A business interaction method, apparatus, business system, electronic device, and medium

Abstract

This application provides a business interaction method, apparatus, business system, electronic device, and medium for enabling business interaction between multiple branch devices. The method is applied to the branch devices; each branch device has established an IPSec tunnel with a headquarters device. The method includes: acquiring a first business message to be sent; determining the target branch device receiving the first business message based on its destination address, and acquiring key information of the target branch device; encapsulating the first business message using the key information to obtain a target business message; and sending the target business message to the target branch device through the headquarters device. In this process, branch devices do not need to establish IPSec tunnels, and business interaction can be achieved even without knowing each other's public IP addresses. Furthermore, business interaction between branch devices does not require multiple negotiations, saving memory and resources for the branch devices and improving device performance.

Description

Technical Field

[0001] This application relates to the field of communication technology, and more specifically, to a service interaction method, apparatus, service system, electronic device, and medium. Background Technology

[0002] IPSec (Internet Protocol Security) protects the IP protocol suite by encrypting and authenticating IP protocol packets.

[0003] As enterprises increase their IT infrastructure, they are increasingly using VPN technology based on the IPSec protocol to network between their headquarters and branch offices. Each branch can establish an IPSec tunnel with the headquarters. In this network model, branches and headquarters can interact for business purposes at any time through these established IPSec tunnels. However, if there are also communication needs between branches, IPSec tunnels need to be established between each branch, which obviously consumes significant computer resources. Summary of the Invention

[0004] The purpose of this application is to provide a business interaction method, device, business system, electronic device and medium to achieve the technical effect of business interaction between branches.

[0005] A first aspect of this application provides a business interaction method, the method being used to enable business interaction between multiple branch devices; the method is applied to the branch devices; the multiple branch devices respectively establish an Internet Security Protocol (IPSec) tunnel with a headquarters device; the method includes:

[0006] Obtain the first service message to be sent;

[0007] Based on the destination address of the first service message, determine the target branch device that receives the first service message, and obtain the key information of the target branch device;

[0008] The first service message is encapsulated using the key information to obtain the target service message;

[0009] The target service message is sent from the headquarters equipment to the target branch equipment.

[0010] In the above implementation process, the branch devices of the branch where the service initiator is located can encapsulate the first service packet using the key information of the target branch device, ensuring that the encapsulated target service packet conforms to the format of IPSec tunnel transmission and reception packets. Finally, the target service packet is transmitted using the IPSec tunnel established between the headquarters device and the target branch device. This process eliminates the need for branch devices to establish IPSec tunnels, enabling service interaction even without knowing each other's public IP addresses. Furthermore, the service interaction between branch devices does not require multiple negotiations, saving memory and resources for the branch devices and improving device performance.

[0011] Furthermore, the process of establishing the IPSec tunnel includes the following steps:

[0012] Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface;

[0013] Establish an IPSec tunnel with the headquarters equipment;

[0014] The headquarters device sends registration information, which includes the public network address and configured interface address of the branch device, to the headquarters device to register using the registration information and the Security Association (SA) information generated for the branch device.

[0015] In the above implementation process, each branch device registers information with the headquarters device, enabling the headquarters device to map the public network address and interface address of each branch device to the SA information, so that the branch devices can query the headquarters device for key information of other branch devices in the future.

[0016] Furthermore, the method also includes:

[0017] Obtain the interface addresses configured for multiple branch devices, and use the obtained interface addresses to perform routing configuration;

[0018] The step of determining the target branch device receiving the first service message based on the destination address of the first service message, and obtaining key information of the target branch device, includes:

[0019] Perform a route lookup based on the destination address to determine the target interface address of the IPSec tunnel interface of the target branch device;

[0020] Obtain key information about the target branch device based on the target interface address.

[0021] In the above implementation process, after each device in the network completes the configuration of the IPSec tunnel interface address, the branch device uses the interface addresses configured by other branch devices for routing configuration. This allows the branch device to determine the next-hop address of the first service packet sent by a user device on the branch by looking up the route, thus identifying the target branch device receiving the first service packet. Based on the next-hop address, the branch device obtains key information about the target branch device to encapsulate the first service packet, enabling service interaction between branch devices without establishing an IPSec tunnel.

[0022] Furthermore, obtaining the key information of the target branch device based on the target interface address includes:

[0023] Query the key information of the target branch device locally based on the target interface address; or

[0024] Send a request message carrying the target interface address to the headquarters device; receive key information about the target branch device returned by the headquarters device based on the target interface address.

[0025] In the above implementation process, after each branch device registers information with the headquarters device and obtains the target interface address of the target branch device through routing lookup, the branch device can request key information of the target branch device from the headquarters device, or query key information previously obtained from the headquarters device and stored locally. This enables the branch device to encapsulate the first service message using the key information, thereby achieving service interaction between branch devices without establishing an IPSec tunnel.

[0026] Furthermore, the key information includes the target public network address and target SA information of the target branch device, wherein the target SA information is generated by the headquarters device for the target branch device;

[0027] The process of encapsulating the first service message using the key information to obtain the target service message includes:

[0028] The first service message is encrypted using the encryption information in the target SA information;

[0029] The target service message is obtained by encapsulating and encrypting the first service message using the target public IP address.

[0030] In the above implementation process, the first service message is encrypted by using the encryption information in the target SA information generated by the headquarters equipment for the target branch equipment, and the encrypted first service message is encapsulated by the target public network address, so that the branch equipment can use the identity of the headquarters equipment to realize business interaction with the target branch equipment, and there is no need to establish an IPSec tunnel between the branch equipment.

[0031] Furthermore, the method also includes:

[0032] Receive the second service message sent by the target branch device;

[0033] The second service message is decrypted using the decryption information in the target SA information.

[0034] In the above implementation process, for the second service message returned by the target branch device, the branch device can use the decryption information in the target SA information to decrypt it, thereby realizing the mutual transmission of service messages between branch devices and realizing service interaction.

[0035] Furthermore, the method also includes:

[0036] In response to the fulfillment of preset conditions, the key information is deleted.

[0037] In the above implementation process, key information is deleted from storage to avoid occupying too much memory resources.

[0038] A second aspect of this application provides a service interaction method, the method being used to enable service interaction between multiple branch devices; each of the multiple branch devices has established an IPSec tunnel with a headquarters device; the method is applied to the headquarters device, the method comprising:

[0039] In response to receiving a third service message sent by a branch device, the destination address of the third service message is obtained; the third service message is a message encapsulated by the branch device.

[0040] If the destination address points to the headquarters device, decapsulate the third service message;

[0041] If the destination address points to the target branch device, then the third service message is forwarded to the target branch device.

[0042] In the above implementation, multiple branch devices establish IPSec tunnels with the headquarters device. When branch devices need to exchange services, the branch device in the branch initiating the service encapsulates the service packet to obtain a third service packet, ensuring that the third service packet conforms to the format of IPSec tunnel message transmission and reception. The headquarters device performs different processing based on the device pointed to by the destination address of the third packet. When the destination address points to the target branch device, the headquarters device performs the function of packet forwarding, thus enabling service exchange between branch devices without establishing an IPSec tunnel.

