Communication method and device, communication equipment and storage medium

Abstract

The invention relates to a communication method and device, communication equipment and a storage medium. The method comprises the following steps: acquiring a to-be-sent message corresponding to each application flow; the message to be sent comprises an inner layer differential service code point DSCP value; the inner-layer DSCP value represents the service priority of the application flow; for each to-be-sent message, according to the inner-layer DSCP value, determining a target Internet security protocol IPsec sub-tunnel matched with the to-be-sent message, and determining a DSCP value corresponding to the target IPsec sub-tunnel; and adding the DSCP value of the target IPsec sub-tunnel to an outer-layer internet interconnection protocol header of the message to be sent, and transmitting the message to be sent based on a priority sequence represented by the DSCP value of the target IPsec sub-tunnel. By adopting the method, the timely transmission of the application data of the high-priority service can be realized, and the high-priority service is ensured.

Description

Technical Field

[0001] This application relates to the field of mobile communication terminal technology, and in particular to a communication method, apparatus, communication device, storage medium, and computer program product. Background Technology

[0002] Current 5G systems allow terminals to access the TNGF (Trusted Non-3GPP Gateway Function) via Non-3GPP networks and IPsec tunnels, achieving "trusted" access. This enables terminals to send uplink data based on "trusted" access. Here, 5G stands for 5th Generation Mobile Communication Technology; Non-3GPP network refers to a network not part of the 3GPP (3rd Generation Partnership Project); IPsec tunnel is a secure tunnel built on the IKE / IPsec protocol stack, where IPsec stands for Internet Protocol Security and IKE stands for Key Exchange Protocol; and TNGF is a gateway function entity in the 3GPP 5G core network used for trusted non-3GPP access scenarios.

[0003] In traditional technology, when a service is transmitted upstream, the terminal determines a different inner DSCP (Differentiated Services Code Point) value for each application traffic, and encapsulates each application traffic into a packet based on that inner DSCP value. The outer IP (Internet Protocol) header DSCP of each packet is uniformly updated to the default value. Then, the terminal transmits each packet upstream through an IPsec tunnel and a Non-3GPP network.

[0004] However, in traditional technologies, because the DSCP value in the outer IP header is always the same, the terminal network card or terminal driver can only see packets of the same priority. Once the uplink is congested, application data for high-priority services cannot be transmitted in a timely manner, meaning that high-priority services cannot be guaranteed. Summary of the Invention

[0005] This application provides a communication method, apparatus, communication device, storage medium, and computer program product that enables timely transmission of application data for high-priority services, thus ensuring the smooth operation of these services.

[0006] A communication method, the method comprising:

[0007] Obtain the packets to be sent corresponding to each application traffic; the packets to be sent contain the inner differential service code point (DSCP) value; the inner DSCP value represents the service priority of the application traffic.

[0008] For each message to be sent, the target Internet Security Protocol (IPsec) sub-tunnel matching the message to be sent is determined based on the inner DSCP value, and the DSCP value corresponding to the target IPsec sub-tunnel is determined.

[0009] The DSCP value of the target IPsec subtunnel is added to the outer Internet Protocol header of the message to be sent, and the message to be sent is transmitted based on the priority order represented by the DSCP value of the target IPsec subtunnel.

[0010] In one embodiment, obtaining the packets to be sent corresponding to each application traffic includes:

[0011] The application traffic is acquired, and the inner DSCP value and 5G mobile communication technology service quality identifier 5QI of each application traffic are determined according to the preset service quality rules.

[0012] The application traffic is encapsulated using the inner DSCP value and the 5QI to obtain the message to be sent.

[0013] In one embodiment, before determining the target Internet Security Protocol (IPsec) sub-tunnel matching the message to be sent based on the inner DSCP value for each message to be sent, the method further includes:

[0014] The sending strategy corresponding to each message to be sent is determined according to the preset quality of service rules;

[0015] If the sending strategy is a plaintext sending strategy, the message to be sent is transmitted to the network card module, and the message to be sent is transmitted uplink through the network card module;

[0016] If the sending strategy is an encrypted sending strategy, the step of determining the target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent for each message to be sent based on the inner DSCP value is executed.

[0017] In one embodiment, determining the target Internet Security Protocol (IPsec) sub-tunnel matching the message to be sent based on the inner DSCP value for each message to be sent includes:

[0018] Based on the source Internet Protocol address, target Internet Protocol address, and inner DSCP value of the message to be sent, determine whether there is a target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent;

[0019] If the target IPsec sub-tunnel exists, record the DSCP value of the target IPsec sub-tunnel.

[0020] In one embodiment, after determining whether a target Internet Security Protocol (IPsec) subtunnel corresponding to the message to be sent exists, the method further includes:

[0021] If the target IPsec subtunnel does not exist, negotiate a new IPsec subtunnel based on the source Internet Protocol address, target Internet Protocol address, and inner DSCP value in the message to be sent;

[0022] Perform the step of determining whether there is a target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent, based on the source Internet Protocol address, target Internet Protocol address, and inner DSCP value of the message to be sent.

[0023] In one embodiment, adding the DSCP value of the target IPsec subtunnel to the outer Internet Protocol header of the message to be sent includes:

[0024] The message to be sent is encrypted to obtain an encrypted message, and the DSCP value of the target IPsec sub-tunnel is added to the outer Internet Protocol header of the encrypted message;

[0025] The encrypted message is transmitted to the network card module based on the target IPsec sub-tunnel.

[0026] In one embodiment, transmitting the message to be sent based on the priority order represented by the DSCP value of the target IPsec sub-tunnel includes:

[0027] The target network interface resource queue corresponding to the message to be sent is determined by the DSCP value in the network interface module and the outer IP header;

[0028] The network interface card (NIC) module adds the encrypted message corresponding to the message to be sent to the target NIC resource queue, and sends the encrypted message in the target NIC resource queue according to the priority order of each NIC resource queue.

[0029] A communication device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0030] The acquisition module is used to acquire the packets to be sent corresponding to each application traffic; the packets to be sent contain the inner differential service code point (DSCP) value; the inner DSCP value represents the service priority of the application traffic.

