A message processing method, apparatus, electronic device, and storage medium

Abstract

This invention discloses a message processing method, apparatus, electronic device, and storage medium. The method includes: acquiring traffic data transmitted by a client; performing traffic data splitting based on identification data carried by the traffic data; dividing the traffic data into messages to be desealed and messages to be encapsulated; determining the message type of the messages to be desealed based on the flag bits of the messages to be desealed; performing a first port conversion process on the messages to be desealed that are session data messages, converting the destination port of the messages to be desealed from the source format to the target format; performing desealing processing on the messages to be desealed in the target format to obtain desealed messages; performing destination network address translation on the messages to be desealed to obtain preprocessing messages; performing encapsulation processing on the preprocessing messages to obtain encapsulated messages; and performing a second port conversion process on the encapsulated messages, converting the destination port of the encapsulated messages from the target format to the source format. This invention can efficiently process messages and can be widely applied in the field of data processing technology.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a message processing method, apparatus, electronic device, and storage medium. Background Technology

[0002] L2TP tunneling technology is widely implemented and applied in Internet access. With the increasing number of LACs (clients) and the resulting surge in traffic, the performance requirements for the LNS (server) are becoming increasingly stringent. Currently, to save costs, various Internet companies typically use lower-cost servers, such as general-purpose x86 servers, to implement the LNS. While these servers offer high flexibility and low cost, their poor performance is a significant drawback, especially when handling large-scale LAC access, resulting in severe packet loss and making them completely unsuitable for the task. Existing technologies cannot balance the packet processing flow of data transmission between the LAC and LNS, and given the characteristics of server usage, packet processing efficiency remains low. Summary of the Invention

[0003] This invention proposes a message processing method, apparatus, electronic device, and storage medium, aiming to at least partially solve one of the technical problems in related technologies.

[0004] On one hand, embodiments of the present invention provide a message processing method, including:

[0005] Obtain traffic data transmitted by the client; the traffic data carries identification data;

[0006] Traffic data is split based on identification data; the result of the splitting process includes packets to be decapsulated and packets to be encapsulated.

[0007] The message type of the message to be unsealed is determined based on the flag bits of the message to be unsealed;

[0008] The first port conversion process is performed on the message to be desealed, which is a session data message, and the destination port of the message to be desealed is converted from the source format to the target format.

[0009] The target format message to be unsealed is unsealed to obtain the unsealed message;

[0010] The destination network address is translated into the encapsulated message to obtain the preprocessing message.

[0011] The preceding processed message is encapsulated to obtain the encapsulated message;

[0012] The encapsulated message undergoes a second port conversion process, converting the destination port of the encapsulated message from the target format to the source format.

[0013] Optionally, the identification data includes network layer identifiers and transport layer identifiers; the traffic data is then processed by splitting based on the identification data, including the following steps:

[0014] The network layer identifier determines the communication protocol used by the network layer and the destination IP address of the network layer.

[0015] The transport layer identifier determines the transport protocol used by the transport layer and the destination port of the transport layer;

[0016] When the communication protocol, destination IP, transmission protocol, and destination port meet the first preset requirements, the traffic data is determined to be a message to be unblocked.

[0017] When the communication protocol, destination IP, transmission protocol, and destination port meet the second preset requirements, the traffic data is determined to be a message to be encapsulated.

[0018] Optionally, the message type includes control messages, session data messages, and non-session data messages; determining the message type of the message to be unsealed based on its flag bits includes the following steps:

[0019] If the first byte of the message to be unsealed has a control flag bit set, the message to be unsealed is determined to be a control message.

[0020] When the message to be unsealed is not a control message, match the protocol field of the message to be unsealed with the target field;

[0021] If the protocol field matches the target field, the message to be unsealed is determined to be a session data message; otherwise, the message to be unsealed is determined to be a non-session data message.

[0022] Optionally, the method further includes the following steps:

[0023] Send the unsealed message whose message type is not a session data message to the CPU for preset processing;

[0024] Here, CPU represents the server that the client connects to.

[0025] Optionally, the method further includes the following steps:

[0026] Perform source network address translation on the unblocking message;

[0027] The result of the source network address translation is transmitted to the server.

[0028] Optionally, the preceding processed message is encapsulated to obtain an encapsulated message, including the following steps:

[0029] Match the IP data of the preceding processed message with the destination IP of the preceding processed message, and encapsulate the corresponding tunnel header based on the IP data to obtain the encapsulated message;

[0030] The destination IP address is determined based on the network layer identifier in the identification data.

[0031] Optionally, the method further includes the following steps:

[0032] Send the encapsulated message in the source format back to the client.

[0033] On the other hand, embodiments of the present invention provide a message processing apparatus, including:

[0034] The first module is used to acquire traffic data transmitted by the client; the traffic data carries identification data.

[0035] The second module is used to perform traffic data splitting based on identification data; the result of the splitting process includes packets to be decapsulated and packets to be encapsulated.

[0036] The third module is used to determine the message type of the message to be unsealed based on the flag bits of the message to be unsealed;

[0037] The fourth module is used to perform the first port conversion process on the message to be desealed, which is a session data message, and convert the destination port of the message to be desealed from the source format to the target format.

[0038] The fifth module is used to deseal the target format message to obtain the deseal message;

[0039] The sixth module is used to perform destination network address translation on the message to be encapsulated, so as to obtain the message to be processed.

[0040] The seventh module is used to encapsulate the preceding processed messages to obtain encapsulated messages;

[0041] The eighth module is used to perform a second port conversion process on the encapsulated message, converting the destination port of the encapsulated message from the target format to the source format.

[0042] Optionally, the identification data includes network layer identifiers and transport layer identifiers; the second module is specifically used for:

[0043] The network layer identifier determines the communication protocol used by the network layer and the destination IP address of the network layer.

[0044] The transport layer identifier determines the transport protocol used by the transport layer and the destination port of the transport layer;

[0045] When the communication protocol, destination IP, transmission protocol, and destination port meet the first preset requirements, the traffic data is determined to be a message to be unblocked.