[0043] Furthermore, the process of establishing the IPSec tunnel includes the following steps:

[0044] Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface;

[0045] For each of the multiple branch devices, SA information corresponding to the branch device is generated, and an IPSec tunnel is established with the branch device;

[0046] In response to receiving registration information sent by a branch device, registration is performed using the registration information and the SA information corresponding to the branch device; the registration information includes the public network address and configured interface address of the branch device.

[0047] In the above implementation process, when establishing an IPSec tunnel, the headquarters equipment registers the registration information sent by each branch equipment, thereby mapping and storing the public network address, interface address and SA information of each branch equipment, so that the headquarters equipment can provide the branch equipment with the function of querying key information of other branch equipment in the future.

[0048] Furthermore, the method also includes:

[0049] In response to receiving a request from a branch device, obtain the target interface address carried in the request;

[0050] Obtain key information of the target branch device indicated by the target interface address; the key information includes the target public network address and target SA information of the target branch device; the target SA information is generated by the headquarters device for the target branch device.

[0051] The key information is returned to the branch device.

[0052] In the above implementation process, the headquarters equipment provides the branch equipment with the function of querying key information of other branch equipment by looking up the pre-stored mapping relationship. This enables the branch equipment to encapsulate the first business message using the key information, thereby enabling business interaction between branch equipment without establishing an IPSec tunnel.

[0053] A third aspect of this application provides a business system, which includes a headquarters device and multiple branch devices that have established IPSec tunnels with the headquarters device.

[0054] The branch device is used to acquire the first service message to be sent; and

[0055] Based on the destination address of the first service message, determine the target branch device receiving the first service message, and obtain key information about the target branch device; and

[0056] The first service message is encapsulated using the key information to obtain the target service message; and

[0057] Send the target service message to the headquarters equipment;

[0058] The headquarters device is used to send the target service message to the target branch device according to the destination address of the target service message.

[0059] A fourth aspect of this application provides a business interaction device, which is used to enable business interaction between multiple branch devices; the device is applied to the branch devices; the multiple branch devices respectively establish an Internet Security Protocol (IPSec) tunnel with the headquarters device; the device includes:

[0060] The first message acquisition module is used to acquire the first service message to be sent.

[0061] The key information acquisition module is used to determine the target branch device receiving the first service message based on the destination address of the first service message, and to acquire key information of the target branch device.

[0062] An encapsulation module is used to encapsulate the first service message using the key information to obtain a target service message;

[0063] The sending module is used to send the target business message to the target branch device through the headquarters device.

[0064] A fifth aspect of this application provides a service interaction device, which is used to enable service interaction between multiple branch devices; each of the multiple branch devices has established an IPSec tunnel with a headquarters device; the device is applied to the headquarters device, and the device includes:

[0065] The second message acquisition module is used to obtain the destination address of the third service message in response to receiving a third service message sent by the branch device; the third service message is a message encapsulated by the branch device.

[0066] The decapsulation module is used to decapsulate the third service message if the destination address points to the headquarters device.

[0067] The forwarding module is used to forward the third service message to the target branch device if the destination address points to the target branch device.

[0068] A sixth aspect of this application provides an electronic device, the electronic device comprising:

[0069] processor;

[0070] Memory used to store processor-executable instructions;

[0071] Wherein, when the processor invokes the executable instructions, it implements the operation of either the first aspect or the second aspect of the method.

[0072] A seventh aspect of this application provides a computer-readable storage medium having computer instructions stored thereon, which, when executed by a processor, implement the steps of the method described in either the first or second aspect. Attached Figure Description

[0073] To more clearly illustrate the technical solutions of the embodiments of this application, the accompanying drawings used in the embodiments of this application will be briefly introduced below. It should be understood that the following drawings only show some embodiments of this application and should not be regarded as a limitation of the scope. For those skilled in the art, other related drawings can be obtained based on these drawings without creative effort.

[0074] Figure 1 A schematic diagram of a business system provided in an embodiment of this application;

[0075] Figure 2 A flowchart illustrating a business interaction method provided in an embodiment of this application;

[0076] Figure 3 A flowchart illustrating another business interaction method provided in an embodiment of this application;

[0077] Figure 4 A flowchart illustrating another business interaction method provided in an embodiment of this application;

[0078] Figure 5 A flowchart illustrating another business interaction method provided in an embodiment of this application;

[0079] Figure 6 A flowchart illustrating another business interaction method provided in an embodiment of this application;

[0080] Figure 7 A flowchart illustrating another business interaction method provided in an embodiment of this application;

[0081] Figure 8 A flowchart illustrating another business interaction method provided in an embodiment of this application;

[0082] Figure 9 A flowchart illustrating another business interaction method provided in an embodiment of this application;

[0083] Figure 10 A structural block diagram of a business interaction device provided in an embodiment of this application;

[0084] Figure 11 A structural block diagram of another business interaction device provided in the embodiments of this application;

[0085] Figure 12 This is a hardware structure diagram of an electronic device provided in an embodiment of this application. Detailed Implementation

[0086] The technical solutions in the embodiments of this application will now be described with reference to the accompanying drawings.

[0087] It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. Furthermore, in the description of this application, terms such as "first," "second," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0088] As enterprises increase their IT infrastructure, they often use VPN technology based on the IPSec protocol to network between headquarters and branch offices in various locations. Each branch office can establish an IPSec tunnel with headquarters. In this network model, branches and headquarters can interact for business purposes at any time through the established IPSec tunnels. However, if there are also interaction needs between branches, it is necessary to establish IPSec tunnels between each branch.

[0089] Establishing an IPSec tunnel between two points requires knowing the IP address of the other end. For example, if both ends are connected to the public network, the public IP address of the other end is needed to establish an IPSec tunnel. However, for individual branches, firstly, since the branches do not know each other's public IP addresses, establishing an IPSec tunnel is difficult. Secondly, establishing an IPSec tunnel requires manual tunnel configuration, increasing the complexity of configuration. Thirdly, establishing an IPSec tunnel requires multiple negotiations between branch devices. When there are many branches, if each branch establishes an IPSec tunnel with each other separately, it will consume a significant amount of memory and computing resources from the branch devices.

[0090] As can be seen, although branches can interact through IPSec tunnels, this method suffers from drawbacks such as difficulty in establishing tunnels and high resource consumption. Therefore, this application provides a service interaction method that enables service interaction between branches without the need to establish IPSec tunnels.

[0091] like Figure 1 As shown, business system 100 represents an application scenario for a business interaction method provided in this application. Business system 100 includes a headquarters device 110 and multiple branch devices. Branch devices refer to gateway devices on branches, and headquarters devices refer to gateway devices at the headquarters. For example, gateway devices include, but are not limited to, network intermediate devices with gateway functions such as routers. In addition to branch devices, each branch also includes one or more user devices. User devices can access the Internet and interact with user devices at the headquarters or other branches through branch devices. Similarly, in addition to headquarters devices, the headquarters also includes one or more user devices. User devices can access the Internet and interact with user devices on branches through the headquarters device.

[0092] See Figure 1 The business system 100 includes branch devices 121 and 122. Branch devices 121 and 122 each establish IPSec tunnels with the headquarters device 110. The process of establishing the IPSec tunnels is described below.

