WO2011082584A1

WO2011082584A1 - Implementing method, network and terminal for processing data packet classification

Info

Publication number: WO2011082584A1
Application number: PCT/CN2010/076022
Authority: WO
Inventors: 张世伟; 符涛
Original assignee: 中兴通讯股份有限公司
Priority date: 2010-01-11
Filing date: 2010-08-16
Publication date: 2011-07-14
Also published as: CN102123072A; CN102123072B

Abstract

An implementing method, network and terminal for processing data packet classification are provided by the present invention, said method is implemented based on a network which processes the data packet classification, the implementing method comprises a processing for the received data packet by the terminal, the processing comprises that the terminal receives the data packet, the packet header of the data packet carries the classification information which denotes the classification of the packet source terminal (101); the terminal processes distinctively said data packet according to said classification information (102). The present invention improves the flexibility for networking, at the same time also ensures the security of the network well.

Description

Method, network and terminal for implementing data packet classification processing

Technical field

The present invention relates to the field of data communications, and in particular, to a method, a network, and a terminal for implementing data packet classification processing.

Background technique

The existing Internet ^ ^ built on Internet Protocol (IP) technology, the openness of the IP network has contributed to the prosperity of the Internet, but also brought a large number of security issues, the nodes in the Internet are managed by multiple agencies in multiple countries, Some nodes are trusted or untrustworthy. Users in the network may receive data packets from trusted nodes and may receive data packets from untrusted nodes. Under the prior art, IP users cannot distinguish between them. Which data packets are sent by trusted nodes, and which data packets are sent by untrusted nodes, cannot be distinguished, thus leaving an attack space for untrusted nodes to impersonate trusted nodes to access the network, which seriously reduces the attack space. Network security.

Summary of the invention

The technical problem to be solved by the present invention is to provide a method, a network and a terminal for implementing data packet classification processing to improve network security.

In order to solve the above technical problem, the present invention provides a method for implementing data packet classification processing, which is implemented on a network that performs classification processing on data packets, and the implementation method includes processing of received data packets by a terminal. This process includes:

Receiving, by the terminal, a data packet, where the packet header of the data packet carries category information indicating a source category of the packet;

The terminal performs a difference processing on the data packet according to the category information.

The category information in the packet header of the data packet is determined by the intermediate node according to the type of the source of the packet and added to the packet header.

The intermediate node is an access device that is responsible for accessing the source end of the packet, and the implementation method further includes processing, by the access device, the original data packet sent by the source end of the packet, where the processing includes: Receiving, by the access device, the original data packet sent by the source end of the packet;

Processing, by the access device, the original data packet, including adding category information indicating the source end category of the packet to the packet header;

Transmitting, by the access device, the processed data packet;

The source end of the packet is sent by the authentication server to the access device during the access authentication process of the source end of the packet.

When the data packet classification processing network communicates with the external network, the intermediate node refers to an interworking service node that connects the data packet classification processing network with the external network, and the implementation method further includes the interworking service node (ISN) external network data. Processing of the message, the process includes:

The ISN receives an external network data packet sent by the external network to the data packet classification processing network; the ISN determines, according to the source of the data packet, the data packet source end in the data packet classification processing network. The category information, and converting the external network data packet into an intranet data packet, including adding category information to the packet header or modifying the original category information in the packet header according to the determined category information;

The ISN forwards the converted intranet data packet to the intranet route.

The ISN receives the intranet data packet sent by the data packet classification processing network to the external network; the ISN converts the intranet data packet into an external network data packet, including according to the trustworthiness of the external network. , modifying or deleting the category information in the header of the data packet;

The ISN forwards the converted external network data packet in the data packet classification processing network.

The step of performing the difference processing on the received data packet by the terminal includes: determining, according to the source category of the packet, the confidentiality of the service application in combination with the terminal's own attribute, and determining the processing of the data Method.

The data packet classification processing network is an Internet network or an identity and location separation network (SILSN).

The category information is carried by the IPV6 extended header. The category information is carried by the Destination Options header of the IPV6 extension header, and the first two digits of the Option Type of the Destination Options header are 00 or 01, indicating the purpose. When the node does not recognize this option, it processes the rest of the data packet or discards the data packet.

