Message processing method, electronic device, and computer-readable storage medium

Abstract

The present disclosure belongs to the technical field of communications. Provided are a message processing method, an electronic device, and a computer-readable storage medium. The message processing method comprises: acquiring an original message to be transmitted by a sending-end device in an industry network; determining authentication information corresponding to the sending-end device, wherein the authentication information comprises an attribute label corresponding to the sending-end device and a data marker fingerprint, the data marker fingerprint is generated on the basis of target data, and the target data comprises the attribute label; on the basis of the original message and the authentication information, generating a target message, wherein a target payload of the target message comprises the authentication information and an original payload of the original message; and sending the target message.

Description

Method for processing packet, electronic device and computer readable storage medium

[0001] Cross-reference to Related Applications

[0002] The present disclosure claims priority to Chinese Patent Application No. 202410472469.9, filed on April 18, 2024, the contents of which are incorporated herein by reference in their entirety. TECHNICAL FIELD

[0003] The present disclosure relates to the field of communication technology, and in particular, to a method for processing a packet, an electronic device, and a computer readable storage medium. BACKGROUND

[0004] Network security is a complete security system including identity authentication, vulnerability management, data protection, and transmission security. In an untrusted network environment, transmission security uses data encryption, digital certificates, and firewall technology to protect data integrity, confidentiality, and availability during network communication, and prevent unauthorized access, data tampering, and communication interruption. Transmission security involves a series of technologies: security protocols based on data encryption (such as Media Access Control Security (MACsec), Internet Protocol Security (IPsec), and Secure Socket Layer (SSL) / Transport Layer Security (TLS)) and identity authentication technologies (including digital signatures, Public Key Infrastructure (PKI), and other technologies).

[0005] In a trusted network environment such as a professional network (referred to as a professional network), the packet transmission traffic is large, and the requirement for network security is high. How to ensure the network security of a trusted network environment such as a professional network is a problem to be solved. SUMMARY

[0006] The first aspect of the present disclosure provides a method for processing a packet, comprising: obtaining an original packet to be transmitted by a sending device in an industry network; determining authentication information corresponding to the sending device, the authentication information comprising an attribute tag corresponding to the sending device and a data marking fingerprint, the data marking fingerprint being generated according to target data, the target data comprising the attribute tag; generating a target packet according to the original packet and the authentication information, the target payload of the target packet comprising the authentication information and the original payload of the original packet; and sending the target packet.

[0007] The second aspect of the present disclosure provides a method for processing a packet, comprising: receiving a target packet from a sending device in an industry network; obtaining authentication information from a target payload of the target packet, the authentication information comprising an attribute tag and a data tag fingerprint corresponding to the sending device; performing security verification according to the authentication information, and determining an original packet according to the target packet and processing the original packet when the security verification is passed.

[0008] The third aspect of the present disclosure provides an electronic device, comprising: at least one processor; a memory having at least one computer program stored thereon, when the at least one computer program is executed by the at least one processor, the at least one processor implements the method according to the first aspect or the second aspect; and at least one I / O interface connected between the processor and the memory, configured to realize information interaction between the processor and the memory.

[0009] The fourth aspect of the present disclosure provides a computer-readable storage medium having a computer program stored thereon, when the computer program is executed by a processor, the processor implements the method according to the first aspect or the second aspect. BRIEF DESCRIPTION OF DRAWINGS

[0010] FIG. 1 is a flowchart of a method for processing a packet of a sending device according to an embodiment of the present disclosure;

[0011] FIG. 2 is a schematic diagram of a structure of a target packet according to an embodiment of the present disclosure;

[0012] FIG. 3 is a flowchart of a method for processing a packet of a receiving device according to an embodiment of the present disclosure;

[0013] FIG. 4 is a schematic diagram of a scenario of application of a method for processing a packet in an industry network according to an embodiment of the present disclosure;

[0014] FIG. 5 is a schematic diagram of a structure of an apparatus for processing a packet according to an embodiment of the present disclosure;

[0015] FIG. 6 is a schematic diagram of a structure of an apparatus for processing a packet according to an embodiment of the present disclosure;

[0016] FIG. 7 is a schematic diagram of a structure of an electronic device according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0017] The specific embodiments of the present disclosure are described in detail below with reference to the accompanying drawings. It should be understood that the specific embodiments described herein are only used to illustrate and explain the present disclosure, and are not used to limit the present disclosure.

[0018] As used in the present disclosure, the term “and / or” includes any and all combinations of one or more of the associated listed items.

[0019] The terminology used in the present disclosure is only for the purpose of describing particular embodiments and is not intended to be limiting of the present disclosure. As used in the present disclosure, the singular forms “a,” “an,” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise.

