Packet processing method, communication apparatus, storage medium and program product

Abstract

The present application relates to the field of communications. Disclosed are a packet processing method, a communication apparatus, a storage medium and a program product. The method comprises: a communication apparatus acquires a sequence number of an Internet protocol security (IPsec) packet to be processed, and then, on the basis of comparison results between the sequence number of said IPsec packet and sequence numbers recorded in a preset buffer and between the sequence number of said IPsec packet and sequence numbers in a sliding window, performs anti-replay processing on said IPsec packet, the preset buffer being used for recording sequence numbers that are currently discontinuous with the sequence numbers in the sliding window. In the method, when the communication apparatus performs anti-replay processing, sequence numbers of out-of-order packets can be stored in the preset buffer, so as to avoid sudden large window advancements, thus avoiding erroneous drops of IPsec packets.

Description

Message processing methods, communication devices, storage media and program products

[0001] This application claims priority to Chinese Patent Application No. 202411716258.1, filed on November 26, 2024, entitled "Message Processing Method, Communication Device, Storage Medium and Program Product", the entire contents of which are incorporated herein by reference. Technical Field

[0002] This application relates to the field of communications, and more particularly to a message processing method, a communication device, a storage medium, and a program product. Background Technology

[0003] Internet Protocol Security (IPsec) is a mainstream IP layer security protocol in the industry, and it is widely used in various network scenarios such as wireless backhaul, remote access, and enterprise private networks.

[0004] IPsec packets may be vulnerable to replay attacks during transmission. A replay attack is an attack method in which an attacker captures a normal IPsec packet, copies it, and injects it into the network. The anti-replay function in the IPsec protocol can protect against replay attacks. The specific process can be simply summarized as follows: The receiving end of the IPsec packet maintains an anti-replay sliding window (in this application, the sequence number at the leading edge of the sliding window is not less than the sequence number at the trailing edge of the sliding window, or in other words, the sequence number at the leading edge of the sliding window is the maximum value of the sequence numbers within the sliding window, and the sequence number at the trailing edge of the sliding window is the minimum value of the sequence numbers within the sliding window). When the receiving end receives an IPsec packet with a sequence number less than the sequence number at the leading edge of the sliding window but greater than or equal to the sequence number at the trailing edge, it compares the sequence number with the sequence number recorded within the sliding window. If a duplicate sequence number exists within the sliding window, the packet is considered a duplicate packet and discarded; if no duplicate sequence number exists within the sliding window, the packet is considered a normal packet and accepted, and the packet's sequence number is recorded within the sliding window. When the sequence number of an IPsec packet received by the receiver is greater than the sequence number at the leading edge of the sliding window, the IPsec packet is considered a normal packet and accepted, and the leading edge of the sliding window is moved to the sequence number of the IPsec packet. When the sequence number of an IPsec packet received by the receiver is less than the sequence number at the trailing edge of the sliding window, the packet is discarded because the sliding window has lost the record information corresponding to the sequence number of the packet.

[0005] However, in live network deployments, on the one hand, the network needs to carry services with varying priorities and provide differentiated services. High-priority packets are processed first, while low-priority packets are overtaken by high-priority packets, resulting in out-of-order delivery. On the other hand, even packets of the same priority may experience out-of-order sequence numbers in multi-link load balancing scenarios due to them taking different links. Therefore, out-of-order delivery is a common phenomenon in networks. If IPsec packets from an IPsec Security Associate (SA) become out of order, it can lead to unexpected packet loss. IPsec packets that arrive late due to out-of-order delivery during transmission may be mistakenly discarded because their sequence numbers are less than the trailing edge of the sliding window. Summary of the Invention

[0006] This application provides a message processing method, communication device, storage medium, and program product, which can add a preset cache to temporarily store non-contiguous sequence numbers within a sliding window, thereby avoiding the accidental discarding of IPsec messages caused by sudden large window opening.

[0007] In a first aspect, embodiments of this application provide a message processing method, the method comprising: obtaining the sequence number of an Internet Security Protocol (IPsec) message to be processed; performing anti-replay processing on the IPsec message to be processed based on the comparison result between the sequence number of the IPsec message to be processed and the sequence number recorded in a preset cache and the sequence number in a sliding window; the preset cache is used to record the sequence number that is not consecutive with the sequence number in the sliding window.

[0008] Based on this method, a preset cache can be added to the existing sliding window to store sequence numbers that are not consecutive with the sequence numbers within the sliding window. The process of preventing replay attacks on the IPsec packets to be processed is then performed based on the comparison between the sequence number of the IPsec packet to be processed and the sequence numbers in the sliding window and the preset cache. Generally, the transmission efficiency of low-priority IPsec packets (e.g., data packets) is lower than that of high-priority IPsec packets (e.g., signaling packets). Therefore, high-priority IPsec packets with large sequence numbers may arrive at the receiving end before low-priority IPsec packets with small sequence numbers. After adding the preset cache, out-of-order sequence numbers that are not consecutive with the sequence numbers within the sliding window can be temporarily stored in the preset cache. This prevents the leading edge of the sliding window from being suddenly pulled to a larger sequence number, thus preventing "late" low-priority IPsec packets from being dropped because their sequence numbers are smaller than the trailing edge of the pulled sliding window, greatly ensuring service performance.

[0009] Furthermore, compared to the widened sliding window scheme in related technologies, this method eliminates the need for configuring an ultra-wide sliding window for high-speed IPsec SAs to avoid packet loss, significantly saving system resources. In IPsec hardware-accelerated systems, IPsec replay protection is handled on-chip, where on-chip storage resources are extremely scarce. The packet processing method provided in this application can expand IPsec specifications by saving resources.

[0010] Furthermore, compared to the parallel IPsec SA scheme proposed in the standard protocol RFC4301, this method does not require increasing the number of IPsec SAs or maintaining the context of multiple IPsec SAs, thus reducing the burden on IPsec bidirectional entities.

[0011] Finally, the preset cache in this method can be set independently on the receiving end without negotiation with the sending end, is fully compatible with the peer, and does not require deployment of both IPsec bidirectional entities to obtain the gain. The IPsec processing end can obtain the gain after deployment on one side, which greatly reduces the deployment cost and speeds up the deployment pace.

[0012] In one possible design, based on the comparison between the sequence number of the IPsec packet to be processed and the sequence numbers recorded in the preset cache and the sliding window, the IPsec packet to be processed is subjected to anti-replay processing, including: if the sequence number of the IPsec packet to be processed is the same as the sequence number in the sliding window or the sequence number recorded in the preset cache, the IPsec packet to be processed is discarded; if the sequence number of the IPsec packet to be processed is not the same as the sequence number in the sliding window or the sequence number recorded in the preset cache, further anti-replay processing is performed on the IPsec packet to be processed based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window.

[0013] In one possible design, based on the relationship between the sequence number of the IPsec packet to be processed and the sequence number within the sliding window, further anti-replay processing is performed on the IPsec packet to be processed, including: if the sequence number of the IPsec packet to be processed is less than the sequence number at the trailing edge of the sliding window, the IPsec packet to be processed is discarded; if the sequence number of the IPsec packet to be processed is greater than or equal to the sequence number at the trailing edge of the sliding window, the IPsec packet to be processed is accepted.

[0014] In one possible design, the anti-replay processing includes accepting the IPsec packet to be processed; the method further includes: if the IPsec packet to be processed is accepted based on the comparison result, recording the sequence number of the IPsec packet to be processed into the sliding window or a preset cache according to the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window.

[0015] Based on this possible design, the sliding window and the sequence number in the preset cache can be dynamically updated according to the sequence number of the IPsec packet to be processed.

[0016] In one possible design, the sequence number of the IPsec packet to be processed is recorded in the sliding window or a preset cache based on the relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window. This includes recording the sequence number of the IPsec packet to be processed in the preset cache when the priority parameter of the IPsec packet to be processed is higher than or equal to the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window and is not continuous with the sequence number at the leading edge of the sliding window.

[0017] Based on this possible design, the sequence number in the preset cache can be dynamically updated according to the sequence number of the high-priority IPsec packets to be processed.

[0018] In one possible design, the sequence number of the IPsec packet to be processed is recorded in the sliding window or a preset cache according to the relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window. This includes recording the sequence number of the IPsec packet to be processed in the sliding window when the priority parameter of the IPsec packet to be processed is higher than or equal to the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than or equal to the sequence number at the rear edge of the sliding window and less than the sequence number at the front edge of the sliding window.

[0019] Based on this possible design, the sequence number in the sliding window can be dynamically updated according to the sequence number of the high-priority IPsec packets to be processed.

[0020] In one possible design, based on the relationship between the sequence number of the IPsec packet to be processed and the sequence number within the sliding window, the sequence number of the IPsec packet to be processed is recorded in the sliding window or a preset cache. This includes: if the priority parameter of the IPsec packet to be processed is lower than the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, the sequence number of the IPsec packet to be processed is recorded in the sliding window, and the leading edge of the sliding window is moved to the position of the sequence number of the IPsec packet to be processed.

[0021] Based on this possible design, the sequence number in the sliding window can be dynamically updated according to the sequence number of the low-priority IPsec packets to be processed.

[0022] In one possible design, the sequence number of the IPsec packet to be processed is recorded in the sliding window or a preset cache based on the relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window. This includes recording the sequence number of the IPsec packet to be processed in the preset cache when the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window is greater than or equal to the difference threshold.

