Data transmission method, system, device and storage medium

Abstract

The present invention discloses a data transmission method, system, device, and storage medium. The method includes: determining the data type and return direction of data to be returned in a current return scenario, wherein the return scenario includes an independent return scenario or a shared return scenario; determining a return mode for the data to be returned based on the data type and return direction; and transmitting the data to be returned based on the return mode. This method achieves secure return of gateway data in different scenarios.

Description

Technical Field

[0001] The present invention relates to the field of data transmission technology, and in particular to a data transmission method, system, device and storage medium. Background Art

[0002] The rapid advancement of communications and information technology, particularly software-defined networking and software-defined radio, has enabled a single gateway device to possess powerful multi-mode and multi-standard communication capabilities. This has led to a demand for diverse and differentiated data transmitted by the gateway. This data is often transmitted over public networks, where plaintext data can be eavesdropped and quickly analyzed to extract important information, posing security risks. Existing gateway IPsec (Internet Protocol Security), a network security protocol suite, implements IPsec by setting up encrypted channels and selecting between encrypted and unencrypted channels for secure data transmission based on the data being transmitted. However, most existing gateway encryption technologies address single-mode scenarios, specifically focusing on establishing IPsec channels and encrypting data transmission within these scenarios. This limited scope of application makes them unsuitable for existing multi-mode and multi-standard scenarios. Summary of the Invention

[0003] The embodiments of the present application provide a data transmission method, system, device and storage medium to achieve secure backhaul of gateway data in different scenarios.

[0004] An embodiment of the present application provides a data transmission method, the data transmission method comprising:

[0005] Determine the data type and return direction of the data to be returned in the current return scenario, wherein the return scenario includes an independent return scenario or a joint return scenario;

[0006] Determining a return method for the data to be returned based on the data type and the return direction;

[0007] Based on the return mode, the data to be returned is transmitted.

[0008] Optionally, before the step of determining a return mode for the data to be returned based on the data type and the return direction, the method further includes:

[0009] The 5G processing unit or the 4G processing unit obtains the key information and the channel address generated by the successful establishment of the IPSec channel sent by the OAM module;

[0010] In the independent backhaul scenario, the 5G processing unit or the 4G processing unit generates a hash table corresponding to the encryption session and the decryption session according to the key information and the channel address generated by the successful establishment of the IPSec channel;

[0011] In the common backhaul scenario, the 5G processing unit establishes the channel address successfully generated based on the key information and the IPSec channel, generates a hash table corresponding to the encryption session and the decryption session, and saves the negotiation address corresponding to the 4G processing unit.

[0012] Optionally, the data to be returned includes 4G data or 5G data, and the return direction includes an uplink direction or a downlink direction. In the independent return scenario, the step of determining a return mode for the data to be returned based on the data type and the return direction includes:

[0013] When the data type is 4G data or 5G data and the return direction is uplink, after looking up the hash table according to the source address to obtain the corresponding encryption session, the data to be returned is encrypted through the encryption session; or

[0014] When the data type is 4G data or 5G data and the return direction is the downlink direction, after the corresponding decryption session is obtained by looking up the hash table according to the security parameter index, the data to be returned is decrypted through the decryption session.

[0015] Optionally, the data to be returned includes 4G data or 5G data, and the return direction includes an uplink direction or a downlink direction. In the common return scenario, the step of determining a return mode for the data to be returned based on the data type and the return direction includes:

[0016] When the data type is 4G data and the return direction is an uplink direction, the 4G processing unit constructs an inner address packet according to the negotiated address and sends it to the 5G processing unit. The 5G processing unit searches the hash table based on the inner address packet to obtain a corresponding encryption session, and encrypts the data to be returned through the encryption session; or

[0017] When the data type is 4G data and the return direction is downlink, the 5G processing unit searches the hash table according to the security parameter index to obtain the corresponding decryption session, decrypts the data to be returned through the decryption session, and then sends the decrypted data to the 4G processing unit; or

[0018] When the data type is 5G data and the return direction is an uplink direction, the 5G processing unit constructs an inner address packet according to the negotiated address, searches a hash table based on the inner address packet to obtain a corresponding encryption session, and encrypts the data to be returned through the encryption session; or

[0019] When the data type is 5G data and the return direction is the downlink direction, the 5G processing unit searches the hash table according to the security parameter index to obtain the corresponding decryption session, decrypts the data to be returned through the decryption session, and sends it to the 4G processing unit.

[0020] Optionally, the data transmission method further includes:

[0021] Set the re-authentication time or IPSec re-negotiation time in each encryption channel;

[0022] When the re-authentication time or the re-negotiation time is reached, the key information is updated.

