Information transmission method and device, electronic equipment, storage medium and program product

Abstract

The invention discloses an information transmission method and device, electronic equipment, a storage medium and a program product, and relates to the technical field of communication, and the method comprises the steps: packaging a to-be-transmitted message into a multi-layer nested message according to a nested namespace configured by an Internet protocol security virtual private network when the to-be-transmitted message is obtained; and transmitting the multi-layer nested message based on the Internet protocol secure virtual private network. According to the embodiment of the invention, the to-be-processed message is packaged into the multi-layer nested message, multi-layer protection is constructed for the to-be-processed message, the security of information transmission is improved, the to-be-processed message can be flexibly packaged into the multi-layer nested message with different characteristics according to different security requirements, the flexibility of information transmission is enhanced, and the security of information transmission is improved. Through strategy routing control, multi-layer internet protocol security virtual private network access and a flexible networking scheme can be realized, so that full utilization of network resources is realized.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to an information transmission method, device, electronic equipment, storage medium and program product. Background Art

[0002] The development of the Internet has promoted the expansion of network scale and the popularization of applications, but information transmission still relies on untrusted public networks, which makes information security a key issue. Internet Protocol Security (IPSec) can ensure the availability, confidentiality and integrity of information during transmission. However, traditional IPSec still faces challenges in application. First, the nesting technology of IPSec with Layer 2 Tunneling Protocol and General Routing Encapsulation is limited to fixed combinations and cannot dynamically adapt to changes in the network. Second, in high-security demand scenarios, traditional IPSec cannot meet high security and customization requirements, affecting business efficiency and user experience. In addition, traditional IPSec cannot effectively manage and control IPSec traffic and cannot fully utilize network resources. Therefore, enhancing the security and flexibility of information transmission, realizing the scheduling management of network traffic and fully utilizing network resources have become urgent issues to be solved in the field of communication technology. Summary of the invention

[0003] The present invention provides an information transmission method, device, electronic device, storage medium and program product, which enhance the security and flexibility of information transmission, realize the scheduling management of network traffic and the full utilization of network resources.

[0004] According to one aspect of an embodiment of the present invention, there is provided an information transmission method, including:

[0005] When a message to be transmitted is obtained, the message to be processed is encapsulated into a multi-layer nested message according to a nested namespace configured in an Internet Protocol security virtual private network;

[0006] Transmit multi-layer nested messages based on Internet Protocol security virtual private network.

[0007] Another aspect of an embodiment of the present invention provides an information transmission device, including:

[0008] A message encapsulation module is used to encapsulate the message to be processed into a multi-layer nested message according to the nested namespace configured by the Internet Protocol Security Virtual Private Network when the message to be transmitted is obtained;

[0009] The message transmission module is used to transmit multi-layer nested messages based on the Internet Protocol Security Virtual Private Network.

[0010] Another aspect of an embodiment of the present invention provides an electronic device, including:

[0011] at least one processor;

[0012] and a memory communicatively coupled to the at least one processor;

[0013] The memory stores a computer program that can be executed by at least one processor, and the computer program is executed by at least one processor so that the at least one processor can execute any one of the information transmission methods in the embodiments of the present invention.

[0014] According to another aspect of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the information transmission method of any embodiment of the present invention when executed.

[0015] According to another aspect of the present invention, a computer program product is provided. The computer program product includes a computer program. When the computer program is executed by a processor, the information transmission method of any embodiment of the present invention is implemented.

[0016] In the embodiment of the present invention, when the sending node obtains the processing message, a nested namespace with a hierarchical structure can be created based on the relevant protocols of the Internet Protocol Security Virtual Private Network. In the nested namespace, each namespace can perform multi-level encapsulation on the obtained message to be processed according to the allocated exclusive resources to obtain a multi-layer nested message, and can rely on the corresponding transmission protocol to transmit the multi-layer nested message in the Internet Protocol Security Virtual Private Network. In the embodiment of the present invention, by using the nested namespace to encapsulate the message to be processed into a multi-layer nested message, a multi-layer protection is constructed for the message to be processed, the security of information transmission is improved, and the message to be processed can be flexibly encapsulated into a multi-layer nested message with different characteristics according to different security requirements, thereby enhancing the flexibility of information transmission. Through policy routing control, multi-layer Internet Protocol Security Virtual Private Network access and flexible networking solutions can be realized, thereby achieving full utilization of network resources. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0018] Figure 1 is a flow chart of an information transmission method provided according to Embodiment 1 of the present invention;

[0019] Figure 2 is a flow chart of another information transmission method provided according to Embodiment 2 of the present invention;

[0020] Figure 3 This is a schematic diagram of an Internet Protocol security transmission mode message provided by Embodiment 3 of the present invention;

[0021] Figure 4 This is a schematic diagram of an Internet Protocol security tunnel mode message provided by Embodiment 3 of the present invention;

[0022] Figure 5 It is a two-layer nested network topology diagram of an Internet Protocol security virtual private network provided by Embodiment 3 of the present invention;