[0020] When the terms “comprising” and / or “consisting of” are used in the present disclosure, it specifies the presence of particular features, integers, steps, operations, elements, and / or components, but does not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0021] Unless otherwise defined, all terms used in the present disclosure, including technical and scientific terms, have the same meaning as commonly understood by one of ordinary skill in the art. It will be further understood that terms, such as those defined in commonly used dictionaries, should be interpreted as having a meaning that is consistent with their meaning in the context of the relevant art and the present disclosure, and will not be interpreted in an overly formal or overly strict sense unless expressly so defined herein.

[0022] The present disclosure provides a method for processing a message, which can be applied to any sending end device in an industry network, which can be any specified range of network, for example, any trusted network such as bank, power and other industry networks. The trusted network has the characteristics of trusted agency and deployable security gateway, and supports the customization of transmission protocol.

[0023] In the present disclosure, a message refers to a data unit exchanged and transmitted in a network. The payload is the part of user data actually needed to be transmitted in communication. The message has a certain format, which usually includes a header (also known as message header) and a payload.

[0024] FIG. 1 shows a flowchart of a method for processing a message provided by the present disclosure, which mainly includes the following steps 101-104.

[0025] Step 101, obtaining an original message to be transmitted by a sending end device in an industry network.

[0026] In some embodiments, the original message can be an IP message, a UDP message, or other protocol messages such as a TCP message, which are not listed one by one here.

[0027] At step 102, authentication information corresponding to the sending device is determined, the authentication information including an attribute label corresponding to the sending device and a data marking fingerprint, the data marking fingerprint being generated according to target data, the target data including the attribute label.

[0028] It should be noted that the attribute label is used to indicate attribute information of the sending device, and the attribute information can be network security information of a network to which the sending device belongs and which is concerned by a user, and the attribute information can be specified by the user according to network security needs.

[0029] In some embodiments, the attribute label includes at least one of the following: a region label used to indicate a network region to which the sending device belongs; a device label used to indicate a network device type to which the sending device belongs; and an industry label used to indicate an industry to which the sending device belongs.

[0030] Of course, in addition to the attribute labels listed here, there can be other attribute labels related to network security, which are only used as examples here.

[0031] The data marking fingerprint is generated based on target data including at least the attribute label, and is used for the receiving device to verify integrity of the target data.

[0032] In some embodiments, the data marking fingerprint is generated using a shared key of the industry network and the target data; or the data marking fingerprint is generated using an IPSec tunnel negotiation key and the target data.

[0033] In some embodiments, a Hash-based Message Authentication Code (HMAC) operation is performed using the shared key of the industry network and the target data to generate the data marking fingerprint.

[0034] HMAC is a message authentication code (MAC) generated by a preset rule after using a cryptographic hash function and combining an encryption key, and HMAC can be used to ensure data integrity and can be used for message authentication.

[0035] In some embodiments, an HMAC operation is performed using the IPSec tunnel negotiation key and the target data to generate the data marking fingerprint.

[0036] It should be noted that whether the data marking fingerprint is generated by using the shared key of the industry network or by using the IPSec tunnel negotiation key can be preconfigured in the sending end device and the receiving end device. If the preconfiguration is that the sending end device and the receiving end device both use the shared key of the industry network for security verification, the data marking fingerprint is generated by using the shared key of the industry network. If the preconfiguration is that the sending end device and the receiving end device both use the IPSec tunnel negotiation key for security verification, the data marking fingerprint is generated by using the IPSec tunnel negotiation key.

[0037] In some embodiments, the target data for generating the data marking fingerprint at least includes the attribute label corresponding to the sending end device, and selectively includes any one or more of the following data: the original payload, the source IP (Internet Protocol) address in the original message header, and the target IP address in the original message header.

[0038] It should be noted that, in addition to the data listed here, other contents in the original message can also be used to generate the data marking fingerprint. The specific contents to be included need to be agreed by the sending end device and the receiving end device, so that the receiving end device generates the data verification fingerprint in the same way and performs verification.

[0039] Step 103: generating a target message according to the original message and the authentication information, wherein the target payload of the target message includes the authentication information and the original payload of the original message.

[0040] In some embodiments, the generation of the target message according to the original message and the authentication information (i.e., step 103) includes but is not limited to the following two ways.

[0041] Way one

[0042] The generation of the target message according to the original message and the authentication information includes: encapsulating the original payload of the original message and the authentication information by using the message format of a specified transmission protocol to obtain a message of the specified transmission protocol, taking the message of the specified transmission protocol as the target payload of the target message, and generating the target message according to the target payload and the original message header of the original message.

[0043] In some embodiments, the specified transmission protocol includes but is not limited to any one of the TCP (Transmission Control Protocol) and the UDP (User Datagram Protocol) transmission protocol.

[0044] In some embodiments, the payload part of the message specifying the transmission protocol comprises the original payload and an authentication payload, and the authentication payload comprises the authentication information.

