A message forwarding method, device and server forwarding method and device

Abstract

The present invention discloses a message forwarding method, device and server forwarding method and device, which encrypt and forward the Ethernet message of the client and decrypt and forward the tunnel message forwarded by the server through a router. The server, as a relay, only needs to forward the message to the corresponding client according to the client ID of the tunnel message, and there is no need to encrypt and decrypt the message, nor to parse the real address of the client, thereby improving the forwarding efficiency of the server; at the same time, encryption and decryption are performed based on a preset hash algorithm and key to avoid data leakage and improve the security of the client address. By constructing a custom tunnel header carrying the hash of the original MAC, the server does not need to know the original MAC and only learns to forward based on the MAC hash, thereby avoiding security risks and improving the server forwarding performance and reducing forwarding delay.

Description

Technical Field

[0001] This invention relates to the field of wireless communication technology, and in particular to a message forwarding method, apparatus, and server forwarding method and apparatus. Background Technology

[0002] Currently, OpenVPN clients establish secure encrypted communication channels with OpenVPN servers and use TAP mode to implement Ethernet Layer 2 forwarding, which means that the OpenVPN server acts as the central encryption and decryption forwarding mechanism.

[0003] Existing address forwarding methods rely on an OpenVPN server as a central relay to forward packets to various clients. This means that when a packet is received from one client, it needs to be decrypted, and when the packet is forwarded to another client, it needs to be encrypted according to that client's encryption method before forwarding. This results in reduced server performance and increased latency in processing and forwarding. At the same time, the server has the real MAC addresses of all client-connected devices, which poses a security risk. Summary of the Invention

[0004] This invention provides a message forwarding method, apparatus, and server forwarding method and apparatus to solve the problems of high forwarding latency and low address security in existing address forwarding methods.

[0005] To address the aforementioned technical problems, embodiments of the present invention provide a message forwarding method, including:

[0006] Obtain a first transmission message, and encrypt and decrypt the first transmission message according to the message type of the first transmission message, wherein the message type includes Ethernet message and tunnel message;

[0007] If the message type is an Ethernet message, the Ethernet message is encrypted according to a pre-configured hash algorithm and key to generate a tunnel message, and the tunnel message is forwarded to the server so that the server can forward the tunnel message.

[0008] If the message type is a tunnel message, the destination address hash value, source address hash value, and client ID are obtained based on the tunnel message. The Ethernet message is then decrypted based on the destination address hash value, source address hash value, and client ID, and forwarded to the client.

[0009] This invention uses a router to encrypt and forward Ethernet packets from clients and decrypt and forward tunnel packets forwarded by the server. The server, acting as a relay, only needs to forward the packets to the corresponding clients based on the client ID in the tunnel packets, without needing to encrypt or decrypt the packets or resolve the client's real address, thus improving the server's forwarding efficiency. At the same time, encryption and decryption based on a preset hash algorithm and key prevent data leakage and improve the security of client addresses.

[0010] In this embodiment, before obtaining the first transmission message, the method further includes:

[0011] The client's hash algorithm and key are pre-configured, and a UDP service port is created; a registration message is generated based on the client's client ID, hash algorithm, and key.

[0012] The registration message is sent to the server for registration, so that the server adds the customer ID to the client list.

[0013] In this embodiment, the step of encrypting the Ethernet packet according to a pre-configured hash algorithm and key to generate a tunnel packet specifically involves:

[0014] Obtain the destination address and source address of the Ethernet packet, and calculate the hash value of the destination address and source address according to a pre-configured hash algorithm;

[0015] A tunnel header is constructed based on the hash values ​​of the destination address and source address and the client ID, and the first transmission message is encrypted using a pre-configured key to generate tunnel data; a tunnel message is generated based on the tunnel data and the tunnel header.

[0016] In this embodiment, the step of obtaining the hash value of the destination address, the hash value of the source address, and the client ID based on the tunnel message, and then decrypting the Ethernet message based on the hash value of the destination address, the hash value of the source address, and the client ID, specifically involves:

[0017] The tunnel header and tunnel data of the tunnel message are parsed. The tunnel header is parsed to obtain the first customer information, which includes the hash value of the destination address, the hash value of the source address, and the customer ID.