[0023] Optionally, after generating the hash tables corresponding to the encryption session and the decryption session, the method further includes:

[0024] Based on the negotiated address, a deletion instruction of an uplink security policy or a deletion instruction of a downlink security policy is sent to the OAM module.

[0025] Optionally, based on the return mode, the step of transmitting the data to be returned includes:

[0026] Determine the network port and security gateway for the data to be returned according to the return method;

[0027] Establishing an IPSec channel between the network port and the security gateway;

[0028] Based on the IPSec channel, the data to be returned is transmitted between the dual-mode gateway and the security gateway.

[0029] In addition, to achieve the above object, the present invention further provides a data transmission system comprising:

[0030] A first determining module is configured to determine a data type and a return direction of the data to be returned in a current return scenario, wherein the return scenario includes an independent return scenario or a common return scenario;

[0031] A second determining module is used to determine a return mode of the data to be returned according to the data type and the return direction;

[0032] The transmission module is used to transmit the data to be returned based on the return mode.

[0033] In addition, to achieve the above-mentioned purpose, the present invention also provides a data transmission device including: a memory, a processor, and a data transmission program stored on the memory and runnable on the processor, wherein the data transmission program implements the steps of the above-mentioned data transmission method when executed by the processor.

[0034] In addition, to achieve the above-mentioned purpose, the present invention also provides a storage medium on which a data transmission program is stored, and when the data transmission program is executed by a processor, the steps of the above-mentioned data transmission method are implemented.

[0035] A technical solution of a data transmission method, system, device and storage medium provided in the embodiments of the present application determines the return mode of the data to be returned according to the data type and return direction of the data to be returned in different return scenarios, and then transmits the data to be returned based on the return mode, thereby realizing the transmission of the data to be returned in different scenarios. BRIEF DESCRIPTION OF THE DRAWINGS

[0036] Figure 1 This is a flow chart of a first embodiment of a data transmission method according to the present invention;

[0037] Figure 2 This is a functional module diagram of the data transmission system of the present invention;

[0038] Figure 3 This is a schematic structural diagram of the data transmission device of the present invention;

[0039] Figure 4 This is a flow chart of the independent backhaul scenario of the present invention;

[0040] Figure 5 This is a flow chart of the present invention in a common backhaul scenario.

[0041] The realization of the purpose, functional features and advantages of this application will be further explained in conjunction with the embodiments and with reference to the accompanying drawings. The above-mentioned drawings are only an embodiment diagram, not the entire invention. DETAILED DESCRIPTION

[0042] The rapid advancement of communications and information technology, particularly software-defined networking and software-defined radio, has enabled a single gateway device to offer powerful multi-mode and multi-standard communication capabilities (Wife, WiMAX, 4G / 5G TDD, 4G / 5G FDD, Ad-Hoc, and more). This has led to a demand for diverse and differentiated data transported by gateways. This data is typically transmitted over public networks. However, the rapid development of information technology, particularly big data and artificial intelligence, and the resulting increases in computing power and algorithm efficiency, has enabled the theft of plaintext data on the link and the rapid analysis and extraction of important information, posing certain security risks. In some security-critical communication scenarios, some data requires encrypted transmission and cannot remain in plaintext on the backhaul network. Typically, data security processing on such gateways is handled as a client, while a security gateway in the core network equipment room aggregates the uplink encrypted traffic from various gateways, typically acting as a server. For encrypted communication between gateways, gateways supporting IPSec are a cost-effective solution.

[0043] Most existing gateway encryption communication technologies address single-mode scenarios, specifically the IPSec channel establishment and data encryption transmission processes within the gateway. This limited scope of application prevents them from adapting to existing multi-mode and multi-standard scenarios. Furthermore, existing gateway IPSec technologies implement IPSec by setting up encrypted channels and then selecting encrypted and unencrypted channels for secure data transmission based on the data being transmitted. This approach still fails to address the issue of transmitting data across different standards within encrypted channels.

[0044] This application is designed for current multi-mode and multi-standard communication scenarios from multiple perspectives, such as data processing and encryption channel establishment on the signaling and data planes, and transmission of multi-standard communication data in encrypted channels, to achieve secure data backhaul of gateways in multi-mode scenarios. Specifically, this application not only provides a signaling-plane IPSec channel establishment method, but also provides a data-plane transmission method. For 4G and 5G dual-mode scenarios with multiple network ports, multiple IPs, and multiple gateways, this application provides a signaling-plane channel establishment method and a data-plane transmission method for multiple IPSec channels. The establishment process is simpler and faster, and it solves the problem of NAT bidirectional traversal. Compared with the existing technology, this invention has the following technical advantages:

[0045] 1) The existing technology is mainly aimed at single-mode gateways. The present invention is aimed at 4G and 5G dual-mode gateways, which can simultaneously meet the secure transmission of 4G and 5G backhaul data;

[0046] 2) The 4G and 5G dual-mode gateway of this application requires the establishment of multiple IPSec channels. Compared with the data backhaul of a single IPSec channel, the multiple IPSec channels not only require the creation of IPSec channels for the signaling plane, but also involve the data plane and signaling interaction process and data plane forwarding. The establishment and data backhaul method of multiple IPSec channels has a wider range of applications than the data backhaul of a single IPSec channel.