[0045] In some embodiments, the authentication payload further comprises an authentication header, and the authentication header comprises at least a key sequence number, which is used to indicate a latest key received by the sending device from a key management device of the industry network; and the data tag fingerprint comprises a first tag fingerprint, which is generated by performing an HMAC operation on the latest key and the target data.

[0046] It should be noted that the latest key used by the sending device to generate the first tag fingerprint is a shared key, and the sending device and the receiving device share the latest key and perform key update according to the received message.

[0047] In some embodiments, before the determining of the authentication information corresponding to the sending device (i.e., step 102), the method for processing the message further comprises: receiving key update information broadcast by a key management device of the industry network, and the key update information comprises an updated key and a key sequence number corresponding to the updated key.

[0048] The key management device of the industry network can broadcast the key update information at a fixed time, periodically, or at an indefinite time.

[0049] The key management device of the industry network belongs to the same industry network as the sending device and the receiving device.

[0050] Using HMAC as the first tag fingerprint can ensure the non-tamperability and anti-forgery of the authentication information. Moreover, compared with the digital signature method, HMAC does not involve encryption and decryption operations of asymmetric keys, and has high execution efficiency, which is suitable for large-flow scenarios of a private network.

[0051] In some embodiments, the data tag fingerprint further comprises a second tag fingerprint, which is generated by performing an HMAC operation on a default key pre-stored by the sending device and the target data.

[0052] In the data tag fingerprint, the first tag fingerprint and the second tag fingerprint are included simultaneously, and after receiving the target message, the receiving device performs security verification using the second tag fingerprint if the security verification based on the first tag fingerprint fails.

[0053] In some embodiments, the pre-stored default key of the sending device can be pre-stored in the sending device by a key management device in an industry network before the sending device is manufactured, and after the sending device accesses the industry network, the sending device receives the latest network key broadcasted by the key management device in the industry network.

[0054] In some embodiments, the sending device locally maintains a key table, which stores information of the latest key and information of the default key, including the key sequence number and the corresponding key of the latest key, and the key sequence number and the corresponding key of the default key, and the latest key in the key table is configured with a validity period. In the case that the sending device determines that the latest key is within the validity period, the sending device calculates the first mark fingerprint by using the latest key.

[0055] In some embodiments, the authentication information further includes an original protocol number or an original port number in the original message header; and the generating the target message according to the target payload and the original message header of the original message includes: replacing the original protocol number in the original message header with a specified protocol number to obtain a target message header of the target message, or replacing the original port number in the original message header with a specified port number to obtain the target message header of the target message; and generating the target message based on the target message header and the target payload.

[0056] In some embodiments, in the case that the original message is an IP message, the authentication payload and the original payload are encapsulated into a new UDP message, placed behind the original message header, and the original protocol number in the original message header is replaced with a UDP protocol number, so that the receiving device identifies the target message as a message containing the authentication payload through the UDP protocol number and the port number in the UDP header. The UDP protocol number is fixed as 17 in the related standards.

[0057] In some embodiments, in the case that the original message is a TCP message or a UDP message, in the case that the authentication payload is placed in the data payload of TCP or UDP, the original port number in the original message header is replaced with a specified TCP or UDP port number, so that the receiving device identifies the target message as a message containing the authentication payload through the specified TCP or UDP port number.

[0058] Method two

[0059] The generating the target message according to the original message and the authentication information includes: embedding the authentication information into an original payload of the original message to obtain a target payload of the target message; and generating the target message according to the target payload and an original message header of the original message.

[0060] In some embodiments, the target message reconstructed by the above method one or method two embeds additional information of the sending end device, but is transmitted in plaintext in the network, and can be used in combination with other network security protocols (such as the IPSec protocol) to guarantee the confidentiality of the message when flowing into the industry network through encrypted transmission.

[0061] Step 104, sending the target message.

[0062] In one example, in combination with the structure of the target message shown in FIG. 2, the generation process of the target message is illustrated as follows.

[0063] The sending end device replaces the original protocol number in the IP header of the original IP message with the UDP protocol number to declare that the UDP message is carried in the payload part of the target message.

[0064] The original payload of the original IP message is re-encapsulated according to the structure of the UDP message to obtain the UDP message as the target payload of the target message: the authentication information, the original payload and the original protocol number are encapsulated into the UDP message, the message header of the UDP message is the general UDP header, and the port number in the message header is set to the pre-designated unified authentication port number to indicate that the authentication information is carried in the UDP message through the authentication port number.

[0065] The authentication information includes but is not limited to the following contents: attribute label, including additional information of user attention, which is defined by the user himself / herself, including but not limited to the area, industry and location of the message source, etc.; HMAC calculated depending on the attribute label, the HMAC corresponding to the latest key is calculated according to the latest key issued by the key management device in the industry network, the HMAC corresponding to the default key is calculated according to the pre-configured default key, the key serial number corresponding to the latest key is added to the UDP message, and the HMAC calculation depends at least on the attribute label and can include other information in addition to the attribute label, which can be defined by the user himself / herself.

