SeND-based kernel and protocol stack interaction method and device

Abstract

The invention provides an interaction method and device of a kernel and a protocol stack based on SeND, and belongs to the technical field of communication. The method comprises the following steps: after a kernel receives an ICMPv6SeND message, determining whether the ICMPv6SeND message is an assembly verification message based on a preset verification rule; wherein the preset verification rule is used for identifying whether the ICMPv6SeND message carries a SeND option field or not; if yes, packaging the assembled verification message to obtain a verification message, and sending the verification message to a protocol stack; and according to a verification result from the protocol stack, matching a corresponding processing strategy so as to process the assembled verification message according to the processing strategy. Therefore, the problems that the current ICMPv6SeND message processing efficiency is low, and a message queue of a kernel and a protocol stack is easily blocked when the message quantity is large are solved, and the use experience of a user is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and device for interaction between a kernel and a protocol stack based on SeND. Background Art

[0002] SeND (Secure Neighbor Discovery) is a security protocol for neighbor discovery and address resolution in IPv6 (Internet Protocol Version 6) networks. It aims to improve the security of IPv6 networks, especially to prevent address spoofing and various attacks on the neighbor discovery protocol. ICMPv6 (Internet Control Message Protocol version 6) messages that rely on the SeND mechanism are ICMPv6 SeND messages.

[0003] The inventor found that when a device currently receives an ICMPv6 SeND message, the kernel usually assembles the option fields in some messages separately, and then the protocol stack completes the verification and returns the assembly verification result message to the kernel. This method leads to low message processing efficiency, and when facing a large number of messages at the same time, it is easy to block the message queues of the kernel and the protocol stack, affecting the normal operation of the communication function and bringing an unfriendly experience to users. Summary of the invention

[0004] The embodiments of the present application provide a method and device for interacting between a kernel and a protocol stack based on SeND, which is used to solve the problem that the current ICMPv6 SeND message processing efficiency is low. When the message volume is large, it is easy to cause the message queues of the kernel and the protocol stack to be blocked, affecting the user experience.

[0005] On the one hand, an embodiment of the present application provides a method for interacting between a kernel and a protocol stack based on SeND, the method comprising:

[0006] After receiving the ICMPv6 SeND message, the kernel determines whether the ICMPv6 SeND message is an assembly verification message based on a preset verification rule; wherein the preset verification rule is used to identify whether the ICMPv6 SeND message carries a SeND option field;

[0007] If so, encapsulating the assembly verification message to obtain a verification message, so as to send the verification message to the protocol stack;

[0008] According to the verification result from the protocol stack, a corresponding processing strategy is matched to process the assembly verification message according to the processing strategy.

[0009] In an implementation of the present application, the SeND option field is an option related to the security mechanism of SeND, including at least Timestamp option, Nonce option, CGA option, and RSA option.

[0010] In one implementation of the present application, before encapsulating the assembly verification message to obtain a verification message and sending the verification message to the protocol stack, the method further includes:

[0011] The kernel verifies the Timestamp option and the Nonce option;

[0012] If the verification result is passed, encapsulating the assembly verification message;

[0013] Otherwise, the assembly verification message is processed according to the processing strategy.

[0014] In one implementation of the present application, the processing strategy at least includes ending the process and sending a kernel reply message.

[0015] In one implementation of the present application, encapsulating the assembly verification message to obtain a verification message to send the verification message to a protocol stack specifically includes:

[0016] Determine the number of SeND option fields corresponding to the assembly verification message;

[0017] Determine a variable-length Options list and an encapsulation header according to the number of the SeND option fields, and add each of the SeND option fields to the variable-length Options list;

[0018] The verification message is obtained by encapsulating the encapsulation header and the variable-length Options list after adding fields, so as to send the verification message to the protocol stack.

[0019] On the other hand, an embodiment of the present application further provides a SeND-based kernel and protocol stack interaction device, the device comprising:

[0020] A determination module, used for the kernel to determine whether the ICMPv6 SeND message is an assembly verification message based on a preset verification rule after receiving the ICMPv6 SeND message; wherein the preset verification rule is used to identify whether the ICMPv6 SeND message carries a SeND option field;

[0021] an encapsulation module, for encapsulating the assembly verification message to obtain a verification message, so as to send the verification message to the protocol stack;

[0022] A matching module is used to match a corresponding processing strategy according to a verification result from the protocol stack, so as to process the assembly verification message according to the processing strategy.

[0023] In an implementation of the present application, the SeND option field is an option related to the security mechanism of SeND, including at least Timestamp option, Nonce option, CGA option, and RSA option.

