Virtual network communication method of trusted equipment and virtual network system

Abstract

The invention discloses a virtual network communication method of trusted equipment and a virtual network system, and the method comprises the steps: configuring virtual network equipment in a private computing unit side, and capturing a first data packet formed at the private computing unit side through the virtual network equipment, the first data packet is redirected to the host side so as to be sent to the host side, and the first data packet is forwarded to the target network through the host side, so that the communication between the privacy computing unit and the remote service is realized, and when the privacy computing unit is in communication with the remote service, the privacy computing unit can communicate with the remote service through the target network. The application program does not need to care about communication between the privacy computing unit and the far-end service, and the communication process is transparent to the application program, so that the application program development flexibility can be improved. Meanwhile, the private computing unit side and the host side perform efficient data transmission through the PCIe channel, so that multiple copies of the first data packet in the network stack are reduced, and the communication delay is reduced.

Description

Technical Field

[0001] The present application relates to the technical field of computer network communication, and in particular to a virtual network communication method and a virtual network system for a trusted device. Background Art

[0002] TEE (Trusted Execution Environment), also known as Trusted Execution Environment, is a secure area isolated from the host system, running in parallel with the host operating system as an independent environment. TEE technology uses hardware and software to protect data and code, thereby ensuring that the confidentiality and integrity of the code and data loaded in the secure area are protected, and obtaining stronger security guarantees than the traditional REE (Rich Execution Environment, universal execution environment) environment. Trusted applications running in TEE can access the full functionality of the main processor and memory on the platform, while hardware isolation protects these components from being affected by user-installed applications running in the main operating system.

[0003] As a TEE product independent of the host, the Secure Process Unit (SPU) has its own operating system, memory, and CPU computing resources within the environment, but it does not have a physical network card, so data cannot flow out of the SPU. This makes it impossible for services within the SPU to communicate with remote services, which in turn affects the use of the SPU.

[0004] Therefore the prior art still needs to be improved and enhanced. Summary of the invention

[0005] The technical problem to be solved by the present application is to provide a virtual network communication method and a virtual network system for a trusted device in view of the deficiencies in the prior art.

[0006] In order to solve the above technical problems, the first aspect of the present application provides a virtual network communication method for a trusted device, which is applied to an electronic device, wherein the electronic device includes a host side and a privacy computing unit side, and a virtual network device is configured in the privacy computing unit side; the virtual network communication method for the trusted device specifically includes: Capturing a first data packet formed on the privacy computing unit side through the virtual network device; The first data packet is sent to the host side through the virtual network device, and the first data packet is forwarded to the target network through the host side.

[0007] The virtual network communication method of the trusted device, wherein the capturing of the first data packet formed on the trusted execution environment side by the virtual network device specifically comprises: The application injects the first data packet into the kernel network stack on the privacy computing unit side; The virtual network device captures the first data packet by interacting with the kernel network stack on the privacy computing unit side.

[0008] The virtual network communication method of the trusted device, wherein the method further comprises: Receive a second data packet from the host side through the virtual network device, and transmit the second data packet to the kernel network stack on the privacy computing unit side.

[0009] The virtual network communication method of the trusted device, wherein the method further comprises: The host side performs security processing on the first data packet and / or the second data packet, and sends the first data packet and / or the second data packet after security processing.

[0010] The virtual network communication method of the trusted device, wherein the security processing includes securely processing the first data packet and / or the second data packet through the host side kernel and / or transmitting the first data packet and / or the second data packet to the user space so as to securely process the first data packet and / or the second data packet through the application.

[0011] The virtual network communication method for a trusted device, wherein a first PCIe control module is deployed on the privacy computing unit side, and a second PCIe control module is deployed on the host side, and both the first PCIe control module and the second PCIe control module communicate with the PCIe channel to form a communication link between the host side and the privacy computing unit side; the communication link is used to transmit a first data packet from the privacy computing unit side to the host side, and a second data packet from the host side to the privacy computing unit side.