[0031] The determination module is used to determine, for each packet to be sent, the target Internet Security Protocol (IPsec) sub-tunnel matched by the inner DSCP value, and determine the DSCP value corresponding to the target IPsec sub-tunnel.

[0032] The transmission module is configured to add the DSCP value of the target IPsec subtunnel to the outer Internet Protocol header of the message to be sent, and transmit the message to be sent based on the priority order represented by the DSCP value of the target IPsec subtunnel.

[0033] A computer-readable storage medium having a computer program stored thereon, the computer program performing the following steps when executed by a processor:

[0034] Obtain the packets to be sent corresponding to each application traffic; the packets to be sent contain the inner differential service code point (DSCP) value; the inner DSCP value represents the service priority of the application traffic.

[0035] For each message to be sent, the target Internet Security Protocol (IPsec) sub-tunnel matching the message to be sent is determined based on the inner DSCP value, and the DSCP value corresponding to the target IPsec sub-tunnel is determined.

[0036] The DSCP value of the target IPsec subtunnel is added to the outer Internet Protocol header of the message to be sent, and the message to be sent is transmitted based on the priority order represented by the DSCP value of the target IPsec subtunnel.

[0037] A computer program product includes a computer program that, when executed by a processor, implements the communication method provided in the embodiments of this application. The method may be:

[0038] Obtain the packets to be sent corresponding to each application traffic; the packets to be sent contain the inner differential service code point (DSCP) value; the inner DSCP value represents the service priority of the application traffic.

[0039] For each message to be sent, the target Internet Security Protocol (IPsec) sub-tunnel matching the message to be sent is determined based on the inner DSCP value, and the DSCP value corresponding to the target IPsec sub-tunnel is determined.

[0040] The DSCP value of the target IPsec subtunnel is added to the outer Internet Protocol header of the message to be sent, and the message to be sent is transmitted based on the priority order represented by the DSCP value of the target IPsec subtunnel.

[0041] The aforementioned communication method, apparatus, communication equipment, storage medium, and computer program product acquire packets to be sent corresponding to each application traffic; the packets to be sent contain inner Differential Service Code Point (DSCP) values; the inner DSCP values ​​characterize the service priority of the application traffic; for each packet to be sent, based on the inner DSCP values, a target Internet Security Protocol (IPsec) sub-tunnel matching the packet to be sent is determined, and the DSCP value corresponding to the target IPsec sub-tunnel is determined; the DSCP value of the target IPsec sub-tunnel is added to the outer Internet Protocol (IP) header of the packet to be sent, and the packets to be sent are transmitted based on the priority order represented by the DSCP values ​​of the target IPsec sub-tunnel. This method determines the target IPsec subtunnel by using the inner DSCP value and adds the DSCP value of the target IPsec subtunnel to the outer IP header of the packet to be sent. This mirrors the inner DSCP value to the outer IP header, enabling the DSCP value in the outer IP packet to identify the service priority of the packet to be sent. The packet is then transmitted according to the priority order, ensuring the timely transmission of application data for high-priority services and guaranteeing the service of high-priority services. Attached Figure Description

[0042] Figure 1 This is a schematic diagram of DSCP remapping of a packet that is not encapsulated by IPsec in one embodiment;

[0043] Figure 2 This is a schematic diagram of DSCP remapping of unencapsulated packets in the prior art in one embodiment;

[0044] Figure 3 This is a flowchart illustrating a communication method in one embodiment;

[0045] Figure 4 This is a schematic diagram of the process of obtaining a message to be sent in one embodiment;

[0046] Figure 5 This is a schematic diagram of the process for determining a target IPsec sub-tunnel in one embodiment;

[0047] Figure 6 This is a schematic diagram of the outer layer mapping of different DSCP packets by the IPsec processing module in one embodiment.

[0048] Figure 7This is a schematic diagram of the process for recording the DSCP value of a target IPsec sub-tunnel in one embodiment;

[0049] Figure 8 This is a schematic diagram of the process for negotiating a new IPsec subtunnel in one embodiment;

[0050] Figure 9 This is a schematic diagram illustrating the process of transmitting encrypted messages to the network interface card module in one embodiment;

[0051] Figure 10 Here is a flowchart of the IPsec processing module in one embodiment;

[0052] Figure 11 This is a schematic diagram of the process of sending encrypted messages in one embodiment;

[0053] Figure 12 This is a schematic diagram of the outer layer mapping of different DSCP packets by the IPsec processing module in one embodiment.

[0054] Figure 13 This is a structural block diagram of a communication device in one embodiment;

[0055] Figure 14 This is an internal structural diagram of a communication device in one embodiment. Detailed Implementation

[0056] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0057] Current 5G systems allow terminals to access the TNGF via Non-3GPP networks and IPsec tunnels to achieve "trusted" access, enabling terminals to send uplink data based on "trusted" access.

[0058] In traditional technologies, when a service request travels upstream, all application data is encapsulated within the same IPsec tunnel. The outer IP header typically uses a uniform DSCP value (or even 0), resulting in:

[0059] Terminal network cards / drivers can only see packets of "same priority" at the link layer and air interface.

[0060] Once the uplink becomes congested, high-priority services (VoIP, real-time video) cannot be adequately guaranteed. Specifically, Figure 1 This is a schematic diagram of DSCP remapping of a packet that is not encapsulated in IPsec, as shown in one embodiment. Figure 1As shown, when application data does not enter the IPsec tunnel, the three data streams carry DSCP markers, namely DSCP marker 1, DSCP marker 2, and DSCP marker 3. The network interface card (NIC) module in the terminal can directly read the DSCP values ​​and map them to different air interface priority queues, thereby ensuring that high-priority services such as voice and video are sent first. If all services are uniformly encapsulated into the same IPsec tunnel, the outer IP header DSCP is uniformly refreshed to the default value. The NIC module can only see packets of "same priority" and cannot distinguish them for processing. When congestion occurs, even high-priority services will lose packets, such as... Figure 2 As shown. Figure 2 This is a schematic diagram of DSCP remapping of a packet that is not encapsulated by IPsec in the prior art, as shown in one embodiment.