[0093] Branch device 121 is communicatively connected to user device 131 on that branch. User device 131 can access the Internet and interact with user device 133 at headquarters and / or user device 132 on other branches through branch device 121.

[0094] Branch device 122 is communicatively connected to user device 132 on the branch. User device 132 can access the Internet and interact with user device 133 at headquarters and / or user device 131 on other branches through branch device 122.

[0095] The headquarters equipment 110 is communicatively connected to the user equipment 133 at the headquarters. The user equipment 133 can access the Internet and interact with user equipment 131 and / or user equipment 132 at the branch through the headquarters equipment 110.

[0096] Figure 1 The diagram shows two branch devices, each corresponding to a user device, as an exemplary example. Of course, the business system 100 may include two or more branch devices, and each branch device may also correspond to one or more user devices. Figure 1 The examples shown do not impose a limit on the number of branch devices and user devices.

[0097] The first aspect of this application provides a business interaction method, which is applied to, for example... Figure 1 Any of the branch devices shown, for example, applied to branch device 121 or branch device 122. Figure 2 A flowchart illustrating a business interaction method provided in the first aspect is shown, including the following steps:

[0098] Step 210: Obtain the first service message to be sent;

[0099] Step 220: Based on the destination address of the first service message, determine the target branch device receiving the first service message, and obtain the key information of the target branch device;

[0100] Step 230: Encapsulate the first service message using the key information to obtain the target service message;

[0101] Step 240: Send the target service message to the target branch device through the headquarters device.

[0102] The above method is described using branch device 121 as an example. Of course, branch device 122 can also be used as the execution subject of the above method, and this application does not impose any restrictions here.

[0103] Branch device 121 acquires the first service message to be sent. The first service message may be sent to branch device 121 by user equipment on the branch where branch device 121 is located, such as user equipment 131. User equipment 131 sends service messages to other user equipment through branch device 121.

[0104] The first service message carries a destination address. The destination address refers to the IP address of the device receiving the first service message. For example, if the first service message is sent from user equipment 131 to user equipment 132, then the destination address of the first service message is the IP address of user equipment 132. Typically, all user equipment on a branch can form a private network, such as... Figure 1 The user equipment 132 shown is located on a private network, and its IP address is the private network IP 192.168.3.0. Therefore, by way of example, the destination address carried by the first message can be the private network IP address.

[0105] Branch device 121 can determine the target branch device and obtain key information of the target branch device based on the target address of the first service message.

[0106] The target branch device receiving the first service message refers to the device that, after receiving the first service message, forwards it to the device indicated by the destination address. In other words, the target branch device is a network intermediate device that the first service message passes through during transmission. Determining the target branch device based on the destination address of the first message can be: determining the target branch where the device indicated by the destination address of the first service message is located, and identifying the branch device of that target branch as the target branch device. Alternatively, it can be: determining the branch device corresponding to the device indicated by the destination address of the first service message as the target branch device.

[0107] In the example above, the destination address of the first service message is the private IP address of user equipment 132. Based on the destination address of the first service message, it can be determined that the target branch device receiving the first service message is branch device 122. The first service message is forwarded to user equipment 132 through branch device 122.

[0108] After identifying the target branch device, key information about it can be obtained. This key information is then used to encapsulate the first service packet, resulting in the target service packet. The encapsulated target service packet conforms to the format of IPSec tunnel transmission and reception packets. Thus, the key information includes all the information required for packet encapsulation.

[0109] Finally, the target service message is sent from the headquarters device to the target branch device. The headquarters device acts as a message forwarder; upon receiving the target service message from the branch device, it forwards it to the target branch device. For example, the headquarters device uses an IPSec tunnel established with the target branch device to send the target service message to the target branch device.

[0110] After receiving the target service message, the target branch device can decapsulate the target service message to obtain the first service message. Then, it sends the first service message to the device indicated by the destination address of the first service message. In the example above, branch device 122 can send the first service message to user equipment 132 according to the destination address of the decapsulated first service message.

[0111] As can be seen, the business interaction method provided in this application allows branch devices to encapsulate a first business message using key information from the target branch device when business interaction is required. This encapsulates the target business message to conform to the format of IPSec tunnel transmission and reception. Finally, the target business message is transmitted using the IPSec tunnel established between the headquarters device and the target branch device. This process eliminates the need for branch devices to establish an IPSec tunnel, enabling business interaction even without knowing each other's public IP addresses. Furthermore, the business interaction between branch devices does not require multiple negotiations, saving memory and resources and improving device performance.

[0112] Regarding the establishment of IPSec tunnels, some embodiments include, for example... Figure 3 The steps shown are as follows:

[0113] Step 310: Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface;

[0114] Step 320: Establish an IPSec tunnel with the headquarters equipment.

[0115] For example, steps 310-320 above can be performed before business interactions occur between branch devices.

[0116] When each branch device establishes an IPSec tunnel with the headquarters device, the first step is to plan the IPSec tunnel interfaces (i.e., IPSec virtual tunnel interfaces) of all devices in the network as a whole. Specifically, each branch device creates an IPSec tunnel interface with the headquarters device, and then configures the interface address of each IPSec tunnel interface. The interface address is the IP address, which is unique within the same network. For example, the interface address can be a fixed logical private network IP address.

[0117] like Figure 1 As shown, the IPSec tunnel interface address of the headquarters device 110 is 1.1.1.1; the IPSec tunnel interface address of the branch device 121 is 1.1.1.2; and the IPSec tunnel interface address of the branch device 122 is 1.1.1.3.

[0118] After configuring the interface addresses, each branch device can establish an IPSec tunnel with the headquarters device. The negotiation and authentication processes involved in establishing the IPSec tunnel between the branch device and the headquarters device can be found in relevant technologies, and will not be elaborated here.

[0119] After an IPSec tunnel is established, all packets arriving at the IPSec tunnel interface will be protected by IPSec, that is, they will be encrypted and forwarded based on the IPSec protocol.

[0120] In some embodiments, Figure 3 Based on the illustrated embodiment, this application provides a business interaction method that further includes the steps of: obtaining the interface addresses configured for multiple branch devices and using the obtained interface addresses for routing configuration.

[0121] This step can be performed when the branch device establishes an IPSec tunnel with the headquarters device, or it can be performed before step 220.

[0122] After each branch device and the headquarters device has completed the interface address configuration, the configured interface addresses of all devices in the network can be aggregated and distributed to all devices in the network, so that all devices in the network can know the interface addresses of other devices in the network. Subsequently, branch devices can use the obtained interface addresses of other branch devices for routing configuration. Specifically, the obtained interface address can be configured as the next-hop address. That is, in the routing configuration, the configured next-hop address is the interface address of the branch device.

[0123] Thus, the determination of the target branch device and the acquisition of key information in step 220 above may include, for example: Figure 4 The steps shown are as follows:

[0124] Step 221: Perform a route lookup based on the destination address to determine the target interface address of the IPSec tunnel interface of the target branch device;

[0125] Step 222: Obtain the key information of the target branch device based on the target interface address.

[0126] During routing configuration, the next-hop address corresponding to each destination address is recorded. Therefore, after obtaining the first service packet, a route lookup can be performed based on the destination address of the first service packet to find the next-hop address corresponding to that destination address. The obtained next-hop address is the target interface address of the IPSec tunnel interface of the target branch device. The branch device indicated by this next-hop address is the target branch device. Finally, key information about the target branch device can be obtained using the target interface address.