[0023] Based on this possible design, the sequence number in the preset cache can be dynamically updated according to the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window.

[0024] In one possible design, the difference threshold is the product of the width of the sliding window and a preset scaling factor, where the preset scaling factor is greater than 0.

[0025] Based on this possible design, the difference threshold can be adjusted in conjunction with the width of the sliding window.

[0026] In one possible design, based on the relationship between the sequence number of the IPsec packet to be processed and the sequence number within the sliding window, the sequence number of the IPsec packet to be processed is recorded in the sliding window or a preset cache. This includes: if the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window is less than a difference threshold, the sequence number of the IPsec packet to be processed is recorded in the sliding window, and the leading edge of the sliding window is moved to the position of the sequence number of the IPsec packet to be processed.

[0027] Based on this possible design, the window can be dynamically adjusted according to the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window.

[0028] In one possible design, for the case where the sequence number of the IPsec packet to be processed is recorded in a preset cache, the sequence number of the IPsec packet to be processed is recorded in a sliding window or in the preset cache, including: if the preset cache has reached its capacity limit, the smallest sequence number in the preset cache is recorded in the sliding window, the leading edge of the sliding window is pulled to the smallest sequence number, and at the same time the smallest sequence number in the preset cache is deleted to obtain an updated preset cache; then the sequence number of the IPsec packet to be processed is recorded in the updated preset cache.

[0029] Based on this possible design, overflow of the preset cache can be avoided.

[0030] In one possible design, pulling the leading edge of the sliding window to the minimum serial number includes: if the serial number at the leading edge of the sliding window is less than the minimum serial number, pulling the leading edge of the sliding window to the minimum serial number.

[0031] Based on this possible design, the leading edge of the sliding window will only be pulled to the minimum serial number if the serial number at the leading edge of the sliding window is smaller than the minimum serial number in the preset cache. This can avoid the situation where the leading edge of the sliding window is pulled back if the minimum serial number is smaller than the serial number at the leading edge of the sliding window.

[0032] In one possible design, the sequence number of the IPsec packet to be processed is recorded in the sliding window or a preset cache according to the relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window. This includes: if the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window and is continuous with the sequence number at the leading edge of the sliding window, then the sequence number of the IPsec packet to be processed is recorded in the sliding window, and the leading edge of the sliding window is pulled to the position of the sequence number of the IPsec packet to be processed.

[0033] Based on this possible design, the sequence number of the IPsec packet to be processed can be directly recorded in the sliding window.

[0034] In one possible design, the method further includes: during the sliding window process, if there is a target sequence number in the preset cache that is consecutive to the sequence number at the leading edge of the sliding window, or if there is a target sequence number that is greater than or equal to the sequence number at the trailing edge of the sliding window and less than the sequence number at the leading edge of the sliding window, then the target sequence number is recorded in the sliding window, the leading edge of the sliding window is pulled to the target sequence number, and the target sequence number is deleted from the preset cache.

[0035] In one possible design, the method further includes: during the sliding window process, if a target sequence number exists in the preset cache that is less than the sequence number at the rear edge of the sliding window, then the target sequence number is directly deleted from the preset cache.

[0036] In this way, the serial number within the sliding window and the serial number record in the preset cache will not be broken, meaning that the serial number will not appear within the range of the maximum serial number in the preset cache and the serial number at the trailing edge of the sliding window, thus preventing the loss of serial number records.

[0037] In one possible design, the method further includes: if the preset cache has reached its capacity limit, then the N smallest sequence numbers in the preset cache are recorded into a sliding window, the leading edge of the sliding window is pulled to the largest sequence number among the N smallest sequence numbers, and at the same time the N smallest sequence numbers in the preset cache are deleted; N is a positive integer.

[0038] Based on this possible design, the sliding window can be used to consume sequence numbers in the preset cache only when the preset cache reaches its capacity limit. This avoids the need to compare the sequence number with the sequence number recorded in the preset cache every time the sliding window slides, thereby reducing processing overhead. In one possible design, the leading edge of the sliding window is moved to the largest sequence number among the N smallest sequence numbers, including: if the sequence number at the leading edge of the sliding window is less than the largest sequence number among the N smallest sequence numbers, then the leading edge of the sliding window is moved to the largest sequence number among the N smallest sequence numbers.

[0039] Secondly, embodiments of this application provide a communication device, which includes an acquisition module and a processing module.

[0040] The acquisition module is used to obtain the sequence number of the IPsec packet to be processed.

[0041] The processing module is used to perform anti-replay processing on the IPsec packets to be processed based on the comparison results between the sequence number of the IPsec packet to be processed and the sequence number recorded in the preset cache and the sequence number in the sliding window; the preset cache is used to record the sequence number that is not consecutive with the sequence number in the sliding window.

[0042] In one possible design, the processing module is specifically used to discard the IPsec packet if the sequence number of the IPsec packet to be processed is the same as the sequence number recorded in the sliding window or the sequence number recorded in the preset cache; if the sequence number of the IPsec packet to be processed is not the same as the sequence number recorded in the sliding window or the sequence number recorded in the preset cache, further anti-replay processing is performed on the IPsec packet to be processed based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window.

[0043] In one possible design, the processing module is specifically configured to discard the IPsec packet if the sequence number of the IPsec packet to be processed is less than the sequence number at the trailing edge of the sliding window; and to accept the IPsec packet if the sequence number of the IPsec packet to be processed is greater than or equal to the sequence number at the trailing edge of the sliding window.

[0044] In one possible design, the anti-replay processing includes acceptance; the processing module is further configured to, when accepting the IPsec packet to be processed based on the comparison result, record the sequence number of the IPsec packet to be processed into the sliding window or a preset cache according to the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window.

[0045] In one possible design, the processing module is specifically used to record the sequence number of the IPsec packet to be processed into a preset cache when the priority parameter of the IPsec packet to be processed is higher than or equal to the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window and is not continuous with the sequence number at the leading edge of the sliding window.

[0046] In one possible design, the processing module is specifically used to record the sequence number of the IPsec packet to be processed into the sliding window when the priority parameter of the IPsec packet to be processed is higher than or equal to the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than or equal to the sequence number at the trailing edge of the sliding window and less than the sequence number at the leading edge of the sliding window.

[0047] In one possible design, the processing module is specifically used to record the sequence number of the IPsec packet to be processed into the sliding window and pull the leading edge of the sliding window to the sequence number of the IPsec packet to be processed when the priority parameter of the IPsec packet to be processed is lower than the priority parameter threshold and the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window.

[0048] In one possible design, the processing module is specifically used to record the sequence number of the IPsec packet to be processed into a preset cache when the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window is greater than or equal to the difference threshold.

[0049] In one possible design, the difference threshold is the product of the width of the sliding window and a preset scaling factor, where the preset scaling factor is greater than 0.

[0050] In one possible design, before recording the sequence number of the IPsec packet to be processed into the preset cache, the processing module, specifically, if the preset cache has reached its capacity limit, records the minimum sequence number in the preset cache into a sliding window, pulls the leading edge of the sliding window to the minimum sequence number, and simultaneously deletes the minimum sequence number from the preset cache to obtain an updated preset cache; then, the sequence number of the IPsec packet to be processed is recorded into the updated preset cache.

[0051] In one possible design, the processing module is specifically used to record the sequence number of the IPsec packet to be processed into the sliding window if the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window and is continuous with the sequence number at the leading edge of the sliding window, and then pull the leading edge of the sliding window to the sequence number of the IPsec packet to be processed.

[0052] In one possible design, the processing module is further configured to, during the sliding window process, if a target sequence number exists in the preset cache that is consecutive to the sequence number at the leading edge of the sliding window, or if a target sequence number is greater than the sequence number at the trailing edge of the sliding window but less than the sequence number at the leading edge of the sliding window, then record the target sequence number in the sliding window, pull the leading edge of the sliding window to the target sequence number, and delete the target sequence number from the preset cache.

[0053] In one possible design, the processing module is also used to directly delete the target sequence number from the preset cache if, during the sliding window process, there is a target sequence number in the preset cache that is smaller than the sequence number at the rear edge of the sliding window.

[0054] Thirdly, embodiments of this application also provide a communication device, including: a memory processor, the processor being configured to execute computer instructions stored in the memory, wherein when the computer instructions are executed, the communication device is configured to perform the method described in the first aspect or any possible design of the first aspect.

[0055] Fourthly, embodiments of this application also provide a computer-readable storage medium storing computer instructions; when the computer instructions are executed in a communication device or a chip embedded in the communication device, they cause the communication device to perform the method described in the first aspect or any possible design of the first aspect.

[0056] Fifthly, embodiments of this application also provide a computer program product containing instructions that, when run on a computer, cause the computer to perform the methods described in the first aspect or any possible design of the first aspect.

[0057] Understandably, the beneficial effects that can be achieved by the second to fifth aspects provided above can be referred to the beneficial effects described in the first aspect, and will not be repeated here. Attached Figure Description

[0058] Figure 1 illustrates a high-priority message overtaking diagram;

[0059] Figure 2 shows a schematic diagram of the composition of a communication system provided in an embodiment of this application;

[0060] Figure 3 shows a schematic diagram of the composition of a communication device provided in an embodiment of this application;

[0061] Figure 4 shows a flowchart of a message processing method provided in an embodiment of this application;

[0062] Figure 5 illustrates a schematic diagram of the combined anti-replay process of sliding window and preset cache provided in an embodiment of this application.

