A method and device for analyzing transmission of a data packet with a timestamp

Abstract

The present application provides a method and device for analyzing the transmission of a data packet with a timestamp, including a data source end and a data destination end using a heartbeat message for verification. If the verification is successful, the data source end compresses the original data packet to be transmitted, and then performs IP encapsulation to obtain a first encapsulation message; if the verification is unsuccessful, the data source end compresses the original data packet to be transmitted, and then performs UDP encapsulation to obtain a second encapsulation message. The present invention realizes the playback of historical data from the data source end to the destination end for data analysis, carries accurate timestamps, facilitates the problem of correlation analysis at the destination end, solves the fragmentation problem caused by excessively large data packets during the transmission process between the source and destination ends, increases network bandwidth utilization, reduces the overhead of UDP headers, and reduces data expansion. Through efficient password transmission mechanisms and encryption methods, the privacy of user data packets is protected and security is improved.

Description

Technical Field

[0001] One or more embodiments of the present specification relate to the field of network technology, and more particularly, to a method and device for analyzing the transmission of a data packet with a timestamp. Background Art

[0002] Currently, in remote data analysis scenarios where the data source and analysis end are separated, the data source end can read historical data from a full-packet capture device and replay the read historical data to the analysis end for data analysis, or the data source end can capture data packets in real time and transmit the data packets to the analysis end device, or the data source end can transmit the local PCAP file to the analysis end device. However, these methods may cause the entire data packet to be fragmented and sent to the server for reassembly after adding each layer of data header, affecting server performance and network bandwidth, and the utilization rate of network bandwidth will also decrease. In addition, in the process of transmitting data from the data source end to the analysis end, if it passes through an untrusted network or is monitored by someone, it is easier to intercept all data packets of the entire enterprise, facing great data security risks. Summary of the invention

[0003] The present application describes a transmission analysis method and device for a data packet with a timestamp, which can solve the above technical problems.

[0004] According to a first aspect, there is provided a method for analyzing the transmission of a data packet with a timestamp, which is used in a transmission analysis device, wherein the transmission analysis device includes at least one data source end and at least one data destination end;

[0005] The method comprises:

[0006] The data source and the data destination are verified using a heartbeat message, wherein the heartbeat message includes at least a protocol number in a custom IP header and a current system timestamp;

[0007] If the verification is successful, the data source end compresses the original data packet to be transmitted, and then performs IP encapsulation to obtain a first encapsulated message, wherein the first encapsulated message header includes the protocol number, the compression algorithm identifier and the original packet length of the original data packet to be transmitted in the custom IP header;

[0008] If the verification is unsuccessful, the data source end compresses the original data packet to be transmitted, and then performs UDP encapsulation to obtain a second encapsulated message, wherein the second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted;

[0009] The data source sends the first encapsulated message or the second encapsulated message to the data destination.

[0010] According to a second aspect, there is provided a transmission analysis device for a data packet with a timestamp, the transmission analysis device comprising at least one data source end and at least one data destination end;

[0011] The data source end is used to verify using a heartbeat message and the data destination end, wherein the heartbeat message at least includes a protocol number in a custom IP header and a current system timestamp;

[0012] If the verification is successful, the data source end is used to compress the original data packet to be transmitted, and then perform IP encapsulation to obtain a first encapsulated message, wherein the first encapsulated message header includes the protocol number, the compression algorithm identifier and the original packet length of the original data packet to be transmitted in the custom IP header;

[0013] If the verification is unsuccessful, the data source end is used to compress the original data packet to be transmitted, and then perform UDP encapsulation to obtain a second package message, wherein the second package message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted;

[0014] The data source is used to send the first encapsulated message or the second encapsulated message to the data destination.

[0015] According to a third aspect, there is provided a transmission analysis system for a data packet with a timestamp, the transmission analysis system comprising at least one data source end and at least one data destination end;

[0016] The data source end is used to verify using a heartbeat message and the data destination end, wherein the heartbeat message at least includes a protocol number in a custom IP header and a current system timestamp;

[0017] If the verification is successful, the data source end is used to compress the original data packet to be transmitted, and then perform IP encapsulation to obtain a first encapsulated message, wherein the first encapsulated message header includes the protocol number, the compression algorithm identifier and the original packet length of the original data packet to be transmitted in the custom IP header;

[0018] If the verification is unsuccessful, the data source end is used to compress the original data packet to be transmitted, and then perform UDP encapsulation to obtain a second package message, wherein the second package message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted;

[0019] The data source is used to send the first encapsulated message or the second encapsulated message to the data destination.

[0020] In the above-mentioned system and method provided in the embodiments of this specification, when historical data is played back to the analysis end for data analysis, accurate timestamps are encapsulated to facilitate correlation analysis problems, avoid fragmentation problems caused by excessively large data packets, increase network bandwidth utilization, protect the privacy of user data, and improve the security of the data transmission process. BRIEF DESCRIPTION OF THE DRAWINGS

[0021] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0022] Figure 1 A schematic diagram showing changes in data packets in a method for analyzing transmission of a data packet with a timestamp provided in an embodiment of this specification;

[0023] Figure 2 A schematic diagram showing changes in UDP encapsulated data packets in a method for analyzing transmission of a data packet with a timestamp provided in an embodiment of this specification;

[0024] Figure 3 A schematic diagram showing a heartbeat packet in a method for analyzing the transmission of a data packet with a timestamp provided in an embodiment of this specification;

[0025] Figure 4 A schematic diagram showing a heartbeat response packet in a method for analyzing the transmission of a data packet with a timestamp provided in an embodiment of this specification;

[0026] Figure 5 A schematic diagram showing a cryptographic transmission packet in a transmission analysis method for a data packet with a timestamp provided in an embodiment of the present specification;

[0027] Figure 6 A schematic diagram showing a password transmission response packet in a transmission analysis method for a data packet with a timestamp provided in an embodiment of this specification;

[0028] Figure 7 A schematic diagram showing a password clearing packet in a method for analyzing the transmission of a data packet with a timestamp provided in an embodiment of this specification;

[0029] Figure 8 A schematic diagram showing a flow chart of a method for analyzing the transmission of a data packet with a timestamp provided in an embodiment of this specification;

[0030] Fig. 9 A schematic diagram showing a flow chart of a method for analyzing the transmission of a data packet with a timestamp provided in an embodiment of this specification;

[0031] Fig.10 A schematic diagram of a module of a transmission analysis device for a data packet with a timestamp provided in an embodiment of this specification is shown;

[0032] Fig.11 A system schematic diagram of a transmission analysis system for a data packet with a timestamp provided in an embodiment of the present specification is shown. DETAILED DESCRIPTION

[0033] The solution provided in this specification is described below in conjunction with the accompanying drawings.

[0034] In order to make the purpose, technical solutions and advantages of the embodiments of the present application clearer, the technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings.

[0035] Remote data analysis refers to data processing activities performed when there is a physical distance between the data source and the analysis end. This form of data analysis is widely used in many industries and fields. The data source retrieves historically retained data packets from the full-packet capture device and replays the historically retained data packets to the analysis end for data analysis. Alternatively, the data source extracts PCAP files from a common host that stores relevant historical packet capture files such as PCAP, and sends the PCAP files to the analysis end for analysis. Alternatively, the data source captures data packets in real time and transmits them to the analysis end in real time.

[0036] Currently, the data source sends data to the analysis end through PCAP over IP, which has the following problems:

[0037] 1. The original data packet plus the PCAP header, plus the newly added UDP, IP and MAC headers, most of the data will exceed 1500 bytes and need to be sent in fragments. The fragmented messages are sent to the analysis end for reassembly, which affects the performance of the analysis end.

[0038] 2. After the original data packet is added with each layer header, the packet length increases, affecting the network bandwidth, and the utilization of the network bandwidth will also decrease. Especially in the scenario where the average packet length is not large, the more bytes are added, the more obvious the decrease in bandwidth utilization.

[0039] 3. When data is transmitted between the data source and analysis end, it passes through an untrusted network or is monitored by someone. The enterprise's data packets are easily stolen, and the security risk of data packet transmission is relatively high.

[0040] In the present invention, the analysis end needs to configure an IP address when it is first run, and communicate normally with the data source end. The analysis end needs to configure a key pair generator to automatically generate a key pair. After the generation, the private key is stored locally and is invisible, and the public key is visible and can be exported. The asymmetric algorithm ECC or RSA algorithm can be selected. The key pair for the analysis end is an optional configuration. If the key pair is not configured, encryption of the data transmission process is not supported, and the heartbeat packet public key verification mechanism is also not supported.

[0041] When the data source is running for the first time, it is necessary to configure the IP address for data transmission with the analysis end. The data source needs to import the public key of the analysis end. Importing the public key of the analysis end is an optional configuration. If the public key is not imported, the encryption function is not supported, and the heartbeat packet and heartbeat response packet do not support the public key system for verification. However, this is not a problem in a secure network.

