WO2020134413A1 - 一种数据传输方法、装置、相关设备及存储介质 - Google Patents

一种数据传输方法、装置、相关设备及存储介质 Download PDF

Info

Publication number
WO2020134413A1
WO2020134413A1 PCT/CN2019/112548 CN2019112548W WO2020134413A1 WO 2020134413 A1 WO2020134413 A1 WO 2020134413A1 CN 2019112548 W CN2019112548 W CN 2019112548W WO 2020134413 A1 WO2020134413 A1 WO 2020134413A1
Authority
WO
WIPO (PCT)
Prior art keywords
data stream
ipsec tunnel
identifier
spi
sub
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Ceased
Application number
PCT/CN2019/112548
Other languages
English (en)
French (fr)
Inventor
毛玉欣
闫新成
吴华强
刘艳昌
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
ZTE Corp
Original Assignee
ZTE Corp
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by ZTE Corp filed Critical ZTE Corp
Priority to EP19902692.3A priority Critical patent/EP3905623B1/en
Publication of WO2020134413A1 publication Critical patent/WO2020134413A1/zh
Anticipated expiration legal-status Critical
Ceased legal-status Critical Current

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H04L12/4645—Details on frame tagging
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/18—Network architectures or network communication protocols for network security using different networks or channels, e.g. using out of band channels
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L67/00—Network arrangements or protocols for supporting network services or applications
    • H04L67/14—Session management
    • H04L67/141—Setup of application sessions
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/164—Implementing security features at a particular protocol layer at the network layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/24—Negotiation of communication capabilities

