A kernel-protocol stack interaction method and apparatus based on SeND

Abstract

This application provides a kernel-protocol stack interaction method and apparatus based on SeND, belonging to the field of communication technology. In this method, when the kernel receives an ICMPv6 SeND message, it determines whether the ICMPv6 SeND message is an assembly verification message based on preset verification rules. The preset verification rules are used to identify whether the ICMPv6 SeND message carries a SeND option field. If so, the assembly verification message is encapsulated to obtain a verification message, which is then sent to the protocol stack. Based on the verification result from the protocol stack, a corresponding processing strategy is matched to process the assembly verification message. This solves the problem of low processing efficiency for current ICMPv6 SeND messages and the potential for message queue blockage between the kernel and protocol stack when the message volume is large, thus improving the user experience.

Description

Technical Field

[0001] This application relates to the field of communication technology, and in particular to a method and apparatus for interaction between a kernel and a protocol stack based on SeND. Background Technology

[0002] Secure Neighbor Discovery (SeND) is a security protocol used for neighbor discovery and address resolution in IPv6 (Internet Protocol Version 6) networks. It aims to improve the security of IPv6 networks, particularly preventing address spoofing and various attacks on neighbor discovery protocols. Messages in ICMPv6 (Internet Control Message Protocol version 6) that rely on the SeND mechanism are called ICMPv6 SeND messages.

[0003] The inventors discovered that currently, when a device receives an ICMPv6 SEND message, the kernel typically assembles the option field within a portion of the message separately. The protocol stack then performs verification and returns the assembled and verified result message to the kernel. This method results in low message processing efficiency, and when faced with a large number of messages simultaneously, it can easily cause message queues in the kernel and protocol stack to become congested, affecting the normal operation of communication functions and providing a poor user experience. Summary of the Invention

[0004] This application provides a kernel-protocol stack interaction method and apparatus based on SeND, which solves the problem of low efficiency in ICMPv6 SeND packet processing and the tendency for message queues in the kernel and protocol stack to be blocked when the packet volume is large, thus affecting the user experience.

[0005] On one hand, embodiments of this application provide a method for interaction between the kernel and the protocol stack based on SeND, the method comprising:

[0006] When the kernel receives an ICMPv6 SeND message, it determines whether the ICMPv6 SeND message is an assembly verification message based on a preset verification rule; wherein, the preset verification rule is used to identify whether the ICMPv6 SeND message carries a SeND option field.

[0007] If so, the assembled verification message is encapsulated to obtain a verification message, and the verification message is sent to the protocol stack;

[0008] Based on the verification result from the protocol stack, a corresponding processing strategy is matched to process the assembled verification message according to the processing strategy.

[0009] In one implementation of this application, the SeND option field contains options related to the security mechanism of SeND, including at least the Timestamp option, Nonce option, CGA option, and RSA option.

[0010] In one implementation of this application, before encapsulating the assembled verification message to obtain a verification message and sending the verification message to the protocol stack, the method further includes:

[0011] The kernel verifies the Timestamp option and the Nonce option;

[0012] If the verification result is successful, the assembled verification message will be encapsulated.

[0013] Otherwise, the assembly verification message is processed according to the processing strategy.

[0014] In one implementation of this application, the processing strategy includes at least terminating the process and sending a kernel reply message.

[0015] In one implementation of this application, the assembled verification message is encapsulated to obtain a verification message, which is then sent to the protocol stack. Specifically, this includes:

[0016] Determine the number of SeND option fields corresponding to the assembled verification message;

[0017] Based on the number of SeND option fields, determine the variable-length Options list and the encapsulation header, and add each of the SeND option fields to the variable-length Options list;

[0018] The verification message is obtained by encapsulating the header and the variable-length Options list after adding fields, and then the verification message is sent to the protocol stack.