[0061] Existing methods can only differentiate downlink traffic for QoS on the TNGF / UPF (User Plane Function) side, and still lack effective differentiation and scheduling capabilities for the "terminal → TNGF" direction.

[0062] Based on the aforementioned traditional technologies, this application provides a communication method that determines the target IPsec sub-tunnel through the inner DSCP value and adds the DSCP value of the target IPsec sub-tunnel to the outer IP header of the packet to be sent. This realizes the mirroring of the inner DSCP value to the outer IP header, thereby enabling the DSCP value in the outer IP packet to identify the service priority of the packet to be sent and transmit the packet to be sent according to the priority order. This achieves timely transmission of application data for high-priority services and ensures the high-priority services.

[0063] It should be noted that the beneficial effects or technical problems solved by the embodiments of this application are not limited to this one, but may also be other implicit or related problems. For details, please refer to the description of the embodiments below.

[0064] Before introducing specific embodiments of the present invention, the technical terms involved in the present invention will be explained:

[0065] TNGF (Trusted Non-3GPP Gateway Function): A gateway function entity in the 3GPP 5G core network used for trusted non-3GPP access scenarios (such as Wi-Fi).

[0066] IPsec tunnel: A secure tunnel built on the IKE / IPsec protocol stack, used to encrypt / protect the integrity of IP services in untrusted or semi-trusted networks.

[0067] DSCP (Differentiated Services Code Point): Located in the DS (Differentiated Services Field) field of the IPv4 / IPv6 (Internet Protocol version 4 / Internet Protocol version 6) packet header, it is used for traffic classification (QCI / 5QI (QCI is the Quality of Service Category Identifier, 5QI is the 5G Quality of Service Indicator) is often used when mapping to DSCP (Differentiated Services Code Point) end-to-end).

[0068] QoS Rule: In 5G systems, traffic filtering and QoS (Quality of Service) parameter rules are issued to the terminal (UE) by the PCF / UPF (PCF stands for Policy Control Function, UPF stands for User Plane Function).

[0069] QoS Flow: Service flows that satisfy the same QoS Rule and apply the same 5QI / ARP (ARP stands for Allocation and Retention Priority).

[0070] Child SA (Security Association): Multiple IPsec subtunnels can be created under the same IKE SA to map different service flows to different encrypted channels.

[0071] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0072] In one embodiment, such as Figure 3As shown, a communication method is provided. This application describes the method applied to a terminal as an example. The terminal can be a wireless terminal, which can be a device providing voice and / or other service data connectivity to a user, a handheld device with wireless connectivity, or other processing devices connected to a wireless modem. The wireless terminal can communicate with one or more core networks via a Radio Access Network (RAN). The wireless terminal can be a mobile terminal, such as a mobile phone (or "cellular" phone) or a computer with a mobile terminal, for example, a portable, pocket-sized, handheld, computer-embedded, or vehicle-mounted mobile device. These exchange voice and / or data with the radio access network. The wireless terminal can also be referred to as a system, subscriber unit, subscriber station, mobile station, mobile, remote station, remote terminal, access terminal, user terminal, user agent, or user device or user equipment, without limitation herein. This application embodiment does not limit the execution device of a communication method, including the following steps 302 to 306:

[0073] Step 302: Obtain the packets to be sent corresponding to each application's traffic.

[0074] The message to be sent contains the inner differential service code point (DSCP) value; the inner DSCP value represents the service priority of the application traffic.

[0075] In practice, the terminal acquires the traffic of each application, determines the inner DSCP value of each application traffic according to the quality of service rules, and generates a message to be sent based on the application traffic and the inner DSCP value of the application traffic.

[0076] Specifically, the terminal has pre-configured Quality of Service (QoS) rules. These QoS rules define the mapping relationship between the priority of each service and the DSCP values. The terminal obtains application traffic from the upper-layer applications. Then, for each application traffic, the terminal determines the inner DSCP value of the application traffic based on the service to which the application traffic belongs and the mapping relationship between the priority of each service and the DSCP values. Based on the application traffic and its inner DSCP value, the terminal generates a message to be sent.

[0077] Step 304: For each message to be sent, determine the target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent based on the inner DSCP value, and determine the DSCP value corresponding to the target IPsec sub-tunnel.

[0078] In implementation, for each packet to be sent, the terminal determines whether the sending strategy of the packet is an encrypted sending strategy based on the Quality of Service (QoS) rules. If the sending strategy of the packet to be sent is an encrypted sending strategy, the terminal determines the target Internet Security Protocol (IPsec) sub-tunnel that the packet to be sent matches based on the inner DSCP value, and determines the DSCP value corresponding to the target IPsec tunnel.

[0079] Specifically, the terminal determines the transmission strategy for each packet to be sent based on the Quality of Service (QoS) rules. If the transmission strategy for the packet to be sent is an encrypted transmission strategy, the terminal uses the source IP address, destination IP address, and inner DSCP value of the packet to be sent to determine the target IPsec sub-tunnel (also known as the Child SA) that matches the packet to be sent, and determines the DSCP value corresponding to the target IPsec sub-tunnel.

[0080] In an optional embodiment, if the sending strategy of the message to be sent is a plaintext sending strategy, the terminal directly transmits the message to be sent to the network card module.

[0081] Step 306: Add the DSCP value of the target IPsec subtunnel to the outer Internet Protocol header of the message to be sent, and transmit the message to be sent based on the priority order represented by the DSCP value of the target IPsec subtunnel.

[0082] In implementation, the terminal adds the DSCP value of the target IPsec subtunnel to the outer Internet Protocol (IP) header of the packet to be sent, thereby mirroring / mapping the inner DSCP value to the outer DSCP value. The terminal transmits the packet to be sent to the network interface card (NIC) module through the target IPsec subtunnel. Then, the NIC module in the terminal transmits the packet according to the priority order represented by the DSCP value of the target IPsec subtunnel.

[0083] Specifically, the terminal encrypts the message to be sent, obtaining an encrypted message, and adds the DSCP value of the target IPsec sub-tunnel to the outer IP header of the encrypted message. The terminal transmits the encrypted message to the network interface card (NIC) module through the target IPsec sub-tunnel. The NIC module determines the target NIC resource queue corresponding to the message to be sent based on the DSCP value in the outer IP header, and sends the encrypted message based on the priority order of each NIC resource queue and the target NIC resource queue.