Definitions

  • This application relates to the technical field of network communication security, in particular to a data transmission method, device, related equipment, and storage medium.
  • an IPSec tunnel is usually used to protect the integrity of the data.
  • the decryption end after the encryption end transmits the data stream to the decryption end through the IPSec tunnel, the decryption end will transmit each packet of the data stream to multiple decryption units according to a preset algorithm for decryption processing.
  • the decryption end processes the packets of the data stream separately through multiple decryption units, which may aggravate the disorder of the packets.
  • An embodiment of the present application provides a data transmission method, which is applied to a sending end.
  • the method includes: determining a virtual SPI identifier by using a stream identifier of a data stream and an SPI identifier of an IPSec tunnel transmitting the data stream; Each encrypted message in the data stream carries the virtual SPI identifier in the corresponding message; the data stream is transmitted to the receiving end through the IPSec tunnel; the virtual SPI identifier is used for the receiving end Send each message of the data stream to the same decryption unit for decryption processing.
  • An embodiment of the present application provides a data transmission method, which is applied to a receiving end.
  • the method includes: receiving a data stream sent by an sending end through an IPSec tunnel; each packet of the data stream carries a virtual SPI identifier; The virtual SPI identification is determined by the sending end based on the flow identification of the data flow and the SPI identification of the IPSec tunnel transmitting the data flow; using the virtual SPI identification, each packet of the data flow is sent to the same decryption The unit performs decryption processing.
  • An embodiment of the present application provides a data transmission device, which is applied to a sending end.
  • the device includes: a first determining unit configured to utilize a flow identifier of a data stream, and an SPI identifier of an IPSec tunnel transmitting the data stream, to determine Virtual SPI identification; encryption unit, set to carry the virtual SPI identification in the corresponding message for each encrypted message in the data stream; first transmission unit, set to receive through the IPSec tunnel
  • the terminal transmits the data stream; the virtual SPI identifier is used by the receiving end to send each message of the data stream to the same decryption unit for decryption processing.
  • An embodiment of the present application provides a data transmission device, which is applied to a receiving end.
  • the device includes: a first receiving unit configured to receive a data stream sent by a sending end through an IPSec tunnel; each packet of the data stream is carried in There is a virtual SPI identification; the virtual SPI identification is determined by the sending end based on the flow identification of the data flow and the SPI identification of the IPSec tunnel transmitting the data flow; the first decryption unit is set to use the virtual SPI identification, Send each message of the data stream to the same decryption unit for decryption processing.
  • An embodiment of the present application provides a data transmission apparatus, which is applied to a sending end.
  • the apparatus includes: a first determining unit configured to determine a distinguishing identifier of a data stream; and further configured to utilize a distinguishing identifier of a data stream and a sub-IPSec tunnel
  • the mapping relationship of the SPI identifier determines the sub-IPSec tunnel used for the data stream transmission;
  • the second transmission unit is configured to transmit the data stream to the receiving end by using the determined sub-IPSec tunnel; through the determined sub-IPSec tunnel Transmitting the data stream to a decryption unit corresponding to the sub-IPSec tunnel at the receiving end for decryption processing.
  • An embodiment of the present application provides a data transmission device, which is applied to a receiving end.
  • the device includes: a second receiving unit configured to receive a data stream sent by a transmitting end through a sub-IPSec tunnel; a second decrypting unit configured to pass The data stream transmitted by the sub-IPSec tunnel is sent to a decryption unit corresponding to the sub-IPSec tunnel for decryption processing.
  • An embodiment of the present application provides a sending device, including: a first processor and a first memory configured to store a computer program capable of running on the processor, wherein the first processor is configured to run the computer program At any time, perform any of the above steps of the data transmission method at the sending end.
  • An embodiment of the present application provides a receiving device, including: a second processor and a second memory configured to store a computer program that can be run on the processor, wherein the first processor is configured to run the computer program At this time, perform any of the steps of the data transmission method at the receiving end described above.
  • An embodiment of the present application provides a storage medium on which a computer program is stored, and when the computer program is executed by a processor, any step of the above data transmission method is implemented.
  • the data transmission method, device, related equipment and storage medium determine the virtual SPI identifier by using the stream identifier of the data stream and the SPI identifier of the IPSec tunnel transmitting the data stream; Each encrypted message carries the virtual SPI identifier in the corresponding message; transmits the data stream to the receiving end through the IPSec tunnel; the virtual SPI identifier is used by the receiving end to transfer the data Each packet of the stream is sent to the same decryption unit for decryption processing.
  • the sending end sends each message carrying the virtual SPI identifier to the receiving end, so that the receiving end can send messages with the same virtual SPI identifier to the same decryption unit for Decryption processing.
  • the problem of out-of-order messages can be avoided, and the processing performance of the IPSec tunnel can also be improved.
  • Figure 1 is a schematic diagram of the IPSec tunnel in the related art
  • FIG. 2 is a schematic diagram of data transmission through an IPSec tunnel in the related art
  • Figure 3 is a schematic diagram of out-of-order messages in the related art
  • FIG. 4 is a schematic diagram 1 of an implementation process of a data transmission method according to an embodiment of the present application.
  • FIG. 5 is a second schematic flowchart of an implementation method of a data transmission method according to an embodiment of the present application.
  • FIG. 6 is a schematic diagram 3 of an implementation process of a data transmission method according to an embodiment of the present application.
  • FIG. 7 is a schematic diagram 4 of an implementation process of a data transmission method according to an embodiment of the present application.
  • FIG. 8 is a schematic diagram of determining a virtual SPI identifier according to an embodiment of this application.
  • FIG. 9 is a schematic diagram of decrypting a message according to an embodiment of the present application.
  • FIG. 10 is a schematic diagram of data flow transmission through a sub-IPSec tunnel according to an embodiment of the present application.
  • FIG. 11 is a schematic structural diagram 1 of a data transmission device according to an embodiment of the present application.
  • FIG. 12 is a second schematic structural diagram of a data transmission device according to an embodiment of the present application.
  • FIG. 13 is a schematic structural diagram 3 of a data transmission device according to an embodiment of the present application.
  • FIG. 14 is a schematic structural diagram 4 of a data transmission device according to an embodiment of the present application.
  • 15 is a schematic structural diagram 5 of a data transmission device according to an embodiment of the present application.
  • 16 is a schematic structural diagram 6 of a data transmission device according to an embodiment of the present application.
  • an IPSec tunnel needs to be established between the sending end and the receiving end.
  • the IPSec tunnel can be expressed by Security Association (SA).
  • SA Security Association
  • the sender and receiver need to negotiate to establish the SA. Since the IPSec tunnel is unidirectional, an IPSec tunnel includes two SAs, and each SA can be uniquely identified using SPI.
  • the SA agreed to use the same encapsulation mode, encryption algorithm, encryption key, verification algorithm, and verification key at both ends of the tunnel.
  • the encapsulation mode can include encapsulated security payload (ESP, Encapsulating Security Payload), authentication header (AH, Authentication) Header; encryption algorithm can include data encryption standard (DES, Data Encryption Standard), digital encryption standard 3 (3DES, Triple DES ), Advanced Encryption Standard (AES, Advanced Encryption Standard); authentication algorithms can include Message Digest 5 (MD5, Message Digest 5), Secure Hash Algorithm 1 (SHA1, Secure Hash Algorithm1), Secure Hash Algorithm 2 (SHA, Secure HashAlgorithm12).
  • ESP Encapsulated security payload
  • AH Authentication
  • encryption algorithm can include data encryption standard (DES, Data Encryption Standard), digital encryption standard 3 (3DES, Triple DES ), Advanced Encryption Standard (AES, Advanced Encryption Standard)
  • authentication algorithms can include Message Digest 5 (MD5, Message Digest 5), Secure Hash Algorithm 1 (SHA1, Secure Hash Algorithm1), Secure Hash Algorithm
  • the establishment method of the IPSec tunnel may include a manual establishment method and an Internet key exchange protocol (IKE, Internet Key Exchange) dynamic negotiation establishment method.
  • IKE Internet Key Exchange
  • the manual establishment method may include the following steps:
  • Step 1 Configure the ACL and define the data flow to be protected through the Access Control List (ACL, Access Control List), that is, the ACL contains the identification of the data flow to be protected, which is usually a 5-tuple.
  • ACL Access Control List
  • Step 2 Establish IPSec SA.
  • configure an IPSec security proposal both ends of the tunnel configure the same encapsulation mode, encryption algorithm, and verification algorithm in their respective security proposals.
  • Configure IPSec security policy define the address, SA identifier SPI, encryption key, authentication key, etc. used at both ends of the tunnel.
  • Configure and apply IPSec security policies establish IPSec tunnels, and transmit packets through the established IPSec tunnels according to ACL policies.
  • the IKE dynamic negotiation method can include the following steps:
  • Step 1 Configure the ACL to define the data flow to be protected, that is, the ACL contains the identification of the data flow to be protected.
  • IKEv1 if IKEv1 is used, ACL rules are not negotiated, and the ACL rules configured on the devices at both ends of the tunnel mirror each other to avoid IPSec SA negotiation failure.
  • IKEv2 the ACL rules of the devices on both ends are negotiated through the transport selector (TS, Traffic Selector) payload. The final result is the intersection of the ACL rules of both parties.
  • negotiate the IKE security proposal configure the encryption and authentication algorithm when establishing IKE SA, and negotiate the message receiver to find the IKE security proposal matching the sender in the IKE security proposal configured by itself, if there is no matching security proposal Negotiation failed.
  • Configure IKE peer configure IKE version, identity authentication and exchange mode.
  • Establish IPSec SA configure IPSec security proposals: configure the same encapsulation mode, encryption algorithm, and authentication algorithm in the respective security proposals at both ends of the tunnel.
  • Configure IPSec security policy define the address, SA identifier SPI, encryption key, authentication key, etc. used at both ends of the tunnel.
  • Configure and apply IPSec security policies establish IPSec tunnels, and transmit packets through the established IPSec tunnels according to ACL policies.
  • both the manual establishment method and the IKE negotiation method must require the IP addresses used at both ends of the tunnel to be fixed.
  • the sender After establishing an IPSec tunnel, after receiving a data stream, the sender first determines whether each packet of the data stream uses IPSec encryption according to the ACL. If necessary, it searches for the corresponding SA and uses the SA to encrypt the encrypted packets. The text is sent to the receiving end. The receiving end decrypts the encrypted packets of the data stream, and forwards the decrypted packets to the packet destination.
  • FIG. 1 is a schematic diagram of an IPSec tunnel.
  • an IPSec tunnel 1 (denoted by SA1) is established between Gateway A and Gateway B for gateway A to send data and gateway B to receive data; and IPSec tunnel 2 is established (Denoted by SA2), for gateway B to send data, gateway A to receive data.
  • SA1 IPSec tunnel 1
  • SA2 IPSec tunnel 2
  • FIG 2 is a schematic diagram of data transmission through an IPSec tunnel.
  • the data center where the centralized unit (CU, Central Unit) and the distributed unit (DU, Distributed Unit) in the 5G network are located in Africa
  • an IPSec tunnel needs to be established between the two data centers to protect the integrity of the data and prevent the data from being stolen or tampered.
  • 5G networks there is a very high demand for the data transmission rate.
  • the International Telecommunication Union (ITU, International Telecommunication Union) defines a single user peak rate of 10-20Gbps, which requires higher data rates for the backhaul network. If an IPSec tunnel needs to be used on the data transmission path, the processing performance of the IPSec tunnel should also meet the corresponding requirements.
  • the processing performance of the IPSec tunnel is limited by the limitation of the hardware processing performance. If the encryption end or the decryption end uses a single processing unit to encrypt or decrypt the message, the IPSec tunnel can only reach a processing performance of hundreds of Mbps. If the encryption end or the decryption end uses multi-processing units or distributed processing units respectively, after the encryption end transmits the data stream to the decryption end through the IPSec tunnel, the decryption end will transmit each packet of the data stream to multiple decryption units according to a preset algorithm Perform decryption processing. In this way, although the processing performance of the IPSec tunnel can be improved, the offload processing will aggravate the disorder of packets and affect the service experience.
  • FIG. 3 is a schematic diagram of out-of-order messages in the related art.
  • the data flow is composed of message A, message B, message C, and message D.
  • gateway A assigns message A to processing unit 1 for encryption processing according to a preset algorithm, assigns message B to processing unit 2 for encryption processing, and assigns message C to processing unit 3 Encryption processing is performed, and the message D is assigned to the processing unit 4 for encryption processing, and each encrypted message is sent to the gateway B through the IPSec tunnel.
  • the gateway B assigns the encrypted message A to the processing unit 1 for decryption according to a preset algorithm, and assigns the encrypted message B to the processing unit 2 for decryption.
  • the encrypted message C is assigned to the processing unit 3 for decryption processing
  • the encrypted message D is assigned to the processing unit 4 for decryption processing. Since each processing unit may receive packets at different timings, and each processing unit may process packets in different ways, it may cause out-of-sequence of packets.
  • a virtual SPI identifier is determined; for each encrypted in the data stream Message, carrying the virtual SPI identifier in the corresponding message; transmitting the data stream to the receiving end through the IPSec tunnel; the virtual SPI identifier is used by the receiving end to transfer each message of the data stream Send to the same decryption unit for decryption processing.
  • An embodiment of the present application provides a data transmission method, which is applied to a sending end. As shown in FIG. 4, the method includes:
  • Step 401 Determine the virtual SPI identifier by using the stream identifier of the data stream and the SPI identifier of the IPSec tunnel transmitting the data stream.
  • IPSec or IP Security
  • IP Security is a three-layer tunnel encryption protocol developed by the IETF. It can be based on an end-to-end security model to establish trust and security between the source and destination IP addresses.
  • multiple IPSec tunnels may be established between the sending end and the receiving end, and the SPI identification is used for unique identification.
  • the receiving end allocates multiple decryption units for each IPSec tunnel.
  • the packets of the same data stream can be sent to the same decryption unit among multiple decryption units for decryption processing .
  • the flow ID of the data stream and the SPI ID of the IPSec tunnel transmitting the data flow can be used to determine the virtual SPI ID; the virtual SPI ID is used by the receiving end to send packets with the same virtual SPI ID
  • the same decryption unit is processed.
  • the sending end before determining the virtual SPI identifier, the sending end also needs to negotiate with the receiving end regarding the virtual SPI support capability to determine whether the receiving end has the capability of supporting the virtual SPI.