[0042] The data source can send heartbeat packets for self-adaptation and choose to use private protocol or UDP protocol to send data to the analysis end. In addition, the data source can also be configured to use private protocol or UDP protocol, which no longer sends heartbeat packets for self-adaptation. The data source can be configured to send data in encrypted form, and can also configure the encryption algorithm and key update cycle, which can be 5 minutes to 1 hour.

[0043] After the data source is started, it sends a heartbeat packet to the analysis end. After receiving the heartbeat packet response from the analysis end, the subsequent data packets sent to the analysis end can use a private protocol solution. If no heartbeat packet response is received from the analysis end, the subsequent data packets sent to the analysis end are sent via UDP packets.

[0044] like Figure 3 The schematic diagram of the heartbeat message sent by the data source end to the analysis end is shown, and the heartbeat message sent by the data source end includes an IP header, a message type and a current system timestamp, and the payload of the heartbeat message includes a byte encrypted with the current system timestamp using the public key of the analysis end. In this embodiment, the protocol number in the IP header uses a private protocol number 200, and a reserved protocol number of 138-252 can also be used. The specific protocol number used can be selected according to the specific scenario, and the message type is 1, which indicates a heartbeat request.

[0045] The analysis end receives the heartbeat message and verifies the legitimacy of the heartbeat message. The verification items include: the current system timestamp in the heartbeat message is within the time range of 30 seconds before and after the system time of the analysis end; the current system timestamp in the heartbeat message is greater than the maximum timestamp previously sent by this data source end. If this is the first time to receive the heartbeat message from this data source end, it is directly valid; the encrypted timestamp in the heartbeat message payload is decrypted with the public key of the analysis end, and the obtained timestamp data is the same as the current system timestamp newly added in the message header of the heartbeat message. If the above three verifications are met at the same time, it means that the heartbeat message is legal, and the analysis end responds to the data source end with a heartbeat response message.

[0046] like Figure 4 The schematic diagram shown is a heartbeat reply message sent from the analysis end to the data source end. The heartbeat reply message includes an IP header, a message type, and a current system timestamp. The heartbeat message payload includes bytes for encrypting the current system timestamp using the public key of the analysis end. The message type is 2, indicating that it is a heartbeat reply message.

[0047] The data source receives the heartbeat response message and verifies the legitimacy of the heartbeat response message. The verification items include that the current system timestamp in the heartbeat response message header is within the time range of 30 seconds before and after the system time of the data source; the current system timestamp in the heartbeat response message is greater than the largest timestamp in the heartbeat response sent by the analysis end before. If this is the first time the heartbeat response from the analysis end is received, it will be directly valid; verify the signature, and use the imported public key of the analysis end to decrypt the encrypted timestamp in the payload of the heartbeat response message. The decrypted timestamp data is the same as the previous timestamp. Each time the heartbeat response message is valid, the data source records the maximum timestamp of the heartbeat response message sent by the analysis end. When the above three tests are met at the same time, it means that the heartbeat response message is legal, and data can be transmitted between the data source and the analysis end through a private protocol. Subsequent data packets will be sent using a private protocol.

[0048] When using a private protocol for data transmission, the data source needs to send a heartbeat message every 5 seconds. If no heartbeat response is received for 4 consecutive times, it means that the network status has changed and the conditions for sending data using the private protocol are not met. The data source will change to UDP encapsulation mode to send data packets to the analysis end. After changing to UDP encapsulation mode to send data packets, the data source continues to send heartbeat packets every 1 minute. If a valid heartbeat response is received, it will switch to the private protocol mode to send data packets.

[0049] The data source can configure an encryption key update cycle of 5 minutes to 1 hour. If it is set to 5 minutes, a day is divided into 288 5-minute periods, and 288 passwords need to be generated. Password 0 is used from 00:00:00 to 00:04:59, password 1 is used from 00:05:00 to 00:09:59, and so on. If the user sets a 10-minute update cycle, 144 passwords are generated, and so on. Each password is generated 5 minutes before the start time it needs to be used. For example, if the use time range of key 10 is 00:50:00-00:54:59, then key 10 will start to be generated at 00:45:00 and sent to the analysis end. The analysis end receives the key and stores it, and sends a key reception success message to the data source. If the data source does not receive the key reception success message, it resends the key transmission message every 3 seconds until it gets confirmation from the analysis end.

[0050] Each time the data source is started, it needs to generate the key needed for the current cycle. If the next key generation cycle is less than 5 minutes away, it needs to generate the key needed for the next cycle at the same time.

[0051] like Figure 5 The schematic diagram of the password transmission message sent by the data source end to the analysis end is shown. The password transmission message includes an IP header. The protocol number in the IP header is 200. When the private protocol is not supported, the UDP header is used. The message type is 3, indicating that the message is password transmission, the password number transmitted this time, the current system timestamp, and the message payload includes a string consisting of a 4-byte current system timestamp and a randomly generated password. The encrypted string is obtained by encrypting the string composed of the public key of the imported analysis end.

[0052] The analysis end receives the password transmission message, parses it and obtains the message type as 3, and verifies the message. The verification includes: the current system timestamp in the message is within the time range of 30 seconds before and after the current analysis end system time; the current system timestamp in the message is greater than the largest timestamp sent by this data source in the password transmission message before, or if this is the first time to receive the password transmission message from this data source, it will be directly valid; decrypt the ciphertext in the password transmission message payload to obtain the timestamp and random password. If the decrypted timestamp is the same as the current system timestamp in the password transmission message header, it means that this password transmission message is valid. Record this random password into this password number. If this password number already exists, overwrite the password saved in the old password number.

[0053] like Figure 6The schematic diagram of the password transmission response message sent by the analysis end to the data source end is shown. The password transmission response message includes an IP header, the protocol number in the IP header is 200, and the UDP header is used when the private protocol is not supported. The message type is 4 password transmission response, the password number transmitted this time, the 4-byte current system timestamp, and the message payload includes a string composed of a 4-byte current system timestamp and a randomly generated password. The encrypted string is obtained by encrypting the composed string using the public key of the analysis end. Among them, whether the UDP header is required depends on the received password transmission package. If there is a UDP header in the password transmission package, the UDP header is brought.

[0054] After the data source receives the password transmission response message, it parses and obtains the message type as 4, and verifies the message: the timestamp in the password transmission response message must be within the time range of 30 seconds before and after the current data source system time; the timestamp in the password transmission response message must be greater than the timestamp of the largest password transmission response sent by the analysis end before. If this is the first time to receive the heartbeat response message from the analysis end, it will be directly valid. Verify the signature and verify it with the public key of the analysis end. After verification, this password number will no longer be sent in the future. Each time the message is valid, the data source needs to record the maximum timestamp, indicating that the analysis end has received and processed it normally.

[0055] After the analysis end is restarted, it receives a data message from any data source. When the data message is an encrypted message, the analysis end does not have this number password locally. After the restart, all passwords have been lost. The analysis end sends a password clearing message to this data source.

[0056] like Figure 7 It is shown that the password clearing message includes an IP header, the protocol number in the IP header is 200, the UDP header is used when the private protocol is not supported, the message type is 5 password clearing, the 4-byte current system timestamp, and the message payload includes an encrypted string obtained by encrypting the 4-byte current system timestamp using the public key of the analysis end. At the same time, whether the UDP header is needed depends on the data message just received. The data message contains UDP, and the password clearing message also contains a UDP header.

[0057] The data source receives the password clear message and verifies the password clear message as follows: the timestamp in the password clear message is within the time range of 30 seconds before and after the current data source system time; the current system timestamp in the password clear message header is greater than the largest timestamp in the password clear message sent by the analysis end. If this is the first time the password clear message is received from the analysis end, it will be directly valid; the signature is verified using the public key of the analysis end. After the verification is valid, the data source will clear all local passwords, regenerate the password to be used, and send it to the analysis end, recording the maximum timestamp of the password clear message.

[0058] Figure 1 As shown, a private protocol is used between the data source end and the analysis end for data transmission. The steps are as follows:

[0059] The data source collects the original data packet, where the original data packet refers to the net content in the packet, excluding information such as the PCAP header. The timestamp of the original data packet is obtained, with 4 bytes for the second and nanosecond parts, totaling 8 bytes. The 8-byte timestamp is placed in front of the entire original data packet. The original data packet with the timestamp added is compressed using a compression algorithm. When the data source is configured for encrypted transmission, the compressed original data packet is encrypted, and the length of the original data packet increases after encryption. ECB mode is selected for encryption, so IV is not required, but the length increases due to encryption grouping.

[0060] The data source encapsulates the encrypted data packet. The encapsulated content includes 1 byte of message type, heartbeat request (1), heartbeat response (2), password transmission (3), password transmission response (4), password clear (5), and data transmission (6). When sending data, message type 6 is used; 1 byte of compression and encryption algorithm, the first 4 bits store the compression algorithm type, and the last 4 bits store the encryption algorithm type, where 0 means no encryption and no compression; 2 bytes of original data packet length, because when capturing packets in the previous step, it may be configured to truncate the packet. When truncation is used, the 2-byte original data packet length stores the length of the original data packet, that is, the length of the original data packet before truncation; 2 bytes of HASH value, the source IP + destination IP of the original data packet is used to calculate the HASH. The function of this value is to perform diversion processing on the analysis end after receiving the packet. It can be diverted to different cores for processing to ensure that all packets of the same stream are processed in the core of the same processor; 2 bytes of key number, the data source end writes the key number used for encryption, and the analysis end uses this key number to find the decryption key.