[0018] Ethernet packets are obtained based on the tunnel data. Second customer information is calculated on the Ethernet packets according to a preset hash algorithm and key. The second customer information includes the hash value of the destination address, the hash value of the source address, and the customer ID.

[0019] Verify the first customer information and the second customer information, and forward the Ethernet packet to the client based on the verification result.

[0020] In this embodiment, the step of verifying the first client information and the second client information, and forwarding the Ethernet packet to the client based on the verification result, specifically involves:

[0021] Compare the hash value of the destination address with the hash value of the source address in the first customer information and the second customer information;

[0022] When the hash value of the destination address and the hash value of the source address in the first and second customer information are equal, the Ethernet packet is forwarded to the client.

[0023] Secondly, the present invention provides a server forwarding method, comprising:

[0024] Receive a second transmission message forwarded by the aforementioned message forwarding method;

[0025] The packet type of the second transmission message is parsed, and the second transmission message is forwarded according to the packet type; the packet type includes registration messages and Ethernet messages;

[0026] If the packet type is a registration message, then update the client list according to the registration message;

[0027] If the packet type is an Ethernet packet, then the hash values ​​of the destination address and source address of the second transmission packet are parsed, and the second transmission packet is forwarded according to the hash values ​​of the destination address and source address.

[0028] In this embodiment, updating the client list according to the registration message specifically means:

[0029] Parse the registration message to obtain the source IP address, source UDP port, device serial number, and customer ID;

[0030] Add the source IP address, source UDP port, device serial number, and client ID to the client list.

[0031] In this embodiment, parsing the hash values ​​of the destination address and source address of the second transmission packet, and forwarding the second transmission packet according to the hash values ​​of the destination address and source address, specifically involves:

[0032] Parse the second transmission message to obtain the source IP address, source UDP port, client ID, hash value of the destination address, and hash value of the source address;

[0033] The address forwarding table is queried and updated based on the hash value of the source address and the client ID. If the address forwarding table contains forwarding record information for the current source address's hash value and the client ID, the second packet is forwarded to the client IP and UDP port in the forwarding record information. Otherwise, the second packet is forwarded to all client IPs and UDP ports associated with the client ID.

[0034] Thirdly, the present invention provides a message forwarding device, comprising: a classification module, an encryption forwarding module, and a decryption forwarding module;

[0035] The classification module is used to obtain a first transmission message and encrypt and decrypt the first transmission message according to the message type of the first transmission message, wherein the message type includes Ethernet message and tunnel message;

[0036] The encryption forwarding module is used to encrypt the Ethernet packet according to a pre-configured hash algorithm and key when the packet type is an Ethernet packet, generate a tunnel packet, and forward the tunnel packet to the server so that the server can forward the tunnel packet.

[0037] The decryption and forwarding module is used to, when the message type is a tunnel message, obtain the hash value of the destination address, the hash value of the source address, and the client ID according to the tunnel message, and decrypt the Ethernet message according to the hash value of the destination address, the hash value of the source address, and the client ID to obtain the Ethernet message, and forward the Ethernet message to the client.

[0038] Fourthly, the present invention provides a server forwarding device, comprising: a receiving module, a router parsing module, a registration module, and a router forwarding module;

[0039] The receiving module is used to receive the second transmission message forwarded by the aforementioned message forwarding method;

[0040] The router parsing module is used to parse the packet type of the second transmission message and forward the second transmission message according to the packet type; the packet type includes registration message and Ethernet message;

[0041] The registration module is used to update the client list according to the registration message when the packet type is a registration message;

[0042] The router forwarding module is used to, when the packet type is an Ethernet packet, parse the hash values ​​of the destination address and source address of the second transmission packet, and forward the second transmission packet according to the hash values ​​of the destination address and source address. Attached Figure Description

[0043] Figure 1 This is a schematic flowchart of a message forwarding method provided in an embodiment of the present invention;

[0044] Figure 2 A network topology diagram for a message forwarding method provided in an embodiment of the present invention;