[0063] Figure 6 illustrates a schematic diagram of the process for preventing preset cache overflow provided in an embodiment of this application;

[0064] Figure 7 illustrates a rule for recording serial numbers into a sliding window and a preset cache, as provided in an embodiment of this application.

[0065] Figure 8 illustrates another rule for recording serial numbers into a sliding window and a preset cache, as provided in an embodiment of this application.

[0066] Figure 9 shows a schematic diagram of another communication device provided in an embodiment of this application. Detailed Implementation

[0067] Internet Protocol Security (IPsec) is a mainstream IP layer security protocol in the industry, and it is widely used in various network scenarios such as wireless backhaul, remote access, and enterprise private networks.

[0068] IPsec packets are susceptible to replay attacks during transmission. A replay attack is an attack method in which an attacker captures a normal IPsec packet, copies it, and injects it into the network. The anti-replay function in the IPsec protocol can counter replay attacks. The specific process can be summarized as follows: The receiving end of the IPsec packet maintains an anti-replay sliding window at the security associate (SA) granularity. Each IPsec SA has an independent sliding window with a width of w. The sequence number at the trailing edge of the window (or the sequence number at the trailing edge) is x, and the sequence number at the leading edge of the window (or the sequence number at the leading edge) is x + w - 1. After receiving the IPsec packet, the receiving end can process the sequence number sn in the packet header as follows:

[0069] 1) When the sequence number is less than the trailing edge of the sliding window, that is, when sn < x, the IPsec packet is directly discarded;

[0070] 2) When the sequence number is greater than the leading edge of the sliding window, that is, when sn > x + w - 1, the IPsec packet is accepted and the sliding window is pulled forward to the leading edge = sn.

[0071] 3) When the sequence number is within the sliding window, that is, when sn≥x and sn≤x+w-1, determine whether sn has been marked within the sliding window:

[0072] If it has not been marked, the IPsec packet is accepted and the sn is marked in the sliding window;

[0073] If it has already been marked, it means that the IPsce packet is a replay packet and will be discarded directly.

[0074] It can be seen that when the sequence number sn of the received IPsec packet falls outside the trailing edge of the sliding window, the receiver cannot actually determine whether the packet is a replay attack packet or a "late" packet caused by out-of-order delivery.

[0075] In widespread deployments, an IPsec Security Associate (SA) can allow encryption and decryption of packets with varying priorities. For example, in wireless backhaul scenarios, both high-priority signaling packets and low-priority data packets can be processed and transmitted through a single IPsec SA. High-priority signaling packets require priority access via the "fast lane," while low-priority data packets are only allowed to use the "normal lane."

[0076] When the receiver's sliding window slides forward step by step according to the sequence number of low-priority packets, there may be cases where high-priority IPxec packets with larger sequence numbers arrive early. This will cause the leading edge of the receiver's sliding window to be pulled to the position of larger sequence numbers, causing some low-priority IPsec packets with smaller sequence numbers to be mistakenly identified as replay attack packets and discarded.

[0077] For example, Figure 1 illustrates a high-priority packet overtaking scenario. As shown in Figure 1, taking the sequence numbers of low-priority IPsec packets in the order of their generation time as X, X+1, X+2, X+3, X+4, X+5, and X+6 as an example, suppose a new high-priority IPsec packet with sequence number X+7 is generated. In order to prioritize the high-priority IPsec packet, the IPsec packet with sequence number X+7 needs to be transmitted first (Figure 1 illustrates high-priority overtaking as an example), and then the IPsec packets with sequence numbers X, X+1, X+2, X+3, X+4, X+5, and X+6 are transmitted. This results in out-of-order transmission within an IPsec SA.

[0078] After receiving the IPsec packet with sequence number X+7, the receiving end, according to the sliding window processing principle described above, needs to move the leading edge of the sliding window to position X+7. Taking a sliding window width of 5 as an example, the trailing edge of the sliding window is also moved to position X+3. When the receiving end then receives IPsec packets with sequence numbers X, X+1, and X+2, according to the same sliding window processing principle, these IPsec packets, whose sequence numbers are less than the trailing edge of the sliding window (or in other words, the sequence number at the trailing edge of the sliding window is X+3), will be considered replay packets and discarded directly.

[0079] In the era of low-speed IPsec SA, IPsec packets were generated at a relatively low rate. The sequence numbers of out-of-order high-priority IPsec packets and low-priority IPsec packets were not significantly different. For example, in the example shown in Figure 1, the sequence number X+7 of the high-priority IPsec packet differed by 7 from the sequence number X of the low-priority IPsec packet. If the width of the sliding window was increased from 5 to 8, the IPsec packet with sequence number X could then be accepted normally. Therefore, in the era of low-speed IPsec SA, widening the sliding window could address the issue of out-of-order IPsec packet drops. Furthermore, even if a drop did occur, as can be seen from the example in Figure 1, the number of dropped packets was limited.

[0080] However, with the advent of high-speed networks, the depth of out-of-order IPsec packets has increased significantly. When high-priority packets arrive at the receiver, their sequence numbers precede those of low-priority packets by a large margin. For example, a high-priority IPsec packet with sequence number X+100 arrives before a low-priority IPsec packet with sequence number X. The receiver's window is pulled further forward, and many IPsec packets with sequence numbers before X+100 may be mistakenly discarded. Increasing the window width cannot keep pace with the increasing depth of out-of-order packets; a wider window consumes more resources, severely impacting the performance of the IPsec receiver system. Packet loss due to out-of-order packets is becoming increasingly severe in the era of high-speed networks.

[0081] To address the issue of accidental IPsec packet drop in the era of high-speed IPsec SAs, the core IPsec standard RFC 4301 provides a solution: the parallel IPsec SA scheme. The parallel IPsec SA scheme establishes multiple IPsec SAs between the sender and receiver, with each IPsec SA handling and transmitting one or more priority IPsec packets.

[0082] However, the parallel IPsec SA scheme will multiply the number of IPsec SAs, and each IPsec SA must maintain its own context, which will be a huge burden for both the sender and receiver.

[0083] It can be seen that both the solution of widening the sliding window and the parallel IPsec SA solution are only theoretical solutions and are difficult to deploy on a large scale in practice.

[0084] Based on this, embodiments of this application provide a packet processing method. This method can add a preset buffer at the receiving end to store sequence numbers that are not consecutive with the sequence numbers within the sliding window. Then, based on the comparison result between the sequence number of the IPsec packet to be processed and the sliding window and the preset buffer, anti-replay processing is performed on the IPsec packet to be processed. In this way, when the receiving end receives a high-priority IPsec packet, the larger sequence number of the high-priority IPsec packet can be stored in the preset buffer, without affecting the sliding window being pushed forward too far. Therefore, without the other end device being aware of this, the method greatly avoids the accidental dropping of packets when receiving deep out-of-order IPsec packets.

[0085] The message processing method provided in the embodiments of this application will be described by way of example below with reference to the accompanying drawings.

[0086] The message processing method provided in this application can be applied to a communication system consisting of a sender and a receiver. Figure 2 shows a schematic diagram of the composition of a communication system provided in this application. As shown in Figure 2, the communication system may include: a sender 100 and a receiver 200.

[0087] An IPsec tunnel can be established between the sender 100 and the receiver 200. The sender 100 and the receiver 200 can send and receive IPsec packets through the IPsec tunnel.

[0088] As an example, the transmitting end 100 may include at least one first terminal device 110 (one is shown as an example in FIG2) and at least one first network device 120 (one is shown as an example in FIG2). The receiving end 200 may include at least one second terminal device 210 (one is shown as an example in FIG2) and at least one second network device 220 (one is shown as an example in FIG2).

[0089] The first terminal device 110 and the second terminal device 210 can be terminal devices with computing and processing functions, such as computers or servers. This application embodiment does not limit the specific form of the first terminal device 110 and the second terminal device 210. The first network device 120 and the second network device 220 can be network devices with gateway functions, such as firewalls or routers. This application embodiment does not limit the specific form of the first network device 120 and the second network device 220.

[0090] An IPsec tunnel can be established between the first network device 120 and the second network device 220.

[0091] The first terminal device 110 can generate an IP data packet to be transmitted, which includes the address of the second terminal device 210. Then, the first terminal device 110 can encrypt the IP data packet according to the IPsec policy and send the encrypted data packet to the first network device 120.

[0092] The first network device 120 can package data packets from the first terminal device 110 according to the configured IPsec policy to obtain IPsec packets.

[0093] The packetization process may include adding an outer IP header (including the source address: the public IP address of the first network device 120, and the destination address: the public IP address of the second network device 220) and an IPsec protocol header (such as an authentication header (AH) or an encapsulating security payload (ESP)). The IPsec protocol header may include the sequence number of the IPsec packet.

[0094] For example, the first network device 120 can negotiate with the second network device 220 to create an SA (Security Association) for providing secure communication services between the two network devices. When a new SA is created, a sequence number counter can be generated, initialized to 0. Each time the first network device 120 packages or sends an IPsec packet on this SA, the sequence number counter increments by 1, and the value of the sequence number counter is strictly monotonically increasing. During packet processing, the first network device 120 can set the value of the sequence number field in the IPsec header to the value of the sequence number counter.