[0023] Figure 6 This is a schematic diagram of a two-layer nested client architecture of an Internet Protocol security virtual private network provided by Embodiment 3 of the present invention;

[0024] Figure 7 This is a schematic diagram of an Internet Protocol security virtual private network multi-layer nested client architecture provided by Embodiment 3 of the present invention;

[0025] Figure 8 It is a schematic diagram of the structure of a device for implementing an information transmission method provided by an embodiment of the present invention;

[0026] Fig. 9 It is a structural schematic diagram of an electronic device for implementing the information transmission method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0027] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0028] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0029] Embodiment 1

[0030] Figure 1 A flow chart of an information transmission method is provided for an embodiment of the present invention. This embodiment can be applied to enhance the security and flexibility of information transmission, realize the scheduling management of network traffic and make full use of network resources. The method can be executed by an information transmission device, which can be implemented in the form of hardware and / or software, and can be configured in an electronic device. Figure 1 As shown, the method includes:

[0031] S101. When a message to be processed is obtained, the message to be processed is encapsulated into a multi-layer nested message according to a nested namespace configured in an Internet Protocol security virtual private network.

[0032] In the embodiment of the present invention, the message to be processed may be understood as a candidate transmission data packet. For example, the type of the data packet may include: text, image, or audio.

[0033] Internet Protocol Security Virtual Private Network can be understood as a network security technology. For example, Internet Protocol Security Virtual Private Network can create a secure and encrypted communication line on the public network by utilizing the Internet Protocol security protocol, and the messages to be processed can be transmitted through the communication line.

[0034] A nested namespace refers to a namespace formed by nesting at least two namespaces. There is an association relationship between the namespaces. For example, the association relationship may include: connecting to each other through destination addresses or connecting to each other through source addresses, etc., wherein the namespace can be understood as a logical container for different Internet Protocol Security (IPSec) connection configurations, which can classify or isolate IPSec-related information, and each namespace can be assigned a set of exclusive resources. For example, exclusive resources may include: the source address of the IPSec connection, the destination address of the IPSec connection, encryption keys, authentication keys or IPSec security policies, etc.

[0035] A multi-layer nested message refers to a data packet that encapsulates one or more sub-messages within a message. It can be understood that the innermost message in the multi-layer nested message is the most original data packet. The most original data packet is encapsulated in multiple layers to form a multi-layer nested message. The multi-layer nested message is used to implement different levels of encryption and authentication to increase the security of data packet transmission.

[0036] Specifically, when the sending node obtains a message for processing, it can create a hierarchical nested namespace based on the relevant protocols of the Internet Protocol Security Virtual Private Network. In the nested namespace, each namespace can perform multi-level encapsulation on the obtained message to be processed according to the allocated exclusive resources to obtain a multi-layer nested message.

[0037] S102. Transmit multi-layer nested messages based on Internet Protocol security virtual private network.

[0038] Specifically, the encapsulated multi-layer nested message can be obtained by relying on the corresponding transmission protocol to transmit the multi-layer nested message in the Internet Protocol Security Virtual Private Network. For example, the corresponding transmission protocol may include: IPSec protocol or IPSec tunnel protocol, etc.

[0039] In the embodiment of the present invention, when the sending node obtains the processing message, a nested namespace with a hierarchical structure can be created based on the relevant protocols of the Internet Protocol Security Virtual Private Network. In the nested namespace, each namespace can perform multi-level encapsulation on the obtained message to be processed according to the allocated exclusive resources to obtain a multi-layer nested message, and can rely on the corresponding transmission protocol to transmit the multi-layer nested message in the Internet Protocol Security Virtual Private Network. In the embodiment of the present invention, by using the nested namespace to encapsulate the message to be processed into a multi-layer nested message, a multi-layer protection is constructed for the message to be processed, the security of information transmission is improved, and the message to be processed can be flexibly encapsulated into a multi-layer nested message with different characteristics according to different security requirements, thereby enhancing the flexibility of information transmission. The structure of the multi-layer nested message allows the addition of diversified information tags to realize the scheduling and management of network traffic. The Internet Protocol Security Virtual Private Network can dynamically allocate network resources according to the priority of traffic, thereby realizing the full utilization of network resources.

[0040] Based on the above embodiments, the embodiments of the present invention also include: determining the target nesting number of Internet Protocol security virtual private network; calling Internet Protocol security virtual professional network software to create a nested namespace corresponding to the target nesting number of layers.

[0041] In the embodiment of the present invention, the target nesting level may be understood as the number of message encapsulation levels set when encapsulating a message, and may be used to determine the number of namespaces.

[0042] Internet Protocol Security Virtual Professional Network software can be understood as a tool for creating nested namespaces. For example, Internet Protocol Security Virtual Professional Network software includes but is not limited to: Strongswan software or Libreswan software.

