A method for transmitting and processing IP data packets based on network layer

Abstract

The present invention discloses a method for transmitting and processing IP packets based on the network layer, which is applied to an IP packet transmission and processing system. The method comprises: configuring parameters of an algorithm processing unit and a network processing unit in the system; having the network processing unit obtain the MAC address of a target router or target gateway based on the configured IP address; having a terminal encapsulate a first IP packet and send it to the network processing unit via the target router or target gateway; having the network processing unit convert the format of the first IP packet and then send the resulting custom packet to the algorithm processing unit; having the algorithm processing unit perform security algorithm processing and then send the custom packet and the security algorithm processing result to a main control unit; the main control unit inspecting the custom packet, sending the resulting second IP packet to a server, and recording the security algorithm processing result in a database. This method can effectively solve problems such as the speed, reliability, and security of packet transmission and processing.

Description

Technical Field

[0001] The present invention relates to the technical field of IP data packet transmission, and more particularly to a method for transmitting and processing IP data packets based on a network layer. Background Art

[0002] Data packet transmission and processing are essential elements of all network and communications equipment, including information system devices. These capabilities typically require high throughput and reliability. During transmission, network packets can be illegally tampered with and replayed, leading to the risk of unauthorized data intrusion and threatening the security of the entire system. In severe cases, they can cause system processing crashes and paralysis.

[0003] Current research on packet transmission and processing in network devices primarily focuses on the transport and application layers. The IPSec protocol processes IP packets, but it can only receive and process packets that have also been processed using the IPSec protocol. Similarly, packets it sends can only be received by devices with IPSec capabilities; it cannot process standard IP packets. Furthermore, the IPSec protocol is complex and inconvenient to use.

[0004] Therefore, how to effectively solve the problems of speed, reliability, and security of data packet transmission and processing is an urgent problem that needs to be solved by those skilled in the art. Summary of the Invention

[0005] In view of the above problems, the present invention provides a method for transmitting and processing IP data packets based on the network layer to at least solve some of the technical problems mentioned in the above background technology.

[0006] In order to achieve the above object, the present invention adopts the following technical solutions:

[0007] The present invention provides a method for transmitting and processing IP data packets based on the network layer, which is applied to an IP data packet transmission and processing system; the IP data packet transmission and processing system includes a network processing unit, an algorithm processing unit and a main control unit; the method includes:

[0008] Configure parameters for the algorithm processing unit and the network processing unit. After the configuration is completed, the network processing unit sends an ARP request packet based on the configured IP address to obtain the MAC address of the target router or target gateway.

[0009] The terminal encapsulates the first IP data packet and forwards the first IP data packet to the network processing unit through the target router or target gateway;

[0010] The network processing unit performs format conversion on the received first IP data packet and sends the obtained custom data packet to the algorithm processing unit;

[0011] After the algorithm processing unit performs security algorithm processing on the received custom data packet, the custom data packet and the corresponding security algorithm processing result are sent to the main control unit;

[0012] After the main control unit checks and processes the custom data packet processed by the security algorithm, it sends the obtained second IP data packet to the server and records the corresponding security algorithm processing result into the database for auditing.

[0013] Furthermore, it also includes:

[0014] The server responds to the received data and sends a second IP data packet of the response to the main control unit;

[0015] The main control unit recovers the received second IP data packet and sends the recovered custom data packet to the algorithm processing unit;

[0016] The algorithm processing unit performs security algorithm processing on the received custom data packet and sends the processed custom data packet to the network processing unit;

[0017] After performing format conversion processing on the received custom data packet, the network processing unit encapsulates the data packet into a first IP data packet according to the MAC address of the target router or target gateway and the information in the custom packet header, and sends the first IP data packet to the terminal.

[0018] Furthermore, the algorithm processing unit includes an algorithm processing circuit, a parameter storage circuit and a parameter management circuit.

[0019] Furthermore, the algorithm processing unit is parameterized, specifically including:

[0020] Insert a dedicated USB key storing algorithm-related parameters into the USB interface on the front panel of the algorithm processing unit; the algorithm-related parameters include bit stream and key;

[0021] The algorithm-related parameters are decrypted through the parameter management circuit. After decryption, the bit stream is used to configure the algorithm processing circuit, and then other parameters are sent to the algorithm processing circuit. At the same time, the sensitive parameters are encrypted again with random numbers and stored in the parameter storage circuit.