[0066] The UDP message reconstructed from the original payload includes a general UDP header and a UDP payload, the UDP payload includes authentication payload and original payload, and the definition of each field in the authentication payload can be referred to Table 1.

[0067] Table 1 Definition of each field in the authentication payload

[0068] By adding the authentication information corresponding to the sending end device on the basis of the original message, the attribute tag and the data marking fingerprint corresponding to the sending end device are encapsulated with the original message to obtain a target message, and the authentication information and the original load are carried in the target load of the target message, so that the receiving end device can perform security verification based on the authentication information carried in the target message after receiving the target message, and the network characteristics of the sending end device can be verified by the attribute tag corresponding to the sending end device, thereby ensuring the effectiveness of the security authentication, achieving simple and efficient, and implementing security verification at the transmission layer to meet the security verification requirements of a large flow scene.

[0069] Embedding authentication information in the target message is a simple and filterable way to filter illegal messages, and the receiving end device judges the legality of the target message and the attributes of the sending end device based on the embedded authentication information, and after confirming the safety of the target message, the embedded authentication information (attribute tag and data marking fingerprint) is stripped from the target message to restore the original message, so that the transmission of the original message in the ordinary network device can be ensured, and simple and fast implementation is achieved.

[0070] Based on the same concept, the disclosure also provides a method for processing a message, and FIG. 3 shows a method flow diagram for processing a message by a receiving end device provided by the disclosure, mainly including the following steps 301-303.

[0071] Step 301, receiving a target message from a sending end device in an industry network.

[0072] Step 302, obtaining authentication information from the target load of the target message, the authentication information including an attribute tag corresponding to the sending end device and a data marking fingerprint.

[0073] In some embodiments, the attribute tag includes at least one of the following: a region tag for indicating a network region to which the sending end device belongs; a device tag for indicating a network device type to which the sending end device belongs; and an industry tag for indicating an industry to which the sending end device belongs.

[0074] Of course, in addition to the attribute tags listed here, there can be other network security-related attribute tags, which are only examples here.

[0075] In some embodiments, the authentication information is obtained from the target load of the target message (i.e., step 302) includes but is not limited to the following two ways.

[0076] Method one

[0077] The authentication information is obtained by parsing the target payload of the target message according to a message format of the specified transmission protocol.

[0078] In some embodiments, the payload part of the message of the specified transmission protocol includes the original payload and an authentication payload, and the authentication payload includes the authentication information.

[0079] In some embodiments, the target message header of the target message includes a specified protocol number or a specified port number; and before the target payload of the target message is parsed according to the message format of the specified transmission protocol to obtain the authentication information, the method further includes: extracting the specified protocol number from the target message header of the target message to obtain the message format of the specified transmission protocol corresponding to the specified protocol number; or extracting the specified port number from the target message header of the target message to obtain the message format of the specified transmission protocol corresponding to the specified port number.

[0080] In some embodiments, the authentication information further includes an original protocol number or an original port number in the original message header; the target message header of the target message includes a specified protocol number or a specified port number; and the original message is determined according to the target message by: replacing the specified protocol number in the target message header of the target message with the original protocol number in the original message header to obtain the original message header, or replacing the specified port number in the target message header of the target message with the original port number to obtain the original message header; parsing the target payload of the target message according to the message format of the specified transmission protocol to obtain an original payload; and determining the original message according to the original message header and the original payload.

[0081] Method two

[0082] The authentication information is obtained by parsing the target payload of the target message.

[0083] In step 303, security verification is performed according to the authentication information, and in the case of passing the security verification, an original message is determined according to the target message, and the original message is processed.

[0084] In some embodiments, the security verification according to the authentication information includes:

[0085] The shared key of the industry network and target data in the target packet are used to generate a data verification fingerprint, the target data including the attribute label, and security verification is performed according to the data verification fingerprint and the data label fingerprint; or an IPSec tunnel negotiation key and target data in the target packet are used to generate a data verification fingerprint, the target data including the attribute label, and security verification is performed according to the data verification fingerprint and the data label fingerprint.