[0127] by Figure 1 As an example, after obtaining the interface address 1.1.1.3 configured by the branch device 122, the branch device 121 can configure the next hop of the private network IP address 192.168.3.0 of the user device 132 to be the interface address 1.1.1.3 of the branch device 122.

[0128] Thus, upon receiving the first service packet with a destination address of 192.168.3.0, a route lookup is performed based on the destination address of the first service packet, determining that the next-hop address of the first service packet is 1.1.1.3. This address is the interface address of the IPSec tunnel interface of branch device 122. Therefore, branch device 122 can be identified as the target branch device, and interface address 1.1.1.3 is the target interface address. Finally, key information about the target branch device 122 can be obtained based on the target interface address 1.1.1.3.

[0129] As can be seen in this embodiment, after each device in the network completes the configuration of the IPSec tunnel interface address, the branch device uses the interface addresses configured by other branch devices to perform routing configuration. This allows the branch device to determine the next-hop address of the first service packet sent by a user device on the branch by looking up the route, thereby identifying the target branch device receiving the first service packet. Based on the next-hop address, the branch device obtains key information about the target branch device to encapsulate the first service packet, enabling service interaction between branch devices without establishing an IPSec tunnel.

[0130] Regarding the establishment of IPSec tunnels, in some embodiments, in Figure 3 Based on the illustrated embodiment, the process of establishing an IPSec tunnel further includes the following steps:

[0131] The headquarters device sends registration information, which includes the public network address and configured interface address of the branch device, to the headquarters device to register using the registration information and the Security Association (SA) information generated for the branch device.

[0132] When establishing an IPSec tunnel, IPSec peers (i.e., two devices running the IPSec protocol) establish a Security Association (SA). An SA is an agreement between IPSec peers regarding certain elements that describe how the peers will use security services (such as encryption) for secure communication, specifically determining how messages will be processed. These elements include the security protocols used by the peers, the characteristics of the data streams to be protected, the data encapsulation mode, the encryption and authentication algorithms used by the protocol, the keys used for secure data transformation and transmission, and the SA's lifespan.

[0133] In this context, an SA (Self-Connection) is a unidirectional logical connection, typically established in pairs: an inbound SA and an outbound SA. The inbound SA processes received data packets, while the outbound SA processes data packets to be sent. Therefore, each party in the peer establishes a separate SA pair.

[0134] by Figure 1 Taking branch device 122 and headquarters device 110 as IPSec peers as an example, when establishing an IPSec tunnel, headquarters device 110 establishes an SA1 pair with branch device 122, including Inbound SA_X and Outbound SA_Y. Correspondingly, branch device 122 establishes an SA2 pair with headquarters device 110, including Inbound SA_Y and Outbound SA_X. Generally, when headquarters device 110 sends a data packet to branch device 122 through the IPSec tunnel, the data packet to be sent is processed using Outbound SA_Y. When branch device 122 receives a data packet sent by headquarters device 110, it processes it using Inbound SA_Y. Conversely, when branch device 122 sends a data packet to headquarters device 110 through the IPSec tunnel, the data packet to be sent is processed using Outbound SA_X. When headquarters device 110 receives a data packet sent by branch device 122, it processes it using Inbound SA_X.

[0135] As described above, the headquarters device establishes IPSec tunnels with multiple branch devices. Thus, the headquarters device establishes an SA (Service Provider) with each branch device and generates SA information for each branch device separately. Therefore, the headquarters device stores multiple SA information sets, each SA set being specific to a different branch device and generated by the headquarters device.

[0136] In this embodiment, when establishing an IPSec tunnel, each branch device also sends registration information to the headquarters device. This registration information includes the branch device's public IP address and configured interface address. The public IP address is the public network IP address. Figure 1 The public IP address of the central headquarters device 110 is 10.0.0.1; the public IP address of the branch device 121 is 20.0.0.1; and the public IP address of the branch device 122 is 30.0.0.1.

[0137] When the headquarters device receives registration information from a branch device, it registers itself using the received registration information and the SA (Service Provider) information generated for that branch device. Registration, for example, might involve storing the mapping relationship between registration information and SA information; that is, storing the mapping relationship between the branch device's interface address, public IP address, and SA information. Thus, when multiple branch devices register with the headquarters device, the headquarters device can ultimately obtain a mapping table containing multiple mapping relationships.

[0138] Continue with Figure 1For example, branch device 122 can send registration information to headquarters device 110, including public IP address 30.0.0.1 and interface address 1.1.1.3. Headquarters device 110 can use the registration information and SA1 information generated for branch device 122, namely the aforementioned SA1 information including Inbound SA_X and Outbound SA_Y, to register. For example, a mapping relationship between the registration information and SA1 information of branch device 122 is generated, resulting in a mapping relationship of "public IP address 30.0.0.1 - interface address 1.1.1.3 - SA1 information". Similarly, when branch device 121 registers information with headquarters device 110, headquarters device 110 can ultimately obtain a mapping relationship of "public IP address 20.0.0.1 - interface address 1.1.1.2 - SA3 information". Among them, SA3 information is SA information generated by headquarters device 110 for branch device 121.

[0139] In this embodiment, each branch device registers information with the headquarters device, enabling the headquarters device to map the public network address and interface address of each branch device to SA information, so that the branch devices can subsequently query the headquarters device for key information of other branch devices.

[0140] Based on the embodiments provided above, regarding the process of obtaining key information, in some embodiments, step 222, obtaining key information, may include:

[0141] Send a request message carrying the target interface address to the headquarters device; receive key information about the target branch device returned by the headquarters device based on the target interface address.

[0142] When a branch device needs to encapsulate a first service packet using key information from the target branch device, the branch device can send a request message to the headquarters device. The request message is used to request the headquarters device to return the key information from the target branch device. Since the branch device determined the target interface address of the IPSec tunnel interface of the target branch device in step 221, it can include the target interface address in the request message.

[0143] After receiving the request information carrying the target interface address, the headquarters device can query the mapping relationship based on the target interface address to obtain the key information corresponding to the target interface address. This key information includes the target public IP address and target SA information of the target branch device. It can be seen that the target public IP address is actually included in the registration information sent by the target branch device to the headquarters device during its registration process. The target SA information is generated by the headquarters device specifically for the target branch device. Finally, the headquarters device returns the target public IP address and target SA information of the target branch device, retrieved based on the target interface address, as key information to the branch device.

[0144] In this embodiment, after each branch device registers information with the headquarters device and obtains the target interface address of the target branch device through routing lookup, the branch device can request key information of the target branch device from the headquarters device. This enables the branch device to encapsulate the first service message using the key information, thereby achieving service interaction between branch devices without establishing an IPSec tunnel.

[0145] Considering that a single business interaction between branch devices may involve multiple transmissions and receptions of business messages, to avoid repeatedly requesting critical information from the headquarters device for the same target branch device, the branch device can store the critical information obtained from the headquarters device locally. Thus, regarding the process of obtaining critical information, in some embodiments, step 222, obtaining critical information, may include:

[0146] Based on the target interface address, query the key information of the target branch device locally.