[0024] In one implementation of the present application, before encapsulating the assembly verification message to obtain a verification message and sending the verification message to the protocol stack, the device further includes:

[0025] A verification module, used for the kernel to verify the Timestamp option and the Nonce option;

[0026] The encapsulation module encapsulates the assembly verification message when the verification result is passed;

[0027] A processing module is used to process the assembly verification message according to the processing strategy otherwise.

[0028] In one implementation of the present application, the processing strategy at least includes ending the process and sending a kernel reply message.

[0029] In one implementation of the present application, the encapsulation module is specifically used to:

[0030] Determine the number of SeND option fields corresponding to the assembly verification message;

[0031] Determine a variable-length Options list and an encapsulation header according to the number of the SeND option fields, and add each of the SeND option fields to the variable-length Options list;

[0032] The verification message is obtained by encapsulating the encapsulation header and the variable-length Options list after adding fields, so as to send the verification message to the protocol stack.

[0033] Compared with the prior art, the present invention has the following significant effects:

[0034] Through the above technical solution, there is no need to encapsulate messages for each option and send them to the protocol stack for verification. Each message only encapsulates one message, which greatly reduces the occupancy of the message queue and ensures the normal operation of the message queue between the kernel and the protocol stack. This improves the efficiency of ICMPv6 SeND message processing, and can still ensure the smooth flow of kernel and protocol stack message queues when the message volume is large, improving the user experience. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0036] Figure 1 A flowchart of a method for interacting between a kernel and a protocol stack based on SeND in an embodiment of the present application;

[0037] Figure 2 This is a schematic diagram of an original interaction method flow corresponding to an interaction method between a kernel and a protocol stack based on SeND in an embodiment of the present application;

[0038] Figure 3 Another flowchart of a method for interacting between a kernel and a protocol stack based on SeND in an embodiment of the present application;

[0039] Figure 4 It is a structural diagram of an interaction device between a kernel and a protocol stack based on SeND in an embodiment of the present application. DETAILED DESCRIPTION

[0040] In order to make the purpose, technical solution and advantages of the present application clearer, the technical solution of the present application will be clearly and completely described below in combination with the specific embodiments of the present application and the corresponding drawings. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present application.

[0041] In the existing technology, the kernel needs to verify the SeND option in the interactive solution of ICMPv6 SeND messages based on Linux kernel 2.6.24. However, the kernel's option verification logic for options such as CGA (Cryptographically Generated Addresses) and RSA (Rivest Shamir Adleman) is not perfect and needs to be sent to the protocol stack for further processing. During the kernel verification, the current option processing result must be obtained before the next option is verified. In addition, the scenario of receiving a large number of ICMPv6 SeND messages at the same time is not considered.

[0042] The embodiments of the present application provide a method and device for interacting with a kernel and a protocol stack based on SeND, which is used to solve the problem that the current ICMPv6 SeND message processing efficiency is low. When the message volume is large, it is easy to cause the message queue of the kernel and the protocol stack to be blocked, affecting the user experience.

[0043] The following describes in detail various embodiments of the present application in conjunction with the accompanying drawings.

[0044] The embodiment of the present application provides a method for interacting between a kernel and a protocol stack based on SeND, such as Figure 1 As shown, the method may include steps S101-S103:

[0045] S101, after receiving an ICMPv6 SeND message, the kernel determines whether the ICMPv6 SeND message is an assembly verification message based on a preset verification rule.

[0046] The preset verification rule is used to identify whether the ICMPv6 SeND message carries the SeND option field.

[0047] Among them, the kernel can be located in devices such as IPv6 routers, IPv6 hosts, switches, network management systems, etc., and this application does not make specific limitations on this.

[0048] Among them, the SeND option field is an option related to the security mechanism of SeND, including at least Timestamp option, Nonce option, CGA option, and RSA option. The CGA option is used to verify the authenticity of the IPv6 address and prevent address spoofing attacks. The RSA option is a digital signature for the SeND neighbor discovery message, which is used to verify the integrity of the message and the authenticity of the sender. The ICMPv6 SeND message can be understood as a SeND neighbor discovery message.

[0049] That is to say, after receiving the ICMPv6 SeND message, the kernel first uses the preset verification rules to detect the SeND option field to determine whether the ICMPv6 SeND message is an assembly verification message. If it is an assembly verification message, then execute the subsequent S102-S103; if not, that is, the ICMPv6 SeND message does not contain the SeND option field, then the kernel directly sends the entire ICMPv6 SeND message to the protocol stack for processing. Since the ICMPv6 SeND message includes regular options and SeNDoptions, the kernel cannot process regular options and needs to send them to the protocol stack for processing.

