Data transmission method, data transmission device and electronic equipment

Abstract

The invention provides a data transmission method, a data transmission device and electronic equipment. The invention provides a data transmission method, a data transmission device and electronic equipment. In the method, a transmitting end device does not split an overlay big data packet of which the byte length is greater than that of an MTU, and directly encrypts and encapsulates the overlay big data packet to obtain an underlay big data packet encapsulated by a TCP, and then a first network card sends the underlay big data packet based on a GSO function. And the second network card receives the underlay big data packet packaged by the TCP based on the GRO function, and directly decapsulates and decrypts the underlay big data packet to obtain an overlay big data packet. Thus, the sending end equipment performs encryption, encapsulation and sending processing on the overlay big data packet once, and the receiving end equipment performs receiving, de-encapsulation and decryption processing on the underlay big data packet once, so that the processing times of the sending end equipment and the receiving end equipment are reduced, and the computing resources of the sending end equipment and the receiving end equipment are saved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a data transmission method, a data transmission device and an electronic device. Background Art

[0002] An overlay network is a virtual network built on top of an underlay network. To ensure the security of data transmission, an overlay network can be built based on tunnel encryption technology. The sending device and the receiving device can communicate in the overlay network based on tunnel encryption technology.

[0003] In the prior art, when an overlay data packet is transmitted based on tunnel encryption technology, the overlay data packet of the sending device is encapsulated to obtain an underlay data packet, and then the underlay data packet is sent through the network card of the sending device and received by the network card of the receiving device. After receiving the underlay data packet, the network card of the receiving device passes it to the operating system of the receiving device, and the operating system of the receiving device can restore the underlay data packet to the original overlay data packet.

[0004] However, in the above-mentioned overlay network built based on tunnel encryption communication technology, due to the limitation of the MTU of the underlay network, for a large overlay data packet, the conventional technical processing is as follows: the sending device first divides the large overlay data packet into multiple small overlay data packets, and the sending device obtains an underlay small data packet after encrypting and encapsulating each small overlay data packet, wherein the length of each underlay small data packet does not exceed the MTU. The receiving device receives each small underlay data packet, and then decrypts and decapsulates it to obtain multiple small overlay data packets, and then reassembles and merges the multiple small overlay data packets to obtain a large overlay data packet. In the above-mentioned process of transmitting the large overlay data packet, the consumption of computing resources by the sending device and the receiving device during transmission is relatively high. Summary of the invention

[0005] The present application provides a data transmission method, a data transmission device and an electronic device. The data transmission method reduces the number of encryption and encapsulation processing times of an overlay data packet by a transmitting device, and can reduce the number of decryption and decapsulation processing times of an underlay data packet by a receiving end, thereby saving computing resources of the transmitting device and the receiving device.

[0006] In a first aspect, an embodiment of the present application provides a data transmission method, which is applied to a sending device, wherein the sending device is connected to a first network card; the first network card has a generic segmentation offload (GSO) function; and the first network card is connected to a receiving device through an underlay network and a second network card; the method includes: based on receiving a first data packet from an upper-layer overlay network, encrypting the first data packet once to obtain a second data packet; wherein the byte length of the first data packet is greater than the maximum transmission unit (MTU) of the underlying underlay network; based on the transmission control protocol (TCP) supported by the GSO function of the first network card, encapsulating the second data packet once to obtain a third data packet, the byte length of the third data packet is greater than the MTU, and the encapsulation format of the third data packet is TCP encapsulation; based on the GSO function of the first network card, sending the third data packet to the second network card of the receiving device through the first network card and the underlay network.

[0007] In the embodiment of the present application, the sending end device makes full use of the GSO function of the first network card, and after receiving the overlay large data packet with a large byte length, does not split the overlay large data packet, but only encrypts it once, and performs one encapsulation process based on the TCP protocol to obtain the underlay large data packet, and then uses the GSO function of the first network card to send the underlay large data packet. In this way, the computing resources of the sending end are saved.

[0008] In some embodiments, the TCP protocol supported by the GSO function of the first network card encapsulates the second data packet once to obtain a third data packet, including: adding an encapsulation header pre-negotiated by the sending device and the receiving device to the second data packet to obtain an encapsulated message; adding a TCP header of the TCP protocol supported by the GSO function of the first network card to the encapsulation message to obtain a TCP message; adding an Internet Protocol (IP) header to the TCP message to obtain the third data packet.

[0009] In some embodiments, the encrypting the first data packet once includes: encrypting the first data packet once using an encryption algorithm pre-negotiated by the sending device and the receiving device to obtain the second data packet.

[0010] In a second aspect, the present application provides a data transmission method, which is applied to a receiving device, wherein the receiving device is connected to a second network card; the second network card supports a generic receive segmentation offload (Generic ReceiveOffload, GRO) function, and the second network card is connected to a sending device through a lower-layer underlay network and a first network card; the method comprises: receiving a third data packet from the second network card; wherein the third data packet is received by the second network card from the underlay network using the GRO function of the second network card, and the third data packet is sent by the sending device to the underlay network using the GSO function of the first network card, and the byte length of the third data packet is greater than the maximum transmission unit MTU of the underlay network; according to the encapsulation header format pre-negotiated by the sending device and the receiving device and the TCP protocol supported by the GRO function of the second network card, the third data packet is decapsulated once to obtain a second data packet; the second data packet is decrypted once to obtain a first data packet; the byte length of the first data packet is greater than the MTU of the underlay network.