[0012] The second aspect of the present application provides a virtual network system for a trusted device, which includes a host side and a privacy computing unit side, and a virtual network device is configured in the privacy computing unit side; the virtual network device is used to capture a first data packet formed by the privacy computing unit side, and send the first data packet to the host side, and forward the first data packet to the target network through the host side.

[0013] The virtual network system of the trusted device, wherein a first PCIe control module is deployed on the privacy computing unit side, and a second PCIe control module is deployed on the host side, and the first PCIe control module and the second PCIe control module both communicate with the PCIe channel to form a communication link between the host side and the privacy computing unit side; the communication link is used to transmit a first data packet from the privacy computing unit side to the host side, and a second data packet from the host side to the privacy computing unit side.

[0014] The virtual network system of the trusted device, wherein a virtual device management module is deployed on the privacy computing unit side; the virtual device management module is used to redirect the first data packet formed by the interaction between the application and the kernel network stack on the privacy computing unit side to the virtual network device.

[0015] The virtual network system of the trusted device, wherein the host side is provided with a host side security module and / or a user security module, the host side security module is used to securely process the second data packet from the remote service, and the user security module is used to transmit the second data packet from the remote service to the user space so as to securely process the second data packet through the application.

[0016] Beneficial effects: 1. This application implements communication between SPU and external network through virtual devices. The communication process is transparent to the application, thereby improving the flexibility of application development.

[0017] 2. Efficient data transmission between the SPU and the host is achieved through the PCIe channel, which reduces the multiple copies of the first data packet in the network stack and reduces communication latency.

[0018] 3. The host side will perform real-time security processing on the second data packet to ensure the legitimacy of the second data packet and the security of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A block diagram of the principles of a virtual network system for a trusted device provided in an embodiment of the present application.

[0021] Figure 2 A flowchart of a virtual network communication method for a trusted device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0022] The embodiments of the present application provide a virtual network communication method and a virtual network system for a trusted device. To make the purpose, technical solution and effect of the present application clearer and more specific, the present application is further described in detail with reference to the accompanying drawings and examples. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0023] It will be understood by those skilled in the art that, unless expressly stated, the singular forms "one", "said", and "the" used herein may also include plural forms. It should be further understood that the term "comprising" used in the specification of the present application refers to the presence of the features, integers, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components and / or groups thereof. It should be understood that when we refer to an element as being "connected" or "coupled" to another element, it may be directly connected or coupled to the other element, or there may be an intermediate element. In addition, the "connection" or "coupling" used herein may include wireless connection or wireless coupling. The term "and / or" used herein includes all or any unit and all combinations of one or more associated listed items.

[0024] It will be understood by those skilled in the art that, unless otherwise defined, all terms (including technical and scientific terms) used herein have the same meaning as those generally understood by those skilled in the art to which this application belongs. It should also be understood that terms such as those defined in general dictionaries should be understood to have meanings consistent with those in the context of the prior art, and will not be interpreted with idealized or overly formal meanings unless specifically defined as here.

[0025] It should be understood that the sequence numbers and sizes of the steps in this embodiment do not mean the order of execution. The execution order of each process is determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present application.

[0026] After research, it was found that TEE (Trusted Execution Environment), also known as Trusted Execution Environment, is a secure area isolated from the host system, running in parallel with the host operating system as an independent environment. TEE technology uses hardware and software to protect data and code, thereby ensuring that the confidentiality and integrity of the code and data loaded in the secure area are protected, and obtaining stronger security guarantees than the traditional REE (Rich Execution Environment, universal execution environment) environment. Trusted applications running in TEE can access the full functionality of the main processor and memory on the platform, while hardware isolation protects these components from being affected by user-installed applications running in the main operating system.

[0027] As a TEE product independent of the host, the Secure Process Unit (SPU) has its own operating system, memory, and CPU computing resources within the environment, but it does not have a physical network card, so data cannot flow out of the SPU. This makes it impossible for services within the SPU to communicate with remote services, which in turn affects the use of the SPU.