[0022] Furthermore, the network processing unit is configured with parameters, specifically including:

[0023] Configure the MAC address of each network port through the RS232 serial port;

[0024] The main control unit configures each IP address of the network processing unit through the Web management interface.

[0025] Furthermore, the network processing unit sends an ARP request packet according to the configured IP address to obtain the MAC address of the target router or target gateway, specifically including:

[0026] The network processing unit sends an ARP request to all devices in the local area network according to the configured IP address; the device responsible for the IP address will send an ARP reply packet after responding to the ARP request; the device responsible for the IP address is the target router or target gateway;

[0027] The network processing unit obtains the MAC address of the target router or target gateway according to the received ARP reply packet.

[0028] Further:

[0029] The Ethernet frame format between the network processing unit and the terminal includes: an Ethernet frame header, a first IP header, a first UDP header, a special identifier, an encapsulation header, a second IP header, a second UDP header or a TCP header, a payload, and an encapsulation trailer; the special identifier is used to indicate whether the data packet conforms to a preset data packet format; the terminal is connected to the network processing unit via a wide area network or an external network to initiate various service requests and obtain data;

[0030] The data packet format between the algorithm processing unit and the network processing unit includes: a custom packet header, an encapsulation header, a second IP header, a second UDP header or a TCP header, a payload, and an encapsulation trailer;

[0031] The data packet format between the main control unit and the algorithm processing unit includes: a custom packet header, a second IP header, a second UDP header or TCP header, and a payload;

[0032] The Ethernet frame format between the main control unit and the server includes: an Ethernet frame header, a second IP header, a second UDP header or a TCP header, and a payload; the server is used to process service requests and data from the terminal.

[0033] Furthermore, the network processing unit processes the received first IP data packet, specifically including: removing the first IP header and the first UDP header in the first IP data packet.

[0034] Furthermore, the main control unit performs recovery processing on the received second IP data packet, specifically including: the main control unit extracts relevant information of the received second IP data packet, searches the hash table through the extracted relevant information, matches the first IP header, and then encapsulates it into a custom data packet.

[0035] Furthermore, the main control unit adopts a CPU chip; the algorithm processing circuit and the network processing unit adopt an FPGA chip; and a PCIE interface is used between the CPU chip and the FPGA chip.

[0036] It can be seen from the above technical solution that, compared with the prior art, the present invention discloses a method for transmitting and processing IP data packets based on the network layer, which has the following beneficial effects:

[0037] The present invention supports reconfigurable processing algorithms and configurable parameters, and can effectively solve problems such as rate security of data packet transmission and processing.

[0038] The present invention adopts a two-layer IP header data packet format between the network processing unit and the remote end, ensuring that the processing of network data packets is directly sunk to the IP layer processing without involving complex transport layer and upper layer protocols, making the processing of data packets simpler and more real-time.

[0039] In the present invention, a PCIE interface is used between the CPU and the FPGA, and by optimizing the driver and PCIE DMA, the transmission bandwidth for IP data packets (with a size of less than 1500 bytes) can reach 10Gbps.

[0040] The technical solution of the present invention is further described in detail below through the accompanying drawings and embodiments. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0042] Figure 1 A schematic diagram of the IP data packet transmission and processing system framework provided by an embodiment of the present invention.

[0043] Figure 2 A flowchart of a method for transmitting and processing network layer IP data packets provided by an embodiment of the present invention.

[0044] Figure 3 A schematic diagram of the Ethernet frame format between a network processing unit and a remote interface provided by an embodiment of the present invention.

[0045] Figure 4 A schematic diagram of the data packet format between the algorithm processing unit and the network processing unit provided in an embodiment of the present invention.

[0046] Figure 5A schematic diagram of the data packet format between the main control unit and the algorithm processing unit provided in an embodiment of the present invention.

[0047] Figure 6 A schematic diagram of the Ethernet frame format between the main control unit and the proximal interface provided in an embodiment of the present invention.

[0048] Figure 7 A schematic diagram of a packaging header provided in an embodiment of the present invention.

[0049] Figure 8 A schematic diagram of the implementation framework of the main control unit provided in an embodiment of the present invention.

[0050] Figure 9 This is a schematic diagram of the algorithm processing circuit implementation framework provided by an embodiment of the present invention.