  • the method before using the flow identifier of the data stream and the SPI identifier of the IPSec tunnel transmitting the data stream to determine the virtual SPI identifier, the method further includes: determining the receiving Whether the terminal has the ability to support virtual SPI; when it is determined that the receiving end has the ability to support virtual SPI, the virtual SPI identifier is determined by using the flow identifier of the data stream and the SPI identifier of the IPSec tunnel transmitting the data stream.
  • the sending end and the receiving end negotiate on whether to support the capability of virtual SPI.
  • the negotiation process may be: the sending end sets the SPI identifier of the IPSec tunnel of the data stream, for example, the SPI identifier The highest bit is set to 1, to indicate that the sending end has the ability to support virtual SPI; the sending end sends the set SPI flag to the receiving end; the receiving end reads that the sending end supports virtual SPI capability The receiving end also sets the highest bit of SPI and sends the set SPI flag to the sending end; the sending end determines whether the receiving end has a virtual SPI support according to the SPI flag sent by the receiving end Capability, optionally, if the receiving end sets the value of the highest bit to 1, it indicates that the receiving end has the capability to support virtual SPI, as shown in Table 1; if the receiving end takes the highest bit If the value is set to 0, it means that the receiving end does not have the ability to support virtual SPI, as shown in Table 2.
  • the sending end and the receiving end also need to negotiate IKE SA, IPSec SA to determine the IPSec tunnel used for data flow transmission, That is, an IPSec security policy is established, and the IPSec security policy includes a mapping relationship between the flow ID of the data flow and the SPI ID of the IPSec tunnel.
  • the method before determining the virtual SPI identifier by using the flow identifier of the data stream and the SPI identifier of the IPSec tunnel transmitting the data stream, the method further includes: performing IPSec with the receiving end SA negotiation; establishing an IPSec tunnel; wherein, in the process of establishing an IPSec tunnel, an IPSec security policy is established, and the IPSec security policy includes a mapping relationship between the flow ID of the data flow and the SPI ID of the IPSec tunnel.
  • an ACL is established for the data flow, and the ACL includes a flow ID of the data flow, and a mapping relationship between the flow ID of the data flow and the SPI ID of the IPSec tunnel is established.
  • the content of the IPSec SA negotiation between the sending end and the receiving end may include the encapsulation mode, encryption algorithm, encryption key, verification algorithm, verification key, etc. used at both ends of the tunnel.
  • the sending end may hash the stream ID of the data stream before transmitting the data stream to the receiving end
  • the obtained hash value is filled in the field of the SPI logo to obtain the virtual SPI logo.
  • determining the virtual SPI identifier by using the flow identifier of the data stream and the SPI identifier of the IPSec tunnel transmitting the data stream includes: Hash operation processing to obtain a hash value; use the obtained hash value to set the field of the SPI logo to obtain a virtual SPI logo.
  • the obtained hash value may be used to set a field at a specific position in the SPI identifier.
  • the SPI identifier can be represented by 26 bits
  • the specific position may refer to the last four bits of the 26 bits, and so on.
  • a hash value of a preset length can be obtained.
  • different hash values are obtained, and the corresponding virtual SPI identifiers are also different.
  • each message of the data stream needs to be encrypted.
  • the method further includes: encrypting each message in the data stream to obtain encrypted messages.
  • the sending end may encrypt each message of the data stream according to an encryption algorithm determined during IPSec SA negotiation with the receiving end.
  • Step 402 For each encrypted message in the data stream, encapsulate with a virtual SPI identifier.
  • the sending end may use multiple encryption units to encrypt each packet of the data stream and encapsulate the virtual SPI logo.
  • Step 403 Transmit the data stream to the receiving end through the IPSec tunnel; the virtual SPI identifier is used by the receiving end to send each message of the data stream to the same decryption unit for decryption processing.
  • An embodiment of the present application provides a data transmission method, which is applied to a receiving end. As shown in FIG. 5, the method includes:
  • Step 501 Receive the data stream sent by the sending end through the IPSec tunnel. Each message of the data stream carries a virtual SPI identifier.
  • the virtual SPI identification is determined by the sending end based on the flow identification of the data flow and the SPI identification of the IPSec tunnel transmitting the data flow.
  • multiple IPSec tunnels can be established between the sending end and the receiving end, and the SPI identification is used for unique identification.
  • the receiving end allocates multiple decryption units for each IPSec tunnel.
  • Step 502 Use the virtual SPI identifier to send each message of the data stream to the same decryption unit for decryption processing.
  • the receiving end uses the virtual SPI identifier to send each message of the data stream to the same decryption unit among multiple decryption units for decryption processing.
  • the receiving end may include multiple decryption units.
  • the receiving end may send the messages with the same virtual SPI identifier to the same decryption unit according to the virtual SPI identifier to perform decryption processing, so as to avoid that the multiple decryption unit processing exacerbates the disorder of the messages.
  • the packets with the same virtual SPI identification indicate that they belong to the same data stream and are processed by the same decryption unit.
  • the use of a virtual SPI identifier to send each message of the data to the same decryption unit for decryption processing includes: sending messages with the same virtual SPI identifier The same decryption unit for decryption processing.
  • the virtual SPI identifiers of the packets of the data stream may be compared, and each packet having the same virtual SPI identifier is sent to the same decryption unit among multiple decryption units for decryption processing.
  • the sending end sends each message carrying the virtual SPI identification to the receiving end, so that the receiving end can have the same virtual based on the virtual SPI identification carried by each message
  • Each message identified by SPI is sent to the same decryption unit for decryption processing. In this way, it can be avoided that multiple decryption units belonging to the same IPSec tunnel process packets at the same time, which aggravates the disorder of packets.
  • An embodiment of the present application also provides a data transmission method, which is applied to the sending end. As shown in FIG. 6, the method includes:
  • Step 601 Determine the distinguishing identifier of the data stream.
  • the distinguishing identifier of the data stream may be composed of quintuple and at least one of the following information: L2 layer information, L3 layer information, L4 layer information, L5 layer information, L6 layer information, L7 layer information information.
  • the distinguishing identifier can uniquely distinguish the data stream.
  • the quintuple may include: a source IP address, a destination IP address, a source port number, a destination port number, and a protocol number.
  • Layers L2 to L7 are the layers defined by the Open System Interconnection (OSI, Open System Interconnection) reference model.
  • L2 layer information can include link related information;
  • L3 layer information can include IP address;
  • L4 layer information can include protocol information, such as TCP protocol, UDP protocol;
  • L5 layer information can include session layer related information, such as quality of service Parameters;
  • L6 layer information may include data format, such as ASCII format, etc.;
  • L7 layer information may include application type of the data stream.
  • the application types include but are not limited to HTTP application types, RTP application types, and so on.
  • the quintuple may be placed in the front, and at least one piece of information in the layers L2 to L7 may be placed in the back, to obtain the distinguishing identifier of the data stream.
  • Step 602 Determine the sub-IPSec tunnel used for the data stream transmission by using the mapping relationship between the distinguishing identifier of the data stream and the SPI identifier of the sub-IPSec tunnel.
  • multiple sub-IPSec tunnels may be established between the sending end and the receiving end, and the SPI identification is used for unique identification.
  • a sub-IPSec tunnel allocates a decryption unit at the receiving end.
  • the sending end and the receiving end also need to negotiate IKE SA and Child SA to determine the sub IPSec tunnel used for data stream transmission, that is, to establish a sub
  • the IPSec security policy includes the mapping relationship between the distinguishing identifier of the data stream and the SPI identifier of the sub-IPSec tunnel.
  • the method further includes: conducting Child SA consultation with the receiving end; establishing a sub-IPSec tunnel; wherein, in the process of establishing the sub-IPSec tunnel, establishing a sub-IPSec tunnel security policy In the sub-IPSec tunnel security policy, the mapping relationship between the distinguishing identifier of the data flow and the SPI identifier of the sub-IPSec tunnel is included.
  • the content of Child SA negotiation between the sending end and the receiving end may include the encapsulation mode, encryption algorithm, encryption key, verification algorithm, verification key, etc. used at both ends of the tunnel.
  • Step 603 Use the determined sub-IPSec tunnel to transmit the data stream to the receiving end.
  • each encrypted message in the data stream is transmitted to the decryption unit of the receiving end corresponding to the sub-IPSec tunnel through the determined sub-IPSec tunnel for decryption processing.
  • An embodiment of the present application provides a data transmission method, which is applied to a receiving end. As shown in FIG. 7, the method includes:
  • Step 701 Receive the data stream sent by the sending end through the sub-IPSec tunnel.
  • the sub-IPSec tunnel is determined by the sending end based on the mapping relationship between the distinguishing identifier of the data stream and the SPI identifier of the sub-IPSec tunnel.
  • Step 702 Send the data stream transmitted through the sub-IPSec tunnel to a decryption unit corresponding to the sub-IPSec tunnel for decryption processing.
  • multiple sub-IPSec tunnels may be established between the sending end and the receiving end, and the SPI identification is used for unique identification.
  • a sub-IPSec tunnel allocates a decryption unit at the receiving end.
  • a sub-IPSec tunnel is assigned a decryption unit at the receiving end, so that the receiving end can send each packet of the data stream to the decryption unit corresponding to the sub-IPSec tunnel for decryption deal with.
  • the disorder of packets caused by the transmission of the packets through IPSec can be avoided.
  • multiple sub-IPSec tunnels are established between the receiving end and the sending end, and multiple data streams can be processed at the same time, thereby improving the processing capability of the IPSec tunnel and further meeting the requirements of 5G data transmission rate.
  • the receiving end sends the GTP message with the same virtual SPI identifier to the same decryption unit among multiple decryption units through the virtual SPI identifier for decryption processing.
  • multiple decryption units are allocated to the receiving end for an IPSec tunnel.
  • the sending end is represented by gateway A
  • the receiving end is represented by gateway B.
  • gateway A deployed on the DU side
  • gateway B deployed on the CU side as an example.
  • the GTP protocol is a commonly used protocol in telecommunications networks. GTP packets have high requirements for order preservation during the transmission of 5G networks. If the disorder of the packets is increased during the transmission process, it will lead to reduced processing performance and even seriously affect the business experience. .
  • IPSec tunnel negotiation between the gateway A and the gateway B and the process of negotiating whether to support the capability of the virtual SPI, reference may be made to the above description, which will not be repeated here.
  • FIG. 8 is a schematic diagram of the virtual SPI logo encapsulated before the gateway A uses the IPSec tunnel to send the data packet.
  • Gateway A and Gateway B have undergone virtual SPI capability negotiation and both support the capability.
  • Gateway A After receiving the GTP data stream, Gateway A first determines the SPI identifier of the IPSec tunnel carrying the GTP data stream according to the IPSec security policy. Second, Gateway A uses the HASH algorithm for TEID_1, takes the last four bits of the hash value, and obtains 0001.
  • the last four bits of the SPI ID corresponding to TEID_1 are set to obtain the virtual SPI ID (denoted by SPI-1). Encrypt the packets belonging to the TEID_1 logo and use SPI-1 to encapsulate them; use the HASH algorithm for TEID_2 to obtain the hash value 0010, and use the hash value 0010 to set the last four digits of the SPI logo corresponding to TEID_2 to obtain the virtual SPI logo (denoted by SPI-2), encrypt the packets belonging to the TEID_2 logo and use SPI-2 to encapsulate; use the HASH algorithm for TEID_3, get the hash value 1001, use the hash value 1001 to the SPI corresponding to TEID_3 Set the last four digits of the logo to obtain the virtual SPI logo (denoted by SPI-3), and encrypt the packets belonging to the TEID_3 logo using SPI-3 encapsulation.
  • Gateway A sends the encapsulated
  • Fig. 9 is a schematic diagram of gateway B decrypting after receiving the above encrypted message.
  • gateway B receives three GTP data streams sent by gateway A through an IPSec tunnel, and distributes GTP messages with the same virtual SPI identifier Go to the same decryption unit for decryption processing.
  • each encrypted message carries a virtual SPI identifier, so that the gateway B can process the encrypted message carrying the same virtual SPI identifier by the same decryption unit among multiple decryption units, which can avoid multiple belonging to the same IPSec tunnel
  • the decryption processing unit processes the packets at the same time, which leads to the problem of increased disorder, and also improves the processing performance of the single IPSec tunnel.
  • the receiving end sends each packet of the received data stream to a decryption unit corresponding to the sub-IPSec tunnel for decryption processing.
  • a decryption unit is allocated at the receiving end for a sub-IPSec tunnel.
  • the sending end is represented by gateway A
  • the receiving end is represented by gateway B.
  • gateway A deployed on the DU side
  • gateway B deployed on the CU side as an example.
  • the process of the negotiation between the gateway A and the gateway B regarding the establishment of the sub-IPSec tunnel refers to the above description, and will not be repeated here.
  • Two sub-IPSec tunnels (denoted by SA1 and SA2) are deployed between Gateway A and Gateway B to securely transmit data communication between devices with an address segment of 10.41.128.0/20 and devices with an address segment of 10.42.144.0/20 protection.
  • the distinguishing mark of the data flow is represented by quintuple and L7 layer information.
  • the mapping relationship between the distinguishing mark of the data flow and the two sub-IPSec tunnels is: SA1 corresponding to the quintuple and HTTP application type, and corresponding to the quintuple and RTP application type. SA2.
  • the gateway A and the gateway B perform Child SA1 negotiation to establish a sub-IPSec tunnel SA1.
  • the negotiation process refers to the IPSec negotiation process.
  • the negotiation process includes establishing the security policy of the sub-IPSec tunnel SA1, and identifying the data flow, namely The quintuple and HTTP application type establish a mapping relationship with SA1's SPI.
  • Gateway A and Gateway B conduct Child SA2 negotiation to establish a sub-IPSec tunnel SA2.
  • the negotiation process includes the establishment of the security policy of the sub-IPSec tunnel SA2, and the identification of the data flow, that is, the 5-tuple and the RTP application type and SA2 SPI establishes a mapping relationship.
  • FIG. 10 is a schematic diagram of data flow transmission through a sub-IPSec tunnel.
  • DPI Deep Packet Inspection
  • Gateway A receives the data flow
  • DPI Deep Packet Inspection
  • Gateway B uses the decryption unit corresponding to SA1 to process the data
  • the encrypted packets of the stream are decrypted and forwarded to the destination IP address.
  • SA2 is selected according to the security policy, and the encrypted packets of the data stream are sent to the gateway B.
  • Gateway B decrypts each packet of the data stream through a decryption unit corresponding to SA2, and forwards it to the destination IP address.
  • the gateway B may send each packet with the same flow identifier to the decryption unit corresponding to the sub-IPSec tunnel for decryption processing. In this way, the problem of out-of-sequence of packets caused by the transmission of packets using IPSec can be avoided.
  • the processing capacity of the IPSec tunnel is improved, which can further meet the requirements of 5G data transmission rate.
  • the embodiment of the present application further provides a data transmission device, which is provided on the sending end, as shown in FIG. 11, including:
  • the first determining unit 111 is configured to determine the virtual SPI identifier by using the stream identifier of the data stream and the SPI identifier of the IPSec tunnel transmitting the data stream;
  • the encryption unit 112 is configured to carry the virtual SPI identifier in the corresponding message for each encrypted message in the data stream;