[0043] Specifically, obtain Internet Protocol security virtual professional network software for creating a nested namespace, determine the target nesting number of the message to be processed, and call the Internet Protocol security virtual professional network software to create a nested namespace corresponding to the target nesting number of the message to be processed based on the determined target nesting number of the message to be processed. By way of example, the method of determining the target nesting number of the message to be processed may include: determining it based on the security level requirement for the transmission of the message to be processed or determining it based on the target nesting number of the user pre-set.

[0044] Based on the above embodiments, the embodiments of the present invention call Internet Protocol security virtual professional network software to create a nested namespace corresponding to the target number of nested layers, including: calling Internet Protocol security virtual professional network software to create a namespace with the target number of nested layers minus one; selecting a first namespace in each namespace, and using the remaining namespaces as candidate namespaces; determining a second namespace in the candidate namespace, and moving the second namespace out of the candidate namespace, and setting the destination address of the first namespace to the second namespace; using the second namespace as a new first namespace, and returning to execute determining the second namespace in the candidate namespace; when it is determined that there is no candidate namespace, using each first namespace as a nested namespace.

[0045] In the embodiment of the present invention, the first namespace can be understood as the namespace initially selected among all the created namespaces. It can be understood that in subsequent operations, the first namespace will be continuously updated and is the starting namespace for encapsulating the message to be processed.

[0046] A candidate namespace can be understood as a namespace waiting to be added to a nested namespace. During the construction of a nested namespace, the candidate namespace can be continuously nested. The nesting process can be implemented by associating the candidate namespace with the nested namespace. For example, the source address or destination address of the innermost or outermost namespace in the nested namespace can be set as the current candidate namespace.

[0047] Specifically, call the Internet Protocol Security Virtual Professional Network software to create a namespace corresponding to the target nesting level, wherein the target nesting level can be pre-configured or determined according to security requirements, and the number of namespaces to be created is equal to the number of target nesting levels minus one. Among all the created namespaces, randomly select a namespace as the starting namespace for encapsulating the message to be processed, and use the starting namespace as the first namespace. Among all the created namespaces, except the first namespace, use the remaining namespaces as candidate namespaces waiting to be added to the nested namespace, randomly select a namespace from the candidate namespaces as the second namespace for encapsulating the message to be processed, and use the second namespace as the starting namespace. The first namespace is removed from the candidate namespace, and the destination address of the first namespace is set to the address of the second namespace. This step ensures that the message to be processed can be correctly forwarded from the first namespace to the second namespace. When the message to be processed is transmitted to the second namespace, the second namespace is promoted to a new first namespace. The above step of determining a new second namespace is repeated in the candidate namespace to determine a new second namespace. The new second namespace is removed from the candidate namespace, and the destination address of the new first namespace is set to the new second namespace. The above steps will continue until the candidate namespace is empty. At this time, all first namespaces associated by the destination address are used as nested namespaces.

[0048] On the basis of the above-mentioned embodiment, the embodiment of the present invention further includes: when receiving a multi-layer nested message, restoring the multi-layer nested message to an original message based on an Internet Protocol security virtual private network.

[0049] In the embodiment of the present invention, the original message can be understood as a data packet that is not encapsulated by the Internet Protocol Security Protocol. It can be understood that the original message can specifically be a message that forms multiple layers of nested messages.

[0050] Specifically, when receiving a multi-layer nested message sent from another node, the sending node can use the Internet Protocol Security Virtual Private Network to decapsulate the multi-layer nested message and restore the multi-layer nested message to an unencapsulated original message. It can be understood that the functions of the sending node at least include: receiving a message to be processed, encapsulating a message to be processed, transmitting a multi-layer nested message, and receiving a multi-layer nested message.

[0051] On the basis of the above-mentioned embodiments, an embodiment of the present invention restores a multi-layer nested message to an original message based on an Internet Protocol security virtual private network, including: taking the multi-layer nested message as the current message, and transmitting the current message to a namespace service node of a destination address in the current message; stripping off a message header of the multi-layer nested message at the namespace service node to obtain an internal nested message; taking the internal nested message as a new current message, and returning to execute stripping off the message header of the multi-layer nested message at the namespace service node; when the current message does not have a message header of an Internet Protocol security virtual private network, taking the current message as the original message.

[0052] In an embodiment of the present invention, the current message can be understood as a data packet being processed in the current processing flow. It can be understood that as the processing flow progresses, after each layer of message header is peeled off, the internally nested message will become the new current message.

[0053] A namespace service node may be understood as an entity for processing namespace-related requests. For example, namespace-related requests may include: a request to strip a message header or a request to send a message, wherein the message header may include: source address, destination address or message type and other information.

[0054] An internal nested message refers to an internal message obtained after stripping off an outer message header. It can be understood that in the process of processing multi-layer nested messages, as the outer message header is stripped off layer by layer, multiple internal nested messages will be obtained in sequence until the final internal nested message is the original message.