[0095] The first network device 120 can send the packaged IPsec packets to the second network device 220 through an IPsec tunnel.

[0096] The second network device 220 can perform anti-replay processing on IPsec packets based on the sequence number in the IPsec packet. The specific anti-replay process can be referred to the packet processing method provided in the following method embodiment, and will not be repeated here.

[0097] In some embodiments, the anti-replay process may include discarding or accepting. Discarding can be understood as deleting the IPsec packet. Accepting can be understood as performing further processing on the IPsec packet (e.g., decryption or authentication) and sending the IPsec packet to the subsequent second terminal device 210.

[0098] It is understood that the communication system shown in Figure 2 above is only for the purpose of more clearly illustrating the technical solution of the embodiments of this application, and does not constitute a limitation on the technical solution provided by the embodiments of this application. The actual communication system may include more or fewer components than those in Figure 2, and the embodiments of this application do not limit this.

[0099] Furthermore, as those skilled in the art will recognize, with the evolution of network architecture and the emergence of new business scenarios, the technical solutions provided in the embodiments of this application are also applicable to similar technical problems.

[0100] The message processing method provided in this application embodiment is executed by a communication device (e.g., the second network device 220 in FIG2 above), or it may be a processor (e.g., a central processing unit (CPU)) in the aforementioned communication device; or it may be a software system in the aforementioned communication device; or it may be a functional module or functional unit in the aforementioned communication device for executing the message processing method, etc. This application embodiment does not limit this.

[0101] For simplicity, the following description will use a communication device as the executing entity.

[0102] Figure 3 shows a schematic diagram of the composition of a communication device provided in an embodiment of this application. This communication device can be the second network device 220 in the communication system shown in Figure 2. As shown in Figure 3, the communication device may include: at least one processor 31, a memory 32, a communication interface 33, and a bus 34.

[0103] The following section, with reference to Figure 3, provides a detailed description of each component of the communication device.

[0104] Processor 31 is the control center of the communication device. It can be a single processor or a collective term for multiple processing elements. For example, processor 31 can be a CPU, an application-specific integrated circuit (ASIC), or one or more integrated circuits configured to implement the embodiments of this application, such as one or more digital signal processors (DSPs), or one or more field-programmable gate arrays (FPGAs), etc.

[0105] The processor 31 can perform various functions of the communication device by running or executing software programs stored in the memory 32 and by calling data stored in the memory 32. For example, it can execute the steps performed by the communication device in the message processing method provided in the embodiments of this application.

[0106] In a specific implementation, as one example, processor 31 may include one or more CPUs, such as CPU0 and CPU1 shown in FIG3.

[0107] In a specific implementation, as one example, the communication device may include multiple processors, such as processor 31 and processor 35 shown in FIG. 3. Each of these processors may be a single-core processor (single-CPU) or a multi-core processor (multi-CPU). Here, a processor may refer to one or more devices, circuits, and / or processing cores for processing data (e.g., computer program instructions).

[0108] The memory 32 is used to store software programs that execute the method steps performed by the communication device of this application, and is controlled by the processor 31 to execute. The memory 32 may be a read-only memory (ROM) or other types of static storage devices that can store static information and instructions, random access memory (RAM) or other types of dynamic storage devices that can store information and instructions, or electrically erasable programmable read-only memory (EEPROM), compact disc read-only memory (CD-ROM) or other optical disc storage, optical disc storage (including compressed optical discs, laser discs, optical discs, digital universal optical discs, Blu-ray discs, etc.), magnetic disk storage media or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and that can be accessed by a computer, but is not limited thereto.

[0109] The memory 32 can exist independently and be connected to the processor 31 via the bus 34. Alternatively, the memory 32 can be integrated with the processor 31; there is no limitation on this.

[0110] Communication interface 33, using any transceiver-like device, is used for communicating with other devices or communication networks. Communication interface 33 can be an Ethernet interface, a radio access network (RAN) interface, a wireless local area network (WLAN) interface, etc. Communication interface 33 may include a receiving unit to implement receiving functions and a transmitting unit to implement transmitting functions.

[0111] Bus 34 can be an industry standard architecture (ISA) bus, a peripheral component interconnect (PCI) bus, or an extended industry standard architecture (EISA) bus. This bus can be divided into address bus, data bus, control bus, etc. For ease of representation, only one thick line is used in Figure 3, but this does not indicate that there is only one bus or one type of bus.

[0112] Although bus 34 is used in Figure 3, it is understandable that the bus can be replaced with other forms of connection, and is not limited to the bus itself.

[0113] The message processing method provided in the embodiments of this application is described below. Optionally, this method can be executed by a communication device having the hardware structure shown in FIG3 above. FIG4 shows a schematic flowchart of a message processing method provided in the embodiments of this application. As shown in FIG4, the method may include the following steps:

[0114] S101. Obtain the sequence number of the IPsec packet to be processed.

[0115] The IPsec packet to be processed can be understood as an IPsec packet received by the communication device (second network device 220) from the peer communication device (first network device 120). The IPsec packet to be processed can be a high-priority IPsec packet as described in the background section above, or a low-priority IPsec packet. This application embodiment does not limit this.

[0116] In one possible implementation, as described above, the IPsec header of the IPsec packet may include the sequence number of the IPsec packet. In this case, the communication device can directly parse the IPsec header to obtain the sequence number of the IPsec packet.

[0117] S102. Based on the comparison results between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window and the sequence number recorded in the preset cache, perform anti-replay processing on the IPsec packet to be processed.

[0118] The preset cache is used to record current sequence numbers that are not consecutive with those in the sliding window. The sliding window can include consecutive or non-consecutive sequence numbers; this embodiment does not restrict whether the sequence numbers in the sliding window are consecutive. Replay protection may include discarding or accepting.

[0119] As an example, the communication device can first compare the sequence number of the IPsec packet to be processed with the sequence number in the sliding window and the sequence number recorded in the preset cache to determine whether they are duplicates. If they are duplicates, the IPsec packet to be processed is discarded. If they are not duplicates, the device can determine whether to discard or accept the packet based on the result of comparing the sequence number of the IPsec packet to be processed with the sequence numbers at the leading and trailing edges of the sliding window.

[0120] Optionally, the serial numbers stored in the preset cache can also be stored in a preset order of size.

[0121] For example, the preset size order can be from smallest to largest, or from largest to smallest. This application does not impose any limitations on this.

[0122] Optionally, the preset cache can use data structures such as arrays or queues to store the sequence numbers. This application embodiment does not limit the specific data structure of the preset cache.

[0123] The message processing method provided in this application can add a preset cache to the existing sliding window to store sequence numbers that are not consecutive with the sequence numbers in the sliding window. It then performs anti-replay processing on the IPsec message to be processed based on the comparison between the obtained sequence number of the IPsec message to be processed and the sliding window and the preset cache. Generally, the transmission efficiency of low-priority IPsec messages (such as the data messages mentioned above) is lower than that of high-priority IPsec messages (such as the signaling messages mentioned above). Therefore, high-priority IPsec messages with large sequence numbers may arrive at the receiving end before low-priority IPsec messages with small sequence numbers. After adding the preset cache, out-of-order sequence numbers that are not consecutive with the sequence numbers in the sliding window can be temporarily stored in the preset cache. This avoids the situation where the leading edge of the sliding window is suddenly pulled to a larger sequence number, thus preventing "late" low-priority IPsec messages from being dropped because their sequence numbers are smaller than the trailing edge of the pulled sliding window, greatly ensuring service performance.

[0124] Furthermore, compared to the widened sliding window scheme in related technologies, the packet processing method provided in this application embodiment eliminates the need to configure an ultra-wide sliding window for high-speed IPsec SA to avoid accidental packet loss, thus greatly saving system resources. In IPsec hardware-accelerated systems, IPsec replay protection is handled on-chip, and on-chip storage resources are very scarce. The packet processing method provided in this application can expand the IPsec specification by saving resources.

[0125] Furthermore, compared with the parallel IPsec SA scheme proposed in the standard protocol RFC4301, the message processing method provided in this application embodiment does not require increasing the number of IPsec SAs, nor does it require maintaining the context of multiple IPsec SAs, thus reducing the burden on IPsec bidirectional entities.

[0126] Finally, the preset cache in the message processing method provided in this application embodiment can be set independently at the receiving end without negotiation with the sending end, is fully compatible with the peer end, and does not require deployment of both IPsec bidirectional entities to obtain gains. Gains can be obtained after deployment of the IPsec processing end on one side, which greatly reduces deployment costs and speeds up the deployment pace.

[0127] In some possible embodiments, the communication device can perform replay protection based on whether the sequence number of the IPsec packet to be processed is duplicated with the sequence number in the sliding window and the sequence number in the preset cache. In this case, the above S102 may specifically include the following steps:

[0128] Step 1a: If the sequence number of the IPsec packet to be processed is the same as the sequence number recorded in the sliding window or the sequence number recorded in the preset cache, the IPsec packet to be processed shall be discarded.

[0129] For example, if the sequence numbers recorded in the sliding window are 1, 2, 3, 4, 5, 6, 7, 8, 9, and the sequence numbers recorded in the preset cache are 100, 200, 300, and the sequence number of the IPsec packet to be processed obtained by the communication device is 6, then the sequence number of the IPsec packet to be processed is the same as the sequence number in the sliding window. The communication device can determine that the IPsec packet to be processed is a replay packet and discard the IPsec packet to be processed.