[0061] When the data source is configured for unencrypted transmission, the following bytes are added to the front of the compressed original data packet: 1-byte message type, heartbeat request (1), heartbeat response (2), password transmission (3), password transmission response (4), password clear (5), data transmission (6), 6 types, send data, message type 6; 1-byte compression and encryption algorithm, the first 4 bits store the compression algorithm type, the last 4 bits store the encryption algorithm type, where 0 means no encryption and no compression; 2-byte original data packet length, because when capturing packets in the previous step, it is possible to configure the capture to be truncated, so what is stored here is the length of the original data packet before truncation; 2-byte HASH value, the source IP + destination IP of the original data packet is used to calculate the HASH. The function of this value is to perform diversion processing after the analysis end receives the packet. It can be diverted to different cores for processing to ensure that all packets of the same stream are processed in the same core; continue to encapsulate the IP header, the protocol number uses a private protocol, and the reserved protocol number 138-252 can be used, for example, 200.

[0062] Figure 2 As shown, the UDP protocol is used for data transmission between the data source end and the analysis end, and the steps are as follows:

[0063] The data source collects the original data packet, where the original data packet refers to the net content in the packet, excluding information such as the PCAP header. The second and nanosecond parts of the timestamp of the original data packet are obtained, which are 4 bytes each for seconds and nanoseconds, for a total of 8 bytes. The 8-byte timestamp is placed in front of the entire original data packet.

[0064] The data source uses a compression algorithm to compress the original data packet with a timestamp.

[0065] When the data source is configured with encrypted transmission, the compressed original data packet is encrypted. The length of the original data packet increases after encryption. When the ECB mode is selected for encryption, IV is not required. Since encryption is grouped, the length increases.

[0066] The data source encapsulates the encrypted data packet. The encapsulated content includes: 1-byte message type, heartbeat request (1), heartbeat response (2), password transmission (3), password transmission response (4), password clear (5), data transmission (6), 6 types. When sending data, the message type uses 6; 1-byte compression and encryption algorithm, the first 4 bits store the compression algorithm type, and the last 4 bits store the encryption algorithm type, where 0 means no encryption and no compression; 2-byte original data packet length, because when capturing packets in the previous step, it is possible to configure the capture to be truncated, so the length of the original packet is stored here, that is, the length of the original data packet before truncation; 2-byte key number, the data source writes the key number used for encryption, and the analysis end uses this key number to find the decryption key.

[0067] When the data source is configured for unencrypted transmission, the following bytes are added to the front of the compressed original data packet: 1-byte message type, heartbeat request (1), heartbeat response (2), password transmission (3), password transmission response (4), password clear (5), data transmission (6), 6 types, send data, message type 6; 1-byte compression and encryption algorithm, the first 4 bits store the compression algorithm type, the last 4 bits store the encryption algorithm type, where 0 means no encryption, no compression; 2-byte original packet length, because when capturing packets in the previous step, it is possible to configure the capture to be truncated, so the length of the original packet before truncation is stored here; the IP header and UDP header are further encapsulated in the data packet, and the HASH value is placed in the source port position in the UDP header. The HASH value is 2 bytes, and the source IP + destination IP of the original packet are used to calculate the HASH. The function of this value is to perform diversion processing after the analysis end receives the packet. It can be diverted to different cores for processing to ensure that all packets of the same flow are processed in the same core.

[0068] The UDP protocol has better compatibility than private protocol numbers and can avoid packet loss due to unsupported protocol numbers by routers in the middle.

[0069] It should be noted that since the generation of key pairs on the analysis end and the import of public keys on the data source end are relatively complex processes, some scenarios may require simpler processing, so these processes can be omitted. However, if this is not performed, the system's operation will change as follows: the heartbeat packet and heartbeat response packet will not be able to be verified using the public key system, which is fine in a secure network. The data end can also be manually configured to use a private protocol or UDP protocol to send, and no longer send heartbeat packets for adaptation. Encryption function cannot be supported.

[0070] For the five types of packets, heartbeat request (1), heartbeat response (2), password transmission (3), password transmission response (4), and password clear (5), they are control packets. If they have a UDP header, the source port and the destination port are set to the same, that is, the port number of this service. When implementing, you can set a port number that is not commonly used on the Internet. For data transmission (6) packets, such packets are only sent from the data source end to the analysis end. The source port will use the source IP + destination IP of the original captured packet for HASH. The HASH algorithm can be set by yourself and try to be as even as possible. The destination port is consistent with the control packet. When the analysis end receives the data transmission packet, the HASH value is used as the key for diversion, which can make full use of the multi-core mechanism for fast diversion. The compression algorithm needs to be used according to the unified standard of the source end and the analysis end. The encryption algorithm also needs to be used according to the unified standard of the data source end and the analysis end.

[0071] Figure 8The flow chart of a method for analyzing the transmission of a data packet with a timestamp provided in an embodiment of the present specification is shown. The transmission analysis device includes at least one data source end and at least one data destination end.

[0072] The following steps are involved:

[0073] 110. The data source and the data destination are verified using a heartbeat message, which at least includes the protocol number in the custom IP header and the current system timestamp.

[0074] 120. If the verification is successful, the data source end compresses the original data packet to be transmitted, and then performs IP encapsulation to obtain a first encapsulated message. The first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0075] 130. If the verification fails, the data source end compresses the original data packet to be transmitted, and then performs UDP encapsulation to obtain a second encapsulated message. The second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0076] 140. The data source sends the first encapsulated message or the second encapsulated message to the data destination.

[0077] In some embodiments, step 110 specifically includes:

[0078] The data source starts up and sends a first heartbeat message to the data destination, wherein the first heartbeat message includes the protocol number, message type and current system timestamp in the custom IP header.

[0079] The data destination verifies the first heartbeat message according to a first preset condition, wherein the first preset condition includes that the difference between the current system timestamp in the first heartbeat message and the system time of the data destination is within a preset range, and that the current system timestamp in the first heartbeat message is greater than the maximum timestamp sent by the data source end saved by the data destination end, or that the current system timestamp in the first heartbeat message is the timestamp sent by the first data source end saved by the data destination end.

[0080] If the first heartbeat messages all meet the first preset condition, the data destination sends a second heartbeat message to the data source, wherein the second heartbeat message includes the protocol number in the custom IP header, the heartbeat message type and the current system timestamp.

[0081] The data source verifies the second heartbeat message according to a second preset condition, wherein the second preset condition includes that the difference between the current system timestamp in the second heartbeat message and the system time of the data source is within a preset range, and that the current system timestamp in the second heartbeat message is greater than the maximum timestamp sent by the data destination end saved by the data source end, or that the current system timestamp in the second heartbeat message is the timestamp sent by the first data destination end saved by the data source end.

[0082] If the second heartbeat messages all meet the second preset condition, the data source end successfully authenticates the data destination end; otherwise, the authentication fails.

[0083] Specifically, the verification failure also includes that the data source end or the data destination end does not receive a response message to the heartbeat message within a preset time, and the received heartbeat message does not meet a preset condition.

[0084] In some embodiments, step 120 specifically includes:

[0085] The data source end obtains the timestamp in the original data packet to be transmitted, and encapsulates the preset part of the timestamp into the outer layer of the original data packet to be transmitted.

[0086] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0087] Assemble a first encapsulation message header, the first encapsulation message header includes a message type, a compression algorithm identifier, an original message length of the original data packet to be transmitted, and a HASH value of a source IP address and a target IP address of the original data packet to be transmitted.

[0088] The first encapsulation message header is encapsulated into the outer layer of the compressed original data packet to be transmitted. The encapsulated original data packet to be transmitted is encapsulated into an IP header, wherein the protocol number in the IP header is the protocol number in the custom IP header.

[0089] In some embodiments, step 130 specifically includes:

[0090] The data source end obtains the timestamp in the original data packet to be transmitted, and encapsulates the preset part of the timestamp into the outer layer of the original data packet to be transmitted.

[0091] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0092] Assemble a second encapsulation message header, where the second encapsulation message header includes a message type field, a compression algorithm identifier, and an original message length of the original data packet to be transmitted.

[0093] Encapsulating the second encapsulation message header into the outer layer of the compressed original data packet to be transmitted;

[0094] The encapsulated original data packet to be transmitted is encapsulated with a UDP header, wherein the source port number in the UDP header is a HASH value of the source IP address and the destination IP address of the original data packet to be transmitted.

[0095] In the method provided in the embodiments of this specification, when historical data is played back to the analysis end for data analysis, accurate timestamps are encapsulated to facilitate correlation analysis problems, avoid fragmentation problems caused by excessively large data packets, and increase network bandwidth utilization.

[0096] Fig. 9 The flow chart of a method for analyzing the transmission of a data packet with a timestamp provided in an embodiment of the present specification is shown. The transmission analysis device includes at least one data source end and at least one data destination end.