[0084] In the above communication method, the target IPsec sub-tunnel is determined by the inner DSCP value, and the DSCP value of the target IPsec sub-tunnel is added to the outer IP header of the message to be sent. This realizes the mirroring of the inner DSCP value to the outer IP header, so that the service priority of the message to be sent can be identified by the DSCP value in the outer IP message, and the message to be sent can be transmitted according to the priority order. This realizes the timely transmission of application data of high-priority services and ensures the high-priority services.

[0085] In one embodiment, such as Figure 4 As shown, the specific processing steps of step 302 may include:

[0086] Step 402: Obtain the traffic of each application and determine the inner DSCP value and 5G mobile communication technology service quality identifier 5QI of each application traffic according to the preset service quality rules.

[0087] Application traffic refers to application data generated by applications that need to be transmitted.

[0088] In implementation, the terminal is pre-configured with Quality of Service (QoS) rules. These QoS rules include DSCP and 5QI rules. Various applications are pre-installed on the terminal. Each application executes different services and generates application traffic. The terminal obtains this application traffic from the applications. For each application traffic, the terminal determines its inner DSCP value and 5QI based on the DSCP and 5QI rules.

[0089] Specifically, the DSCP rule is a DSCP mapping table. This mapping table contains the mapping relationship between each DSCP value and each traffic type. For each application traffic, the terminal determines the traffic type of the application traffic based on the service to which the application traffic belongs. Then, the terminal determines the inner DSCP value of the application traffic based on the mapping relationship between each DSCP value and each traffic type, as well as the traffic type of the application traffic. Based on the traffic type of the application traffic, the current network conditions, the user subscription information of the terminal's user, and the 5QI rule, the terminal determines the 5QI of the application traffic. For example, if the service to which the application traffic belongs is a real-time service (voice, video), then the service priority represented by the inner DSCP value of the application traffic is higher.

[0090] Step 404: Obtain the message to be sent based on the inner DSCP value and the 5QI encapsulated application traffic.

[0091] In practice, the terminal generates a protocol header based on the 5G network protocol and 5QI, and generates a message to be sent based on the inner layer of the protocol header, the DSCP value, and the application traffic.

[0092] In one optional embodiment, the 5G network protocol is the User Plane GPRS (General Packet Radio Service) tunneling protocol. The terminal adds an outer header to the application traffic. This outer header is the GTP-U (GPRS Tunneling Protocol for the User Plane) header. The terminal adds 5QI to the GTP-U header and integrates the application traffic, the inner IP header (containing the inner DSCP value), and the GTP-U header according to a specified format to obtain the message to be sent. The message to be sent contains the source IP address and the destination IP address.

[0093] In this embodiment, the inner DSCP value and 5QI are determined by the quality of service rules, and the application traffic is encapsulated based on the inner DSCP value and 5QI to obtain the message to be sent. The service priority of the message to be sent can be clearly defined by the inner DSCP value, which facilitates the subsequent sending of the message to be sent.

[0094] In one embodiment, before determining the target IPsec sub-tunnel that the packet to be sent matches, it is also necessary to determine whether the packet to be sent is transmitted in encrypted form. Therefore, as Figure 5 As shown, before step 304 is executed, the specific processing procedure of this communication method may further include:

[0095] Step 502: Determine the sending strategy corresponding to each message to be sent according to the preset quality of service rules.

[0096] The transmission strategy includes plaintext transmission and encrypted transmission. The plaintext transmission strategy involves sending packets directly through a "plaintext queue." The encrypted transmission strategy employs an IPsec encryption process.

[0097] In practice, the terminal determines the corresponding sending strategy for each message to be sent based on the quality of service rules.

[0098] Specifically, the message to be sent contains network layer information, transport layer information, and application layer information. The terminal matches the network, transport, and application layer information in the message with preset quality of service (QoS) rules to obtain the traffic category of the message and the QoS requirements for that traffic category. The terminal then determines the corresponding sending strategy for the message based on the traffic category and QoS requirements.

[0099] Step 504: If the sending strategy is plaintext sending strategy, the message to be sent is transmitted to the network card module, and the message to be sent is transmitted uplink through the network card module.

[0100] In practice, if the transmission strategy is plaintext transmission, the terminal directly transmits the message to be sent to the network interface card (NIC) module. The NIC module then sends the message to be sent uplink to the base station.

[0101] Step 506: If the sending strategy is an encrypted sending strategy, perform the step of determining the target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent based on the inner DSCP value for each message to be sent.

[0102] In implementation, if the sending strategy is an encrypted sending strategy, the terminal executes step 304 above. The specific processing procedure of step 304 has been described in detail in the above embodiments, and will not be repeated here in the embodiments of this application.

[0103] In one exemplary embodiment, the terminal adds a QoS tagging module and an IPsec processing module. The QoS tagging module is used to filter and tag each application traffic based on QoS rules (inner DSCP value / 5QI), and generate packets to be sent. The QoS tagging module is also used to decide, according to QoS rules, whether the traffic should directly go through the "plaintext queue" (plaintext transmission policy) or enter the IPsec encryption process (encrypted transmission policy). Figure 6 This is a schematic diagram illustrating the outer layer mapping of different DSCP packets by the IPsec processing module in one embodiment. For example... Figure 6 As shown, the terminal acquires each data stream. Here, the data streams are application traffic. The data streams are data stream 1, data stream 2, data stream 3, and data stream 4. The QoS tagging module in the terminal tags and encapsulates data streams 1, 2, 3, and 4 respectively, obtaining the corresponding packets to be sent for each data stream. The packet to be sent for data stream 1 is packet 1, with an inner DSCP value of 1; the packet to be sent for data stream 2 is packet 2, with an inner DSCP value of 2; the packet to be sent for data stream 3 is packet 3, with an inner DSCP value of 3; and the packet to be sent for data stream 4 is packet 4, with an inner DSCP value of 4. Then, the QoS tagging module in the terminal determines the sending strategy for each packet to be sent. For packet 1, the corresponding sending strategy is a plaintext sending strategy. Therefore, packet 1 to be sent retains its inner DSCP value of 1 and is directly transmitted in plaintext to the network interface card (NIC) module. The NIC module then performs uplink transmission of packet 1. Packets 2, 3, and 4 to be sent all follow encrypted transmission strategies. Therefore, packets 2, 3, and 4 enter different QoS flows according to the QoS rules. The IPsec processing module selects / creates an independent Child-SA for each QoS flow and mirrors the inner DSCP to the outer header, achieving "multi-tunnel, multi-priority" coexistence.