The category information includes a source identifier type (SIDT) determined according to a terminal type and/or a trustworthiness (CG) determined according to a terminal trustworthiness, wherein the source identifier type includes: an in-network trusted user Group users in the network, Internet cafe users in the network, similar network users that can be trusted outside the network, heterogeneous network users that can be trusted outside the network, or untrusted network users outside the network. And/or the intra-domain identifier of the terminal.

In order to solve the above technical problem, the present invention further provides a terminal, where the terminal is implemented based on a communication network, and the terminal includes:

a receiving module, configured to: receive a data packet, where the packet header of the data packet carries category information indicating a source category of the packet;

a packet source end category determining module, connected to the receiving module, configured to: determine a source type of the packet according to the category information in the data packet;

The data packet processing module is configured to be connected to the packet source class determining module, and configured to: perform differential processing on the data packet according to the source class of the packet.

The data packet processing module is configured to: determine, according to the source type of the packet, the method for processing the data packet according to the confidentiality of the service application in combination with the terminal's own attribute.

The category information is carried by the IPV6 extension header.

The category information is carried by the Destination Options header of the IPV6 extension header, and the first two digits of the Option Type of the Destination Options header are 00 or 01, indicating the purpose. When the node does not recognize this option, it processes the rest of the data packet or discards the data packet.

The category information includes a source identifier type (SIDT) determined according to a terminal type and/or a trustworthiness (CG) determined according to a terminal trustworthiness, wherein the source identifier type includes: an in-network trusted user , intranet group users, intranet cafe users, trusted network users of the same network, extranet Trusted heterogeneous network users or untrusted network users outside the network.

To solve the above technical problem, the present invention further provides a network for classifying data packets, the network comprising:

The terminal is configured to: receive and receive a data packet, where the packet header of the received data packet carries category information indicating a source category of the packet; and the received data packet according to the category information in the received data packet Differentiate processing; and

The intermediate node is connected to the terminal through the network, and is configured to: receive and forward the data packet, and add the source of the packet to the packet header of the received data packet according to the category of the source of the packet before forwarding. Category information.

The intermediate node is an access device that implements access by the terminal, and the network further includes an authentication server that is connected to the access device;

The server is configured to: perform user identification and authentication on the terminal, and notify the access device where the terminal is located in the authentication process; the access device is configured to: according to the terminal acquired from the authentication server The category adds the corresponding category information to the header of the data packet sent by the terminal.

The intermediate node is an interworking service node (ISN) between the network and the external network, and the ISN includes:

a receiving module, configured to: receive an external network data packet sent by the external network to the data packet classification processing network;

a category information determining module, configured to be connected to the receiving module, configured to: determine, according to the category information of the data packet classification processing network of the source end of the external network data message;

The data packet conversion module is connected to the category information determining module, and is configured to: convert the external network data packet into an intranet data packet, and include adding category information to the packet header according to the determined category information. Or modify the original category information in the header of the message;

The data packet forwarding module is connected to the data packet conversion module, and is configured to: forward the intranet data packet converted by the data packet conversion module in the data packet classification processing network.

The receiving module of the ISN is further configured to: receive a data packet classification processing network and send it to other Intranet data message of the network;

The category information determining module of the ISN is further configured to: determine, according to a trusted situation of the external network, category information of the source end of the intranet data packet in the outer network;

The data packet conversion module of the ISN is further configured to: convert the intranet data packet into an external network data packet, and include deleting or modifying category information in the packet header according to the determined category information; The data packet forwarding module is further configured to: forward the external network data packet converted by the data packet conversion module to the external network.

The terminal is configured to perform the difference processing on the received data packet in the following manner: determining the data packet according to the source type of the packet, and combining the attribute of the terminal with the confidentiality of the service application. The way to deal with it.

The category information is carried by the IPV6 extension header.

The category information includes a source identifier type (SIDT) determined according to a terminal type and/or a trustworthiness (CG) determined according to a terminal trustworthiness, wherein the source identifier type includes: an in-network trusted user Group users in the network, Internet cafe users in the network, similar network users that can be trusted outside the network, heterogeneous network users that can be trusted outside the network, or untrusted network users outside the network.