[0046] When the communication protocol, destination IP, transmission protocol, and destination port meet the second preset requirements, the traffic data is determined to be a message to be encapsulated.

[0047] Optionally, the message types include control messages, session data messages, and non-session data messages; the third module is specifically used for:

[0048] If the first byte of the message to be unsealed has a control flag bit set, the message to be unsealed is determined to be a control message.

[0049] When the message to be unsealed is not a control message, match the protocol field of the message to be unsealed with the target field;

[0050] If the protocol field matches the target field, the message to be unsealed is determined to be a session data message; otherwise, the message to be unsealed is determined to be a non-session data message.

[0051] Optionally, the device further includes:

[0052] The ninth module is used to send messages to be unsealed that are not session data messages to the CPU for preset processing;

[0053] Here, CPU represents the server that the client connects to.

[0054] Optionally, the device further includes:

[0055] The tenth module is used to perform source network address translation on the unsealed message;

[0056] The eleventh module is used to transmit the result of the source network address translation to the server.

[0057] Optionally, the seventh module is specifically used for:

[0058] Match the IP data of the preceding processed message with the destination IP of the preceding processed message, and encapsulate the corresponding tunnel header based on the IP data to obtain the encapsulated message;

[0059] The destination IP address is determined based on the network layer identifier in the identification data.

[0060] Optionally, the device further includes:

[0061] The eleventh module is used to send the encapsulated message in the source format back to the client.

[0062] On the other hand, embodiments of the present invention provide an electronic device, including: a processor and a memory; the memory is used to store a program; the processor executes the program to implement the above-described message processing method.

[0063] On the other hand, embodiments of the present invention provide a computer storage medium storing a processor-executable program, which, when executed by a processor, is used to implement the above-described message processing method.

[0064] This invention embodiment acquires traffic data transmitted by the client; the traffic data carries identification data; the traffic data is split based on the identification data; the result of the splitting process includes unsealed packets and unsealed packets; the packet type of the unsealed packet is determined according to the flag bit of the unsealed packet; a first port conversion process is performed on the unsealed packet whose packet type is session data packet, converting the destination port of the unsealed packet from the source format to the target format; the unsealed packet of the target format is desealed to obtain an unsealed packet; the destination network address is converted on the unsealed packet to obtain a preprocessing packet; the preprocessing packet is encapsulated to obtain an encapsulated packet; and a second port conversion process is performed on the encapsulated packet, converting the destination port of the encapsulated packet from the target format to the source format. The method of this invention can be applied to data processing and computing units independent of the CPU. It reduces CPU load by shifting the message processing flow. Specifically, it involves diverting the acquired process data, followed by adaptive decapsulation and encapsulation processing. Furthermore, it uses format conversion for port conversion to ensure that the decapsulation and encapsulation results are compatible with the original message protocol types of the client and server. This invention enables efficient message processing. Attached Figure Description

[0065] The accompanying drawings are provided to further understand the technical solutions of the present invention and constitute a part of the specification. They are used together with the embodiments of the present invention to explain the technical solutions of the present invention, and do not constitute a limitation on the technical solutions of the present invention.

[0066] Figure 1 This is a schematic diagram of an implementation environment for message processing provided in an embodiment of the present invention;

[0067] Figure 2 This is a flowchart illustrating a message processing method provided in an embodiment of the present invention;

[0068] Figure 3 This is a schematic diagram of the expanded process of the diversion process provided in an embodiment of the present invention;

[0069] Figure 4 This is a schematic diagram of the process for determining the message type provided in an embodiment of the present invention;

[0070] Figure 5 A schematic diagram illustrating an example of the L2TP-PPP-IPv4 message format provided in an embodiment of the present invention;

[0071] Figure 6 A schematic diagram illustrating an example of a 2-layer MPLS tag over UDP packet format provided in an embodiment of the present invention;

[0072] Figure 7 This is a schematic diagram of an extended process of the message processing method provided in an embodiment of the present invention;

[0073] Figure 8 A schematic diagram illustrating the flow principle of a specific application of message processing provided in an embodiment of the present invention;

[0074] Figure 9 This is a schematic diagram of the structure of a message processing device provided in an embodiment of the present invention;

[0075] Figure 10 This is a schematic diagram of the structure of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0076] To make the objectives, technical solutions, and advantages of this invention clearer, the invention will be further described in detail below with reference to the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the invention.

[0077] It should be noted that although functional modules are divided in the system diagram and the logical order is shown in the flowchart, in some cases, the steps shown or described may be performed in a different order than the module division in the system or the order in the flowchart. The terms "first / S100," "second / S200," etc., in the specification, claims, and the aforementioned figures are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence.

[0078] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0079] It is understood that the message processing method provided in this embodiment of the invention can be applied to any computer device with data processing and computing capabilities, and this computer device can be various types of terminals or servers. When the computer device in the embodiment is a server, the server is an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms. Optionally, the terminal can be a smartphone, tablet computer, laptop computer, or desktop computer, but it is not limited to these.

[0080] For the convenience of understanding the technical solution of the present invention, first, the technical feature proper nouns that may appear in the embodiments of the present invention are explained as follows:

[0081] L2TP: Layer 2 Tunneling Protocol.

[0082] LNS: L2TP Network Server, that is, the server side.

[0083] LAC: L2TP Access Concentrator, that is, the L2TP access client.

[0084] SNAT: Source Network Address Translation.

[0085] DNAT: Destination Network Address Translation.

[0086] DPU: Data Processing and Computing Unit, a hardware device dedicated to processing data packets.

[0087] SW: Software layer, referring to a general-purpose CPU processor, usually ARM or X86, etc.

[0088] HW: Hardware layer, referring to a dedicated processor, in contrast to SW.

[0089] MAF: Match, Modify, Forward, an abbreviation for the three major processes of packet processing.

[0090] PIPE: Hardware Acceleration Pipeline, a pipeline on the DPU dedicated to accelerating MAF for packets, with high performance.

[0091] DPDK: Data Plane Development Kit, a development framework for processing data packets using a general-purpose CPU.

[0092] FLOW: Flow, referring to packets with reciprocal five-tuples, that is, the connection in the transport layer.