[0104] In this embodiment, a transmission strategy is determined for each packet to be sent using Quality of Service (QoS) rules, thereby achieving packet diversion. Furthermore, when the transmission strategy is encryption, a target IPsec sub-tunnel is determined to facilitate subsequent transmission of the packets to be sent.

[0105] In one embodiment, such as Figure 7 As shown, step 304, which involves determining the target IPsec subtunnel matching each message to be sent based on the inner DSCP value, may include:

[0106] Step 702: Based on the source Internet Protocol address, destination Internet Protocol address, and inner DSCP value of the message to be sent, determine whether there is a target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent.

[0107] In implementation, multiple IPsec subtunnels (Child SAs) can be created under the same IKE SA. IPsec subtunnels are determined based on transmission requirements. When an IPsec subtunnel needs to be established, the terminal negotiates a new IPsec subtunnel based on the source IP address, destination IP address, and inner DSCP value of the packet to be transmitted. Therefore, the terminal determines whether a target IPsec subtunnel matching the packet exists based on the source IP address, destination IP address, and inner DSCP value of the packet to be transmitted. If a target IPsec subtunnel exists, the terminal executes step 704 below. If no target IPsec subtunnel exists, the terminal executes step 802 below.

[0108] Step 704: If a target IPsec subtunnel exists, record the DSCP value of the target IPsec subtunnel.

[0109] In practice, if a target IPsec subtunnel exists, the terminal records the DSCP value of the target IPsec subtunnel. This DSCP value represents the priority of each packet to be sent in the target IPsec subtunnel.

[0110] In this embodiment, the target IPsec tunnel corresponding to the packet to be sent is determined by the inner DSCP value of the packet to be sent, and the DSCP value of the target IPsec tunnel is recorded. The target IPsec tunnel that can transmit the packet to be sent is obtained, which facilitates the subsequent classification of the packet to be sent based on the DSCP value of the target IPsec tunnel. This solves the industry pain point that IPsec encapsulation causes the uplink traffic to be unable to be classified.

[0111] In one embodiment, if a target IPsec subtunnel does not exist, a new IPsec subtunnel needs to be negotiated. Therefore, as... Figure 8As shown, after step 702 is executed, the specific processing procedure of this communication method may further include:

[0112] Step 802: If no target IPsec subtunnel exists, negotiate a new IPsec subtunnel based on the source Internet Protocol address, target Internet Protocol address, and inner DSCP value in the message to be sent.

[0113] In practice, if no target IPsec subtunnel exists, the terminal negotiates and establishes a new IPsec subtunnel based on the source IP address, target IP address, and inner DSCP value in the message to be sent.

[0114] Specifically, if no target IPsec subtunnel exists, the terminal initiates negotiation with the network interface card (NIC) module based on the target IP address and source IP address, and establishes a secure IKE SA. Then, the terminal sends a CREATE_CHILD_SA (establish IPsec subtunnel) message to the NIC module based on the inner layer number (DSCP) value, and establishes a new IPsec subtunnel with the NIC module based on the CREATE_CHILD_SA message.

[0115] Step 804 involves determining whether a target Internet Security Protocol (IPsec) sub-tunnel exists that matches the source Internet Protocol address, target Internet Protocol address, and inner DSCP value of the message to be sent.

[0116] In implementation, the terminal continues to execute step 702 as described above. The specific processing procedure of step 702 has been described in detail in the above embodiments, and will not be repeated here. At this time, the terminal will determine the new IPsec sub-tunnel as the target IPsec sub-tunnel corresponding to the packet to be sent, and record the DSCP value corresponding to the target IPsec sub-tunnel.

[0117] In this embodiment, in the absence of a target IPsec tunnel, a new IPsec tunnel is negotiated using the information of the message to be sent, thereby establishing a personalized new IPsec tunnel to facilitate subsequent transmission of the message to be sent.

[0118] In one embodiment, such as Figure 9 As shown, the specific process of adding the DSCP value of the target IPsec sub-tunnel to the outer Internet Protocol header of the message to be sent in step 306 may include:

[0119] Step 902: Encrypt the message to be sent to obtain the encrypted message, and add the DSCP value of the target IPsec sub-tunnel to the outer Internet Protocol header of the encrypted message.

[0120] In implementation, the terminal encrypts the message to be sent based on the IKE / IPsec protocol to obtain an encrypted message. Then, the terminal adds the DSCP value of the target IPsec sub-tunnel to the outer IP header of the encrypted message to obtain an encrypted message with a DSCP tag.

[0121] Specifically, the terminal selects the IPsec protocol and encrypts the message to be sent according to the selected IPsec protocol and the encryption algorithm and key in IKE, obtaining an encrypted message. Then, the terminal adds the DSCP value of the target IPsec subtunnel to the outer IP header of the encrypted message, resulting in an encrypted message with a DSCP tag. By adding the DSCP value of the target IPsec subtunnel to the outer IP header, the "inner DSCP" is mirrored / mapped to the "outer IP DSCP".

[0122] Step 904: Transmit encrypted packets to the network interface card module based on the target IPsec sub-tunnel.

[0123] In practice, the terminal transmits encrypted packets from the IPsec processing module to the network interface card module through the target IPsec sub-tunnel.

[0124] In one exemplary embodiment, an IPsec processing module is added to the terminal. This IPsec processing module is used to map traffic (packets to be sent) to different IPsec Child SAs (IPsec subtunnels) according to QoS Flow, and to mirror / map the "inner DSCP" to the "outer IP DSCP". Figure 10 This is a flowchart illustrating the workflow of the IPsec processing module in one embodiment. Figure 10 As shown, the IPsec processing module flow includes:

[0125] Step 1001: Receive an unencrypted message with a DSCP tag. Here, the DSCP tag is the inner DSCP value, and the unencrypted message is the message to be sent.