[0097] The following steps are involved:

[0098] 210. The data destination generates a key pair, wherein the private key in the key pair is stored locally and the public key is exported to the data source.

[0099] It should be understood that the data destination can correspond to multiple data sources. The data destination generates a key pair for each data source, saves the private key in the key pair locally, and exports the public key in the key pair to the corresponding data source.

[0100] 220. The data source and the data destination are authenticated using heartbeat messages.

[0101] In some embodiments, step 220 includes:

[0102] The data source starts and sends a third heartbeat message to the data destination, wherein the third heartbeat message includes the protocol number in the custom IP header, the heartbeat message type, the current system timestamp, and the first encrypted string obtained by encrypting the current system timestamp using the public key of the imported data destination.

[0103] The data destination verifies the third heartbeat message according to the third preset condition, and the third preset condition includes that the difference between the current system timestamp in the third heartbeat message and the system time of the data destination is within a preset range, and the current system timestamp in the third heartbeat message is greater than the maximum timestamp sent by the data source end saved by the data destination end, or, the current system timestamp in the third heartbeat message is the timestamp sent by the first data source end saved by the data destination end, and the first encrypted character string is decrypted using the private key of the data destination end, and the timestamp obtained by decryption is consistent with the current system timestamp in the third heartbeat message.

[0104] If the third heartbeat message meets the third preset condition, the data destination sends a fourth heartbeat message to the data source, wherein the fourth heartbeat message includes the protocol number in the custom IP header, the heartbeat message type, the current system timestamp, and the second encrypted string obtained by encrypting the current system timestamp using the private key of the data source destination.

[0105] The data source verifies the fourth heartbeat message according to the fourth preset condition, and the fourth preset condition includes that the current system timestamp in the fourth heartbeat message is within a preset range from the system time of the data source, and the current system timestamp in the fourth heartbeat message is greater than the maximum timestamp sent by the data destination saved by the data source, or the current system timestamp in the fourth heartbeat message is the timestamp sent by the first data destination saved by the data source, and the second encrypted character string is decrypted using the imported public key of the data destination, and the timestamp obtained by decryption is consistent with the current system timestamp in the fourth heartbeat message.

[0106] If the fourth heartbeat messages all meet the fourth preset condition, the data source end successfully authenticates the data destination end; otherwise, the authentication fails.

[0107] Step 230: The data source and the data destination negotiate the password for the current transmission password number.

[0108] In some embodiments, step 230 includes:

[0109] The data source generates a password to be used in the current cycle or a password to be used in the next cycle according to a preset password generation cycle.

[0110] The data source encapsulates the password to be used in the current cycle or the password to be used in the next cycle into a first password transmission message and sends it to the data destination. The first password transmission message is encapsulated according to the result of the heartbeat message verification by the data source and the data destination;

[0111] The first password transmission message includes the protocol number in the custom IP header, the message type, the current transmission password number, the current system timestamp, and a third encrypted string obtained by encrypting a constructed string using the public key of the imported data destination, wherein the constructed string is a string consisting of the current system timestamp and the password to be used in the current cycle or the password to be used in the next cycle.

[0112] When the verification result is unsuccessful, the first password transmission message also includes a UDP header.

[0113] The data destination receives the first password transmission message and verifies the first password transmission message according to the fifth preset condition. The fifth preset condition includes that the difference between the current system timestamp in the first password transmission message and the system time of the data destination is within a preset range, and the current system timestamp in the first password transmission message is greater than the maximum timestamp sent by the data source end and stored by the data destination end, or the current system timestamp in the first password transmission message is the timestamp sent by the first data source end and stored by the data destination end, and the third encrypted character string is decrypted using the private key of the data destination end, and the timestamp obtained by decryption is consistent with the current system timestamp in the first password transmission message.

[0114] If the first password transmission message satisfies the fifth preset condition, the data destination end sends a second password transmission message to the data source end, wherein the second password transmission message is encapsulated according to the result of the heartbeat message verification by the data source end and the data destination end.

[0115] The second password transmission message includes the protocol number in the custom IP header, the message type, the current transmission password number, the current system timestamp, and a fourth encrypted string obtained by encrypting a constructed string using the private key of the data destination, wherein the constructed string is a string composed of the current system timestamp and the password to be used in the current cycle or the password to be used in the next cycle, and the current transmission password number is the same as the current transmission password number in the first password transmission message.

[0116] When the verification result is unsuccessful, the second password transmission message also includes a UDP header.

[0117] The data destination terminal receives the second password transmission message and verifies the second password transmission message according to the sixth preset condition, the sixth preset condition including that the difference between the current system timestamp in the second password transmission message and the system time of the data source terminal is within a preset range, and the current system timestamp in the second password transmission message is greater than the maximum timestamp sent by the data destination terminal and stored in the data source terminal, or the current system timestamp in the second password transmission message is the first timestamp sent by the data destination terminal and stored in the data source terminal, and the fourth encrypted character string is decrypted using the private key of the data destination terminal, and the timestamp obtained by decryption is consistent with the current system timestamp in the second password transmission message.

[0118] If the second password transmission messages all meet the sixth preset condition, the data source and the data destination confirm that the password negotiation of the current transmission password number is completed.

[0119] 240. When the data source and the data destination are successfully authenticated using a heartbeat message, the data source compresses the original data packet to be transmitted, and then performs IP encapsulation to obtain a first encapsulated message. The first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier, and the original packet length of the original data packet to be transmitted.

[0120] In some embodiments, step 240 specifically includes:

[0121] The data source end obtains the timestamp in the original data packet to be transmitted, and encapsulates the preset part of the timestamp into the original data packet to be transmitted.

[0122] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0123] The compressed original data packet to be transmitted is encrypted using the password of the current transmission password number negotiated by the data source end and the data destination end.

[0124] Assemble a first encapsulation message header, the first encapsulation message header includes a message type, a compression algorithm identifier, an encryption algorithm identifier, an original message length of the original data packet to be transmitted, a HASH value of the source IP address and the target IP address of the original data packet to be transmitted, and a current transmission password number.

[0125] The first encapsulation message header is encapsulated into the outer layer of the encrypted original data packet to be transmitted.

[0126] An IP header is encapsulated for the encapsulated original data packet to be transmitted, wherein the protocol number in the IP header is the protocol number in the custom IP header.

[0127] 250. When the data source and the data destination fail to verify using the heartbeat message, the data source compresses the original data packet to be transmitted, and then performs UDP encapsulation to obtain a second encapsulated message. The second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0128] In some embodiments, step 240 includes:

[0129] The data source end obtains the timestamp in the original data packet to be transmitted, and encapsulates a preset part of the timestamp into the original data packet to be transmitted.

[0130] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0131] The compressed original data packet to be transmitted is encrypted using the password of the current transmission password number negotiated by the data source end and the data destination end.

[0132] Assemble a second encapsulation message header, the second encapsulation message header includes a message type field, a compression algorithm identifier, an encryption algorithm identifier, an original message length of the original data packet to be transmitted, and a current transmission password number.

[0133] The second encapsulation message header is encapsulated into the outer layer of the encrypted original data packet to be transmitted.

[0134] The encapsulated original data packet to be transmitted is encapsulated with a UDP header, wherein the source port number in the UDP header is a HASH value of the source IP address and the target IP address of the original data packet to be transmitted.

[0135] 260. The data source sends the first encapsulated message or the second encapsulated message to the data destination.

[0136] This embodiment avoids fragmentation through compression technology, reduces the extra overhead caused by message reassembly at the analysis end, makes the overall data packet smaller, and improves bandwidth utilization; because the server needs to process a very large amount of data packets, it needs multi-threaded parallel processing. Before sending the data packet, the service diversion mark is made in advance. After the server receives the packet, it can be quickly diverted to different cores to improve efficiency; encryption technology is used in necessary scenarios to avoid security risks. Since encryption will affect the overhead, it is an optional option of the solution and only needs to be turned on in an unsafe network, and the switch can be flexibly controlled.

[0137] Corresponding to the above method provided by the present invention, Fig.10 A schematic diagram of the structure of a transmission analysis device for a data packet with a timestamp provided in an embodiment of the present specification is shown.

[0138] The transmission analysis device includes at least one data source end and at least one data destination end.

[0139] The data source end is used to perform verification using a heartbeat message and a data destination end. The heartbeat message includes at least the protocol number in the custom IP header and the current system timestamp.

[0140] If the verification is successful, the data source is used to compress the original data packet to be transmitted, and then perform IP encapsulation to obtain a first encapsulated message. The first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0141] If the verification fails, the data source end is used to compress the original data packet to be transmitted, and then perform UDP encapsulation to obtain a second encapsulated message. The second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0142] The data source end is used to send the first encapsulated message or the second encapsulated message to the data destination end.

[0143] In some embodiments, the data source is started to send a first heartbeat message to the data destination, wherein the first heartbeat message includes the protocol number, message type and current system timestamp in the custom IP header.