[0086] In some embodiments, the authentication payload further includes an authentication header including at least a key sequence number indicating a key used to generate the data label fingerprint; the data label fingerprint includes a first label fingerprint and a second label fingerprint; and the security verification according to the authentication information includes: obtaining a key sequence number of a latest saved key received from a key management device of the industry network; in a case where the key sequence number of the latest saved key is the same as the key sequence number in the authentication header, performing an HMAC operation using the latest saved key and target data in the target packet to generate a first verification fingerprint, the target data including at least the attribute label, verifying the legality of the attribute label in a case where the first verification fingerprint is the same as the first label fingerprint, determining that the security verification is passed in a case where the attribute label is legal, determining that the security verification is failed in a case where the attribute label is illegal, and determining that the security verification is failed in a case where the first verification fingerprint is not the same as the first label fingerprint; or, in a case where the key sequence number of the latest saved key is not the same as the key sequence number in the authentication header, performing an HMAC operation using a pre-saved default key and target data in the target packet to generate a second verification fingerprint, verifying the legality of the attribute label in a case where the second verification fingerprint is the same as the second label fingerprint, determining that the security verification is passed in a case where the attribute label is legal, determining that the security verification is failed in a case where the attribute label is illegal, and determining that the security verification is failed in a case where the second verification fingerprint is not the same as the second label fingerprint.

[0087] It should be noted that the receiving end device and the sending end device share the latest key and update the key according to the received message.

[0088] In some embodiments, before the security verification according to the authentication information, the method of processing the packet further includes: receiving and saving latest key update information broadcast by a key management device in the industry network, the key update information including an updated key and a key sequence number corresponding to the updated key.

[0089] The key management device can broadcast the key update information at a fixed time, periodically broadcast the key update information, or broadcast the key update information at an irregular time.

[0090] The key management device, the sending end device and the receiving end device belong to the same industry network.

[0091] In some embodiments, the receiving end device locally maintains a key table, which stores information of the latest key and information of the default key, including the key sequence number and the corresponding key of the latest key, and the key sequence number and the corresponding key of the default key, and the latest key in the key table is configured with a validity period.

[0092] The receiving end device finds the key and the corresponding validity period from the locally maintained key table according to the key sequence number in the authentication payload; if the key corresponding to the key sequence number is found, and the key is within the validity period, the first verification fingerprint is calculated using the found key, and the security verification is performed by matching the first verification fingerprint and the first marking fingerprint; if the key corresponding to the key sequence number is not found, or the key corresponding to the key sequence number is not within the validity period, the second verification fingerprint is calculated using the default key, and the security verification is performed by matching the second verification fingerprint and the second marking fingerprint.

[0093] In some embodiments, in the case where the security verification is passed, the processing of the original message includes: forwarding the original message to the related application, or forwarding the original message to the next hop network device. Here, only for example, other processing of the original message can also be performed, which is not listed one by one here.

[0094] In some embodiments, in the case where the security verification is not passed, an exception handling is performed, including at least one of the following: in the case where the security verification is not passed, an exception alarm is performed; in the case where the security verification is not passed, the target message is discarded to block the transmission of illegal messages, in the case where the receiving end device is a security gateway of the industry network, the illegal messages can be prevented from entering the industry network; in the case where the security verification is not passed, the related information (the authenticated source address, the source domain, etc.) of the target message is forwarded to a monitoring and early warning system, and the monitoring and early warning system performs statistical analysis based on the collected target messages whose security verification is not passed, so as to identify and monitor potential illegal messages, and take necessary defense measures to protect network security, and provide a basis for the whole network security situation analysis of a specific network.

[0095] In some embodiments, the monitoring and early warning system can provide functions of querying each node device in the industry network, managing each node device, managing users, configuring policies and rules (such as configuring attribute tags, calculation rules of data marking fingerprints, etc.), data statistics and analysis, etc., and is an important part of the whole network security situation of the industry network.

[0096] In the case that the monitoring and early warning system is a central control node of the industry network, the illegal messages reported by each node device in the industry network are comprehensively analyzed to realize cross-domain transmission early warning and network situation analysis monitoring.

[0097] In some cases, in the case that the receiving end device is an entry device of the industry network, the entry device preliminarily counts the information such as the source domain and the industry domain of the identified illegal messages, and reports the preliminary counting result to the monitoring and early warning system. The monitoring and early warning system can aggregate the information of the illegal messages reported by each entry device in the industry network, and perform security situation analysis through big data analysis and other means. In addition, the illegal messages can be analyzed by using active alarm and generating trend chart, so as to better predict and prevent network security threats.

[0098] In some embodiments, the statistics of the illegal messages include, but are not limited to, the following categories: messages without embedded attribute labels, messages with failed data tag fingerprint verification, and illegal cross-domain messages.

[0099] In some embodiments, the method for processing messages further includes verifying the legality of the attribute label, including filtering the attribute label carried by the authentication payload by using a pre-configured filtering rule to determine whether there is an illegal label in the attribute label, determining that the attribute label is illegal in the case that there is an illegal label, and determining that the attribute label is legal in the case that there is no illegal label.

[0100] The filtering rule is pre-configured locally in the receiving end device, and can be configured by a key management device in the industry network and the like.