And/or the intra-domain identifier of the terminal.

The present invention utilizes the category information of the source class of the packet carried in the packet header, so that the terminal that receives the packet can distinguish the user outside the network from the user and/or the trusted user according to the category information in the packet header. For untrusted users, the security of the user and the upper-layer services can be differentiated according to the category, which not only satisfies the interconnection and intercommunication requirements required by the user for common services, but also enables the P-network users to identify untrusted users for corresponding processing. While improving the flexibility of networking, it also ensures the security of the network. BRIEF abstract

1 is a schematic diagram of a method for classifying a data packet by a terminal of the present invention;

2 is a schematic diagram of a method for processing a data packet by an access device according to the present invention;

3 is a schematic diagram of a method for processing an external network data packet of an interworking service node according to the present invention;

Figure 5 is a network architecture diagram of identity and location identification separation;

6 is a processing flow of the access service node ASN adding a source identification type;

Figure 7 is a method for determining the source identification type of the access device ASN;

8 is a flow chart of processing an inter-network message by the interworking service node ISN;

FIG. 9 is a schematic diagram of determining a source identifier type of an external network data packet by the interworking service node ISN; FIG. 10 is a schematic diagram of processing, by the terminal, a data packet sent by another user according to the category information carried by the destination extension header.

Preferred embodiment of the invention

The main idea of the data packet classification processing method, the network, and the terminal of the present invention is to use the packet header of the data packet to carry the category information indicating the source end category of the packet, so that the terminal receiving the data packet can be based on the category information. Data packets are treated differently.

The invention is mainly applied to a network with independent management authority, and has an access control device at the boundary, such as an operator's network, or an enterprise network, or a single autonomous domain, etc., the network and other networks have obvious boundaries, and the boundary device It is responsible for adding or deleting the category information mentioned in the present invention. For convenience of description, we refer to this network with independent management capability as a P network.

When the P network and other networks are connected to the Internet, the users in the network will receive the packets of the trusted users and the packets of the untrusted users outside the network. For the security of the user and the needs of the upper-layer services, the P-network is required. The user can identify different sources and/or trust levels of these data messages. In order to distinguish the source and/or trust level of these packets, it is necessary to take some new control measures at the borders of the P network, such as the access node and the interworking node, so that the data packets in the network entering the P network can carry the classes. Information, so that the terminal device can be based on the category information carried in the data message, for different sources or not Users with the same level of trust learn different ways.

As shown in FIG. 1 , the method for implementing data packet classification processing according to the present invention is implemented by a data packet classification processing network (P network) for classifying data packets, and the implementation method includes the terminal receiving data. The processing method of the message, the processing method includes:

Step 101: The terminal receives a data packet, where the packet header of the data packet carries category information indicating a source category of the packet.

Step 102: The terminal performs a difference processing on the data packet according to the category information. When the P network terminal performs the difference processing on the received data packet, the method for processing the data packet is determined according to the source type of the packet and the confidentiality of the service application in combination with the terminal's own attribute. . For example, for a more confidential server-type terminal, untrusted external network users can be denied access to avoid leakage of confidential information. In addition, for some politically sensitive BBS forum servers, you can perform some functional restrictions on Internet cafe users who are not easy to trace, such as only allowing browsing of forum content but not allowing new posts to be posted, thus ensuring the order of the BBS forum and avoiding the use of criminals. The BBS Forum publishes malicious information.

The category information mentioned in the present invention is that the source node sends the original data packet, and the intermediate node (such as the access device in the P network or the interworking service node between the P network and the external network) determines and joins the report according to the source of the packet. Header, including source identification type and/or trustworthiness:

The source identifier type is determined by the intermediate node according to the type of the source of the packet, including:

1. Trusted ordinary users in the network

2. Group users in the network

3, Internet cafe users

When the P network and the external network communicate with each other, in addition to the above three types, the source type information of the packet also includes:

4. Trusted similar network users outside the network

5. Trusted heterogeneous network users outside the network (such as IP V6 source address authentication users)

6. Untrusted network users outside the network.

When a user inside the P network receives a data packet sent by another user forwarded by the intermediate node, The source of the message can be distinguished according to the source identification type.