[0126] Step 1002: Determine if there is a target Child SA that matches the source, destination, and DSCP QoSFlow. If a target Child SA exists, proceed to step 1003; otherwise, proceed to step 1006.

[0127] Step 1003: Record the DSCP value of the target Child SA.

[0128] Step 1004: Encrypt the unencrypted message to obtain an encrypted message.

[0129] Step 1005: Add the DSCP value of the target Child SA to the outer IP packet of the encrypted message.

[0130] Step 1006 involves establishing or modifying the session flow. Establishing or modifying the session flow involves quickly negotiating a new Child-SA.

[0131] In this embodiment, the DSCP value of the IPsec sub-tunnel is added to the encrypted message by the target, so that the network card module can determine the service priority of the message to be sent according to the outer header. This makes it easier for the network card module to prioritize the use of the network card resource queue to send the message with higher service priority, thus ensuring the availability and stability of real-time services (voice and video) with higher service priority in the trusted Wi-Fi environment.

[0132] In one embodiment, such as Figure 11 As shown, the specific processing procedure in step 306 for transmitting the packets to be sent based on the priority order represented by the DSCP value of the target IPsec sub-tunnel may include:

[0133] Step 1102: Determine the target network interface resource queue corresponding to the packet to be sent by using the network interface module and the DSCP value in the outer IP header.

[0134] In implementation, the network interface card (NIC) module pre-configures the correspondence between each DSCP value and each NIC resource queue. The NIC module in the terminal determines the target NIC resource queue corresponding to the packet to be sent based on the DSCP values ​​in the outer header and the correspondence between each DSCP value and each NIC resource queue.

[0135] Step 1104: Based on the network interface card (NIC) module, add the encrypted message corresponding to the message to be sent to the target NIC resource queue, and send the encrypted message in the target NIC resource queue according to the priority order of each NIC resource queue.

[0136] In implementation, the terminal has a pre-set priority order for network interface card (NIC) resource queues. The NIC module in the terminal adds the encrypted packet corresponding to the packet to be sent to the target NIC resource queue. Then, the NIC module sends the encrypted packet from the target NIC resource queue uplink according to the priority order of each NIC resource queue.

[0137] In one exemplary embodiment, Figure 12 This is a schematic diagram illustrating the outer layer mapping of different DSCP packets by the IPsec processing module in one embodiment. For example... Figure 12As shown, the IPsec processing module receives packets 2, 3, and 4 to be sent. Packet 2 belongs to QoS Flow 1, and its inner DSCP value is 2 (DSCP flag 2). Packet 3 belongs to QoS Flow 2, and its inner DSCP value is 3 (DSCP flag 3). Packet 4 belongs to QoS Flow 3, and its inner DSCP value is 4 (DSCP flag 4).

[0138] The terminal determines that the target IPsec sub-tunnel corresponding to QoS Flow1 is Child SA1, and records the DSCP value of Child SA1 as 1 (DSCP flag 1). The terminal determines that the target IPsec sub-tunnel corresponding to QoS Flow2 is Child SA2, and records the DSCP value of Child SA2 as 2 (DSCP flag 2). The terminal determines that the target IPsec sub-tunnel corresponding to QoS Flow3 is Child SA3, and records the DSCP value of Child SA3 as 3 (DSCP flag 3). The terminal adds DSCP value 1 to the outer IP header of packet 2 to be sent, and adds DSCP value 2 to the outer IP header of packet 3 to be sent. At the same time, the terminal adds DSCP value 3 to the outer IP header of packet 4 to be sent.

[0139] The terminal transmits packet 2 to the network interface card (NIC) module based on Child SA1. The NIC module adds packet 2 to NIC resource queue 1 according to its outer DSCP value 1, and sends the packet 2 in queue 1 according to the priority order of each NIC resource queue. The terminal transmits packet 3 to the NIC module based on Child SA2. The NIC module adds packet 3 to NIC resource queue 2 according to its outer DSCP value 2, and sends the packet 3 in queue 2 according to the priority order of each NIC resource queue. The terminal transmits packet 4 to the NIC module based on Child SA3. The NIC module adds packet 4 to NIC resource queue 2 according to its outer DSCP value 3, and sends the packet 4 in queue 2 according to the priority order of each NIC resource queue.

[0140] Optionally, the mapping relationship between the DSCP value and the network interface card resource queue can be 1:n or 1:1, and this embodiment does not limit this.

[0141] In this embodiment, the service priority of the packets to be sent is identified by the DSCP value in the outer IP packet, and the packets are transmitted according to the priority order, thus ensuring the timely transmission of application data for high-priority services. Furthermore, this application does not require modification of the 3GPP standard or the TNGF / UPF side protocol; it can be implemented simply by upgrading the terminal software, making it convenient to use.

[0142] It should be understood that, although Figure 2-12 The steps in the flowchart are shown sequentially as indicated by the arrows, but these steps are not necessarily executed in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order in which these steps are executed, and they can be performed in other orders. Figure 2-12 At least some of the steps in the process may include multiple steps or multiple stages. These steps or stages are not necessarily completed at the same time, but may be executed at different times. The execution order of these steps or stages is not necessarily sequential, but may be executed in turn or alternately with other steps or at least some of the steps or stages in other steps.

[0143] In one embodiment, such as Figure 13 As shown, a communication device 1300 is provided, including: an acquisition module 1301, a determination module 1302, and a transmission module 1303, wherein:

[0144] The acquisition module 1301 is used to acquire the packets to be sent corresponding to each application traffic; the packets to be sent contain the inner differential service code point (DSCP) value; the inner DSCP value represents the service priority of the application traffic.

[0145] The determination module 1302 is used to determine, for each message to be sent, the target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent based on the inner DSCP value, and to determine the DSCP value corresponding to the target IPsec sub-tunnel.

[0146] The transmission module 1303 is used to add the DSCP value of the target IPsec subtunnel to the outer Internet Protocol header of the message to be sent, and to transmit the message to be sent based on the priority order represented by the DSCP value of the target IPsec subtunnel.

