 As shown, when the target anti-replay window slides from position 1 to position 2, if the difference between M and N is greater than the target window value, the system determines that the target anti-replay window is sliding over a large span due to burst traffic, that is, the sliding rate of the target anti-replay window is too fast. At this time, the sequence number interval of the tolerance window is determined based on the first sequence number M and the preset window value. For example, when the target window value is 32 bits and the preset window value is 8 bits, if N–M>=2 32 , then it is determined that the sliding rate of the target anti-replay window is too fast. At this time, the sequence number interval of the tolerance window is [M-2 8 , M]. Among them, the tolerance window does not support sliding, and the tolerance window is only valid when the sliding rate of the target anti-replay window is too fast.

[0058] It should be noted that by setting a tolerance window, normal data packets discarded when the target anti-replay window slides too fast can be checked, avoiding retransmission of the discarded normal data packets and reducing energy waste of related network equipment.

[0059] From the above content, it can be seen that the present invention provides a solution for adaptively adjusting the anti-replay window size. By performing data analysis on the packet loss rate of multiple anti-replay windows obtained at regular intervals when checking multiple data packets and the traffic throughput corresponding to the data packets, an analysis result table is obtained. The window value of the anti-replay window is obtained from the analysis result table based on the traffic throughput and packet loss rate thresholds, which can achieve the effect of dynamically adjusting the window value of the anti-replay window, and solves the problem of high network failure rate in the prior art caused by the inability of the anti-replay window to adapt to changes in communication traffic.

[0060] Example 2

[0061] Based on the first embodiment of the present invention, an embodiment of a device for setting an anti-replay window is also provided. When the device is running, the method for setting an anti-replay window of the above embodiment is executed. Figure 3 is a schematic diagram of an optional anti-replay window setting device according to an embodiment of the present invention, such as Figure 3 As shown, the device includes: a receiving module 301, a determining module 303, an acquiring module 305 and a setting module 307.

[0062] The receiving module 301 is configured to receive a target data packet.

[0063] Optionally, the target data packet may be received based on a system, a server, an electronic device, or the like. In this embodiment, the target data packet may be received based on a system.

[0064] Optionally, the target data packet is an ESP (Encapsulation Security Payload) data packet, where ESP is a data encapsulation protocol in the IPsec system.

[0065] The determination module 303 is configured to determine a target traffic throughput corresponding to the target data packet, wherein the target traffic throughput is used to represent a bandwidth value of a network channel for transmitting the target data packet.

[0066] Optionally, the system determines the target traffic throughput corresponding to the target data packet based on the size of the target data packet, i.e., the bandwidth of the network channel transmitting the target data packet. For example, when the target data packet size is 1500MB, the target traffic throughput corresponding to the target data packet is determined to be 2Gbps; when the target data packet size is 3GB, the target traffic throughput corresponding to the target data packet is determined to be 4Gbps. The network channel may be an IPsec VPN tunnel.

[0067] An acquisition module 305 is configured to obtain a target window value from an analysis result table based on a target traffic throughput and a packet loss rate threshold, wherein the packet loss rate threshold is used to represent a maximum packet loss rate corresponding to a first data packet being discarded by the anti-replay window during verification of a target data packet, the sequence number of the first data packet being less than the sequence number corresponding to the left boundary of the anti-replay window, and the anti-replay window being an IPsec VPN anti-replay window. The analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput, the multiple traffic throughputs including at least the target traffic throughput, and the packet loss rate corresponding to the target window value being less than the packet loss rate threshold.

[0068] The setting module 307 is configured to set a target anti-replay window based on the target window value, wherein the target anti-replay window is used to verify the target data packet.

[0069] Optionally, the system obtains the target window value from the analysis result table according to the target traffic throughput and the packet loss rate threshold, and sets the target anti-replay window based on the target window value. The packet loss rate threshold is the tolerance threshold of the first data packet discarded in the process of verifying the target data packet by the anti-replay window pre-set by the user, wherein the serial number of the first data packet is less than the serial number corresponding to the left boundary of the anti-replay window. For example, the tolerance threshold of the first data packet discarded in the process of verifying the target data packet by the anti-replay window set by user A is 4‰, and the tolerance threshold of the first data packet discarded in the process of verifying the target data packet by the anti-replay window set by user B is 6‰. The analysis result table is a pre-generated data table, as shown in Table 2.