The trustworthiness is determined by the intermediate node according to the trustworthiness or trustworthiness level of the source of the message. It can be divided into two (such as: fully trusted and completely untrustworthy) or multiple trustworthiness, and the data packet is received. The P network users are differentiated according to the trustworthiness.

In addition, in order to implement traceback to the source of the packet, the header of the data packet may also carry a domain identifier, or both a domain identifier and an intra-domain user identifier, where the domain may be a group, an Internet cafe, or The internet.

The intermediate node referred to in the present invention refers to an access device in the network or an interworking service node between the networks, and the following respectively describe:

As shown in FIG. 2, the method for processing, by the access device, the data packet sent by the source of the packet includes: Step 201: The access device receives the original data packet sent by the source end of the packet; Step 202: The access device processes the original data packet, including adding category information indicating the source end category of the packet to the packet header;

The access device adds different category information according to different source terminal categories, such as trusted users in the network, group users in the network, and users in the network.

Step 203: The access device forwards the processed data packet.

When the p-network communicates with other similar or heterogeneous networks, the interworking service node (ISN) processes the packet headers of the data packets across the network, including processing the data packets sent to the external network and the content sent to the external network. Data packet processing, as shown in Figure 3, the method for processing the data packet sent by the ISN to the external network to the internal network includes:

Step 301: The ISN receives an external network data packet sent by the external network to the internal network.

Step 302: The ISN determines, according to the source of the data packet, the category information of the source end of the data packet in the internal network, and converts the external network data packet into an intranet data packet, including according to the determined category. The information adds category information to the packet header or modifies the original category information in the packet header; Step 303: The ISN forwards the intranet data packet to the intranet route.

As shown in Figure 4, the method for processing the data packet sent by the ISN to the external network includes:

Step 401: The ISN receives an intranet data packet sent by the intranet to the external network.

Step 402: The ISN converts the intranet data packet into the external network data packet, including modifying or deleting the category information in the data packet header according to the trusted condition of the external network.

Step 403: The ISN forwards the route of the external network data packet obtained after the conversion to the external network.

The categorization information of the present invention is carried by the IPV4 or IPV6 packet header. Specifically, it can be implemented by adding or defining a new packet header option in the IPV4 or IPV6 packet header, in order to change the current information as little as possible. With a data message protocol, the present invention preferably utilizes the extended message header of the IPV6 data message to carry the type information referred to in the present invention.

In order to distinguish the source of the data packet, the user needs to carry the category information of the user in the IPV6 packet. Currently, the IPV6 protocol does not have a complete mechanism for carrying the source identifier category information in the data packet, and the category information cannot be encapsulated into the IPV6 packet. In the text transmission, in order to enable the user of the P network to identify the user whose received data message is derived, the IPV6 protocol needs to be extended so that the data message carries the sender's category information.

The following describes the extension header of the existing IPV6 data packet:

The IPV6 header shown in Table 1 is defined in the IPV6 protocol (RFC2460) to carry additional Internet information:

Table 1

Source Address

Destination Address RFC2460 proposes to add an IPV6 extension header between the header of the IPV6 and the header of the upper layer. RFC2460 defines six types of extended packet headers, which are Hop-by-Hop Options header, Routing header, Fragment header, Authentication header, and ESP. Encapsulating Security Payload header, Destination Options header.

The RFC2460 defines a protocol number for each extension header, such as a hop-by-hop option header of 0 and a destination option header of 60. When the Internet application needs to use the IPV6 packet extension header to deliver information, you only need to set the next header in Table 1 to the corresponding protocol number. For example, if you need to pass data in the message using the destination option header, you only need to set the next header in Table 1 (Next Header) to 60.

The various IPV6 extension headers can coexist in a certain order, as shown in Table 2. Immediately after the IPV6 header is the routing header, then the destination option header, and finally the TCP packet header.