[0055] Specifically, when the receiving party performs an operation of restoring a multi-layer nested message, the multi-layer nested message is determined to be a message currently being received and processed, and the message currently being received and processed is used as the current message. According to the destination address contained in the current message, the current message is transmitted to the namespace service node pointed to by the destination address. On the namespace service node, an operation of stripping the Internet Protocol Security Virtual Private Network message header of the multi-layer nested message is performed to extract the internal nested message that does not contain the Internet Protocol Security Virtual Private Network message header. After obtaining the internal nested message, the next round of Internet Protocol Security Virtual Private Network message header stripping operation is performed, and the above-mentioned internal nested message is updated to a new current message. The above-mentioned stripping operation is repeated until the Internet Protocol Security Virtual Private Network message header does not exist in the new current message. When it is determined that the current message does not contain the Internet Protocol Security Virtual Private Network message header, the stripping operation is stopped, and the latest current message is identified as the original message.

[0056] Embodiment 2

[0057] Figure 2This is a flow chart of another information transmission method provided by an embodiment of the present invention. Based on the above embodiment, the embodiment of the present invention provides another information transmission method. Figure 2 As shown, the method includes:

[0058] S201. When a message to be processed is received, an outer namespace of a nested namespace is obtained as a current namespace, and the message to be processed is used as a target processing message.

[0059] In the embodiment of the present invention, the outer namespace refers to a namespace at a higher level or a more peripheral position in the hierarchical structure of nested namespaces.

[0060] The current namespace refers to the namespace currently being used during message processing. For example, in a hierarchical structure of nested namespaces, when an outer namespace at a higher level or a more peripheral position is used, the outer namespace is used as the current namespace.

[0061] The target processing message can be understood as a message that needs to be encapsulated and transmitted, and the acquired message to be processed can be used as the target processing message that needs to be encapsulated and transmitted.

[0062] Specifically, the Internet Protocol Security Virtual Private Network software can be called to create a nested namespace. When a message to be processed is received, the outer namespace at a higher level or more peripheral position within the created nested namespace can be used as the current namespace, and the received message to be processed that needs to be encapsulated and transmitted can be used as the target processing message. The target processing message can be encapsulated and transmitted in the current namespace.

[0063] S202: extract the connection information parameters of the current namespace, and encapsulate the target processing message according to the connection information parameters to obtain a preliminary nested message.

[0064] In the embodiment of the present invention, the connection information parameter may be understood as a series of parameters used to ensure that the message can be correctly transmitted in the network. For example, the connection information parameter may include: a port number or a protocol type.

[0065] The preliminary nested message refers to the message formed after the target processing message is preliminarily encapsulated according to the connection information parameters. It can be understood that when the number of nested namespaces is 2, the target processing message only needs to be nested once to obtain the preliminary nested message; when the number of nested namespaces is greater than 2, the preliminary nested message needs to be encapsulated multiple times to form a multi-layer nested message.

[0066] Specifically, the outer namespace of the nested namespace is used as the current namespace, the message to be processed is used as the target processing message, the connection information parameters of the current namespace used to ensure the correct transmission of the message are extracted, the target processing message is preliminarily encapsulated based on the extracted connection information parameters, and a preliminary nested message is obtained.

[0067] For example, the step of preliminarily encapsulating the target processing message may include: adding header information or performing data format conversion.

[0068] S203: extract the inner namespace of the current namespace in the nested namespace as the new current namespace, and return to S202 to extract the connection information parameters of the current namespace.

[0069] In the embodiment of the present invention, the inner namespace refers to a namespace that is at a lower level or more central position than the outer namespace in the hierarchical structure of the nested namespaces.

[0070] Specifically, the outer namespace of the nested namespace is obtained as the current namespace, and based on the current namespace being determined, the inner namespace of the current namespace is extracted from the nested namespace, and the inner namespace is updated to be the new current namespace, and the connection information parameters of the new current namespace are extracted to obtain the connection information parameters of the new current namespace. Subsequent encapsulation operations can be performed based on the extracted connection information parameters of the new current namespace.

[0071] S204: When the current namespace is the innermost namespace of the nested namespace, the preliminary nested message is treated as a multi-layer nested message.

[0072] In the embodiment of the present invention, the innermost namespace can be understood as the deepest namespace in the nested structure. In the innermost namespace, all encapsulation of target processing messages has been completed.

[0073] Specifically, the selection operation of the new current namespace and the operation of obtaining the connection information parameters of the new current namespace are repeatedly performed. When the latest current namespace is the deepest namespace in the nested namespace, the target processing message can be encapsulated according to the connection information parameters of the latest current namespace to obtain a preliminary nested message, and the preliminary nested message is used as a multi-layer nested message.

[0074] S205: Transmit the multi-layer nested message to the service node of the outermost namespace of the nested namespace, and use the outermost namespace as the current namespace.

[0075] In the embodiment of the present invention, the outermost namespace can be understood as the topmost namespace in the nested structure. It can be understood that the outermost namespace is the starting point for encapsulating the target processing message.

[0076] A service node can be understood as another entity that handles namespace-related requests.