[0047] 3) The dual-mode gateway designed in this application provides a signaling-plane channel establishment method and a data-plane transmission method for multiple IPSec channels for the multi-network port, multi-IP, and multi-gateway scenarios of 4G and 5G dual modes, meeting the data security transmission requirements in a variety of complex networking scenarios. The establishment process is simpler and faster, and solves the problem of NAT bidirectional traversal.

[0048] To better understand the above technical solutions, exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments described herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0049] The system architecture of the data transmission method of the present application includes a dual-mode gateway unit, a security gateway unit, and a core network unit. The following will introduce each component of the system architecture in detail:

[0050] Dual-mode gateway unit: The 4G processing unit and the 5G processing unit run simultaneously, and the dual-mode gateway unit has multiple backhaul network ports. The backhaul methods corresponding to the data to be backhauled are different in different scenarios. Whether in an independent backhaul scenario or a common backhaul scenario, the dual-mode gateway unit can establish Xn link IPSec channels with the security gateway, and will not interfere with other IPSec channels. The dual-mode gateway unit can act as an IPSec client or server. The above descriptions are all usage scenarios as a client. When acting as a client, it establishes an IPSec channel with the security gateway or other gateways. When acting as a server, other gateways establish Xn link IPSec channels with this dual-mode gateway unit. After the channel is successfully established, it encrypts the uplink data sent to other gateways or core networks, or decrypts the downlink data received from other gateways or core networks.

[0051] Security gateway unit: As the IPSec server, it is responsible for establishing an IPSec channel with the dual-mode gateway unit, receiving unencrypted data from the core network, encrypting it and forwarding it to the dual-mode gateway unit, receiving encrypted data from the dual-mode gateway unit, decrypting it and forwarding it to the core network.

[0052] Core network unit: receives unencrypted signaling plane data and data plane data from or sent to the security gateway.

[0053] like Figure 1 As shown, in the first embodiment of the present application, the data transmission method of the present application is applied to a 5G processing unit or a 4G processing unit, and the data transmission method of the present application specifically includes the following steps:

[0054] Step S110 , determining the data type and return direction of the data to be returned in the current return scenario, wherein the return scenario includes an independent return scenario or a common return scenario.

[0055] In this embodiment, the data type of the data to be returned includes 4G data or 5G data, and the return direction includes an uplink direction or a downlink direction. If the 5G processing unit or the 4G processing unit acts as a client and the security gateway acts as a server, the uplink direction is the direction in which the 5G processing unit or the 4G processing unit uploads the data to be returned to the security gateway, and the downlink direction is the direction in which the security gateway downloads the data to be returned to the 5G processing unit or the 4G processing unit.

[0056] Step S120: Determine a return method for the data to be returned according to the data type and the return direction.

[0057] In this embodiment, different backhaul scenarios correspond to different backhaul methods. In different backhaul scenarios, different data types and backhaul directions correspond to different backhaul methods for the data to be backhauled.

[0058] Optionally, based on the return mode, a network port and a security gateway for the data to be returned can be determined; an IPSec channel can be established between the network port and the security gateway; and based on the IPSec channel, the data to be returned can be transmitted between the dual-mode gateway and the security gateway. The dual-mode gateway unit has multiple network ports.

[0059] In the independent backhaul scenario, the dual-mode gateway unit can use two different network ports and one security gateway or two security gateways to establish two IPSec encrypted channels. For example, 5G data is backhauled through the IPSec1 encrypted channel of network port 1, and 4G data is backhauled through the IPSec2 encrypted channel of network port 2.

[0060] Exemplarily, the return method of the data to be returned includes:

[0061] (1) The 5G processing unit uses network port 1 and security gateway 1 to establish an IPSec1 channel.

[0062] (2) The 4G processing unit uses network port 2 and security gateway 2 to establish an IPSec2 channel.

[0063] (3) The 5G processing unit uses network port 1 and security gateway 1 to establish an IPSec1 channel, and the 4G processing unit uses network port 2 and security gateway 1 to establish an IPSec2 channel. It should be noted that in the independent backhaul scenario, the 4G processing unit and the 5G processing unit do not interfere with each other in the encryption and decryption of the backhaul data, and the data is backhauled from their respective network ports.