[0070] Table 2

[0071]

[0072] Optionally, as can be seen from Table 1, when the packet loss rate threshold pre-set by the user is 4‰ and the traffic throughput corresponding to the target data packet is 8Gbps, the packet loss rate of the anti-replay window with a window value of 32 bits is 15‰ under the traffic throughput of 8Gbps, the packet loss rate of the anti-replay window with a window value of 64 bits is 10‰ under the traffic throughput of 8Gbps, and the packet loss rate of the anti-replay window with a window value of 128 bits is 4‰ under the traffic throughput of 8Gbps. Since the packet loss rates of the anti-replay windows with window values ​​of 32 bits and 64 bits are greater than the packet loss rate threshold of 4‰, the window value of 128 bits is determined as the target window value.

[0073] It should be noted that based on the target traffic throughput and packet loss rate threshold, the target window value is obtained from the analysis result table to set the target anti-replay window, thereby achieving the effect of dynamically adjusting the window value of the anti-replay window, and solving the problem of high network failure rate in the existing technology due to the inability of the anti-replay window to adapt to changes in communication traffic.

[0074] Optionally, in this embodiment, when the packet loss rates of the anti-replay windows corresponding to multiple window values ​​are all less than the packet loss rate threshold at the target traffic throughput, the smallest window value is selected as the target window value. As can be seen from Table 1, when the packet loss rate threshold preset by the user is 4‰ and the traffic throughput corresponding to the target data packet is 2Gbps, the packet loss rate of the anti-replay window with a window value of 32 bits is 2‰ at the 2Gbps traffic throughput, the packet loss rate of the anti-replay window with a window value of 64 bits is 1‰ at the 2Gbps traffic throughput, and the packet loss rate of the anti-replay window with a window value of 128 bits is 1‰ at the 2Gbps traffic throughput. Among them, the packet loss rates of the anti-replay windows with window values ​​of 32 bits, 64 bits, and 128 bits are all less than the packet loss rate threshold of 4‰. At this time, the 32-bit window value is determined as the target window value.

[0075] It should be noted that when the packet loss rates of the anti-replay windows corresponding to multiple window values ​​are all less than the packet loss rate threshold under the target traffic throughput, the smallest window value is selected as the target window value. This can solve the problem of wasting resources due to the need to spend a lot of resources to maintain the anti-replay window due to the configuration of a larger window value for a smaller traffic throughput, thereby improving resource utilization.

[0076] Optionally, the anti-replay window setting device further includes: a first acquisition module, a data analysis module, and a generation module. The first acquisition module is used to acquire historical data information of multiple anti-replay windows in a target time period, wherein each anti-replay window corresponds to a window value, and the historical data information includes at least first information and second information, the first information being used to characterize the packet loss rate of the anti-replay window when verifying multiple data packets, and the second information being used to characterize the traffic throughput corresponding to the data packets; the data analysis module is used to perform data analysis on the historical data information to obtain an analysis result, wherein the analysis result is used to characterize the correspondence between the window value of each anti-replay window, the packet loss rate of each anti-replay window, and the traffic throughput corresponding to the data packets; and the generation module is used to generate an analysis result table based on the analysis result.

[0077] Optionally, the first acquisition module includes: a detection unit and a first acquisition unit. The detection unit is configured to detect whether the first time is a target time, wherein the first time is the time when the target data packet is received, and the target time is the time for acquiring historical data information; the first acquisition unit is configured to acquire historical data information of multiple anti-replay windows in a target time period when the first time is the target time, wherein the end time of the target time period is the target time, and the duration of the target time period is a preset duration.

[0078] Optionally, in this embodiment, the target time is a user-preset time for acquiring historical data information for multiple anti-replay windows. For example, the user sets the acquisition of historical data information to begin at 1-hour intervals between 1:00 AM and 12:00 PM daily. When the current time (i.e., the first time) is the target time, the system begins acquiring historical data information for multiple anti-replay windows in the target time period. For example, when the current time is 3:00 AM, the system acquires historical data information from 2:00 AM to 3:00 AM. The system then performs data analysis on the historical data information, obtains analysis results, and generates an analysis result table based on the analysis results.

