Packet processing method, device and system

Abstract

The application provides a message processing method, device and system. The method comprises: a terminal device generates a first data message, the first data message comprises a first field and a second field, the first field and the second field are different, the first field carries first information, the second field carries second information, and the second field is used for indicating third information, the first information is used for indicating first identity information of the terminal device, the second information is used for indicating the first identity information, and the third information comprises information for encrypting, decrypting and security checking a payload of the first data message; and the terminal device sends the first data message to a first network device. The method can improve the communication security in the network and help save network resources.

Description

TECHNICAL FIELD

[0001] Embodiments of the present application relate to the technical field of network communication, and more particularly, to a message processing method, device and system. BACKGROUND

[0002] With the increasing number of internet of things (IoT) terminal devices, more and more hackers take IoT terminal devices as attack targets. Hackers use the vulnerabilities existing in various types of IoT terminal devices to implant malicious programs, control IoT terminal devices to launch distributed denial of service (DDoS) attacks, steal data information, or operate business interruption. The security problem of IoT terminal devices has become a major consideration factor for the wide deployment of IoT services. The security verification of IoT terminal devices is generally completed by the network device (for example, an access switch) of the access layer or the network device (for example, a convergence switch) of the convergence layer of the IoT terminal device. The device that verifies the security of the IoT terminal device is also called a security verification point. The security verification point can perform security verification on the data message sent by the IoT terminal device to determine whether the data message is truly from the IoT terminal device, that is, whether the data message is a fake message.

[0003] In the related art, the principle of security verification performed by the security verification point is as follows: the data message sent by the IoT terminal device carries the identifier (ID) of the IoT terminal device. After the security verification point receives the data message, the ID of the IoT terminal device is obtained from the data message, and the address information of the IoT terminal device is obtained according to the locally saved address mapping table and the ID of the IoT terminal device. Thereafter, the address information is compared with the address information encapsulated in the data message to determine whether it is a fake message. In this implementation, a large amount of address mapping table is stored in the security verification point, which consumes more network resources.

[0004] Therefore, there is an urgent need for a message processing method that can improve the communication security in the network and help save network resources. SUMMARY

[0005] The present application provides a message processing method, device and system. The method can improve the communication security in the network and help save network resources.

[0006] In a first aspect, a message processing method is provided. The method comprises: generating, by a terminal device, a first data message, the first data message comprising a first field and a second field, the first field and the second field being different, the first field carrying first information, the second field carrying second information, and the second field being used to indicate third information, the first information being used to indicate first identity information of the terminal device, the second information being used to indicate the first identity information, and the third information comprising information for encrypting, decrypting, and security checking a payload of the first data message; and sending, by the terminal device, the first data message to a first network device.

[0007] The first data message sent by the terminal device comprises the first field and the second field, the first information can be obtained according to the first field, and the second information can be obtained according to the second field, and the first information and the second information are both used to indicate the first identity information of the terminal device. That is, the first data message sent by the terminal device comprises source end information of the first data message (i.e., information of the terminal device). The third information comprises information for encrypting, decrypting, and security checking the payload of the first data message. Optionally, the third information can also comprise information for encrypting and decrypting part of a header of the first data message, the part of the header at least excluding the second field. The security checking comprises, but is not limited to, integrity checking and anti-replay checking.

[0008] In the technical solution, the first data message sent by the terminal device comprises the first field and the second field, the first information carried by the first field is used to indicate the first identity information of the terminal device, the second information carried by the second field is used to indicate the first identity information of the terminal device, and the second field is used to indicate the third information, and the third information comprises information for encrypting, decrypting, and security checking the payload of the first data message. In this way, the first network device can obtain the first information, the second information, and the third information according to the received first data message, determine whether the security checking of the first data message passes by using the third information, and determine that the first data message is a data message sent by the terminal device by comparing the first information and the second information, i.e., the first data message is a non-forged message. Thereafter, the first network device can perform subsequent forwarding processing on the first data message, and the method can improve the communication security in the network. The method also helps to save network resources, avoiding the need to store a large number of address mapping tables in the local of the first network device in the prior art.

[0009] In a possible design, the first identity information includes a first identity identifier and a first key identifier, the first identity identifier is used to uniquely identify the identity of the terminal device, and the first key is used for encryption, decryption and security verification on the payload of the first data packet.

[0010] Optionally, when the third information includes information for encryption and decryption on the partial header of the first data packet, the first key is also used for the information for encryption and decryption on the partial header of the first data packet.

[0011] Optionally, in another possible design, the first field is an Internet Protocol (IP) address field.

[0012] In the technical solution, the first identity information of the terminal device is carried in the IP address field, and the implementation is relatively simple. For example, but not limited to, part of the value of the IP address field is used to indicate the first identity information.

[0013] Optionally, in another possible design, the first field is a specific field in the header of the first data packet.

[0014] In the technical solution, the specific field in the header of the first data packet carries the first identity information of the terminal device, and the field carrying the first identity information can be more flexibly set.

[0015] Optionally, in another possible design, the specific field is an option field or an extension field.

[0016] When the specific field is the option field, the first data packet can be an IPv4 data packet. When the specific field is the extension field, the first data packet can be an IPv6 data packet. The type of the IPv6 extension field is not limited. For example, the option field can be any one of an option 43 field and an option 60 field.

[0017] Optionally, in another possible design, the second field is a security channel identifier (SCI) field in a security header (SecTAG) field, and the SCI field has a mapping relationship with the third information.

[0018] The SCI field has a mapping relationship with the third information, that is, the corresponding third information can be obtained through the SCI field (for example, but not limited to, the SCI field as an index).

[0019] Optionally, in another possible design, the first data packet includes a first data packet header, and the first data packet header includes the first field and the second field.

[0020] It should be noted that the first data message provided by the present application includes but is not limited to the various fields described in the first aspect above, and the information carried by the various fields includes but is not limited to the content described in the first aspect above. Optionally, the first data message can further include other fields specified in the network communication protocol. For example, the first data message can further include a third field, which is an integrity check value (ICV) field. The third field can be located at the tail of the first data message or in the security header SecTAG. Optionally, the first field can further carry fourth information, which is used to indicate second identity information, which is the identity information of the destination terminal device of the first data message.

[0021] In a second aspect, a message processing method is provided, and the method comprises the following steps: a first network device acquires a first data message, the first data message comprising a first field and a second field, the first field and the second field being different, the first field carrying first information, the second field carrying second information, and the second field being used to indicate third information, the first information being used to indicate first identity information of the terminal device, the second information being used to indicate the first identity information, and the third information comprising information for encrypting, decrypting and security checking a payload of the first data message; and the first network device determines, according to the first data message, that the first data message is a data message sent by a terminal device.

[0022] In the first data message received by the first network device, the first field can be used to acquire the first information, and the second field can be used to acquire the second information, and both the first information and the second information are used to indicate the first identity information of the terminal device. That is, the first data message received by the first network device includes source end information of the first data message (i.e., information of the terminal device). The security checking includes but is not limited to integrity checking and anti-replay checking. The third information comprises information for encrypting, decrypting and security checking the payload of the first data message. Optionally, the third information can further comprise information for encrypting and decrypting part of the header of the first data message, the part of the header at least excluding the second field. The security checking includes but is not limited to integrity checking and anti-replay checking. The first data message is a data message sent by the terminal device, i.e., the terminal device is the source end device of the first data message, and other devices do not illegally tamper with the information carried by the first data message.

[0023] In the technical solution, the first data message received by the first network device comprises a first field and a second field, the first information carried by the first field is used to indicate the first identity information of the terminal device, the second information carried by the second field is used to indicate the first identity information of the terminal device, and the second field is used to indicate third information, the third information comprising information for encrypting, decrypting and security checking the payload of the first data message. In this way, the first network device can acquire the first information, the second information and the third information according to the received first data message, and determine whether the security check of the first data message passes by using the third information, and determine that the first data message is a data message sent by the terminal device by comparing the first information and the second information, that is, the first data message is a non-forged message. Thereafter, the first network device can perform subsequent forwarding processing on the first data message, and the method can improve the communication security in the network. The method avoids the need to store a large number of address mapping tables in the local of the first network device in the prior art, and helps to save network resources. That is, the message processing method provided by the present application can improve the communication security in the network and help to save network resources.

[0024] Optionally, in a possible design, the first network device acquires the first data message, comprising: the first network device receives the first data message sent by the terminal device.

[0025] Optionally, in another possible design, the first network device acquires the first data message, comprising: the first network device receives a second data message sent by a second network device, the second network device being a forwarding device located between the first network device and the terminal device, the second data message comprising a second data message header and the first data message, the second data message header comprising tunnel information, the tunnel corresponding to the tunnel information being used to forward the second data message; and the first network device acquires the first data message from the second data message.

[0026] Optionally, the second data message can also comprise a second data message header and part of the first data message, for example, the part of the first data message can comprise at least a first field, a second field, a payload and a third field.