[0144] A data destination end is used to verify a first heartbeat message according to a first preset condition, wherein the first preset condition includes that the difference between a current system timestamp in the first heartbeat message and the system time of the data destination end is within a preset range, and that the current system timestamp in the first heartbeat message is greater than the maximum timestamp sent by the data source end and stored by the data destination end, or that the current system timestamp in the first heartbeat message is the timestamp sent by the first data source end and stored by the data destination end.

[0145] If the first heartbeat messages all meet the first preset condition, the data destination sends a second heartbeat message to the data source, wherein the second heartbeat message includes the protocol number in the custom IP header, the heartbeat message type and the current system timestamp.

[0146] The data source end is used to verify the second heartbeat message according to the second preset condition, wherein the second preset condition includes that the difference between the current system timestamp in the second heartbeat message and the system time of the data source end is within a preset range, and the current system timestamp in the second heartbeat message is greater than the maximum timestamp sent by the data destination end saved by the data source end, or the current system timestamp in the second heartbeat message is the timestamp sent by the first data destination end saved by the data source end.

[0147] If the second heartbeat messages all meet the second preset condition, the data source end successfully authenticates the data destination end; otherwise, the authentication fails.

[0148] Specifically, the verification failure also includes that the data source end or the data destination end does not receive a response message to the heartbeat message within a preset time, and the received heartbeat message does not meet a preset condition.

[0149] In some embodiments, the data source is used to obtain the timestamp in the original data packet to be transmitted, and encapsulate a preset part of the timestamp into the outer layer of the original data packet to be transmitted.

[0150] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0151] Assemble a first encapsulation message header, the first encapsulation message header includes a message type, a compression algorithm identifier, an original message length of the original data packet to be transmitted, and a HASH value of a source IP address and a target IP address of the original data packet to be transmitted.

[0152] The first encapsulation message header is encapsulated into the outer layer of the compressed original data packet to be transmitted. The encapsulated original data packet to be transmitted is encapsulated into an IP header, wherein the protocol number in the IP header is the protocol number in the custom IP header.

[0153] In some embodiments, the data source is used to obtain the timestamp in the original data packet to be transmitted, and encapsulate a preset part of the timestamp into the outer layer of the original data packet to be transmitted.

[0154] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0155] Assemble a second encapsulation message header, where the second encapsulation message header includes a message type field, a compression algorithm identifier, and an original message length of the original data packet to be transmitted.

[0156] The second encapsulation message header is encapsulated into the outer layer of the compressed original data packet to be transmitted.

[0157] The encapsulated original data packet to be transmitted is encapsulated with a UDP header, wherein the source port number in the UDP header is a HASH value of the source IP address and the destination IP address of the original data packet to be transmitted.

[0158] The embodiment of the present specification also provides a transmission analysis device for a data packet with a timestamp, wherein the transmission analysis device includes at least one data source end and at least one data destination end.

[0159] The data destination is used to generate a key pair, in which the private key is stored locally and the public key is exported to the data source.

[0160] It should be understood that the data destination can correspond to multiple data sources. The data destination generates a key pair for each data source, saves the private key in the key pair locally, and exports the public key in the key pair to the corresponding data source.

[0161] The data source is used to verify with the data destination using heartbeat messages.

[0162] In some embodiments, the data source is started to send a third heartbeat message to the data destination, wherein the third heartbeat message includes the protocol number in the custom IP header, the heartbeat message type, the current system timestamp, and the first encrypted string obtained by encrypting the current system timestamp using the imported public key of the data destination.

[0163] A data destination end is used to verify a third heartbeat message according to a third preset condition, wherein the third preset condition includes that the difference between the current system timestamp in the third heartbeat message and the system time of the data destination end is within a preset range, and that the current system timestamp in the third heartbeat message is greater than the maximum timestamp sent by the data source end saved by the data destination end, or that the current system timestamp in the third heartbeat message is the timestamp sent by the first data source end saved by the data destination end, and that the first encrypted character string is decrypted using the private key of the data destination end, and the timestamp obtained by decryption is consistent with the current system timestamp in the third heartbeat message.

[0164] If the third heartbeat message meets the third preset condition, the data destination sends a fourth heartbeat message to the data source, wherein the fourth heartbeat message includes the protocol number in the custom IP header, the heartbeat message type, the current system timestamp, and the second encrypted string obtained by encrypting the current system timestamp using the private key of the data source destination.

[0165] The data source end is used to verify the fourth heartbeat message according to the fourth preset condition, and the fourth preset condition includes that the current system timestamp in the fourth heartbeat message is within a preset range from the system time of the data source end, and the current system timestamp in the fourth heartbeat message is greater than the maximum timestamp sent by the data destination end saved by the data source end, or the current system timestamp in the fourth heartbeat message is the timestamp sent by the first data destination end saved by the data source end, and the second encrypted character string is decrypted using the public key of the imported data destination end, and the timestamp obtained by decryption is consistent with the current system timestamp in the fourth heartbeat message.

[0166] If the fourth heartbeat messages all meet the fourth preset condition, the data source end successfully authenticates the data destination end; otherwise, the authentication fails.

[0167] The data source is used to negotiate the password of the current transmission password number with the data destination.

[0168] In some embodiments, the data source is used to generate a password to be used in the current cycle or a password to be used in the next cycle according to a preset password generation cycle.

[0169] The data source end is used to encapsulate the password to be used in the current cycle or the password to be used in the next cycle into a first password transmission message and send it to the data destination end. The first password transmission message is encapsulated according to the result of the data source end and the data destination end using the heartbeat message verification.

[0170] The first password transmission message includes the protocol number in the custom IP header, the message type, the current transmission password number, the current system timestamp, and a third encrypted string obtained by encrypting a constructed string using the public key of the imported data destination, wherein the constructed string is a string consisting of the current system timestamp and the password to be used in the current cycle or the password to be used in the next cycle.

[0171] When the verification result is unsuccessful, the first password transmission message also includes a UDP header.

[0172] The data destination terminal is used to receive the first password transmission message and verify the first password transmission message according to the fifth preset condition. The fifth preset condition includes that the difference between the current system timestamp in the first password transmission message and the system time of the data destination terminal is within a preset range, and the current system timestamp in the first password transmission message is greater than the maximum timestamp sent by the data source terminal stored in the data destination terminal, or the current system timestamp in the first password transmission message is the timestamp sent by the first data source terminal stored in the data destination terminal, and the third encrypted character string is decrypted using the private key of the data destination terminal, and the timestamp obtained by decryption is consistent with the current system timestamp in the first password transmission message.

[0173] If the first password transmission message satisfies the fifth preset condition, the data destination end sends a second password transmission message to the data source end, wherein the second password transmission message is encapsulated according to the result of the heartbeat message verification by the data source end and the data destination end.

[0174] The second password transmission message includes the protocol number in the custom IP header, the message type, the current transmission password number, the current system timestamp, and a fourth encrypted string obtained by encrypting a constructed string using the private key of the data destination, wherein the constructed string is a string composed of the current system timestamp and the password to be used in the current cycle or the password to be used in the next cycle, and the current transmission password number is the same as the current transmission password number in the first password transmission message.

[0175] When the verification result is unsuccessful, the second password transmission message also includes a UDP header.

[0176] A data destination terminal is used to receive a second password transmission message and verify the second password transmission message according to a sixth preset condition, the sixth preset condition including that the difference between the current system timestamp in the second password transmission message and the system time of the data source terminal is within a preset range, and that the current system timestamp in the second password transmission message is greater than the maximum timestamp sent by the data destination terminal and stored in the data source terminal, or that the current system timestamp in the second password transmission message is the first timestamp sent by the data destination terminal and stored in the data source terminal, and that the fourth encrypted character string is decrypted using the private key of the data destination terminal, and the timestamp obtained by decryption is consistent with the current system timestamp in the second password transmission message.

[0177] If the second password transmission messages all meet the sixth preset condition, the data source and the data destination confirm that the password negotiation of the current transmission password number is completed.

[0178] When the data source and the data destination are successfully authenticated using a heartbeat message, the data source compresses the original data packet to be transmitted and then performs IP encapsulation to obtain a first encapsulated message. The first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier, and the original packet length of the original data packet to be transmitted.

[0179] In some embodiments, the data source is used to obtain the timestamp in the original data packet to be transmitted, and encapsulate a preset part of the timestamp into the original data packet to be transmitted.

[0180] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0181] The compressed original data packet to be transmitted is encrypted using the password of the current transmission password number negotiated by the data source end and the data destination end.

[0182] Assemble a first encapsulation message header, the first encapsulation message header includes a message type, a compression algorithm identifier, an encryption algorithm identifier, an original message length of the original data packet to be transmitted, a HASH value of the source IP address and the target IP address of the original data packet to be transmitted, and a current transmission password number.

[0183] The first encapsulation message header is encapsulated into the outer layer of the encrypted original data packet to be transmitted.

[0184] An IP header is encapsulated for the encapsulated original data packet to be transmitted, wherein the protocol number in the IP header is the protocol number in the custom IP header.

[0185] When the data source and the data destination fail to verify using the heartbeat message, the data source compresses the original data packet to be transmitted and then performs UDP encapsulation to obtain a second encapsulated message. The second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0186] In some embodiments, the data source is used to obtain the timestamp in the original data packet to be transmitted, and encapsulate a preset part of the timestamp into the original data packet to be transmitted.