[0019] On the other hand, embodiments of this application also provide an interaction device between a kernel and a protocol stack based on SeND, the device comprising:

[0020] The determination module is used by the kernel to determine whether an ICMPv6 SeND message is an assembly verification message based on a preset verification rule after receiving the ICMPv6 SeND message; wherein the preset verification rule is used to identify whether the ICMPv6 SeND message carries a SeND option field.

[0021] An encapsulation module is used to encapsulate the assembled verification message into a verification message if the condition is met, so as to send the verification message to the protocol stack.

[0022] The matching module is used to match the corresponding processing strategy based on the verification result from the protocol stack, so as to process the assembled verification message according to the processing strategy.

[0023] In one implementation of this application, the SeND option field contains options related to the security mechanism of SeND, including at least the Timestamp option, Nonce option, CGA option, and RSA option.

[0024] In one implementation of this application, before encapsulating the assembled verification message to obtain a verification message and sending the verification message to the protocol stack, the apparatus further includes:

[0025] The verification module is used by the kernel to verify the Timestamp option and the Nonce option;

[0026] The encapsulation module encapsulates the assembly verification message if the verification result is satisfactory.

[0027] A processing module is used to otherwise process the assembly verification message according to the processing strategy.

[0028] In one implementation of this application, the processing strategy includes at least terminating the process and sending a kernel reply message.

[0029] In one implementation of this application, the encapsulation module is specifically used for:

[0030] Determine the number of SeND option fields corresponding to the assembled verification message;

[0031] Based on the number of SeND option fields, determine the variable-length Options list and the encapsulation header, and add each of the SeND option fields to the variable-length Options list;

[0032] The verification message is obtained by encapsulating the header and the variable-length Options list after adding fields, and then the verification message is sent to the protocol stack.

[0033] Compared with the prior art, the significant advantages of this application are as follows:

[0034] The above technical solution eliminates the need to encapsulate messages for each option separately and send them to the protocol stack for verification. Each packet only encapsulates one message, significantly reducing the occupation of the message queue and ensuring the normal operation of the message queue between the kernel and the protocol stack. This improves the processing efficiency of ICMPv6 SEND packets, ensuring smooth communication between the kernel and the protocol stack message queue even with a large number of packets, thus enhancing the user experience. Attached Figure Description

[0035] The accompanying drawings, which are included to provide a further understanding of this application and form part of this application, illustrate exemplary embodiments and are used to explain this application, but do not constitute an undue limitation of this application. In the drawings:

[0036] Figure 1 This is a flowchart illustrating a SeND-based kernel-protocol stack interaction method in an embodiment of this application.

[0037] Figure 2 This is a schematic diagram of the original interaction method flow corresponding to a SeND-based kernel and protocol stack interaction method in an embodiment of this application.

[0038] Figure 3 This is a schematic diagram illustrating another method for interaction between the kernel and protocol stack based on SeND, as described in this application.

[0039] Figure 4 This is a schematic diagram of the structure of an interaction device between a kernel and a protocol stack based on SeND, as described in an embodiment of this application. Detailed Implementation

[0040] To make the objectives, technical solutions, and advantages of this application clearer, the technical solutions of this application will be clearly and completely described below in conjunction with specific embodiments and corresponding drawings. Obviously, the described embodiments are only a part of the embodiments of this application, and not all of them. Based on the embodiments in this application, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this application.

[0041] Existing technologies based on Linux kernel 2.6.24 for ICMPv6 SeND message interaction require the kernel to verify SeND options. However, the kernel's verification logic for options such as CGA (Cryptographically Generated Addresses) and RSA (Rivest Shamir Adleman) is insufficient, necessitating further processing by the protocol stack. Furthermore, the kernel requires the processing result of the current option before verifying the next. Additionally, it does not consider scenarios involving the simultaneous reception of a large number of ICMPv6 SeND messages.

[0042] This application provides a kernel-protocol stack interaction method and apparatus based on SeND to solve the problem of low efficiency in ICMPv6 SeND packet processing, which can easily lead to message queue blockage in the kernel and protocol stack when the packet volume is large, thus affecting the user experience.