[0027] The tunnel information can include source node information of a tunnel corresponding to the tunnel information, destination node information of the tunnel corresponding to the tunnel information, and tunnel identification information used for uniquely identifying the tunnel. The tunnel includes, but is not limited to, a generic routing encapsulation (GRE) tunnel, a multi-protocol label switching (MPLS) tunnel, a point-to-point protocol over Ethernet (PPPoE) tunnel, or a layer 2 tunneling protocol (L2TP) tunnel.

[0028] Optionally, in another possible design, the first network device determines, according to the first data packet, that the first data packet is a data packet sent by the terminal device, including: the first network device processes the first data packet to obtain the first information, the second information, and the third information; the first network device performs security check on the first data packet according to the third information, and determines that the first data packet passes the security check; and the first network device determines that the first data packet is the data packet sent by the terminal device based on that the first information matches the second information.

[0029] Optionally, in another possible design, the second data packet header further includes the second field.

[0030] In the technical solution, the second field is set in the second data packet header, which is beneficial to improving the efficiency of packet processing.

[0031] Optionally, in another possible design, the first identity information includes a first identity identifier and a first key identifier, the first identity identifier is used for uniquely identifying the identity of the terminal device, and the first key identifier is used for uniquely identifying the first key, the first key being used for encrypting, decrypting, and performing security check on the payload of the first data packet.

[0032] Optionally, when the third information includes information of encrypting and decrypting part of the header of the first data packet, the first key is further used for encrypting and decrypting the information of the part of the header of the first data packet.

[0033] Optionally, in another possible design, the first field is an Internet Protocol (IP) address field.

[0034] In the technical solution, the first identity information of the terminal device is carried in the IP address field, and the implementation is simple. The first identity information of the terminal device is carried in the IP address field, for example, but not limited to, part of the value of the IP address field is used to indicate the first identity information.

[0035] Optionally, in another possible design, the first field is a specific field of the first data packet header.

[0036] In the technical solution, the first identity information of the terminal device is carried in the specific field of the first data packet header, and the field carrying the first identity information can be set more flexibly.

[0037] Optionally, in another possible design, the specific field is an option field.

[0038] Optionally, in another possible design, the second field is a security channel identifier SCI field in a security header SecTAG, and the SCI field has a mapping relationship with the third information.

[0039] The SCI field has a mapping relationship with the third information, that is, the corresponding third information can be found through the SCI field (for example, but not limited to, the SCI field as an index). The mapping relationship can be stored in a local table item of the first network device, so that the first network device can obtain the third information according to the SCI field and the table item after processing the first data packet.

[0040] Optionally, in another possible design, the first data packet includes a first data packet header, and the first data packet header includes the first field and the second field.

[0041] It should be noted that the first data packet or the second data packet provided by the present application includes but is not limited to the various fields described in the second aspect and the information carried by the various fields includes but is not limited to the content described in the second aspect. Optionally, the first data packet or the second data packet can also include other fields defined in the network communication protocol. For example, the first data packet can also include a third field, and the third field is an ICV field. The third field can be located at the tail of the first data packet or in the security header SecTAG. Optionally, the first field can also carry fourth information, and the fourth information is used to indicate second identity information, and the second identity information is the identity information of the destination terminal device of the first data packet.

[0042] In a third aspect, a terminal device is provided, comprising: a processing unit configured to generate a first data packet, the first data packet comprising a first field and a second field, the first field and the second field being different, the first field carrying first information, the second field carrying second information, and the second field being used to indicate third information, the first information being used to indicate first identity information of the terminal device, the second information being used to indicate the first identity information, and the third information comprising information for encrypting, decrypting and security checking a payload of the first data packet; and a transceiver configured to send the first data packet to a first network device.

[0043] Optionally, the third information further comprises information for encrypting and decrypting a part of a header of the first data packet, the part of the header not comprising at least the second field.

[0044] In a possible design of the first aspect, the first identity information comprises a first identity and a first key identifier, the first identity being used to uniquely identify an identity of the terminal device, and the first key identifier being used to uniquely identify a first key, the first key being used to encrypt, decrypt and security verify the payload of the first data packet.

[0045] Optionally, when the third information comprises information for encrypting and decrypting the part of the header of the first data packet, the first key is further used to encrypt and decrypt the part of the header of the first data packet.

[0046] Optionally, in another possible design of the first aspect, the first field is an Internet Protocol (IP) address field.

[0047] Optionally, in another possible design of the first aspect, the first field is a specific field of a header of the first data packet.

[0048] Optionally, in another possible design of the first aspect, the specific field is an option field or an extension field.

[0049] Optionally, in another possible design of the first aspect, the second field is a Security Header (SecTAG) field, and a Security Channel Identifier (SCI) field in the SecTAG field carries the second information.

[0050] Optionally, in another possible design of the first aspect, the second field is a Security Channel Identifier (SCI) field in a Security Header (SecTAG) field, and the SCI field has a mapping relationship with the third information.

[0051] Optionally, in another possible design of the first aspect, the first data packet comprises a first data packet header, and the first data packet header comprises the first field and the second field.

[0052] It should be noted that the first data message provided by the present application includes but is not limited to the fields described in the third aspect, and the information carried by the fields includes but is not limited to the information described in the third aspect. Optionally, the first data message can further include other fields defined in a network communication protocol. For example, the first data message can further include a third field, which is an ICV field. The third field can be located at the tail of the first data message or in a security header SecTAG. Optionally, the first field can further carry fourth information, which is used to indicate second identity information, and the second identity information is the identity information of a destination terminal device of the first data message. The content not described in detail in the third aspect can be referred to the related description of the first aspect. For the sake of brevity, the detailed description is not repeated here.

[0053] In a fourth aspect, a first network device is provided, which includes: a transceiver unit and a processing unit, configured to obtain a first data message, the first data message including a first field and a second field, the first field and the second field being different, the first field carrying first information, the second field carrying second information, and the second field being used to indicate third information, the first information being used to indicate first identity information of the terminal device, the second information being used to indicate the first identity information, and the third information including information for encrypting, decrypting and security checking a payload of the first data message; and the processing unit being configured to determine, according to the first data message, that the first data message is a data message sent by a terminal device.

[0054] Optionally, the third information can further include information for encrypting and decrypting a part of the header of the first data message, the part of the header at least excluding the second field.

[0055] In a possible design, the transceiver unit is further configured to receive the first data message sent by the terminal device.

[0056] Optionally, in another possible design, the transceiver unit is further configured to receive a second data message sent by a second network device, the second network device being a forwarding device located between the first network device and the terminal device, the second data message including a second data message header and the first data message, the second data message header including tunnel information, the tunnel corresponding to the tunnel information being used to forward the second data message; and the processing unit is further configured to obtain the first data message from the second data message.

[0057] Optionally, the second data message can also include the second data message header and a part of the first data message, for example, the part of the first data message at least including the first field, the second field, the payload and the third field.

[0058] Optionally, in another possible design, the processing unit is further configured to: process the first data packet to obtain the first information, the second information, and the third information; perform security check on the first data packet according to the third information, and determine that the first data packet passes the security check; and determine that the first data packet is a data packet sent by the terminal device based on the first information matching the second information.

[0059] Optionally, in another possible design, the second data packet header further includes the second field.

[0060] Optionally, in another possible design, the first identity information includes a first identity and a first key identifier, the first identity is used to uniquely identify the identity of the terminal device, and the first key identifier is used to uniquely identify a first key, the first key being used to encrypt, decode, and perform security verification on the payload of the first data packet.

[0061] Optionally, in another possible design, the first field is an Internet Protocol (IP) address field.

[0062] Optionally, in another possible design, the first field is a specific field of the first data packet header.

[0063] Optionally, in another possible design, the specific field is an option field or an extension field.

[0064] Optionally, in another possible design, the second field is a Security Channel Identifier (SCI) field in a Security Header (SecTAG) field, and the SCI field has a mapping relationship with the third information.

[0065] Optionally, in another possible design, the first data packet includes a first data packet header, and the first data packet header includes the first field and the second field.

[0066] It should be noted that the first data packet provided in this application includes but is not limited to various fields described in the fourth aspect, and the information carried by each field includes but is not limited to the content described in the fourth aspect. Optionally, the first data packet can further include other fields defined in a network communication protocol. For example, the first data packet can further include a third field, and the third field is an ICV field, which can be located at the tail of the first data packet or in a Security Header (SecTAG). Optionally, the first field can further carry fourth information, and the fourth information is used to indicate second identity information, and the second identity information is the identity information of a destination terminal device of the first data packet.

[0067] The above fourth aspect not described in detail can refer to the related description of the second aspect. For brevity, the detailed description is not repeated here.

[0068] In a fifth aspect, a packet processing method is provided. The method includes: a first network device receiving a second data packet sent by a second network device, the second data packet including a second data packet header and a first data packet, the second data packet header including tunnel information, a tunnel corresponding to the tunnel information being used to forward the second data packet, the first data packet including a first field and a second field, the first field and the second field being different, the first field carrying first information, the second field carrying second information, and the second field being used to indicate third information, the first information being used to indicate first identity information of a terminal device, the second information being used to indicate the first identity information, and the third information including information used to encrypt, decrypt, and perform security check on a payload of the first data packet; and the first network device processing the second data packet to determine that the first data packet is a data packet sent by the terminal device.