[0064] In the common backhaul scenario, the dual-mode gateway unit can establish an IPSec encryption channel through an address of the same network port and a security gateway, and the 4G processing unit and 5G processing unit share this encryption channel for backhaul data; in addition, the dual-mode gateway unit can establish two IPSec encryption channels IPSec1 and IPSec2 through an address of the same network port and a security gateway or two security gateways. Among them, 5G data is backhauled through the IPSec1 encryption channel of network port 1, and 4G data is backhauled through the IPSec2 encryption channel of network port 2.

[0065] Based on the above technical solution, this application can realize high-security encrypted communication in various ways in the backhaul link of 4G and 5G dual-mode gateways.

[0066] Step S130: transmitting the data to be returned based on the return method.

[0067] In this embodiment, after determining the corresponding backhaul method for either the independent or shared backhaul scenario, the data to be backhauled is transmitted. Different backhaul methods correspond to different IPSec channels and network ports for the data to be backhauled. A network port refers to a physical interface or port in a computer network that connects to a wide area network.

[0068] According to the above technical solution, this embodiment determines the return mode of the data to be returned according to the data type and return direction of the data to be returned in different return scenarios, and then transmits the data to be returned based on the return mode, thereby realizing the transmission of the data to be returned in different scenarios.

[0069] In one embodiment, referring to Figure 4 In an independent return scenario, before determining the return mode of the data to be returned according to the data type and the return direction, the method further includes the following steps:

[0070] In step S210, the 5G processing unit or the 4G processing unit obtains the key information and the channel address generated by the successful establishment of the IPSec channel sent by the OAM module;

[0071] Step S220: In the independent backhaul scenario, the 5G processing unit or the 4G processing unit generates a hash table corresponding to the encryption session and the decryption session according to the key information and the channel address generated by the successful establishment of the IPSec channel;

[0072] In this embodiment, after the dual-mode gateway unit calls the driver interface to obtain key information, it then determines the IPSec channel to which the key information belongs, based on the information sent by the OAM module to the 5G processing unit or the 4G processing unit. The 5G processing unit or the 4G processing unit then establishes an encrypted or decrypted QAT session, and the corresponding information is stored in a hash table.

[0073] The OAM module's processing unit is independent of the 5G processing unit or the 4G processing unit and does not interfere with each other. An IPSec QAT session is a session created when performing IPsec operations using the QAT hardware acceleration engine. IPSec is a security protocol used to protect network communications, ensuring data confidentiality, integrity, and reliability through encryption and authentication mechanisms. QAT is a hardware acceleration technology that can improve the performance and efficiency of IPsec operations. When using IPSec QAT for encryption and decryption operations, a session is created to manage and execute the corresponding tasks. An IPSec QAT session stores parameters and context information related to IPsec operations, including encryption algorithms, key material, encryption modes, authentication algorithms, and more. When used in conjunction with the QAT hardware accelerator, an IPSec QAT session can significantly improve IPsec operation performance and reduce the burden on the main processor. Session creation involves passing relevant parameters to the QAT hardware accelerator and obtaining a session identifier for subsequent encryption and decryption operations. When using an IPSec QAT session for IPsec operations, the session identifier is used to reference and manage the specific session, ensuring the correct application of encryption and authentication algorithms while providing efficient hardware acceleration. In summary, an IPSec QAT session is created when using the QAT hardware acceleration engine for IPsec operations. It manages related parameters and context information and improves IPsec performance by working with the QAT hardware accelerator. It is a crucial component in ensuring data security.

[0074] Furthermore, the data to be returned includes 4G data or 5G data, and the return direction includes an uplink direction or a downlink direction. In the independent return scenario, the step of determining the return mode of the data to be returned based on the data type and the return direction includes:

[0075] Step S121, when the data type is 4G data or 5G data and the return direction is uplink, after looking up the hash table according to the source address to obtain the corresponding encryption session, encrypt the data to be returned through the encryption session;

[0076] In this embodiment, the 4G uplink channel includes non-encrypted address data. After the corresponding IPSec channel information and outer layer related packet assembly information are obtained by searching the hash table according to the source address, they are packaged and then sent out through the network port after encryption is completed by the corresponding QAT session.

[0077] Alternatively, in step S122, when the data type is 4G data or 5G data and the return direction is the downlink direction, after obtaining the corresponding decryption session by looking up the hash table according to the security parameter index, the data to be returned is decrypted through the decryption session.

[0078] In this embodiment, for 4G downlink data, the SPI value (i.e., security parameter index) in the encrypted packet esp header is used to determine whether it is an IPSec signaling packet. If it is a signaling packet, no decryption is performed. If it is not a signaling packet, the hash table is searched based on the SPI value to obtain the corresponding QAT session and corresponding information for decryption, which are then decrypted and unpacked and sent to other units for processing.