[0130] For example, if the sequence numbers recorded in the sliding window are 1, 2, 3, 4, 5, 6, 7, 8, 9, and the sequence numbers recorded in the preset cache are 100, 200, 300, and the sequence number of the IPsec packet to be processed obtained by the communication device is 100, then the sequence number of the IPsec packet to be processed is the same as the sequence number in the preset cache. The communication device can determine that the IPsec packet to be processed is a replay packet and discard the IPsec packet to be processed.

[0131] Step 2a: If the sequence number of the IPsec packet to be processed does not overlap with the sequence number recorded in the sliding window and the sequence number recorded in the preset cache, further anti-replay processing is performed on the IPsec packet to be processed based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window.

[0132] For example, the communication device can perform further replay protection processing on the IPsec packet to be processed based on the relationship between the sequence number of the IPsec packet and the sequence number at the trailing edge of the sliding window. In this case, step 2a above can specifically include the following situations:

[0133] Case 1: If the sequence number of the IPsec packet to be processed is less than the sequence number at the trailing edge of the sliding window, then the IPsec packet to be processed is discarded.

[0134] For example, taking a sliding window with a width of 6, sequence numbers within the sliding window of 4, 5, 6, 7, 8, and 9, a sequence number of 4 at the leading edge of the sliding window, a sequence number of 9 at the trailing edge of the sliding window, and sequence numbers of 100, 200, and 300 in the preset cache as an example, assuming the communication device obtains a sequence number of 3 for the IPsec packet to be processed, then the sequence number of the IPsec packet to be processed does not overlap with the sequence numbers in the sliding window and the preset cache, and the sequence number 3 of the IPsec packet to be processed is less than the sequence number 4 at the trailing edge of the sliding window, the communication device can determine that the IPsec packet to be processed is a replay packet and discard the IPsec packet to be processed.

[0135] Case 2: If the sequence number of the IPsec packet to be processed is greater than or equal to the sequence number at the trailing edge of the sliding window, then the IPsec packet to be processed is accepted.

[0136] For example, taking the sequence numbers within the sliding window as 1, 2, 3, 4, 5, 7, 8, 9, and the sequence numbers in the preset cache as 100, 200, 300, if the communication device obtains a sequence number of 6 for the IPsec packet to be processed, then the sequence number of the IPsec packet to be processed does not overlap with the sequence numbers in the sliding window and the preset cache. Furthermore, since the sequence number 6 of the IPsec packet to be processed is greater than the sequence number 1 at the trailing edge of the sliding window, the communication device can determine that the IPsec packet to be processed is not a replay packet and accept it. And because the sequence number 6 is less than the sequence number 9 at the leading edge of the sliding window, the window is not closed at this time.

[0137] For example, taking the sequence numbers within the sliding window as 1, 2, 3, 4, 5, 7, 8, 9, and the sequence numbers in the preset cache as 100, 200, 300, if the communication device obtains a sequence number of 10 for the IPsec packet to be processed, then the sequence number of the IPsec packet to be processed does not overlap with the sequence numbers in the sliding window and the preset cache. Furthermore, the sequence number 10 of the IPsec packet to be processed is greater than the sequence number 1 at the trailing edge of the sliding window. The communication device can determine that the IPsec packet to be processed is not a replay packet and accept it. Since sequence number 10 is greater than the sequence number 9 at the leading edge of the sliding window, and sequence number 10 and sequence number 9 at the leading edge of the sliding window are consecutive, pulling sequence number 9 at the leading edge of the sliding window to 10 will change the sequence numbers within the sliding window to 2, 3, 4, 5, 7, 8, 9, 10 after the window is pulled.

[0138] In some possible embodiments, when accepting the IPsec packet to be processed based on the comparison result in S102, the communication device may record the sequence number of the IPsec packet to be processed into the sliding window or a preset cache according to the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window.

[0139] In one possible implementation, the communication device can combine the priority of the IPsec packets to be processed to record the sequence number of the IPsec packets into a sliding window or a preset buffer. For example, this could include the following specific scenarios:

[0140] Case 1: If the priority parameter of the IPsec packet to be processed is higher than or equal to the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window and is not continuous with the sequence number at the leading edge of the sliding window, the communication device will record the sequence number of the IPsec packet to be processed into the preset cache.

[0141] The priority parameter can be a Differentiated Services Code Point (DSCP) value or other parameters characterizing the priority of the IPsec packet to be processed. This application embodiment does not limit the specific type of priority parameter. The priority parameter threshold can be preset in the communication device. Taking a DSCP value as an example, the priority parameter threshold can be set to 46 or 48, etc. This application embodiment does not limit the specific value of the priority parameter threshold.

[0142] For example, taking the sequence numbers in the sliding window as 1, 2, 3, 4, 5, 7, 8, 9, and the priority parameter threshold as 46, assuming that the DSCP value of the IPsec packet to be processed obtained by the communication device is 48 and the sequence number is 100, after the communication device accepts the IPsec packet to be processed, since the DSCP value of the IPsec packet to be processed is 48, which is greater than the priority parameter threshold 46, and the sequence number 100 is greater than the sequence number 9 at the front edge of the sliding window and is not continuous with 9, the sequence number of the IPsec packet to be processed is significantly different from the sequence number in the sliding window. Therefore, the communication device can temporarily store the sequence number 100 of the IPsec packet to be processed in a preset cache.

[0143] Case 2: If the priority parameter of the IPsec packet to be processed is higher than or equal to the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than or equal to the sequence number at the rear edge of the sliding window and less than the sequence number at the front edge of the sliding window, then the sequence number of the IPsec packet to be processed is recorded in the sliding window.

[0144] For example, taking a sliding window with sequence numbers 1, 2, 3, 4, 5, 7, 8, 9 and a priority parameter threshold of 46, assuming the communication device receives an IPsec packet with a DSCP value of 48 and a sequence number of 6, after accepting the IPsec packet, because the DSCP value of 48 is greater than the priority parameter threshold of 46, and the sequence number 6 is greater than the sequence number 1 at the rear edge of the sliding window but less than the sequence number 9 at the front edge, the sequence number of the higher-priority IPsec packet falls into the sliding window. The communication device can then record the sequence number 6 of the IPsec packet into the sliding window. At this time, the sequence numbers in the sliding window are 1, 2, 3, 4, 5, 6, 7, 8, 9.

[0145] Case 3: If the priority parameter of the IPsec packet to be processed is lower than the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, record the sequence number of the IPsec packet to be processed into the sliding window, and pull the leading edge of the sliding window to the sequence number of the IPsec packet to be processed.

[0146] For example, consider a scenario where the sequence number of the IPsec packet to be processed is consecutive to the sequence number at the leading edge of the sliding window. Assume the sequence numbers within the sliding window are 1, 2, 3, 4, 5, 7, 8, 9, the priority threshold is 46, the DSCP value of the IPsec packet to be processed is 0, and the sequence number is 10. After the communication device receives the IPsec packet, because the DSCP value of the IPsec packet to be processed is 0 (less than the priority threshold 46), and the sequence number 10 is greater than the sequence number 9 at the leading edge of the sliding window, the sequence number of the lower-priority IPsec packet to be processed is before the sliding window. Therefore, the communication device can record the sequence number 10 of the IPsec packet to be processed into the sliding window and pull it forward until the leading edge of the sliding window is 10. At this point, the sequence numbers within the sliding window are 2, 3, 4, 5, 7, 8, 9, 10.

[0147] For example, consider a case where the sequence number of the IPsec packet to be processed is not consecutive to the sequence number at the leading edge of the sliding window. Assume the sequence numbers within the sliding window are 1, 2, 3, 4, 5, 7, 8, 9, the priority parameter threshold is 46, the DSCP value of the IPsec packet to be processed is 0, and the sequence number is 100. After the communication device receives the IPsec packet to be processed, since the DSCP value 0 of the IPsec packet to be processed is less than the priority threshold 46, and the sequence number 100 is greater than the sequence number 9 at the leading edge of the sliding window, the sequence number of the lower-priority IPsec packet to be processed is before the sliding window. The communication device can record the sequence number 100 of the IPsec packet to be processed into the sliding window and pull it forward until the leading edge of the sliding window is 100, correspondingly the trailing edge of the sliding window is 92.

[0148] Case 4: If the priority parameter of the IPsec packet to be processed is lower than the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than the sequence number at the rear edge of the sliding window but less than the sequence number at the front edge of the sliding window, then the sequence number of the IPsec packet to be processed is recorded in the sliding window.

[0149] The handling process for scenario 4 can be referred to the handling process for scenario 2 above, and will not be repeated here.

[0150] In another possible implementation, the communication device can record the sequence number of the IPsec packet to be processed into the sliding window or a preset cache based on the difference between the sequence number of the IPsec packet to be processed and the sequence number at the trailing edge of the sliding window.

[0151] For example, if the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window is greater than the difference threshold, the communication device can record the sequence number of the IPsec packet to be processed into a preset cache; if the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window is less than the difference threshold, the communication device can record the sequence number of the IPsec packet to be processed into the sliding window and pull the leading edge of the sliding window to the sequence number of the IPsec packet to be processed.