[0093] Uplink: Port, referring to the actual physical optical port on the BLUEFILED DPU.

[0094] SF: Auxiliary Port, a virtual network port used in the system-on-chip of the BLUEFILED DPU.

[0095] VF: Virtual Port, a virtual network port used in the Host system, mainly for virtualization.

[0096] PF: Physical Port, the physical port of the BLUEFILED DPU seen in the Host system.

[0097] OFFLOAD: Offload, that is, transferring the calculation of traffic processing to the DPU.

[0098] NAT: Network Address Translation.

[0099] NAPT: Network Address Port Translation.

[0100] CGN: Carrier-grade NAT, characterized by its large scale and high stability.

[0101] BlueField-2 DPU: A commercial DPU manufactured by NVIDIA.

[0102] IPv4: Internet Protocol version 4, also known as the fourth version of the Internet Protocol, is the fourth revision in the development process of the Internet Protocol and the first version of the protocol to be widely deployed. IPv4 is the core of the Internet and the most widely used version of the Internet Protocol.

[0103] UDP: User Datagram Protocol.

[0104] The OSI seven-layer model (Q) is a framework for understanding and describing computer network communication. It decomposes network communication into seven different layers, including L1 (physical layer), L2 (data link layer), L3 (network layer), L4 (transport layer), L5 (session layer), L6 (presentation layer), and L7 (application layer).

[0105] like Figure 1 The diagram shown is a schematic representation of an implementation environment provided by an embodiment of the present invention. (Refer to...) Figure 1 The implementation environment includes at least one terminal 102 and a server 101. The terminal 102 and the server 101 can be connected via a network, either wirelessly or via a wired connection, to complete data transmission and exchange.

[0106] Server 101 can be a standalone physical server, a server cluster or distributed system consisting of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communication, middleware services, domain name services, security services, CDN (Content Delivery Network), and big data and artificial intelligence platforms.

[0107] Additionally, server 101 can also be a node server in a blockchain network. Blockchain is a novel application model of computer technologies such as distributed data storage, peer-to-peer transmission, consensus mechanisms, and encryption algorithms.

[0108] Terminal 102 can be a smartphone, tablet computer, laptop computer, desktop computer, smart speaker, smartwatch, etc., but is not limited to these. Terminal 102 and server 101 can be directly or indirectly connected via wired or wireless communication, and this embodiment of the invention does not impose any limitations.

[0109] Exemplary based on Figure 1 The implementation environment shown in this embodiment of the invention provides a message processing method. The following description uses the application of this message processing method in terminal 102 as an example. It can be understood that this message processing method can also be applied to server 101.

[0110] Reference Figure 2 , Figure 2 This is a flowchart illustrating a message processing method applied to a terminal (e.g., a DPU) according to an embodiment of the present invention. The executing entity of this message processing method can be any of the aforementioned computer devices (including servers or terminals). (Refer to...) Figure 2 The method includes the following steps:

[0111] S100, Obtain traffic data transmitted by the client;

[0112] The traffic data carries identification data; specifically, multiple PIPEs can be created on the DPU to implement subsequent process steps.

[0113] For example, in some specific implementations, acquiring traffic data transmitted by the client can be achieved as follows: the LAC can use an L2TP tunnel to send session uplink traffic to the DPU; similarly, the DPU can also use an L2TP tunnel to send session downlink traffic to the LAC. Due to the introduction of L2TP tunnels, the fixed processing method of L2TP tunnel encapsulation and decapsulation, which is offloaded to the DPU for execution, performs much better than on the CPU.

[0114] S200: Traffic data is diverted based on identification data;

[0115] The results of the traffic splitting process include messages to be desealed and messages to be encapsulated.

[0116] It should be noted that the identification data includes network layer identifiers and transport layer identifiers; in some embodiments, such as Figure 3As shown, step S200 may include the following steps: S201, determining the communication protocol used by the network layer and the destination IP of the network layer according to the network layer identifier; S202, determining the transmission protocol used by the transmission layer and the destination port of the transmission layer according to the transmission layer identifier; S203, when the communication protocol, destination IP, transmission protocol and destination port meet the first preset requirement, determining the traffic data as a message to be decapsulated; S204, when the communication protocol, destination IP, transmission protocol and destination port meet the second preset requirement, determining the traffic data as a message to be encapsulated.

[0117] For example, in some specific implementations, step S200 can be implemented through a first acceleration pipe. Specifically, an UP_DN_DIST_PIPE (downlink traffic splitting PIPE, i.e., the first acceleration pipe) is created on the DPU. All traffic entering the DPU first enters the UP_DN_DIST_PIPE for traffic splitting. The splitting is achieved by adding MAF rules in the PIPE. The specific uplink traffic matching rule is: L3 is IPv4, and the destination IP of L3 is the LNS IP, and L4 is UDP, and the destination port of L4 is 1701 (the fixed port used by the L2TP protocol). Traffic that meets this rule is sent to L2TP_CONTRL_FILTERPIPE (L2TP control message splitting PIPE, also known as the second acceleration pipe) for L2TP control / data message splitting. The specific downlink traffic matching rule is: L3 is IPv4, and the destination IP of L3 belongs to the set of public IPs configured by the LNS. Traffic that meets this rule is sent to the downlink traffic DNAT_PIPE (the third acceleration pipe) for DNAT processing.

[0118] S300. Determine the message type of the message to be unsealed based on the flag bits of the message to be unsealed;

[0119] It should be noted that message types include control messages, session data messages, and non-session data messages; in some embodiments, such as Figure 4 As shown, step S300 may include the following steps: S301, when the first byte of the message to be unsealed has a control flag bit set, the message to be unsealed is determined to be a control message; S302, when the message to be unsealed is not a control message, the protocol field of the message to be unsealed is matched with the target field; S303, when the protocol field and the target field match successfully, the message to be unsealed is determined to be a session data message; otherwise, the message to be unsealed is determined to be a non-session data message.

[0120] In some embodiments, the method may further include the following steps: sending the message to be unsealed, whose message type is not a session data message, to the CPU for preset processing; wherein the CPU represents the server connected to the client.