[0069] The first data packet is a data packet sent by a terminal device, that is, the terminal device is a source terminal device of the first data packet. A destination terminal device of the first data packet is the first network device. Optionally, the third information can further include information used to encrypt and decrypt a part of a header of the first data packet, the part of the header at least excluding the second field.

[0070] In a possible design, the first network device processes the second data packet to determine that the first data packet is a data packet sent by the terminal device, including: the first network device processes the second data packet to obtain the first information, the second information, and the third information; the first network device performs security check on the first data packet according to the third information, and determines that the second data packet passes the security check; and the first network device determines that the first data packet is a data packet sent by the terminal device based on that the first information matches the second information.

[0071] In another possible design, the first identity information includes a first identity and a first key identifier, the first identity being used to uniquely identify an identity of the terminal device, and the first key identifier being used to uniquely identify a first key, the first key being used to encrypt, decrypt, and perform security check on the payload of the first data packet.

[0072] Optionally, when the third information includes information used to encrypt and decrypt the part of the header of the first data packet, the first key is further used to encrypt and decrypt the part of the header of the first data packet.

[0073] In another possible design, the first field is an Internet Protocol (IP) address field.

[0074] In another possible design, the first field is a specific field of the first data packet header.

[0075] In another possible design, the specific field is an option field or an extension field.

[0076] In another possible design, the second field is a security channel identifier (SCI) field in a security header (SecTAG) field, and the SCI field has a mapping relationship with the third information.

[0077] In another possible design, the first data packet includes a first data packet header, and the first data packet header includes the first field and the second field.

[0078] In a sixth aspect, a first network device is provided, which includes a transceiver and a processing unit. The transceiver is configured to receive a second data packet sent by a second network device, where the second data packet includes a second data packet header and a first data packet. The second data packet header includes tunnel information, the tunnel corresponding to the tunnel information is used to forward the second data packet. The first data packet includes a first field and a second field, the first field and the second field are different. The first field carries first information, the second field carries second information, and the second field is used to indicate third information. The first information is used to indicate first identity information of a terminal device, the second information is used to indicate the first identity information, and the third information includes information used to encrypt, decrypt, and perform security check on a payload of the first data packet. The processing unit is configured to process the second data packet, and determine that the first data packet is a data packet sent by the terminal device. Optionally, the third information can also include information used to encrypt and decrypt a part of the header of the first data packet, and the part of the header at least does not include the second field.

[0079] In the sixth aspect, the first data packet is a data packet sent by the terminal device, i.e., the terminal device is a source device of the first data packet. The destination terminal device of the first data packet is the first network device.

[0080] In a possible design, the processing unit is further configured to process the second data packet, obtain the first information, the second information, and the third information, perform security check on the first data packet according to the third information, determine that the second data packet passes the security check, and determine that the first data packet is a data packet sent by the terminal device based on the fact that the first information matches the second information.

[0081] In another possible design, the first identity information includes a first identity identifier and a first key identifier, the first identity identifier being used to uniquely identify an identity of the terminal device, and the first key identifier being used to uniquely identify the first key, the first key being used to encrypt, decrypt and perform security check on the payload of the first data packet.

[0082] Optionally, when the third information includes information used to encrypt and decrypt the partial header of the first data packet, the first key is further used to encrypt and decrypt the information used to encrypt and decrypt the partial header of the first data packet.

[0083] In another possible design, the first field is an Internet Protocol (IP) address field.

[0084] In another possible design, the first field is a specific field of the header of the first data packet.

[0085] In another possible design, the specific field is an option field or an extension field.

[0086] In another possible design, the second field is a security channel identifier (SCI) field in a security header (SecTAG) field, and the SCI field has a mapping relationship with the third information.

[0087] In another possible design, the first data packet includes a first data packet header, and the first data packet header includes the first field and the second field.

[0088] In a seventh aspect, a terminal device is provided, which has the functions of the terminal device described in the third aspect. The functions can be implemented based on hardware, or implemented based on hardware executing corresponding software. The hardware or software includes one or more modules corresponding to the functions.

[0089] In a possible implementation, the terminal device includes a processor configured to support the terminal device to perform the corresponding functions in the above method.

[0090] The terminal device can further include a memory coupled to the processor, which stores necessary program instructions and data of the terminal device.

[0091] In another possible implementation, the terminal device includes a processor, a transmitter, a receiver, a random access memory, a read-only memory, and a bus. The processor is coupled to the transmitter, the receiver, the random access memory, and the read-only memory via the bus respectively. When the terminal device needs to be run, the terminal device is started by a basic input / output system or a bootloader in an embedded system fixed in the read-only memory, and is guided to a normal operation state. After the terminal device enters the normal operation state, an application program and an operating system are run in the random access memory, so that the processor executes the method in the first aspect or any possible implementation of the first aspect.

[0092] In an eighth aspect, a first network device is provided, which has the functions of the first network device described in the fourth aspect. The functions can be implemented based on hardware, or the corresponding software is executed based on hardware. The hardware or software includes one or more modules corresponding to the functions.

[0093] In a possible implementation, the first network device includes a processor configured to support the first network device to execute the corresponding functions in the above method.

[0094] The first network device can further include a memory coupled to the processor, which stores necessary program instructions and data of the first network device.

[0095] In another possible implementation, the first network device includes a processor, a transmitter, a receiver, a random access memory, a read-only memory, and a bus. The processor is coupled to the transmitter, the receiver, the random access memory, and the read-only memory via the bus respectively. When the first network device needs to be run, the first network device is started by a basic input / output system or a bootloader in an embedded system fixed in the read-only memory, and is guided to a normal operation state. After the first network device enters the normal operation state, an application program and an operating system are run in the random access memory, so that the processor executes the method in the second aspect or any possible implementation of the second aspect.

[0096] In a ninth aspect, a first network device is provided, which has the functions of the first network device described in the sixth aspect. The functions can be implemented based on hardware, or the corresponding software is executed based on hardware. The hardware or software includes one or more modules corresponding to the functions.

[0097] In a possible implementation, the first network device includes a processor configured to support the first network device to execute the corresponding functions in the above method.

[0098] The first network device can further include a memory coupled with the processor, which stores program instructions and data necessary for the first network device.

[0099] In another possible implementation, the first network device includes a processor, a transmitter, a receiver, a random access memory, a read-only memory, and a bus. The processor is coupled with the transmitter, the receiver, the random access memory, and the read-only memory through the bus respectively. When the first network device needs to be run, the system is started by a basic input / output system or a bootloader in an embedded system solidified in the read-only memory, and the first network device is guided to a normal running state. After the first network device enters the normal running state, an application program and an operating system are run in the random access memory, so that the processor executes the method in the fifth aspect or any possible implementation of the fifth aspect.

[0100] In the tenth aspect, a computer program product is provided, which includes computer program codes, when the computer program codes are run on a computer, the computer is caused to execute the method in the first aspect, the second aspect, or the fifth aspect, and any possible implementation of the first aspect, the second aspect, or the fifth aspect.

[0101] In the eleventh aspect, a computer readable medium is provided, which stores program codes, when the computer program codes are run on a computer, the computer is caused to execute the method in the first aspect, the second aspect, or the fifth aspect, and any possible implementation of the first aspect, the second aspect, or the fifth aspect. The computer readable storage includes but is not limited to one or more of the following: a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), a Flash memory, an electrically EPROM (EEPROM), and a hard drive.

[0102] In a twelfth aspect, a chip system is provided, which includes a processor and a data interface, wherein the processor reads instructions stored on a memory through the data interface to execute the method in the first aspect, the second aspect or the fifth aspect, and any possible implementation of the first aspect, the second aspect or the fifth aspect. In a specific implementation process, the chip system can be implemented in the form of a central processing unit (CPU), a micro controller unit (MCU), a micro processing unit (MPU), a digital signal processing (DSP), a system on chip (SoC), an application-specific integrated circuit (ASIC), a field programmable gate array (FPGA) or a programmable logic device (PLD).

[0103] In a thirteenth aspect, a system is provided, which includes a terminal device and a first network device, the terminal device is configured to execute the method in the first aspect or any possible implementation of the first aspect, and the first network device is configured to execute the method in the second aspect or any possible implementation of the second aspect.

[0104] On the basis of the implementation manners of the aspects provided in the present application, further combinations can be made to provide more implementation manners. BRIEF DESCRIPTION OF DRAWINGS

[0105] Figure 1 FIG. 1 is a schematic flowchart of a packet processing method 100 provided by an embodiment of the present application.

[0106] Figure 2 FIG. 2 is a schematic flowchart of a terminal packet processing method 200 provided by an embodiment of the present application.

[0107] Figure 3 FIG. 3 is a format schematic diagram of a first data packet provided by an embodiment of the present application.

[0108] Figure 4 FIG. 4 is another format schematic diagram of a first data packet provided by an embodiment of the present application.

[0109] Figure 5 FIG. 5 is a format schematic diagram of a second field provided by an embodiment of the present application.