[0045] Figure 3 This is a schematic diagram of the structure of a tunnel packet according to a packet forwarding method provided in an embodiment of the present invention;

[0046] Figure 4 This is another flowchart illustrating a message forwarding method provided in an embodiment of the present invention;

[0047] Figure 5 This is a schematic flowchart of a server forwarding method provided in an embodiment of the present invention;

[0048] Figure 6 This is a timing diagram of a forwarding method based on mapped MAC addresses provided in an embodiment of the present invention. Detailed Implementation

[0049] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0050] Example 1

[0051] Please refer to Figure 1 , Figure 1 A flowchart illustrating a message forwarding method provided in an embodiment of the present invention includes steps 101 to 103, as detailed below:

[0052] Step 101: Obtain the first transmission message, and encrypt and decrypt the first transmission message according to the message type of the first transmission message. The message type includes Ethernet message and tunnel message.

[0053] In this embodiment, before obtaining the first transmission message, the method further includes:

[0054] The client's hash algorithm and key are pre-configured, and a UDP service port is created; a registration message is generated based on the client's client ID, hash algorithm, and key.

[0055] The registration message is sent to the server for registration, so that the server adds the customer ID to the client list.

[0056] In this embodiment, the 5G router device client generates a registration message using the client ID, hash algorithm, and key, and sends the registration message to the server for registration.

[0057] In this embodiment, the router receives Ethernet packets transmitted by the client or tunnel packets transmitted by the server, and encrypts and decrypts them before forwarding. If the first transmitted packet is an Ethernet packet transmitted by the client, it needs to be encrypted before forwarding; if the first transmitted packet is a tunnel packet transmitted by the server, it needs to be decrypted before forwarding.

[0058] Step 102: If the message type is an Ethernet message, the Ethernet message is encrypted according to the pre-configured hash algorithm and key to generate a tunnel message, and the tunnel message is forwarded to the server so that the server can forward the tunnel message.

[0059] In this embodiment, the step of encrypting the Ethernet packet according to a pre-configured hash algorithm and key to generate a tunnel packet specifically involves:

[0060] Obtain the destination address and source address of the Ethernet packet, and calculate the hash value of the destination address and source address according to a pre-configured hash algorithm;

[0061] A tunnel header is constructed based on the hash values ​​of the destination address and source address and the client ID, and the first transmission message is encrypted using a pre-configured key to generate tunnel data; a tunnel message is generated based on the tunnel data and the tunnel header.

[0062] In this embodiment, the router receives the Ethernet packet sent by the client, obtains the destination MAC address and source MAC address from the Ethernet packet, calculates the hash value of the destination MAC address and source MAC address using the hash algorithm pre-configured by the client, constructs a custom tunnel header by combining the client ID, and encrypts the Ethernet packet using the key pre-configured by the client to obtain tunnel data. The Ethernet type tunnel packet formed by the custom tunnel header and the encrypted tunnel data is sent to the server through the UDP port.

[0063] In this embodiment, the same user configures hash algorithms and keys on multiple 5G router devices (clients) they own, with the same customer ID, the same key, and the same hash algorithm selected; that is, the customer ID, key, and hash algorithm are all configured by the user themselves. In other words, the user presets parameters in the 5G router devices, and the 5G router devices register with the server only with the parameters configured by the user.

[0064] Please refer to Figure 2 , Figure 2This is a network topology diagram for a message forwarding method provided in an embodiment of the present invention.

[0065] In this embodiment, customer A configures the same customer ID, communication key, and hash algorithm on its 5G router devices A / B / C. Only devices with the same customer ID, communication key, and hash algorithm can communicate normally.

[0066] In this embodiment, each client, such as the 5G router devices A / B / C of client A device, constructs a custom tunnel message based on the communication key and hash algorithm for the received Ethernet message, and forwards the custom tunnel message to the virtual switch of the software server through keyless communication, and forwards the obtained custom tunnel message to the corresponding port through keyless communication.