[0147] Since a branch device may interact with multiple target branch devices simultaneously, when storing critical information, the branch device can store the mapping relationship between the interface addresses of other branch devices' IPSec tunnel interfaces and their critical information. Thus, when it is necessary to obtain the critical information of a target branch device, the target interface address of the target branch device's IPSec tunnel interface and the pre-stored mapping relationship can be used to query the target branch device's critical information.

[0148] Optionally, when it is necessary to obtain key information about a target branch device, the key information can first be queried locally based on the target interface address. If it is not found locally, the key information of the target branch device can then be requested from the headquarters device using the target interface address, and the mapping relationship between the target interface address and the obtained key information can be stored locally.

[0149] Continuing with the example above, when branch device 121 needs to obtain key information from target branch device 122, it can first query the target branch device 122 locally based on the target interface address 1.1.1.3. If the information is found, the key information is used to encapsulate the first business message. If the information is not found locally, branch device 121 sends a request message carrying the target interface address 1.1.1.3 to headquarters device 110.

[0150] Since the headquarters device 110 stores the mapping relationship of "public IP address 30.0.0.1 - interface address 1.1.1.3 - SA1 information", it can query the corresponding public IP address 30.0.0.1 and SA1 information based on the target interface address 1.1.1.3 in the request information. Subsequently, the headquarters device 110 can return the queried public IP address 30.0.0.1 and SA1 information as key information to the branch device 121.

[0151] After receiving the key information returned by the headquarters device 110, the branch device 121 can store the mapping relationship of "interface address 1.1.1.3 - key information". In this way, when the branch device 121 needs to use the key information of the target branch device 122 again, it can query the corresponding key information locally according to the target interface address 1.1.1.3.

[0152] In this embodiment, the branch device stores the key information obtained from the headquarters device locally, so that when the branch device needs to reuse the key information of the target branch device, it can directly obtain it from the local device, avoiding repeated requests for key information from the headquarters device and improving the encapsulation efficiency of the first business message.

[0153] In some embodiments, when there are many branch devices in the network, if a branch device persistently stores key information of other branch devices, it will consume a lot of memory resources. Therefore, a service interaction method based on any of the above embodiments further includes the step of: deleting the key information in response to meeting a preset condition.

[0154] The preset conditions can be set by those skilled in the art based on actual circumstances. For example, preset conditions may include, but are not limited to, one or more of the following: reaching the life cycle of key information, the remaining storage space of key information being less than a preset threshold, and ending the interaction between the branch device and the target branch device.

[0155] Regarding the encapsulation process of the first service message, in some embodiments, as described above, the key information includes the target public IP address and target SA information of the target branch device. The target SA information is generated by the headquarters device for the target branch device. Thus, the encapsulation process in step 230 includes, as follows: Figure 5 The steps shown are as follows:

[0156] Step 231: Encrypt the first service message using the encryption information in the target SA information;

[0157] Step 232: Encapsulate the encrypted first service message using the target public IP address to obtain the target service message.

[0158] As mentioned above, the SA information includes encryption and authentication algorithms and keys used in the peer-to-peer data transmission protocol. Therefore, after obtaining the key information including the target public network address and the target SA information, the branch device can first encrypt the first service message using the encryption information in the target SA information. Then, it can encapsulate the encrypted first service message using the target public network address to obtain the target service message. A new IP header can be generated using the target public network address, and the encrypted first service message and the new IP header together form the target service message.

[0159] As can be seen from the above encapsulation process, the branch device uses the encryption information in the target SA information generated by the headquarters device for the target branch device to encrypt the first service message. Therefore, when the target branch device receives the target service message forwarded by the headquarters device, it can use the decryption information in the SA information generated by the headquarters device to decrypt it.

[0160] In the example above, branch device 121 uses the encrypted information (i.e., Outbound SA_Y) in the SA1 information generated by headquarters device 110 for target branch device 122 to encrypt the first service message. Then, target branch device 122 can use the decrypted information (i.e., Inbound SA_Y) in the SA2 information it generated for headquarters device to decrypt the message.

[0161] From the perspective of the target branch device, when it receives a service message, regardless of whether the message was generated by the headquarters device or another branch device, the target branch device uses the same method to decapsulate and decrypt the message. In fact, when a branch device sends its first service message to the target branch device, it can be considered that the branch device is using the headquarters device's identity, or "pretending" to be the headquarters device, to achieve business interaction with the target branch device. Therefore, when encrypting the first service message, the branch device uses the SA information generated by the headquarters device specifically for the target branch device.

[0162] In the example above, branch device 121 uses the identity of headquarters device 110 to "pretend" to be headquarters device 110 and interact with branch device 122. Since headquarters device 110 uses the encryption information in SA1 information to encrypt the business message when sending it to branch device 122, when branch device 121 uses the identity of headquarters device 110 to "pretend" to be headquarters device 110 and sends the first business message to branch device 122, it also uses the encryption information in SA1 information to encrypt the first business message.

[0163] As can be seen, in this embodiment, the first service message is encrypted by using the encryption information in the target SA information generated by the headquarters device for the target branch device, and the encrypted first service message is encapsulated by the target public network address, so that the branch device can use the identity of the headquarters device to realize the service interaction with the target branch device, and there is no need to establish an IPSec tunnel between the branch devices.

[0164] In some embodiments, after a branch device sends a target service message to a target branch device, it may receive a second service message returned by the target branch device. Thus, a service interaction method based on any of the above embodiments further includes, for example... Figure 6 The steps shown are as follows:

[0165] Step 610: Receive the second service message sent by the target branch device;

[0166] Step 620: Decrypt the second service message using the decryption information in the target SA information.

[0167] When the target branch device responds with a second service message in response to the target service message, it encrypts the second service message using the encryption information in the SA information generated by the target branch device in response to the headquarters device. In this way, the branch device can correspondingly use the decryption information in the target SA information, i.e., the SA information generated by the headquarters device in response to the target branch device, to decrypt the second service message.

[0168] In the example above, when the target branch device 122 sends a second service message in response to the target service message, it will encrypt the second service message using the encryption information (i.e., Outbound SA_X) in the SA2 information generated by the target branch device 122 for the headquarters device 110. Accordingly, the branch device 121 can use the decryption information (i.e., Inbound SA_X) in the SA1 information to decrypt the encrypted second service message.

[0169] In this embodiment, for the second service message returned by the target branch device, the branch device can use the decryption information in the target SA information to decrypt it, thereby realizing the mutual transmission of service messages between branch devices and realizing service interaction.

[0170] The second aspect of this application provides a business interaction method, which is applied to, for example... Figure 1 The headquarters device 110 is shown. This method is used to enable business interaction between multiple branch devices. Multiple branch devices, such as branch device 121 and branch device 122, have established IPSec tunnels with the headquarters device 110.

[0171] Figure 7A flowchart illustrating a business interaction method provided in the second aspect is shown, including the following steps:

[0172] Step 710: In response to receiving a third service message sent by a branch device, obtain the destination address of the third service message;

[0173] The third service message is the message encapsulated by the branch device;

[0174] Step 721: If the destination address points to the headquarters device, decapsulate the third service message;

[0175] Step 722: If the destination address points to the target branch device, then forward the third service message to the target branch device.