[0101] In the present disclosure, the receiving end device obtains authentication information from the target message, verifies the security of the message by using the attribute label and the data tag fingerprint in the authentication information, the authentication information can directly control the message flow through the network entry of the network layer, and is suitable for large-flow scenarios of special networks. The data tag fingerprint is calculated at a high speed, so it can be applied to large-flow scenarios and can further improve the verification efficiency.

[0102] The method for processing messages provided in the present disclosure can be applied to the communication between the base station and the network management, and the communication between the base station and the core network. Before the message enters the network management and the core network, the illegal message is filtered by the method to ensure the security of the message entering the network management and the core network.

[0103] The method for processing messages provided in the present disclosure can be applied to the communication between the user equipment and the edge access device, such as WiFi and MEC (Mobile Edge Computing).

[0104] The method provided by the present disclosure is applied to an industry network, and messages sent by edge devices of the industry network pass through a security gateway to enter a specific network. The security gateway filters out illegal messages to ensure the security of the messages flowing into the specific network.

[0105] In the present disclosure, by embedding an attribute tag of a sending device in an original message, the identity of the sending device or the network where the sending device is located, and other parameters are indicated by the attribute tag, so that the security of the message sent by the sending device can be finely verified. In addition, compared with the network transmission security technology containing identity information in the application layer protocol, this method can control the message flow at the bottom layer of the transmission network.

[0106] In some embodiments, as shown in FIG. 4, a scenario diagram in which the above-described method of processing messages is applied in a specific network. In this scenario, messages transmitted through a wireless access domain pass through a security gateway to reach an industry user domain, a computer room or a data center. An authentication component is deployed in the security gateway corresponding to each of the industry user domain, the computer room and the data center. The authentication component is a software program for executing the above-described message processing method.

[0107] The authentication component performs security verification on the messages that pass through the wireless access domain to the security gateway, including alarming and blocking the monitored illegal messages, and providing data aggregation statistics and analysis basis for abnormal early warning and security situation assessment.

[0108] The operations performed by the authentication component include encapsulating authentication information, verifying authentication information, and stripping authentication information.

[0109] Encapsulating authentication information includes the process of embedding authentication information in an original message to generate a target message. For specific embedding processes, refer to the description of the sending device in the above embodiments, which will not be repeated here.

[0110] Verifying authentication information includes the process of obtaining authentication information from a target message and verifying it. For specific processes, refer to the description of the receiving device in the above embodiments, which will not be repeated here.

[0111] Stripping authentication information includes the process of restoring the original message. For specific processes, refer to the description of the receiving device in the above embodiments, which will not be repeated here.

[0112] The authentication center is equivalent to the key management device described in the above embodiments.

[0113] The step division of the above various methods is only for the purpose of clear description, and can be combined into one step or split into multiple steps in implementation, as long as the same logical relationship is included, and all are within the protection scope of the disclosure; adding insignificant modifications or introducing insignificant designs in the algorithm or process, but not changing the core design of the algorithm and process, are within the protection scope of the disclosure.

[0114] An apparatus for processing a packet is provided in the disclosure, and is applied to a sending end device. The specific implementation of the apparatus can be referred to the related description of the sending end device in the method embodiments, which will not be repeated here. Fig. 5 shows a structural schematic diagram of the apparatus, which mainly includes: a first obtaining module 501 configured to obtain an original packet to be transmitted by a sending end device in an industry network; a second obtaining module 502 configured to determine authentication information corresponding to the sending end device, the authentication information including an attribute tag corresponding to the sending end device and a data marking fingerprint, the data marking fingerprint being generated according to target data, the target data including the attribute tag; a processing module 503 configured to generate a target packet according to the original packet and the authentication information, a target payload of the target packet including the authentication information and an original payload of the original packet; and a transmission module 504 configured to transmit the target packet.

[0115] An apparatus for processing a packet is provided in the disclosure, and is applied to a receiving end device. The specific implementation of the apparatus can be referred to the related description of the receiving end device in the method embodiments, which will not be repeated here. Fig. 6 shows a structural schematic diagram of the apparatus, which mainly includes: a transmission module 601 configured to receive a target packet from a sending end device in an industry network; an obtaining module 602 configured to parse authentication information from a target payload of the target packet, the authentication information including an attribute tag corresponding to the sending end device and a data marking fingerprint; and a processing module 603 configured to perform security verification according to the authentication information, and in the case that the security verification is passed, determine an original packet according to the target packet and process the original packet.

[0116] The apparatus for processing a packet provided in the disclosure has functions or includes modules, which can be used to execute the method for processing a packet described in the method embodiments. The specific implementation and technical effects can be referred to the description of the method embodiments, which will not be repeated here for brevity.