[0121] For example, in some specific implementations, rules need to be set in L2TP_CONTRL_FILTER PIPE (second acceleration pipe) to split session data packets and control packets. The distinction rule is whether the control flag bit is set in the first byte of the L2TP packet; if so, it is sent to the CPU for L2TP control packet processing; otherwise, it is sent to PPP_IPV4_FILTER_PIPE (PPP IPv4 payload splitting PIPE, also known as the fourth acceleration pipe) for splitting.

[0122] The rule for PPP_IPV4_FILTER_PIPE is to match whether the protocol field of the PPP message is 0x0021, that is, whether the PPP message carries an IPv4 message; if so, it indicates that this is a session data message and is sent to L2TP_TO_MPLSOUDP_PIPE (the fifth acceleration pipe, L2TP to MPLS OVER UDP) for conversion processing; otherwise, it is sent to the CPU for processing of PPP non-session data.

[0123] S400: Perform first port conversion processing on the message to be desealed, which is a session data message, and convert the destination port of the message to be desealed from the source format to the target format.

[0124] For example, in some specific implementations, since BlueField DPU currently does not support decapsulation and encapsulation of L2TP tunnels, but it does support decapsulation and encapsulation of MPLS over UDP tunnels, the packet structure when encapsulating PPP + IPv4 data packets in an L2TP tunnel happens to be the same as the packet structure of a Layer 2 MPLS label over UDP (the two packet formats are as follows). Figure 5 and Figure 6 Therefore, simply changing the L2TP destination port from 1701 (source format) to 6635 (destination format) will convert it to an MPLS over UDP tunnel packet.

[0125] S500: Deseal the target format message to be desealed to obtain a deseal message;

[0126] For example, in some specific implementations, after being converted into an MPLS OVER UDP tunnel packet, it is sent to L2TP_DECAP_PIPE (sixth acceleration pipe) for L2TP decapsulation. The decapsulated packet is a normal IPv4 packet, which is the actual session uplink packet.

[0127] In some embodiments, such as Figure 7 As shown, the method may also include the following steps: T100, performing source network address translation on the desealed message; T200, transmitting the result of the source network address translation to the server.

[0128] For example, in some specific implementations, after deblocking, the data is sent to SNAT_PIPE (seventh acceleration pipe) for further processing (e.g., source network address translation).

[0129] S600: Perform destination network address translation on the message to be encapsulated to obtain the preceding processed message;

[0130] For example, in some specific implementations, DNAT processing is performed on the downstream traffic DNAT_PIPE (third acceleration pipeline).

[0131] S700: Encapsulate the preceding processed message to obtain an encapsulated message;

[0132] It should be noted that in some embodiments, step S700 may include the following steps: matching the IP data of the preceding processed message with the destination IP of the preceding processed message, encapsulating the corresponding tunnel header based on the IP data, and obtaining the encapsulated message; wherein, the destination IP is determined based on the network layer identifier in the identifier data.

[0133] For example, in some specific implementations, the packets after the preprocessing is completed need to be encapsulated with L2TP. Since BlueField DPU does not support L2TP encapsulation, it can only be encapsulated according to the MPLS OVER UDP format first. Therefore, the packets after preprocessing enter MPLS_ENCAP_PIPE (the eighth acceleration pipe). At the same time, MPLS_ENCAP_PIPE needs to be configured with rules because different sessions have different L2TP tunnel encapsulation. Each session has its own LAC IP (i.e., the source IP when LAC and DPU establish L2TP), its own L2TP tunnel ID, and PPP session ID.

[0134] Specifically, the matching field is the L3 destination IP, which is the session IP. Each session's downlink packet will match its own IP (i.e., IP data) in MPLS_ENCAP_PIPE and encapsulate the corresponding MPLS OVER UDP tunnel header (actually encapsulated according to the L2TP tunnel fields).

[0135] S800 performs a second port conversion process on the encapsulated message, converting the destination port of the encapsulated message from the target format to the source format.

[0136] In some embodiments, the method may further include the following step: sending the encapsulated message in the source format back to the client.

[0137] For example, in some specific implementations, since the encapsulated UDP port is 6635 (target format), it needs to be changed to 1701 (source format). Therefore, the packet is sent to MPLSOUDP_TO_L2TP_PIPE to modify the port, and then sent to LAC after completion.

[0138] To explain in detail the principle of the technical solution of the present invention, the overall process of the present invention will be described below with reference to some specific embodiments. It is easy to understand that the following is an explanation of the technical principle of the present invention and should not be regarded as a limitation of the present invention.

[0139] First, it should be noted that, given the problems existing in the prior art, this invention employs a novel data processing mode: introducing a Data Processing Unit (DPU) to accelerate the data plane, freeing up CPU computing power, and transferring the L2TP encapsulation and decapsulation processing of packets to the DPU. Compared to a general-purpose CPU, its processing performance is significantly higher. However, the BlueField-2 DPU chip does not support the L2TP protocol. To support the offloading of L2TP services to the BlueField-2 DPU, this invention uses a special method to implement the encapsulation and decapsulation of L2TP packet headers by the BlueField-2 DPU.

[0140] For example, such as Figure 8 As shown, the technical solution of the present invention can be implemented through the following process:

[0141] LAC uses L2TP tunnels to send session uplink traffic to DPU, and DPU also uses L2TP tunnels to send session downlink traffic to LAC.

[0142] Due to the introduction of L2TP tunnels, the fixed processing method of L2TP tunnel encapsulation and decapsulation, which is offloaded to the DPU for execution, performs much better than on the CPU.