[0067] In this embodiment, the router encrypts and forwards Ethernet packets from the client and decrypts and forwards tunnel packets forwarded by the server. As a relay, the server only needs to forward the packets to the corresponding client based on the client ID of the tunnel packet, without needing to encrypt or decrypt the packets or resolve the client's real address, thus improving the server's forwarding efficiency. At the same time, encryption and decryption based on a preset hash algorithm and key prevent data leakage and improve the security of the client's address.

[0068] Please refer to Figure 3 , Figure 3 This is a schematic diagram of the structure of a tunnel message provided by an embodiment of the present invention for a message forwarding method.

[0069] In this embodiment, the tunnel message includes a custom tunnel header and encrypted tunnel data. During transmission, an IP header and a UDP header are added before the custom tunnel header. The IP header, i.e., the source IP address header, includes the destination IP and source IP. The UDP header includes the source port and destination port. The custom tunnel header includes the hash value of the destination MAC address, the hash value of the source MAC address, the packet type (client ID), and the length. The encrypted tunnel data is the data encrypted by the router using a key on the original Ethernet packet. It includes the original Ethernet header and the original Ethernet packet. The original Ethernet header includes the destination MAC address, the source MAC address, and the Ethernet type.

[0070] In this embodiment, calculating the hash value of the MAC address is mainly to perform an irreversible hash operation on the destination address and the source address. It is a mapping value of the original MAC address during transmission in the network. The original MAC address cannot be obtained by reversible operation of the non-interface model. The server uses the MAC hash value to forward the data to avoid security risks.

[0071] In this embodiment, the hash value of the MAC is calculated as follows: the hash value is equal to the original MAC address plus the key. After calculating the hash using the hash algorithm, the last 6 bytes are taken to obtain the hash value of the MAC address. If the original MAC address belongs to a broadcast or multicast address, the first byte of the MAC hash is set to bit 0 as 1; otherwise, if the MAC belongs to a unicast address, the first byte of the MAC hash is set to bit 0 as 0.

[0072] In this embodiment, commonly used hash algorithms include MD5, SHA-1, SHA-256, SHA-384, SHA-512, SHA-3, and the Chinese national cryptographic standard SM3.

[0073] Step 103: If the message type is a tunnel message, obtain the hash value of the destination address, the hash value of the source address, and the client ID based on the tunnel message, and decrypt the Ethernet message based on the hash value of the destination address, the hash value of the source address, and the client ID, and forward the Ethernet message to the client.

[0074] In this embodiment, the step of obtaining the hash value of the destination address, the hash value of the source address, and the client ID based on the tunnel message, and then decrypting the Ethernet message based on the hash value of the destination address, the hash value of the source address, and the client ID, specifically involves:

[0075] The tunnel header and tunnel data of the tunnel message are parsed. The tunnel header is parsed to obtain the first customer information, which includes the hash value of the destination address, the hash value of the source address, and the customer ID.

[0076] Ethernet packets are obtained based on the tunnel data. Second customer information is calculated on the Ethernet packets according to a preset hash algorithm and key. The second customer information includes the hash value of the destination address, the hash value of the source address, and the customer ID.

[0077] Verify the first customer information and the second customer information, and forward the Ethernet packet to the client based on the verification result.

[0078] In this embodiment, the step of verifying the first client information and the second client information, and forwarding the Ethernet packet to the client based on the verification result, specifically involves:

[0079] Compare the hash value of the destination address with the hash value of the source address in the first customer information and the second customer information;

[0080] When the hash value of the destination address and the hash value of the source address in the first and second customer information are equal, the Ethernet packet is forwarded to the client.

[0081] In this embodiment, the 5G router device receives an Ethernet tunnel packet forwarded by the server, extracts the client ID, destination MAC hash value, and source MAC hash value from the packet according to the packet structure, decrypts the encrypted tunnel data using a key pair to obtain the Ethernet packet, calculates the hash value of the destination address and source MAC address in the Ethernet header respectively, compares the hash values ​​of the destination address and source MAC address in the custom tunnel header respectively to calculate the hash value of the destination address and source MAC address, and if the verification passes, forwards the packet to the user equipment.

[0082] In this embodiment, the original MAC address can only be obtained by decryption using a preset key, and the hash value is further verified and checked using a preset hash algorithm to check the legality of the message.