[0011] In the embodiment of the present application, when the second network card has the GRO function, the receiving end device receives the TCP-encapsulated underlay large data packet based on the GRO function of the second network card, and the receiving end device performs one decapsulation and one decryption process on the underlay large data packet to obtain the original overlay data packet. In this way, the number of times the receiving end device performs decryption and decapsulation is reduced, thereby reducing the computing resources of the receiving end device.

[0012] In some embodiments, according to the encapsulation header format pre-negotiated by the sending device and the receiving device and the TCP protocol supported by the GRO function of the second network card, the third data packet is decapsulated, including: removing the IP header of the third data packet to obtain a TCP message; removing the TCP header of the TCP protocol supported by the GSO function of the first network card in the TCP message to obtain an encapsulated message; removing the encapsulation header pre-negotiated by the sending device and the receiving device in the encapsulated message to obtain the second data packet.

[0013] In some embodiments, the decrypting the second data packet includes: decrypting the second data packet based on an encryption algorithm pre-negotiated by the sending device and the receiving device.

[0014] In a third aspect, the present application provides a data transmission device, including: a module for executing the data transmission method described in the first aspect.

[0015] In a fourth aspect, the present application provides a data transmission device, comprising: a module for executing the data transmission method described in the second aspect.

[0016] In a fifth aspect, the present application provides a chip comprising an interface circuit and a logic circuit, wherein the interface circuit is used to receive signals from other chips outside the chip and transmit them to the logic circuit, or to send signals from the logic circuit to other chips outside the chip, and the logic circuit is used to implement the method described in the first aspect or the second aspect of the present application.

[0017] In a sixth aspect, the present application provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect or the second aspect of the present application.

[0018] In a seventh aspect, the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the first aspect or the second aspect of the present application.

[0019] In an eighth aspect, the present application provides a sending end device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, and when the processor executes the program, the method described in the first aspect of the present application is implemented.

[0020] In a ninth aspect, the present application provides a receiving device, comprising a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and when the processor executes the program, the method described in the second aspect of the present application is implemented.

[0021] In a tenth aspect, the present application provides an electronic device, comprising the data transmission device described in the third aspect of the present application and a first network card.

[0022] In an eleventh aspect, the present application provides an electronic device, comprising the data transmission device and a second network card described in the fourth aspect of the present application.

[0023] The beneficial effects of the data transmission methods of the third aspect to the eleventh aspect and each embodiment mentioned above can be referred to the beneficial effects brought about by the first aspect and the second aspect and each embodiment mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] Figure 1 A signaling interaction diagram of a data transmission method provided in an embodiment of the present application;

[0025] Figure 2 A flowchart for implementing a one-time packaging provided in an embodiment of the present application;

[0026] Figure 3A flowchart for implementing a one-time decapsulation provided in an embodiment of the present application;

[0027] Figure 4 A schematic diagram of the structure of a data transmission device provided in an embodiment of the present application;

[0028] Figure 5 A schematic diagram of the structure of a data transmission device provided in an embodiment of the present application;

[0029] Figure 6 A schematic diagram of the structure of a transmitting device provided in an embodiment of the present application;

[0030] Figure 7 A schematic diagram of the structure of a receiving device provided in an embodiment of the present application;

[0031] Figure 8 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application;

[0032] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0033] In this application, "at least one" means one or more, and "plurality" means two or more. "And / or" describes the association relationship of associated objects, indicating that three relationships may exist. For example, A and / or B can represent: A exists alone, A and B exist at the same time, and B exists alone, where A and B can be singular or plural. The character " / " generally indicates that the associated objects before and after are in an "or" relationship. "At least one of the following" or similar expressions refers to any combination of these items, including any combination of single items or plural items. For example, at least one of a, b, or c alone can represent: a, b, c, a and b, a and c, or a, b, and c, where a, b, and c can be single or multiple. In addition, the terms "first" and "second" are used for descriptive purposes only and cannot be understood as indicating or implying relative importance.

[0034] The directions or positional relationships indicated by terms such as "center", "longitudinal", "lateral", "up", "down", "left", "right", "front", and "back" are based on the directions or positional relationships shown in the accompanying drawings and are only for the convenience of describing the present application and simplifying the description. They do not indicate or imply that the device or element referred to must have a specific direction, be constructed and operated in a specific direction, and therefore should not be understood as a limitation on the present application.

[0035] The terms "connected" and "connected" should be understood in a broad sense. For example, the "connected" or "connected" of a circuit structure can refer to not only physical connection, but also electrical connection or signal connection. For example, it can be directly connected, that is, physically connected, or indirectly connected through at least one intermediate element, as long as the circuit is connected, or it can be the internal connection of two elements; signal connection can refer to signal connection through a circuit or through a media medium, such as radio waves. For ordinary technicians in this field, the specific meanings of the above terms in this application can be understood according to specific circumstances.

