ESP Packet Service-Type Fields for Low-Overhead Traffic Identification
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for determining the service type of an original packet in IPSec ESP packets require full decryption, leading to high calculation overheads for devices.
Innovation Solution
Incorporating a service type field into the ESP packet structure, allowing devices to parse and determine the service type without decrypting the encrypted part, thereby reducing calculation workload.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If the device decrypts the encrypted part of the ESP packet to determine service type, then the service type can be accurately identified, but the calculation overhead increases significantly
Solution Approach 1:
The encrypted part of the ESP packet is segmented into a service type sub-field and an original data sub-field. The service type sub-field is decrypted and processed first to determine the service type, while the original data sub-field remains encrypted. This segmentation allows the device to identify service types with high accuracy without incurring the full calculation overhead of decrypting the entire encrypted part.
2Loss of information
If the device processes the entire encrypted part, then complete information is obtained, but the processing time and computational resources increase
Solution Approach 1:
The service type information is extracted from the encrypted part and placed in a separate service type sub-field. This extracted field can be decrypted and processed independently and quickly, reducing processing time. The remaining original data sub-field stays encrypted, maintaining information security while avoiding unnecessary decryption of data that doesn't need to be processed immediately.
3Productivity
If a service type field is added to the ESP packet, then service type determination becomes efficient, but the packet structure complexity increases
Solution Approach 1:
Instead of adding a separate service type field throughout the entire packet structure, the service type information is embedded as a specific sub-field within the encrypted part. This localized approach allows receiving devices to quickly access service type information without requiring fundamental changes to the overall ESP packet structure, thus improving processing efficiency while minimizing structural complexity.
Data Source
Figure 1~3
Figure 4~5
Figure 6
AI summary
This application discloses a packet transmission method and apparatus, and a computer storage medium, and belongs to the field of communications technologies. A first device obtains service type information of an original packet. The first device generates an ESP packet of the original packet based on a target security association, where the ESP packet includes a packet header, an ESP header, a service type field, a first encrypted part, and an ESP authentication data field, and the service type field includes the service type information. The first device sends the ESP packet to a second device. The second device parses the service type field to obtain the service type information of the original packet. The second device performs a target operation on the ESP packet based on a service policy and the service type information of the original packet. The second device may obtain the service type information of the original packet by parsing the service type field of the ESP packet, without decrypting the first encrypted part, thereby reducing calculation overheads in a process in which the second device determines a service type of the original packet.