  • the first transmission unit 113 is configured to transmit the data stream to the receiving end through the IPSec tunnel; the virtual SPI identifier is used for the receiving end to send each message of the data stream to the same decryption unit Perform decryption processing.
  • multiple IPSec tunnels may be established between the sending end and the receiving end, and the SPI identification is used for unique identification.
  • the receiving end allocates multiple decryption units for each IPSec tunnel.
  • the sending end may hash the stream ID of the data stream before transmitting the data stream to the receiving end
  • the obtained hash value is filled in the SPI field to obtain the virtual SPI identification.
  • the first determining unit 111 is specifically configured to: perform hash operation processing on the stream identifier of the data stream to obtain a hash value; and use the obtained hash value to set a field of the SPI identifier to obtain a virtual SPI identifier.
  • the obtained hash value may be used to set a field at a specific position in the SPI identifier.
  • the SPI identification can be represented by 26 bits
  • the specific position may refer to the last four bits of the 26 bits, and so on.
  • the sending end before determining the virtual SPI identifier, the sending end also needs to negotiate with the receiving end regarding the virtual SPI support capability to determine whether the receiving end has the capability of supporting the virtual SPI.
  • the device further includes: a judging unit configured to judge whether the receiving end has the capability of supporting virtual SPI; when it is determined that the receiving end has the capability of supporting virtual SPI, Using the flow identifier of the data stream and the SPI identifier of the IPSec tunnel transmitting the data stream, the virtual SPI identifier is determined.
  • the sending end and the receiving end also need to negotiate IKE SA, IPSec SA to determine the IPSec tunnel used for data flow transmission, That is, an IPSec security policy is established, and the IPSec security policy includes a mapping relationship between the flow ID of the data flow and the SPI ID of the IPSec tunnel.
  • the apparatus further includes: a first negotiation unit configured to perform IPSec SA negotiation with the receiving end; and establish an IPSec tunnel.
  • an IPSec security policy is established, and the IPSec security policy includes a mapping relationship between the flow ID of the data flow and the SPI ID of the IPSec tunnel.
  • an ACL is established for the data flow, and the ACL includes a flow ID of the data flow, and a mapping relationship between the flow ID of the data flow and the SPI ID of the IPSec tunnel is established.
  • the content of the IPSec SA negotiation between the sending end and the receiving end may include the encapsulation mode, encryption algorithm, encryption key, verification algorithm, verification key, etc. used at both ends of the tunnel.
  • each message of the data stream needs to be encrypted.
  • the encryption unit 112 is specifically configured to encrypt each message in the data stream to obtain encrypted messages.
  • the first determination unit 111, the encryption unit 112, the first transmission unit 113, the judgment unit, and the first negotiation unit may be implemented by a processor in the data transmission device.
  • the embodiment of the present application further provides a data transmission device, which is provided on the receiving end, as shown in FIG. 12, including:
  • the first receiving unit 121 is configured to receive a data stream sent by the sending end through an IPSec tunnel; each packet of the data stream carries a corresponding virtual SPI identifier; the virtual SPI identifier is based on the data by the sending end
  • the flow ID of the flow and the SPI ID of the IPSec tunnel transmitting the data flow are determined;
  • the first decryption unit 122 is configured to use virtual SPI identification to send each message of the data to the same decryption unit among the multiple decryption units for decryption processing.
  • multiple IPSec tunnels can be established between the sending end and the receiving end, and the SPI identification is used for unique identification.
  • the receiving end allocates multiple decryption units for each IPSec tunnel.
  • the receiving end may include multiple decryption units.
  • the receiving end may send the messages with the same virtual SPI identifier to the same decryption unit according to the virtual SPI identifier to perform decryption processing, so as to avoid that the multiple decryption unit processing exacerbates the disorder of the messages.
  • the packets with the same virtual SPI identification indicate that they belong to the same data stream and are processed by the same decryption unit.
  • the first decryption unit 122 is specifically configured to send packets with the same virtual SPI identifier to the same decryption unit for decryption processing.
  • the first decryption unit 122 may compare the virtual SPI identifiers of the packets of the data stream, and send the packets with the same virtual SPI identifier to the same decryption unit for decryption processing.
  • the first receiving unit 121 and the first decrypting unit 122 may be implemented by a processor in a data transmission device.
  • the embodiment of the present application also provides a data transmission device, which is provided on the sending end, as shown in FIG. 13, and includes:
  • the second determining unit 131 is set to determine the distinguishing identifier of the data stream; and is also set to determine the sub-IPSec tunnel used with the data stream by using the mapping relationship between the distinguishing identifier of the data stream and the SPI identifier of the sub-IPSec tunnel;
  • the second transmission unit 132 is configured to use the determined sub-IPSec tunnel to transmit the data stream to the receiving end.
  • the distinguishing identifier of the data stream may be composed of quintuple and at least one of the following information: L2 layer information, L3 layer information, L4 layer information, L5 layer information, L6 layer information, L7 layer information information.
  • the distinguishing identifier can uniquely distinguish the data stream.
  • the quintuple may include: a source IP address, a destination IP address, a source port number, a destination port number, and a protocol number.
  • Layers L2 to L7 are the layers defined by the OSI reference model.
  • L2 layer information can include link related information;
  • L3 layer information can include IP address;
  • L4 layer information can include protocol information, such as TCP protocol, UDP protocol;
  • L5 layer information can include session layer related information, such as quality of service Parameters;
  • L6 layer information may include data format, such as ASCII format, etc.;
  • L7 layer information may include application type of the data stream.
  • the application types include but are not limited to HTTP application types, RTP application types, and so on.
  • multiple sub-IPSec tunnels may be established between the sending end and the receiving end, and the SPI identification is used for unique identification.
  • a sub-IPSec tunnel allocates a decryption unit at the receiving end.
  • the sending end and the receiving end also need to negotiate IKE SA and Child SA to determine the sub IPSec tunnel used for data stream transmission, that is, to establish a sub
  • the IPSec security policy includes the mapping relationship between the distinguishing identifier of the data stream and the SPI identifier of the sub-IPSec tunnel.
  • the apparatus further includes: a second negotiation unit configured to perform Child SA negotiation with the receiving end; establish a child IPSec tunnel;
  • a sub-IPSec tunnel security policy is established, and the sub-IPSec tunnel security policy includes a mapping relationship between the distinguishing identifier of the data flow and the SPI identifier of the sub-IPSec tunnel.
  • the content of Child SA negotiation between the sending end and the receiving end may include the encapsulation mode, encryption algorithm, encryption key, verification algorithm, verification key, etc. used at both ends of the tunnel.
  • the data stream is transmitted to the decryption unit corresponding to the sub-IPSec tunnel of the receiving end through the determined sub-IPSec tunnel for decryption processing.
  • the second determination unit 131, the second transmission unit 132, and the second negotiation unit may be implemented by a processor in the data transmission device.
  • the embodiment of the present application further provides a data transmission device, which is provided on the receiving end, as shown in FIG. 14, including:
  • the second receiving unit 141 is configured to receive the data stream sent by the sending end through the sub-IPSec tunnel.
  • the sub IPSec tunnel is determined by the sending end based on the mapping relationship between the distinguishing identifier of the data stream and the SPI identifier of the sub IPSec tunnel.
  • the second decryption unit 142 is configured to send the data stream transmitted through the sub-IPSec tunnel to the decryption unit corresponding to the sub-IPSec tunnel for decryption processing.
  • multiple sub-IPSec tunnels may be established between the sending end and the receiving end, and the SPI is used for unique identification.
  • a sub-IPSec tunnel allocates a decryption unit at the receiving end.
  • the second receiving unit 141 may be implemented by a communication interface in a data transmission device.
  • the second decryption unit 142 may be implemented by a processor in the data transmission device.
  • an embodiment of the present application further provides a sending device.
  • the smart device 150 includes: a first communication interface 151 , The first processor 152, the first memory 153; wherein,
  • the first communication interface 151 can exchange information with other devices;
  • the first processor 152 is connected to the first communication interface 151 to implement information interaction with the wireless network access device, and is configured to execute the method provided by the one or more technical solutions on the smart device side when the computer program is running.
  • the computer program is stored on the first memory 153.
  • the various components in the smart device 150 are coupled together through the bus system 154. Understandably, the bus system 154 is configured to implement connection and communication between these components.
  • the bus system 154 also includes a power bus, a control bus, and a status signal bus.
  • various buses are marked as the bus system 154 in FIG. 15.
  • the first memory 153 in the embodiment of the present application is configured to store various types of data to support the operation of the smart device 150. Examples of these data include: any computer program used to operate on the smart device 150.
  • the method disclosed in the above embodiments of the present application may be applied to the first processor 152, or implemented by the first processor 152.
  • the first processor 152 may be an integrated circuit chip with signal processing capabilities. In the implementation process, each step of the above method may be completed by an integrated logic circuit of hardware in the first processor 152 or an instruction in the form of software.
  • the above-mentioned first processor 152 may be a general-purpose processor, a digital signal processor (DSP, Digital Processor), or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, and the like.
  • the first processor 152 may implement or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor may be a microprocessor or any conventional processor.
  • the steps of the method disclosed in the embodiments of the present application may be directly implemented and completed by a hardware decoding processor, or may be implemented and completed by a combination of hardware and software modules in the decoding processor.
  • the software module may be located in a storage medium.
  • the storage medium is located in the first memory 153.
  • the first processor 152 reads the information in the first memory 153 and completes the steps of the foregoing method in combination with its hardware.
  • the transmission device 150 may be one or more application specific integrated circuits (ASIC, Application Integrated Circuit), DSP, programmable logic device (PLD, Programmable Logic Device), complex programmable logic device (CPLD , Complex Programmable Logic Device, Field Programmable Gate Array (FPGA, Field-Programmable Gate Array), general-purpose processor, controller, microcontroller (MCU, Micro Controller), microprocessor (Microprocessor), or other electronic Component implementation for performing the aforementioned method.
  • ASIC application specific integrated circuits
  • DSP programmable logic device
  • PLD Programmable Logic Device
  • CPLD Complex programmable logic device
  • FPGA Field Programmable Gate Array
  • MCU microcontroller
  • Microprocessor Microprocessor
  • the receiving device 160 includes:
  • the second communication interface 161 can exchange information with other devices
  • the second processor 162 is connected to the second communication interface 161 to implement information interaction with the smart device, and is configured to execute the method provided by one or more technical solutions on the wireless network access device side when running a computer program.
  • the computer program is stored on the second memory 163.
  • the various components in the wireless network access device 160 are coupled together through the bus system 164. Understandably, the bus system 164 is configured to implement connection and communication between these components.
  • the bus system 164 also includes a power bus, a control bus, and a status signal bus.
  • various buses are marked as the bus system 164 in FIG. 16.
  • the second memory 163 in the embodiment of the present application is configured to store various types of data to support the operation of the wireless network access device 160. Examples of these data include: any computer program for operating on the wireless network access device 160.
  • the method disclosed in the above embodiments of the present application may be applied to the second processor 162, or implemented by the second processor 162.
  • the second processor 162 may be an integrated circuit chip with signal processing capabilities. In the implementation process, the steps of the above method may be completed by instructions in the form of hardware integrated logic circuits or software in the second processor 162.
  • the above-mentioned second processor 162 may be a general-purpose processor, DSP, or other programmable logic device, discrete gate or transistor logic device, discrete hardware component, or the like.
  • the second processor 162 may implement or execute the methods, steps, and logical block diagrams disclosed in the embodiments of the present application.
  • the general-purpose processor may be a microprocessor or any conventional processor or the like.
  • the steps of the method disclosed in the embodiments of the present application may be directly implemented and completed by a hardware decoding processor, or may be implemented and completed by a combination of hardware and software modules in the decoding processor.
  • the software module may be located in a storage medium, and the storage medium is located in the second memory 163.
  • the second processor 162 reads the information in the second memory 163 and completes the steps of the foregoing method in combination with its hardware.
  • the receiving device 160 may be implemented by one or more ASICs, DSPs, PLDs, CPLDs, FPGAs, general-purpose processors, controllers, MCUs, Microprocessors, or other electronic components for performing the aforementioned methods.
  • the memories may be volatile memories or non-volatile memories, and may also include both volatile and non-volatile memories.
  • the non-volatile memory can be read-only memory (ROM, Read Only Memory), programmable read-only memory (PROM, Programmable Read-Only Memory), erasable programmable read-only memory (EPROM, Erasable Programmable Read- Only Memory), Electrically Erasable Programmable Read Only Memory (EEPROM, Electrically Erasable Programmable Read-Only Memory), Magnetic Random Access Memory (FRAM, Ferromagnetic Random Access Memory), Flash Memory (Flash) Memory, Magnetic Surface Memory , Compact disc, or read-only compact disc (CD-ROM, Compact, Read-Only Memory); the magnetic surface memory can be a disk storage or a tape storage.
  • the volatile memory may be a random access memory (RAM, Random Access Memory), which is used as an external cache.
  • RAM random access memory
  • SRAM static random access memory
  • SSRAM synchronous static random access memory
  • DRAM Dynamic Random Access Memory
  • SDRAM Synchronous Dynamic Random Access Memory
  • DDRSDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • ESDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • ESDRAM Double Data Rate Synchronous Dynamic Random Access Memory
  • ESDRAM Enhanced Synchronous Dynamic Random Access Memory
  • SLDRAM SyncLink Dynamic Random Access Memory
  • DRRAM Direct Rambus Random Access Random Access Memory
  • DRRAM Direct Rambus Random Access Random Access Memory
  • a data transmission method, apparatus, related equipment, and storage medium provided by the embodiments of the present application have the following beneficial effects: the sending end sends each message carrying the virtual SPI logo to the receiving end, so that the receiving The terminal can send packets with the same virtual SPI identifier to the same decryption unit for decryption processing. In this way, the problem of out-of-order messages can be avoided, and the processing performance of the IPSec tunnel can also be improved.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种数据传输方法，装置、相关设备及存储介质。其中，该方法包括：利用数据流的流标识，以及传输所述数据流的网络协议安全(IPSec，Internet Protocol Security)隧道的安全参数索引(SPI，Security Parameter Index)标识，确定虚拟SPI标识；针对所述数据流中的每个加密后的报文，将虚拟SPI标识携带于相应报文中；通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。