[0036] An overlay network is a virtual network built on top of an underlay network. To ensure the security of data transmission, an overlay network can be built based on tunnel encryption technology. The sending device and the receiving device can communicate in the overlay network based on tunnel encryption technology.

[0037] When an overlay data packet is transmitted in the overlay network between the sending device and the receiving device based on the tunnel encryption technology, the sending device needs to process the data packet so that the data packet meets the transmission conditions of the underlay network, and then transmit the processed underlay data packet through the underlay network between the sending device and the receiving device. Correspondingly, after receiving the processed data packet, the receiving device restores the underlay data packet to obtain the unprocessed overlay data packet.

[0038] Conventional tunnel encryption communication protocols include Internet Protocol Security (IPSec), Layer 2 Tunneling Protocol (L2TP) and Wireguard. Most of them adopt User Datagram Protocol (UDP) encapsulation. On the basis of overlay data packets, the overlay data packets are encrypted, and then the encapsulation header, UDP header, and Internet Protocol (IP) header are added to uniformly encapsulate different types of original overlay data packets into UDP packets to form a data-encrypted underlay data packet, which is then transmitted in the underlay network layer. After the underlay network layer at the opposite end receives the underlay data packet, it decapsulates and decrypts it to obtain the original overlay data packet, and passes the overlay data packet to the upper-layer overlay network to complete the encrypted communication process of the virtual tunnel.

[0039] The underlay data packet has a packet length limit, and its byte length cannot exceed the MTU of the underlay network layer. The MTU of the conventional underlay network layer is 1500 bytes. If the original overlay is a large data packet that exceeds the MTU, such as a 32K-byte TCP large data packet, and the encrypted and encapsulated underlay data packet exceeds the MTU limit, the original overlay data packet cannot be directly encrypted and encapsulated.

[0040] In a conventional virtual tunnel, the tunnel sender needs to split the original overlay packet first, split the overlay packet into multiple small overlay data packets, and then perform UDP encryption and encapsulation on each small overlay data packet to obtain multiple UDP data packets of the underlay network layer, and then send out the multiple UDP data packets. The tunnel receiver receives each UDP data packet, first decrypts and decapsulates it, obtains each small overlay data packet, and then reassembles all the small overlay data packets into a large overlay data packet, that is, the original overlay packet, and then passes the overlay packet to the overlay network layer. Each original overlay large packet needs to be processed in this way when it is transmitted in the tunnel.

[0041] The original overlay large data packet that has not been encrypted and encapsulated can also be described as an overlay large packet. Among them, the small overlay data packet can also be described as an overlay segment, an overlay segment packet, etc. The UDP data packet of the underlay network layer can also be described as an underlay UDP data packet, etc.

[0042] The sending end performs segmentation, encryption, encapsulation, and sending operations. The receiving end performs receiving, decryption, decapsulation, and reassembly operations. Such a process increases the processing pressure on the CPU of the devices at both ends and increases the delay of tunnel encryption communication. This problem is particularly serious in electronic devices with low CPU performance, such as embedded communication devices. The process of segmentation followed by encryption and encapsulation seriously reduces the speed of encrypted communication in the tunnel. For example, in electronic devices with low CPU performance, the communication speed of the IPSEC tunnel is low and cannot meet the actual application requirements of encrypted communication.

[0043] In addition, many encryption technologies are implemented using hardware encryption. Most hardware encryptions have a characteristic: the encryption and decryption of a large number of small packets is slower than the encryption and decryption of a small number of large packets. For encryption or decryption processing, each small packet of data needs to be passed to the hardware encryption module. After the hardware encryption module encrypts or decrypts each small packet of data, it passes the encrypted or decrypted small packet data to the operating system kernel in turn. The encryption and decryption processing of each small packet of data requires such a data transmission process. This will reduce the processing speed of encryption and decryption, increase the processing burden of the operating system kernel, bring processing pressure to the CPU, and also increase time delay, reducing the encrypted communication speed of the tunnel.

[0044] In addition, as a bridge between electronic devices and the network, the network card has the GSO function after years of development. It can offload the splitting function of large data packets to the network card for execution. The network card will perform the splitting of large data packets, and the electronic device kernel protocol stack no longer needs to split large data packets. The GSO function can significantly reduce the processing pressure of the operating system kernel CPU, reduce the delay of data packet splitting, and thus increase the transmission speed of data packets.

[0045] Corresponding to the GSO function of the network card connected to the sending device, the network card connected to the receiving device also has the GRO function. The GRO function of the network card supports caching the received underlay segmented packets, reassembling multiple cached underlay segmented packets into a complete underlay data packet, and then passing the reassembled underlay large data packet to the kernel protocol stack of the operating system of the receiving device. The kernel protocol stack of the operating system no longer performs the caching and reassembly operations on the underlay segmented packets. The GRO function can also greatly reduce the processing pressure of the operating system kernel, reduce the segmentation cache reassembly delay of the data packet, and speed up the transmission speed of the data packet.

[0046] For some electronic devices with low CPU processing power, such as embedded communication devices, the GSO and GRO functions of the network card are of great value. The GSO and GRO functions of the network card can significantly reduce the performance requirements of the electronic device on the CPU, so that electronic devices with low CPU performance can use low-cost CPUs to achieve high-speed communication.