[0079] Optionally, historical data information can be analyzed through stand-alone device evaluation and analysis, or it can be uploaded to the cloud for big data analysis based on information provided by devices of the same model in the same network environment.

[0080] It should be noted that by periodically obtaining historical data information of multiple anti-replay windows and performing data analysis on the historical data information of multiple anti-replay windows to obtain an analysis result table, the data in the analysis result table can be made more consistent with the current system operation status, thereby improving the accuracy of determining the analysis result table and thereby improving the accuracy of the determined target window value.

[0081] Optionally, the anti-replay window setting device further includes: a second acquisition module, a calculation module, a detection module, and a first setting module. The second acquisition module is used to obtain the first sequence number and the second sequence number corresponding to the target anti-replay window after setting the target anti-replay window based on the target window value, wherein the first sequence number is greater than the second sequence number, and the difference between the first sequence number and the second sequence number is the target window value; the calculation module is used to calculate the difference between the sequence number of the target data packet and the first sequence number; the detection module is used to detect whether the difference is greater than the target window value; the first setting module is used to set a tolerance window when the difference is greater than the target window value, wherein the tolerance window is used to verify the second data packet, the sequence number of the second data packet is less than the first sequence number, and is within the sequence number range of the tolerance window.

[0082] Optionally, the anti-replay window setting device further includes: a second determination module, configured to verify the target data packet when the difference is less than or equal to the target window value.

[0083] Optionally, after setting the target anti-replay window based on the target window value, the system starts to verify the target data packet through the target anti-replay window. Figure 2 As shown, the system first obtains the first sequence number and the second sequence number of the target anti-replay window, wherein the first sequence number corresponds to the maximum sequence number M (i.e. Figure 2 The second sequence number corresponds to the minimum sequence number of the sequence number interval corresponding to the target anti-replay window (i.e. Figure 2 The difference between the first and second sequence numbers is the target window value. Then the system calculates the sequence number N of the target data packet (i.e. Figure 2 The difference between the N indicated by the rightmost Top position in the packet and the first sequence number is detected to determine whether a tolerance window needs to be set by checking whether the difference is greater than the target window value. When the difference is greater than the target window value, the target anti-replay window slides from position 1 to position 2. At this time, it is determined that the sliding rate of the target anti-replay window is too fast, and a tolerance window is set. The direction in which the target anti-replay window slides from position 1 to position 2 is the direction in which the sequence number increases. The tolerance window is used to verify the second data packet. The sequence number of the second data packet is less than the first sequence number and is within the sequence number range of the tolerance window.

[0084] Optionally, when the difference is less than or equal to the target window value, the system determines that the sliding rate of the target anti-replay window is normal, and the system verifies the target data packet through the target anti-replay window.

[0085] Optionally, the anti-replay window setting device further includes: a third acquisition module, a third determination module, and a second setting module. The third acquisition module is configured to acquire a preset window value, wherein the preset window value is a window value of the tolerance window; the third determination module is configured to determine a sequence number interval of the tolerance window based on the first sequence number and the preset window value; and the second setting module is configured to set the tolerance window based on the sequence number interval of the tolerance window.

[0086] Optionally, in this embodiment, the preset window value is a window value of a tolerance window preset by the user, and the tolerance window is used to verify normal data packets that are discarded when the target anti-replay window slides too fast and are within the sequence number interval of the tolerance window, such as Figure 2As shown, when the target anti-replay window slides from position 1 to position 2, if the difference between M and N is greater than the target window value, the system determines that the target anti-replay window is sliding over a large span due to burst traffic, that is, the sliding rate of the target anti-replay window is too fast. At this time, the sequence number interval of the tolerance window is determined based on the first sequence number M and the preset window value. For example, when the target window value is 32 bits and the preset window value is 8 bits, if N–M>=2 32 , then it is determined that the sliding rate of the target anti-replay window is too fast. At this time, the sequence number interval of the tolerance window is [M-2 8 , M]. Among them, the tolerance window does not support sliding, and the tolerance window is only valid when the sliding rate of the target anti-replay window is too fast.