Table 2

Among the six extension headers defined in IPV6, the destination option header is used to carry information that is only checked by the destination node. The message format of the destination option header is shown in Table 3 below:

table 3

The Next Header indicates the next protocol header type, and Hdr Ext Len indicates the length of the destination option extension header, in units of 8 bytes, excluding the first byte.

In RFC2460, Options are further selected by Option Type and Options. Length (Opt Data Len) and option data. The first three bits of the option type are specified, and the first and second bits specify the action taken by the node that processes the IPV6 data message without knowing the tag:

00 - Skip this option to continue processing

01 - Discard this article.

10 - Discard this text, send ICMP

11 - Discard this message, send ICMP when it is not a multicast address

In addition, RFC2460 has the following three bits for the Option Type: 1 if the option data affects the route, otherwise 0.

For the 8-bit Option Type, except for the first three digits above, only 5 digits are available, that is, there are actually only 32 numbering spaces. Currently, the RFC has specified a destination option for the mobile IP protocol, called the home address. The Home Address option, whose value defines 0xC9, has a lower 5 bits of 00111 and occupies the sequence number 9.

The option length is in bytes and describes the actual length of the option data. The embodiment of the method is generally set to 12.

Since the destination option header is used to carry information that is only checked by the destination node, and the category information in the data message of the present invention is used by the end user, the present invention preferably uses the destination option header for extension.

The following describes the specific method for carrying the category information (including source identification type, trustworthiness) and traceability information (domain identifier and intra-domain user identifier) by using the destination option header of IPV6, as shown in Table 4:

Table 4

In the table, the next header (Next Header) and the header extension length ( Hdr Ext Len ) The meanings are the same as above, and are not described here. The following describes the new or newly defined destination extension header options of the present invention:

1, option type (Option Type):

The option type in the destination option header has a total of 8 bits:

For the upper 2 bits, the present invention does not make special provisions, and can be set by the node processing device according to the situation. For example, when the security level is relatively high, such as the public security network, this option can be set to 01, that is, if this is handled The node of the data packet does not recognize this data format and discards the entire packet. For a general type of node, it can be set to 00, so that even if the node does not recognize this option, the entire data packet can be processed normally, thereby improving system compatibility and maximizing the use of the original device. For the third bit, In the invention, the intermediate node will process this option, and the option data will affect the route, so it is set to 1;

For the lower 5 digits, you can select any of the 31 serial numbers other than the serial number option 00111 to expand. For example, the lower 5 digits use 11111 for expansion.

This new extended option type can have two alternative values:

One is 00111111, which is 0X3F, which means that when the destination node does not recognize this option, it should discard this data message.

One is 01111111, which is 0X9F, which means that when the destination node does not recognize this option, it still processes the rest of the data message normally.

The present invention provides a method for carrying an identifier of a sender class in an IPV6 data packet. By carrying the sender's category in the data packet, the terminal user can conveniently recognize that the received data packet is a trust. The node is also sent by the non-trusted node, so that data packets of different sources and different trust levels can be distinguished. More specifically, the present invention provides a method for carrying a user source address classification in an extended header of an IPV6 packet header. The method is applicable to a network that uses IPV6 to transmit and needs to distinguish the source of the packet.

2, source identification type

The source ID type (SIDT) is allocated a space of one byte. The values of each source identification type are defined as follows:

0X00 A common user in the network that can be trusted.

0X01 Group users in the network 0X02 Internet cafe users.

0X03 ~ 0X0F Reserved

0X80 Trusted network users of the same type.

0X81 Trusted heterogeneous network users outside the network.

0X82 Untrusted network users outside the network.

0X83 ~ 0X8F Reserved

3. Trustworthiness

A space of one byte is allocated for Credibility Grade (CG), and the trustworthiness is divided into two levels of trustworthiness: fully trustworthy and completely untrustworthy. If the source address is completely untrustworthy, it should be set to 0. If this source address is fully trusted, it should be set to 255.

4, domain identifier

The domain identifier (DID) is the information of the domain where the source of the packet is located. It is assigned 48 bits. This identifier has different roles under different source identifier types:

If the source ID type is a common user that can be trusted in the network: DID can be used to represent the MAC address of the source ID, or it can have no meaning. When there is no meaning, the DID should be set to 0.