[0051] Figure 10 A schematic diagram of the framework of a network processing unit implementation scheme provided in an embodiment of the present invention.

[0052] Figure 11 This is a schematic diagram of the implementation framework of the parameter storage circuit provided by an embodiment of the present invention.

[0053] Figure 12 This is a schematic diagram of the implementation framework of the parameter management circuit provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0054] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0055] Example 1:

[0056] The embodiment of the present invention discloses a method for transmitting and processing IP data packets based on the network layer, which is applied to an IP data packet transmission and processing system; Figure 1 As shown, the IP data packet transmission and processing system includes a network processing unit, an algorithm processing unit and a main control unit; wherein the algorithm processing unit includes an algorithm processing circuit, a parameter management circuit and a parameter storage circuit, and the structure adopts a 6U CPCIE architecture in a plug-in card form.

[0057] The embodiment of the present invention provides a method for transmitting and processing network layer IP data packets, see Figure 2 As shown, it includes parameter configuration part and working part; specifically:

[0058] 1. After the system is powered on, configure the parameters of the algorithm processing unit and the network processing unit; among them:

[0059] (1) Configure parameters of the algorithm processing unit:

[0060] Insert the dedicated USB key that stores the algorithm-related parameters into the USB port on the front panel of the algorithm processing unit; the algorithm-related parameters include bit stream and key, etc.

[0061] The algorithm-related parameters are decrypted through the parameter management circuit, and after decryption, the bit stream is used to configure the algorithm processing circuit, and then other parameters are sent to the algorithm processing circuit. At the same time, the sensitive parameters are encrypted again with random numbers and stored in the parameter storage circuit;

[0062] (2) Configure parameters for the network processing unit:

[0063] Configure the MAC address of each network port through the RS232 serial port; the main control unit configures the IP address of each network processing unit through the Web management interface.

[0064] (3) After the configuration is completed, the network processing unit sends an ARP request data packet according to the configured IP address to obtain the MAC address of the target router or target gateway; specifically: the network processing unit sends an ARP request to all devices in the local area network according to the configured IP address; the device responsible for the IP address will send an ARP reply packet after responding to the ARP request; the device responsible for the IP address is the target router or target gateway; the network processing unit obtains the MAC address of the target router or target gateway connected to the network processing unit based on the received ARP reply packet.

[0065] 2. Working part:

[0066] The terminal encapsulates the first IP data packet and forwards the first IP data packet to the network processing unit through the target router or target gateway; the network processing unit receives the first IP data packet sent by the terminal through the 10Gbps Ethernet SFP, performs format conversion processing, and sends the processed custom data packet to the algorithm processing unit through the high-speed GTH interface; the algorithm processing unit performs security algorithm processing on the received custom data packet, and then sends the custom data packet and the corresponding security algorithm processing result to the main control unit through the PCIE3.0x8 interface; after the main control unit checks and processes the custom data packet after the security algorithm processing, it sends the obtained second IP data packet to the server through the 10Gbps Ethernet SFP, and records the corresponding security algorithm processing result in the database for auditing.

[0067] Similarly, the reverse processing is performed in the opposite direction; specifically, the server responds to the received data and sends the second IP data packet of the response to the main control unit; the main control unit recovers the received second IP data packet and sends the recovered custom data packet to the algorithm processing unit; the algorithm processing unit performs security algorithm processing on the received custom data packet and sends the processed custom data packet to the network processing unit; the network processing unit performs format conversion on the received custom data packet and encapsulates it into a first IP data packet according to the MAC address of the target router or target gateway and the information in the custom packet header, and sends the first IP data packet to the terminal.

[0068] Example 2:

[0069] In order to implement the method for network layer IP data packet transmission and processing provided in the first embodiment, a specific data packet format must be used. The specific data packet transmission format defined in the second embodiment specifically includes:

[0070] 1. The Ethernet frame format between the network processing unit and the terminal is shown in Figure 3 As shown, it includes: an Ethernet frame header, a first IP header (i.e., IP1 header), a first UDP header (i.e., UDP1 header), a special identifier, an encapsulation header, a second IP header (i.e., IP2 header), a second UDP header (i.e., UDP2 header) or a TCP header (i.e., TCP2 header), a payload, and an encapsulation tail; wherein the special identifier is used to indicate whether the data packet conforms to the preset data packet format; the terminal is connected to the network processing unit through a wide area network or an external network, and is used to initiate various service requests and obtain data.