[0047] Among them, the GSO / GRO function of the network card supports the transmission of TCP data packets, but does not support the transmission of UDP and other types of data packets.

[0048] If the sending device and the receiving device use the above-mentioned traditional IPSEC, L2TP, wireguard and other UDP encapsulation type tunnels for data transmission. On the one hand, the sending device splits the overlay data packet, encrypts and encapsulates each small data packet after the split, which will occupy more computing resources of the sending device CPU and operating system kernel, and increase the data transmission delay; similarly, the receiving device needs to decrypt and decapsulate each small data packet received, and reassemble multiple small data packets after decapsulation, which will occupy more computing resources of the receiving device CPU. On the other hand, the sending device splits the data packet before sending it.

[0049] In addition, the sending end device splits the received data packets, but the splitting process is not transferred to the first network card connected to the sending end device and having the GSO function, so the GSO function of the first network card is not fully utilized. The receiving end device reassembles the received data packets, but the reassembly process is not transferred to the second network card connected to the receiving end and having the GRO function, so the GRO function of the second network card is not fully utilized.

[0050] Based on this, the present application provides a data transmission method. The data transmission method is applied to a sending end device, a connection between the sending end device and a first network card, the first network card has a GSO function; and the first network card is connected to the receiving end device through an underlay network and a second network card. Among them, the connection method between the sending end device and the first network card is not limited. In some embodiments, the first network card is a plug-in network card device, the sending end device has a network card slot, and the first network card is inserted into the network card slot to establish a connection with the sending end device. In other embodiments, the first network card is an integrable circuit module, which can be integrated inside the sending end device before the sending end device leaves the factory.

[0051] Accordingly, the connection method between the receiving device and the second network card is not limited. The second network card can also be connected to the receiving device through the network card slot, or integrated into the receiving device before the receiving device leaves the factory.

[0052] The transmitting device and the receiving device can be various handheld devices with wireless communication functions, vehicle-mounted devices, wearable devices, computing devices or other processing devices connected to wireless modems, as well as various forms of user terminal devices or mobile stations (Mobile Station, MS), customer terminal equipment (Customer Premise Equipment, CPE) and other wireless broadband access devices.

[0053] The data transmission method provided in the embodiment of the present application can be applied to various communication systems, and the communication system can be a fourth-generation mobile communication system (the 4th generation mobile communication system, 4G), a fifth-generation mobile communication technology (5th-Generation wireless communication technology, 5G) new radio (New Radio, NR) system or a future communication system, or various other wireless communication systems.

[0054] Figure 1 This is a signaling interaction diagram of the data transmission method provided in the embodiment of the present application. Figure 1 As shown, the method describes the interaction process between the sending end device and the receiving end device, and the method includes:

[0055] S101. A transmitting end device encrypts a first data packet (overlay large packet) received from an overlay network to obtain a second data packet. The byte length of the first data packet is greater than the MTU of the underlay network.

[0056] The entity device that sends the first data packet to the sending end device may be any device different from the sending end device.

[0057] As mentioned above, an overlay network is a virtual network built on top of an underlay network, and a sending device receives a first data packet sent by the overlay network; specifically, the sending device enables the GRO function of the underlying network card (first network card) that receives the overlay data packet, for example, the GRO function of the local area network (LAN) network card is enabled, and the LAN network card of the sending device receives a large TCP packet, which is an overlay packet.

[0058] The first data packet is encrypted, including: using an encryption algorithm pre-negotiated by a sending end device and a receiving end device to encrypt the first data packet once to obtain a second data packet.

[0059] The encryption process of the first data packet is as follows: the sending end device performs encryption processing on the first data packet based on the hardware encryption engine. Specifically, each time the sending end device receives a first data packet (overlay packet), it sends the first data packet as a whole to the hardware encryption engine at one time. The hardware encryption engine performs an encryption operation on the first data packet and outputs a complete second data packet to the operating system at one time.

[0060] A hardware cryptographic engine is a processor specially designed to perform encryption or decryption operations, also known as a cryptographic accelerator, cryptographic coprocessor, or cryptographic processor. A hardware cryptographic engine can usually process large amounts of data very quickly.

[0061] This application does not limit the algorithm for encrypting the first data packet. The sending end device can select a suitable encryption algorithm according to actual needs. Exemplarily, the hardware encryption engine can perform a one-time encryption process on the first data packet based on the GCM (AES) encryption algorithm.

[0062] S102. The sending end device performs a TCP encapsulation process on the second data packet based on the TCP protocol supported by the GSO function of the first network card to obtain a third data packet (a TCP-encapsulated underlay large data packet); wherein the byte length of the third data packet is greater than the MTU.

[0063] As described above, TCP is used to encapsulate the second data packet, and the receiving device and the sending device need to communicate based on the TCP protocol.

[0064] Before S102, the method further includes: the sending end device and the receiving end device perform a three-way handshake to establish a TCP connection.

[0065] In the related art, the overlay data packet is mostly encapsulated by using the UDP encapsulation method that matches the User Datagram Protocol (UDP). On the basis of encrypting the overlay data packet, the UDP header and IP header are added to the overlay data packet to encapsulate it into a UDP data packet. The UDP data packet is then transmitted in the underlay network.