[0087] It should be noted that by setting a tolerance window, normal data packets discarded when the target anti-replay window slides too fast can be checked, avoiding retransmission of the discarded normal data packets and reducing energy waste of related network equipment.

[0088] Based on the above-mentioned solution of the present invention, it can be known that in an embodiment of the present invention, a target anti-replay window is set by obtaining a target window value from an analysis result table based on a target traffic throughput and a packet loss rate threshold. First, a target data packet is received; then a target traffic throughput corresponding to the target data packet is determined, wherein the target traffic throughput is used to represent the bandwidth value of the network channel for transmitting the target data packet; then, based on the target traffic throughput and the packet loss rate threshold, a target window value is obtained from the analysis result table, wherein the packet loss rate threshold is used to represent the maximum packet loss rate corresponding to the first data packet discarded during the anti-replay window verification process of the target data packet, the sequence number of the first data packet is less than the sequence number corresponding to the left boundary of the anti-replay window, and the anti-replay window is an IPsec VPN anti-replay window. The analysis result table includes at least multiple traffic throughputs, multiple window values, and the packet loss rate corresponding to each window value at each traffic throughput, the multiple traffic throughputs including at least the target traffic throughput, and the packet loss rate corresponding to the target window value is less than the packet loss rate threshold; finally, a target anti-replay window is set based on the target window value, wherein the target anti-replay window is used to verify the target data packet.

[0089] It is easy to notice that in the above process, since the analysis result table stores the correspondence between the window value of each anti-replay window, the packet loss rate of each anti-replay window, and the traffic throughput, it is possible to obtain the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold to set the target anti-replay window, thereby achieving the effect of dynamically adjusting the window value of the anti-replay window, and solving the problem of high network failure rate in the prior art due to the inability of the anti-replay window to adapt to changes in communication traffic.

[0090] It can be seen that through the technical solution of the present invention, the purpose of setting the target anti-replay window by obtaining the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold is achieved, thereby realizing the technical effect of dynamically adjusting the window value of the anti-replay window, and further solving the technical problem of high network failure rate caused by the inability of the anti-replay window to adapt to changes in communication traffic in the prior art.

[0091] Example 3

[0092] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided, in which a computer program is stored. The computer program is configured to execute the above-mentioned method for setting an anti-replay window when running.

[0093] Example 4

[0094] According to another aspect of an embodiment of the present invention, an electronic device is provided, wherein: Figure 4 is a schematic diagram of an optional electronic device according to an embodiment of the present invention, such as Figure 4 As shown, the electronic device includes one or more processors; a memory for storing one or more programs, which, when the one or more programs are executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the above-mentioned anti-replay window setting method during operation.

[0095] Example 5

[0096] According to another aspect of an embodiment of the present invention, a computer program product is provided, including a computer program / instruction, which implements the above-mentioned method for setting the anti-replay window when the computer program / instruction is executed by a processor.

[0097] In the above embodiments of the present invention, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0098] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only exemplary. For example, the division of units can be a logical function division. In actual implementation, there may be other division methods, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0099] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple units. Some or all of the units may be selected to achieve the purpose of the present embodiment according to actual needs.

[0100] In addition, the functional units in the various embodiments of the present invention may be integrated into a single processing unit, each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0101] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes several instructions for enabling a computer device (which can be a personal computer, server or network device, etc.) to execute all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk, etc. Various media that can store program codes.

[0102] The above are only preferred embodiments of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for setting an anti-replay window, characterized in that: include: Receive target data packet; Determining a target traffic throughput corresponding to the target data packet, wherein the target traffic throughput is used to represent a bandwidth value of a network channel for transmitting the target data packet; Obtaining a target window value from an analysis result table based on the target traffic throughput and the packet loss rate threshold, wherein the packet loss rate threshold is used to characterize a maximum packet loss rate corresponding to a first data packet discarded by the anti-replay window during verification of the target data packet, the sequence number of the first data packet being less than the sequence number corresponding to the left boundary of the anti-replay window, the anti-replay window being an IPsec VPN anti-replay window, the analysis result table including at least a plurality of traffic throughputs, a plurality of window values, and a packet loss rate corresponding to each of the window values ​​at each of the traffic throughputs, the plurality of traffic throughputs including at least the target traffic throughput, and the packet loss rate corresponding to the target window value being less than the packet loss rate threshold; A target anti-replay window is set based on the target window value, wherein the target anti-replay window is used to verify the target data packet.