[0071] Among them, the source IP address of the IP1 header is the IP address of the sender. This address will change when passing through the NAT traversal device, so the source IP address here cannot be used as information for data packet inspection; the destination IP address of the IP2 header is the IP address of the receiver. This address will not change after passing through the NAT device, so the network processing unit mainly detects the destination IP address when detecting and judging legal data packets; therefore, the embodiment of the present invention adopts a data packet format with two layers of IP headers, and the network processing unit can rely on the destination IP address of the inner IP2 header when detecting and judging legal data packets; in other words, since the information in the IP2 header will not be affected and changed during transmission, it records real information for subsequent network communication between the main control unit and the terminal.

[0072] IP1 data packets use the UDP protocol. Because the UDP protocol is connectionless, and the checksum of the UDP data packet does not need to be calculated, it can be directly set to 0. After modifying some fields, only the checksum of the IP header needs to be recalculated and it can be encapsulated into a new IP data packet and sent out, thereby achieving the purpose of fast processing and forwarding;

[0073] The port number in the UDP1 header is not checked here because it may change, but this information (source IP address, destination IP address, source port and destination port) needs to be recorded and stored in the custom packet header so that the returned data packet can be re-encapsulated with the IP1 header and transmitted to the algorithm processing unit;

[0074] In an embodiment of the present invention, a special identifier is also used to indicate whether a data packet conforms to the data packet format defined here. Because there are a large number of data packets on the network, and there are also many data packets that meet the requirements of a legal destination IP address, but most of them are not in the format defined here, so this special identifier can be used to shield other data packets that are not in this format.

[0075] 2. The data packet format between the algorithm processing unit and the network processing unit is shown in Figure 4 As shown, it includes: a custom packet header, an encapsulation header, a second IP header (i.e., an IP2 header), a second UDP header (i.e., a UDP2 header) or a TCP header (i.e., a TCP2 header), a payload, and an encapsulation trailer;

[0076] Among them, the custom packet header is of fixed size, mainly including packet size, data payload size, processing results, source IP address, destination IP address, source port and destination port and identifier; the custom packet header is designed to transmit key information between various units inside the device. The network processing unit needs to extract the key information of the network packet and fill it into the custom packet header, and at the same time needs to use the custom packet header to encapsulate the new IP data packet; the algorithm processing unit decides what key to use for what algorithm calculation and fills in the processing result information based on the custom packet header; the main control unit establishes an information mapping table and backfills key information based on the custom packet header.

[0077] The data packet between the network processing unit, the algorithm processing unit and the remote end also includes an encapsulation header and an encapsulation trailer. The information in the encapsulation header is mainly used by the algorithm processing unit, and the algorithm processing result data is written into the encapsulation trailer.

[0078] 3. The data packet format between the main control unit and the algorithm processing unit is shown in Figure 5 As shown, it includes: a custom packet header, a second IP header (i.e., IP2 header), a second UDP header (i.e., UDP2 header) or a TCP header (i.e., TCP2 header), and a payload.

[0079] 4. The Ethernet frame format between the main control unit and the server is shown in Figure 6 As shown, it includes: an Ethernet frame header, a second IP header (i.e., IP2 header), a second UDP header (i.e., UDP2 header) or a TCP header (i.e., TCP2 header), and a payload; wherein the server is used to process service requests and data from the terminal.

[0080] 5. For the above encapsulation header, see Figure 7 As shown, it includes an 8-byte identifier, a 4-byte timestamp, a 1-byte algorithm type, a 1-byte key batch, and a 2-byte data length.

[0081] Based on the above-mentioned specific data packet transmission format, the network processing unit in the above-mentioned embodiment 1 processes the received first IP data packet, specifically including: removing the first IP header and the first UDP header in the first IP data packet.

[0082] Based on the above-mentioned specific data packet transmission format, the main control unit in the above-mentioned embodiment 1 recovers and processes the received second IP data packet, specifically including: the main control unit extracts the relevant information of the received second IP data packet, and searches the hash table through the extracted relevant information to match the first IP header, and then encapsulates it into a custom data packet.