[0110] Figure 6 is a schematic flowchart of a packet processing method 600 provided by an embodiment of the present application.

[0111] Figure 7 is a schematic flowchart of a packet processing method 700 provided by an embodiment of the present application.

[0112] Figure 8 is a format schematic diagram of a second data packet provided by an embodiment of the present application.

[0113] Figure 9 is a schematic diagram of one specific embodiment of the packet processing method provided by an embodiment of the present application.

[0114] Figure 10 is a schematic diagram of another specific embodiment of the packet processing method provided by an embodiment of the present application.

[0115] Figure 11 is a schematic diagram of a terminal device 1100 provided by an embodiment of the present application.

[0116] Figure 12 is a schematic diagram of a first network device 1200 provided by an embodiment of the present application.

[0117] Figure 13 is a hardware structure schematic diagram of a device 1300 provided by an embodiment of the present application.

[0118] Figure 14 is a schematic diagram of a system 1400 provided by an embodiment of the present application. DETAILED DESCRIPTION

[0119] The technical solutions in the embodiments of the present application will be described below with reference to the drawings.

[0120] The terms used in the embodiment part of the present application are only used for explaining the specific embodiments of the present application, and are not intended to limit the present application.

[0121] The terms “first”, “second”, “third” and the like in the present application are used to distinguish the same items or similar items with basically the same function and role, and there is no logical or time sequence dependency between the “first”, “second” and “third”, and the quantity and execution order are not limited.

[0122] The present application will present various aspects, embodiments or features around a system which can include a plurality of devices, components, modules, etc. It should be understood and appreciated that each system can include additional devices, components, modules, etc., and / or can not include all the devices, components, modules, etc. discussed in connection with the drawings. In addition, combinations of these solutions can also be used.

[0123] In addition, the words "example" and "exemplary" are used herein to mean serving as an example, instance, or illustration. Any implementation described herein as "example" or "exemplary" is not necessarily to be construed as preferred or advantageous over other implementations. The

[0124] The network architecture and service scenarios described in the embodiments of the present application are used to more clearly illustrate the technical solutions of the embodiments of the present application, and do not constitute a limitation on the technical solutions provided by the embodiments of the present application. Those skilled in the art can know that, with the evolution of network architecture and the appearance of new service scenarios, the technical solutions provided by the embodiments of the present application are also applicable to similar technical problems.

[0125] In this specification, the reference to "one embodiment" or "some embodiments" means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the application. The appearances of the phrases "in one embodiment" or "in some embodiments" in various places in the specification are not necessarily all referring to the same embodiment, but can refer to one or more but not all embodiments unless otherwise indicated. The terms "comprising," "including," "having," and their variants mean "including but not limited to," unless otherwise indicated.

[0126] In this specification, "at least one" means one or more, and "multiple" means two or more. The term "and / or" describes the associated relationship of the associated objects, which means that there can be three kinds of relationships, for example, A and / or B, which can represent the following three cases: A exists alone, A and B exist together, and B exists alone, where A and B can be singular or plural. The character " / " generally represents an "or" relationship between the associated objects. "At least one of the following" or similar expressions means any combination of these items, including any combination of single or multiple items. For example, at least one of a, b, or c can represent a, b, c, a-b, a-c, b-c, or a-b-c, where a, b, and c can be single or multiple.

[0127] Next, the related technologies of the embodiments of the present application are specifically introduced:

[0128] First, the packet processing method provided by the embodiments of the present application is introduced in combination with Figures 1 to 8

[0129] Figure 1 is a schematic flowchart of a packet processing method 100 provided by the embodiments of the present application. As shown in Figure 1 ​As shown, the method 100 includes step 110 and step 120. Next, step 110 and step 120 are described in detail.

[0130] In step 110, the terminal device generates a first data packet, the first data packet includes a first field and a second field, the first field and the second field are different, the first field carries first information, the second field carries second information, and the second field is used to indicate third information, the first information is used to indicate first identity information of the terminal device, the second information is used to indicate the first identity information, and the third information includes information for encrypting, decrypting and security checking the payload of the first data packet.

[0131] The first field and the second field are different, which can be understood as that the first field and the second field are different fields in the first data packet. The first information and the second information are both used to indicate the first identity information of the terminal device. In an example, the first information and the second information can be the same. For example, the first information can be an IP address 1 of a terminal device 1, and the second information can also be the IP address 1 of the terminal device 1, which is used to uniquely identify the terminal device 1. In another example, the first information and the second information can be different. For example, the first information can be an IP address 1 of a terminal device 1, and the second information can be an ID 1 of the terminal device 1, the IP address 1 is used to uniquely identify the terminal device, and the ID 1 is also used to uniquely identify the terminal device 1. The second field is used to indicate the third information, and the second field can be directly used to indicate the third information, or the second field can be indirectly used to indicate the third information, which is not limited.

[0132] The first identity information can include a first identity and a first key identifier, the first identity is used to uniquely identify the identity of the terminal device, and the first key identifier is used to uniquely identify a first key, and the first key is used to encrypt, decrypt and security check the payload of the first data packet. The first identity is not limited, as long as the identity that can uniquely identify the identity of the terminal device can be called the first identity.

[0133] The third information includes information for encrypting, decrypting and security checking the payload of the first data packet. Optionally, the third information can also include information for encrypting and decrypting part of the header of the first data packet, and the part of the header at least does not include the second field.

[0134] Optionally, the first data packet can further include a third field, the third field being used for checking security of the first data packet, for example but not limited to, the third field can be located at a tail of the first data packet or in a security tag (SecTAG). In an example, when the security check is an integrity check, the third field is an ICV field, i.e., the ICV field is used for checking integrity of the first data packet. In this implementation, the terminal device is further configured to perform the following operations: the terminal device encrypts the payload of the first data packet by using a first key and a first algorithm, the third information includes the first key and the first algorithm; the terminal device processes the encrypted first data packet by using a hash algorithm to obtain a first digital signature; and the third field is set to carry the first digital signature. Optionally, the security check can also be other security-related checks. For example, the security check can also be an anti-replay check, in which case the third field is a field used for performing the anti-replay check. In the embodiments of the present application, when the security check is an integrity check, checking integrity of the first data packet includes checking integrity of data carried by the payload of the first data packet.

[0135] Optionally, the first field can further carry fourth information, the fourth information being used for indicating second identity information, the second identity information being identity information of a destination terminal device of the first data packet.

[0136] Optionally, the first data packet includes a first data packet header, the first data packet header including the first field and the second field. For example, Figure 2 A format of a first data packet provided by an embodiment of the present application is shown. It should be understood that the first data packet header can further include fields other than the first field and the second field. For example, Figure 2 For example, the first header can further include other fields, including but not limited to a flags field, a type of service field, a version field, a protocol field, and the like.

[0137] In some possible design, the first field is an internet protocol (IP) address field, i.e., the IP address field carries the first identity information of the terminal device. The IP address field carrying the first identity information can be, but is not limited to, that part of the value of the IP address field is used to indicate the first identity information. The IP address field includes a source IP address field and a destination IP address field, part of the value of the source IP address field can be used to carry a source IP address prefix, and the remaining part of the value of the source IP address field can be used to carry the first identity information. The destination IP address field carries a destination IP address prefix, and optionally, the destination IP address field can also carry the second identity information. In an example, part of the value of the destination IP address field is used to carry the destination IP address prefix, and the remaining part of the value of the destination IP address field can be used to carry the second identity information (i.e., the identity information of the destination terminal device of the first data packet).

[0138] In some possible design, the first field is a specific field of the first data packet header. Optionally, the specific field is an option field. For example, Figure 3 A format of a first data packet provided by an embodiment of the present application is shown, i.e., the first data packet is an internet protocol version 4 (IPv4) packet, and an option field of a packet header of the IPv4 packet carries identity information, which can include the first identity information. Optionally, the identity information can also include the second identity information. Optionally, the specific field can also be a field other than the option field. For example, Figure 4 Another format of a first data packet provided by an embodiment of the present application is shown, i.e., the first field is a specific field of the first data packet header, and the specific field is a field other than the option field.

[0139] In some possible design, the second field is a secure channel identification (SCI) field in the SecTAG field, and the SCI field has a mapping relationship with the third information. The SCI field has a mapping relationship with the third information, i.e., the corresponding third information can be obtained through the SCI field (for example, but not limited to, the SCI field as an index). It can be understood that the first network device can store the mapping relationship between the SCI field and the third information. Correspondingly, the first network device processes the first data packet, and the third information can be obtained according to the SCI field in the first data packet. For example, Figure 5 The format of the SecTAG field is shown. As Figure 5As shown, the SecTAG field includes an ether type field, a tag control information (TCI) field, an agreement no (AN) field, a Short Length (SL) field, a packet number (PN) field and an SCI field. The Ether Type occupies two octets and is identified by 0x88E5, the TCI and the AN together occupy one octet, the AN occupies two bits and is used to declare the protocol type and the key of the security protocol, and the next packet number, the TCI is before the AN and occupies 6 bits, including a version, an end station (ES), a secure channel (SC), a secure channel broadcast, encryption and changed text, each occupying one bit. The SL occupies one octet, only the last four bits are valid, if the value is less than 15, it is used to identify the length of the user data, otherwise it is set to 0, the PN occupies 4 octets and is a positive integer that is monotonically increasing and globally unique, used to identify a legal data frame sequence number and for replay protection, each visitor will maintain a PN with an integer value and an initial value of a fixed value. The SCI occupies 8 octets, the SCI field is used to carry identity information, and the SCI field is used to indicate the third information.