[0050] In addition, the protocol stack of this application transplants the original kernel's verification method for SeND option to the protocol and matches it with the original protocol stack verification method so that the protocol stack can handle multiple options.

[0051] S102: When the kernel determines that the ICMPv6 SeND message is an assembly verification message, it encapsulates the assembly verification message to obtain a verification message, and sends the verification message to the protocol stack.

[0052] In an embodiment of the present application, before encapsulating the assembly verification message to obtain a verification message and sending the verification message to the protocol stack, the method further includes:

[0053] The kernel verifies the Timestamp option and the Nonce option. If the verification result is passed, the assembly verification message is encapsulated. Otherwise, the assembly verification message is processed according to the processing strategy. The processing strategy at least includes ending the process and the kernel replying to the message.

[0054] That is to say, the kernel only verifies the timestamp option and the random number option, compares the Timestamp option and the Nonce option with the preset record option content, and obtains the verification result based on whether the comparison result is consistent. If the verification result passes, the kernel can encapsulate the complete assembly verification message, that is, the ICMPv6SeND message, into a message to send to the protocol stack. If the verification result fails, for example, any option in the Timestamp option and the Nonce option is inconsistent with the preset record option content, the corresponding process of the assembly verification message can be terminated.

[0055] Further, the assembly verification message is encapsulated to obtain a verification message, so as to send the verification message to the protocol stack, specifically including:

[0056] The kernel determines the number of SeND option fields corresponding to the assembly verification message. According to the number of SeND option fields, the variable-length Options list and the encapsulation header are determined, and each SeND option field is added to the variable-length Options list in a predetermined order. The predetermined order can be set by the user, and this application does not make specific restrictions on this. For example, the options are added in sequence according to the pre-defined encoding of the options. According to the encapsulation header and the variable-length Options list after the added fields, the verification message is encapsulated to send the verification message to the protocol stack.

[0057] In other words, the present application defines a new encapsulation structure, including an encapsulation header and a variable-length Options list (i.e., a list storing options). The encapsulation header may include basic information such as the type, length, and checksum of the encapsulation structure. Each option in the variable-length Options list should be encoded in the format specified by the ICMPv6 SeND protocol. The kernel can determine the number of SeND option fields, thereby determining the length of the variable-length Options list, and adding SeND option fields corresponding to the number of SeND option fields. According to the above encapsulation results, the kernel can package multiple SeND options into a whole, obtain a verification message, and send the verification message to the protocol stack for unified processing of each SeND option in the whole.

[0058] In an embodiment of the present application, after the protocol stack receives the above-mentioned encapsulated verification message, it can first parse the encapsulation header to obtain the length and other necessary information of the variable-length Options list, and then traverse the variable-length Options list in the above-mentioned predetermined order and verify and process each option. The protocol stack can process various options defined in the ICMPv6 SeND protocol, including but not limited to CGA option, RSA option, etc. The processing process should follow the provisions of the ICMPv6 SeND protocol and perform necessary verification and analysis on each option. After the processing is completed, the protocol stack encapsulates the processing results (such as whether the verification is passed, error information, etc.) into a message, that is, the verification result.

[0059] Through the above solution, the verification logic of multiple options is merged to reduce the number of interactions between the kernel and the protocol stack. When facing multiple ICMPv6 messages, it can greatly reduce the computing overhead and improve the processing efficiency of the protocol stack.

[0060] In addition, when the kernel determines that the ICMPv6 SeND message is not an assembly verification message, it processes the ICMPv6 SeND message normally, that is, sends it to the protocol stack for processing.

[0061] S103, the kernel matches a corresponding processing strategy according to the verification result from the protocol stack, so as to process the assembly verification message according to the processing strategy.

[0062] For example, if the verification result is failed, the processing strategy is to end the process; if the verification result is passed, the kernel will perform related operations of the reply message.

[0063] Figure 2 A flowchart of the original kernel and protocol stack interaction method before implementing the SeND-based kernel and protocol stack interaction method corresponding to the embodiment of the present application is as follows: Figure 2 As shown, including:

[0064] S201, the kernel receives the ICMPv6 message; S202, determines whether it carries the SeND option, if so, executes S203, otherwise executes S204; S203, determines whether the check results of the Timestamp option and Nonce option in the kernel are success, if so, executes S205, otherwise executes S2010; S204, sends the complete ICMPv6 SeND message to the protocol stack; S205, determines whether there is an unprocessed SeND option, if so, executes S206, otherwise executes S204; S206, sends a single SeND option is encapsulated into the message; S207, the message is sent to the protocol stack; S208, the processing result is returned to the kernel; S209, determine whether the processing result is success, if so, execute S205, otherwise execute S2010; S2010, end the process; S2011, the protocol stack verifies non-SeNDoption; S2012, the processing result is returned to the kernel; S2013, determine whether the processing result is success, if not, execute S2010, otherwise execute S2014; S2014, the kernel replies with a message.