[0043] The various embodiments of this application are described in detail below with reference to the accompanying drawings.

[0044] This application provides a method for kernel-protocol stack interaction based on SeND, such as... Figure 1 As shown, the method may include steps S101-S103:

[0045] S101: When the kernel receives an ICMPv6 SeND message, it determines whether the ICMPv6 SeND message is an assembly verification message based on preset verification rules.

[0046] The preset verification rules are used to identify whether ICMPv6 SeND messages carry the SeND option field.

[0047] The kernel can reside in devices such as IPv6 routers, IPv6 hosts, switches, and network management systems; this application does not impose specific limitations on it.

[0048] The SeND options field contains options related to the security mechanisms of SeND, including at least the Timestamp option, Nonce option, CGA option, and RSA option. The CGA option is used to verify the authenticity of the IPv6 address and prevent address spoofing attacks. The RSA option is a digital signature for the SeND neighbor discovery message, used to verify the message's integrity and the sender's authenticity. An ICMPv6 SeND message can be understood as a SeND neighbor discovery message.

[0049] In other words, after receiving an ICMPv6 SeND message, the kernel first uses preset verification rules to check the SeND option field to determine whether the ICMPv6 SeND message is an assembly verification message. If it is an assembly verification message, subsequent steps S102-S103 are executed; otherwise, if the ICMPv6 SeND message does not contain the SeND option field, the kernel directly sends the entire ICMPv6 SeND message to the protocol stack for processing. Since the ICMPv6 SeND message includes both regular options and SeND options, the kernel cannot process the regular options and must send them to the protocol stack for processing.

[0050] In addition, the protocol stack in this application ported the original kernel's verification method for SeND options to the protocol and matched it with the original protocol stack verification method so that the protocol stack can handle multiple options.

[0051] S102, if the kernel determines that the ICMPv6 SeND message is an assembly verification message, it encapsulates the assembly verification message to obtain a verification message, and sends the verification message to the protocol stack.

[0052] In this embodiment of the application, before encapsulating the assembled verification message into a verification message and sending the verification message to the protocol stack, the method further includes:

[0053] The kernel verifies the Timestamp option and Nonce option. If the verification passes, the assembled verification message is encapsulated. Otherwise, the assembled verification message is processed according to the processing strategy. This processing strategy includes at least terminating the process and sending a kernel reply message.

[0054] In other words, the kernel only verifies the timestamp and nonce options. It compares the timestamp and nonce options with the preset record options and determines the verification result based on the comparison. If the verification passes, the kernel can encapsulate the complete assembled verification message, i.e., the ICMPv6SeND message, into a message and send it to the protocol stack. If the verification fails, for example, if either the timestamp or nonce option is inconsistent with the preset record options, the process of assembling and verifying the message can be terminated.

[0055] Furthermore, the assembled verification message is encapsulated to obtain a verification message, which is then sent to the protocol stack. Specifically, this includes:

[0056] The kernel determines the number of SeND option fields corresponding to the assembled verification message. Based on the number of SeND option fields, it determines the variable-length Options list and encapsulation header, and adds each SeND option field to the variable-length Options list in a predetermined order. This predetermined order can be set by the user, and this application does not impose a specific limitation on it; for example, it can add the options sequentially according to predefined encodings. Based on the encapsulation header and the variable-length Options list after adding fields, the kernel encapsulates the message to obtain the verification message, which is then sent to the protocol stack.

[0057] In other words, this application defines a new encapsulation structure, including an encapsulation header and a variable-length Options list (i.e., a list storing options). The encapsulation header may contain basic information such as the encapsulation structure type, length, and checksum. Each option in the variable-length Options list should be encoded according to the format specified by the ICMPv6 SeND protocol. The kernel can determine the number of SeND option fields, thereby determining the length of the variable-length Options list, and add the SeND option fields corresponding to the number of SeND option fields to it. According to the above encapsulation result, the kernel can package multiple SeND options into a whole to obtain a check message, and send the check message to the protocol stack for unified processing of each SeND option in the whole.