[0083] Please refer to Figure 4 , Figure 4 This is another flowchart illustrating a message forwarding method provided by an embodiment of the present invention. In this embodiment, the 5G router device initializes according to the customer configuration, creates a UDP socket, and logs in and registers with the server carrying the customer ID. In this embodiment, the 5G router device determines in real time whether it has received an Ethernet message that the user equipment needs to forward and whether it has received a custom UDP tunnel message from the server.

[0084] In this embodiment, when the 5G router receives an Ethernet packet from a customer's user equipment, it obtains the destination MAC address and source MAC address from the Ethernet packet, calculates their hash values ​​to construct a custom tunnel header, encrypts the Ethernet packet using a key to obtain encrypted tunnel data, and sends the custom tunnel header and encrypted tunnel data to the server via UDP. In this embodiment, when the 5G router receives a custom tunnel packet from the server via UDP, it interprets the custom tunnel header to obtain the hash values ​​of the destination MAC address and source MAC address, and the customer ID. It decrypts the tunnel data to obtain the Ethernet packet, further calculates the hash values ​​of the destination MAC address and source MAC address in the original Ethernet header, and then determines whether the MAC address hash value of the custom tunnel header is equal to the MAC address hash value of the original Ethernet header. If they are equal, the verification passes, and the original Ethernet packet is forwarded to the user equipment; otherwise, it is not forwarded.

[0085] In this embodiment, the router encrypts and forwards Ethernet packets from the client and decrypts and forwards tunnel packets forwarded by the server. As a relay, the server only needs to forward the packets to the corresponding client based on the client ID of the tunnel packet, without needing to encrypt or decrypt the packets or resolve the client's real address, thus improving the server's forwarding efficiency. At the same time, encryption and decryption based on a preset hash algorithm and key prevent data leakage and improve the security of the client's address.

[0086] This invention also provides a forwarding device based on mapped MAC addresses, comprising: a classification module, an encryption forwarding module, and a decryption forwarding module;

[0087] The classification module is used to obtain a first transmission message and encrypt and decrypt the first transmission message according to the message type of the first transmission message, wherein the message type includes Ethernet message and tunnel message;

[0088] The encryption forwarding module is used to encrypt the Ethernet packet according to a pre-configured hash algorithm and key when the packet type is an Ethernet packet, generate a tunnel packet, and forward the tunnel packet to the server so that the server can forward the tunnel packet.

[0089] The decryption and forwarding module is used to, when the message type is a tunnel message, obtain the hash value of the destination address, the hash value of the source address, and the client ID according to the tunnel message, and decrypt the Ethernet message according to the hash value of the destination address, the hash value of the source address, and the client ID to obtain the Ethernet message, and forward the Ethernet message to the client.

[0090] Please refer to Figure 5 , Figure 5 This is a schematic flowchart of a server forwarding method provided in an embodiment of the present invention.

[0091] In this embodiment, the server forwarding method includes:

[0092] Receive a second transmission message forwarded by the aforementioned message forwarding method;

[0093] The packet type of the second transmission message is parsed, and the second transmission message is forwarded according to the packet type; the packet type includes registration messages and Ethernet messages;

[0094] If the packet type is a registration message, then update the client list according to the registration message;

[0095] If the packet type is an Ethernet packet, then the hash values ​​of the destination address and source address of the second transmission packet are parsed, and the second transmission packet is forwarded according to the hash values ​​of the destination address and source address.

[0096] In this embodiment, updating the client list according to the registration message specifically means:

[0097] Parse the registration message to obtain the source IP address, source UDP port, device serial number, and customer ID;

[0098] Add the source IP address, source UDP port, device serial number, and client ID to the client list.

[0099] In this embodiment, the custom server initializes by creating a MAC address forwarding table and a client list, and listens on a UDP service port.

[0100] Please refer to Table 1, which is a list of clients for a server forwarding method provided in an embodiment of the present invention.

[0101]

[0102] Table 1

[0103] In this embodiment, the server initializes and creates a MAC address forwarding table and a client list, and listens on the UDP service port. When a registration message is received, the server obtains the corresponding source IP address, source UDP port, client ID, and device serial number from the registration message and adds it to the client list.