[0176] When the headquarters equipment receives a third service message sent by a branch equipment, it needs to distinguish whether the third service message is a service message exchanged between the headquarters equipment and the branch equipment, or a service message exchanged between the branch equipment and other branch equipment.

[0177] Headquarters equipment can distinguish third-party service packets based on their destination address. Since third-party service packets are encapsulated packets from branch devices, they conform to the format of IPSec tunnel transmission and reception packets. Therefore, the destination address of a third-party service packet can be the encapsulated destination address, i.e., the public IP address in the new IP header.

[0178] If the destination address points to the headquarters device, for example, if the destination address is the public IP address of the headquarters device, it means that the third service message is a service message exchanged between the headquarters device and the branch device. In this case, the headquarters device can decapsulate the third service message.

[0179] If the destination address points to another branch device, for example, if the destination address is the public IP address of another branch device, it indicates that the third service message is a service message exchanged between branch devices. In this case, the third service message is also the target service message obtained by the branch device encapsulating the first service message as described in the previous embodiment. The other branch device pointed to by the destination address of the third service message is also the target branch device described in the previous embodiment. In this case, the headquarters device acts as a message forwarder, forwarding the third service message to the target branch device pointed to by the destination address. For example, the headquarters device uses the IPSec tunnel established with the target branch device to send the target service message to the target branch device.

[0180] As can be seen, the business interaction method provided in this application establishes an IPSec tunnel between multiple branch devices and the headquarters device. When business interaction is required between branch devices, the branch device of the branch initiating the business encapsulates the business packet to obtain a third business packet, ensuring that the third business packet conforms to the format of IPSec tunnel message transmission and reception. The headquarters device performs different processing based on the device pointed to by the destination address of the third packet. When the destination address points to the target branch device, the headquarters device performs the function of packet forwarding, thereby enabling business interaction between branch devices without establishing an IPSec tunnel.

[0181] Regarding the establishment of IPSec tunnels, some embodiments include, for example... Figure 8 The steps shown are as follows:

[0182] Step 810: Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface;

[0183] Step 820: For each of the multiple branch devices, generate SA information corresponding to the branch device and establish an IPSec tunnel with the branch device;

[0184] Step 830: In response to receiving registration information sent by the branch device, register using the registration information and the SA information corresponding to the branch device.

[0185] The registration information includes the public network address and configured interface address of the branch device.

[0186] For example, steps 810-830 described above can be performed before business interactions occur between branch devices.

[0187] When each branch device establishes an IPSec tunnel with the headquarters device, the first step is to plan the IPSec tunnel interfaces of all devices in the network as a whole. Specifically, each branch device creates an IPSec tunnel interface with the headquarters device, and then configures the interface address of each IPSec tunnel interface.

[0188] Subsequently, since the headquarters device establishes corresponding IPSec tunnels with each of the multiple branch devices, for each branch device, the headquarters device generates SA information corresponding to that branch device, i.e., the SA information generated by the headquarters device for that branch device as mentioned above, and establishes an IPSec tunnel with each branch device. The negotiation, authentication, and other processes performed when establishing the IPSec tunnel between the branch device and the headquarters device can be referred to relevant technologies, and will not be elaborated here.

[0189] After an IPSec tunnel is established, all packets arriving at the IPSec tunnel interface will be protected by IPSec, that is, they will be encrypted and forwarded based on the IPSec protocol.

[0190] Subsequently, upon receiving registration information from a branch device, the headquarters device registers itself using the received registration information and the SA (Service Provider) information generated for that branch device. The registration information includes the branch device's public IP address and configured interface address. Registration, for example, can involve storing the mapping relationship between registration information and SA information; that is, storing the mapping relationship between the branch device's interface address, public IP address, and SA information. Thus, when multiple branch devices register with the headquarters device, the headquarters device ultimately obtains a mapping table containing multiple mapping relationships.

[0191] In this embodiment, when establishing an IPSec tunnel, the headquarters device registers the registration information sent by each branch device, thereby mapping and storing the public network address, interface address and SA information of each branch device, so that the headquarters device can provide the branch devices with the function of querying key information of other branch devices in the future.

[0192] In some embodiments, Figure 8 Based on the illustrated embodiments, the above method further includes, as shown in the example below. Figure 9 The steps shown are as follows:

[0193] Step 910: In response to receiving a request message from a branch device, obtain the target interface address carried in the request message;

[0194] Step 920: Obtain key information about the target branch device indicated by the target interface address;

[0195] The key information includes the target public network address and target SA information of the target branch device; the target SA information is generated by the headquarters device for the target branch device.

[0196] Step 930: Return the key information to the branch device.

[0197] For example, steps 910-930 above can be performed after the establishment of the IPSec tunnel between the headquarters equipment and the branch equipment is completed.

[0198] When a branch device needs to encapsulate a first service message using key information from the target branch device, it sends a request message to the headquarters device. This request message requests the headquarters device to return the key information from the target branch device. The request message includes the target interface address of the target branch device.

[0199] In step 830, the headquarters device registered information and stored a mapping relationship between the interface addresses, public IP addresses, and SA information of multiple branch devices. Therefore, after receiving a request from a branch device, the headquarters device can match the target interface address obtained from the request with the pre-stored mapping relationship to obtain key information corresponding to the target interface address. This key information includes the target public IP address and target SA information of the target branch device. Finally, the headquarters device returns the matched key information to the branch device.

[0200] In this embodiment, the headquarters device provides branch devices with the function of querying key information of other branch devices by looking up pre-stored mapping relationships. This enables branch devices to encapsulate the first service message using the key information, thereby enabling service interaction between branch devices without establishing an IPSec tunnel.

[0201] A third aspect of this application provides a business system including a headquarters device and multiple branch devices, each having established an IPSec tunnel with the headquarters device. As one embodiment, it can be as follows: Figure 1 The business system 100 shown.

[0202] The branch device is used to acquire the first service message to be sent; and

[0203] Based on the destination address of the first service message, determine the target branch device receiving the first service message, and obtain key information about the target branch device; and

[0204] The first service message is encapsulated using the key information to obtain the target service message; and

[0205] Send the target service message to the headquarters equipment;

[0206] The headquarters device is used to send the target service message to the target branch device according to the destination address of the target service message.

[0207] In some embodiments, the branching device is further configured to:

[0208] Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface; and

[0209] Establish an IPSec tunnel with the headquarters equipment; and

[0210] The headquarters device sends registration information, which includes the public network address and configured interface address of the branch device, to the headquarters device to register using the registration information and the Security Association (SA) information generated for the branch device.

[0211] In some embodiments, the branching device is further configured to:

[0212] Obtain the interface addresses configured for multiple branch devices, and use the obtained interface addresses to perform routing configuration;

[0213] Perform a route lookup based on the destination address to determine the target interface address of the IPSec tunnel interface of the target branch device;

[0214] Obtain key information about the target branch device based on the target interface address.

[0215] In some embodiments, the branching device is specifically used for:

[0216] Query the key information of the target branch device locally based on the target interface address; or

[0217] Send a request message carrying the target interface address to the headquarters device; receive key information about the target branch device returned by the headquarters device based on the target interface address.