[0117] It should be noted that each module involved in the above is a logical module. In actual application, one logical unit can be one physical unit, or a part of one physical unit, or realized in combination of multiple physical units. In addition, in order to highlight the innovative part of the present disclosure, the unit not closely related to solving the technical problems proposed in the present disclosure is not introduced in the above packet processing device, but this does not mean that there is no other unit in the packet processing device.

[0118] Referring to FIG. 7, the present disclosure provides an electronic device, comprising: at least one processor 701; a memory 702, having at least one computer program stored thereon, when the at least one computer program is executed by the at least one processor, so that the at least one processor implements the above packet processing method; at least one I / O interface 703 connected between the processor and the memory, configured to realize the information interaction of the processor and the memory.

[0119] The processor 701 is a device with data processing capability, including but not limited to central processing unit (CPU) and the like; the memory 702 is a device with data storage capability, including but not limited to random access memory (RAM, more specifically SDRAM, DDR, etc.), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory (FLASH); the I / O interface (read-write interface) 703 is connected between the processor 701 and the memory 702, and can realize the information interaction of the processor 701 and the memory 702, including but not limited to data bus (Bus) and the like.

[0120] In some embodiments, the processor 701, the memory 702 and the I / O interface 703 are connected with each other through a bus, and further connected with other components of the computing device.

[0121] The present disclosure also provides a computer readable storage medium having a computer program stored thereon, when the computer program is executed by a processor, the processor implements the packet processing method provided by the present disclosure. To avoid repeated description, the specific steps of the method are not described here.

[0122] Those of ordinary skill in the art will realize and understand that all or some of the steps in the methods, the functional modules / units in the systems and devices described above can be implemented as software, firmware, hardware, and appropriate combinations thereof. In hardware implementation, the division between the functional modules / units mentioned in the above description does not necessarily correspond to the division of physical components; for example, one physical component can have multiple functions, or one function or step can be performed by several physical components in cooperation. Some or all of the physical components can be implemented as software executed by a processor (such as a central processing unit, a digital signal processor, or a microprocessor), or as hardware, or as an integrated circuit, such as an application-specific integrated circuit. Such software can be distributed on a computer-readable medium, which can include computer storage media (or non-transitory media) and communication media (or transitory media). As is well known to those of ordinary skill in the art, the term computer storage media includes volatile and non-volatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store the desired information and that can be accessed by a computer. In addition, it is well known to those of ordinary skill in the art that communication media typically embodies computer readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media.

[0123] It should be noted that the terms "comprising", "containing", or any other similar term are intended to encompass non-exclusive inclusions such that a process, method, article, or apparatus that comprises a list of elements does not include those elements solely, but can also include other elements not expressly listed or inherent to such process, method, article, or apparatus.

[0124] Those of ordinary skill in the art will realize and understand that although some of the embodiments described herein include certain features included in other embodiments but not others, the combination of features of different embodiments means that it is within the scope of the embodiments and forms different embodiments.

[0125] It is understood that the above embodiments are only exemplary for illustrating the principles of the present disclosure, and the present disclosure is not limited thereto. Various modifications and improvements can be made by those of ordinary skill in the art without departing from the spirit and essence of the present disclosure, and these modifications and improvements are also considered to be within the scope of protection of the present disclosure.

Claims

1. A method for processing a packet, comprising: obtaining an original packet to be transmitted by a sending device in an industry network; determining authentication information corresponding to the sending device, the authentication information comprising an attribute tag corresponding to the sending device and a data marking fingerprint, the data marking fingerprint being generated according to target data, the target data comprising the attribute tag; generating a target packet according to the original packet and the authentication information, wherein a target payload of the target packet comprises the authentication information and an original payload of the original packet; and sending the target packet.

2. The method of claim 1, wherein, The data marking fingerprint is generated using a shared key of the industry network and the target data. Or The data marking fingerprint is generated using an IPSec tunnel negotiation key and the target data.

3. The method of claim 1, wherein, The generating of the target packet according to the original packet and the authentication information comprises: performing encapsulation using a packet format of a specified transmission protocol according to the original payload of the original packet and the authentication information, to obtain a packet of the specified transmission protocol, taking the packet of the specified transmission protocol as the target payload of the target packet, and generating the target packet according to the target payload and an original packet header of the original packet. Or embedding the authentication information into the original payload of the original packet to obtain the target payload of the target packet, and generating the target packet according to the target payload and the original packet header of the original packet.

4. The method of claim 3, wherein, The payload part of the packet of the specified transmission protocol comprises the original payload and an authentication payload, and the authentication payload comprises the authentication information.

5. The method of claim 3, wherein, The authentication information further comprises an original protocol number or an original port number in the original packet header. The generating of the target packet according to the target payload and the original packet header of the original packet comprises: replacing an original protocol number of the original packet header with a specified protocol number to obtain a target packet header of the target packet, or replacing an original port number of the original packet header with a specified port number to obtain the target packet header of the target packet; and generating a target packet based on the target packet header and the target payload.