[0077] Specifically, the multi-layer nested messages can be transmitted to the service node corresponding to the outermost namespace based on the Internet Protocol Security Virtual Private Network, and the outermost namespace can be used as the current namespace. The service node corresponding to the current namespace performs subsequent operations based on the received multi-layer nested messages.

[0078] S206 . Strip the message headers of the multi-layer nested messages at the service node of the current namespace to obtain the current nested message.

[0079] In the embodiment of the present invention, the current nested message can be understood as a data packet, which contains a valid load and can be used to obtain a message to be transmitted.

[0080] Specifically, the service node of the current namespace is responsible for receiving multi-layer nested messages. After the service node of the current namespace receives the multi-layer nested messages, it strips the message headers of the multi-layer nested messages to obtain a data packet containing a valid load. The data packet containing the valid load can be used as the current nested message.

[0081] S207: Transmit the current nested message to the service node of the inner namespace of the current namespace, use the inner namespace as the new current namespace, and use the current nested message as a new multi-layer nested message.

[0082] The inner namespace may be a namespace located at an inner position of the current namespace, and the destination address of the current namespace may point to the inner namespace.

[0083] Specifically, the inner namespace corresponding to the current namespace can be determined, and the current nested message generated by stripping the message header can be transmitted to the service node of the inner namespace. For example, the destination address of the current namespace can be extracted, and the current nested message can be transmitted to the service node corresponding to the destination address, that is, the service node corresponding to the inner namespace corresponding to the current namespace. The inner namespace can be used as a new current namespace, and the current nested message that transmits the new current namespace can be used as a new multi-layer nested message.

[0084] S208. Return to the service node executing in the current namespace to strip the message headers of the multi-layer nested messages to obtain the current nested message.

[0085] In the implementation of the present invention, after obtaining the new current namespace and the multi-layer nested message, the execution can return to step 206, and in the service node of the current namespace, the operation of stripping the message header of the current nested message is performed to obtain a new current nested message, and the above new current nested message can be used as the current nested message for subsequent operations, and the message headers of the multi-layer nested message are stripped layer by layer. The multi-layer nested message structure of the embodiment of the present invention can allow the addition of diverse information tags, facilitate the implementation of diverse network traffic scheduling management through routing control strategies, realize the reasonable allocation of network resources, and enhance the diversity of message transmission control.

[0086] S209: When the current nested message does not include an IP security virtual private network message header, use the current nested message as a message to be transmitted, and transmit the message to be transmitted to a target address.

[0087] Specifically, the selection operation of the new current namespace and the stripping operation of the message header are repeatedly performed. When the current nested message does not include the message header of the Internet Protocol Security Virtual Private Network, the above operations are stopped, and the latest current nested message is used as the message to be transmitted. The message to be transmitted can be transmitted to the target address based on the Internet Protocol Security Virtual Private Network, and the target address performs subsequent operations based on the received message to be transmitted.

[0088] In an embodiment of the present invention, Internet Protocol security virtual private network software can be called to create a nested namespace. When a message to be processed is received, an outer namespace at a higher level or a more peripheral position in the created nested namespace can be used as the current namespace, and the received message to be processed that needs to be encapsulated and transmitted can be used as the target processing message. The connection information parameters of the current namespace used to ensure the correct transmission of the message are extracted, and the target processing message is preliminarily encapsulated based on the extracted connection information parameters to obtain a preliminary nested message. The inner namespace of the current namespace is extracted from the nested namespace, and the inner namespace is updated to a new current namespace. The connection information parameters of the new current namespace are extracted to obtain the connection information parameters of the new current namespace, and the selection operation of the new current namespace and the operation of obtaining the connection information parameters of the new current namespace are repeatedly performed. When the latest current namespace is the deepest namespace in the nested namespace, the target processing message is encapsulated according to the connection information parameters of the latest current namespace to obtain a preliminary nested message, and the preliminary nested message is used as a multi-layer nested message. The multi-layer nested message can be encapsulated based on the Internet Protocol security virtual private network. The set of messages is transmitted to the service node corresponding to the outermost namespace, and the outermost namespace is used as the current namespace. After receiving the multi-layer nested messages, the service node of the current namespace strips the message headers of the multi-layer nested messages to obtain a data packet containing a valid load, and uses the above data packet containing a valid load as the current nested message. Based on the Internet Protocol Security Virtual Private Network, the current nested message can be transmitted to the inner namespace of the current namespace. At this time, the above inner namespace is updated to the new current namespace for the next round of unsealing operation, and the current nested message is transmitted to the above current namespace. In terms of space, in the service node of the current namespace, the operation of stripping the message header of the current nested message is performed to obtain a new current nested message, and the selection operation of the new current namespace and the stripping operation of the message header are repeatedly performed. When the message header of the Internet Protocol Security Virtual Private Network is not included in the current nested message, the above-mentioned repeated selection operation of the new current namespace and the stripping operation of the message header are stopped, and the latest current nested message is used as the message to be transmitted. The message to be transmitted can be transmitted to the target address based on the Internet Protocol Security Virtual Private Network, and the target address performs subsequent operations based on the received message to be transmitted. In the embodiment of the present invention, the target processing message is encapsulated layer by layer by the new current namespace determined layer by layer, which improves the confidentiality of the message encapsulation and ensures the integrity of the message during the transmission process; by stripping the message headers of the multi-layer nested message layer by layer, the invalid information in the multi-layer nested message can be effectively removed, the network bandwidth occupation is reduced, and the efficiency of information transmission is improved, thereby achieving the beneficial effect of making full use of network resources.