[0065] Based on the above process, it can be seen that when the kernel processes a message carrying the SeND option, the kernel needs to interact with the protocol stack multiple times, and the message processing cannot be completed efficiently. Figure 3 As shown, including:

[0066] S301, the kernel receives the ICMPv6 message; S302, determines whether it carries the SeND option, if so, executes S303, otherwise executes S304; S303, determines whether the check results of the Timestamp option and Nonce option in the kernel are success, if so, executes S304, if not, executes S308; S304, the complete ICMPv6 SeND message is sent to the protocol stack; S305, the protocol stack verifies all options; S306, the processing result is returned to the kernel; S307, determines whether the processing result is success, if not, executes S308, if yes, executes S309; ​​S308, ends the process; S309, the kernel replies to the message.

[0067] Through the above technical solution, there is no need to encapsulate messages for each option and send them to the protocol stack for verification. Each message only encapsulates one message, which greatly reduces the occupancy of the message queue and ensures the normal operation of the message queue between the kernel and the protocol stack. This improves the efficiency of ICMPv6 SeND message processing, and can still ensure the smooth flow of kernel and protocol stack message queues when the message volume is large, improving the user experience.

[0068] Figure 4 A structural diagram of a SeND-based kernel and protocol stack interaction device 400 provided in an embodiment of the present application, such as Figure 4 As shown, the device comprises:

[0069] The determination module 401 is used for the kernel to determine whether the ICMPv6 SeND message is an assembly verification message based on a preset verification rule after receiving the ICMPv6 SeND message. The preset verification rule is used to identify whether the ICMPv6 SeND message carries the SeND option field. The encapsulation module 402 is used to encapsulate the assembly verification message to obtain a verification message if so, so as to send the verification message to the protocol stack. The matching module 403 is used to match the corresponding processing strategy according to the verification result from the protocol stack, so as to process the assembly verification message according to the processing strategy.

[0070] In one embodiment of the present application, the SeND option field is an option related to the security mechanism of SeND, including at least Timestamp option, Nonce option, CGA option, and RSA option.

[0071] In one embodiment of the present application, before encapsulating the assembly verification message to obtain a verification message and sending the verification message to the protocol stack, the device further includes:

[0072] The verification module is used for the kernel to verify the Timestamp option and the Nonce option. The encapsulation module encapsulates the assembly verification message if the verification result is passed. The processing module is used to process the assembly verification message according to the processing strategy otherwise.

[0073] In one embodiment of the present application, the processing strategy at least includes ending the process and the kernel replying message.

[0074] In one embodiment of the present application, the encapsulation module 402 is specifically used for:

[0075] Determine the number of SeND option fields corresponding to the assembly verification message. According to the number of SeND option fields, determine the variable-length Options list and the encapsulation header, and add each SeND option field to the variable-length Options list. According to the encapsulation header and the variable-length Options list after adding the field, encapsulate to obtain the verification message, and send the verification message to the protocol stack.

[0076] The systems, devices, modules or units described in the above embodiments may be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, the computer may be, for example, a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email device, a game console, a tablet computer, a wearable device, or a combination of any of these devices.

[0077] For the convenience of description, the above device is described in various units according to their functions. Of course, when implementing this specification, the functions of each unit can be implemented in the same or multiple software and / or hardware.

[0078] Those skilled in the art will appreciate that the embodiments of this specification may be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification may be in the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the embodiments of this specification may be in the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0079] This specification is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of this specification. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0080] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0081] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process in the computer or other programmable device. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0082] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0083] The memory may include non-permanent storage in a computer-readable medium, random access memory (RAM) and / or non-volatile memory in the form of read-only memory (ROM) or flash RAM. The memory is an example of a computer-readable medium.

[0084] Computer readable media include permanent and non-permanent, removable and non-removable media that can be implemented by any method or technology to store information. Information can be computer readable instructions, data structures, program modules or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, magnetic tape magnetic disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device. As defined herein, computer readable media does not include temporary computer readable media (transitory media), such as modulated data signals and carrier waves.