[0147] In one exemplary embodiment, the acquisition module 1301 includes:

[0148] The first acquisition submodule is used to acquire the traffic of each application and determine the inner DSCP value and the 5G mobile communication technology service quality identifier 5QI of each application traffic according to the preset service quality rules.

[0149] The first encapsulation submodule is used to obtain the message to be sent based on the inner DSCP value and the 5QI encapsulated application traffic.

[0150] In one exemplary embodiment, the communication device 1300 further includes:

[0151] The second determining module is used to determine the sending strategy corresponding to each message to be sent according to the preset quality of service rules.

[0152] The first transmission module is used to transmit the message to be sent to the network card module if the sending strategy is a plaintext sending strategy, and to transmit the message to be sent uplink through the network card module.

[0153] The first execution module is used to, if the sending strategy is an encrypted sending strategy, perform the following steps for each message to be sent: determining the target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent based on the inner DSCP value.

[0154] In an exemplary embodiment, the determining module 1302 includes a first determining submodule and a second determining submodule. The first determining submodule includes:

[0155] The first judgment submodule is used to determine whether there is a target Internet Security Protocol (IPsec) subtunnel that matches the message to be sent, based on the source Internet Protocol address, the target Internet Protocol address, and the inner DSCP value of the message to be sent.

[0156] The recording submodule is used to record the DSCP value of the target IPsec subtunnel if it exists.

[0157] In one exemplary embodiment, the communication device 1300 further includes:

[0158] The negotiation module is used to negotiate a new IPsec subtunnel if the target IPsec subtunnel does not exist, based on the source Internet Protocol address, the target Internet Protocol address, and the inner DSCP value in the message to be sent.

[0159] The second execution module is used to perform the step of determining whether there is a target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent, based on the source Internet Protocol address, the target Internet Protocol address, and the inner DSCP value of the message to be sent.

[0160] In one exemplary embodiment, the transmission module 1303 includes a first adding submodule and a second transmission submodule. The first adding submodule includes:

[0161] The encryption submodule is used to encrypt the message to be sent, obtain the encrypted message, and add the DSCP value of the target IPsec subtunnel to the outer Internet Protocol header of the encrypted message.

[0162] The third transmission submodule is used to transmit encrypted packets to the network interface card module based on the target IPsec sub-tunnel.

[0163] In one exemplary embodiment, the transmission module 1303 includes a first adding submodule and a second transmission submodule. The second transmission submodule includes:

[0164] The third determination submodule is used to determine the target network interface resource queue corresponding to the packet to be sent by using the network interface module and the DSCP value in the outer IP header.

[0165] The sending submodule is used to add the encrypted message corresponding to the message to be sent to the target network interface card resource queue based on the network interface card module, and send the encrypted message in the target network interface card resource queue according to the priority order of each network interface card resource queue.

[0166] Specific limitations regarding the communication device can be found in the limitations regarding the communication method above, and will not be repeated here. Each module in the aforementioned communication device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in hardware or independently of the processor in the computer device, or stored in software in the memory of the computer device, so that the processor can call and execute the operations corresponding to each module.

[0167] In one embodiment, a communication device is provided, see [link to previous document]. Figure 14 . Figure 14 This is a schematic diagram of the structure of the terminal device provided in an embodiment of the present invention. Figure 14 The terminal device 1400 shown includes at least one processor 1401, a memory 1402, at least one network interface 1404, and a user interface 1403. The various components in the terminal device 1400 are coupled together via a bus system 1405. It is understood that the bus system 1405 is used to implement communication between these components. In addition to a data bus, the bus system 1405 also includes a power bus, a control bus, and a status signal bus. However, for clarity, ... Figure 14 Various buses are designated as bus system 1405. Additionally, this embodiment of the invention includes a transceiver 1406, which may consist of multiple components, including a transmitter and a receiver, providing a unit for communicating with various other devices over a transmission medium.

[0168] The user interface 1403 may include a display, keyboard, or clicking device (e.g., mouse, trackball, touchpad, or touchscreen).

[0169] It is understood that the memory 1402 in the embodiments of the present invention can be volatile memory or non-volatile memory, or may include both volatile and non-volatile memory. The non-volatile memory can be read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), or flash memory. The volatile memory can be random access memory (RAM), which is used as an external cache. By way of example, but not limitation, many forms of RAM are available, such as Static Random Access Memory (SRAM), Dynamic Random Access Memory (DRAM), Synchronous DRAM (SDRAM), Double Data Rate SDRAM (DDR SDRAM), Enhanced Synchronous DRAM (ESDRAM), Synchlink DRAM (SLDRAM), and Direct Rambus RAM (DRRAM). The memory 1402 of the systems and methods described in this embodiment is intended to include, but is not limited to, these and any other suitable types of memory.

[0170] In some implementations, memory 1402 stores elements, executable modules or data structures, or subsets thereof, or extended sets thereof: operating system 14021 and application program 14022.

[0171] The operating system 14021 includes various system programs, such as the framework layer, core library layer, and driver layer, used to implement various basic business functions and handle hardware-based tasks. The application program 14022 includes various applications, such as a media player and a browser, used to implement various application functions. The program implementing the method of this embodiment can be included in the application program 14022.

[0172] In this embodiment of the invention, by calling the program or instructions stored in memory 1402, specifically the program or instructions stored in application program 14022, the processor is used to obtain the packets to be sent corresponding to each application traffic; the packets to be sent contain inner differential service code point (DSCP) values; the inner DSCP values ​​represent the service priority of the application traffic; for each packet to be sent, based on the inner DSCP values, the target Internet Security Protocol (IPsec) sub-tunnel matching the packet to be sent is determined, and the DSCP value corresponding to the target IPsec sub-tunnel is determined; the DSCP value of the target IPsec sub-tunnel is added to the outer Internet Protocol (IP) header of the packet to be sent, and the packets to be sent are transmitted based on the priority order represented by the DSCP value of the target IPsec sub-tunnel.