[0143] A UP_DN_DIST_PIPE (downlink traffic splitting PIPE) is created on the DPU. All traffic entering the DPU first enters the UP_DN_DIST_PIPE for traffic splitting. Splitting is achieved by adding MAF rules to the PIPE. Specifically, the uplink traffic matching rules are: L3 is IPv4, the destination IP of L3 is the LNS IP, L4 is UDP, and the destination port of L4 is 1701 (a fixed port used by the L2TP protocol). Traffic that meets this rule is sent to the L2TP_CONTRL_FILTERPIPE (L2TP control message splitting PIPE) for L2TP control / data packet splitting. Specifically, the downlink traffic matching rules are: L3 is IPv4, and the destination IP of L3 belongs to the set of public IPs configured by the LNS. Traffic that meets this rule is sent to the downlink traffic DNAT_PIPE for DNAT processing. The DNAT_PIPE contains a large number of DNAT rules, which are generated by the CPU and loaded onto the DPU along with SNAT rules when a user generates a new flow. Once the rules are loaded, subsequent packets in the flow will hit these SNAT / DNAT rules. All subsequent packets in the flow are processed on the DPU. Only packets that do not hit the rules (i.e., MISS FLOW TO CPU) are uploaded to the CPU. The packets that do not hit the rules are the first few packets of each new flow.

[0144] The flow determination conditions for DNAT_PIPE / SNAT_PIPE are the SNAT / DNAT rules.

[0145] The composition of SNAT / DNAT rules: The modification items of SNAT rules are the source IP of L3 and the source port of L4, and the modification items of DNAT rules are the destination IP of L3 and the destination port of L4; the matching items are different in different NAT modes.

[0146] In full cone NAT mode, DNAT rules match the L3 dst IP and L4 dst port; SNAT rules match the L3 src IP and L4 src port.

[0147] In symmetric NAT mode, the matching items for SNAT and DNAT rules are the same, including L3 source IP and dst IP, and L4 source port and dst port. However, the source and destination of SNAT rules and DNAT rules are reversed.

[0148] In the L2TP_CONTRL_FILTER PIPE, rules need to be set to split session data packets and control packets. The distinction rule is whether the control flag bit is set in the first byte of the L2TP packet; if so, it is sent to the CPU for L2TP control packet processing; otherwise, it is sent to PPP_IPV4_FILTER_PIPE (PPP IPV4 payload splitting PIPE) for splitting.

[0149] The rule for PPP_IPV4_FILTER_PIPE is to match whether the protocol field of the PPP packet is 0x0021, that is, whether the PPP packet carries an IPv4 packet; if so, it indicates that this is a session data packet and is sent to L2TP_TO_MPLSOUDP_PIPE (L2TP to MPLS OVER UDP) for conversion processing; otherwise, it is sent to the CPU for processing of non-session PPP data.

[0150] Since BlueField DPU currently does not support decapsulation and encapsulation of L2TP tunnels, but it does support decapsulation and encapsulation of MPLS OVERUDP tunnels, the packet structure when encapsulating PPP + IPv4 data packets in an L2TP tunnel happens to be the same as the packet structure of a Layer 2 MPLS label over UDP (the two packet formats are as follows). Figure 5 and Figure 6 Therefore, simply changing the L2TP destination port to 6635 will convert it into an MPLS OVER UDP tunnel packet. After conversion, it is sent to L2TP_DECAP_PIPE for L2TP decapsulation. The decapsulated packet is a normal IPv4 packet, which is the actual session uplink packet. After decapsulation, it is sent to SNAT_PIPE for further processing. Specifically, after passing through SNAT_PIPE, the user uplink packet has completed all processing and exposure, and is sent to the Internet (IPv4 TO INTERNET TX, i.e., the data stream sent to the server).

[0151] Similarly, packets after the preprocessing is completed need to be encapsulated using L2TP. Since BlueField DPU does not support L2TP encapsulation, it can only be encapsulated according to the MPLS OVER UDP format first. Therefore, packets after preprocessing enter MPLS_ENCAP_PIPE. At the same time, MPLS_ENCAP_PIPE needs to be configured with rules because different sessions have different L2TP tunnel encapsulation. Each session has its own LAC IP (i.e., the source IP when the LAC and DPU establish L2TP), its own L2TP tunnel ID, and PPP session ID.

[0152] The matching field is the destination IP of L3, which is the session IP. Each session's downlink packet will match its own IP in MPLS_ENCAP_PIPE and encapsulate the corresponding MPLS OVER UDP tunnel header (actually encapsulated according to the fields of the L2TP tunnel). Since the encapsulated UDP port is 6635, it needs to be changed to 1701. Therefore, the packet is sent to MPLSOUDP_TO_L2TP_PIPE to modify the port, and after completion, it is sent to LAC.

[0153] Specifically, this invention implements the processing of L2TP data packets by the BlueField-2 DPU. Leveraging the characteristic that the L2TP packet header and MPLS OVER UDP frame structure have the same length, the port of the received L2TP data packet is changed to the MPLS data packet port. The BlueField-2 DPU's ability to process MPLS OVER UDP packets is then used to decapsulate the packet. Similarly, the BlueField-2 DPU's MPLS OVER UDP encapsulation function is used to encapsulate the L2TP packet header into an MPLS OVER UDP packet, and then the port is modified to finally encapsulate it back into an L2TP packet header.

[0154] This invention is based on NVIDIA's BlueField-2 DPU; in this invention, we mainly use the BlueField-2 DPU to implement the LNS function, supporting the encapsulation and decapsulation of L2TP protocol data packet headers:

[0155] L2TP message encapsulation:

[0156] Encapsulate the corresponding MPLS OVER UDP tunnel header (actually encapsulated according to the L2TP tunnel fields); since the encapsulated UDP port is 6635, it also needs to be changed to 1701, so the packet is sent to MPLSOUDP_TO_L2TP_PIPE to modify the port, and then sent to LAC.

[0157] L2TP message decapsulation:

[0158] Changing the L2TP destination port from 1701 to 6635 will convert it into an MPLS OVER UDP tunnel packet. After conversion, the packet is sent to L2TP_DECAP_PIPE for L2TP deblocking.

[0159] The detailed implementation scheme for L2TP data packet header encapsulation is as follows:

[0160] After the preprocessing is completed, the packet needs to be encapsulated with L2TP. Since BlueField DPU does not support L2TP encapsulation, it can only be encapsulated according to the MPLS OVER UDP format first. Therefore, the packet after preprocessing enters MPLS_ENCAP_PIPE. At the same time, MPLS_ENCAP_PIPE needs to be configured with rules because the L2TP tunnel encapsulation is different for different sessions. Each session has its own LAC IP (i.e., the source IP when the LAC and DPU establish L2TP), its own L2TP tunnel ID, and PPP session ID.