[0028] Currently, forwarding is performed through a gateway service, such as Nginx. However, existing gateway services generally only intercept and forward the first IP data packet, and do not process the content of the first data packet (such as encryption, etc.). In addition, when forwarding the first data packet through a gateway service, the application needs to participate, and it is impossible to achieve non-perceptual communication between the two parties, which will affect the flexibility of application development. At the same time, when forwarding the first data packet through a gateway service, the first data packet needs to be copied multiple times in the network stack, which will cause a delay in the transmission of the first data packet.

[0029] In order to solve the above problems, in an embodiment of the present application, a virtual network device is configured in the privacy computing unit side, and the first data packet formed by the privacy computing unit side is captured by the virtual network device, and the first data packet is redirected to the host side to send the first data packet to the host side, and the first data packet is forwarded to the target network by the host side, so that not only the communication between the privacy computing unit and the remote service is realized, but also when the privacy computing unit communicates with the remote service, the application does not need to care about the communication between the privacy computing unit and the remote service, and the communication process is transparent to the application, thereby improving the flexibility of application development. At the same time, the privacy computing unit side and the host side perform data efficient transmission through the PCIe channel, reducing multiple copies of the first data packet in the network stack and reducing communication delays.

[0030] The application content is further explained below through the description of embodiments in conjunction with the accompanying drawings.

[0031] This embodiment provides a virtual network system of a trusted device, such as Figure 1 As shown, the virtual network system of the trusted device includes a host, and the host includes one or more SPUs. Each SPU can be an application / server, that is, an SPU application / SPU server. For the sake of convenience, the SPU is recorded as the privacy computing unit side, and the host environment of the host where the SPU is deployed is recorded as the host side. The SPU cannot communicate directly with the remote service. If the SPU needs to communicate with the remote service, it needs to send a first data packet to the host side, and the host side sends the first data packet to the remote service. Similarly, if the remote service accesses the SPU in the host side, it is also necessary to first receive the second data packet sent by the remote service through the host side, and then the host side confirms the SPU side corresponding to the second data packet, and sends the second data packet to the SPU side. Of course, when the remote service needs to send the first data packet to the SPU in the host side, it is also necessary to first receive the first data packet sent by the remote service through the host side, and then the host side confirms the SPU side corresponding to the first data packet, and sends the first data packet to the SPU side. Here, the SPU side sends the first data packet to the remote service, and the remote service sends the second data packet to the SPU side as an example for subsequent explanation.

[0032] As a trusted device independent of the host, the SPU has an operating system, memory, and CPU computing resources inside the SPU, but there is no physical network card inside the SPU, so the first data packet in the SPU cannot flow from the SPU side to the host side. To this end, in an embodiment of the present application, a virtual network device (such as a TUN device ( / dev / net / tun), etc.) is configured on the SPU side. The virtual network device is used as a bridge between the kernel network stack on the privacy computing unit side and the PCIe interface, thereby realizing communication between the SPU side and the host side. In other words, the virtual network device is used to capture the first data packet on the privacy computing unit side, send the first data packet to the host side, and forward the first data packet to the target network through the host side. At the same time, the virtual network device is also used to receive the second data packet from the host side and transmit the second data packet to the kernel network stack on the privacy computing unit side. In the embodiment of the present application, by deploying a virtual network device on the SPU side, on the one hand, the virtual network device interacts with the kernel network stack on the privacy computing unit side, thereby realizing efficient data interaction between the user state and the kernel state; on the other hand, the virtual network device is used to realize communication between the SPU side and the host side, thereby realizing efficient transmission inside the host.

[0033] Furthermore, the virtual network device communicates with the kernel network stack, and transmits the first data packet to the virtual network device through the kernel network stack, wherein the first data packet may be generated by an application within the SPU, that is, the application initiates communication with the remote service and determines the first data packet that needs to be interacted with, and then interacts with the kernel network stack through the Socket API to send the first data packet to the kernel network stack. After receiving the first data packet, the kernel network stack forwards the first data packet to the virtual network device.