Description

一种数据传输方法、装置、相关设备及存储介质 技术领域
本申请涉及网络通信安全技术领域，尤其涉及一种数据传输方法、装置、相关设备及存储介质。
背景技术
目前，在第五代移动通信(5G，the 5th Generation mobile communication technology)网络中，为保证数据传输的安全性，通常会使用IPSec隧道对数据进行完整性保护。目前，为了提高IPSec隧道的处理性能，加密端将数据流通过IPSec隧道传输至解密端后，解密端会按照预设算法将数据流的各报文传输至多个解密单元进行解密处理。
上述方式解密端通过多个解密单元对数据流的各报文进行分别处理，很可能会加剧报文乱序。
发明内容
为解决存在的相关技术问题，在本申请实施例中提供了一种数据传输方法、装置、相关设备及存储介质。
本申请实施例的技术方案是这样实现的：
本申请实施例提供了一种数据传输方法，应用于发送端，所述方法包括：利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识；针对所述数据流中的每个加密后的报文，将虚拟SPI标识携带于相应报文中；通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。
本申请实施例提供了一种数据传输方法，应用于接收端，所述方法包括：接收发送端通过IPSec隧道发送的数据流；所述数据流的各报文中携带有虚拟SPI标识；所述虚拟SPI标识是所述发送端基于所述数据流的流标识以及传输 所述数据流的IPSec隧道的SPI标识确定的；利用虚拟SPI标识，将所述数据流的各报文送入同一个解密单元进行解密处理。
本申请实施例提供了一种数据传输装置，应用于发送端，所述装置包括：第一确定单元，设置为利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识；加密单元，设置为针对所述数据流中的每个加密后的报文，将虚拟SPI标识携带于相应报文中；第一传输单元，设置为通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。
本申请实施例提供了一种数据传输装置，应用于接收端，所述装置包括：第一接收单元，设置为接收发送端通过IPSec隧道发送的数据流；所述数据流的各报文中携带有虚拟SPI标识；所述虚拟SPI标识是所述发送端基于所述数据流的流标识以及传输所述数据流的IPSec隧道的SPI标识确定的；第一解密单元，设置为利用虚拟SPI标识，将所述数据流的各报文送入同一个解密单元进行解密处理。
本申请实施例提供了一种数据传输装置，应用于发送端，所述装置包括：第一确定单元，设置为确定数据流的区分标识；还设置为利用数据流的区分标识与子IPSec隧道的SPI标识的映射关系，确定所述数据流传输所使用的子IPSec隧道；第二传输单元，设置为利用确定的子IPSec隧道，向接收端传输所述数据流；通过所述确定的子IPSec隧道将所述数据流传输至所述接收端的与所述子IPSec隧道对应的解密单元进行解密处理。
本申请实施例提供了一种数据传输装置，应用于接收端，所述装置包括：第二接收单元，设置为接收发送端通过子IPSec隧道发送的数据流；第二解密单元，设置为将通过子IPSec隧道传输的所述数据流发送至与所述子IPSec隧道对应的解密单元进行解密处理。
本申请实施例提供了一种发送设备，包括：第一处理器和设置为存储能够在处理器上运行的计算机程序的第一存储器，其中，所述第一处理器设置为运行所述计算机程序时，执行上面所述任一项发送端数据传输方法的步骤。
本申请实施例提供了一种接收设备，包括：第二处理器和设置为存储能够在处理器上运行的计算机程序的第二存储器，其中，所述第一处理器设置为运行所述计算机程序时，执行上面所述任一项接收端数据传输方法的步骤。
本申请实施例提供了一种存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现上面所述任一项数据传输方法的步骤。
本申请实施例提供的数据传输方法、装置、相关设备及存储介质，利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识；针对所述数据流中的每个加密后的报文，将虚拟SPI标识携带于相应报文中；通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。采用本申请实施例的方案，所述发送端将携带有虚拟SPI标识的各报文发送给接收端，这样，所述接收端可以将具有相同虚拟SPI标识的报文送入同一个解密单元进行解密处理。如此，可避免报文乱序问题的发生，同时还能提高IPSec隧道的处理性能。
附图说明
图1为相关技术中IPSec隧道的示意图；
图2为相关技术中通过IPSec隧道进行数据传输的示意图；
图3为相关技术中报文乱序的示意图；
图4为本申请实施例数据传输方法的实现流程示意图一；
图5为本申请实施例数据传输方法的实现流程示意图二；
图6为本申请实施例数据传输方法的实现流程示意图三；
图7为本申请实施例数据传输方法的实现流程示意图四；
图8为本申请实施例确定虚拟SPI标识的示意图；
图9为本申请实施例对报文进行解密的示意图；
图10为本申请实施例通过子IPSec隧道传输数据流的示意图；
图11为本申请实施例数据传输装置的组成结构示意图一；
图12为本申请实施例数据传输装置的组成结构示意图二；
图13为本申请实施例数据传输装置的组成结构示意图三；
图14为本申请实施例数据传输装置的组成结构示意图四；
图15为本申请实施例数据传输装置的组成结构示意图五；
图16为本申请实施例数据传输装置的组成结构示意图六。
具体实施方式
下面结合附图及实施例对本申请再作进一步详细的描述。
目前，为了保证数据传输的安全性以及对数据的完整性进行保护，需要在所述发送端与所述接收端之间建立IPSec隧道。IPSec隧道可以用安全联盟(SA，Security Association)表示。在正式建立IPSec隧道之前，发送端和接收端需要进行协商，以建立SA。由于IPSec隧道是单向的，因此，一个IPSec隧道包括两个SA，每个SA可以使用SPI进行唯一标识。SA约定了隧道两端使用相同的封装模式、加密算法、加密密钥、验证算法、验证密钥。其中，封装模式可以包括封装安全载荷(ESP，Encapsulating Security Payload)、验证头(AH，Authentication Header)；加密算法可以包括数据加密标准(DES，Data Encryption Standard)、数字加密标准3(3DES，Triple DES)、高级加密标准(AES，Advanced Encryption Standard)；验证算法可以包括消息摘要5(MD5，Message Digest 5)、安全哈希算法1(SHA1，Secure Hash Algorithm1)、安全哈希算法2(SHA，Secure Hash Algorithm12)。
这里，IPSec隧道的建立方式可以包括手动建立方式和因特网密钥交换协议(IKE，Internet Key Exchange)动态协商建立方式。
手动建立方式可以包括以下步骤：
步骤1，配置ACL，通过访问控制列表(ACL，Access Control List)定义需要保护的数据流，即ACL包含需要保护的数据流的标识，通常为五元组。
这里，只有ACL定义的数据流才被IPSec隧道保护，其他数据流不受保护。
步骤2，建立IPSec SA。
可选地，配置IPSec安全提议：隧道两端在各自的安全提议中配置相同的封装模式、加密算法、验证算法。配置IPSec安全策略：定义隧道两端使用的地址、SA标识符SPI、加密密钥、验证密钥等等。配置应用IPSec安全策略，建立IPSec隧道，按照ACL策略并通过建立的IPSec隧道对报文传输。
IKE动态协商方式可以包括以下步骤：
步骤1，配置ACL，通过ACL定义被保护的数据流，即ACL包含需要保 护的数据流的标识。
这里，如果使用IKEv1，则不协商ACL规则，隧道两端设备配置的ACL规则互为镜像，避免IPSec SA协商失败。如果使用IKEv2，则通过传输选择器(TS，Traffic Selector)载荷实现两端设备的ACL规则协商，最终结果取双方ACL规则的交集。
步骤2，建立IKE SA。
可选地，协商IKE安全提议：配置建立IKE SA时的加密和验证算法，协商消息接收方在自己配置的IKE安全提议中寻找与发送方相匹配的IKE安全提议，如果没有匹配的安全提议则协商失败.配置IKE对等体：配置IKE版本、身份认证和交换模式。建立IPSec SA：可选地，配置IPSec安全提议：隧道两端在各自的安全提议中配置相同的封装模式、加密算法、验证算法。配置IPSec安全策略：定义隧道两端使用的地址、SA标识符SPI、加密密钥、验证密钥等等。配置应用IPSec安全策略，建立IPSec隧道，按照ACL策略并通过建立的IPSec隧道对报文传输。
这里，IKE动态协商建立方式中，增加了IKE SA建立的过程。
需要说明的是，手动建立方式和IKE方式协商方式都必须要求隧道两端所使用的IP地址固定。建立IPSec隧道后，发送端在接收一个数据流后，首先根据ACL判断所述数据流的各报文是否使用IPSec加密，如果需要，则查找对应的SA，利用所述SA将加密后的各报文发送给接收端。接收端对所述数据流的加密后的各报文进行解密，并向报文目的地转发解密后的各报文。
图1是IPSec隧道的示意图，如图1所示，在网关A和网关B之间建立IPSec隧道1(用SA1表示)，用于供网关A发送数据、网关B接收数据；并建立IPSec隧道2(用SA2表示)，用于供网关B发送数据、网关A接收数据。
图2是通过IPSec隧道进行数据传输的示意图，如图2所示，5G网络中的集中单元(CU，Central Unit)所在的数据中心和分布式单元(DU，Distributed Unit)所在的数据中心在非信任网络中进行数据传输时，需要在两个数据中心之间建立IPSec隧道，以对数据进行完整性保护，防止数据被窃取或篡改。此外，无线接入和核心网之间的回传网、业务网络网元和管理域网元之间的管理编排网络也存在数据安全传输的需求。5G网络中，对数据传输的速率存在极高的需求，比如，国际电信联盟(ITU，International Telecommunication Union)定义了单 用户峰值速率需达到10-20Gbps，对回传网的数据速率要求更高。如果数据传输路径上需要使用IPSec隧道，则要求IPSec隧道的处理性能也应达到相应要求。
目前，IPSec隧道的处理性能受限于硬件处理性能的局限，如果加密端或解密端分别使用单一处理单元对报文进行加密或解密，IPSec隧道仅能达到数百Mbps的处理性能。如果加密端或解密端分别使用多处理单元或分布式处理单元，加密端将数据流通过IPSec隧道传输至解密端后，解密端会按照预设算法将数据流的各报文传输至多个解密单元进行解密处理。这样，虽然可提升IPSec隧道的处理性能，但分流处理会加剧报文乱序，影响到业务体验。
图3是相关技术中报文乱序的示意图，如图3所示，数据流由报文A、报文B、报文C、报文D组成。网关A接收到数据流后，网关A按照预设算法，将报文A分配给处理单元1进行加密处理，将报文B分配给处理单元2进行加密处理，将报文C分配给处理单元3进行加密处理，将报文D分配给处理单元4进行加密处理，并通过IPSec隧道将加密后的各报文发送给网关B。网关B接收到数据流的各加密报文后，按照预设算法，将加密后的报文A分配给处理单元1进行解密处理，将加密后的报文B分配给处理单元2进行解密处理，将加密后的报文C分配给处理单元3进行解密处理，将加密后的报文D分配给处理单元4进行解密处理。由于每个处理单元接收报文的时序可能不同，每个处理单元对报文的处理方式可能不同，因此，可能会导致报文乱序问题的发生。
基于此，在本申请的各种实施例中，利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识；针对所述数据流中的每个加密后的报文，将虚拟SPI标识携带于相应报文中；通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。
本申请实施例提供一种数据传输方法，应用于发送端，如图4所示，该方法包括：
步骤401：利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识。
其中，IPSec，即IP Security，它是IETF制定的三层隧道加密协议，可以是基于端对端的安全模式，在源IP地址和目的IP地址之间建立信任和安全性。
这里，为了保证数据传输的安全性，可以在所述发送端和接收端之间建立多条IPSec隧道，并用SPI标识进行唯一标识。其中，所述接收端为每条IPSec隧道分配多个解密单元。
实际应用时，为了使所述接收端在对所述数据流的各报文进行解密前，就能够将同一个数据流的各报文送入多个解密单元中的同一个解密单元进行解密处理，可以利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识；所述虚拟SPI标识用于供所述接收端将具有相同虚拟SPI标识的报文送入同一个解密单元进行处理。
这里，在确定虚拟SPI标识之前，所述发送端还需要针对虚拟SPI支持能力与所述接收端进行协商，以确定所述接收端是否具有支持虚拟SPI的能力。
基于此，在一个可选的实施例中，所述利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识之前，所述方法还包括：判断所述接收端是否具有支持虚拟SPI的能力；当确定所述接收端具有支持虚拟SPI的能力时，利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识。
这里，所述发送端与所述接收端关于是否支持虚拟SPI的能力进行协商，协商的过程可以为：所述发送端对所述数据流的IPSec隧道的SPI标识进行设置，比如将SPI标识的最高比特位设置为1，以表征所述发送端具有支持虚拟SPI的能力；所述发送端将设置的SPI标识发送至所述接收端；所述接收端读取所述发送端支持虚拟SPI能力；所述接收端也进行SPI最高位设置，并将设置的SPI标识发送至所述发送端；所述发送端根据所述接收端发送的SPI标识，确定所述接收端是否具有支持虚拟SPI的能力，可选地，如果所述接收端将最高位的取值设置为1，则表示所述接收端具有支持虚拟SPI的能力，如表1所示；如果所述接收端将最高位的取值设置为0，则表示所述接收端不具有支持虚拟SPI的能力，如表2所示。
1 x x x x x x x x x x x x x x x x x x x x x x x x x x x 0 0 0 0