[0066] However, when the sending device sends the encapsulated data packet to the underlay network through the first network card, the GSO function of the first network card does not support the UDP data packet of the existing tunnel encryption communication protocol. Therefore, the existing encapsulation method is not suitable for this application.

[0067] In the present application, the first network card with GSO function supports data packets encapsulated based on the TCP protocol. In order to effectively utilize the GSO function of the first network card, the second data packet is encapsulated once based on the TCP protocol supported by the GSO function of the first network card to obtain a third data packet.

[0068] The encapsulation format of the third data packet is TCP encapsulation.

[0069] The method of encapsulating the second data packet once is as follows: Figure 2 As shown, including S2021 to S2023:

[0070] S1021. The sending end device adds an encapsulation header pre-negotiated between the sending end device and the receiving end device to the second data packet to obtain an encapsulated message.

[0071] Among them, the encapsulation header includes: an encapsulation protocol frame identifier, the length of the encapsulation header, the total length of the encapsulation header and the second data packet, a first identifier of the transmission tunnel between the sending device and the receiving device, a second identifier of the encryption algorithm based on which the first data packet is encrypted, and a check code of the encapsulation frame header.

[0072] The encapsulation protocol frame identifier is used to distinguish different encapsulation protocols. Different protocol messages require different encapsulation protocol frame identifiers for distinction. The encapsulation protocol frame identifier occupies 4 bytes.

[0073] The length of the encapsulation header occupies 2 bytes. The total length of the encapsulation protocol header and the second data packet occupies 2 bytes, the first identifier occupies 4 bytes, the second identifier occupies 2 bytes, and the checksum occupies 2 bytes.

[0074] S1022: The sending end device adds a TCP header of the TCP protocol supported by the GSO function of the first network card to the encapsulation message to obtain a TCP message.

[0075] The TCP header includes a TCP port.

[0076] S1023. The sending device adds the IP header to the TCP message to obtain a third data packet.

[0077] Among them, the IP header includes the IP address.

[0078] S103: The sending end device sends the third data packet to the receiving end device through the first network card and the underlay network based on the GSO function of the first network card.

[0079] It can be understood that after the first data packet is encrypted and encapsulated once, it becomes a third data packet (underlay data packet) that can be transmitted in the underlay network. In this way, the first network card of the underlay network layer can transmit the third data packet to the receiving end side.

[0080] S104: The receiving device receives the third data packet (TCP-encapsulated underlay large data packet) through the second network card.

[0081] The second network card has a GRO function, and the third data packet is received by the second network card from the underlay network using the GRO function of the second network card. And the third data packet is sent to the underlay network by the sending end device using the GSO function of the first network card.

[0082] The byte length of the third data packet is greater than the MTU.

[0083] S105: The receiving device decapsulates the third data packet to obtain a second data packet.

[0084] The third data packet is a TCP-encapsulated underlay data packet.

[0085] The specific implementation method of the receiving end device performing a decapsulation process on the third data packet is as follows: Figure 3 As shown, including S2051 to S2053:

[0086] S1051. The receiving device removes the IP header of the third data packet to obtain a TCP message.

[0087] S1052: The receiving device removes the TCP header of the TCP protocol supported by the GSO function of the first network card in the TCP message to obtain an encapsulated message.

[0088] S1053: The receiving device removes the encapsulation header that is pre-negotiated between the sending device and the receiving device in the encapsulated message to obtain a second data packet.

[0089] S106, decrypt the second data packet once to obtain a first data packet (overlay large packet).

[0090] Performing a decryption process on the second data packet to obtain the first data packet includes: performing a decryption process on the second data packet based on an encryption algorithm pre-negotiated by the sending end device and the receiving end device.

[0091] The specific implementation method of performing a decryption process on the second data packet is as follows: the second data packet is input into the hardware encryption engine as a whole at one time, and the hardware encryption engine performs a decryption operation on the second data packet and outputs a complete first data packet at one time.

[0092] In the data transmission method adopted by the present application, the sending device does not split the overlay large data packet whose byte length is greater than the MTU, but directly encrypts and encapsulates it to obtain the TCP-encapsulated underlay large data packet, and then the first network card sends the underlay large data packet based on the GSO function. The second network card receives the TCP-encapsulated underlay large data packet based on the GRO function, and directly decapsulates and decrypts it to obtain the overlay large data packet. In this way, the sending device performs encryption, encapsulation and sending processing on the overlay large data packet once, and the receiving device performs reception, decapsulation and decryption processing on the underlay large data packet once, which reduces the number of processing times of the sending device and the receiving device, and saves the computing resources of the sending device and the receiving device.

[0093] In addition, the sending device uses TCP to encapsulate to obtain the third data packet. When the first network card sends the encapsulated TCP packet (the third data packet), it will actually split the third data packet into multiple segment packets, and then send the multiple segment packets out. The length of each segment packet does not exceed the MTU of the underlay network. Therefore, the use of TCP encapsulation technology will not violate the technical specifications and standards of the underlay network. However, the processing of this segmented sending is completed inside the first network card, and has nothing to do with the CPU and operating system of the sending device, and does not occupy the computing resources of the sending device.