[0085] It should also be noted that the terms "include", "comprises" or any other variations thereof are intended to cover non-exclusive inclusion, so that a process, method, commodity or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, commodity or device. In the absence of more restrictions, the elements defined by the sentence "comprises a ..." do not exclude the existence of other identical elements in the process, method, commodity or device including the elements.

[0086] This specification may be described in the general context of computer-executable instructions executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc. that perform specific tasks or implement specific abstract data types. This specification may also be practiced in distributed computing environments where tasks are performed by remote processing devices connected through a communication network. In a distributed computing environment, program modules may be located in local and remote computer storage media, including storage devices.

[0087] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device, equipment, and non-volatile computer storage medium embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0088] The above is a description of a specific embodiment of the specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0089] The above description is only one or more embodiments of this specification and is not intended to limit this specification. For those skilled in the art, one or more embodiments of this specification may have various changes and variations. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of one or more embodiments of this specification shall be included in the scope of the claims of this specification.

Claims

1. A method for interacting between a kernel and a protocol stack based on SeND, characterized in that: The method comprises: After receiving the ICMPv6 SeND message, the kernel determines whether the ICMPv6 SeND message is an assembly verification message based on a preset verification rule; wherein the preset verification rule is used to identify whether the ICMPv6 SeND message carries a SeND option field; If so, encapsulating the assembly verification message to obtain a verification message, so as to send the verification message to the protocol stack; According to the verification result from the protocol stack, a corresponding processing strategy is matched to process the assembly verification message according to the processing strategy.

2. According to claim 1, a method for interacting between a kernel and a protocol stack based on SeND, characterized in that: The SeND option field is an option related to the security mechanism of SeND, including at least Timestamp option, Nonce option, CGA option, and RSA option.

3. The method for interacting between a kernel and a protocol stack based on SeND according to claim 2, characterized in that: The method further includes encapsulating the assembly verification message to obtain a verification message, and before sending the verification message to the protocol stack: The kernel verifies the Timestamp option and the Nonce option; If the verification result is passed, encapsulating the assembly verification message; Otherwise, the assembly verification message is processed according to the processing strategy.

4. The method for interacting between a kernel and a protocol stack based on SeND according to claim 3, characterized in that: The processing strategy at least includes ending the process and the kernel replying to the message.

5. The method for interacting between a kernel and a protocol stack based on SeND according to claim 1, characterized in that: Encapsulating the assembly verification message to obtain a verification message, so as to send the verification message to the protocol stack, specifically includes: Determine the number of SeND option fields corresponding to the assembly verification message; Determine a variable-length Options list and an encapsulation header according to the number of the SeND option fields, and add each of the SeND option fields to the variable-length Options list; The verification message is obtained by encapsulating the encapsulation header and the variable-length Options list after adding fields, so as to send the verification message to the protocol stack.

6. A SeND-based kernel and protocol stack interaction device, characterized in that: The device comprises: A determination module, used for the kernel to determine whether the ICMPv6 SeND message is an assembly verification message based on a preset verification rule after receiving the ICMPv6 SeND message; wherein the preset verification rule is used to identify whether the ICMPv6 SeND message carries a SeND option field; An encapsulation module, for encapsulating the assembly verification message to obtain a verification message, so as to send the verification message to the protocol stack; A matching module is used to match a corresponding processing strategy according to a verification result from the protocol stack, so as to process the assembly verification message according to the processing strategy.

7. The SeND-based kernel and protocol stack interaction device according to claim 1, characterized in that: The SeND option field is an option related to the security mechanism of SeND, including at least Timestamp option, Nonce option, CGA option, and RSA option.

8. The method for interacting between a kernel and a protocol stack based on SeND according to claim 7, characterized in that: Before encapsulating the assembly verification message to obtain a verification message and sending the verification message to the protocol stack, the device further includes: A verification module, used for the kernel to verify the Timestamp option and the Nonce option; The encapsulation module encapsulates the assembly verification message when the verification result is passed; A processing module is used to process the assembly verification message according to the processing strategy otherwise.

9. The method for interacting between a kernel and a protocol stack based on SeND according to claim 8, characterized in that: The processing strategy at least includes ending the process and the kernel replying to the message.

10. The SeND-based kernel and protocol stack interaction method according to claim 1, characterized in that: The encapsulation module is specifically used for: Determine the number of SeND option fields corresponding to the assembly verification message; Determine a variable-length Options list and an encapsulation header according to the number of the SeND option fields, and add each of the SeND option fields to the variable-length Options list; The verification message is obtained by encapsulating the encapsulation header and the variable-length Options list after adding fields, so as to send the verification message to the protocol stack.

Images