[0218] In some embodiments, the key information includes the target public IP address and target SA information of the target branch device, wherein the target SA information is generated by the headquarters device for the target branch device; the branch device is specifically used for:

[0219] The first service message is encrypted using the encryption information in the target SA information;

[0220] The target service message is obtained by encapsulating and encrypting the first service message using the target public IP address.

[0221] In some embodiments, the branching device is further configured to:

[0222] Receive the second service message sent by the target branch device;

[0223] The second service message is decrypted using the decryption information in the target SA information.

[0224] In some embodiments, the branching device is further configured to:

[0225] In response to the fulfillment of preset conditions, the key information is deleted.

[0226] In some embodiments, the headquarters equipment is also used for:

[0227] Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface; and

[0228] For each of the multiple branch devices, generate SA information corresponding to the branch device, and establish an IPSec tunnel with the branch device; and

[0229] In response to receiving registration information sent by a branch device, registration is performed using the registration information and the SA information corresponding to the branch device; the registration information includes the public network address and configured interface address of the branch device.

[0230] In some embodiments, the headquarters equipment is also used for:

[0231] In response to receiving a request from a branch device, the target interface address carried in the request is obtained; and

[0232] Obtain key information about the target branch device indicated by the target interface address; the key information includes the target public network address and target SA information of the target branch device; the target SA information is generated by the headquarters device for the target branch device; and

[0233] The key information is returned to the branch device.

[0234] The specific implementation process of the functions and roles of each device in the above system can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0235] The fourth aspect of this application provides a business interaction device for enabling business interaction between multiple branch devices; the device is applied to the branch devices; each of the multiple branch devices establishes an IPSec tunnel with the headquarters device. Figure 10 As shown, a business interaction device 1000 includes:

[0236] The first message acquisition module 1010 is used to acquire the first service message to be sent.

[0237] The key information acquisition module 1020 is used to determine the target branch device receiving the first service message based on the destination address of the first service message, and to acquire the key information of the target branch device.

[0238] The encapsulation module 1030 is used to encapsulate the first service message using the key information to obtain the target service message;

[0239] The sending module 1040 is used to send the target service message to the target branch device through the headquarters device.

[0240] In some embodiments, a business interaction device 1000 further includes a tunnel establishment module, used for:

[0241] Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface;

[0242] Establish an IPSec tunnel with the headquarters equipment;

[0243] The headquarters device sends registration information, which includes the public network address and configured interface address of the branch device, to the headquarters device to register using the registration information and the Security Association (SA) information generated for the branch device.

[0244] In some embodiments, a service interaction device 1000 further includes a routing configuration module, used for:

[0245] Obtain the interface addresses configured for multiple branch devices, and use the obtained interface addresses to perform routing configuration;

[0246] The key information acquisition module 1020 is specifically used for:

[0247] Perform a route lookup based on the destination address to determine the target interface address of the IPSec tunnel interface of the target branch device;

[0248] Obtain key information about the target branch device based on the target interface address.

[0249] In some embodiments, the key information acquisition module 1020 is specifically used for:

[0250] Query the key information of the target branch device locally based on the target interface address; or

[0251] Send a request message carrying the target interface address to the headquarters device; receive key information about the target branch device returned by the headquarters device based on the target interface address.

[0252] In some embodiments, the key information includes the target public network address and target SA information of the target branch device, wherein the target SA information is generated by the headquarters device for the target branch device; the encapsulation module 1030 is specifically used for:

[0253] The first service message is encrypted using the encryption information in the target SA information;

[0254] The target service message is obtained by encapsulating and encrypting the first service message using the target public IP address.

[0255] In some embodiments, a business interaction device 1000 further includes a receiving module, configured to:

[0256] Receive the second service message sent by the target branch device;

[0257] The second service message is decrypted using the decryption information in the target SA information.

[0258] In some embodiments, a business interaction device 1000 further includes a deletion module, configured to:

[0259] In response to the fulfillment of preset conditions, the key information is deleted.

[0260] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0261] The fifth aspect of this application provides a service interaction device for enabling service interaction between multiple branch devices; each of the branch devices establishes an IPSec tunnel with a headquarters device; the device is applied to the headquarters device. Figure 11 As shown, a business interaction device 1100 includes:

[0262] The second message acquisition module 1110 is used to acquire the destination address of the third service message in response to receiving a third service message sent by the branch device; the third service message is a message encapsulated by the branch device.

[0263] The decapsulation module 1120 is used to decapsulate the third service message if the destination address points to the headquarters device.

[0264] The forwarding module 1130 is used to forward the third service message to the target branch device if the destination address points to the target branch device.

[0265] In some embodiments, a business interaction device 1100 further includes an establishment module, configured to:

[0266] Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface;

[0267] For each of the multiple branch devices, SA information corresponding to the branch device is generated, and an IPSec tunnel is established with the branch device;

[0268] In response to receiving registration information sent by a branch device, registration is performed using the registration information and the SA information corresponding to the branch device; the registration information includes the public network address and configured interface address of the branch device.

[0269] In some embodiments, a business interaction device 1100 further includes a query module, used for:

[0270] In response to receiving a request from a branch device, obtain the target interface address carried in the request;

[0271] Obtain key information of the target branch device indicated by the target interface address; the key information includes the target public network address and target SA information of the target branch device; the target SA information is generated by the headquarters device for the target branch device.

[0272] The key information is returned to the branch device.

[0273] The specific implementation process of the functions and roles of each module in the above device can be found in the implementation process of the corresponding steps in the above method, and will not be repeated here.

[0274] Based on the business interaction method described in any of the embodiments of the first and second aspects above, the sixth aspect of this application also provides, as follows: Figure 12 The diagram shows the structure of an electronic device. Figure 12 At the hardware level, the electronic device includes a processor, an internal bus, a network interface, memory, and non-volatile memory, and may also include other hardware required for the services. The processor reads the corresponding computer program from the non-volatile memory into memory and then runs it to implement a service interaction method as described in any embodiment of the first aspect above, and / or a service interaction method as described in any embodiment of the second aspect above.

[0275] In some embodiments, an electronic device may be a branching device, such as... Figure 1 The branch device 121 or branch device 122 shown. The processor in the branch device reads the corresponding computer program from non-volatile memory into memory and then runs it to implement the business interaction method described in any embodiment of the first aspect above.

[0276] In some embodiments, an electronic device may be a headquarters device, such as... Figure 1 The headquarters equipment 110 shown. The processor in the headquarters equipment reads the corresponding computer program from non-volatile memory into memory and then runs it to implement a business interaction method described in any embodiment of the second aspect above.

[0277] The seventh aspect of this application also provides a computer storage medium storing a computer program, which, when executed by a processor, can be used to perform a business interaction method described in any embodiment of the first aspect above, and / or a business interaction method described in any embodiment of the second aspect above.

[0278] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can also be implemented in other ways. The apparatus embodiments described above are merely illustrative. For example, the flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of apparatus, methods, and computer program products according to various embodiments of this application. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions marked in the blocks may occur in a different order than those marked in the drawings. For example, two consecutive blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram and / or flowchart, and combinations of blocks in block diagrams and / or flowcharts, can be implemented using a dedicated hardware-based system that performs the specified function or action, or using a combination of dedicated hardware and computer instructions.