[0104] In this embodiment, the custom server continuously monitors whether it receives custom tunnel packets from the client via UDP, and processes them according to the packet type in the custom tunnel header. If the packet type is a registration type, the server obtains the source IP address, source UDP port, and device serial number corresponding to the packet, and adds it to the client list. If the packet type is an Ethernet packet, the server obtains the source IP address and source UDP port corresponding to the packet, and interprets the custom tunnel header to extract the hash value of the destination MAC address and the hash value of the source MAC address.

[0105] In this embodiment, parsing the hash values ​​of the destination address and source address of the second transmission packet, and forwarding the second transmission packet according to the hash values ​​of the destination address and source address, specifically involves:

[0106] Parse the second transmission message to obtain the source IP address, source UDP port, client ID, hash value of the destination address, and hash value of the source address;

[0107] The address forwarding table is queried and updated based on the hash value of the source address and the client ID. If the address forwarding table contains forwarding record information for the current source address's hash value and the client ID, the second packet is forwarded to the client IP and UDP port in the forwarding record information. Otherwise, the second packet is forwarded to all client IPs and UDP ports associated with the client ID.

[0108] Please refer to Table 2, which is a MAC address forwarding table for a server forwarding method provided in an embodiment of the present invention.

[0109]

[0110] Table 2

[0111] In this embodiment, each row in the MAC address forwarding table corresponds to one forwarding record.

[0112] In this embodiment, the server receives a custom tunnel packet of Ethernet type sent from the client (5G router device), extracts the source IP address, source UDP port, client ID, destination MAC hash value, and source MAC hash value from the packet, and updates or creates forwarding record entries to the MAC address forwarding table based on the source MAC hash value and client ID.

[0113] In this embodiment, the custom server updates or creates forwarding record entries to the MAC address forwarding table based on information such as the source MAC address hash value and the client ID. Then, it queries the MAC address forwarding table to obtain forwarding record entries based on the destination MAC address hash value and the client ID, and determines whether a forwarding record entry exists. If a forwarding record entry exists, the custom tunnel packet is sent to the IP address and UDP port information of the client corresponding to the forwarding record entry. If no forwarding record entry exists, the client list is iterated through based on the client ID to obtain each client, and the custom tunnel packet is sent to the IP address and UDP port information of each client. When a client whose IP address + UDP port equals the received custom tunnel packet is encountered, it is ignored and not sent.

[0114] This invention also provides a server forwarding device, comprising: a receiving module, a router parsing module, a registration module, and a router forwarding module;

[0115] The receiving module is used to receive the second transmission message forwarded by the aforementioned message forwarding method.

[0116] The router parsing module is used to parse the packet type of the second transmission message and forward the second transmission message according to the packet type; the packet type includes registration message and Ethernet message;

[0117] The registration module is used to update the client list according to the registration message when the packet type is a registration message;

[0118] The router forwarding module is used to, when the packet type is an Ethernet packet, parse the hash values ​​of the destination address and source address of the second transmission packet, and forward the second transmission packet according to the hash values ​​of the destination address and source address.

[0119] Please refer to Figure 6 , Figure 6 This is a timing diagram of a forwarding method based on mapped MAC addresses provided in an embodiment of the present invention.

[0120] In this embodiment, the MAC address mapping forwarding method is implemented using a user equipment, a router, and a server. The router forwards packets based on the aforementioned packet forwarding method, and the server forwards packets based on the aforementioned server forwarding method.

[0121] In this embodiment, the client's router first registers with the server.

[0122] In this embodiment, the user equipment sends an Ethernet packet to the router device; after receiving the Ethernet packet, the router device constructs a custom tunnel packet according to the customer's preset hash algorithm and key. Specifically, it calculates the hash values ​​of the destination address and the source address according to the preset hash algorithm and key, generates the custom tunnel packet, and sends the custom tunnel packet to the server.