[0161] The matching field is the destination IP of L3, which is the session IP. Each session's downlink packet will match its own IP in MPLS_ENCAP_PIPE and encapsulate the corresponding MPLS OVER UDP tunnel header (actually encapsulated according to the L2TP tunnel fields). Since the encapsulated UDP port is 6635, it needs to be changed to 1701. Therefore, the packet is sent to MPLSOUDP_TO_L2TP_PIPE to modify the port, and after completion, it is sent to LAC.

[0162] The detailed implementation scheme for L2TP data packet header decapsulation is as follows:

[0163] Since BlueField DPU currently does not support decapsulation and encapsulation of L2TP tunnels, but it does support decapsulation and encapsulation of MPLS OVERUDP tunnels, and the packet structure of L2TP tunnel encapsulation of PPP + IPv4 data packets happens to be the same as the packet structure of Layer 2 MPLS label OVER UDP, we only need to change the L2TP destination port to 6635 to convert it into an MPLS OVER UDP tunnel packet. After conversion, it is sent to L2TP_DECAP_PIPE for L2TP decapsulation processing. The decapsulated packet is a normal IPv4 packet, which is the actual session uplink packet. After decapsulation, it is sent to SNAT_PIPE for further processing.

[0164] In summary, the technical solution of this invention creatively solves the problem of BlueField DPU's lack of support for L2TP data packets, expands the application scope of BlueField DPU, and also meets the requirements of offloading services to the DPU for execution, thereby greatly improving service forwarding performance, robustness, and security. Compared with the prior art, this invention has at least the following beneficial effects:

[0165] 1. Regarding inventiveness: The solution of this invention enables BlueField DPU to support the processing of L2TP data packets, which has a high degree of inventiveness.

[0166] 2. Regarding forwarding performance advantages: Compared with cloud platform CPU-based packet data processing solutions, this invention has significant performance advantages by processing network packets through hardware (including desealing and encapsulating L2TP tunnel packets), as well as lower latency, less CPU usage, and less energy consumption.

[0167] 3. Regarding stability: Compared to pure software solutions based on cloud platforms, the DPU smart network card hardware processing of network packets is not affected by abnormal packets, and there is no possibility of program crashing or downtime, which has great robustness and security.

[0168] Specifically, this invention can be widely applied to VPDN networking scenarios, helping customers build an enterprise-level private network isolated from the internet at a lower cost. It addresses both the high cost of traditional fiber optic VPN networking and the general network performance degradation and instability issues. The networking technology based on this invention can provide enterprises or individuals with the private network services, internet access services, cloud services, etc., and can also provide customized value-added services such as application identification and network optimization. It features efficient, flexible, and visualized networking, high-speed, stable, and low-cost connections, facilitating enterprise network cloud upgrades.

[0169] On the other hand, such as Figure 9 As shown, an embodiment of the present invention provides a message processing apparatus 900, comprising:

[0170] The first module 910 is used to acquire traffic data transmitted by the client; the traffic data carries identification data.

[0171] The second module 920 is used to perform traffic data splitting based on identification data; the result of the splitting process includes packets to be decapsulated and packets to be encapsulated.

[0172] The third module 930 is used to determine the message type of the message to be unsealed based on the flag bits of the message to be unsealed;

[0173] The fourth module 940 is used to perform the first port conversion process on the message to be desealed, which is a session data message, and convert the destination port of the message to be desealed from the source format to the target format.

[0174] The fifth module 950 is used to deseal the target format message to obtain the deseal message;

[0175] The sixth module 960 is used to perform destination network address translation on the message to be encapsulated to obtain the preceding processed message;

[0176] The seventh module 970 is used to encapsulate the preceding processed messages to obtain encapsulated messages;

[0177] The eighth module 980 is used to perform second port conversion processing on the encapsulated message, converting the destination port of the encapsulated message from the target format to the source format.

[0178] In some embodiments, the identification data includes a network layer identifier and a transport layer identifier; the second module is specifically used for:

[0179] The network layer identifier determines the communication protocol used by the network layer and the destination IP address of the network layer.

[0180] The transport layer identifier determines the transport protocol used by the transport layer and the destination port of the transport layer;

[0181] When the communication protocol, destination IP, transmission protocol, and destination port meet the first preset requirements, the traffic data is determined to be a message to be unblocked.

[0182] When the communication protocol, destination IP, transmission protocol, and destination port meet the second preset requirements, the traffic data is determined to be a message to be encapsulated.

[0183] In some embodiments, the message types include control messages, session data messages, and non-session data messages; the third module can specifically be used for:

[0184] If the first byte of the message to be unsealed has a control flag bit set, the message to be unsealed is determined to be a control message.

[0185] When the message to be unsealed is not a control message, match the protocol field of the message to be unsealed with the target field;

[0186] If the protocol field matches the target field, the message to be unsealed is determined to be a session data message; otherwise, the message to be unsealed is determined to be a non-session data message.

[0187] In some embodiments, the apparatus may further include:

[0188] The ninth module is used to send messages to be unsealed that are not session data messages to the CPU for preset processing;

[0189] Here, CPU represents the server that the client connects to.

[0190] In some embodiments, the apparatus may further include:

[0191] The tenth module is used to perform source network address translation on the unsealed message;

[0192] The eleventh module is used to transmit the result of the source network address translation to the server.

[0193] In some embodiments, the seventh module may specifically be used for:

[0194] Match the IP data of the preceding processed message with the destination IP of the preceding processed message, and encapsulate the corresponding tunnel header based on the IP data to obtain the encapsulated message;

[0195] The destination IP address is determined based on the network layer identifier in the identification data.

[0196] In some embodiments, the apparatus may further include:

[0197] The eleventh module is used to send the encapsulated message in the source format back to the client.