表1
0 x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x x
表2
这里，在对所述接收端是否具有支持虚拟SPI的能力进行确认之前，所述 发送端与所述接收端还需要进行IKE SA、IPSec SA的协商，以确定数据流传输所使用的IPSec隧道，即建立IPSec安全策略，IPSec安全策略包含所述数据流的流标识与IPSec隧道的SPI标识的映射关系。
基于此，在一实施例中，所述利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识之前，所述方法还包括：与所述接收端进行IPSec SA协商；建立IPSec隧道；其中，在建立IPSec隧道的过程中，建立IPSec安全策略，在所述IPSec安全策略中包含所述数据流的流标识和所述IPSec隧道的SPI标识的映射关系。
可选地，为所述数据流建立ACL，ACL中包含所述数据流的流标识，并建立所述数据流的流标识和IPSec隧道的SPI标识的映射关系。
这里，所述发送端与所述接收端进行IPSec SA协商的内容可以包括隧道两端使用的封装模式、加密算法、加密密钥、验证算法、验证密钥等等。
实际应用时，如果所述发送端确定所述接收端具备支持虚拟SPI的能力，则所述发送端向所述接收端传输所述数据流之前，可以将所述数据流的流标识经过哈希得到的哈希值填入SPI标识的字段中，得到虚拟SPI标识。
基于此，在一个可选的实施例中，所述利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识，包括：对所述数据流的流标识进行哈希运算处理，得到哈希值；利用得到的哈希值设置所述SPI标识的字段，得到虚拟SPI标识。
这里，可以利用得到的哈希值，设置所述SPI标识中特定位置的字段。比如，假设所述SPI标识可以用26比特表示，则所述特定位置可以是指26比特中的末四位比特等等。
这里，对所述数据流的流标识进行哈希运算处理，可以得到预设长度的哈希值。流标识不同的数据流，得到的哈希值也不同，对应的虚拟SPI标识也就不同。
实际应用时，所述发送端将所述数据流发送至所述接收端之前，还需要对所述数据流的各报文进行加密。
基于此，在一个可选的实施例中，所述方法还包括：对所述数据流中的每个报文进行加密，得到加密后的各报文。
这里，所述发送端可以按照与所述接收端进行IPSec SA协商时确定的加密算法对所述数据流的各报文进行加密。
步骤402：针对所述数据流中的每个加密后的报文，用虚拟SPI标识封装。
这里，为了提高IPSec隧道的处理性能，所述发送端可以使用多个加密单元对所述数据流的各报文分别进行加密并封装虚拟SPI标识。
步骤403：通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。
本申请实施例提供了一种数据传输方法，应用于接收端，如图5所示，所述方法包括：
步骤501：接收发送端通过IPSec隧道发送的数据流。所述数据流的各报文中携带有虚拟SPI标识。
其中，所述虚拟SPI标识是所述发送端基于所述数据流的流标识以及传输所述数据流的IPSec隧道的SPI标识确定的。
这里，所述发送端和接收端之间可建立多条IPSec隧道，并用SPI标识进行唯一标识。其中，所述接收端为每条IPSec隧道分配多个解密单元。
步骤502：利用虚拟SPI标识，将所述数据流的各报文送入同一个解密单元进行解密处理。
这里，所述接收端利用虚拟SPI标识，将所述数据流的各报文送入多个解密单元中的同一个解密单元进行解密处理。
实际应用时，为了提高IPSec隧道的处理性能，所述接收端可以包括多个解密单元。所述接收端可以根据虚拟SPI标识将具有相同虚拟SPI标识的报文送入同一个解密单元进行解密处理，以避免因为多解密单元处理加剧报文乱序。其中，具有相同虚拟SPI标识的报文，表示属于同一条数据流，由同一个解密单元处理。
基于此，在一个可选的实施例中，所述利用虚拟SPI标识，将所述数据的各报文送入同一个解密单元进行解密处理，包括：将具有相同虚拟SPI标识的报文送入同一个解密单元，以进行解密处理。
可选地，可以将所述数据流的各报文的虚拟SPI标识进行比较，具备相同 虚拟SPI标识的各报文送入多个解密单元中的同一个解密单元，以进行解密处理。
采用本申请实施例的方案，所述发送端将携带有虚拟SPI标识的各报文发送至所述接收端，这样，所述接收端可以基于各报文携带的虚拟SPI标识，将具有相同虚拟SPI标识的各报文送入同一个解密单元进行解密处理。如此，可避免因为属于同一IPSec隧道的多个解密单元同时处理报文而加剧报文乱序的发生。
本申请实施例还提供了一种数据传输方法，应用于发送端，如图6所示，所述方法包括：
步骤601：确定数据流的区分标识。
其中，所述数据流的区分标识可以由五元组及以下信息至少之一组成：L2层的信息、L3层的信息、L4层的信息、L5层的信息、L6层的信息、L7层的信息。所述区分标识能够唯一区分所述数据流。
这里，所述五元组可以包括：源IP地址、目的IP地址，源端口号、目的端口号以及协议号。L2至L7层为开放系统互联(OSI，Open System Interconnection)参考模型定义的各层。L2层信息可以包括与链路相关的信息；L3层信息可以包括IP地址；L4层信息可以包括协议信息，比如TCP协议、UDP协议；L5层信息可以包括与会话层相关的信息，比如服务质量参数；L6层信息可以包括数据格式，比如ASCII格式等等；L7层信息可以包括所述数据流的应用类型。所述应用类型包括但不限于HTTP应用类型、RTP应用类型等等。
可选地，可以将五元组放置在前面，将L2层至L7层中至少一个信息放置在后面，得到所述数据流的区分标识。
步骤602：利用数据流的区分标识与子IPSec隧道的SPI标识的映射关系，确定与所述数据流传输所使用的子IPSec隧道。
实际应用时，为了满足5G数据传输速率的需求，可以在所述发送端和接收端之间建立多条子IPSec隧道，并用SPI标识进行唯一标识。一条子IPSec隧道在所述接收端分配一个解密单元。
这里，所述发送端对所述数据流进行传输前，所述发送端与所述接收端还 需要进行IKE SA、Child SA的协商，以确定数据流传输所使用的子IPSec隧道，即建立子IPSec安全策略，包含所述数据流的区分标识与子IPSec隧道的SPI标识的映射关系。
基于此，在一个可选的实施例中，所述方法还包括：与所述接收端进行Child SA协商；建立子IPSec隧道；其中，在建立子IPSec隧道的过程中，建立子IPSec隧道安全策略，在所述子IPSec隧道安全策略中包含所述数据流的区分标识和子IPSec隧道的SPI标识的映射关系。
这里，所述发送端与所述接收端进行Child SA协商的内容可以包括隧道两端使用的封装模式、加密算法、加密密钥、验证算法、验证密钥等等。
步骤603：利用确定的子IPSec隧道，向接收端传输所述数据流。
这里，通过所述确定的子IPSec隧道将所述数据流中加密后的各报文传输至所述接收端的与所述子IPSec隧道对应的解密单元进行解密处理。
本申请实施例提供了一种数据传输方法，应用于接收端，如图7所示，所述方法包括：
步骤701：接收发送端通过子IPSec隧道发送的数据流。
其中，所述子IPSec隧道是所述发送端基于所述数据流的区分标识与子IPSec隧道的SPI标识的映射关系确定的。
步骤702：将通过子IPSec隧道传输的所述数据流发送至与所述子IPSec隧道对应的解密单元进行解密处理。
这里，为了满足5G数据传输速率的需求，可以在所述发送端和接收端之间建立多条子IPSec隧道，并用SPI标识进行唯一标识。一条子IPSec隧道在所述接收端分配一个解密单元。
这里，所述发送端与所述接收端关于建立子IPSec隧道进行协商的过程已在上文详述，这里不再赘述。
采用本申请实施例的方案，一条子IPSec隧道在所述接收端分配一个解密单元，这样，所述接收端可以将所述数据流的各报文送入与子IPSec隧道对应的解密单元进行解密处理。如此，可避免因为报文经过IPSec传输引发的报文乱序。另外，所述接收端与所述发送端之间建立多条子IPSec隧道，可以同对多个数据流进行处理，从而提高了IPSec隧道的处理能力，进而能够满足5G数 据传输速率的需求。
下面结合应用实施例对本申请再作进一步详细的描述。
应用实施例一
本应用实施例中，接收端通过虚拟SPI标识，将具有相同虚拟SPI标识的GTP报文送入多个解密单元中的同一个解密单元进行解密处理。
另外，本应用实施例中，为一条IPSec隧道在所述接收端分配多个解密单元。发送端用网关A表示，接收端用网关B表示。在5G网络中，以DU侧部署网关A，CU侧部署网关B为例。
GTP协议是电信网络中常用的协议，GTP报文在5G网络的传输过程中对保序有很高要求，如果传输过程中加剧报文乱序，则会导致处理性能下降，甚至严重影响业务体验。所述网关A与所述网关B进行IPSec隧道协商的过程，以及关于是否支持虚拟SPI的能力进行协商的过程可以参考上述描述，在此不再赘述。
图8为网关A使用IPSec隧道发送数据报文之前封装虚拟SPI标识的示意图。在此之前假设网关A和网关B已经经过虚拟SPI能力协商，都支持所述能力。如图8所示，假设有三条GTP数据流，对应的流标识分别用TEID_1、TEID_2、TEID_3表示。网关A接收到GTP数据流后，首先，根据IPSec安全策略确定承载所述GTP数据流的IPSec隧道的SPI标识。第二，网关A对TEID_1使用HASH算法，取末四位哈希值，得出0001，利用0001对TEID_1对应的SPI标识的末四位进行设置，得到虚拟SPI标识(用SPI-1表示)，对属于TEID_1标识的报文进行加密处理后使用SPI-1封装；对TEID_2使用HASH算法，得出哈希值0010，利用哈希值0010对TEID_2对应的SPI标识的末四位进行设置，得到虚拟SPI标识(用SPI-2表示)，对属于TEID_2标识的报文进行加密处理后使用SPI-2封装；对TEID_3使用HASH算法，得出哈希值1001，利用哈希值1001对TEID_3对应的SPI标识的末四位进行设置，得到虚拟SPI标识(用SPI-3表示)，对属于TEID_3标识的报文进行加密处理后使用SPI-3封装。网关A将封装后的上述加密报文发送给网关B。
图9为网关B接收到上述加密报文后进行解密处理的示意图，如图9所示，网关B通过IPSec隧道接收网关A发送的三条GTP数据流，将具有相同虚拟SPI标识的GTP报文分配到同一个解密单元进行解密处理。
可选地，将“0001”的报文A和报文B分配给解密单元1进行解密处理；将“0010”的报文C和报文D分配给解密单元2进行解密处理；将“1001”的报文E分配给解密单元3进行解密处理。每个解密单元对解密后的报文按照目的地址发送给目的地。
这里，每个加密报文均携带虚拟SPI标识，这样，网关B可以将携带相同虚拟SPI标识的加密报文由多个解密单元中同一个解密单元进行处理，能够避免属于同一IPSec隧道的多个解密处理单元同时处理报文，引发乱序加剧的问题，还提高了单IPSec隧道的处理性能。
应用实施例二
本应用实施例中，接收端将接收数据流的各报文送入与子IPSec隧道对应的解密单元进行解密处理。
另外，本应用实施例中，为一条子IPSec隧道在所述接收端分配一个解密单元。发送端用网关A表示，接收端用网关B表示。在5G网络中，以DU侧部署网关A，CU侧部署网关B为例。
所述网关A与所述网关B关于建立子IPSec隧道进行协商的过程参考上述描述，在此不再赘述。网关A和网关B之间部署两条子IPSec隧道(用SA1和SA2表示)，对地址段为10.41.128.0/20的设备与地址段为10.42.144.0/20的设备之间的数据通信进行安全传输保护。其中，数据流的区分标识用五元组及L7层信息表示，数据流的区分标识与两条子IPSec隧道的映射关系为：五元组及HTTP应用类型对应SA1，五元组及RTP应用类型对应SA2。
这里，网关A与网关B进行Child SA1协商，建立子IPSec隧道SA1，协商过程参考IPSec协商过程，协商过程中包括建立所述子IPSec隧道SA1的安全策略，将所述数据流的区分标识，即五元组及HTTP应用类型和SA1的SPI建立映射关系。网关A与网关B进行Child SA2协商，建立子IPSec隧道SA2，协商过程中包括建立所述子IPSec隧道SA2的安全策略，将所述数据流的区分标识，即五元组及RTP应用类型和SA2的SPI建立映射关系。
图10为通过子IPSec隧道传输数据流的示意图，如图10所示，当网关A接收到数据流时，通过深度数据包检测(DPI，Deep Packet Inspection)检测识别所述数据流的报文的应用类型，如果识别的应用类型为HTTP应用类型，则根据安全策略选择SA1，将所述数据流的加密后的各报文发送给网关B；网关 B通过与SA1对应的解密单元对所述数据流的加密后的各报文进行解密处理，并向目的IP地址转发。如果使用DPI检测识别所述数据流的报文的应用类型为RTP应用类型，则根据安全策略选择SA2，将所述数据流的加密后的各报文发送给网关B。网关B通过与SA2对应的解密单元对所述数据流的各报文进行解密处理，并向目的IP地址转发。
这里，通过子IPSec隧道，网关B可以将流标识相同的各报文送入与子IPSec隧道对应的解密单元进行解密处理。如此，可避免因为报文使用IPSec传输引发的报文乱序问题的发生。
另外，通过建立多条子IPSec隧道，同对多个数据流进行处理，从而提高了IPSec隧道的处理能力，进而能够满足5G数据传输速率的需求。
为了实现本申请实施例的方法，本申请实施例还提供了一种数据传输装置，设置在发送端上，如图11所示，包括：
第一确定单元111，设置为利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识；
加密单元112，设置为针对所述数据流中的每个加密后的报文，将虚拟SPI标识携带于相应报文中；
第一传输单元113，设置为通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。
这里，为了保证数据传输的安全性，可以在所述发送端和接收端之间建立多条IPSec隧道，并用SPI标识进行唯一标识。其中，所述接收端为每条IPSec隧道分配多个解密单元。
实际应用时，如果所述发送端确定所述接收端具备支持虚拟SPI的能力，则所述发送端向所述接收端传输所述数据流之前，可以将所述数据流的流标识经过哈希得到的哈希值填入SPI的字段中，得到虚拟SPI标识。
所述第一确定单元111，具体设置为：对所述数据流的流标识进行哈希运算处理，得到哈希值；利用得到的哈希值设置所述SPI标识的字段，得到虚拟SPI标识。