[0094] In order to more clearly understand the technical effects obtained by the present application, the following exemplary explanations are given of the number of encryptions, encapsulations, and transmissions corresponding to the sending device in the existing data transmission method and the data transmission method of the present application, and the number of receptions, decapsulations, and decryptions corresponding to the receiving device.

[0095] In the existing data transmission method, at the sending end of the tunnel, the existing encrypted tunnel sends an overlay packet, and the sending device splits the overlay packet into multiple segmented packets. For example, the sending device receives a 32K-byte overlay packet, and splits the overlay packet according to the byte length of 1400 to obtain 23 segmented packets. The 23 segmented packets are input into the encryption module in sequence, and the encryption module performs 23 encryption operations to obtain 23 encrypted packets. Next, the sending device encapsulates the 23 encrypted packets in sequence, performs 23 encapsulation processes, and obtains 23 encapsulated packets. The sending device sends the 23 encapsulated packets through the underlay layer network card device. In the whole process, the sending device needs to undergo 23 splitting operations + 23 encryption operations + 23 encapsulation processes + 23 sending operations. There are a total of 92 processing processes.

[0096] At the receiving end of the tunnel, the receiving device receives 23 encapsulated packets from the underlay layer network card device, that is, it performs 23 receiving operations. Then the 23 encapsulated packets are decapsulated to obtain 23 encrypted packets. The 23 encrypted packets are input into the encryption module, which decrypts the 23 encrypted packets in turn to obtain 23 decrypted segmented overlay packets; next, the receiving device reassembles the 23 segmented overlay packets to obtain the original overlay packet. In the whole process, the receiving device needs to undergo 23 receptions + 23 decapsulations + 23 decryptions + 23 reassemblies. There are a total of 92 processing processes.

[0097] It can be seen that in the existing data transmission method, for an overlay packet with a large amount of data, multiple splitting, sending, encryption and encapsulation operations will bring a lot of resource consumption to the sending device. Correspondingly, multiple receiving, decapsulation, decryption and reassembly operations will also bring a lot of resource consumption to the receiving device.

[0098] In the embodiment of the present application, the sending end device does not split the first data packet, which saves the process of splitting the operating system, saving the CPU resources and time delay of the splitting process. The operating system passes the overlay large packet data (first data packet) to the encryption module at one time, and the encryption module encrypts the first data packet once, instead of encrypting multiple small data packets. After the encryption module completes the encryption process, it passes the encrypted second data packet to the operating system at one time. The operating system obtains an encrypted large packet at one time. Multiple small packet data are not encrypted multiple times, saving the time delay of encryption processing. The operating system directly encapsulates the encrypted large packet (second data packet) instead of encapsulating multiple small packets multiple times, saving CPU resources and time consumption for encapsulation processing. The operating system sends a large encapsulated TCP packet (third data packet) from the underlay layer network card in a GSO manner at one time, saving the process of sending multiple encapsulated packets multiple times, saving CPU resources and time consumption for sending encapsulated packets. In the above process, the sending end device only needs to perform one encryption + one encapsulation + one transmission, and only three processing processes are required in total. Compared with conventional encrypted tunnels, it can significantly reduce CPU resource consumption and time delay.

[0099] Accordingly, the receiving device uses the GRO function of the second network card of the underlay layer to receive the entire TCP encapsulated large packet (third data packet) in a GRO mode at one time, instead of receiving multiple encapsulated small packets multiple times, saving the CPU resources and time consumption of receiving encapsulated packets from the network card device multiple times. The tunnel receiving end operating system directly decapsulates the TCP encapsulated large packet (third data packet) once to obtain an encrypted large packet (second data packet), instead of decapsulating multiple encapsulated packets multiple times, saving the CPU resources and time consumption of decapsulation processing. The tunnel receiving end operating system decrypts the encrypted large packet once to obtain the original overlay large packet (first data packet), instead of decrypting multiple small packet data multiple times, saving the process of data exchange between multiple small packet data and the encryption module, saving CPU resources for decryption processing, and reducing the time delay of decryption processing. The tunnel receiving end operating system no longer needs to perform reassembly processing of multiple overlay segments. Taking the reception of a 32K-byte overlay large packet as an example, the entire receiving process of the receiving end only requires one reception + one decapsulation + one decryption, and only three processing processes are required in total. Compared with conventional encrypted tunnels, it can significantly reduce CPU resource consumption and time delay.

[0100] The innovation of this patented method is that it makes full use of the GSO / GRO function of the underlay layer network card to effectively improve the way the encrypted tunnel handles the overlay packet (the first data packet). The operating systems at both ends of the encrypted tunnel directly encrypt, encapsulate, send, receive, decapsulate, and decrypt the overlay packet (the first data packet). The entire processing process is not segmented or merged, which effectively reduces the total number of packets processed by the encrypted tunnel and the total number of packets processed by the operating system, thereby effectively reducing the total CPU consumption and time delay of the devices at both ends, and improving the encrypted communication speed of the tunnel.