[0123] In this embodiment, after receiving the custom tunnel packet sent by the router device, the server parses the custom tunnel packet to obtain the hash value of the destination address and the hash value of the source NAC address. Then, based on the hash value of the destination address and the client ID, it matches a forwarding record in the MAC forwarding list. Specifically, it matches the original MAC address hash value and client information in the MAC forwarding list. If there is no corresponding forwarding record, it creates a forwarding record in the MAC forwarding list based on the original MAC address hash value and the client ID. If there is a corresponding forwarding record, it updates the forwarding record in the MAC forwarding list based on the original MAC address hash value and the client ID, and forwards the tunnel packet to the router device according to the forwarding record.

[0124] In this embodiment, after receiving the tunnel packet sent by the server, the router device parses the custom tunnel packet to obtain the original Ethernet packet and Ethernet header. The Ethernet header includes the destination address, the hash value of the source address, and the client ID. The router calculates the hash value of the destination address and the source MAC address in the Ethernet header respectively. The router compares the hash values ​​of the destination address and the source MAC address in the custom tunnel header to calculate the hash values ​​of the destination address and the source MAC address. If the two calculated hash values ​​are equal, the verification passes. After performing packet verification, the router forwards the Ethernet packet to the user equipment.

[0125] In this embodiment, the router encrypts and forwards Ethernet packets from the client and decrypts and forwards tunnel packets forwarded by the server. As a relay, the server only needs to forward the packets to the corresponding client based on the client ID of the tunnel packet, without needing to encrypt or decrypt the packets or resolve the client's real address, thus improving the server's forwarding efficiency. At the same time, encryption and decryption based on a preset hash algorithm and key prevent data leakage and improve the security of the client's address.

[0126] In this embodiment, the customer pre-configures the communication key and hash algorithm, and the server does not need to encrypt or decrypt or know the original real MAC address. 5G router devices with the same customer ID must use the same key and hash algorithm to communicate securely; otherwise, the 5G router device will fail to verify the message and discard it. Therefore, if a device uses an access server with the same customer ID but lacks the key and hash algorithm, that device cannot communicate normally with other devices.

[0127] The specific embodiments described above further illustrate the purpose, technical solution, and beneficial effects of the present invention. It should be understood that the above descriptions are merely specific embodiments of the present invention and are not intended to limit the scope of protection of the present invention. In particular, it should be noted that any modifications, equivalent substitutions, improvements, etc., made within the spirit and principles of the present invention should be included within the scope of protection of the present invention for those skilled in the art.

Claims

1. A message forwarding method, characterized in that: include: Acquire a first transmission message, and perform encryption and decryption processing on the first transmission message according to a message type of the first transmission message, where the message type includes an Ethernet message and a tunnel message; If the message type is an Ethernet message, encrypt the Ethernet message according to a pre-configured hash algorithm and a key to generate a tunnel message. Specifically, obtain the destination address and the source address of the Ethernet message, and calculate the hash value of the destination address and the hash value of the source address according to the pre-configured hash algorithm; Constructing a tunnel header according to the hash value of the destination address, the hash value of the source address and the client ID, and encrypting the first transmission message according to a pre-configured key to generate tunnel data; Generate a tunnel message according to the tunnel data and the tunnel header; and forwarding the tunnel message to a server so that the server forwards the tunnel message; If the message type is a tunnel message, the tunnel header of the tunnel message is parsed to obtain the hash value of the destination address, the hash value of the source address and the client ID, and the tunnel data of the tunnel message is decrypted to obtain an Ethernet message, and the Ethernet message is forwarded to the client.

2. A message forwarding method according to claim 1, characterized in that: Before obtaining the first transmission message, the method further includes: Pre-configure the client's hash algorithm and key, create a UDP service port; and generate a registration message based on the client's customer ID, hash algorithm and key; The registration message is sent to the server for registration, so that the server adds the client ID to the client list.

3. A message forwarding method according to claim 1, characterized in that: The step of parsing the tunnel header of the tunnel message to obtain the hash value of the destination address, the hash value of the source address and the client ID, decrypting the tunnel data of the tunnel message to obtain an Ethernet message, and forwarding the Ethernet message to the client is specifically as follows: Parsing the tunnel header and tunnel data of the tunnel message, parsing the tunnel header to obtain first customer information, where the first customer information includes a hash value of a destination address, a hash value of a source address, and a customer ID; Acquire an Ethernet message according to the tunnel data, and calculate second customer information for the Ethernet message according to a preset hash algorithm and a key, the second customer information including a hash value of a destination address, a hash value of a source address, and a customer ID; The first client information and the second client information are verified, and the Ethernet message is forwarded to the client according to the verification result.