[0173] The methods disclosed in the above embodiments of the present invention, in part or in all of them, can also be applied to processor 1401, implemented by processor 1401, or implemented by processor 1401 in conjunction with other components (e.g., transceivers). Processor 1401 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above methods can be completed by the integrated logic circuit of the hardware in processor 1401 or by instructions in the form of software. The processor 1401 may be a general-purpose processor, a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a field-programmable gate array (FPGA), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components. It can implement or execute the methods, steps, and logic block diagrams disclosed in the embodiments of the present invention. The general-purpose processor may be a microprocessor or any conventional processor. The steps of the methods disclosed in the embodiments of the present invention can be directly embodied in the execution of a hardware decoding processor, or executed by a combination of hardware and software modules in the decoding processor. The software module can reside in a mature storage medium in the art, such as random access memory, flash memory, read-only memory, programmable read-only memory, electrically erasable programmable memory, or registers. This storage medium is located in memory 1402. Processor 1401 reads the information in memory 1402 and, in conjunction with its hardware, completes the steps of the above method.

[0174] It is understood that the embodiments described in this invention can be implemented using hardware, software, firmware, middleware, microcode, or a combination thereof. For hardware implementation, the processing unit can be implemented in one or more application-specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field-programmable gate arrays (FPGAs), general-purpose processors, controllers, microcontrollers, microprocessors, other electronic units for performing the functions described in this application, or combinations thereof.

[0175] For software implementation, the technology described in the embodiments of the present invention can be implemented by modules (e.g., procedures, functions, etc.) that perform the functions described in the embodiments of the present invention. The software code can be stored in memory and executed by processor 1401. The memory can be implemented in processor 1401 or external to processor 1401.

[0176] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon that, when executed by a processor, implements the steps in the above method embodiments.

[0177] In one embodiment, a computer program product is provided, including a computer program that, when executed by a processor, implements the steps in the above method embodiments.

[0178] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. Any references to memory, storage, databases, or other media used in the embodiments provided in this application can include at least one of non-volatile and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, or optical storage, etc. Volatile memory can include random access memory (RAM) or external cache memory. By way of illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM), etc.

[0179] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0180] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are relatively specific and detailed, they should not be construed as limiting the scope of the invention patent. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this patent application should be determined by the appended claims.

Claims

1. A communication method, characterized in that, The method includes: Obtain the packets to be sent corresponding to each application traffic; the packets to be sent contain the inner differential service code point (DSCP) value; the inner DSCP value represents the service priority of the application traffic. For each message to be sent, the target Internet Security Protocol (IPsec) sub-tunnel matching the message to be sent is determined based on the inner DSCP value, and the DSCP value corresponding to the target IPsec sub-tunnel is determined. The DSCP value of the target IPsec subtunnel is added to the outer Internet Protocol header of the message to be sent, and the message to be sent is transmitted based on the priority order represented by the DSCP value of the target IPsec subtunnel.

2. The method according to claim 1, characterized in that, The step of obtaining the packets to be sent corresponding to each application's traffic includes: The application traffic is acquired, and the inner DSCP value and 5G mobile communication technology service quality identifier 5QI of each application traffic are determined according to the preset service quality rules. The application traffic is encapsulated using the inner DSCP value and the 5QI to obtain the message to be sent.

3. The method according to claim 1, characterized in that, Before determining the target Internet Security Protocol (IPsec) sub-tunnel matching the message to be sent based on the inner DSCP value for each message to be sent, the method further includes: The sending strategy corresponding to each message to be sent is determined according to the preset quality of service rules; If the sending strategy is a plaintext sending strategy, the message to be sent is transmitted to the network card module, and the message to be sent is transmitted uplink through the network card module; If the sending strategy is an encrypted sending strategy, the step of determining the target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent for each message to be sent based on the inner DSCP value is executed.

4. The method according to claim 1, characterized in that, For each message to be sent, determining the target IPsec sub-tunnel matching the message to be sent based on the inner DSCP value includes: Based on the source Internet Protocol address, target Internet Protocol address, and inner DSCP value of the message to be sent, determine whether there is a target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent; If the target IPsec sub-tunnel exists, record the DSCP value of the target IPsec sub-tunnel.

5. The method according to claim 4, characterized in that, After determining whether a target Internet Security Protocol (IPsec) sub-tunnel corresponding to the message to be sent exists, the method further includes: If the target IPsec subtunnel does not exist, negotiate a new IPsec subtunnel based on the source Internet Protocol address, target Internet Protocol address, and inner DSCP value in the message to be sent; Perform the step of determining whether there is a target Internet Security Protocol (IPsec) sub-tunnel that matches the message to be sent, based on the source Internet Protocol address, target Internet Protocol address, and inner DSCP value of the message to be sent.

6. The method according to claim 1, characterized in that, Adding the DSCP value of the target IPsec sub-tunnel to the outer Internet Protocol header of the message to be sent includes: The message to be sent is encrypted to obtain an encrypted message, and the DSCP value of the target IPsec sub-tunnel is added to the outer Internet Protocol header of the encrypted message; The encrypted message is transmitted to the network card module based on the target IPsec sub-tunnel.

7. The method according to claim 1, characterized in that, The transmission of the message to be sent based on the priority order represented by the DSCP value of the target IPsec sub-tunnel includes: The target network interface resource queue corresponding to the message to be sent is determined by the DSCP value in the network interface module and the outer IP header; The network interface card (NIC) module adds the encrypted message corresponding to the message to be sent to the target NIC resource queue, and sends the encrypted message in the target NIC resource queue according to the priority order of each NIC resource queue.

8. A communication device, characterized in that, The device includes: The acquisition module is used to acquire the packets to be sent corresponding to each application traffic; the packets to be sent contain the inner differential service code point (DSCP) value; the inner DSCP value represents the service priority of the application traffic. The determination module is used to determine, for each packet to be sent, the target Internet Security Protocol (IPsec) sub-tunnel matched by the inner DSCP value, and determine the DSCP value corresponding to the target IPsec sub-tunnel. The transmission module is configured to add the DSCP value of the target IPsec subtunnel to the outer Internet Protocol header of the message to be sent, and transmit the message to be sent based on the priority order represented by the DSCP value of the target IPsec subtunnel.

9. A communication device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

11. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by a processor, it implements the steps of the method according to any one of claims 1 to 7.

Images