[0198] The content of the method embodiments of the present invention is applicable to the device embodiments. The specific functions implemented by the device embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0199] On the other hand, embodiments of the present invention also provide an electronic device, which includes a memory and a processor. The memory stores a computer program, and the processor executes the computer program to implement the aforementioned sensitive information method. This electronic device can be any smart terminal, including tablet computers, in-vehicle computers, etc.

[0200] It is understood that the content of the above method embodiments is applicable to this device embodiment. The specific functions implemented by this device embodiment are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above method embodiments.

[0201] like Figure 10 As shown, Figure 10 This illustration shows a specific example of the hardware structure of an electronic device according to an embodiment. The electronic device includes:

[0202] The processor 1001 can be implemented using a general-purpose CPU (Central Processing Unit), microprocessor, application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of the present invention.

[0203] The memory 1002 can be implemented as a read-only memory (ROM), static storage device, dynamic storage device, or random access memory (RAM). The memory 1002 can store the operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented through software or firmware, the relevant program code is stored in the memory 1002 and is called and executed by the processor 1001 to execute the network node population optimization method of the embodiments of this invention.

[0204] Input / output interface 1003 is used to implement information input and output;

[0205] The communication interface 1004 is used to enable communication and interaction between this device and other devices. Communication can be achieved through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0206] Bus 1005 transmits information between various components of the device (e.g., processor 1001, memory 1002, input / output interface 1003, and communication interface 1004);

[0207] The processor 1001, memory 1002, input / output interface 1003 and communication interface 1004 are connected to each other within the device via bus 1005.

[0208] The electronic device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate; that is, they may be located in one place or distributed across multiple network units. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0209] The content of the method embodiments of the present invention is applicable to the embodiments of the present electronic device. The specific functions implemented by the embodiments of the present electronic device are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0210] Another aspect of this invention provides a computer-readable storage medium storing a program that is executed by a processor to implement the aforementioned method.

[0211] It should be noted that the computer-readable medium shown in the embodiments of the present invention can be a computer-readable signal medium or a computer-readable storage medium, or any combination thereof. A computer-readable storage medium can be, for example,—but not limited to—an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination thereof. More specific examples of a computer-readable storage medium may include, but are not limited to: an electrical connection having one or more wires, a portable computer disk, a hard disk, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM), flash memory, optical fiber, portable compact disc read-only memory (CD to ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof. In the present invention, a computer-readable storage medium can be any tangible medium containing or storing a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. In the present invention, a computer-readable signal medium can include a data signal propagated in baseband or as part of a carrier wave, wherein computer-readable program code is carried. Such transmitted data signals can take various forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination thereof. The computer-readable signal medium can also be any computer-readable medium other than a computer-readable storage medium, which can send, propagate, or transmit a program for use by or in connection with an instruction execution system, apparatus, or device. The program code contained on the computer-readable medium can be transmitted using any suitable medium, including but not limited to wireless, wired, etc., or any suitable combination thereof.

[0212] The content of the method embodiments of the present invention is applicable to the computer-readable storage medium embodiments. The specific functions implemented by the computer-readable storage medium embodiments are the same as those of the above method embodiments, and the beneficial effects achieved are also the same as those achieved by the above methods.

[0213] This invention also discloses a computer program product or computer program, which includes computer instructions stored in a computer-readable storage medium. A processor of a computer device can read the computer instructions from the computer-readable storage medium and execute the computer instructions, causing the computer device to perform the aforementioned method.

[0214] The flowcharts and block diagrams in the accompanying drawings illustrate the architecture, functionality, and operation of possible implementations of systems, methods, and computer program products according to various embodiments of the present invention. In this regard, each block in a flowchart or block diagram may represent a module, segment, or portion of code containing one or more executable instructions for implementing a specified logical function. It should also be noted that in some alternative implementations, the functions indicated in the blocks may occur in a different order than those indicated in the drawings. For example, two consecutively indicated blocks may actually be executed substantially in parallel, and they may sometimes be executed in reverse order, depending on the functions involved. It should also be noted that each block in a block diagram or flowchart, and combinations of blocks in a block diagram or flowchart, may be implemented using a dedicated hardware-based system that performs the specified function or operation, or using a combination of dedicated hardware and computer instructions.

[0215] It should be noted that although several modules for the device used to perform actions have been mentioned in the detailed description above, this division is not mandatory. In fact, according to embodiments of the present invention, the features and functions of two or more modules or units described above can be embodied in one module or unit. Conversely, the features and functions of one module or unit described above can be further divided and embodied by multiple modules or units.

[0216] Through the above description of the embodiments, those skilled in the art will readily understand that the exemplary embodiments described herein can be implemented by software or by combining software with necessary hardware. Therefore, the technical solutions according to the embodiments of the present invention can be embodied in the form of a software product, which can be stored in a non-volatile storage medium (such as a CD-ROM, USB flash drive, portable hard drive, etc.) or on a network, including several instructions to cause a computing device (such as a personal computer, server, touch terminal, or network device, etc.) to execute the method according to the embodiments of the present invention.

[0217] In some alternative embodiments, the functions / operations mentioned in the block diagrams may not occur in the order shown in the operation diagrams. For example, depending on the functions / operations involved, two consecutively shown blocks may actually be executed substantially simultaneously, or the blocks may sometimes be executed in reverse order. Furthermore, the embodiments presented and described in the flowcharts of this invention are provided by way of example to provide a more comprehensive understanding of the technology. The disclosed methods are not limited to the operations and logic flows presented herein. Alternative embodiments are contemplated in which the order of various operations is changed and sub-operations described as part of a larger operation are executed independently.

[0218] Furthermore, although the invention has been described in the context of functional modules, it should be understood that, unless otherwise stated, one or more of the functions and / or features may be integrated into a single physical device and / or software module, or one or more functions and / or features may be implemented in a separate physical device or software module. It is also understood that a detailed discussion of the actual implementation of each module is unnecessary for understanding the invention. Rather, given the properties, functions, and internal relationships of the various functional modules in the apparatus disclosed herein, the actual implementation of the module will be understood within the scope of conventional skill of an engineer. Therefore, those skilled in the art can implement the invention as set forth in the claims using ordinary techniques without excessive experimentation. It is also understood that the specific concepts disclosed are merely illustrative and not intended to limit the scope of the invention, which is determined by the full scope of the appended claims and their equivalents.