[0187] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0188] The compressed original data packet to be transmitted is encrypted using the password of the current transmission password number negotiated by the data source end and the data destination end.

[0189] Assemble a second encapsulation message header, the second encapsulation message header includes a message type field, a compression algorithm identifier, an encryption algorithm identifier, an original message length of the original data packet to be transmitted, and a current transmission password number.

[0190] The second encapsulation message header is encapsulated into the outer layer of the encrypted original data packet to be transmitted.

[0191] The encapsulated original data packet to be transmitted is encapsulated with a UDP header, wherein the source port number in the UDP header is a HASH value of the source IP address and the target IP address of the original data packet to be transmitted.

[0192] The data source end is used to send the first encapsulated message or the second encapsulated message to the data destination end.

[0193] The embodiment of the present specification provides a transmission analysis system for a data packet with a timestamp, wherein the transmission analysis system includes at least one data source end and at least one data destination end.

[0194] The data source end is used to perform verification using a heartbeat message and a data destination end. The heartbeat message includes at least the protocol number in the custom IP header and the current system timestamp.

[0195] If the verification is successful, the data source is used to compress the original data packet to be transmitted, and then perform IP encapsulation to obtain a first encapsulated message. The first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0196] If the verification fails, the data source end is used to compress the original data packet to be transmitted, and then perform UDP encapsulation to obtain a second encapsulated message. The second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0197] The data source end is used to send the first encapsulated message or the second encapsulated message to the data destination end.

[0198] In some embodiments, the data source is started to send a first heartbeat message to the data destination, wherein the first heartbeat message includes the protocol number, message type and current system timestamp in the custom IP header.

[0199] A data destination end is used to verify a first heartbeat message according to a first preset condition, wherein the first preset condition includes that the difference between a current system timestamp in the first heartbeat message and the system time of the data destination end is within a preset range, and that the current system timestamp in the first heartbeat message is greater than the maximum timestamp sent by the data source end saved by the data destination end, or that the current system timestamp in the first heartbeat message is the timestamp sent by the first data source end saved by the data destination end.

[0200] If the first heartbeat messages all meet the first preset condition, the data destination sends a second heartbeat message to the data source, wherein the second heartbeat message includes the protocol number in the custom IP header, the heartbeat message type and the current system timestamp.

[0201] The data source verifies the second heartbeat message according to a second preset condition, wherein the second preset condition includes that the difference between the current system timestamp in the second heartbeat message and the system time of the data source is within a preset range, and that the current system timestamp in the second heartbeat message is greater than the maximum timestamp sent by the data destination end saved by the data source end, or that the current system timestamp in the second heartbeat message is the timestamp sent by the first data destination end saved by the data source end.

[0202] If the second heartbeat messages all meet the second preset condition, the data source end successfully authenticates the data destination end; otherwise, the authentication fails.

[0203] Specifically, the verification failure also includes that the data source end or the data destination end does not receive a response message to the heartbeat message within a preset time, and the received heartbeat message does not meet a preset condition.

[0204] In some embodiments, the data source is used to obtain the timestamp in the original data packet to be transmitted, and encapsulate a preset part of the timestamp into the outer layer of the original data packet to be transmitted.

[0205] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0206] Assemble a first encapsulation message header, the first encapsulation message header includes a message type, a compression algorithm identifier, an original message length of the original data packet to be transmitted, and a HASH value of a source IP address and a target IP address of the original data packet to be transmitted.

[0207] The first encapsulation message header is encapsulated into the outer layer of the compressed original data packet to be transmitted. The encapsulated original data packet to be transmitted is encapsulated into an IP header, wherein the protocol number in the IP header is the protocol number in the custom IP header.

[0208] In some embodiments, the data source is used to obtain the timestamp in the original data packet to be transmitted, and encapsulate a preset part of the timestamp into the outer layer of the original data packet to be transmitted.

[0209] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0210] Assemble a second encapsulation message header, where the second encapsulation message header includes a message type field, a compression algorithm identifier, and an original message length of the original data packet to be transmitted.

[0211] The second encapsulation message header is encapsulated into the outer layer of the compressed original data packet to be transmitted.

[0212] The encapsulated original data packet to be transmitted is encapsulated with a UDP header, wherein the source port number in the UDP header is a HASH value of the source IP address and the destination IP address of the original data packet to be transmitted.

[0213] The embodiment of the present specification provides a transmission analysis system for a data packet with a timestamp, wherein the transmission analysis system includes at least one data source end and at least one data destination end.

[0214] The data destination is used to generate a key pair, in which the private key is stored locally and the public key is exported to the data source.

[0215] It should be understood that the data destination can correspond to multiple data sources. The data destination generates a key pair for each data source, saves the private key in the key pair locally, and exports the public key in the key pair to the corresponding data source.

[0216] The data source is used to verify with the data destination using heartbeat messages.

[0217] In some embodiments, the data source is started to send a third heartbeat message to the data destination, wherein the third heartbeat message includes the protocol number in the custom IP header, the heartbeat message type, the current system timestamp, and the first encrypted string obtained by encrypting the current system timestamp using the imported public key of the data destination.

[0218] A data destination end is used to verify a third heartbeat message according to a third preset condition, wherein the third preset condition includes that the difference between the current system timestamp in the third heartbeat message and the system time of the data destination end is within a preset range, and that the current system timestamp in the third heartbeat message is greater than the maximum timestamp sent by the data source end saved by the data destination end, or that the current system timestamp in the third heartbeat message is the timestamp sent by the first data source end saved by the data destination end, and that the first encrypted character string is decrypted using the private key of the data destination end, and the timestamp obtained by decryption is consistent with the current system timestamp in the third heartbeat message.

[0219] If the third heartbeat message meets the third preset condition, the data destination end is used to send a fourth heartbeat message to the data source end, wherein the fourth heartbeat message includes the protocol number in the custom IP header, the heartbeat message type, the current system timestamp, and the second encrypted string obtained by encrypting the current system timestamp using the private key of the data source destination end.

[0220] The data source end is used to verify the fourth heartbeat message according to the fourth preset condition, and the fourth preset condition includes that the current system timestamp in the fourth heartbeat message is within a preset range from the system time of the data source end, and the current system timestamp in the fourth heartbeat message is greater than the maximum timestamp sent by the data destination end saved by the data source end, or the current system timestamp in the fourth heartbeat message is the timestamp sent by the first data destination end saved by the data source end, and the second encrypted character string is decrypted using the public key of the imported data destination end, and the timestamp obtained by decryption is consistent with the current system timestamp in the fourth heartbeat message.

[0221] If the fourth heartbeat messages all meet the fourth preset condition, the data source end successfully authenticates the data destination end; otherwise, the authentication fails.

[0222] The data source is used to negotiate the password of the current transmission password number with the data destination.

[0223] In some embodiments, the data source is used to generate a password to be used in the current cycle or a password to be used in the next cycle according to a preset password generation cycle.

[0224] The data source end is used to encapsulate the password to be used in the current cycle or the password to be used in the next cycle into a first password transmission message and send it to the data destination end. The first password transmission message is encapsulated according to the result of the data source end and the data destination end using the heartbeat message verification;

[0225] The first password transmission message includes the protocol number in the custom IP header, the message type, the current transmission password number, the current system timestamp, and a third encrypted string obtained by encrypting the constructed string using the public key of the imported data destination, wherein the constructed string is a string composed of the current system timestamp and the password to be used in the current cycle or the password to be used in the next cycle. When the verification result is unsuccessful, the first password transmission message also includes a UDP header.

[0226] The data destination terminal is used to receive the first password transmission message and verify the first password transmission message according to the fifth preset condition. The fifth preset condition includes that the difference between the current system timestamp in the first password transmission message and the system time of the data destination terminal is within a preset range, and the current system timestamp in the first password transmission message is greater than the maximum timestamp sent by the data source terminal stored in the data destination terminal, or the current system timestamp in the first password transmission message is the timestamp sent by the first data source terminal stored in the data destination terminal, and the third encrypted character string is decrypted using the private key of the data destination terminal, and the timestamp obtained by decryption is consistent with the current system timestamp in the first password transmission message.

[0227] If the first password transmission message meets the fifth preset condition, the data destination end is used to send a second password transmission message to the data source end, wherein the second password transmission message is encapsulated according to the result of the heartbeat message verification by the data source end and the data destination end.

[0228] The second password transmission message includes the protocol number in the custom IP header, the message type, the current transmission password number, the current system timestamp, and a fourth encrypted string obtained by encrypting a constructed string using the private key of the data destination, wherein the constructed string is a string composed of the current system timestamp and the password to be used in the current cycle or the password to be used in the next cycle, and the current transmission password number is the same as the current transmission password number in the first password transmission message.

[0229] When the verification result is unsuccessful, the second password transmission message also includes a UDP header.