[0152] For example, taking the sequence numbers within the sliding window as 1, 2, 3, 4, 5, 7, 8, 9, and the difference threshold as 5, assuming the sequence number of the IPsec packet to be processed is 20, then the difference between the sequence number 20 of the IPsec packet to be processed and the sequence number 9 at the leading edge of the sliding window is 20-9=11, which is greater than the difference threshold. At this time, it can be considered that the sequence number of the IPsec packet to be processed differs greatly from the sequence number within the sliding window, and the communication device can temporarily store the sequence number of the IPsec packet to be processed in a preset cache.

[0153] For example, taking the sequence numbers within the sliding window as 1, 2, 3, 4, 5, 7, 8, 9, and the difference threshold as 5, assuming the sequence number of the IPsec packet to be processed is 12, the difference between the sequence number 12 of the IPsec packet to be processed and the sequence number 9 at the leading edge of the sliding window is 12-9=3, which is less than the difference threshold. At this time, it can be considered that the sequence number of the IPsec packet to be processed is small compared with the sequence number within the sliding window. The communication device can record the sequence number of the IPsec packet to be processed into the sliding window and pull it to the leading edge of the sliding window, where the sequence number is 12. At this time, the sequence numbers within the sliding window are 4, 5, 7, 8, 9, 12, with the sequence number corresponding to the leading edge of the sliding window being 12 and the sequence number corresponding to the trailing edge being 4.

[0154] It should be noted that, if the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window is equal to the difference threshold, the communication device may record the sequence number of the IPsec packet to be processed into a preset cache; alternatively, the communication device may record the sequence number of the IPsec packet to be processed into the sliding window and then pull the window. This application embodiment does not impose any limitations on this.

[0155] Optionally, the difference threshold can be preset in the communication device. For example, the difference threshold can be set to 5, 10, 50, or 100, etc. This application embodiment does not limit the specific value of the preset difference threshold.

[0156] Alternatively, the difference threshold can also be determined based on the width of the sliding window.

[0157] For example, the difference threshold can be specifically implemented as the product of the width of the sliding window and a preset scaling factor.

[0158] The preset scaling factor is greater than 0. For example, the preset scaling factor can be set to 0.3, 0.5, 0.8, 1, or 1.5, etc. This application embodiment does not limit the specific value of the preset scaling factor.

[0159] For example, taking a sliding window width of 20 as an example, assuming a preset scaling factor of 0.5, the difference threshold is 20 × 0.5 = 10. At this time, serial numbers that are more than 10 serial numbers greater than the leading edge of the sliding window can be stored in the preset cache, while serial numbers that are less than 10 serial numbers greater than the leading edge of the sliding window can be stored in the sliding window and the window can be pulled down.

[0160] In another possible implementation, if the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window and is continuous with the sequence number at the leading edge of the sliding window, the communication device can record the sequence number of the IPsec packet to be processed into the sliding window and pull the leading edge of the sliding window to the sequence number of the IPsec packet to be processed.

[0161] For example, taking the sequence numbers in the sliding window as 1, 2, 3, 4, 5, 7, 8, 9, assuming the sequence number of the IPsec packet to be processed is 10, which is greater than the sequence number 9 at the front edge of the sliding window and is consecutive to 9, the communication device can record the sequence number 10 of the IPsec packet to be processed into the sliding window and pull the front edge of the sliding window to 10. At this time, the sequence numbers in the sliding window are 2, 3, 4, 5, 7, 8, 9, 10.

[0162] In some embodiments, the preset cache may also have a capacity limit, which can be used to indicate the maximum number of sequence numbers that the preset cache can store. For example, the maximum number of sequence numbers that the preset cache can store can be set to 5, 10, 50, or 100, etc. This application embodiment does not limit the capacity limit of the preset cache. In this case, for the situation of recording the sequence number of the IPsec packet to be processed into the preset cache, the above-mentioned step of recording the sequence number of the IPsec packet to be processed into the sliding window or the preset cache can specifically include the following steps:

[0163] Step 1b: If the preset cache has reached its capacity limit, record the minimum serial number in the preset cache into the sliding window, drag the leading edge of the sliding window to the minimum serial number, and delete the minimum serial number in the preset cache at the same time to obtain the updated preset cache.

[0164] For example, before recording the sequence number of the IPsec packet to be processed into the preset cache, the communication device can also determine whether the preset cache has reached its capacity limit.

[0165] Optionally, the step of pulling the leading edge of the sliding window to the minimum serial number in step 1b above may specifically include: if the serial number at the leading edge of the sliding window is less than the minimum serial number, pulling the leading edge of the sliding window to the minimum serial number.

[0166] In this way, the leading edge of the sliding window will only be pulled to the minimum serial number if the serial number at the leading edge of the sliding window is smaller than the minimum serial number in the preset cache. This avoids the situation where the leading edge of the sliding window is pulled back if the minimum serial number is smaller than the serial number at the leading edge of the sliding window.

[0167] Step 2b: Record the sequence number of the IPsec packet to be processed into the updated preset cache.

[0168] For example, taking sequence numbers 1, 2, 3, 4, 5, 7, 8, 9 within the sliding window, and sequence numbers 50, 51, 52, 80, 100 in the preset cache as an example, assuming the preset cache's capacity limit is 5 sequence numbers, the preset cache has reached its capacity limit. If the sequence number of the IPsec packet to be processed is 200, it needs to be recorded in the preset cache. In this case, the smallest sequence number 50 in the preset cache can be deleted, and this smallest sequence number 50 can be recorded in the sliding window. The leading edge of the sliding window is then moved to the position of this smallest sequence number 50, and the sequence number 200 is recorded in the updated preset cache. At this point, the leading edge of the sliding window is 50, the trailing edge is 42, and the sliding window is marked with sequence number 50. The sequence numbers in the preset cache are 51, 52, 80, 100, 200.

[0169] The message processing method provided in this application embodiment can also forcibly pull the sliding window to the minimum sequence number of the preset cache when the preset cache reaches its capacity limit. This can prevent the preset cache from overflowing and also maintain the continuity of the sequence number within the sliding window, thereby avoiding record loss.

[0170] In some possible embodiments, during the process of sliding the window, the window can also consume the sequence number recorded in a preset cache.

[0171] For example, during the sliding window process, if there is a target sequence number in the preset cache that is consecutive to the sequence number at the leading edge of the sliding window, or if there is a target sequence number that is greater than or equal to the sequence number at the trailing edge of the sliding window but less than the sequence number at the leading edge of the sliding window, the communication device can record the target sequence number into the sliding window, pull the leading edge of the sliding window to the target sequence number, and delete the target sequence number from the preset cache.

[0172] For example, if the communication device pulls the sliding window forward to the leading edge of the sliding window being 10, and the serial numbers inside the sliding window are 2, 3, 4, 5, 7, 8, 9, 10, and the serial numbers in the preset cache are 11, 20, 30, 100, and the target serial number 11 in the preset cache is consecutive to the serial number 10 at the leading edge of the sliding window, the communication device can transfer the target serial number 11 from the preset cache to the sliding window. This can also be understood as the communication device pulling the sliding window forward to the leading edge of the sliding window being 11, and correspondingly the trailing edge of the sliding window being 3, the serial numbers inside the sliding window being updated to 3, 4, 5, 7, 8, 9, 10, 11, and the serial numbers in the preset cache being updated to 20, 30, 100.

[0173] For example, if the communication device pulls the sliding window forward to the front edge of the sliding window being 10, and the serial numbers inside the sliding window are 2, 3, 4, 5, 7, 8, 10, and the serial numbers in the preset cache are 9, 20, 30, 100, and there is a target serial number 9 in the preset cache that is greater than the serial number 2 at the rear edge of the sliding window and less than the serial number 10 at the front edge of the sliding window, the communication device can transfer the target serial number 9 from the preset cache to the sliding window.

[0174] For example, during the sliding window process, if there is a target sequence number in the preset cache that is smaller than the sequence number at the rear edge of the sliding window, the communication device can delete the target sequence number from the preset cache.

[0175] For example, taking the aforementioned communication device pulling the sliding window forward to the leading edge of the sliding window being 100, and the serial number inside the sliding window being 100, assuming that the serial numbers in the preset cache are 50, 200, 300, and 400, and that there is a target serial number 50 in the preset cache that is less than the serial number 93 at the trailing edge of the sliding window, the communication device can delete the target serial number 50 from the preset cache, and the serial numbers in the preset cache will be 200, 300, and 400.

[0176] In this way, the serial number within the sliding window and the serial number record in the preset cache will not be broken, meaning that the serial number will not appear within the range of the maximum serial number in the preset cache and the serial number at the trailing edge of the sliding window, thus preventing the loss of serial number records.

[0177] In other embodiments, to reduce processing overhead, the communication device may not consume the sequence numbers recorded in the preset cache during the windowing process, and only process the sequence numbers recorded in the preset cache when the preset cache reaches its capacity limit. In this case, the method may further include the following steps:

[0178] Step 1c: If the preset cache has reached its capacity limit, record the N smallest serial numbers in the preset cache into the sliding window, drag the leading edge of the sliding window to the largest serial number among the N smallest serial numbers, and delete the N smallest serial numbers in the preset cache at the same time.