[0058] In this embodiment, after receiving the encapsulated verification message, the protocol stack first parses the encapsulation header to obtain the length and other necessary information of the variable-length Options list. Then, it traverses the variable-length Options list in the predetermined order and verifies and processes each option. The protocol stack can handle various options defined in the ICMPv6 SeND protocol, including but not limited to CGA option and RSA option. The processing should follow the provisions of the ICMPv6 SeND protocol, performing necessary verification and parsing on each option. After processing, the protocol stack encapsulates the processing result (e.g., whether the verification passed, error information, etc.) into a message, i.e., the verification result.

[0059] By merging the verification logic of multiple options using the above approach, the number of interactions between the kernel and the protocol stack is reduced. When dealing with multiple ICMPv6 packets, this significantly reduces computational overhead and improves the processing efficiency of the protocol stack.

[0060] In addition, if the kernel determines that the ICMPv6 SeND message is not an assembly verification message, it will process the ICMPv6 SeND message normally, that is, send it to the protocol stack for processing.

[0061] S103, the kernel matches the corresponding processing strategy based on the verification result from the protocol stack, and processes the assembled verification message according to the processing strategy.

[0062] For example, if the verification result is unsuccessful, the processing strategy is to terminate the process; if the verification result is successful, the kernel will execute the relevant operations in the reply message.

[0063] Figure 2 This is a flowchart illustrating the original kernel-protocol stack interaction method prior to the SeND-based kernel-protocol stack interaction method corresponding to the embodiments of this application, as shown below. Figure 2 As shown, it includes:

[0064] S201, the kernel receives the ICMPv6 message; S202, it checks if the SeND option is carried; if yes, proceed to S203, otherwise proceed to S204; S203, it checks if the timestamp option and nonce option verification results in the kernel are successful; if yes, proceed to S205, otherwise proceed to S2010; S204, the complete ICMPv6 SeND message is sent to the protocol stack; S205, it checks if there are any unprocessed SeND options; if yes, proceed to S206, otherwise proceed to S204; S206, the single SeND... The option is encapsulated in the message; S207, the message is sent to the protocol stack; S208, the processing result is returned to the kernel; S209, it is determined whether the processing result is success. If yes, S205 is executed; otherwise, S2010 is executed; S2010, the process ends; S2011, the protocol stack verifies that it is not a SenDoption; S2012, the processing result is returned to the kernel; S2013, it is determined whether the processing result is success. If no, S2010 is executed; otherwise, S2014 is executed; S2014, the kernel replies with a message.

[0065] As can be seen from the above process, when processing packets carrying the SeND option, the kernel needs to interact with the protocol stack multiple times, which cannot efficiently complete packet processing. The flowchart of the SeND-based kernel-protocol stack interaction method provided in this application is shown below. Figure 3 As shown, it includes:

[0066] S301, The kernel receives the ICMPv6 message; S302, Determine if the SeND option is carried. If yes, proceed to S303; otherwise, proceed to S304; S303, Determine if the timestamp option and nonce option verification results in the kernel are success. If yes, proceed to S304; otherwise, proceed to S308; S304, Send the complete ICMPv6 SeND message to the protocol stack; S305, The protocol stack verifies all options; S306, The processing result is returned to the kernel; S307, Determine if the processing result is success. If no, proceed to S308; if yes, proceed to S309; ​​S308, End the process; S309, The kernel replies with a message.

[0067] The above technical solution eliminates the need to encapsulate messages for each option separately and send them to the protocol stack for verification. Each packet only encapsulates one message, significantly reducing the occupation of the message queue and ensuring the normal operation of the message queue between the kernel and the protocol stack. This improves the processing efficiency of ICMPv6 SEND packets, ensuring smooth communication between the kernel and the protocol stack message queue even with a large number of packets, thus enhancing the user experience.