[0083] Since the data packet transmission and processing system is powerful and has complex logic, it is further divided into the following five functional parts in the embodiment of the present invention:

[0084] (1) Main control unit: uses an x86 architecture CPU chip to implement web-based configuration of the network processing unit, data packet auditing, PCIE data packet sending and receiving, and network packet sending and receiving functions;

[0085] (2) Algorithm processing circuit: Using FPGA chips to implement encryption and decryption algorithms or integrity verification algorithms to ensure data confidentiality and integrity, with algorithm reconfiguration and parameter reconfiguration;

[0086] (3) Network processing unit: uses FPGA chip to realize the sending, receiving and processing of terminal IP data packets;

[0087] As can be seen, the embodiment of the present invention adopts an architecture of two high-performance FPGAs, a high-performance CPU, and an embedded MCU, which are interconnected via a backplane. The CPU and FPGA use a PCIE interface. By optimizing the driver and PCIE DMA, the transmission bandwidth for IP data packets (with a size of less than 1500 bytes) can reach 10Gbps.

[0088] (4) Parameter storage circuit: uses SRAM (Static Random-Access Memory) chip to store key parameters. When necessary, sensitive parameters can be destroyed by cutting off the connection with the battery;

[0089] (5) Parameter management circuit: It uses an embedded MCU (Microcontroller Unit) chip to communicate with the algorithm processing circuit through the SPI interface to complete the management and configuration of the key parameters required by the algorithm processing circuit.

[0090] Next, the implementation methods of the above five functional parts are described in detail.

[0091] 1. Implementation method of the main control unit:

[0092] The main control unit is used to configure the necessary parameters of the network processing unit, implement data packet auditing, send and receive PCIE interface data packets, send and receive IP packets and process data packets. Figure 8 shown.

[0093] The main control unit is implemented by an x86 architecture CPU. On the Ethernet side, it uses DPDK technology for high-performance network packet processing. By sharing the storage memory of packets captured by the network card and PCIE packets, zero copy is achieved, thereby obtaining high-performance transmission bandwidth. On the PCIE side, the data format adopts AXI-Stream mode. Through high-performance drivers, a chained DMA method is adopted. One page corresponds to one data packet. When the main control unit sends data to the PCIE interface, it starts DMA of the corresponding size according to the number of packets and transfers the data to the algorithm processing unit. When the main control unit receives data from the PCIE interface, the DMA sets a fixed number of packets for each DMA. During this period, if the number of packets is less than the set number, the algorithm processing unit will send invalid data when it detects that the main control unit has requested data but there is not enough data to send. One data packet is one packet, so that this DMA is completed quickly. This method avoids the use of timeout interrupts, reduces the processing waste caused by introducing timeouts, and greatly improves the transmission bandwidth of PCIE DMA.

[0094] After the main control unit receives a data packet from the PCIE interface, it extracts the identifier and IP quadruple in the custom packet header and the IP quadruple in the payload, and constructs a hash mapping table of the second set of IP quadruple and identifier, as well as the first set of IP quadruple; wherein the IP quadruple includes the source IP address, destination IP address, source port and destination port; when the main control unit receives a data packet from the Ethernet interface, it searches the hash table through the second set of IP quadruple to obtain the first set of IP quadruple and identifier information, and fills it into the custom packet header; the audit module audits all data packets, mainly recording information such as IP address, identifier, key batch and processing results.

[0095] 2. Implementation method of algorithm processing circuit:

[0096] The function of the algorithm processing circuit is to perform cryptographic operations or HMAC operations on the data packet according to the configured key and the identifier in the data packet, thereby protecting the network data packet from potential attacks and ensuring the authenticity, integrity and confidentiality of data reading and writing.

[0097] The design principle is to use a reconfiguration method to configure the FPGA's internal algorithm module. Through MCU configuration, the root key is stored in the FPGA's internal RAM, and other parameters are configured in the FPGA's internal registers. When a data packet is received from the GTH interface, it first undergoes a security check to verify the validity of the packet format and key fields. If invalid, the packet is discarded or the data payload is removed, and the length field of the corresponding custom packet header and the processing result are modified. After passing the security check, the data enters the algorithm processing module, where the root key is calculated with the identifier and used as the operation key to perform algorithmic processing on the data. If the algorithm is a cryptographic function, decryption is performed. The decrypted data is subjected to a CRC check and compared with the CRC value in the packet. If the check is consistent, the packet is valid. If it is inconsistent, the packet is invalid, the data payload is removed, and the length field of the corresponding custom packet header and the processing result are modified. If the algorithm is an HMAC function, HMAC authentication is performed and the authentication result is compared with the authentication value in the packet. If the result is consistent, the packet is valid. If it is inconsistent, the packet is invalid, the data payload is removed, and the length field of the corresponding custom packet header and the processing result are modified. The processed data packet is sent to the main control unit via the PCIE interface. When receiving data packets from the PCIE interface, the processing flow is the opposite of the processing of data packets from the GTH interface. However, during the security check, if the check is illegal, it will be discarded. Figure 9 shown.