[0140] In the embodiment of the present application, the first data packet can be, but is not limited to, an IPv4 packet or an internet protocol version 6 (IPv6) packet. The terminal device includes, but is not limited to, an IoT terminal device. For example, the IoT terminal device can be a smart control device of a street lamp. For example, the IoT terminal device can be a smart device of a medical device. For example, the IoT terminal device can be a smart device of a production workshop, a machine room, etc. For example, the IoT terminal device can be a growth monitoring device of crops. For example, the IoT terminal device can be a pedestrian detection sensor or a device supporting a temperature detection sensor. For example, the IoT terminal device can be an environmental sensor. For example, the IoT terminal device can be a home smart device.

[0141] In step 120, the terminal device sends the first data packet to the first network device.

[0142] The first network device can be an access device in the network. For example, the first network device can be an access switch. In one example, when the first network device is an access device, the first network device can specifically be a network device that verifies the first data packet. In another example, the first network device can specifically be a network device that forwards the first data packet. Based on this, the embodiments of the present application provide two ways to verify the security of the first data packet. Next, based on the method 100 described above, and in combination with Figures 6 to 8 , the method flowcharts corresponding to the two ways are specifically introduced. In the following Figure 6 and Figure 7 , the first identity information of the terminal device carried in the first field of the first data packet sent by the terminal device is taken as an example, and the first identity information of the terminal device carried in the second field of the first data packet is taken as an example. It should be understood that Figure 6 and Figure 7 are only illustrative, and do not constitute any limitation on the packet processing method provided by the embodiments of the present application. For example, in another possible design, the first identity information of the terminal device carried in the first field of the first data packet sent by the terminal device is not the first identity information of the terminal device carried in the second field of the first data packet. Based on this, after the first network device identifies the first field and the second field in the first data packet, it can be determined that the first data packet is not the data packet sent by the terminal device, i.e., the first data packet is a fake packet. Thereafter, the first network device can discard the first data packet to ensure the security of network communication.

[0143] Way one: The first network device determines that the first data packet sent by the terminal device is the data packet sent by the terminal device, i.e., the first data packet is a non-fake packet and is secure. In this implementation way, the first network device is also called a security verification device, and the first network device is located in the access layer in the network.

[0144] Next, the above way one is introduced in combination with Figure 6 . Figure 6 is a schematic flowchart of a packet processing method 600 provided by the embodiments of the present application. As shown in Figure 6 , the method 600 includes steps 610 to 630. Next, the steps 610 to 630 are specifically introduced.

[0145] ​At step 610, the terminal device generates a first data packet, the first data packet comprising a first field and a second field, the first field and the second field being different, the first field carrying first information, the second field carrying second information, and the second field being used to indicate third information, the first information being used to indicate first identity information of the terminal device, the second information being used to indicate the first identity information, and the third information comprising information for encrypting, decrypting and security checking a payload of the first data packet.

[0146] Optionally, the third information can further comprise information for encrypting and decrypting a part of a header of the first data packet, the part of the header at least excluding the second field. When the third information comprises the information for encrypting and decrypting the part of the header of the first data packet, the first key is further used for encrypting and decrypting the part of the header of the first data packet.

[0147] The format and definition of the first data packet in step 610 are the same as those of the first data packet in method 100, and will not be described in detail here.

[0148] In one example, when the security checking comprises integrity checking, i.e., the third information comprises information for encrypting, decrypting and integrity checking the payload of the first data packet, the terminal device generating the first data packet can comprise the following steps: the terminal device encrypts the payload of the first data packet by using a first key and a first algorithm, the third information comprising the first key and the first algorithm; the terminal device processes the encrypted first data packet by using a hash algorithm to obtain a first digital signature, and fills the first digital signature in the third field of the first data packet; and the terminal device encapsulates the identity information in the first field and the second field, and encapsulates the identity information in the SCI field, the identity information comprising the first identity information of the terminal device, or the identity information comprising the first identity information of the terminal device and second identity information of the first network device.

[0149] At step 620, the terminal device sends the first data packet to the first network device.

[0150] At step 630, the first network device processes the first data packet to determine that the first data packet is a data packet sent by the terminal device.

[0151] The first data packet is a data packet sent by the terminal device, that is, the terminal device is a source terminal device of the first data packet, and information carried by the first data packet is not illegally tampered with by other devices. The first network device processes the first data packet to determine that the first data packet is a data packet sent by the terminal device, which can include the following steps: the first network device processes the first data packet to obtain first information, second information, and third information; the first network device performs security verification on the first data packet according to the third information to determine that the first data packet passes the security verification; and the first network device determines that the first data packet is a data packet sent by the terminal device based on the first information matching the second information. The first network device processes the first data packet to obtain the third information, which can include the following steps: analyzing the first data packet to obtain an SCI field; and obtaining the third information according to the SCI field and a preset table item, the preset table item being a table item stored locally on the first network device, and the preset table item recording a mapping relationship between the SCI field and the third information.

[0152] In one example, when the security verification is integrity verification, the first network device performs integrity verification on the first data packet according to the third information to determine that the first data packet passes the integrity verification, which can include the following steps: the first network device obtains the third information according to the SCI field in the first data packet, the third information including a first key and a second algorithm; the first network device performs decryption processing on the first data packet according to the first key and the second algorithm to obtain a second digital signature; and based on the second digital signature matching a first digital signature included in the third field, it is determined that the first data packet passes the integrity verification.

[0153] In the above-mentioned manner one, the first network device is located in the access layer of the network, and the first network device can perform verification (including security verification and identity verification) on the received first data packet. Specifically, the first network device can obtain first information, second information, and third information from the received first data packet, and determine that the security verification of the first data packet passes by using the third information, and compare the first information and the second information to determine that the first data packet is a data packet sent by the terminal device, that is, the first data packet is a non-fake packet. Thereafter, the first network device can perform subsequent forwarding processing on the first data packet, which can improve the communication security in the network. The method avoids the need to store a large number of address mapping tables in the local of the first network device, and helps to save network resources. That is, the method can improve the communication security in the network and help to save network resources.

[0154] The second mode is that the first network device determines that the first data packet is a data packet sent by the terminal device, that is, the first data packet is a non-fake packet and is safe. In this implementation mode, the first network device is also referred to as a security verification device, and the first network device is located at the aggregation layer in the network.

[0155] The following describes the second implementation mode in combination with Figure 7 and Figure 8 the above. Figure 7 FIG. 7 is a schematic flowchart of a packet processing method 700 provided by an embodiment of the present application. As shown in the figure, the method 700 includes steps 710 to 750. The following describes the steps 710 to 750. Figure 7

[0156] In step 710, the terminal device generates a first data packet. The first data packet includes a first field and a second field, the first field and the second field are different, the first field carries first information, the second field carries second information, and the second field is used to indicate third information. The first information is used to indicate first identity information of the terminal device, the second information is used to indicate the first identity information, and the third information includes information for encrypting, decrypting and security checking a payload of the first data packet.

[0157] Optionally, the third information can also include information for encrypting and decrypting a part of a header of the first data packet, and the part of the header at least does not include the second field. When the third information includes the information for encrypting and decrypting the part of the header of the first data packet, the first key is also used to encrypt and decrypt the information for encrypting and decrypting the part of the header of the first data packet.

[0158] The format and definition of the first data packet are the same as those shown in the method 100, and details are not described herein again. The method for the terminal device to generate the first data packet is the same as that described in the step 610, and details are not described herein again.

[0159] In step 720, the terminal device sends the first data packet to a second network device.

[0160] In step 730, the second network device generates a second data packet according to the first data packet. The second data packet includes a second data packet header and the first data packet.

[0161] ​The second network device can be an access layer device or a forwarding device in the network, without specific limitations. The second network device forwards the first data packet to the first network device. After receiving the first data packet, the second network device needs to encapsulate it using a tunnel and then send the encapsulated second data packet to the first network device through the tunnel. The second data packet includes a second data packet header and a first data packet. The second data packet header includes tunnel information, and the tunnel corresponding to the tunnel information is used to forward the second data packet. This tunnel information may include: the source node information (i.e., the second network device) of the tunnel corresponding to the tunnel information, the destination node information (i.e., the first network device) of the tunnel corresponding to the tunnel information, and tunnel identification information, which is used to uniquely identify the tunnel.