[0034] After receiving the first data packet, the virtual network device sends the first data packet to the host side. In order to avoid communication delay caused by multiple copies of the first data packet in the network stack, a high-speed communication channel is established between the virtual network device and the host side through the PCIe channel in the embodiment of the present application, and efficient communication between the virtual network device and the host side is achieved through the PCIe channel. Specifically, Figure 2 As shown, a first PCIe control module (denoted as SpuPcs) is deployed on the SPU side, and a second PCIe control module (denoted as HostPcs) is deployed on the host side. The first PCIe control module and the second PCIe control module establish communication through the PCIe channel to form a communication link between the host side and the privacy computing unit side; the communication link is used to transmit a first data packet from the privacy computing unit side to the host side, and a second data packet from the host side to the privacy computing unit side. In other words, the first PCIe control module on the SPU side and the second PCIe control module on the host side work together and forward the data in the SPU to the host side through the PCIe channel between the two.

[0035] Furthermore, in order to manage the virtual network device, a virtual network device management module (denoted as SpuTun) can also be deployed on the SPU side, and the virtual network device management module is used to redirect the first data packet formed by the interaction between the application and the kernel network stack on the privacy computing unit side to the virtual network device. In other words, the virtual network device is managed by the virtual network device management module to control the virtual network device to redirect the first data packet from the application and the second data packet from the host side, thereby realizing the network interaction between the kernel state and the user state.

[0036] In one implementation, a host-side management module (referred to as HostTun) may also be provided on the host side, for managing the first data packet sent to the host side through the virtual network device, so as to inject the first data packet into the kernel network stack on the host side, so that the first data packet can be sent to the target network through the physical network interface on the host side. In addition, the host side may deploy a host-side security module (referred to as Netfilter) and / or a user security module (referred to as NFQUEUE), and the host-side security module is used to perform security processing on the second data packet from the remote service and / or the first data packet from the SPU side. The user security module is used to transmit the second data packet and / or the first data packet from the remote service to the user space, so as to perform security processing on the second data packet and / or the first data packet through the application. This ensures that all incoming and outgoing second data packets and / or first data packets comply with the system's security policy and prevent unauthorized access.

[0037] Based on the virtual network system of the above-mentioned trusted device, the embodiment of the present application provides a virtual network communication method of a trusted device, such as Figure 2 As shown, the virtual network communication method of the trusted device specifically includes: S10, capturing a first data packet formed on the privacy computing unit side through the virtual network device; S20. Send the first data packet to the host side through the virtual network device, and forward the first data packet to the target network through the host side.

[0038] Specifically, the first data packet is what the application on the privacy computing unit side needs to interact with the target network (i.e., the remote service). That is to say, the application can interact with the remote service through a virtual network device to transmit the first data packet to the remote service, or receive the second data packet sent by the remote service.

[0039] Further, after the application initiates the first data packet, the application injects the first data packet into the kernel network stack interaction on the SPU side, and then the virtual network device captures the first data packet of the kernel network stack on the SPU side. Based on this, in one implementation, the capturing of the first data packet formed on the trusted execution environment side by the virtual network device specifically includes: S11, the application injects the first data packet into the kernel network stack on the privacy computing unit side; S12. The virtual network device captures the first data packet by interacting with the kernel network stack on the privacy computing unit side.

[0040] Specifically, after receiving the first data packet, if the first data packet needs to be sent to a remote service, the kernel network stack on the privacy computing unit side will redirect the first data packet to the virtual network device so that the virtual network device can capture the first data packet. In other words, the kernel network stack on the privacy computing unit side receives the first data packet of the application interaction and detects the interaction object of the first data packet. When the interaction object is a remote service, the first data packet is redirected and then interacted with the virtual network device, so as to achieve the goal of using the virtual network device to capture the first data packet that needs to be interacted with the remote service in the kernel network stack on the privacy computing unit side. The application only needs to interact the first data packet with the kernel network stack on the privacy computing unit side, and does not need to care about the process of the virtual network device obtaining the first data packet and the process of the virtual network device interacting with the host side.