[0079] The SPI value is the Security Parameter Index. It is used to identify and distinguish different security associations in IPsec. In IPsec, a security association is a set of communicating pairs that share the same security policy. Each security association has a unique SPI value to identify and distinguish it. The SPI value is a 32-bit integer assigned to devices initiating and receiving IPsec communications to help them correctly select and apply encryption and authentication algorithms. When a device receives an IPsec packet, it examines the SPI value in the packet header and uses it to determine how to process the packet. The SPI value plays an important role in IPsec tunnel mode and transport mode. In tunnel mode, the SPI value identifies different IPsec tunnels to correctly encrypt and decrypt the entire IP packet. In transport mode, the SPI value identifies different security associations to ensure the correct selection and application of encryption and authentication algorithms. The SPI value is configured by the network administrator and negotiated and exchanged between IPsec devices. By using unique SPI values, IPsec can efficiently manage and handle multiple security associations while ensuring security and data integrity. In summary, the SPI value is a 32-bit integer used to identify and distinguish security associations in IPsec. It is used to select and apply encryption and authentication algorithms to ensure data security and integrity.

[0080] In computer networks, ESP is part of the IPsec protocol suite, used to provide confidentiality, integrity, and authentication. ESP encapsulates IP packets above the transport layer and protects data security through encryption and authentication algorithms.

[0081] In this embodiment, the uplink and downlink data of 5G are processed in the same way as 4G and will not be described in detail.

[0082] According to the above technical solution, the dual-mode gateway designed by this application provides a signaling-plane channel establishment method and a data-plane transmission method for multiple IPSec channels for the multi-network port, multi-IP, and multi-gateway scenarios of 4G and 5G dual modes, meeting the data security transmission requirements in independent backhaul scenarios. The establishment process is simpler and faster, and solves the problem of NAT bidirectional traversal.

[0083] In one embodiment, referring to Figure 5 In a common backhaul scenario, before determining the backhaul method of the data to be backhauled according to the data type and the backhaul direction, the method further includes the following steps:

[0084] In step S210, the 5G processing unit or the 4G processing unit obtains the key information and the channel address generated by the successful establishment of the IPSec channel sent by the OAM module;

[0085] Step S230: In the common backhaul scenario, the 5G processing unit establishes the channel address successfully generated based on the key information and the IPSec channel, generates a hash table corresponding to the encryption session and the decryption session, and saves the negotiation address corresponding to the 4G processing unit.

[0086] In this embodiment, after the 5G processing unit or 4G processing unit calls the driver interface to obtain key information, it then determines the IPSec link to which the key information belongs, based on the information sent to it by the OAM module. Combining the information obtained from both the driver and the OAM module, the 5G processing unit saves the negotiated address corresponding to the 4G processing unit and creates a corresponding QAT session. It is important to note that when the 4G processing unit identifies a shared backhaul scenario, it does not need to create a QAT session or the corresponding hash table.

[0087] Furthermore, the data to be returned includes 4G data or 5G data, and the return direction includes an uplink direction or a downlink direction. In the common return scenario, the step of determining the return mode of the data to be returned based on the data type and the return direction includes:

[0088] In step S123, when the data type is 4G data and the return direction is the uplink direction, the 4G processing unit constructs an inner address packet according to the negotiated address and sends it to the 5G processing unit. The 5G processing unit searches the hash table based on the inner address packet to obtain the corresponding encryption session, and encrypts the data to be returned through the encryption session.

[0089] In this embodiment, 4G uplink data is assembled into an inner-address packet based on the negotiated address sent to the 4G processing unit by its corresponding OAM module. This inner-address packet is then handed off to the 5G processing unit. The 5G processing unit retains the negotiated address of the 4G processing unit and uses this negotiated address to look up the hash table, find the corresponding QAT session, and assemble the packet header information, which is then encrypted and sent out.

[0090] Alternatively, in step S124, when the data type is 4G data and the return direction is the downlink direction, the 5G processing unit searches the hash table according to the security parameter index to obtain the corresponding decryption session, decrypts the data to be returned through the decryption session, and sends it to the 4G processing unit.

[0091] In this embodiment, upon receiving 4G downlink data, the 5G processing unit determines whether it is an IPSec signaling packet based on the SPI value in the encrypted packet's ESP header. If it is, decryption is not performed. If not, the SPI value is used to search the hash table, obtain the corresponding QAT session and corresponding information, and decrypt and unpack the packet. After successful decryption, the packet is sent to the 4G processing unit.