[0230] A data destination terminal is used to receive a second password transmission message and verify the second password transmission message according to a sixth preset condition, the sixth preset condition including that the difference between the current system timestamp in the second password transmission message and the system time of the data source terminal is within a preset range, and that the current system timestamp in the second password transmission message is greater than the maximum timestamp sent by the data destination terminal and stored in the data source terminal, or that the current system timestamp in the second password transmission message is the first timestamp sent by the data destination terminal and stored in the data source terminal, and that the fourth encrypted character string is decrypted using the private key of the data destination terminal, and the timestamp obtained by decryption is consistent with the current system timestamp in the second password transmission message.

[0231] If the second password transmission messages all meet the sixth preset condition, the data source and the data destination confirm that the password negotiation of the current transmission password number is completed.

[0232] When the source and the data destination are successfully verified using the heartbeat message, the data source is used to compress the original data packet to be transmitted, and then perform IP encapsulation to obtain a first encapsulated message. The first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0233] In some embodiments, the data source is used to obtain the timestamp in the original data packet to be transmitted, and encapsulate a preset part of the timestamp into the original data packet to be transmitted.

[0234] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0235] The compressed original data packet to be transmitted is encrypted using the password of the current transmission password number negotiated by the data source end and the data destination end.

[0236] Assemble a first encapsulation message header, the first encapsulation message header includes a message type, a compression algorithm identifier, an encryption algorithm identifier, an original message length of the original data packet to be transmitted, a HASH value of the source IP address and the target IP address of the original data packet to be transmitted, and a current transmission password number.

[0237] The first encapsulation message header is encapsulated into the outer layer of the encrypted original data packet to be transmitted.

[0238] An IP header is encapsulated for the encapsulated original data packet to be transmitted, wherein the protocol number in the IP header is the protocol number in the custom IP header.

[0239] When the data source and the data destination fail to verify using the heartbeat message, the data source compresses the original data packet to be transmitted and then performs UDP encapsulation to obtain a second encapsulated message. The second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted.

[0240] In some embodiments, the data source is used to obtain the timestamp in the original data packet to be transmitted, and encapsulate a preset part of the timestamp into the original data packet to be transmitted.

[0241] The original data packet to be transmitted after encapsulating the timestamp is compressed by a compression algorithm.

[0242] The compressed original data packet to be transmitted is encrypted using the password of the current transmission password number negotiated by the data source end and the data destination end.

[0243] Assembling a second encapsulation message header, the second encapsulation message header including a message type field, a compression algorithm identifier, an encryption algorithm identifier, an original message length of the original data packet to be transmitted, and a current transmission password number;

[0244] The second encapsulation message header is encapsulated into the outer layer of the encrypted original data packet to be transmitted.

[0245] The encapsulated original data packet to be transmitted is encapsulated with a UDP header, wherein the source port number in the UDP header is a HASH value of the source IP address and the target IP address of the original data packet to be transmitted.

[0246] The data source end is used to send the first encapsulated message or the second encapsulated message to the data destination end.

[0247] This embodiment implements the process of attaching accurate timestamps to historical data when it is played back to the analysis end for data analysis, facilitating correlation analysis of problems, avoiding fragmentation problems caused by excessively large data packets through compression, increasing network bandwidth utilization, and reducing UDP header overhead through private protocols, making it easier to use and reducing data expansion. Through efficient password transmission mechanisms and encryption methods, the privacy of user data packets is protected and security is improved.

[0248] Those skilled in the art should be aware that in one or more of the above examples, the functions described in this application can be implemented by hardware, software, firmware, or any combination thereof. When implemented by software, these functions can be stored in a computer-readable medium or transmitted as one or more instructions or codes on a computer-readable medium.

[0249] The specific implementation methods described above further illustrate the purpose, technical solutions and beneficial effects of the present application in detail. It should be understood that the above description is only the specific implementation methods of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made on the basis of the technical solutions of the present application should be included in the scope of protection of the present application.

Claims

1. A method for analyzing the transmission of a data packet with a timestamp, characterized in that: A transmission analysis device, wherein the transmission analysis device includes at least one data source end and at least one data destination end; The method comprises: The data source and the data destination are verified using a heartbeat message, wherein the heartbeat message includes at least a protocol number in a custom IP header and a current system timestamp; If the verification is successful, the data source end compresses the original data packet to be transmitted, and then performs IP encapsulation to obtain a first encapsulated message, wherein the first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier and the original packet length of the original data packet to be transmitted; If the verification is unsuccessful, the data source end compresses the original data packet to be transmitted, and then performs UDP encapsulation to obtain a second encapsulated message, wherein the second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted; The data source sends the first encapsulated message or the second encapsulated message to the data destination; The data source and the data destination are verified using a heartbeat message, specifically including: The data source starts and sends a first heartbeat message to the data destination, wherein the first heartbeat message includes a protocol number, a message type, and a current system timestamp in a custom IP header; The data destination verifies the first heartbeat message according to a first preset condition; The first preset condition includes that the difference between the current system timestamp in the first heartbeat message and the system time of the data destination end is within a preset range, and the current system timestamp in the first heartbeat message is greater than the maximum timestamp sent by the data source end and saved by the data destination end, or the current system timestamp in the first heartbeat message is the first timestamp sent by the data source end and saved by the data destination end; If the first heartbeat message meets the first preset condition, the data destination sends a second heartbeat message to the data source, wherein the second heartbeat message includes the protocol number, the heartbeat message type and the current system timestamp in the custom IP header; The data source verifies the second heartbeat message according to a second preset condition; The second preset condition includes that the difference between the current system timestamp in the second heartbeat message and the system time of the data source end is within a preset range, and the current system timestamp in the second heartbeat message is greater than the maximum timestamp sent by the data destination end saved by the data source end, or the current system timestamp in the second heartbeat message is the first timestamp sent by the data destination end saved by the data source end; If the second heartbeat message meets the second preset condition, the data source successfully authenticates the data destination; Otherwise, verification fails.

2. The method according to claim 1, characterized in that The data source end compresses the original data packet to be transmitted, and then performs IP encapsulation to obtain a first encapsulated message, which specifically includes: The data source end obtains the timestamp in the original data packet to be transmitted, and encapsulates a preset part of the timestamp into the outer layer of the original data packet to be transmitted; Compressing the original data packet to be transmitted after encapsulating the timestamp by using a compression algorithm; Assembling the first encapsulation message header, wherein the first encapsulation message header includes a message type, a compression algorithm identifier, an original message length of the original data packet to be transmitted, and a HASH value of a source IP address and a destination IP address of the original data packet to be transmitted; Encapsulating the first encapsulation message header into the outer layer of the compressed original data packet to be transmitted; An IP header is encapsulated for the encapsulated original data packet to be transmitted, wherein the protocol number in the IP header is the protocol number in the custom IP header.

3. The method according to claim 1, characterized in that The data source end compresses the original data packet to be transmitted, and then performs UDP encapsulation to obtain a second encapsulated message, which specifically includes: The data source end obtains the timestamp in the original data packet to be transmitted, and encapsulates a preset part of the timestamp into the outer layer of the original data packet to be transmitted; Compressing the original data packet to be transmitted after encapsulating the timestamp by using a compression algorithm; Assembling the second encapsulation message header, wherein the second encapsulation message header includes a message type field, a compression algorithm identifier, and an original message length of the original data packet to be transmitted; Encapsulating the second encapsulation message header into the outer layer of the compressed original data packet to be transmitted; The encapsulated original data packet to be transmitted is encapsulated with a UDP header, wherein the source port number in the UDP header is a HASH value of a source IP address and a target IP address of the original data packet to be transmitted.

4. The method according to claim 1, characterized in that: The method further comprises: The data destination generates a key pair, wherein the private key in the key pair is stored locally, and the public key in the key pair is exported to the data source; The data source and the data destination are verified using a heartbeat message, specifically including: The data source end starts and sends a third heartbeat message to the data destination end, wherein the third heartbeat message includes a protocol number in a custom IP header, a heartbeat message type, a current system timestamp, and a first encrypted string obtained by encrypting the current system timestamp using the imported public key of the data destination end; The data destination verifies the third heartbeat message according to a third preset condition; The third preset condition includes that the difference between the current system timestamp in the third heartbeat message and the system time of the data destination end is within a preset range, and the current system timestamp in the third heartbeat message is greater than the maximum timestamp sent by the data source end and saved by the data destination end, or the current system timestamp in the third heartbeat message is the first timestamp sent by the data source end and saved by the data destination end, and the first encrypted string is decrypted using the private key of the data destination end, and the timestamp obtained is consistent with the current system timestamp in the third heartbeat message; If the third heartbeat message meets the third preset condition, the data destination end sends a fourth heartbeat message to the data source end, wherein the fourth heartbeat message includes the protocol number in the custom IP header, the heartbeat message type, the current system timestamp, and the second encrypted string obtained by encrypting the current system timestamp using the private key of the data destination end; The data source verifies the fourth heartbeat message according to a fourth preset condition, wherein the fourth preset condition includes that the difference between the current system timestamp in the fourth heartbeat message and the system time of the data source is within a preset range, and that the current system timestamp in the fourth heartbeat message is greater than the maximum timestamp sent by the data destination end and saved by the data source end, or that the current system timestamp in the fourth heartbeat message is the first timestamp sent by the data destination end and saved by the data source end, and that the timestamp obtained by decrypting the second encrypted character string using the imported public key of the data destination end is consistent with the current system timestamp in the fourth heartbeat message; If the fourth heartbeat message meets the fourth preset condition, the data source end successfully authenticates the data destination end; Otherwise, verification fails.