[0219] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0220] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by, or in conjunction with, an instruction execution means, apparatus, or device (such as a computer-based device, a processor-including device, or other means that can fetch and execute instructions from, or in conjunction with, an instruction execution means, apparatus, or device). For the purposes of this specification, "computer-readable medium" can be any means that can contain, store, communicate, propagate, or transmit programs for use by, or in conjunction with, an instruction execution means, apparatus, or device.

[0221] More specific examples (a non-exhaustive list) of computer-readable media include: electrical connections (electronic devices) having one or more wires, portable computer disk drives (magnetic devices), random access memory (RAM), read-only memory (ROM), erasable and editable read-only memory (EPROM or flash memory), fiber optic devices, and portable optical disc read-only memory (CDROM). Furthermore, computer-readable media can even be paper or other suitable media on which programs can be printed, because programs can be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, interpreting, or otherwise processing as necessary, and then stored in computer memory.

[0222] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.

[0223] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.

[0224] Although embodiments of the invention have been shown and described, those skilled in the art will understand that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the claims and their equivalents.

[0225] The above is a detailed description of the preferred embodiments of the present invention. However, the present invention is not limited to the embodiments. Those skilled in the art can make various equivalent modifications or substitutions without departing from the spirit of the present invention. All such equivalent modifications or substitutions are included within the scope defined by the claims of the present invention.

Claims

1. A method of processing a packet, the method comprising: The method comprises the following steps: Obtaining traffic data transmitted by a client; the traffic data carries identification data; Based on the identification data, the traffic data is processed by flow splitting; the result of the flow splitting processing includes a to-be-unpacked message and a to-be-encapsulated message; According to the flag bit of the to-be-unpacked message, the message type of the to-be-unpacked message is determined; For the to-be-unpacked message with the message type of session data message, first port conversion processing is performed to convert the destination port of the to-be-unpacked message from a source format to a target format; The to-be-unpacked message in the target format is unpacked to obtain an unpacked message; The to-be-encapsulated message is processed by destination network address conversion to obtain a pre-processing message; The pre-processing message is encapsulated to obtain an encapsulated message; The encapsulated message is processed by second port conversion to convert the destination port of the encapsulated message from the target format to the source format.

2. The packet processing method of claim 1, wherein, The identification data includes network layer identification and transport layer identification; based on the identification data, the traffic data is processed by flow splitting, which comprises the following steps: According to the network layer identification, the communication protocol adopted by the network layer and the destination IP of the network layer are determined; According to the transport layer identification, the transport protocol adopted by the transport layer and the destination port of the transport layer are determined; When the communication protocol, the destination IP, the transport protocol and the destination port meet the first preset requirement, it is determined that the traffic data is the to-be-unpacked message; When the communication protocol, the destination IP, the transport protocol and the destination port meet the second preset requirement, it is determined that the traffic data is the to-be-encapsulated message.

3. The packet processing method of claim 1, wherein, The message type includes a control message, the session data message and a non-session data message; according to the flag bit of the to-be-unpacked message, the message type of the to-be-unpacked message is determined, which comprises the following steps: When the first byte of the to-be-unpacked message is provided with a control flag bit, it is determined that the to-be-unpacked message is the control message; When the to-be-unpacked message is not the control message, the protocol field of the to-be-unpacked message is matched with a target field; When the protocol field and the target field are matched successfully, it is determined that the to-be-unpacked message is the session data message, otherwise, it is determined that the to-be-unpacked message is the non-session data message.

4. The packet processing method of claim 1 or 3, wherein, The method further comprises the following steps: The to-be-unpacked message with the message type other than the session data message is sent to a CPU for preset processing; Wherein, the CPU represents a service end connected by the client.

5. The packet processing method of claim 1, wherein, The method further comprises the following steps: The unpacked message is processed by source network address conversion; The result of the source network address conversion is transmitted to a service end.

6. The packet processing method of claim 1, wherein, The to-be-encapsulated message is processed by encapsulation to obtain an encapsulated message, which comprises the following steps: According to the destination IP of the pre-processing message, the IP data of the pre-processing message is matched, and a corresponding tunnel header is encapsulated based on the IP data to obtain the encapsulated message; Wherein, the destination IP is determined based on the network layer identification in the identification data.

7. The packet processing method of claim 1, wherein, The method further comprises the following steps: The encapsulated message in the source format is sent back to the client.

8. A packet processing device, characterized by, The method comprises the following steps: A first module is configured to acquire traffic data transmitted by a client; The traffic data carries identification data; A second module is configured to perform traffic distribution processing on the traffic data based on the identification data; the result of the traffic distribution processing comprises a to-be-unencrypted packet and a to-be-encrypted packet; A third module is configured to determine a packet type of the to-be-unencrypted packet according to a flag bit of the to-be-unencrypted packet; A fourth module is configured to perform first port conversion processing on the to-be-unencrypted packet with the packet type of session data packet, and convert a destination port of the to-be-unencrypted packet from a source format to a target format; A fifth module is configured to perform unencryption processing on the to-be-unencrypted packet with the target format, and obtain an unencrypted packet; A sixth module is configured to perform destination network address conversion on the to-be-encrypted packet, and obtain a pre-processing packet; A seventh module is configured to perform encryption processing on the pre-processing packet, and obtain an encrypted packet; An eighth module is configured to perform second port conversion processing on the encrypted packet, and convert the destination port of the encrypted packet from the target format to the source format.

9. An electronic device, comprising: The method comprises the following steps: A processor and a memory are comprised; The memory is configured to store a program; 10. A computer storage medium having stored thereon a program that is executable by a processor, the program comprising instructions for causing the processor to perform the method of any one of claims 1-9. The processor executes the program to implement the method according to any one of claims 1 to 7. The program executable by the processor, when executed by the processor, is configured to implement the method according to any one of claims 1 to 7.

Images