[0092] Alternatively, in step S125, when the data type is 5G data and the return direction is the uplink direction, the 5G processing unit forms an inner address packet according to the negotiated address, searches the hash table based on the inner address packet to obtain the corresponding encryption session, and encrypts the data to be returned through the encryption session.

[0093] In this embodiment, 5G uplink data is packaged into inner-layer addresses based on the negotiation address sent to the 5G processing unit by its corresponding OAM module. The 5G processing unit retains the negotiation address of the 4G processing unit and uses this negotiation address to look up the hash table, find the corresponding QAT session and packet header information, assemble the packets, and send them directly after encryption.

[0094] Alternatively, in step S126, when the data type is 5G data and the return direction is the downlink direction, the 5G processing unit searches the hash table according to the security parameter index to obtain the corresponding decryption session, decrypts the data to be returned through the decryption session, and sends it to the 4G processing unit.

[0095] In this embodiment, after the 5G downlink data is received by the 5G processing unit, it is determined whether it is an IPSec signaling packet based on the ESP header SPI value. If it is a signaling packet, no decryption is performed. If it is not a signaling packet, the hash table is searched according to the SPI value to obtain the corresponding QAT session and corresponding information for decryption. After successful decryption, it is sent to other processing units.

[0096] According to the above technical solution, the dual-mode gateway designed by this application provides a signaling-plane channel establishment method and a data-plane transmission method for multiple IPSec channels for the multi-network port, multi-IP, and multi-gateway scenarios of 4G and 5G dual modes, meeting the data security transmission requirements in the common backhaul scenario. The establishment process is simpler and faster, and solves the problem of NAT bidirectional traversal.

[0097] In one embodiment, the process of establishing an IPSec channel includes the interaction between the processing unit, the driver, and the OAM module. Specifically, it includes:

[0098] Before running the processing unit, the relevant parameters have been configured on the web management interface. The OAM module reads the web parameters into the relevant files. The OAM module needs to check the network port link status before starting the IPSec establishment process. If normal, it will send the IPSec parameters to the processing unit and wait for the response from the processing unit. Determine whether a response from the processing unit is received. If a response is received, the OAM module starts strongswan to establish the IPSec channel. The OAM module calls the driver interface to determine whether the IPSec channel is successfully established. If it is successfully established, the OAM module sends the IPSec negotiation success mark and negotiation address to the IPSEC processing unit and other processing units. In addition, the IPSec link is maintained periodically. If the link fails, the relevant professionals are informed and the relevant professionals reclaim the corresponding resources.

[0099] It should be emphasized that the re-authentication OAM module process is consistent with the above process, while IPSec re-negotiation does not involve the above process of the OAM module.

[0100] After receiving the IPSec parameters, the IPSEC processing unit identifies that it is in IPSec mode, configures the network card diversion rules, and initializes other IPSEC processing units in IPSec mode. It calls the driver interface to obtain IPSec key information, wherein the driver interface is a blocking type. This driver interface needs to be called before the OAM module starts IPSec. The IPSEC processing unit receives the negotiation success flag and negotiation address sent by the OAM module. The IPSEC processing unit combines the key information obtained from the driver and the information obtained from the OAM module to create a QAT session and hash table, and is ready.

[0101] Optionally, the IPSEC processing unit (5G processing unit or 4G processing unit) sends an uplink security policy deletion instruction or a downlink security policy deletion instruction to the OAM module based on the negotiated address. Specifically, the IPSEC processing unit needs to request the OAM module to delete the strongswan kernel encryption policy based on the negotiated address. In the technical solution, all data is uniformly encrypted and decrypted by the QAT session. Therefore, strongswan needs to delete this policy to ensure that kernel data is unencrypted.

[0102] It's important to note that the reauthentication process for the IPSEC processing unit is essentially the same as described above. The difference is that when creating a new QAT session, the old corresponding resources must be recycled and deleted, and a new hash table must be created. During IPSec renegotiation, after the driver obtains the corresponding new key information, it first recycles and deletes the old corresponding resources, then creates a new QAT session and updates the corresponding hash table. At the same time, it requests the OAM module to delete the corresponding strongswan security policy. This security policy includes either an uplink security policy or a downlink security policy.

[0103] StrongSwan, an open-source IPsec implementation, is used to establish and manage virtual private network (VPN) connections. It provides a secure communication method, creating encrypted tunnels over untrusted networks and ensuring confidentiality, integrity, and authentication of data transmission. StrongSwan supports the IPsec protocol suite and runs on multiple operating systems, including Linux, FreeBSD, Mac OS X, and Android. Using StrongSwan, VPN connections can be easily configured and managed, providing encrypted communication between internal and external network segments within an organization. It supports a variety of IPsec configuration scenarios, including site-to-site VPNs, remote access VPNs, and router-to-router VPNs. StrongSwan offers flexible configuration options and is highly customizable. It supports a variety of authentication methods, encryption algorithms, and key exchange protocols, enabling users to configure and deploy it based on their security needs. In summary, StrongSwan is open-source software for establishing and managing IPsec VPN connections. It provides a secure communication method that ensures confidentiality, integrity, and authentication of data transmission. With StrongSwan, users can easily configure and manage VPN connections to meet the secure communication needs of various scenarios.