[0101] The data transmission method of the present application is particularly valuable for embedded communication devices. The CPU performance of embedded communication devices is not high, and the processing performance of the hardware encryption module is not high, which greatly limits the tunnel encryption communication speed. Not only is the tunnel encryption communication speed not high, but the device CPU consumption is also very large. Using the data transmission method of the present application, the CPU consumption caused by tunnel encryption and encapsulation processing can be effectively reduced, the processing speed of the hardware encryption module can be effectively improved, and the tunnel encryption communication speed can be effectively improved.

[0102] After actual testing of related products, the data transmission method of this application can significantly improve the speed of tunnel encryption communication on low-end embedded devices. For example, on a CPE device with a Qualcomm 5018 chip, this application is used to implement an encrypted communication tunnel, and compared with an IPSEC encrypted tunnel, the encrypted communication speed is 2-4 times faster.

[0103] The device type, data packet length, segment length, encryption algorithm and encapsulation format in this embodiment are for illustrative purposes only and are not limited by these specific detailed parameters in actual implementation.

[0104] It should be noted that although the steps of the method in the present application are described in a specific order in the drawings, this does not require or imply that the steps must be performed in this specific order, or that all the steps shown must be performed to achieve the desired results. Additionally or alternatively, some steps may be omitted, multiple steps may be combined into one step, and / or one step may be decomposed into multiple steps, etc.; or, steps in different embodiments may be combined into a new technical solution.

[0105] Based on the foregoing embodiments, an embodiment of the present application provides a data transmission device, which includes the modules included and the units included in the modules, and can be implemented by a processor; of course, it can also be implemented by a specific logic circuit; in the implementation process, the processor can be a CPU, a microprocessor (MPU), a digital signal processor (DSP) or a field programmable gate array (FPGA), etc.

[0106] Figure 4 A schematic diagram of the structure of a data transmission device provided in an embodiment of the present application is shown in FIG. Figure 4 As shown, the data transmission device 40 includes an encryption module 41 , a packaging module 42 and a sending module 43 .

[0107] Among them, the encryption module 41 is used to encrypt the first data packet once based on receiving the first data packet from the upper overlay network to obtain a second data packet; wherein the byte length of the first data packet is greater than the maximum transmission unit MTU of the underlying underlay network.

[0108] The encapsulation module 42 is used to encapsulate the second data packet based on the TCP protocol supported by the GSO function of the first network card to obtain a third data packet, the byte length of the third data packet is greater than the MTU, and the encapsulation format of the third data packet is TCP encapsulation.

[0109] The sending module 43 is used to send the third data packet to the second network card of the receiving end device through the first network card and the underlay network based on the GSO function of the first network card.

[0110] In some embodiments, the encapsulation module 42 is specifically used to add the encapsulation header pre-negotiated by the sending device and the receiving device to the second data packet to obtain an encapsulated message; add the TCP header of the TCP protocol supported by the GSO function of the first network card to the encapsulation message to obtain a TCP message; add the Internet Protocol IP header to the TCP message to obtain the third data packet.

[0111] In some embodiments, the encryption module 41 is specifically configured to perform encryption processing on the first data packet once using an encryption algorithm pre-negotiated by the sending end device and the receiving end device to obtain the second data packet.

[0112] Based on the above embodiments, the present application provides a data transmission device. Figure 5 A schematic diagram of the structure of a data transmission device provided in an embodiment of the present application is shown in FIG. Figure 5 As shown, the data transmission device 50 includes a receiving module 51 , a packaging module 52 and an encryption module 53 .

[0113] Among them, the receiving module 51 is used to receive a third data packet from the second network card; wherein the third data packet is received by the second network card from the underlay network using the GRO function of the second network card, and the third data packet is sent to the underlay network by the sending end device using the GSO function of the first network card, and the byte length of the third data packet is greater than the maximum transmission unit MTU of the underlay network.

[0114] The encapsulation module 52 is used to decapsulate the third data packet once according to the encapsulation header format pre-negotiated by the sending end device and the receiving end device and the TCP protocol supported by the GRO function of the second network card to obtain a second data packet.

[0115] The encryption module 53 is used to perform a decryption process on the second data packet to obtain a first data packet; the byte length of the first data packet is greater than the MTU of the underlay network.

[0116] In some embodiments, the encapsulation module 52 is specifically used to remove the IP header of the third data packet to obtain a TCP message; remove the TCP header of the TCP protocol supported by the GSO function of the first network card in the TCP message to obtain an encapsulated message; remove the encapsulation header pre-negotiated by the sending device and the receiving device in the encapsulated message to obtain the second data packet.

[0117] In some embodiments, the encryption module 53 is specifically configured to decrypt the second data packet based on an encryption algorithm pre-negotiated by the sending device and the receiving device.

[0118] The present application embodiment provides a sending end device, Figure 6 Schematic diagram of the hardware entity of the transmitting end device in the embodiment of the present application, such as Figure 6 As shown, the sending end device 60 includes a memory 601 and a processor 602, the memory 601 stores a computer program that can be run on the processor 602, and the processor 602 implements the steps of the data transmission method applied to the sending end device provided in the above embodiment when executing the program.

[0119] It should be noted that the memory 601 is configured to store instructions and applications executable by the processor 602, and can also cache data to be processed or processed by various modules in the processor 602 and the sending end device 60 (for example, image data, audio data, voice communication data, and video communication data), which can be implemented through flash memory (FLASH) or random access memory (Random Access Memory, RAM).