这里，可以利用得到的哈希值，设置所述SPI标识中特定位置的字段。比 如，假设所述SPI标识可以用26比特表示，则所述特定位置可以是指26比特中的末四位比特等等。
这里，在确定虚拟SPI标识之前，所述发送端还需要针对虚拟SPI支持能力与所述接收端进行协商，以确定所述接收端是否具有支持虚拟SPI的能力。
基于此，在一个可选的实施例中，所述装置还包括：判断单元，设置为判断所述接收端是否具有支持虚拟SPI的能力；当确定所述接收端具有支持虚拟SPI的能力时，利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识。
这里，在对所述接收端是否具有支持虚拟SPI的能力进行确认之前，所述发送端与所述接收端还需要进行IKE SA、IPSec SA的协商，以确定数据流传输所使用的IPSec隧道，即建立IPSec安全策略，IPSec安全策略包含所述数据流的流标识与IPSec隧道的SPI标识的映射关系。
基于此，在一个可选的实施例中，所述装置还包括：第一协商单元，设置为与所述接收端进行IPSec SA协商；建立IPSec隧道。
其中，在建立IPSec隧道的过程中，建立IPSec安全策略，在所述IPSec安全策略中包含所述数据流的流标识和所述IPSec隧道的SPI标识的映射关系。
可选地，为所述数据流建立ACL，ACL中包含所述数据流的流标识，并建立所述数据流的流标识和IPSec隧道的SPI标识的映射关系。
这里，所述发送端与所述接收端进行IPSec SA协商的内容可以包括隧道两端使用的封装模式、加密算法、加密密钥、验证算法、验证密钥等等。
实际应用时，所述发送端将所述数据流发送至所述接收端之前，还需要对所述数据流的各报文进行加密。
基于此，在一个可选的实施例中，所述加密单元112，具体设置为对所述数据流中的每个报文进行加密，得到加密后的各报文。
实际应用时，所述第一确定单元111、加密单元112、第一传输单元113、判断单元、第一协商单元可由数据传输装置中的处理器实现。
为了实现本申请实施例的方法，本申请实施例还提供了一种数据传输装置，设置在接收端上，如图12所示，包括：
第一接收单元121，设置为接收发送端通过IPSec隧道发送的数据流；所述 数据流的各报文中携带有相应的虚拟SPI标识；所述虚拟SPI标识是所述发送端基于所述数据流的流标识以及传输所述数据流的IPSec隧道的SPI标识确定的；
第一解密单元122，设置为利用虚拟SPI标识，将所述数据的各报文送入多个解密单元中的同一个解密单元进行解密处理。
这里，所述发送端和接收端之间可建立多条IPSec隧道，并用SPI标识进行唯一标识。其中，所述接收端为每条IPSec隧道分配多个解密单元。
实际应用时，为了提高IPSec隧道的处理性能，所述接收端可以包括多个解密单元。所述接收端可以根据虚拟SPI标识将具有相同虚拟SPI标识的报文送入同一个解密单元进行解密处理，以避免因为多解密单元处理加剧报文乱序。其中，具有相同虚拟SPI标识的报文，表示属于同一条数据流，由同一个解密单元处理。
基于此，在一个可选的实施例中，所述第一解密单元122，具体设置为：将具有相同虚拟SPI标识的报文送入同一个解密单元，以进行解密处理。
可选地，所述第一解密单元122，可以将所述数据流的各报文的虚拟SPI标识进行比较，具备相同虚拟SPI标识的各报文送入同一个解密单元，以进行解密处理。
实际应用时，所述第一接收单元121、第一解密单元122可由数据传输装置中的处理器实现。
为了实现本申请实施例的方法，本申请实施例还提供了一种数据传输装置，设置在发送端上，如图13所示，包括：
第二确定单元131，设置为确定数据流的区分标识；还设置为利用数据流的区分标识与子IPSec隧道的SPI标识的映射关系，确定与所述数据流使用的子IPSec隧道；
第二传输单元132，设置为利用确定的子IPSec隧道，向接收端传输所述数据流。
其中，所述数据流的区分标识可以由五元组及以下信息至少之一组成：L2层的信息、L3层的信息、L4层的信息、L5层的信息、L6层的信息、L7层的信息。所述区分标识能够唯一区分所述数据流。
这里，所述五元组可以包括：源IP地址、目的IP地址，源端口号、目的端口号以及协议号。L2至L7层为OSI参考模型定义的各层。L2层信息可以包括与链路相关的信息；L3层信息可以包括IP地址；L4层信息可以包括协议信息，比如TCP协议、UDP协议；L5层信息可以包括与会话层相关的信息，比如服务质量参数；L6层信息可以包括数据格式，比如ASCII格式等等；L7层信息可以包括所述数据流的应用类型。所述应用类型包括但不限于HTTP应用类型、RTP应用类型等等。
实际应用时，为了满足5G数据传输速率的需求，可以在所述发送端和接收端之间建立多条子IPSec隧道，并用SPI标识进行唯一标识。一条子IPSec隧道在所述接收端分配一个解密单元。
这里，所述发送端对所述数据流进行传输前，所述发送端与所述接收端还需要进行IKE SA、Child SA的协商，以确定数据流传输所使用的子IPSec隧道，即建立子IPSec安全策略，包含所述数据流的区分标识与子IPSec隧道的SPI标识的映射关系。
基于此，在一个可选的实施例中，所述装置还包括：第二协商单元，设置为与所述接收端进行Child SA协商；建立子IPSec隧道；
其中，在建立子IPSec隧道的过程中，建立子IPSec隧道安全策略，在所述子IPSec隧道安全策略中包含所述数据流的区分标识和子IPSec隧道的SPI标识的映射关系。
这里，所述发送端与所述接收端进行Child SA协商的内容可以包括隧道两端使用的封装模式、加密算法、加密密钥、验证算法、验证密钥等等。
这里，通过所述确定的子IPSec隧道将所述数据流传输至所述接收端的与所述子IPSec隧道对应的解密单元进行解密处理。
实际应用时，所述第二确定单元131、第二传输单元132、第二协商单元可由数据传输装置中的处理器实现。
为了实现本申请实施例的方法，本申请实施例还提供了一种数据传输装置，设置在接收端上，如图14所示，包括：
第二接收单元141，设置为接收发送端通过子IPSec隧道发送的数据流。
其中，所述子IPSec隧道是所述发送端基于所述数据流的区分标识与子 IPSec隧道的SPI标识的映射关系确定的。
第二解密单元142，设置为将通过子IPSec隧道传输的所述数据流发送至与所述子IPSec隧道对应的解密单元进行解密处理。
这里，为了满足5G数据传输速率的需求，可以在所述发送端和接收端之间建立多条子IPSec隧道，并用SPI进行唯一标识。一条子IPSec隧道在所述接收端分配一个解密单元。
实际应用时，所述第二接收单元141可由数据传输装置中的通信接口实现。第二解密单元142可由数据传输装置中的处理器实现。
基于上述程序模块的硬件实现，且为了实现本申请实施例发送端侧的方法，本申请实施例还提供了一种发送设备，如图15所示，该智能设备150包括：第一通信接口151、第一处理器152、第一存储器153；其中，
第一通信接口151，能够与其它设备进行信息交互；
第一处理器152，与所述第一通信接口151连接，以实现与无线网络接入设备进行信息交互，设置为运行计算机程序时，执行上述智能设备侧一个或多个技术方案提供的方法。而所述计算机程序存储在第一存储器153上。
当然，实际应用时，智能设备150中的各个组件通过总线系统154耦合在一起。可理解，总线系统154设置为实现这些组件之间的连接通信。总线系统154除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。但是为了清楚说明起见，在图15中将各种总线都标为总线系统154。
本申请实施例中的第一存储器153设置为存储各种类型的数据以支持智能设备150的操作。这些数据的示例包括：用于在智能设备150上操作的任何计算机程序。
上述本申请实施例揭示的方法可以应用于所述第一处理器152中，或者由所述第一处理器152实现。所述第一处理器152可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过所述第一处理器152中的硬件的集成逻辑电路或者软件形式的指令完成。上述的所述第一处理器152可以是通用处理器、数字信号处理器(DSP，Digital Signal Processor)，或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。所述第一处理器152可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或者任何常规的处理器等。结合本申请 实施例所公开的方法的步骤，可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于存储介质中，该存储介质位于第一存储器153，所述第一处理器152读取第一存储器153中的信息，结合其硬件完成前述方法的步骤。
在示例性实施例中，发送设备150可以被一个或多个应用专用集成电路(ASIC，Application Specific Integrated Circuit)、DSP、可编程逻辑器件(PLD，Programmable Logic Device)、复杂可编程逻辑器件(CPLD，Complex Programmable Logic Device)、现场可编程门阵列(FPGA，Field-Programmable Gate Array)、通用处理器、控制器、微控制器(MCU，Micro Controller Unit)、微处理器(Microprocessor)、或者其他电子元件实现，用于执行前述方法。
基于上述程序模块的硬件实现，且为了实现本申请实施例接收端侧的方法，如图16所示，该接收设备160包括：
第二通信接口161，能够与其它设备进行信息交互；
第二处理器162，与所述第二通信接口161连接，以实现与智能设备进行信息交互，设置为运行计算机程序时，执行上述无线网络接入设备侧一个或多个技术方案提供的方法。而所述计算机程序存储在所述第二存储器163上。
当然，实际应用时，无线网络接入设备160中的各个组件通过总线系统164耦合在一起。可理解，总线系统164设置为实现这些组件之间的连接通信。总线系统164除包括数据总线之外，还包括电源总线、控制总线和状态信号总线。但是为了清楚说明起见，在图16中将各种总线都标为总线系统164。
本申请实施例中的第二存储器163设置为存储各种类型的数据以支持无线网络接入设备160的操作。这些数据的示例包括：用于在无线网络接入设备160上操作的任何计算机程序。
上述本申请实施例揭示的方法可以应用于所述第二处理器162中，或者由所述第二处理器162实现。所述第二处理器162可能是一种集成电路芯片，具有信号的处理能力。在实现过程中，上述方法的各步骤可以通过所述第二处理器162中的硬件的集成逻辑电路或者软件形式的指令完成。上述的所述第二处理器162可以是通用处理器、DSP，或者其他可编程逻辑器件、分立门或者晶体管逻辑器件、分立硬件组件等。所述第二处理器162可以实现或者执行本申请实施例中的公开的各方法、步骤及逻辑框图。通用处理器可以是微处理器或 者任何常规的处理器等。结合本申请实施例所公开的方法的步骤，可以直接体现为硬件译码处理器执行完成，或者用译码处理器中的硬件及软件模块组合执行完成。软件模块可以位于存储介质中，该存储介质位于第二存储器163，所述第二处理器162读取第二存储器163中的信息，结合其硬件完成前述方法的步骤。
在示例性实施例中，接收设备160可以被一个或多个ASIC、DSP、PLD、CPLD、FPGA、通用处理器、控制器、MCU、Microprocessor、或其他电子元件实现，用于执行前述方法。
可以理解，本申请实施例的存储器(第一存储器153、第二存储器163)可以是易失性存储器或者非易失性存储器，也可包括易失性和非易失性存储器两者。其中，非易失性存储器可以是只读存储器(ROM，Read Only Memory)、可编程只读存储器(PROM，Programmable Read-Only Memory)、可擦除可编程只读存储器(EPROM，Erasable Programmable Read-Only Memory)、电可擦除可编程只读存储器(EEPROM，Electrically Erasable Programmable Read-Only Memory)、磁性随机存取存储器(FRAM，ferromagnetic random access memory)、快闪存储器(Flash Memory)、磁表面存储器、光盘、或只读光盘(CD-ROM，Compact Disc Read-Only Memory)；磁表面存储器可以是磁盘存储器或磁带存储器。易失性存储器可以是随机存取存储器(RAM，Random Access Memory)，其用作外部高速缓存。通过示例性但不是限制性说明，许多形式的RAM可用，例如静态随机存取存储器(SRAM，Static Random Access Memory)、同步静态随机存取存储器(SSRAM，Synchronous Static Random Access Memory)、动态随机存取存储器(DRAM，Dynamic Random Access Memory)、同步动态随机存取存储器(SDRAM，Synchronous Dynamic Random Access Memory)、双倍数据速率同步动态随机存取存储器(DDRSDRAM，Double Data Rate Synchronous Dynamic Random Access Memory)、增强型同步动态随机存取存储器(ESDRAM，Enhanced Synchronous Dynamic Random Access Memory)、同步连接动态随机存取存储器(SLDRAM，SyncLink Dynamic Random Access Memory)、直接内存总线随机存取存储器(DRRAM，Direct Rambus Random Access Memory)。本申请实施例描述的存储器旨在包括但不限于这些和任意其它适合类型的存储器。
需要说明的是：“第一”、“第二”等是用于区别类似的对象，而不必用于描 述特定的顺序或先后次序。
另外，本申请实施例所记载的技术方案之间，在不冲突的情况下，可以任意组合。
以上所述，仅为本申请的较佳实施例而已，并非用于限定本申请的保护范围。
工业实用性
如上所述，本申请实施例提供的一种数据传输方法、装置、相关设备及存储介质具有以下有益效果：发送端将携带有虚拟SPI标识的各报文发送给接收端，这样，所述接收端可以将具有相同虚拟SPI标识的报文送入同一个解密单元进行解密处理。如此，可避免报文乱序问题的发生，同时还能提高IPSec隧道的处理性能。