[0089] Embodiment 3

[0090] Internet Protocol Security (IPSec) is mainly composed of the following protocols: Authentication Header (AH) protocol, Encapsulating Security Payload (ESP) protocol and Internet Key Exchange (IKE) protocol responsible for key management. AH and ESP can be used separately or in combination. IPSec includes transport mode and tunnel mode. In the transport mode, only the data part is encrypted, and the original IP header remains unchanged. Figure 3 In tunnel mode, the entire Internet Protocol (IP) data packet is encrypted, including both the IP header and the IP data, and then the entire encrypted data packet is filled in a new IP data packet for forwarding, as shown in Figure 1. Figure 4 shown.

[0091] The embodiments of the present invention provide an information transmission method based on two-layer nesting and an information transmission method based on multi-layer nesting on the basis of the above embodiments. The principles of the above two information transmission methods are to install an Internet Protocol Security Virtual Private Network (IPSec VPN) software on a service node, create a corresponding namespace according to the number of layers of IPSec VPN nesting, perform corresponding instantiation operations in multiple namespaces, and realize flexible IPSec VPN access and networking solutions such as IPSec over IPSec and even multi-layer IPSec nesting through policy routing control.

[0092] like Figure 5As shown, the IPSec VPN link established between the client and the service node where VPN2 is located is named VPN-2, and the IPSec VPN link established between the client and the service node where VPN1 is located is named VPN-1. A method for information transmission based on two-layer nesting, the method comprising: when the client needs to access the network where IP-H is located, the message sent from the client is encrypted by two layers of IPSec tunnels, VPN-2 and VPN-1, and its message format is: VPN-1|VPN-2|data payload, when the message reaches the service node where VPN1 is located, the VPN1 node performs IPSec tunnel decryption on the message, strips off the outer IPSec tunnel header and sends it out, at this time the message format is: VPN-2|data payload, when the message reaches the service node where VPN2 is located, the VPN2 node performs IPSec tunnel decryption on the message, strips off the outer IPSec tunnel header and sends it out, at this time the message format is: Data payload, the message is restored to the original data message; when the message reaches the network where IP-H is located, the network where IP-H is located will reply, wherein the reply process includes: when the message reaches the service node where VPN2 is located, the VPN2 node encrypts the message through the IPSec tunnel, adds the outer IPSec tunnel header and sends it out, at this time the message format is: VPN-2|data payload, when the message reaches the service node where VPN1 is located, the VPN1 node encrypts the message through the IPSec tunnel, adds the outer IPSec tunnel header and sends it out, at this time the message format is: VPN-1|VPN-2|data payload, when the message reaches the client, the message is sequentially decrypted through the IPSec VPN1 tunnel, the outer IPSec VPN1 tunnel header is stripped off, the IPSec VPN2 tunnel is decrypted, the outer IPSec VPN2 tunnel header is stripped off, and the message is restored to the original data message, and sent to the application layer. The above steps fully describe the example scenario of two-layer nesting of IPSecVPN.

[0093] like Figure 6As shown in the figure, the dark arrow part shows the message processing flow sent by the client to the external destination, and the light arrow part shows the message processing flow received by the client to the external destination. IPSec VPN software is installed on the client, where the software can be: Strongswan, Libreswan or Openswan. On the service node where VPN2 is located, use VPN software to establish an IPSec VPN link with the client, named VPN-2, set right = veth2's IP, rightsubnet = the network where IP-H is located, and the client sets the route to the network where the destination IP-F is located as the next hop: veth3, where veth2 is directly connected to veth3. After the message sent by veth2 is encrypted by the VPN-2 IPSec tunnel, its message format is: VPN-2|data payload, create a namespace, and in the namespace, on the service node where VPN1 is located, use IPSec VPN software to establish an IPSec VPN link with the client, named VPN-1, set right = veth4's IP, rightsubnet = the network where veth2 is located. In the namespace, set the route to the network where the destination IP-D is located as the next hop: IP-B. After the message sent by veth4 is encrypted by the VPN-2IPSec tunnel, its message format is: VPN-1|VPN-2|data payload.

[0094] The embodiment of this invention provides a method for two or more layers of IPSec VPN nesting. The client creates a corresponding namespace according to the number of layers of IPSec VPN nesting. If N layers of VPN nesting are required, the number of corresponding namespaces created is N-1. The internal architecture of the client is shown as follows: Figure 7 shown.