4. A message forwarding method as claimed in claim 3, characterized in that: The verifying the first customer information and the second customer information, and forwarding the Ethernet message to the client according to the verification result, is specifically: Comparing the hash value of the destination address and the hash value of the source address in the first customer information and the second customer information; When the hash value of the destination address and the hash value of the source address in the first client information are equal to the hash value of the destination address and the hash value of the source address in the second client information, the Ethernet message is forwarded to the client.

5. A server forwarding method, characterized in that: include: Receiving a second transmission message forwarded by a message forwarding method according to any one of claims 1 to 4; Parsing a packet type of the second transmission message, and forwarding the second transmission message according to the packet type; the packet type includes a registration message and an Ethernet message; If the packet type is a registration message, updating the client list according to the registration message; If the packet type is an Ethernet message, the hash value of the destination address and the hash value of the source address of the second transmission message are parsed, and the second transmission message is forwarded according to the hash value of the destination address and the hash value of the source address.

6. A server forwarding method as claimed in claim 5, characterized in that: The updating of the client list according to the registration message is specifically: Parse the registration message to obtain the source IP address, source UDP port, device serial number and customer ID; The source IP address, source UDP port, device serial number and client ID are added to the client list.

7. A server forwarding method as claimed in claim 5, characterized in that: The step of parsing the hash value of the destination address and the hash value of the source address of the second transmission message, and forwarding the second transmission message according to the hash value of the destination address and the hash value of the source address, is specifically: Parsing the second transmission message to obtain a source IP address, a source UDP port, a client ID, a hash value of a destination address, and a hash value of a source address; Query and update the address forwarding table according to the hash value of the source address and the client ID; If the address forwarding table contains the hash value of the current source address and the forwarding record information of the client ID, forwarding the second transmission message to the client IP and UDP port in the forwarding record information; Otherwise, the second transmission message is forwarded to all client IPs and UDP ports associated with the client ID.

8. A message forwarding device, characterized in that: include: Classification module, encryption forwarding module and decryption forwarding module; The classification module is used to obtain a first transmission message, and perform encryption and decryption processing on the first transmission message according to a message type of the first transmission message, wherein the message type includes an Ethernet message and a tunnel message; The encryption forwarding module is used for, when the message type is an Ethernet message, encrypting the Ethernet message according to a pre-configured hash algorithm and a key to generate a tunnel message, specifically, obtaining a destination address and a source address of the Ethernet message, and calculating a hash value of the destination address and a hash value of the source address according to a pre-configured hash algorithm; Constructing a tunnel header according to the hash value of the destination address, the hash value of the source address and the client ID, and encrypting the first transmission message according to a pre-configured key to generate tunnel data; Generate a tunnel message according to the tunnel data and the tunnel header; and forwarding the tunnel message to a server so that the server forwards the tunnel message; The decryption and forwarding module is used to parse the tunnel header of the tunnel message to obtain the hash value of the destination address, the hash value of the source address and the client ID when the message type is a tunnel message, and decrypt the tunnel data of the tunnel message to obtain an Ethernet message, and forward the Ethernet message to the client.

9. A server forwarding device, characterized in that: include: Receiving module, router parsing module, registration module and router forwarding module; The receiving module is used to receive a second transmission message forwarded by a message forwarding method according to any one of claims 1 to 4; The router parsing module is used to parse the packet type of the second transmission message and forward the second transmission message according to the packet type; the packet type includes a registration message and an Ethernet message; The registration module is used to update the client list according to the registration message when the packet type is a registration message; The router forwarding module is used to parse the hash value of the destination address and the hash value of the source address of the second transmission message when the packet type is an Ethernet message, and forward the second transmission message according to the hash value of the destination address and the hash value of the source address.

Images