Claims (18)

  1. 一种数据传输方法，应用于发送端，所述方法包括：
    利用数据流的流标识，以及传输所述数据流的网络协议安全IPSec隧道的安全参数索引SPI标识，确定虚拟SPI标识；
    针对所述数据流中的每个加密后的报文，将虚拟SPI标识携带于相应报文中；
    通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。
  2. 根据权利要求1所述的方法，其中，所述利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识，包括：
    对所述数据流的流标识进行哈希运算处理，得到哈希值；
    利用得到的哈希值设置所述SPI标识的字段，得到虚拟SPI标识。
  3. 根据权利要求1所述的方法，其中，所述利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识之前，所述方法还包括：
    判断所述接收端是否具有支持虚拟SPI的能力；
    当确定所述接收端具有支持虚拟SPI的能力时，利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识。
  4. 根据权利要求1所述的方法，其中，所述利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识之前，所述方法还包括：
    与所述接收端进行IPsec安全联盟SA协商，建立IPSec隧道；其中，
    在建立IPSec隧道的过程中，建立IPSec安全策略，在所述IPSec安全策略中包含所述数据流的流标识和所述IPSec隧道的SPI标识的映射关系。
  5. 一种数据传输方法，应用于接收端，所述方法包括：
    接收发送端通过IPSec隧道发送的数据流；所述数据流的各报文中携带有虚拟SPI标识；所述虚拟SPI标识是所述发送端基于所述数据流的流标识以及传输所述数据流的IPSec隧道的SPI标识确定的；
    利用虚拟SPI标识，将所述数据流的各报文送入同一个解密单元进行解密处理。
  6. 根据权利要求5所述的方法，其中，所述利用虚拟SPI标识，将所述数据流的各报文送入同一个解密单元进行解密处理，包括：
    将具有相同虚拟SPI标识的报文送入同一个解密单元，以进行解密处理。
  7. 一种数据传输方法，应用于发送端，所述方法包括：
    确定数据流的区分标识；
    利用数据流的区分标识与子IPSec隧道的SPI标识的映射关系，确定所述数据流传输所使用的子IPSec隧道；
    利用确定的子IPSec隧道，向接收端传输所述数据流；通过所述确定的子IPSec隧道将所述数据流传输至所述接收端的与所述子IPSec隧道对应的解密单元进行解密处理。
  8. 根据权利要求7所述的方法，其中，所述数据流的区分标识由五元组及以下信息至少之一组成：
    L2层的信息；L3层的信息；L4层的信息；L5层的信息；L6层的信息；L7层的信息。
  9. 根据权利要求7所述的方法，其中，所述方法还包括：
    与所述接收端进行子Child SA协商，建立子IPSec隧道；其中，
    在建立子IPSec隧道的过程中，建立子IPSec隧道安全策略，在所述子IPSec隧道安全策略中包含所述数据流的区分标识和子IPSec隧道的SPI标识的映射关系。
  10. 一种数据传输方法，应用于接收端，所述方法包括：
    接收发送端通过子IPSec隧道发送的数据流；
    将通过子IPSec隧道传输的所述数据流发送至所述子IPSec隧道对应的解密单元进行解密处理。
  11. 根据权利要求10所述的方法，其中，所述方法还包括：
    与所述发送端进行Child SA协商，建立子IPSec隧道。
  12. 一种数据传输装置，应用于发送端，所述装置包括：
    第一确定单元，设置为利用数据流的流标识，以及传输所述数据流的IPSec隧道的SPI标识，确定虚拟SPI标识；
    加密单元，设置为针对所述数据流中的每个加密后的报文，将虚拟SPI标识携带于相应报文中；
    第一传输单元，设置为通过所述IPSec隧道，向接收端传输所述数据流；所述虚拟SPI标识用于供所述接收端将所述数据流的各报文送入同一个解密单元进行解密处理。
  13. 一种数据传输装置，应用于接收端，所述装置包括：
    第一接收单元，设置为接收发送端通过IPSec隧道发送的数据流；所述数据流的各报文中携带有虚拟SPI标识；所述虚拟SPI标识是所述发送端基于所述数据流的流标识以及传输所述数据流的IPSec隧道的SPI标识确定的；
    第一解密单元，设置为利用虚拟SPI标识，将所述数据流的各报文送入同一个解密单元进行解密处理。
  14. 一种数据传输装置，应用于发送端，所述装置包括：
    第一确定单元，设置为确定数据流的区分标识；还设置为利用数据流的区分标识与子IPSec隧道的SPI标识的映射关系，确定所述数据流传输所使用的子IPSec隧道；
    第二传输单元，设置为利用确定的子IPSec隧道，向接收端传输所述数据流；通过所述确定的子IPSec隧道将所述数据流传输至所述接收端的与所述子IPSec隧道对应的解密单元进行解密处理。
  15. 一种数据传输装置，应用于接收端，所述装置包括：
    第二接收单元，设置为接收发送端通过子IPSec隧道发送的数据流；
    第二解密单元，设置为将通过子IPSec隧道传输的所述数据流发送至与所述子IPSec隧道对应的解密单元进行解密处理。
  16. 一种发送设备，包括：第一处理器和设置为存储能够在处理器上运行的计算机程序的第一存储器，
    其中，所述第一处理器设置为运行所述计算机程序时，执行权利要求1至4任一项所述方法的步骤，或者，执行权利要求7至9任一项所述方法的步骤。
  17. 一种接收设备，包括：第二处理器和设置为存储能够在处理器上运行 的计算机程序的第二存储器，
    其中，所述第一处理器设置为运行所述计算机程序时，执行权利要求5或6所述方法的步骤，或者，执行权利要求10或11所述方法的步骤。
  18. 一种存储介质，其上存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1至4任一项所述方法的步骤，或者，执行权利要求5至6任一项所述方法的步骤，或者，执行权利要求7至9任一项所述方法的步骤，或者，执行权利要求10或11所述方法的步骤。
PCT/CN2019/112548 2018-12-28 2019-10-22 一种数据传输方法、装置、相关设备及存储介质 Ceased WO2020134413A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP19902692.3A EP3905623B1 (en) 2018-12-28 2019-10-22 Data transmission method and apparatus, related device, and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201811628535.8A CN111385259B (zh) 2018-12-28 2018-12-28 一种数据传输方法、装置、相关设备及存储介质
CN201811628535.8 2018-12-28

Publications (1)

Publication Number Publication Date
WO2020134413A1 true WO2020134413A1 (zh) 2020-07-02

Family

ID=71126938

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2019/112548 Ceased WO2020134413A1 (zh) 2018-12-28 2019-10-22 一种数据传输方法、装置、相关设备及存储介质

Country Status (3)

Country Link
EP (1) EP3905623B1 (zh)
CN (1) CN111385259B (zh)
WO (1) WO2020134413A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114039812A (zh) * 2021-10-26 2022-02-11 南方电网数字电网研究院有限公司 数据传输通道建立方法、装置、计算机设备和存储介质
US11477176B1 (en) 2021-05-27 2022-10-18 Microsoft Technology Licensing, Llc Throughput for a single VPN connection using multiple processing cores
US12231405B2 (en) 2021-05-27 2025-02-18 Microsoft Technology Licensing, Llc Selecting a VPN connection using negotiated cryptographic algorithms to improve throughput

Families Citing this family (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111865583B (zh) * 2020-07-20 2023-04-18 北京天融信网络安全技术有限公司 隧道协商方法、装置、电子设备及存储介质
CN113194097B (zh) * 2021-04-30 2022-02-11 北京数盾信息科技有限公司 一种安全网关的数据处理方法、装置及安全网关
CN113726737A (zh) * 2021-07-26 2021-11-30 绿盟科技集团股份有限公司 一种通信方法、设备及介质
CN115550250B (zh) * 2022-11-17 2023-04-07 鹏城实验室 小流报文重传方法、系统、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100217971A1 (en) * 2009-02-25 2010-08-26 Cisco Technology, Inc. Aggregation of cryptography engines
CN102907056A (zh) * 2011-01-21 2013-01-30 华为技术有限公司 数据流控制处理方法、装置及系统
CN104247367A (zh) * 2012-03-30 2014-12-24 华为技术有限公司 提升IPsec性能和防窃听安全性
CN106998549A (zh) * 2016-01-25 2017-08-01 中兴通讯股份有限公司 IPSec隧道的建立方法及装置、终端和网络侧设备
CN108989194A (zh) * 2017-05-31 2018-12-11 微软技术许可有限责任公司 分布式IPSec网关

Family Cites Families (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JP2000315997A (ja) * 1999-04-30 2000-11-14 Toshiba Corp 暗号通信方法及びノード装置
US20100268935A1 (en) * 2009-04-21 2010-10-21 Richard Rodgers Methods, systems, and computer readable media for maintaining flow affinity to internet protocol security (ipsec) sessions in a load-sharing security gateway
EP3643029B1 (en) * 2017-06-20 2021-08-04 Telefonaktiebolaget LM Ericsson (publ) Flow multiplexing in ipsec
CN107454116A (zh) * 2017-10-10 2017-12-08 郑州云海信息技术有限公司 单隧道模式下IPsec ESP协议的优化方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20100217971A1 (en) * 2009-02-25 2010-08-26 Cisco Technology, Inc. Aggregation of cryptography engines
CN102907056A (zh) * 2011-01-21 2013-01-30 华为技术有限公司 数据流控制处理方法、装置及系统
CN104247367A (zh) * 2012-03-30 2014-12-24 华为技术有限公司 提升IPsec性能和防窃听安全性
CN106998549A (zh) * 2016-01-25 2017-08-01 中兴通讯股份有限公司 IPSec隧道的建立方法及装置、终端和网络侧设备
CN108989194A (zh) * 2017-05-31 2018-12-11 微软技术许可有限责任公司 分布式IPSec网关

Non-Patent Citations (2)

* Cited by examiner, † Cited by third party
Title
MOTOROLA MOBILITY-LENOVO; NOKIA; NOKIA SHANGHAI BELL: "Changing Transport Mode to Tunnel Mode for IPsec Tunnel", 3GPP TSG-CT WG1 MEETING #111BIS C1-184265, 13 July 2018 (2018-07-13), XP051465766, DOI: 20200110184653A *
See also references of EP3905623A4 *

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US11477176B1 (en) 2021-05-27 2022-10-18 Microsoft Technology Licensing, Llc Throughput for a single VPN connection using multiple processing cores
WO2022250870A1 (en) * 2021-05-27 2022-12-01 Microsoft Technology Licensing, Llc Throughput for a single vpn connection using multiple processing cores
US12231405B2 (en) 2021-05-27 2025-02-18 Microsoft Technology Licensing, Llc Selecting a VPN connection using negotiated cryptographic algorithms to improve throughput
CN114039812A (zh) * 2021-10-26 2022-02-11 南方电网数字电网研究院有限公司 数据传输通道建立方法、装置、计算机设备和存储介质

Also Published As

Publication number Publication date
EP3905623A4 (en) 2022-03-02
CN111385259A (zh) 2020-07-07
EP3905623B1 (en) 2025-12-10
EP3905623A1 (en) 2021-11-03
CN111385259B (zh) 2023-09-01

Similar Documents

Publication Publication Date Title
CN111385259B (zh) 一种数据传输方法、装置、相关设备及存储介质
US10333919B2 (en) System and method for traversing a NAT device with IPSec AH authentication
US9712504B2 (en) Method and apparatus for avoiding double-encryption in site-to-site IPsec VPN connections
CN102882789B (zh) 一种数据报文处理方法、系统及设备
KR101680955B1 (ko) 다중 터널 가상 사설 네트워크
US10708245B2 (en) MACsec for encrypting tunnel data packets
JP6288802B2 (ja) 盗聴に対するＩＰｓｅｃ通信のパフォーマンス及びセキュリティの向上
US9294506B2 (en) Method and apparatus for security encapsulating IP datagrams
US9100370B2 (en) Strong SSL proxy authentication with forced SSL renegotiation against a target server
US10091170B2 (en) Method and apparatus for distributing encryption and decryption processes between network devices
US9369550B2 (en) Protocol for layer two multiple network links tunnelling
US20100268935A1 (en) Methods, systems, and computer readable media for maintaining flow affinity to internet protocol security (ipsec) sessions in a load-sharing security gateway
US10044841B2 (en) Methods and systems for creating protocol header for embedded layer two packets
CN110719248A (zh) 用户数据报协议报文的转发方法及装置
WO2015131609A1 (zh) 一种实现L2TP over IPsec接入的方法
CN105471827A (zh) 一种报文传输方法及装置
US20190281530A1 (en) X2 service transmission method and network device
WO2016165277A1 (zh) 一种实现IPsec分流的方法和装置
CN105635076B (zh) 一种媒体传输方法和设备
US11095619B2 (en) Information exchange for secure communication
CN106027508A (zh) 一种认证加密的数据传输方法及装置
CN114039812B (zh) 数据传输通道建立方法、装置、计算机设备和存储介质
CN117254976A (zh) 基于VPP的国标IPsec VPN实现方法、装置、系统及电子设备
CN107454116A (zh) 单隧道模式下IPsec ESP协议的优化方法及装置

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 19902692

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2019902692

Country of ref document: EP

Effective date: 20210728

WWG Wipo information: grant in national office

Ref document number: 2019902692

Country of ref document: EP