6. The method of claim 4, wherein, The authentication payload further comprises an authentication header, and the authentication header comprises at least a key sequence number, used to indicate a latest key received by the sending device from a key management device of the industry network. The data marking fingerprint comprises a first marking fingerprint, and the first marking fingerprint is generated by performing HMAC operation according to the latest key and the target data.

7. The method of claim 4 or 6, wherein, The data marking fingerprint comprises a second marking fingerprint, and the second marking fingerprint is generated by performing HMAC operation using a default key pre-stored by the sending device and the target data. 8.A method for processing a packet, comprising: receiving a target packet from a sending device in an industry network; obtaining authentication information from a target payload of the target packet, wherein the authentication information comprises an attribute tag corresponding to the sending device and a data marking fingerprint; performing security verification according to the authentication information, and in a case where the security verification is passed, determining an original packet according to the target packet and processing the original packet.

9. The method of claim 8, wherein, The security verification according to the authentication information comprises: generating a data verification fingerprint by using a shared key of the industry network and target data in the target message, the target data comprising the attribute label; and performing security verification according to the data verification fingerprint and the data label fingerprint; or generating a data verification fingerprint by using an IPSec tunnel negotiation key and target data in the target message, the target data comprising the attribute label; and performing security verification according to the data verification fingerprint and the data label fingerprint.

10. The method of claim 8, wherein, The authentication information obtained from the target payload of the target message comprises: parsing the target payload of the target message by using a message format of a specified transmission protocol to obtain the authentication information; the target payload is obtained by encapsulating by using the message format of the specified transmission protocol; or extracting the authentication information from the target payload of the target message. The payload part of the message of the specified transmission protocol comprises the original payload and an authentication payload, and the authentication payload comprises the authentication information.

11. The method of claim 10, wherein, The target message header of the target message comprises a specified protocol number or a specified port number.

12. The method of claim 10, wherein, The method further comprises: before the parsing of the target payload of the target message by using the message format of the specified transmission protocol to obtain the authentication information, extracting the specified protocol number from the target message header of the target message to obtain the message format of the specified transmission protocol corresponding to the specified protocol number; or extracting the specified port number from the target message header of the target message to obtain the message format of the specified transmission protocol corresponding to the specified port number. The authentication information further comprises an original protocol number or an original port number in the original message header; and the target message header of the target message comprises a specified protocol number or a specified port number.

13. The method of claim 10, wherein, The determination of the original message according to the target message comprises: replacing the specified protocol number in the target message header of the target message with an original protocol number in the original message header to obtain the original message header; or replacing the specified port number in the target message header of the target message with an original port number to obtain the original message header; parsing the target payload of the target message by using the message format of the specified transmission protocol to obtain an original payload; determining the original message according to the original message header and the original payload. The authentication payload further comprises an authentication header, and the authentication header comprises at least a key sequence number for indicating a key used for generating the data label fingerprint; 14. The method of claim 11, wherein, The data label fingerprint comprises a first label fingerprint and a second label fingerprint. The security verification according to the authentication information comprises: obtaining a key sequence number of a latest saved key received from a key management device of the industry network; ​ In the case that the key serial number of the latest saved key is the same as the key serial number in the authentication header, a first verification fingerprint is generated by performing an HMAC operation on the latest saved key and target data in the target packet, the target data at least including the attribute label; in the case that the first verification fingerprint and the first marked fingerprint are the same, the legality of the attribute label is verified, and in the case that the attribute label is legal, it is determined that the security verification is passed, and in the case that the attribute label is not legal, it is determined that the security verification is failed; in the case that the first verification fingerprint and the first marked fingerprint are not the same, it is determined that the security verification is failed; Or In the case that the key serial number of the latest saved key is not the same as the key serial number in the authentication header, a second verification fingerprint is generated by performing an HMAC operation on a pre-saved default key and target data in the target packet; in the case that the second verification fingerprint and the second marked fingerprint are the same, the legality of the attribute label is verified, and in the case that the attribute label is legal, it is determined that the security verification is passed, and in the case that the attribute label is not legal, it is determined that the security verification is failed; in the case that the second verification fingerprint and the second marked fingerprint are not the same, it is determined that the security verification is failed.

15. An electronic device, comprising: at least one processor; a memory having at least one computer program stored thereon, when the at least one computer program is executed by the at least one processor, the at least one processor implements the method according to any one of claims 1 to 7, or implements the method according to any one of claims 8 to 14; at least one I / O interface connected between the processor and the memory, configured to realize information interaction of the processor and the memory.

16. A computer readable storage medium having a computer program stored thereon, when the computer program is executed by a processor, the processor implements the method according to any one of claims 1 to 7, or implements the method according to any one of claims 8 to 14.

Images