[0095] Embodiment 4

[0096] Figure 8 A schematic diagram of the structure of an information transmission device provided by an embodiment of the present invention is shown in FIG. Figure 8 As shown, the device comprises:

[0097] The message encapsulation module 301 is used to encapsulate the message to be processed into a multi-layer nested message according to the nested namespace configured by the Internet Protocol Security Virtual Private Network when the message to be transmitted is obtained;

[0098] The message transmission module 302 is used to transmit multi-layer nested messages based on the Internet Protocol security virtual private network.

[0099] In the embodiment of the present invention, when the sending node obtains the processing message, a nested namespace with a hierarchical structure can be created based on the relevant protocols of the Internet Protocol Security Virtual Private Network. In the nested namespace, each namespace can perform multi-level encapsulation on the obtained message to be processed according to the allocated exclusive resources to obtain a multi-layer nested message, and can rely on the corresponding transmission protocol to transmit the multi-layer nested message in the Internet Protocol Security Virtual Private Network. In the embodiment of the present invention, by using the nested namespace to encapsulate the message to be processed into a multi-layer nested message, a multi-layer protection is constructed for the message to be processed, the security of information transmission is improved, and the message to be processed can be flexibly encapsulated into a multi-layer nested message with different characteristics according to different security requirements, thereby enhancing the flexibility of information transmission. The structure of the multi-layer nested message allows the addition of diversified information tags to realize the scheduling and management of network traffic. The Internet Protocol Security Virtual Private Network can dynamically allocate network resources according to the priority of traffic, thereby realizing the full utilization of network resources.

[0100] Based on the above embodiments, the embodiments of the present invention also include: a nesting layer determination unit, used to determine the target nesting layer of the Internet Protocol security virtual private network; a namespace creation unit, used to call the Internet Protocol security virtual professional network software to create a nested namespace corresponding to the target nesting layer.

[0101] On the basis of the above-mentioned embodiment, the embodiment of the present invention further includes: a message restoration unit, which is used to restore the multi-layer nested message to the original message based on the Internet Protocol Security Virtual Private Network when the multi-layer nested message is received.

[0102] Based on the above embodiment, the namespace creation unit is specifically used to call the Internet Protocol Security Virtual Professional Network software to create a namespace with a target nesting number minus one; select the first namespace in each namespace, and use the remaining namespaces as candidate namespaces; determine the second namespace in the candidate namespace, and move the second namespace out of the candidate namespace, and set the destination address of the first namespace to the second namespace; use the second namespace as the new first namespace, and return to execute the determination of the second namespace in the candidate namespace; when it is determined that there is no candidate namespace, use each first namespace as a nested namespace.

[0103] On the basis of the above-mentioned embodiment, the message restoration unit is specifically used to take the multi-layer nested message as the current message, transmit the current message to the namespace service node of the destination address in the current message; strip off the message header of the multi-layer nested message at the namespace service node to obtain the internal nested message; take the internal nested message as the new current message, and return to execute the message header stripping of the multi-layer nested message at the namespace service node; when the current nested message does not have the message header of the Internet Protocol security virtual private network, take the current message as the original message.

[0104] On the basis of the above-mentioned embodiment, the message encapsulation module is specifically used to, when receiving a message to be transmitted, obtain the outer namespace of the nested namespace as the current namespace, and use the message to be transmitted as the target processing message; extract the connection information parameters of the current namespace, and encapsulate the target processing message according to the connection information parameters to obtain a preliminary nested message; extract the inner namespace of the current namespace in the nested namespace as the new current namespace, and return to execute the extraction of the connection information parameters of the current namespace; when the current namespace is the innermost namespace of the nested namespace, treat the preliminary nested message as a multi-layer nested message.

[0105] On the basis of the above embodiments, the message transmission module is specifically used to transmit multi-layer nested messages to the service node of the outermost namespace of the nested namespace, and use the outer namespace as the current namespace; strip the message header of the multi-layer nested message at the service node of the current namespace to obtain the current nested message; transmit the current nested message to the service node of the inner namespace of the current namespace, and use the inner namespace as the new current namespace, and use the current nested message as a new multi-layer nested message; return to execute the service node in the current namespace to strip the message header of the multi-layer nested message to obtain the current nested message; when the current nested message does not include the message header of the Internet Protocol Security Virtual Private Network, use the current nested message as the message to be transmitted, and transmit the message to be transmitted to the target address.

[0106] Embodiment 5

[0107] Fig. 9A schematic diagram of an electronic device that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown in the embodiments of the present invention, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present invention described and / or required herein.

[0108] like Fig. 9 As shown, the electronic device includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the ROM 12 or the computer program loaded from the storage unit 18 to the RAM 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. The input / output (I / O) interface 15 is also connected to the bus 14.

[0109] A number of components in the electronic device are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0110] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit, a graphics processing unit, various special artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any appropriate processors, controllers, microcontrollers, etc. The processor 11 performs the various methods and processes described above, for example, the information transmission method.