[0041] After obtaining the first data packet, the virtual network device will forward the first data packet to the host side, wherein a PCIe channel is established between the virtual network device and the host side, and the virtual network device sends the first data packet to the host side through the PCIe channel, which can reduce the multiple copies of the first data packet in the network stack and reduce the communication delay. Specifically, the virtual network device can be deployed with a first PCIe control module, and the host side can be deployed with a second PCIe control module. A PCIe channel is established between the first PCIe control module and the second PCIe control module, and the virtual network device sends the first data packet to the first PCIe control module, and the first PCIe control module sends the first data packet to the second PCIe control module through the PCIe channel. The second PCIe module injects the first data packet into the kernel network stack of the host side to transmit the first data packet to the host side. The embodiment of the present application realizes the establishment of a high-speed communication link between the virtual network device and the grid service on the host side through the PCIe channel to ensure the low-latency transmission of the first data packet. At the same time, the responsibilities of the grid service on the host side are very clear. It is only responsible for redirecting and routing the first data packet, and does not involve data processing, encryption or decryption at the application layer, so that the gateway service remains lightweight and can process high-throughput first data packets without making any modifications to the data content. Among them, the gateway service can be a physical gateway on the host side, which is responsible for sending data packets to the external network or receiving data packets from the external network. The physical network card performs the actual transmission of data through a standard network stack. Before reaching the physical network card, the data packet is processed by a raw socket, which is used to directly operate the incoming / outgoing data packets to achieve specific customized functions.

[0042] Of course, the first data packet in the SPU can be transmitted to the host side through the virtual network device, and the second data packet from the remote service on the host side can also be transmitted to the application through the virtual network device. To this end, the method also includes: Receive a second data packet from the host side through the virtual network device, and transmit the second data packet to the kernel network stack on the privacy computing unit side.

[0043] Specifically, the virtual network device receives the second data packet through the PCIe channel between the virtual network device and the host side, where the second data packet can be a data packet from a remote service. That is to say, after receiving the second data packet that needs to be sent to the privacy computing unit side, the host side will redirect the second data packet, and then transmit the second data packet to the virtual network device through the PCIe channel between the virtual network device and the host side. After receiving the second data packet, the virtual network device injects the second data packet into the kernel network stack on the privacy computing unit side, and then interacts with the application through the kernel network stack on the privacy computing unit side, thereby realizing data interaction between the privacy computing unit side and the host side.

[0044] Further, upon receiving the first data packet and / or the second data packet, the kernel network stack on the host side may directly send the first data packet and / or the second data packet, or may first perform security management on the first data packet and / or the second data packet, and then send the first data packet and / or the second data packet after security management. In an embodiment of the present application, the kernel network stack on the host side first performs security management on the first data packet and / or the second data packet, and then sends the first data packet and / or the second data packet after security management. That is, the method further includes: The host side performs security processing on the first data packet and / or the second data packet, and sends the first data packet and / or the second data packet after security processing.

[0045] Specifically, the security processing includes performing security processing on the first data packet and / or the second data packet through the host-side kernel and / or transmitting the first data packet and / or the second data packet to the user space so as to perform security processing on the first data packet and / or the second data packet through the application. In a typical implementation, the security processing includes performing security processing on the first data packet and / or the second data packet through the host-side kernel and transmitting the first data packet and / or the second data packet to the user space so as to perform security processing on the first data packet and / or the second data packet through the application, wherein the security processing on the first data packet and / or the second data packet through the host-side kernel may be filtering and managing the first data packet and / or the second data packet through the Netfilter framework; transmitting the first data packet and / or the second data packet to the user space so as to perform security processing on the first data packet and / or the second data packet through the application may be transmitting the first data packet and / or the second data packet to the user space for the application to perform in-depth processing, such as security checking, load balancing, etc.

[0046] The embodiment of the present application integrates the Netfilter framework in the host side, and the Netfilter framework filters and monitors the data packets entering and / or leaving the SPU according to predefined rules to prevent unauthorized access and potential security threats, ensuring that only the authorized first data packet and / or second data packet can enter the system, further ensuring the isolation and security of the SPU environment. In addition, the second data packet after passing through the Netfilter framework will also pass the first data packet and / or the second data packet to the user space through NFQUEUE, thereby further improving the security of the first data packet and / or the second data packet.

[0047] In addition, the transmission process of the first data packet from the virtual network device to the host side and the transmission process of the second data packet from the host side to the first data packet from the remote service to the virtual network device are both transparent to the application program inside the SPU. The application program believes that it directly communicates with the remote service without having to worry about how the first data packet and the second data packet flow between the SPU and the host side, thereby improving the flexibility of application program development.