[0068] Figure 4 A schematic diagram of the structure of a SeND-based kernel and protocol stack interaction device 400 provided in this application embodiment is shown below. Figure 4 As shown, the device includes:

[0069] The determination module 401 is used by the kernel to determine whether an ICMPv6 SeND message is an assembly verification message based on preset verification rules after receiving it. The preset verification rules are used to identify whether the ICMPv6 SeND message carries the SeND option field. The encapsulation module 402 is used to encapsulate the assembly verification message into a verification message if it is, and then send the verification message to the protocol stack. The matching module 403 is used to match the verification result from the protocol stack with an appropriate processing strategy, and then process the assembly verification message according to the processing strategy.

[0070] In one embodiment of this application, the SeND option field contains options related to the security mechanism of SeND, including at least the Timestamp option, Nonce option, CGA option, and RSA option.

[0071] In one embodiment of this application, before encapsulating the assembled verification message to obtain a verification message and sending the verification message to the protocol stack, the apparatus further includes:

[0072] The verification module is used by the kernel to verify the Timestamp option and Nonce option. The encapsulation module encapsulates the assembled verification message if the verification result is successful. The processing module processes the assembled verification message according to the specified processing strategy if the verification fails.

[0073] In one embodiment of this application, the processing strategy includes at least terminating the process and sending a kernel reply message.

[0074] In one embodiment of this application, the encapsulation module 402 is specifically used for:

[0075] Determine the number of SeND option fields corresponding to the assembled verification message. Based on the number of SeND option fields, determine the variable-length Options list and encapsulation header, and add each SeND option field to the variable-length Options list. Based on the encapsulation header and the variable-length Options list after adding fields, encapsulate the message to obtain the verification message, and send the verification message to the protocol stack.

[0076] The systems, devices, modules, or units described in the above embodiments can be implemented by computer chips or entities, or by products with certain functions. A typical implementation device is a computer. Specifically, a computer can be, for example, a personal computer, laptop computer, cellular phone, camera phone, smartphone, personal digital assistant, media player, navigation device, email device, game console, tablet computer, wearable device, or any combination of these devices.

[0077] For ease of description, the above devices are described in terms of function, divided into various units. Of course, in implementing this specification, the functions of each unit can be implemented in one or more software and / or hardware components.

[0078] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, systems, or computer program products. Therefore, the embodiments of this specification can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the embodiments of this specification can take the form of a computer program product implemented on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0079] This specification is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of this specification. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create a machine for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0080] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0081] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0082] In a typical configuration, a computing device includes one or more processors (CPU), input / output interfaces, network interfaces, and memory.

[0083] Memory may include non-persistent storage in computer-readable media, such as random access memory (RAM) and / or non-volatile memory, such as read-only memory (ROM) or flash RAM. Memory is an example of computer-readable media.

[0084] Computer-readable media includes both permanent and non-permanent, removable and non-removable media that can store information using any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase-change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technologies, CD-ROM, digital versatile optical disc (DVD) or other optical storage, magnetic tape, magnetic magnetic disk storage or other magnetic storage devices, or any other non-transferable medium that can be used to store information accessible by a computing device. As defined herein, computer-readable media does not include transient computer-readable media, such as modulated data signals and carrier waves.

[0085] It should also be noted that the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitation, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0086] This specification can be described in the general context of computer-executable instructions that are executed by a computer, such as program modules. Generally, program modules include routines, programs, objects, components, data structures, etc., that perform a specific task or implement a specific abstract data type. This specification can also be practiced in distributed computing environments, where tasks are performed by remote processing devices connected via a communication network. In distributed computing environments, program modules can reside in local and remote computer storage media, including storage devices.

[0087] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the embodiments of apparatus, devices, and non-volatile computer storage media are basically similar to the method embodiments, so the descriptions are relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0088] The foregoing has described specific embodiments of this specification. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in a different order than that shown in the embodiments and may still achieve the desired result. Furthermore, the processes depicted in the drawings do not necessarily require the specific or sequential order shown to achieve the desired result. In some embodiments, multitasking and parallel processing are possible or may be advantageous.