[0120] The embodiment of the present application provides a receiving end device, Figure 7 Schematic diagram of the hardware entity of the receiving end device of the embodiment of the present application, such as Figure 7 As shown, the receiving device 70 includes a memory 701 and a processor 702, the memory 701 stores a computer program that can be run on the processor 702, and the processor 702 implements the steps of the data transmission method applied to the receiving device provided in the above embodiment when executing the program.

[0121] It should be noted that the memory 701 is configured to store instructions and applications executable by the processor 702, and can also cache data to be processed or processed by various modules in the processor 702 and the receiving device 70 (for example, image data, audio data, voice communication data, and video communication data), which can be implemented through FLASH or RAM.

[0122] The present application embodiment provides an electronic device, such as Figure 8 As shown, the electronic device 80 includes Figure 4 The data transmission device 40 and the first network card are shown. The functions of the modules included in the data transmission device 40 are as described in the above embodiment, and will not be repeated here.

[0123] The present application embodiment provides an electronic device. Fig. 9 As shown, the electronic device 90 includes Figure 5 The data transmission module 50 and the second network card are shown. The functions of the modules included in the data transmission device 50 are as described in the above embodiment, and will not be repeated here.

[0124] An embodiment of the present application provides a computer program product including instructions, which, when executed on a computer, enables the computer to execute the steps in the configuration information transmission method provided in the above method embodiment.

[0125] It should be noted here that the description of the above storage medium and device embodiments is similar to the description of the above method embodiments, and has similar beneficial effects as the method embodiments. For technical details not disclosed in the storage medium, storage medium and device embodiments of this application, please refer to the description of the method embodiments of this application for understanding.

Claims

1. A data transmission method, characterized in that: The method is applied to a sending end device, the sending end device is connected to a first network card; the first network card has a general send segmentation offload (GSO) function; The first network card is connected to the receiving end device through the underlying underlay network and the second network card; the method includes: Based on receiving a first data packet from an upper layer overlay network, encrypting the first data packet once to obtain a second data packet; wherein the byte length of the first data packet is greater than the maximum transmission unit MTU of the underlay network; Based on the transmission control protocol TCP protocol supported by the GSO function of the first network card, encapsulate the second data packet once to obtain a third data packet, the byte length of the third data packet is greater than the MTU, and the encapsulation format of the third data packet is TCP encapsulation; Based on the GSO function of the first network card, the third data packet is sent to the second network card of the receiving device through the first network card and the underlay network.

2. The method according to claim 1, characterized in that The TCP protocol supported by the GSO function of the first network card performs an encapsulation process on the second data packet to obtain a third data packet, including: Adding an encapsulation header pre-negotiated by the sending end device and the receiving end device to the second data packet to obtain an encapsulated message; Adding a TCP header of the TCP protocol supported by the GSO function of the first network card to the encapsulated message to obtain a TCP message; An Internet Protocol (IP) header is added to the TCP message to obtain the third data packet.

3. The method according to claim 1, characterized in that The performing encryption processing on the first data packet once includes: The first data packet is encrypted once using an encryption algorithm pre-negotiated by the sending end device and the receiving end device to obtain the second data packet.

4. A data transmission method, characterized in that: The method is applied to a receiving device, the receiving device is connected to a second network card; the second network card supports a general receive segmentation offload (GRO) function; and the second network card is connected to a sending device through a lower layer underlay network and a first network card; the method includes: receiving a third data packet from the second network card; wherein the third data packet is received by the second network card from the underlay network using the GRO function of the second network card, and the third data packet is sent by the sending end device to the underlay network using the general send segmentation offload (GSO) function of the first network card, and the byte length of the third data packet is greater than the maximum transmission unit (MTU) of the underlay network; According to the encapsulation header format agreed upon in advance by the sending end device and the receiving end device and the transmission control protocol TCP protocol supported by the GRO function of the second network card, the third data packet is decapsulated once to obtain a second data packet; The second data packet is decrypted once to obtain a first data packet; the byte length of the first data packet is greater than the MTU of the underlay network.

5. The method according to claim 4, characterized in that According to the encapsulation header format agreed upon in advance by the sending end device and the receiving end device and the TCP protocol supported by the GRO function of the second network card, the third data packet is decapsulated once, including: Remove the Internet Protocol IP header of the third data packet to obtain a TCP message; Remove the TCP header of the TCP protocol supported by the GSO function of the first network card in the TCP message to obtain an encapsulated message; The encapsulation header pre-agreed between the sending end device and the receiving end device in the encapsulation message is removed to obtain the second data packet.

6. The method according to claim 5, characterized in that The decrypting the second data packet includes: The second data packet is decrypted based on an encryption algorithm pre-negotiated by the sending device and the receiving device.

7. A data transmission device, characterized in that: The method comprises a module for executing the method according to any one of claims 1 to 3.

8. A data transmission device, characterized in that: Comprising modules for executing the method according to any one of claims 4 to 6.

9. An electronic device, characterized in that: It comprises the data transmission device as claimed in claim 7 and a first network card.

10. An electronic device, characterized in that: It comprises the data transmission device as claimed in claim 8 and a second network card.

Images