[0104] Optionally, in order to ensure the security of the returned data, a re-authentication time or an IPSec re-negotiation time is set in each encryption channel; when the re-authentication time or the re-negotiation time is reached, the key information is updated.

[0105] The embodiments of the present invention provide embodiments of the data transmission method. It should be noted that although a logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in an order different from that shown here.

[0106] like Figure 2 As shown, the present application provides a data transmission system, comprising:

[0107] A first determining module 10 is configured to determine the data type and return direction of the data to be returned in a current return scenario, wherein the return scenario includes an independent return scenario or a common return scenario;

[0108] A second determining module 20 is configured to determine a return mode for the data to be returned based on the data type and the return direction;

[0109] The transmission module 30 is configured to transmit the data to be returned based on the return mode.

[0110] The specific implementation of the data transmission system of the present invention is basically the same as the various embodiments of the above-mentioned data transmission method, and will not be repeated here.

[0111] As an implementation method, the hardware environment architecture involved in the data transmission method can be as follows: Figure 3 shown.

[0112] Optionally, the hardware architecture involved in the data transmission method includes a data transmission device. As an implementation, the data transmission device includes a processor 101, such as a CPU, a memory 102, and a communication bus 103. Communication bus 103 is used to enable communication between these components. Processor 101 is used to invoke an application to execute control operations.

[0113] The memory 102 may be a high-speed RAM memory or a stable memory such as a disk memory.

[0114] It can be understood that, in one embodiment, the data transmission program is stored in the memory 102 or in a computer-readable storage medium. When the processor 101 calls the data transmission program from the memory 102 or the computer-readable storage medium, it performs the following operations:

[0115] Determine the data type and return direction of the data to be returned in the current return scenario, wherein the return scenario includes an independent return scenario or a joint return scenario;

[0116] Determining a return method for the data to be returned based on the data type and the return direction;

[0117] Based on the return mode, the data to be returned is transmitted.

[0118] Based on the same inventive concept, an embodiment of the present application also provides a computer-readable storage medium, which stores a data transmission program. When the data transmission program is executed by a processor, it implements the various steps of the data transmission method described above and can achieve the same technical effect. To avoid repetition, it will not be repeated here.

[0119] Since the storage medium provided in the embodiments of this application is the storage medium used to implement the method of the embodiments of this application, those skilled in the art will be able to understand the specific structure and variations of the storage medium based on the method described in the embodiments of this application, and therefore will not be described in detail here. All storage media used in the method of the embodiments of this application fall within the scope of protection to be provided by this application.

[0120] It should be noted that, in this document, the terms "comprise," "include," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or system comprising a list of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or system. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not preclude the presence of other identical elements in the process, method, article, or system comprising the element.

[0121] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0122] Through the description of the above embodiments, those skilled in the art can clearly understand that the above embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) as described above, and includes a number of instructions for enabling a terminal device (which can be a mobile phone, computer, server, TV, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0123] The above are only preferred embodiments of the present invention and are not intended to limit the patent scope of the present invention. Any equivalent structure or equivalent process transformation made using the contents of the present invention description and drawings, or directly or indirectly applied in other related technical fields, are also included in the patent protection scope of the present invention.

Claims

1. A data transmission method, applied to a dual-mode gateway unit, i.e., a 5G processing unit or a 4G processing unit, characterized in that: The data transmission method includes: S1: Obtain the key information and the channel address generated by the successful IPSec channel establishment sent by the OAM module; S2: Determine the data type and return direction of the data to be returned in the current return scenario, and determine the return method of the data to be returned based on the data type and the return direction, specifically including: In the common backhaul scenario, the dual-mode gateway unit establishes an IPSec encrypted channel through an address of the same network port and a security gateway, or establishes two IPSec encrypted channels through an address of the same network port and two security gateways; In the common backhaul scenario, the 5G processing unit generates an encrypted QAT session, a decrypted QAT session and a corresponding hash table according to the key information and the channel address, and saves the negotiation address corresponding to the 4G processing unit; when the data type is 4G data and the backhaul direction is the uplink direction, the 4G processing unit constructs an inner address packet according to the negotiation address and sends it to the 5G processing unit, and the 5G processing unit searches the hash table based on the inner address packet to obtain the corresponding encrypted QAT session, and encrypts the data to be backhauled through the encrypted QAT session; in the When the data type is 4G data or 5G data and the return direction is downlink, the 5G processing unit searches the hash table according to the SPI value of the encrypted packet ESP header to obtain the corresponding decryption QAT session, decrypts the data to be returned through the decryption QAT session, and sends it to the 4G processing unit; when the data type is 5G data and the return direction is uplink, the 5G processing unit constructs an inner address packet according to the negotiated address, searches the hash table based on the inner address packet to obtain the corresponding encryption QAT session, and encrypts the data to be returned through the encryption QAT session; If the dual-mode gateway unit acts as a client and the security gateway acts as a server, the uplink direction is the direction in which the client uploads the data to be returned to the server, and the downlink direction is the direction in which the server downloads the data to be returned to the client; S3: According to the return mode, an IPSec channel is established between the network port and the security gateway, and the data to be returned is transmitted between the dual-mode gateway and the security gateway.