[0089] The above description is merely one or more embodiments of this specification and is not intended to limit this specification. Various modifications and variations can be made to the one or more embodiments of this specification by those skilled in the art. Any modifications, equivalent substitutions, improvements, etc., made within the spirit and principle of one or more embodiments of this specification should be included within the scope of the claims of this specification.

Claims

1. A kernel-protocol stack interaction method based on SeND, characterized in that, The method includes: When the kernel receives an ICMPv6 SeND message, it determines whether the ICMPv6 SeND message is an assembly verification message based on a preset verification rule; wherein, the preset verification rule is used to identify whether the ICMPv6 SeND message carries a SeND option field. If so, the assembled verification message is encapsulated to obtain a verification message, and the verification message is sent to the protocol stack; Based on the verification result from the protocol stack, a corresponding processing strategy is matched to process the assembled verification message according to the processing strategy. Specifically, the process of encapsulating the assembled verification message into a verification message and sending the verification message to the protocol stack includes: Determine the number of SeND option fields corresponding to the assembled verification message; Based on the number of SeND option fields, determine the variable-length Options list and the encapsulation header, and add each of the SeND option fields to the variable-length Options list; The verification message is obtained by encapsulating the header and the variable-length Options list after adding fields, and then the verification message is sent to the protocol stack.

2. The kernel-protocol stack interaction method based on SeND according to claim 1, characterized in that, The SeND option field contains options related to the security mechanism of SeND, including at least the Timestamp option, Nonce option, CGA option, and RSA option.

3. The kernel-protocol stack interaction method based on SeND according to claim 2, characterized in that, The method further includes encapsulating the assembled verification message into a verification message before sending the verification message to the protocol stack: The kernel verifies the Timestamp option and the Nonce option; If the verification result is successful, the assembled verification message will be encapsulated. Otherwise, the assembly verification message is processed according to the processing strategy.

4. The kernel-protocol stack interaction method based on SeND according to claim 3, characterized in that, The processing strategy includes at least terminating the process and sending a kernel reply message.

5. A kernel and protocol stack interaction device based on SeND, characterized in that, The device includes: The determination module is used by the kernel to determine whether an ICMPv6 SeND message is an assembly verification message based on a preset verification rule after receiving the ICMPv6 SeND message; wherein the preset verification rule is used to identify whether the ICMPv6 SeND message carries a SeND option field. An encapsulation module is used to encapsulate the assembled verification message into a verification message if the condition is met, so as to send the verification message to the protocol stack. The matching module is used to match the corresponding processing strategy based on the verification result from the protocol stack, so as to process the assembled verification message according to the processing strategy. Specifically, the encapsulation module is used for: Determine the number of SeND option fields corresponding to the assembled verification message; Based on the number of SeND option fields, determine the variable-length Options list and the encapsulation header, and add each of the SeND option fields to the variable-length Options list; The verification message is obtained by encapsulating the header and the variable-length Options list after adding fields, and then the verification message is sent to the protocol stack.

6. The kernel and protocol stack interaction device based on SeND according to claim 5, characterized in that, The SeND option field contains options related to the security mechanism of SeND, including at least the Timestamp option, Nonce option, CGA option, and RSA option.

7. The kernel and protocol stack interaction device based on SeND according to claim 6, characterized in that, Before encapsulating the assembled verification message into a verification message and sending the verification message to the protocol stack, the apparatus further includes: The verification module is used by the kernel to verify the Timestamp option and the Nonce option; The encapsulation module encapsulates the assembly verification message if the verification result is satisfactory. A processing module is used to otherwise process the assembly verification message according to the processing strategy.

8. The kernel and protocol stack interaction device based on SeND according to claim 7, characterized in that, The processing strategy includes at least terminating the process and sending a kernel reply message.

Images