[0162] In some possible designs, the second data packet includes a second data packet header and a first data packet. The first data packet may include a first field, a second field, a payload, and a third field. The second data packet may include the entire content of the first data packet, or it may only include a portion of the first data packet, which at least includes the first field, the second field, the payload, and the third field. For example, Figure 8 Image (1) shows a schematic diagram of the format of a second data packet provided in an embodiment of this application. Figure 8 As shown, the header of the second data packet includes a second data packet header and a first data packet header. The second data packet header includes the aforementioned tunnel information, and the first data packet header includes a first field and a second field. It should be understood that... Figure 8 Example (1) shows the third field located at the end of the second data packet. Optionally, the third field can also be located in other positions in the second data packet, for example, the third field can also be a field after the first data packet header included in the second data packet.

[0163] Optionally, the second data packet header may also include a second field. For example, Figure 8 (2) shows that the second data packet header also includes a second field. It should be understood that... Figure 8 The second data packet header also includes a field carrying tunnel information. Figure 8 (Not shown in the image). Optionally, the second data packet header may also carry other fields, which are not specifically limited. It should be understood that... Figure 8 Example (2) shows the third field located at the end of the second data packet. Optionally, the third field can also be located in other positions in the second data packet, for example, the third field can also be a field after the first data packet header included in the second data packet.

[0164] At step 740, the second network device sends the second data packet to the first network device.

[0165] At step 740, the second network device sends the second data packet to the first network device.

[0166] At step 750, the first network device processes the second data packet to determine that the first data packet is a data packet sent by the terminal device.

[0167] At step 750, the first network device processes the second data packet to determine that the first data packet is a data packet sent by the terminal device. Figure 7 The above description is only illustrative and does not limit the packet processing method provided by the embodiments of the present application. For example, in another possible design, the second network device and the first network device can further include one or more forwarding devices for forwarding the second data packet received from the second network device to the first network device so that the first network device receives the corresponding data packet.

[0168] In the above-described second manner, the first network device is a security verification device, the first network device is located at an aggregation layer in the network, the first network device can obtain the second data packet sent by the second network device, and obtain the information of the first data packet from the second data packet. Based on this, the first network device can check (including security check and identity check) the first data packet. Specifically, the first network device can obtain the first information, the second information, and the third information according to the first data packet, and determine that the security check of the first data packet is passed by using the third information, and compare the first information and the second information to determine that the first data packet is the data packet sent by the terminal device, that is, the first data packet is a non-forged packet. Thereafter, the first network device can perform subsequent forwarding processing on the first data packet. The method can improve the communication security in the network. The method avoids the need to store a large number of address mapping tables in the local of the first network device, and helps to save network resources. That is, the method can improve the communication security in the network, and helps to save network resources.

[0169] The above describes Figures 1 to 8 The above describes Figure 9 The above describes Figure 10 Two specific embodiments of the packet processing method provided by the embodiments of the present application are described below. It should be understood that Figure 9 The above describes Figure 10 The examples are only used to help those skilled in the art to understand the embodiments of the present application, and are not intended to limit the embodiments of the present application to the specific values or specific scenarios shown. Those skilled in the art can obviously make various equivalent modifications or changes according to the examples given below, and such modifications and changes also fall within the scope of the embodiments of the present application. Figure 9 The above describes Figure 10 The above describes The above describes

[0170] The above describes Figure 9 is a schematic diagram of one specific embodiment of the packet processing method provided by the embodiments of the present application. As shown in (1) of Figure 9 The terminal device sends an IPv6 data packet 1 to a security verification point, and the security verification point is an access device in a network. Based on the scenario shown in (1) of Figure 9 The above describes The above describes

[0171] In the embodiments of the present application, the terminal device is the source device of the IPv6 data packet 1. The destination terminal device of the IPv6 data packet 1 is not specifically limited. The source device of the IPv6 data packet 1 and the destination terminal device of the IPv6 data packet 1 can not be the same terminal device.

[0172] At step 910, the terminal device generates an IPv6 data packet 1 and sends the IPv6 data packet 1 to the security verification point.

[0173] The terminal device generates the IPv6 data packet 1, which can include the following steps: using the key 1 and the algorithm 1 to encrypt the payload of the IPv6 data packet 1, the security context information including the key 1 and the algorithm 1; generating a digital signature 1 (also known as a public key digital signature) for the encrypted IPv6 data packet 1 through a hash-based message authentication code (HMAC) related to the key, and filling the digital signature 1 in the integrity check value (ICV) field at the tail of the IPv6 data packet 1; setting the lower 64 bits of the source IPv6 address to carry the identity information of the terminal device, and setting the lower 64 bits of the destination IPv6 address to carry the identity information of the terminal device to which the IPv6 data packet 1 is destined; and setting the SCI field to carry the identity information of the terminal device; and the SCI field is used to indicate the security context information, that is, there is a mapping relationship between the SCI field and the security context information. It can be understood that in this implementation, the header of the IPv6 data packet 1 carries double identity information, that is, the lower 64 bits of the source IPv6 address and the SCI field in the SecTAG field. The way in which the terminal device obtains the IPv6 address of the device is not limited. For example, the terminal device can obtain the IPv6 address from the DCHP. For another example, the IPv6 address can also be statically configured. The above security context information can be obtained after the terminal device is connected to the network and passes the security verification.

[0174] In the embodiments of the present application, the format of the IPv6 data packet 1 can be as follows Figure 9As shown in (2) of FIG. 6, the packet header carries the identity information of the terminal device, and the SCI field in the SecTAG field also carries the identity information of the terminal device. Specifically, the lower 64 bits of the source IPv6 address can be used to carry the identity information of the terminal device, and the lower 64 bits of the destination IPv6 address can be used to carry the identity information of the destination terminal device of the IPv6 data packet 1. The lower 64 bits of the source IPv6 address (i.e., the identity information of the terminal device) can be represented as ID1||MID1, and the lower 64 bits of the destination IPv6 address (i.e., the identity information of the security verification point) can be represented as ID2||MID1, where "||" is a connection symbol. ID1 is the identity ID of the terminal device, and ID1 is used to indicate the terminal device. ID2 is the identity ID of the destination terminal device of the IPv6 data packet 1, and ID2 is used to indicate the destination terminal device of the IPv6 data packet 1. MID1 is the key ID for encrypting the data in the payload of the IPv6 data packet 1. Optionally, the format of the IPv6 data packet 1 can also be as shown in (3) of FIG. 6, that is, the lower 64 bits of the source IPv6 address can be used to carry the identity information of the terminal device, and the SCI field in the SecTAG field also carries the identity information of the terminal device. In this implementation manner, the packet header of the IPv6 data packet 1 can not carry the identity information of the destination terminal device of the IPv6 data packet 1. It can be understood that, Figure 9 Figure 9 Figure 9 The format of the IPv6 data packet 1 shown in (2) or (3) of FIG. 6 is only schematic, and does not constitute any limitation on the format of the IPv6 data packet 1 provided by the embodiments of the present application. For example, the packet header of the IPv6 data packet 1 can further include other fields, and these other fields can also carry other information.

[0175] In step 920, the security verification point performs integrity verification on the IPv6 data packet 1.

[0176] ​​The security verification point performs integrity verification on the IPv6 data packet 1, which can include the following steps: the security verification point obtains the SCI field in the SecTAG from the IPv6 data packet 1, obtains the security verification context information according to the SCI field, and the security verification context information further includes algorithm 2 and key 2; the security verification point performs decryption processing on the IPv6 data packet 1 by using algorithm 2 and key 2 to obtain a digital signature 2; and then the security verification point determines whether the integrity verification is passed by comparing the digital signature 2 with the data signature 1 carried in the ICV field of the IPv6 data packet 1. When the security verification point determines that the digital signature 2 matches the data signature 1 carried in the ICV field of the IPv6 data packet 1 through comparison, it is determined that the integrity verification of the IPv6 data packet 1 is passed; otherwise, it is determined that the integrity verification of the IPv6 data packet 1 is not passed. In the embodiment of the application, the IPv6 data packet 1 that fails to pass the verification can be discarded directly. The IPv6 data packet 1 that passes the verification can be processed subsequently (for example, data carried in the payload of the IPv6 data packet 1 that passes the verification is forwarded to a destination terminal device, and the like). The verification algorithm includes, but is not limited to, a message digest 5 (MD5) algorithm, a secure hash algorithm (SHA), a SHA1 or SHA2 algorithm. Optionally, the key 2 is completely the same as the key 1.

[0177] It can be understood that the security verification point performs integrity verification on the IPv6 data packet 1, and only after the integrity verification is passed, the step 930 below is executed.

[0178] In step 930, the security verification point processes the IPv6 data packet 1 to determine that the IPv6 data packet 1 is a data packet sent by a terminal device.

[0179] The security verification point processes the IPv6 data packet 1 to determine that the IPv6 data packet is a data packet sent by a terminal device, which can include the following steps: the security verification point obtains the identity information of the terminal device carried in the IPv6 packet header and the identity information of the terminal device carried in the SCI field from the IPv6 data packet 1; and compares the two identity information. When it is determined that the two identity information indicate the same terminal device, it is considered that the first data packet is a non-forged packet and is safe, and subsequent forwarding processing is performed; otherwise, it is considered that the first data packet is a forged packet and is unsafe, and the first data packet is discarded. Optionally, the forged first data packet can also be forwarded to other security devices for further other security identification and processing. Next, the method for processing a packet provided in an embodiment of the application is introduced. Figure 10 Another specific embodiment of the packet processing method provided in the embodiment of the application is introduced.