[0179] Wherein, N is a positive integer. For example, N can be 1, 2, 3 or 4, etc. The specific value of N is not limited in the embodiments of this application.

[0180] For example, taking N as 2, and the serial numbers in the preset cache as 50, 51, 52, 80, 100, assuming the maximum capacity of the preset cache is 5 serial numbers, the preset cache has reached its capacity limit. The communication device can record the two smallest serial numbers 50 and 51 in the preset cache into the sliding window, pull the leading edge of the sliding window to 51, and delete 50 and 51 from the preset cache. The serial numbers in the preset cache are then updated to 52, 80, 100.

[0181] Optionally, the step of pulling the leading edge of the sliding window to the largest serial number among the N smallest serial numbers in step 1c above can specifically include: if the serial number at the leading edge of the sliding window is less than the largest serial number among the N smallest serial numbers, then pull the leading edge of the sliding window to the largest serial number among the N smallest serial numbers.

[0182] Based on the understanding of the above embodiments, Figure 5 shows a schematic diagram of the joint anti-replay process of sliding window and preset cache provided in the embodiments of this application.

[0183] As shown in Figure 5(a), in the initial state, the initial width of the upper preset cache is 0, the serial number in the preset cache is empty, the width of the sliding window is fixed, and the serial number in the sliding window is 0.

[0184] As shown in Figure 5(b), under normal circumstances without out-of-order messages, the upper preset buffer does not store sequence numbers and remains empty, while the sliding window stores sequence numbers in ascending order.

[0185] As shown in Figure 5(c), when a high-priority out-of-order message arrives, the sequence number of the out-of-order message is stored in the preset buffer above (Figure 5(c) is shown as an example with the sequence number of the out-of-order message being 100). At this time, the out-of-order message will not be pulled out of the window, and the sliding window will continue to slide forward according to the consecutive sequence numbers.

[0186] As shown in Figure 5(d), the sliding window catches up with the preset buffer. The sliding window stores the sequence number in an increasing order and slides forward continuously to catch up with the sequence number of out-of-order packets in the preset buffer.

[0187] As shown in Figure 5(e), the sliding window digests the preset cache. When the sliding window moves forward to catch up with the serial number in the preset cache, the serial number in the preset cache can be transferred into the sliding window and digested by the sliding window.

[0188] Based on the understanding of the above embodiments, Figure 6 shows a schematic diagram of the process flow for preventing preset cache overflow provided by the embodiments of this application.

[0189] As shown in Figure 6(a), the serial number in the sliding window can include 1, 2, 3, 4, 5, 6, 7, 8, 9, and the serial number in the preset cache can include 99, 100, 200, 300, 400.

[0190] As shown in Figure 6(b), assuming the maximum capacity of the preset cache is 5 serial numbers, a new serial number 500 needs to be recorded in the preset cache.

[0191] As shown in Figure 6(c), the communication device can transfer the minimum sequence number 99 in the preset cache from the preset cache to the sliding window, and pull the window so that the sequence number at the leading edge of the sliding window is 99.

[0192] Based on the understanding of the above embodiments, Figure 7 shows a schematic diagram of a rule for recording serial numbers into a sliding window and recording them into a preset cache, provided in an embodiment of this application.

[0193] As shown in Figure 7(a), the sequence number within the sliding window can include 5, 7, 8, and 9, while the sequence number in the preset buffer can include 100 and 200. The sequence number 4 of a low-priority message (shown as SN1=4 in Figure 7(a)) is less than the sequence number 5 at the trailing edge of the sliding window. The sequence number 6 of a high-priority message (shown as SN2=6 in Figure 7(a)) is greater than the sequence number 5 at the trailing edge of the sliding window but less than the sequence number 9 at the leading edge of the sliding window. The communication device can record sequence number 6 within the sliding window.

[0194] As shown in Figure 7(b), the sequence numbers within the sliding window can include 5, 6, 7, 8, and 9, while the sequence numbers in the preset buffer can include 100 and 200. The sequence number 150 of a low-priority message (Figure 7(b) shows SN1 = 150 as an example) is greater than the sequence number 9 at the leading edge of the sliding window. The communication device can pull the window to the leading edge with the sequence number 150. Simultaneously, since the sequence number within the sliding window catches up with the sequence number 100 in the preset buffer, the sequence number 100 in the preset buffer is consumed.

[0195] As shown in Figure 7(c), the sequence number within the sliding window can include 5, 6, 7, 8, and 9, while the sequence number in the preset buffer can include 100 and 200. The sequence number 150 of a high-priority message (Figure 7(c) shows SN1=150 as an example) is greater than the sequence number 9 at the leading edge of the sliding window and is not consecutive to 9. The communication device can record 150 into the preset buffer.

[0196] Based on the understanding of the above embodiments, Figure 8 shows another schematic diagram of the rules for recording serial numbers into a sliding window and into a preset cache, provided in the embodiments of this application.

[0197] As shown in Figure 8(a), the sequence number within the sliding window can include 5, 6, 7, 8, and 9, with a difference threshold of 5. The sequence number of the new message is 12, and the difference between it and the sequence number 9 at the leading edge of the sliding window (12-9=3) is less than the difference threshold of 5. The communication device can record 12 into the sliding window and drag it to the leading edge of the sliding window to obtain the sequence number 12.

[0198] As shown in Figure 8(b), the sequence number within the sliding window can include 5, 6, 7, 8, and 9, with a difference threshold of 5. The sequence number of the new message is 20, and the difference between it and the sequence number 9 at the leading edge of the sliding window, 20-9=11, is greater than the difference threshold of 5. Therefore, the communication device can record 20 into the preset buffer above.

[0199] The above mainly describes the solution provided by the embodiments of this application from the perspective of the interaction between various network elements. It is understood that, in order to achieve the above functions, the communication device includes the corresponding hardware structure and / or software module for performing each function.

[0200] For example, this application embodiment can also provide a communication device. Figure 9 shows a schematic diagram of another communication device provided by this application embodiment. As shown in Figure 9, the communication device may include: an acquisition module 901 and a processing module 902. The acquisition module 901 and the processing module 902 can cooperate with each other to execute the message processing method provided in Figure 4 of the foregoing embodiment. For example, the acquisition module 901 can be used to execute the aforementioned S101. The processing module 902 can be used to execute the aforementioned S102, the specific implementation steps of S102, the step of recording the sequence number of the IPsec message to be processed into the sliding window or the preset cache after S102, the specific steps of how to record the sequence number of the IPsec message to be processed into the sliding window or the preset cache after S102, the step of the sliding window digesting the sequence number recorded in the preset cache after S102, and the step of digesting the sequence number recorded in the preset cache after the preset cache reaches its capacity limit.

[0201] It should be understood that the division of modules (or units) in the above device is merely a logical functional division. In actual implementation, they can be fully or partially integrated into a single physical entity, or they can be physically separated. Furthermore, all modules in the device can be implemented entirely in software through processing element calls; all modules can be implemented entirely in hardware; or some modules can be implemented in software through processing element calls, while others can be implemented in hardware.

[0202] For example, each module can be a separate processing element, or it can be integrated into a chip within the device. Alternatively, it can be stored as a program in memory, and its function can be called and executed by a processing element within the device. Furthermore, these modules can be integrated in whole or in part, or implemented independently. The processing element mentioned here can also be called a processor, which can be an integrated circuit with signal processing capabilities. In implementation, each step of the above method or each of the above modules can be implemented through integrated logic circuits in the processor element or through software calls from the processing element.

[0203] In one example, the module in any of the above devices may be one or more integrated circuits configured to implement the above methods, such as one or more ASICs, or one or more DSPs, or one or more FPGAs, or a combination of at least two of these integrated circuit forms.

[0204] For example, when modules in a device can be implemented via a processing element scheduler, the processing element can be a general-purpose processor, such as a CPU or other processor capable of calling programs. Alternatively, these modules can be integrated together to form a system-on-a-chip (SOC).

[0205] In one implementation, the modules of the communication device that implement the corresponding steps in the above methods can be implemented in the form of a processing element scheduler. For example, the communication device may include a processing element and a storage element. The processing element calls the program stored in the storage element to execute the method executed by the corresponding communication device in the above method embodiments. The storage element can be a storage element located on the same chip as the processing element, i.e., an on-chip storage element.

[0206] In another implementation, the program for executing the method performed by the communication device in the above method can be located on a storage element on a different chip than the processing element, i.e., an off-chip storage element. In this case, the processing element calls or loads the program from the off-chip storage element onto the on-chip storage element to call and execute the method executed by the corresponding communication device in the above method embodiments.

[0207] For example, embodiments of this application may also provide a communication device, which may include a memory and a processor. The processor is configured to execute computer instructions stored in the memory. When the computer instructions are executed, the device performs the method described above. The memory may be located within or outside the communication device. The processor may include one or more processors.

[0208] In another implementation, the modules of the communication device that implement the steps of the above methods can be configured as one or more processing elements. These processing elements can be disposed on the communication device, and can be integrated circuits, such as one or more ASICs, one or more DSPs, one or more FPGAs, or combinations of these types of integrated circuits. These integrated circuits can be integrated together to form a chip.