[0279] In addition, the functional modules in the various embodiments of this application can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

[0280] If the aforementioned functions are implemented as software functional modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0281] The above description is merely an embodiment of this application and is not intended to limit the scope of protection of this application. Various modifications and variations can be made to this application by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of this application should be included within the scope of protection of this application. It should be noted that similar reference numerals and letters in the following figures indicate similar items; therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures.

[0282] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

[0283] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

Claims

1. A business interaction method, characterized in that, The method is used to enable business interaction between multiple branch devices; The method is applied to the branch equipment; The branch devices have established IPSec tunnels with the headquarters devices respectively; the method includes: Obtain the first service message to be sent; Based on the destination address of the first service message, the target branch device receiving the first service message is determined, and key information of the target branch device is obtained; wherein, the key information includes the target public network address and target SA information of the target branch device, the target SA information is generated by the headquarters device for the target branch device, and the target SA information includes encryption information and decryption information; The first service message is encrypted using the encryption information in the target SA information, and the encrypted first service message is encapsulated using the target public network address to obtain the target service message; The target service message is sent to the headquarters device, so that the headquarters device forwards the target service message to the target branch device, and the target branch device decrypts the target service message using the decryption information in the SA information generated by the target branch device for the headquarters device.

2. The method according to claim 1, characterized in that, The process of establishing the IPSec tunnel includes the following steps: Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface; Establish an IPSec tunnel with the headquarters equipment; The headquarters device sends registration information, which includes the public network address and configured interface address of the branch device, to the headquarters device to register using the registration information and the Security Association (SA) information generated for the branch device.

3. The method according to claim 2, characterized in that, The method further includes: Obtain the interface addresses configured for multiple branch devices, and use the obtained interface addresses to perform routing configuration; The step of determining the target branch device receiving the first service message based on the destination address of the first service message, and obtaining key information of the target branch device, includes: Perform a route lookup based on the destination address to determine the target interface address of the IPSec tunnel interface of the target branch device; Obtain key information about the target branch device based on the target interface address.

4. The method according to claim 3, characterized in that, The step of obtaining key information about the target branch device based on the target interface address includes: Query the key information of the target branch device locally based on the target interface address; or Send a request message carrying the target interface address to the headquarters device; receive key information about the target branch device returned by the headquarters device based on the target interface address.

5. The method according to claim 1, characterized in that, The method further includes: Receive the second service message sent by the target branch device; The second service message is decrypted using the decryption information in the target SA information.

6. The method according to claim 1, characterized in that, The method further includes: In response to the fulfillment of preset conditions, the key information is deleted.

7. A business interaction method, characterized in that, The method is used to enable business interaction between multiple branch devices; each of the multiple branch devices has established an IPSec tunnel with the headquarters device. The method is applied to the headquarters equipment, and the method includes: In response to receiving a third service message sent by a branch device, the destination address of the third service message is obtained; the third service message is a message encapsulated by the branch device. If the destination address points to the headquarters device, decapsulate the third service message; If the destination address points to the target branch device, then the third service message is forwarded to the target branch device; Wherein, if the destination address points to the target branch device, the third service message is obtained by the branch device encrypting the first service message using the encryption information in the target SA information, and then encapsulating the encrypted first service message using the target public network address of the target branch device; the target SA information is generated by the headquarters device for the target branch device; after receiving the third service message, the target branch device decrypts the third service message using the decryption information in the SA information generated by the target branch device for the headquarters device.

8. The method according to claim 7, characterized in that, The process of establishing the IPSec tunnel includes the following steps: Create an IPSec tunnel interface and configure the interface address of the IPSec tunnel interface; For each of the multiple branch devices, SA information corresponding to the branch device is generated, and an IPSec tunnel is established with the branch device; In response to receiving registration information sent by a branch device, registration is performed using the registration information and the SA information corresponding to the branch device; the registration information includes the public network address and configured interface address of the branch device.

9. The method according to claim 8, characterized in that, The method further includes: In response to receiving a request from a branch device, obtain the target interface address carried in the request; Obtain key information of the target branch device indicated by the target interface address; the key information includes the target public network address and target SA information of the target branch device; the target SA information is generated by the headquarters device for the target branch device. The key information is returned to the branch device.

10. A business system, characterized in that, The business system includes headquarters equipment and multiple branch equipment, each having established an IPSec tunnel with the headquarters equipment. The branch device is used to acquire the first service message to be sent; as well as Based on the destination address of the first service message, the target branch device receiving the first service message is determined, and key information of the target branch device is obtained; wherein, the key information includes the target public network address and target SA information of the target branch device, the target SA information being generated by the headquarters device for the target branch device, and the target SA information including encryption information and decryption information; and The first service packet is encrypted using the encryption information in the target SA information, and the encrypted first service packet is encapsulated using the target public network address to obtain the target service packet; and Send the target service message to the headquarters equipment; The headquarters device is configured to send the target service message to the target branch device according to the destination address of the target service message, so that the target branch device can decrypt the target service message using the decryption information in the SA information generated by the target branch device in response to the headquarters device.

11. A business interaction device, characterized in that, The device is used to enable business interaction between multiple branch devices; The device is applied to the branch equipment; The branch devices have established IPSec tunnels with the headquarters devices respectively; the device includes: The first message acquisition module is used to acquire the first service message to be sent. The key information acquisition module is used to determine the target branch device receiving the first service message based on the destination address of the first service message, and to acquire key information of the target branch device; wherein, the key information includes the target public network address and target SA information of the target branch device, the target SA information is generated by the headquarters device for the target branch device, and the target SA information includes encryption information and decryption information; The encapsulation module is used to encrypt the first service message using the encryption information in the target SA information, and to encapsulate the encrypted first service message using the target public network address to obtain the target service message. The sending module is used to send the target service message to the headquarters device, so that the headquarters device forwards the target service message to the target branch device, and the target branch device decrypts the target service message using the decryption information in the SA information generated by the target branch device for the headquarters device.

12. A business interaction device, characterized in that, The device is used to enable business interaction between multiple branch devices; each of the multiple branch devices has established an IPSec tunnel with the headquarters device. The device is applied to the headquarters equipment, and the device includes: The second message acquisition module is used to obtain the destination address of the third service message in response to receiving a third service message sent by the branch device; the third service message is a message encapsulated by the branch device. The decapsulation module is used to decapsulate the third service message if the destination address points to the headquarters device. The forwarding module is used to forward the third service message to the target branch device if the destination address points to the target branch device; Wherein, if the destination address points to the target branch device, the third service message is obtained by the branch device encrypting the first service message using the encryption information in the target SA information, and then encapsulating the encrypted first service message using the target public network address of the target branch device; the target SA information is generated by the headquarters device for the target branch device; after receiving the third service message, the target branch device decrypts the third service message using the decryption information in the SA information generated by the target branch device for the headquarters device.

13. An electronic device, characterized in that, The electronic device includes: processor; Memory used to store processor-executable instructions; Wherein, when the processor invokes the executable instructions, it implements the operation of any one of the methods described in claims 1-6 or claims 7-9.

14. A computer-readable storage medium, characterized in that, It stores computer instructions that, when executed by a processor, implement the steps of the method as described in any one of claims 1-6 or 7-9.

Images