[0180] Figure 10 is a schematic diagram of another specific embodiment of the packet processing method provided by the embodiments of the present application. As shown in Figure 10 (1), the terminal device sends an IPv6 data packet 1 to a security verification point, and the security verification point is a device of the convergence layer in the network. Based on the scenario shown in Figure 10 (1), the packet processing method provided by the embodiments of the present application can include steps 1010 to 1040. Next, steps 1010 to 1040 are described in detail.

[0181] In the embodiments of the present application, the terminal device is the source terminal device of the IPv6 data packet 1. The destination terminal device of the IPv6 data packet 1 is not specifically limited. The source terminal device of the IPv6 data packet 1 and the destination terminal device of the IPv6 data packet 1 can not be the same terminal device.

[0182] Step 1010, the terminal device generates an IPv6 data packet 1, and sends the IPv6 data packet 1 to the network.

[0183] Correspondingly, after the terminal device performs the above step 1010, the access device in the network can receive the IPv6 data packet 1. The format of the IPv6 data packet 1 can be as shown in Figure 9 (2) or Figure 9 (3). The method described in the above step 1010 is the same as the method described in the above step 910, and the content not described in detail here can be referred to the related description in the above step 910.

[0184] Step 1020, the access device generates an IPv6 data packet 2 according to the IPv6 data packet 1, and sends the IPv6 data packet 2 to the security verification point.

[0185] The access device generates the IPv6 data packet 2 according to the IPv6 data packet 1 can include the following steps: the access device encapsulates the IPv6 data packet 1 according to the tunnel information to obtain the IPv6 data packet 2. The tunnel information includes the source node information (i.e., the information of the access device) of the tunnel corresponding to the tunnel information, the destination node information (i.e., the information of the security verification point) of the tunnel corresponding to the tunnel information, and tunnel identification information for uniquely identifying the tunnel.

[0186] In the above step 1020, the format of the IPv6 data packet 2 can be as shown in Figure 10 (2), (3) or (4). In Figure 10In (2) of the above (1), the packet header of the IPv6 data packet 2 includes a packet header #2 and a packet header #1, the packet header #2 includes an outer packet header, the outer packet header carries tunnel information, the packet header #1 includes an inner packet header and a SecTAG field, the inner packet header includes an IP address field, and the format of the IP address field can be as described above Figure 9 In (2) of the above (1), or Figure 9 In (3) of the above (1). In Figure 10 In (3) of the above (1), the packet header of the IPv6 data packet 2 includes a packet header #2 and a packet header #1, the packet header #2 includes an outer packet header and a SecTAG field, the outer packet header includes tunnel information, the packet header #1 includes an inner packet header, the inner packet header includes an IP address field, and the format of the IP address field can be as described above Figure 9 In (2) of the above (1). In Figure 10 In (4) of the above (1), the packet header of the IPv6 data packet 2 includes a packet header #2 and a packet header #1, the packet header #2 includes an outer packet header and a SecTAG field, the outer packet header carries tunnel information, the packet header #1 includes an inner packet header and a SecTAG field, the inner packet header includes an IP address field, and the format of the IP address field can be as described above Figures 1 to 10 In (2) of the above (1).

[0187] In step 1030, the security verification point performs integrity verification on the IPv6 data packet 1.

[0188] The method described in the above step 1030 has the same principle as the method described in the above step 920, and the content not described in detail herein can be referred to the related description in the above step 920.

[0189] It can be understood that the integrity verification is performed on the IPv6 data packet 1 at the security verification point, and after the integrity verification passes, the step below 1040 is executed.

[0190] In step 1040, the security verification point processes the IPv6 data packet 1 to determine that the IPv6 data packet 1 is a data packet sent by a terminal device.

[0191] The method described in the above step 1040 has the same principle as the method described in the above step 930, and the content not described in detail herein can be referred to the related description in the above step 930.

[0192] The above describes the packet processing method provided by the present application in combination with Figures 11 to 14 The above describes the packet processing method provided by the present application in combination with Figure 11This application provides a detailed description of the terminal device, the first network device, and the system. It should be understood that the descriptions of the method embodiments correspond to the descriptions of the apparatus embodiments; therefore, any parts not described in detail can be found in the foregoing method embodiments.

[0193] Figure 11 This is a schematic diagram of a terminal device 1100 provided in an embodiment of this application. Figure 12 The terminal device 1100 shown includes a transceiver unit 1110 and a processing unit 1120.

[0194] The transceiver unit 1110 is used to execute steps 120, 620, and 720 as described above. These steps are detailed in the preceding descriptions and will not be repeated here. The processing unit 1120 is used to execute steps 110, 610, and 710 as described above. These steps are detailed in the preceding descriptions and will not be repeated here.

[0195] Figure 12 This is a schematic diagram of a first network device 1200 provided in an embodiment of this application. For example... Figure 13 The first network device 1200 shown includes a transceiver unit 1210 and a processing unit 1220.

[0196] The transceiver unit 1210 is used to receive the first data packet in the above method embodiment and to send the second data packet in the above method embodiment. The processing unit 1220 is used to execute the above steps 630, 730, and the data integrity verification related steps described in the above method 600.

[0197] Figure 13 This is a schematic diagram of the hardware structure of a device 1300 provided in an embodiment of this application.

[0198] like Figure 13 As shown, the device 1300 includes a processor 1310, a communication interface 1320, a memory 1330, and a bus 1340. The communication interface 1320 can be implemented wirelessly or via a wired connection; specifically, it can be a network interface card (NIC). The processor 1310, memory 1330, and communication interface 1320 are connected via the bus 1340.

[0199] In some implementations, Figure 11 The device 1300 shown can execute the corresponding steps performed by the terminal device in the above method embodiments. These steps can be found in the relevant descriptions above, and will not be repeated in detail here.

[0200] Among them, in the above Figure 11When the functions of each unit module included in the terminal device 1100 are executed by software, the memory 1330 can store the program code executed by the software, and the processor 1310 can call the program code stored in the memory 1330 to execute the functions of each unit module included in the terminal device 1100. For details not elaborated here, please refer to the above description. Figure 11 Description of terminal device 1100 in the text.

[0201] Specifically, the communication interface 1320 may include a transmitter and a receiver, and the specific functions of the transmitter are as described above. Figure 11 The transmitting function of the transceiver unit 1110 shown is the same. The functions of the transmitter, which are not described in detail here, can be found above. Figure 11 The transmitting function of the transceiver unit 1110 shown is illustrated. The specific functions of the receiver are the same as described above. Figure 11 The receiving function of the transceiver unit 1110 shown is the same. The functions of the receiver, which are not described in detail here, can be found above. Figure 13 The receiving function of the transceiver unit 1110 shown.

[0202] The memory 1330 includes an operating system 1331 and an application program 1332, used to store programs, code, or computer-executable instructions. When the processor or hardware device executes these programs, code, or computer-executable instructions, the processing procedures involving the terminal device in the method embodiment can be completed. Optionally, the memory 1330 may include read-only memory (ROM) and random access memory (RAM). The ROM includes a basic input / output system (BIOS) or an embedded system; the RAM includes the application program and the operating system. When the terminal device needs to run, the system is booted through the BIOS embedded in the ROM or the bootloader in the embedded system, guiding the terminal device into normal operating mode. After the terminal device enters normal operating mode, the application program and operating system running in the RAM complete the processing procedures involving the terminal device in the method embodiment.

[0203] In some other implementations, Figure 12 The device 1300 shown can perform the corresponding steps executed by the first network device in the above method embodiment. These steps can be found in the relevant descriptions above, and will not be repeated in detail here.

[0204] Among them, in the above Figure 12In the case that the functions of the various unit modules included in the first network device 1200 are implemented by software execution, the memory 1330 can store the program code of the software execution, and the processor 1310 can invoke the program code of the software execution stored in the memory 1330 to implement the functions of the various unit modules included in the first network device 1200. The details not described herein can refer to the above description of the first network device 1200 in the method embodiment. Figure 12

[0205] The communication interface 1320 specifically can include a transmitter and a receiver, and the specific function of the transmitter is the same as the transmitting function of the transceiver unit 1210 described above. Figure 12 The function of the transmitter not described in detail herein can refer to the transmitting function of the transceiver unit 1210 described above. Figure 12 The specific function of the receiver is the same as the receiving function of the transceiver unit 1210 described above. Figure 12 The function of the receiver not described in detail herein can refer to the receiving function of the transceiver unit 1210 described above. Figure 13 The specific function of the receiver is the same as the receiving function of the transceiver unit 1210 described above.