[0048] In summary, this embodiment provides a virtual network communication method and a virtual network system for a trusted device, the method includes configuring a virtual network device in the privacy computing unit side, capturing the first data packet formed by the privacy computing unit side through the virtual network device, redirecting the first data packet to the host side to send the first data packet to the host side, and forwarding the first data packet to the target network through the host side, so that not only the communication between the privacy computing unit and the remote service is realized, but also when the privacy computing unit communicates with the remote service, the application does not need to care about the communication between the privacy computing unit and the remote service, and the communication process is transparent to the application, thereby improving the flexibility of application development. At the same time, the privacy computing unit side and the host side perform efficient data transmission through the PCIe channel, reducing multiple copies of the first data packet in the network stack and reducing communication delays.

[0049] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A virtual network communication method for a trusted device, characterized in that: Applied to an electronic device, the electronic device includes a host side and a privacy computing unit side, the privacy computing unit side is configured with a virtual network device; the virtual network communication method of the trusted device specifically includes: Capturing a first data packet formed on the privacy computing unit side through the virtual network device; The first data packet is sent to the host side through the virtual network device, and the first data packet is forwarded to the target network through the host side.

2. The virtual network communication method of a trusted device according to claim 1, characterized in that: The step of capturing the first data packet formed on the trusted execution environment side by the virtual network device specifically includes: The application injects the first data packet into the kernel network stack on the privacy computing unit side; The virtual network device captures the first data packet by interacting with the kernel network stack on the privacy computing unit side.

3. The virtual network communication method of a trusted device according to claim 1, characterized in that: The method further comprises: Receive a second data packet from the host side through the virtual network device, and transmit the second data packet to the kernel network stack on the privacy computing unit side.

4. The virtual network communication method of a trusted device according to claim 3, characterized in that: The method further comprises: The host side performs security processing on the first data packet and / or the second data packet, and sends the first data packet and / or the second data packet after security processing.

5. The virtual network communication method of a trusted device according to claim 4, characterized in that: The security processing includes performing security processing on the first data packet and / or the second data packet through a host-side kernel and / or transmitting the first data packet and / or the second data packet to a user space so as to perform security processing on the first data packet and / or the second data packet through an application.

6. The virtual network communication method of a trusted device according to claim 1 or 3, characterized in that: A first PCIe control module is deployed on the privacy computing unit side, and a second PCIe control module is deployed on the host side. Both the first PCIe control module and the second PCIe control module communicate with the PCIe channel to form a communication link between the host side and the privacy computing unit side; the communication link is used to transmit a first data packet from the privacy computing unit side to the host side, and a second data packet from the host side to the privacy computing unit side.

7. A virtual network system of a trusted device, characterized in that: The virtual network system of the trusted device includes a host side and a privacy computing unit side, and a virtual network device is configured in the privacy computing unit side; the virtual network device is used to capture the first data packet formed by the privacy computing unit side, send the first data packet to the host side, and forward the first data packet to the target network through the host side.

8. The virtual network system of the trusted device according to claim 7, characterized in that: A first PCIe control module is deployed on the privacy computing unit side, and a second PCIe control module is deployed on the host side. Both the first PCIe control module and the second PCIe control module communicate with the PCIe channel to form a communication link between the host side and the privacy computing unit side; the communication link is used to transmit a first data packet from the privacy computing unit side to the host side, and a second data packet from the host side to the privacy computing unit side.

9. The virtual network system of a trusted device according to claim 7, characterized in that: A virtual device management module is deployed on the privacy computing unit side; The virtual device management module is used to redirect the first data packet formed by the interaction between the application and the kernel network stack on the privacy computing unit side to the virtual network device.

10. The virtual network system of a trusted device according to claim 7, characterized in that: The host side is provided with a host side security module and / or a user security module. The host side security module is used to securely process the second data packet from the remote service, and the user security module is used to transmit the second data packet from the remote service to the user space so as to securely process the second data packet through the application.

Images