5. The method according to claim 4, characterized in that After the data source and the data destination have completed verification using a heartbeat message, the method further includes: The data source generates a password to be used in the current cycle or a password to be used in the next cycle according to a preset password generation cycle; The data source encapsulates the password to be used in the current cycle or the password to be used in the next cycle into a first password transmission message, and sends it to the data destination; Wherein, the first password transmission message is encapsulated according to the result of the verification of the data source end and the data destination end using the heartbeat message; The first password transmission message includes the protocol number, message type, current transmission password number, current system timestamp and a third encrypted string obtained by encrypting a constructed string using the imported public key of the data destination end in the custom IP header, wherein the constructed string is a string composed of the current system timestamp and the password to be used in the current cycle, or a string composed of the current system timestamp and the password to be used in the next cycle; When the verification result is unsuccessful, the first password transmission message also includes a UDP header; The data destination receives the first password transmission message, and verifies the first password transmission message according to a fifth preset condition; The fifth preset condition includes that the difference between the current system timestamp in the first password transmission message and the system time of the data destination end is within a preset range, and the current system timestamp in the first password transmission message is greater than the maximum timestamp sent by the data source end and stored by the data destination end, or the current system timestamp in the first password transmission message is the first timestamp sent by the data source end and stored by the data destination end, and the timestamp obtained by decrypting the third encrypted character string using the private key of the data destination end is consistent with the current system timestamp in the first password transmission message; If the first password transmission message satisfies the fifth preset condition, the data destination sends a second password transmission message to the data source; Wherein, the second password transmission message is encapsulated according to the result of the verification of the data source end and the data destination end using the heartbeat message; The second password transmission message includes the protocol number, message type, current transmission password number, current system timestamp in the custom IP header, and a fourth encrypted string obtained by encrypting the constructed string using the private key of the data destination, wherein the constructed string is a string consisting of the current system timestamp and the password to be used in the current cycle or the password to be used in the next cycle, and the current transmission password number is the same as the current transmission password number in the first password transmission message; When the verification result is unsuccessful, the second password transmission message also includes a UDP header; The data destination receives the second password transmission message, and verifies the second password transmission message according to a sixth preset condition; The sixth preset condition includes that the difference between the current system timestamp in the second password transmission message and the system time of the data source is within a preset range, and the current system timestamp in the second password transmission message is greater than the maximum timestamp sent by the data destination end and stored by the data source end, or the current system timestamp in the second password transmission message is the first timestamp sent by the data destination end and stored by the data source end, and the timestamp obtained by decrypting the fourth encrypted string using the private key of the data destination end is consistent with the current system timestamp in the second password transmission message; If the second password transmission message meets the sixth preset condition, the data source and the data destination confirm that the password negotiation of the current transmission password number is completed.

6. The method according to claim 5, characterized in that The data source end compresses the original data packet to be transmitted, and then performs IP encapsulation to obtain a first encapsulated message, which specifically includes: The data source end obtains the timestamp in the original data packet to be transmitted, and encapsulates a preset part of the timestamp into the outer layer of the original data packet to be transmitted; Compressing the original data packet to be transmitted after encapsulating the timestamp by using a compression algorithm; Encrypting the compressed original data packet to be transmitted by using the password of the current transmission password number obtained through negotiation between the data source and the data destination; Assembling the first encapsulation message header, the first encapsulation message header including a message type, a compression algorithm identifier, an encryption algorithm identifier, an original message length of the original data packet to be transmitted, a HASH value of a source IP address and a target IP address of the original data packet to be transmitted, and the current transmission password number; Encapsulating the first encapsulation message header into the outer layer of the encrypted original data packet to be transmitted; An IP header is encapsulated for the encapsulated original data packet to be transmitted, wherein the protocol number in the IP header is the protocol number in the custom IP header.

7. The method according to claim 5, characterized in that The data source end compresses the original data packet to be transmitted, and then performs UDP encapsulation to obtain a second packet, which specifically includes: The data source end obtains the timestamp in the original data packet to be transmitted, and encapsulates a preset part of the timestamp into the outer layer of the original data packet to be transmitted; Compressing the original data packet to be transmitted after encapsulating the timestamp by using a compression algorithm; Encrypting the compressed original data packet to be transmitted by using the password of the current transmission password number obtained through negotiation between the data source and the data destination; Assembling the second encapsulation message header, the second encapsulation message header including a message type field, a compression algorithm identifier, an encryption algorithm identifier, an original message length of the original data packet to be transmitted, and the current transmission password number; Encapsulating the second encapsulation message header into the outer layer of the encrypted original data packet to be transmitted; The encapsulated original data packet to be transmitted is encapsulated with a UDP header, wherein the source port number in the UDP header is a HASH value of a source IP address and a target IP address of the original data packet to be transmitted.

8. A transmission analysis device for a data packet with a timestamp, characterized in that: The transmission analysis device includes at least one data source end and at least one data destination end; The data source end is used to verify using a heartbeat message and the data destination end, wherein the heartbeat message at least includes a protocol number in a custom IP header and a current system timestamp; If the verification is successful, the data source end is used to compress the original data packet to be transmitted, and then perform IP encapsulation to obtain a first encapsulated message, wherein the first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier and the original packet length of the original data packet to be transmitted; If the verification is unsuccessful, the data source end is used to compress the original data packet to be transmitted, and then perform UDP encapsulation to obtain a second encapsulated message, wherein the second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted; The data source is used to send the first encapsulated message or the second encapsulated message to the data destination; The data source end is started to send a first heartbeat message to the data destination end, wherein the first heartbeat message includes a protocol number, a message type and a current system timestamp in a custom IP header; The data destination is used to verify the first heartbeat message according to a first preset condition; The first preset condition includes that the difference between the current system timestamp in the first heartbeat message and the system time of the data destination end is within a preset range, and the current system timestamp in the first heartbeat message is greater than the maximum timestamp sent by the data source end and saved by the data destination end, or the current system timestamp in the first heartbeat message is the first timestamp sent by the data source end and saved by the data destination end; If the first heartbeat message meets the first preset condition, the data destination sends a second heartbeat message to the data source, wherein the second heartbeat message includes the protocol number, the heartbeat message type and the current system timestamp in the custom IP header; The data source end is used to verify the second heartbeat message according to a second preset condition; The second preset condition includes that the difference between the current system timestamp in the second heartbeat message and the system time of the data source end is within a preset range, and the current system timestamp in the second heartbeat message is greater than the maximum timestamp sent by the data destination end saved by the data source end, or the current system timestamp in the second heartbeat message is the first timestamp sent by the data destination end saved by the data source end; If the second heartbeat message meets the second preset condition, the data source successfully authenticates the data destination; Otherwise, verification fails.

9. A transmission analysis system for a data packet with a timestamp, characterized in that: The transmission analysis system includes at least one data source end and at least one data destination end; The data source end is used to verify using a heartbeat message and the data destination end, wherein the heartbeat message at least includes a protocol number in a custom IP header and a current system timestamp; If the verification is successful, the data source end is used to compress the original data packet to be transmitted, and then perform IP encapsulation to obtain a first encapsulated message, wherein the first encapsulated message header includes the protocol number in the custom IP header, the compression algorithm identifier and the original packet length of the original data packet to be transmitted; If the verification is unsuccessful, the data source end is used to compress the original data packet to be transmitted, and then perform UDP encapsulation to obtain a second encapsulated message, wherein the second encapsulated message header includes a compression algorithm identifier and the original packet length of the original data packet to be transmitted; The data source is used to send the first encapsulated message or the second encapsulated message to the data destination; The data source end is started to send a first heartbeat message to the data destination end, wherein the first heartbeat message includes a protocol number, a message type and a current system timestamp in a custom IP header; The data destination verifies the first heartbeat message according to a first preset condition; The first preset condition includes that the difference between the current system timestamp in the first heartbeat message and the system time of the data destination end is within a preset range, and the current system timestamp in the first heartbeat message is greater than the maximum timestamp sent by the data source end and saved by the data destination end, or the current system timestamp in the first heartbeat message is the first timestamp sent by the data source end and saved by the data destination end; If the first heartbeat message meets the first preset condition, the data destination sends a second heartbeat message to the data source, wherein the second heartbeat message includes the protocol number, the heartbeat message type and the current system timestamp in the custom IP header; The data source verifies the second heartbeat message according to a second preset condition; The second preset condition includes that the difference between the current system timestamp in the second heartbeat message and the system time of the data source end is within a preset range, and the current system timestamp in the second heartbeat message is greater than the maximum timestamp sent by the data destination end saved by the data source end, or the current system timestamp in the second heartbeat message is the first timestamp sent by the data destination end saved by the data source end; If the second heartbeat message meets the second preset condition, the data source successfully authenticates the data destination; Otherwise, verification fails.

Images