[0206] The memory 1330 includes an operating system 1331 and an application program 1332, and is configured to store programs, codes or computer execution instructions, which can complete the processing process related to the first network device in the method embodiment when the processor or hardware device executes the programs, codes or computer execution instructions. Optionally, the memory 1330 can include a read-only memory (ROM) and a random access memory (RAM). The ROM includes a basic input / output system (BIOS) or an embedded system; and the RAM includes an application program and an operating system. When the first network device needs to be run, the system is started by the BIOS or the bootloader in the embedded system solidified in the ROM, and the first network device is guided to enter a normal running state. After the first network device enters the normal running state, the application program and the operating system running in the RAM are executed, so that the processing process related to the first network device in the method embodiment is completed.

[0207] It can be understood that, Figure 14 Only a simplified design of the device 1300 is shown. In some implementations, the network device 1300 can also include any number of processors 1310, communication interfaces 1320 or memories 1330. In other implementations, the network device 1300 can also include only any number of processors 1310 and communication interfaces 1320. ​

[0208] Figure 14 is a schematic diagram of a system 1400 according to an embodiment of the present application. As shown in Figure 11 , the system 1400 can include the terminal device 1100 shown in Figure 12 and the first network device 1200 shown in Figure 13 . Wherein, the hardware structure of the terminal device 1100 and the first network device 1200 can be as shown in Figure 9 .

[0209] Wherein, the terminal device 1100 can be the terminal device in the method 100, the method 600 or the method 700, for performing the corresponding steps performed by the terminal device in the method 100, the method 600 or the method 700. The first network device 1200 can be the first network device in the method 100, the method 600 or the method 700, for performing the corresponding steps performed by the first network device in the method 100, the method 600 or the method 700. Optionally, the first network device can also be the security verification point in the method 100 or the method 600, for performing the corresponding steps performed by the security verification point in the method 100 or the method 600. Figure 10 or Figure 9 . Figure 10 or Figure 13 corresponding method embodiments.

[0210] Optionally, in another possible design, the system 1400 can further include a second network device, and the hardware structure of the second network device can be as shown in Figure 10 . The second network device can be the second network device in the method 700, for performing the corresponding steps performed by the second network device in the method 700. Optionally, the second network device can also be the access device in the method 100 or the method 600, for performing the corresponding steps performed by the access device in the method 100 or the method 600. Figure 10 or ​ corresponding method embodiments.

[0211] The embodiment of the present application provides a computer program product, when the computer program product runs on the terminal device, makes the terminal device execute the method in the method embodiments.

[0212] The embodiment of the present application provides a computer program product, when the computer program product runs on the first network device, makes the first network device execute the method in the method embodiments.

[0213] The embodiment of the present application provides a computer readable storage medium, for storing a computer program, the computer program includes a method for executing the method in the method embodiments.

[0214] The embodiment of the present application provides a chip system, comprising at least one processor and an interface; the at least one processor is used for calling and running a computer program, so that the chip system executes the method in the method embodiment.

[0215] The devices in various product forms described above have any function of the network equipment in the method embodiments respectively, and details are not described herein again.

[0216] Those skilled in the art can realize that the units and algorithm steps of the examples described in combination with the embodiments disclosed herein can be realized by electronic hardware or a combination of computer software and electronic hardware. Whether the functions are realized in hardware or software mode depends on the specific application and design constraints of the technical solution. The skilled person can use different methods to realize the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0217] Those skilled in the art can clearly understand that, for the convenience and brevity of description, the specific working processes of the system, device and unit described above can refer to the corresponding processes in the foregoing method embodiments, and details are not described herein again.

[0218] In several embodiments provided in the present application, it should be understood that the disclosed system, device and method can be realized by other ways. For example, the device embodiments described above are only schematic, for example, the division of the units is only a logical function division, and actual implementation can have another division mode, for example, a plurality of units or components can be combined or integrated into another system, or some features can be ignored or not executed. In addition, the coupling or direct coupling or communication connection between the units shown or discussed can be indirect coupling or communication connection through some interface, device or unit, and can be electrical, mechanical or other forms.

[0219] The units described as separate components can or can not be physically separate, and the components shown as units can or can not be physical units, that is, can be located in one place, or can be distributed on a plurality of network units. According to actual needs, part or all of the units can be selected to realize the purpose of the embodiment.

[0220] In addition, each functional unit in each embodiment of the present application can be integrated in one processing unit, or each unit can exist physically, or two or more units can be integrated in one unit.

[0221] If the functions are implemented in the form of software function units and sold or used as independent products, they can be stored in a computer readable storage medium. Based on this understanding, the technical solutions of the present application or the parts of the technical solutions that essentially contribute to the prior art or the parts of the technical solutions can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a plurality of instructions for causing a computer device (which can be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of the present application. The aforementioned storage medium includes a U disk, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and various media that can store program codes.

[0222] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art can easily think of changes or replacements within the technical scope disclosed in the present application, which should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method of processing a packet, the method comprising: The terminal device generates a first data packet, the first data packet comprising a first field and a second field, the first field and the second field being different, the first field carrying first information, the second field carrying second information, and the second field being used for indicating third information, the first information being used for indicating first identity information of the terminal device, the second information being used for indicating the first identity information, the third information comprising information for encrypting, decrypting and security checking a payload of the first data packet, the first information carried in the first field matching the second information carried in the second field, so that a first network device determines that the first data packet is a data packet sent by the terminal device according to the first information matching the second information. The terminal device sends the first data packet to the first network device. The first identity information comprises a first identity identifier and a first key identifier, the first identity identifier being used for uniquely identifying an identity of the terminal device, and the first key identifier being used for uniquely identifying a first key, the first key being used for encrypting, decrypting and security checking the payload of the first data packet.

2. The method of claim 1, wherein, The first field is an Internet Protocol (IP) address field.

3. The method of claim 1, wherein, The first field is a specific field of a first data packet header.

4. The method of claim 1, wherein, The specific field is an option field or an extension field.

5. The method of claim 4, wherein, The second field is a security channel identifier (SCI) field in a security header (SecTAG) field, and the SCI field has a mapping relationship with the third information.

6. The method according to any one of claims 1 to 5, characterized in that, The first data packet comprises a first data packet header, and the first data packet header comprises the first field and the second field.

7. The method according to any one of claims 1 to 5, characterized in that, The first network device obtains a first data packet, the first data packet comprising a first field and a second field, the first field and the second field being different, the first field carrying first information, the second field carrying second information, and the second field being used for indicating third information, the first information being used for indicating first identity information of a terminal device, the second information being used for indicating the first identity information, and the third information comprising information for encrypting, decrypting and security checking a payload of the first data packet.

8. A message processing method characterized by, The first network device determines that the first data packet is a data packet sent by the terminal device based on the first information matching the second information. The first network device obtains a first data packet, comprising: The first network device receives the first data packet sent by the terminal device.

9. The method of claim 8, wherein, The first network device obtains a first data packet, comprising: The first network device receives a second data packet sent by a second network device, the second network device being a forwarding device located between the first network device and the terminal device, the second data packet comprising a second data packet header and the first data packet, the second data packet header comprising tunnel information, and a tunnel corresponding to the tunnel information being used for forwarding the second data packet; 10. The method of claim 8, wherein, ​ ​ The first network device obtains the first data packet from the second data packet.

11. The method according to any one of claims 8 to 10, characterized in that, The first network device determines, according to the first data packet, that the first data packet is a data packet sent by a terminal device, including: The first network device processes the first data packet to obtain the first information, the second information and the third information. The first network device performs security check on the first data packet according to the third information, and determines that the first data packet passes the security check.

12. The method of claim 10, wherein, The second data packet header further includes the second field.

13. The method according to any one of claims 8 to 10, characterized in that, The first identity information includes a first identity and a first key identifier, the first identity is used to uniquely identify the identity of the terminal device, and the first key identifier is used to uniquely identify a first key, and the first key is used to encrypt, decode and perform security check on the payload of the first data packet.

14. The method according to any one of claims 8 to 10, characterized in that, The first field is an Internet Protocol (IP) address field.

15. The method according to any one of claims 8 to 10, characterized in that, The first field is a specific field of the first data packet header.

16. The method of claim 15, wherein, The specific field is an option field or an extension field.

17. The method according to any one of claims 8 to 10, characterized in that, The second field is a secure channel identifier (SCI) field in a security header (SecTAG) field, and the SCI field has a mapping relationship with the third information.

18. The method according to any one of claims 8 to 10, characterized in that, The first data packet includes a first data packet header, and the first data packet header includes the first field and the second field.

19. A terminal device, comprising: including: The processor is coupled with the memory, reads and executes instructions and / or program codes in the memory, and performs the method in any one of claims 1-7.

20. A first network device, comprising: including: The processor is coupled with the memory, reads and executes instructions and / or program codes in the memory, and performs the method in any one of claims 8-18.

21. A computer-readable storage medium, characterized in that, The computer program, when running on a computer, causes the computer to perform the method in any one of claims 1-18.

22. A chip system, characterized by including: The logic circuit is coupled with the input / output interface, transmits data through the input / output interface, and performs the method in any one of claims 1-18.

23. A system, comprising: The system includes a terminal device and a first network device, the terminal device is configured to perform the method in any one of claims 1-7, and the first network device is configured to perform the method in any one of claims 8-18.

Images