2. The method according to claim 1, characterized in that Before obtaining the target window value from the analysis result table based on the target traffic throughput and packet loss rate threshold, the method further includes: Obtaining historical data information of multiple anti-replay windows in a target time period, wherein each anti-replay window corresponds to a window value, and the historical data information includes at least first information and second information, the first information being used to characterize a packet loss rate of the anti-replay window when verifying multiple data packets, and the second information being used to characterize a traffic throughput corresponding to the data packets; Performing data analysis on the historical data information to obtain an analysis result, wherein the analysis result is used to characterize a correspondence between the window value of each anti-replay window, the packet loss rate of each anti-replay window, and the traffic throughput corresponding to the data packet; The analysis result table is generated based on the analysis result.

3. The method according to claim 2, characterized in that Obtain historical data information for multiple anti-replay windows in the target time period, including: Detecting whether the first time is a target time, wherein the first time is the time when the target data packet is received, and the target time is the time when the historical data information is obtained; When the first time is the target time, historical data information of the plurality of anti-replay windows in the target time period is obtained, wherein the end time of the target time period is the target time, and the duration of the target time period is a preset duration.

4. The method according to claim 1, wherein After setting the target anti-replay window based on the target window value, the method further includes: Obtaining a first sequence number and a second sequence number corresponding to the target anti-replay window, wherein the first sequence number is greater than the second sequence number, and a difference between the first sequence number and the second sequence number is the target window value; Calculating a difference between the sequence number of the target data packet and the first sequence number; Detecting whether the difference is greater than the target window value; When the difference is greater than the target window value, a tolerance window is set, wherein the tolerance window is used to verify the second data packet, the sequence number of the second data packet is less than the first sequence number and is within the sequence number range of the tolerance window.

5. The method according to claim 4, characterized in that The method further comprises: When the difference is less than or equal to the target window value, the target data packet is checked.

6. The method according to claim 4, characterized in that When the difference is greater than the target window value, setting a tolerance window includes: Obtaining a preset window value, wherein the preset window value is a window value of the tolerance window; Determining a sequence number interval of the tolerance window based on the first sequence number and the preset window value; The tolerance window is set based on a sequence number interval of the tolerance window.

7. A device for setting an anti-replay window, characterized in that: include: A receiving module, used for receiving a target data packet; a determination module, configured to determine a target traffic throughput corresponding to the target data packet, wherein the target traffic throughput is used to represent a bandwidth value of a network channel for transmitting the target data packet; an acquisition module, configured to acquire a target window value from an analysis result table based on the target traffic throughput and a packet loss rate threshold, wherein the packet loss rate threshold is used to characterize a maximum packet loss rate corresponding to a first data packet discarded by an anti-replay window during verification of the target data packet, the sequence number of the first data packet being less than the sequence number corresponding to the left boundary of the anti-replay window, the anti-replay window being an IPsec VPN anti-replay window, the analysis result table comprising at least a plurality of traffic throughputs, a plurality of window values, and a packet loss rate corresponding to each of the window values ​​at each of the traffic throughputs, the plurality of traffic throughputs including at least the target traffic throughput, and the packet loss rate corresponding to the target window value being less than the packet loss rate threshold; A setting module is used to set a target anti-replay window based on the target window value, wherein the target anti-replay window is used to verify the target data packet.

8. A computer-readable storage medium, characterized in that A computer program is stored in a computer-readable storage medium, wherein the computer program is configured to execute the method for setting the anti-replay window as claimed in any one of claims 1 to 6 when running.

9. An electronic device, characterized in that: The electronic device includes one or more processors; A memory for storing one or more programs, which, when executed by the one or more processors, enables the one or more processors to run the programs, wherein the programs are configured to execute the method for setting the anti-replay window described in any one of claims 1 to 6 when running.

10. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the method for setting the anti-replay window according to any one of claims 1 to 6 is implemented.

Images