[0098] To prevent illegal replay attacks, the parameter configuration includes the configuration of time information. The timestamp will be checked in the security check module. If the offset between the timestamp in the data packet and the local time is within the legal range, the timestamp of the data packet is considered legal. Otherwise, it is considered a data packet with an illegal timestamp.

[0099] 3. Implementation methods of the network processing unit:

[0100] The role of the network processing unit is to achieve simple data processing, fast and real-time transmission by adopting IP data packet processing methods, and it has the scalability of the network. The network processing unit is mainly composed of an Ethernet data packet transceiver module, an Aurora data packet transceiver module and a data packet processing module. After receiving the configuration package of the main control unit or detecting that the Ethernet interface is connected, it sends an ARP request packet according to the configured local IP address and gateway IP address. When the ARP response packet from the receiving end is received, the MAC address of the other end is stored; when receiving an Ethernet frame from the Ethernet interface, first determine whether the destination MAC address is a local MAC address or a broadcast address. If it is a local MAC address, then proceed to process it. If it is a broadcast address, it is also necessary to determine whether it is an ARP request packet. When an ARP request packet is received and the destination address is a legal address, construct an ARP response packet and send it to the other end. When an IP data packet is received , determine whether the destination IP address is legal, discard the data packets with illegal IP addresses, then determine whether the protocol number is UDP, discard those that are not UDP protocols, calculate the checksum of the IP header, if it is inconsistent with the checksum of the IP header in the data packet, discard the data packet, then determine whether there is a special mark, discard the data packet without a special mark, and finally remove the outer IP header and UDP header of the legal data packet, fill the relevant IP address and port into the corresponding field of the custom packet header, and use the following data as a payload, encapsulate it into a custom data packet and send it to the algorithm processing unit through GTH; similarly, perform the reverse operation in the opposite direction. The implementation block diagram is as follows Figure 10 shown.

[0101] 4. Implementation method of parameter storage circuit:

[0102] The function of the parameter storage circuit is to store key sensitive data. When necessary, the stored parameters can be destroyed by pressing a button or removing the card. The parameter storage adopts SRAM storage, which is powered by a battery. The controller of the parameter storage is implemented in the FPGA of the algorithm processing circuit. Since the algorithm bit rate of the FPGA needs to be stored, and the algorithm bit stream is relatively large, with more than ten megabytes, two 8MB SRAMs are used. The implementation method of the parameter storage circuit is as follows Figure 11 shown.

[0103] 5. Implementation method of parameter management circuit:

[0104] The parameter management circuit is implemented using an MCU chip to manage, store, and configure various parameters. The parameter management circuit implementation block diagram is shown in the figure below. Figure 12 shown.

[0105] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on the differences from other embodiments. Reference can be made to the common and similar parts between the various embodiments. For the systems disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the description is relatively simple, and the relevant parts can be referred to the method description.