2. The data transmission method according to claim 1, wherein: If the current backhaul scenario is an independent backhaul scenario, determining the data type and backhaul direction of the data to be backhauled in the current backhaul scenario, and determining the backhaul method of the data to be backhauled based on the data type and the backhaul direction, specifically includes: In the independent backhaul scenario, the dual-mode gateway unit can establish two IPSec encrypted channels using two different network ports and one security gateway or two security gateways; In the independent backhaul scenario, generating an encrypted QAT session, a decrypted QAT session, and a corresponding hash table according to the key information and the channel address; When the return direction is the uplink direction, after obtaining the corresponding encryption QAT session according to the source address, the data to be returned is encrypted through the encryption QAT session; or, when the return direction is the downlink direction, after looking up the hash table according to the SPI value of the encrypted packet ESP header to obtain the corresponding decryption QAT session, the data to be returned is decrypted through the decryption QAT session.

3. The data transmission method according to claim 1, wherein: The data transmission method further includes: Set the re-authentication time or IPSec re-negotiation time in each encryption channel; When the re-authentication time or the re-negotiation time is reached, the key information is updated.

4. The data transmission method according to claim 1, wherein: After generating the encrypted QAT session, the decrypted QAT session and the corresponding hash table, the method further includes: Based on the negotiated address, a deletion instruction of an uplink security policy or a deletion instruction of a downlink security policy is sent to the OAM module.

5. A data transmission system, characterized in that: Applied to a dual-mode gateway unit, i.e., a 5G processing unit or a 4G processing unit, the data transmission system includes: The determination module is used to obtain the key information and the channel address generated by the successful establishment of the IPSec channel sent by the OAM module; Determining the data type and return direction of the data to be returned in the current return scenario, and determining the return method of the data to be returned based on the data type and the return direction, specifically including: In the common backhaul scenario, the dual-mode gateway unit establishes an IPSec encrypted channel through an address of the same network port and a security gateway, or establishes two IPSec encrypted channels through an address of the same network port and two security gateways; In the common backhaul scenario, the 5G processing unit generates an encrypted QAT session, a decrypted QAT session and a corresponding hash table according to the key information and the channel address, and saves the negotiation address corresponding to the 4G processing unit; when the data type is 4G data and the backhaul direction is the uplink direction, the 4G processing unit constructs an inner address packet according to the negotiation address and sends it to the 5G processing unit, and the 5G processing unit searches the hash table based on the inner address packet to obtain the corresponding encrypted QAT session, and encrypts the data to be backhauled through the encrypted QAT session; in the When the data type is 4G data or 5G data and the return direction is downlink, the 5G processing unit searches the hash table according to the SPI value of the encrypted packet ESP header to obtain the corresponding decryption QAT session, decrypts the data to be returned through the decryption QAT session, and sends it to the 4G processing unit; when the data type is 5G data and the return direction is uplink, the 5G processing unit constructs an inner address packet according to the negotiated address, searches the hash table based on the inner address packet to obtain the corresponding encryption QAT session, and encrypts the data to be returned through the encryption QAT session; If the dual-mode gateway unit acts as a client and the security gateway acts as a server, the uplink direction is the direction in which the client uploads the data to be returned to the server, and the downlink direction is the direction in which the server downloads the data to be returned to the client; The transmission module is used to establish an IPSec channel between the network port and the security gateway according to the return mode, and transmit the data to be returned between the dual-mode gateway and the security gateway.

6. A data transmission device, characterized in that: The data transmission device includes: a memory, a processor, and a data transmission program stored in the memory and executable on the processor. When the data transmission program is executed by the processor, the steps of the data transmission method according to any one of claims 1 to 4 are implemented.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a data transmission program, and when the data transmission program is executed by a processor, the steps of the data transmission method according to any one of claims 1 to 4 are implemented.

Images