[0209] The modules implementing the various steps of the above method in the communication device can be integrated together and implemented in the form of a System-on-Chip (SoC). This SoC chip is used to implement the corresponding method. The chip can integrate at least one processing element and a storage element, with the processing element calling the stored program in the storage element to implement the corresponding method; alternatively, the chip can integrate at least one integrated circuit to implement the corresponding method; or, a combination of the above implementation methods can be used, with the functions of some modules implemented by the processing element calling the program, and the functions of other modules implemented by the integrated circuit.

[0210] The processing element here is as described above and can be a general-purpose processor, such as a CPU, or one or more integrated circuits configured to implement the above methods, such as one or more ASICs, or one or more microprocessors (DSPs), or one or more FPGAs, or a combination of at least two of these integrated circuit forms.

[0211] A storage element can be a single memory or a collective term for multiple storage elements.

[0212] For example, this application also provides a chip system that can be applied to the aforementioned communication device. The chip system includes one or more interface circuits and one or more processors; the interface circuits and processors are interconnected via lines; the processor receives and executes computer instructions from the electronic device's memory through the interface circuits to implement the methods performed by the corresponding communication devices in the above method embodiments.

[0213] Through the above description of the embodiments, those skilled in the art can clearly understand that, for the sake of convenience and brevity, only the division of the above functional modules is used as an example. In actual applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the device can be divided into different functional modules to complete all or part of the functions described above.

[0214] In the several embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative; for instance, the division of modules or modules is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple modules or components may be combined or integrated into another device, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or modules may be electrical, mechanical, or other forms.

[0215] The modules described as separate components may or may not be physically separate. The components shown as modules can be one or more physical modules, meaning they can be located in one place or distributed in multiple different locations. Some or all of the modules can be selected to achieve the purpose of this embodiment according to actual needs.

[0216] Furthermore, the functional modules in the various embodiments of this application can be integrated into one processing module, or each module can exist physically separately, or two or more modules can be integrated into one module. The integrated modules described above can be implemented in hardware or as software functional modules.

[0217] If the integrated module is implemented as a software functional module and sold or used as an independent product, it can be stored in a readable storage medium. Based on this understanding, the technical solutions of this application, in essence, or the parts that contribute to the prior art, or all or part of the technical solutions, can be embodied in the form of a software product, such as a program. This software product is stored in a program product, such as a computer-readable storage medium, and includes several instructions to cause a device (which may be a microcontroller, chip, etc.) or processor to execute all or part of the steps of the methods described in the various embodiments of this application. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0218] For example, embodiments of this application may also provide a computer-readable storage medium storing computer instructions; when the computer instructions are executed in a communication device or in a chip embedded in the communication device, the communication device may perform the method performed by the communication device as described in the foregoing embodiments.

[0219] Alternatively, when computer instructions are executed in the communication device or in a chip embedded in the communication device, the communication device performs the method described in the foregoing embodiments.

[0220] In an exemplary embodiment, this application also provides a computer program product containing instructions that, when run on a computer, enable the computer to perform the method executed by the communication device as described in the foregoing embodiments.

[0221] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions within the technical scope disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A message processing method, characterized in that, The method includes: Obtain the sequence number of the IPsec packet to be processed; Based on the comparison between the sequence number of the IPsec packet to be processed and the sequence number recorded in the preset cache and the sequence number in the sliding window, the IPsec packet to be processed is subjected to anti-replay processing; the preset cache is used to record the sequence number that is not consecutive with the sequence number in the sliding window.

2. The method according to claim 1, characterized in that, The step of performing anti-replay processing on the IPsec packet to be processed based on the comparison result between the sequence number of the IPsec packet to be processed and the sequence number recorded in the preset cache and the sequence number in the sliding window includes: If the sequence number of the IPsec packet to be processed is the same as the sequence number recorded in the sliding window or the sequence number recorded in the preset cache, the IPsec packet to be processed will be discarded. If the sequence number of the IPsec packet to be processed does not overlap with the sequence number recorded in the sliding window and the sequence number recorded in the preset cache, further anti-replay processing is performed on the IPsec packet to be processed based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window.

3. The method according to claim 2, characterized in that, The step of further preventing replay attacks on the IPsec packet to be processed based on the relationship between the sequence number of the IPsec packet to be processed and the sequence number within the sliding window includes: If the sequence number of the IPsec packet to be processed is less than the sequence number at the trailing edge of the sliding window, then the IPsec packet to be processed is discarded. If the sequence number of the IPsec packet to be processed is greater than or equal to the sequence number at the trailing edge of the sliding window, then the IPsec packet to be processed is accepted.

4. The method according to claim 1, characterized in that, The anti-replay processing includes accepting the IPsec packet to be processed; the method further includes: If the IPsec packet to be processed is accepted based on the comparison result, the sequence number of the IPsec packet to be processed is recorded in the sliding window or the preset cache according to the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window.

5. The method according to claim 4, characterized in that, The step of recording the sequence number of the IPsec packet to be processed into the sliding window or the preset cache based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window includes: If the priority parameter of the IPsec packet to be processed is higher than or equal to the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the sequence number of the IPsec packet to be processed is not continuous with the sequence number at the leading edge of the sliding window, the sequence number of the IPsec packet to be processed is recorded in the preset cache.

6. The method according to claim 4, characterized in that, The step of recording the sequence number of the IPsec packet to be processed into the sliding window or the preset cache based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window includes: If the priority parameter of the IPsec packet to be processed is higher than or equal to the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than or equal to the sequence number at the rear edge of the sliding window, and the sequence number of the IPsec packet to be processed is less than the sequence number at the front edge of the sliding window, then the sequence number of the IPsec packet to be processed is recorded in the sliding window.

7. The method according to claim 4, characterized in that, The step of recording the sequence number of the IPsec packet to be processed into the sliding window or the preset cache based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window includes: If the priority parameter of the IPsec packet to be processed is lower than the priority parameter threshold, and the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, the sequence number of the IPsec packet to be processed is recorded in the sliding window, and the leading edge of the sliding window is pulled to the sequence number of the IPsec packet to be processed.

8. The method according to claim 4, characterized in that, The step of recording the sequence number of the IPsec packet to be processed into the sliding window or the preset cache based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window includes: recording the sequence number of the IPsec packet to be processed into the preset cache when the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window is greater than or equal to a difference threshold.

9. The method according to claim 8, characterized in that, The difference threshold is the product of the width of the sliding window and a preset proportional coefficient, wherein the preset proportional coefficient is greater than 0.

10. The method according to claim 4, characterized in that, The step of recording the sequence number of the IPsec packet to be processed into the sliding window or the preset cache based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window includes: If the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and the difference between the sequence number of the IPsec packet to be processed and the sequence number at the leading edge of the sliding window is less than the difference threshold, the sequence number of the IPsec packet to be processed is recorded in the sliding window, and the leading edge of the sliding window is pulled to the position of the sequence number of the IPsec packet to be processed.

11. The method according to any one of claims 4-10, characterized in that, Regarding the case where the sequence number of the IPsec packet to be processed is recorded in the preset cache, the step of recording the sequence number of the IPsec packet to be processed in the sliding window or the preset cache includes: If the preset cache has reached its capacity limit, the minimum sequence number in the preset cache is recorded in the sliding window, the leading edge of the sliding window is dragged to the minimum sequence number, and the minimum sequence number in the preset cache is deleted at the same time to obtain the updated preset cache; The sequence number of the IPsec packet to be processed is recorded in the updated preset cache.

12. The method according to claim 4, characterized in that, The step of recording the sequence number of the IPsec packet to be processed into the sliding window or the preset cache based on the size relationship between the sequence number of the IPsec packet to be processed and the sequence number in the sliding window includes: If the sequence number of the IPsec packet to be processed is greater than the sequence number at the leading edge of the sliding window, and is consecutive to the sequence number at the leading edge of the sliding window, then the sequence number of the IPsec packet to be processed is recorded in the sliding window, and the leading edge of the sliding window is pulled to the position of the sequence number of the IPsec packet to be processed.

13. The method according to claim 4, characterized in that, The method further includes: During the sliding window process, if there is a target sequence number in the preset cache that is consecutive to the sequence number at the leading edge of the sliding window, or if there is a target sequence number that is greater than or equal to the sequence number at the trailing edge of the sliding window and less than the sequence number at the leading edge of the sliding window, then the target sequence number is recorded in the sliding window, the leading edge of the sliding window is pulled to the target sequence number, and the target sequence number is deleted from the preset cache.

14. The method according to claim 4, characterized in that, The method further includes: During the sliding window process, if a target sequence number exists in the preset cache that is smaller than the sequence number at the rear edge of the sliding window, then the target sequence number is deleted from the preset cache.

15. The method according to claim 4, characterized in that, The method further includes: if the preset cache has reached its capacity limit, then the N smallest sequence numbers in the preset cache are recorded into the sliding window, the leading edge of the sliding window is pulled to the largest sequence number among the N smallest sequence numbers, and the N smallest sequence numbers in the preset cache are deleted at the same time; N is a positive integer.

16. A communication device, characterized in that, include: A memory and a processor, the processor being configured to execute computer instructions stored in the memory, which, when executed, cause the apparatus to perform the method according to any one of claims 1-15.

17. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions; when the computer instructions are executed in the communication device or in a chip embedded in the communication device, they cause the communication device to perform the method described in any one of claims 1-15.

18. A computer program product containing instructions, characterized in that, When it is run on a computer, it enables the computer to perform the method described in any one of claims 1-15.

Images