[0106] The above description of the disclosed embodiments is intended to enable one skilled in the art to implement or use the present invention. Various modifications to these embodiments will be readily apparent to one skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not limited to the embodiments shown herein but is intended to conform to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for transmitting and processing IP data packets based on the network layer, characterized in that: Applied to IP data packet transmission and processing systems; The IP data packet transmission and processing system includes a network processing unit, an algorithm processing unit and a main control unit; the method includes: Configure parameters for the algorithm processing unit and the network processing unit. After the configuration is completed, the network processing unit sends an ARP request packet based on the configured IP address to obtain the MAC address of the target router or target gateway. The terminal encapsulates the first IP data packet and forwards the first IP data packet to the network processing unit through the target router or target gateway; The network processing unit performs format conversion on the received first IP data packet and sends the obtained custom data packet to the algorithm processing unit; After the algorithm processing unit performs security algorithm processing on the received custom data packet, the custom data packet and the corresponding security algorithm processing result are sent to the main control unit; After the main control unit checks and processes the custom data packet processed by the security algorithm, it sends the obtained second IP data packet to the server and records the corresponding security algorithm processing results in the database for auditing; The Ethernet frame format between the network processing unit and the terminal includes: an Ethernet frame header, a first IP header, a first UDP header, a special identifier, an encapsulation header, a second IP header, a second UDP header or a TCP header, a payload, and an encapsulation trailer; the special identifier is used to indicate whether the data packet conforms to a preset data packet format; the terminal is connected to the network processing unit via a wide area network or an external network to initiate various service requests and obtain data; The data packet format between the algorithm processing unit and the network processing unit includes: a custom packet header, an encapsulation header, a second IP header, a second UDP header or a TCP header, a payload, and an encapsulation trailer; The data packet format between the main control unit and the algorithm processing unit includes: a custom packet header, a second IP header, a second UDP header or TCP header, and a payload; The Ethernet frame format between the main control unit and the server includes: an Ethernet frame header, a second IP header, a second UDP header or TCP header, and a payload; the server is used to process service requests and data from the terminal; The first IP header is the IP1 header, and the source IP address of the IP1 header is the IP address of the sending end; The second IP header is an IP2 header, and the destination IP address of the IP2 header is the IP address of the receiving end; The custom packet header is of fixed size and includes packet size, data payload size, processing result, source IP address, destination IP address, source port and destination port and identifier.

2. The method for transmitting and processing network layer IP data packets according to claim 1, wherein: Also includes: The server responds to the received data and sends a second IP data packet of the response to the main control unit; The main control unit recovers the received second IP data packet and sends the recovered custom data packet to the algorithm processing unit; The algorithm processing unit performs security algorithm processing on the received custom data packet and sends the processed custom data packet to the network processing unit; After performing format conversion processing on the received custom data packet, the network processing unit encapsulates the data packet into a first IP data packet according to the MAC address of the target router or target gateway and the information in the custom packet header, and sends the first IP data packet to the terminal.

3. The method for transmitting and processing network layer IP data packets according to claim 1, wherein: The algorithm processing unit includes an algorithm processing circuit, a parameter storage circuit and a parameter management circuit.

4. The method for transmitting and processing network layer IP data packets according to claim 3, wherein: Configure the parameters of the algorithm processing unit, including: Insert a dedicated USB key storing algorithm-related parameters into the USB interface on the front panel of the algorithm processing unit; the algorithm-related parameters include bit stream and key; The algorithm-related parameters are decrypted through the parameter management circuit. After decryption, the bit stream is used to configure the algorithm processing circuit, and then other parameters are sent to the algorithm processing circuit. At the same time, the sensitive parameters are encrypted again with random numbers and stored in the parameter storage circuit.

5. The method for transmitting and processing network layer IP data packets according to claim 1, wherein: Configure parameters for the network processing unit, including: Configure the MAC address of each network port through the RS232 serial port; The main control unit configures each IP address of the network processing unit through the Web management interface.

6. The method for transmitting and processing network layer IP data packets according to claim 1, wherein: The network processing unit sends an ARP request packet based on the configured IP address to obtain the MAC address of the target router or target gateway, specifically including: The network processing unit sends an ARP request to all devices in the local area network according to the configured IP address; the device responsible for the IP address will send an ARP reply packet after responding to the ARP request; the device responsible for the IP address is the target router or target gateway; The network processing unit obtains the MAC address of the target router or target gateway according to the received ARP reply packet.

7. The method for transmitting and processing network layer IP data packets according to claim 1, wherein: The network processing unit processes the received first IP data packet, specifically including: removing the first IP header and the first UDP header in the first IP data packet.

8. The method for transmitting and processing network layer IP data packets according to claim 1, wherein: The main control unit performs recovery processing on the received second IP data packet, specifically including: the main control unit extracts relevant information of the received second IP data packet, searches the hash table through the extracted relevant information, matches the first IP header, and then encapsulates it into a custom data packet.

9. The method for transmitting and processing network layer IP data packets according to claim 3, wherein: The main control unit adopts a CPU chip; the algorithm processing circuit and the network processing unit adopt an FPGA chip; and a PCIE interface is used between the CPU chip and the FPGA chip.

Images