[0111] In some embodiments, the information transmission method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the information transmission method may be performed. Alternatively, in other embodiments, the processor 11 may be configured as the information transmission method in any other appropriate manner (e.g., by means of firmware).

[0112] Various implementations of the systems and techniques described above in the embodiments of the present invention may be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays, application specific integrated circuits, application specific standard products, systems on a chip, load programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various implementations may include: being implemented in one or more computer programs, which may be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general programmable processor, which may receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0113] The computer programs for implementing the methods of the embodiments of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer programs are executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer programs may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0114] In the context of an embodiment of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by an instruction execution system, device or equipment or used in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a RAM, a ROM, an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0115] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a cathode ray tube or a liquid crystal display monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or a trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including: acoustic input, voice input, or tactile input).

[0116] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: local area networks, wide area networks, blockchain networks, and the Internet.

[0117] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and virtual private server services.

[0118] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0119] The above specific implementations do not constitute a limitation on the protection scope of the embodiments of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. An information transmission method, characterized in that: The method comprises: When a message to be processed is obtained, the message to be processed is encapsulated into a multi-layer nested message according to a nested namespace configured by an Internet Protocol security virtual private network; The multi-layer nested message is transmitted based on the Internet Protocol security virtual private network.

2. The method according to claim 1, characterized in that: Also includes: determining a target number of nesting levels of the Internet Protocol security virtual private network; Call Internet Protocol Security Virtual Professional Network software to create the nested namespace corresponding to the target nesting level.

3. The method according to claim 1, characterized in that: When the message to be transmitted is obtained, the message to be processed is encapsulated into a multi-layer nested message according to the nested namespace configured by the Internet Protocol Security Virtual Private Network, including: When receiving the message to be processed, obtaining the outer namespace of the nested namespace as the current namespace, and taking the message to be transmitted as the target processing message; Extracting connection information parameters of the current namespace, and encapsulating the target processing message according to the connection information parameters to obtain a preliminary nested message; Extracting the inner namespace of the current namespace in the nested namespace as the new current namespace, and returning connection information parameters for extracting the current namespace; When the current namespace is the innermost namespace of the nested namespace, the preliminary nested message is used as the multi-layer nested message.

4. The method according to claim 1, characterized in that: The transmitting of the multi-layer nested message based on the Internet Protocol security virtual private network includes: Transmitting the multi-layer nested message to a service node of an outermost namespace of the nested namespace, and using the outermost namespace as a current namespace; Stripping the message headers of the multi-layer nested messages at the service node of the current namespace to obtain the current nested message; Transmitting the current nested message to a service node of an inner namespace of the current namespace, taking the inner namespace as a new current namespace, and taking the current nested message as a new multi-layer nested message; Returning to execute the process of stripping the message header of the multi-layer nested message at the service node in the current namespace to obtain the current nested message; When the current nested message does not include the message header of the Internet Protocol security virtual private network, the current nested message is used as the message to be processed, and the message to be processed is transmitted to the target address.

5. The method according to claim 2, characterized in that: The calling of Internet Protocol Security Virtual Professional Network software to create the nested namespace corresponding to the target nesting level includes: Calling the Internet Protocol Security Virtual Professional Network software to create a namespace with the target nesting level minus one; Selecting a first namespace from among the namespaces, and using the remaining namespaces as candidate namespaces; Determine a second namespace within the candidate namespace, move the second namespace out of the candidate namespace, and set the destination address of the first namespace to the second namespace; Taking the second namespace as the new first namespace, and returning to determine the second namespace in the candidate namespace; When it is determined that the candidate namespace does not exist, each of the first namespaces is used as the nested namespace.

6. The method according to claim 1, characterized in that: Also includes: When the multi-layer nested message is received, the multi-layer nested message is restored to the original message based on the Internet Protocol security virtual private network.

7. The method according to claim 6, characterized in that: The method of restoring the multi-layer nested message to the original message based on the Internet Protocol Security Virtual Private Network includes: Taking the multi-layer nested message as the current message, and transmitting the current message to the namespace service node of the destination address in the current message; Stripping the message headers of the multi-layer nested messages at the namespace service node to obtain internal nested messages; Taking the internal nested message as the new current message, and returning to execute the message header stripping of the multi-layer nested message at the namespace service node; When the current message does not have the message header of the Internet Protocol security virtual private network, the current message is used as the original message.

8. An information transmission device, characterized in that: The device comprises: A message encapsulation module, used for encapsulating the message to be processed into a multi-layer nested message according to the nested namespace configured by the Internet Protocol Security Virtual Private Network when the message to be transmitted is obtained; A message transmission module is used to transmit the multi-layer nested messages based on the Internet Protocol security virtual private network.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the information transmission method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the information transmission method according to any one of claims 1 to 7 when executed.

11. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the computer program implements the information transmission method according to any one of claims 1 to 7.

Images