If the source identification type is an intranet group user: DID stands for group number and is valid within one operator. For example, China Telecom can use Lenovo as a group user and give a 48-bit group number 0X0000 0000 F001.

If the source ID type is the intranet user: DID stands for the Internet cafe number, which is valid nationwide. If the source ID type is a trusted P network (like network) user: DID represents the same type of network identifier.

If the source ID type is other network (heterogeneous network) users that are trusted outside the network: DID stands for heterogeneous network ID.

If the source ID type is other network users that are not trusted: DID is meaningless.

5, domain user identifier

The Domain User Identification (DUI) indicates the user's number in this domain, which is assigned 32 bits. It has different roles under different source identification types:

If the source ID type is a normal user that can be trusted in the network: meaningless. If the source identification type is an intranet group user: Represents the user serial number within the group.

If the source ID type is Internet cafe user: Represents the Internet cafe user serial number.

If the source ID type is a network user that can be trusted outside the network: Represent the network's own number. If the source ID type is a trusted heterogeneous network user: Represent the network's own number. If the source ID type is untrusted outside the network. External network users: meaningless

The source address type, DID, and DUI relationships are shown in Table 5 below:

It is worth noting that the above only gives an example. The representation method of the category information in the actual network, the source identification type and/or the partitioning method of the trust degree and the arrangement order are not necessarily strictly as described above, as long as the P network It is a protection scope of the present invention that the terminal that receives the data message can perform the difference processing according to the category information.

Based on the definitions of the above sections, the following examples are given in conjunction with the application examples for the destination extension headers in each case:

Application example 1

Table 6 below is the destination extension header of data packets sent by ordinary users in the network received by the P network terminal: Table 6 Option type= ^ _T

Next Header Hdr Ext LeiFl ^ Opt Data Leffl2

0x3F

Credibility

Source-ID Type=0 Domain Identification (DID) =0

Grade (CG) = 255

Domain Identification (DID) =0

Domain User Identif icatio^DUI) =0 where:

Hdr Ext Len=l means that the option is followed by an 8-byte length, which is basically fixed.

Option Type=0x3F means that if the destination node does not recognize this option, the data message can be processed normally.

OptDataLen=12 indicates that the option length is 12 bytes.

Source-ID Type=0 means that the source of this packet is sent by a normal user in the network.

CG=255, indicating that this user is completely trusted.

DID=0, indicating that the DID is not used, which means that the DID field is meaningless.

DUI=0, indicating that the DUI is not used, which means that the DDI field is meaningless.

Application example 2

Table 7 below shows the destination extension headers of data packets sent by group users in the network received by the P network terminal:

Table 7

among them:

Hdr Ext Len=l means that there is an 8-byte length after the option. This length is basically fixed Option Type=0x3F. If the destination node does not recognize this option, the number can be processed normally. According to the message.

Opt Data Len=12 indicates that the option length is 12 bytes.

Source-ID Type=l indicates that the source of this packet was sent by an intranet group user.

CG=255, indicating that this user is completely trusted.

DID=0x000000Al , indicating that the user who sent this packet is from a group user with group number 101.

DUI=0x55667788, which indicates that the user of this packet is a user number within the group of 0x55667788.

Application example 3

Table 8 below is the destination extension header of the data packet sent by the Internet cafe user received by the P network terminal:

Table 8

among them:

Opt Data Len=12 indicates that the option length is 12 bytes.

Source-ID Type=2 indicates that the source of this packet is sent by an Internet cafe user.

CG=1 means that this user is not very trustworthy and is similar to untrustworthy.

DID=0x99F8AABBCCDD , indicating that the user who sent this packet is from the Internet cafe user whose Internet cafe number is 0x99F8AABBCCDD. DUI=0x00000005, which indicates that the user of this packet is the user number 5 in the Internet cafe. Application example 4

Table 9 below shows the destination extension headers of data packets sent by peer-to-peer network users that are received by the P-network terminal:

Table 9

among them:

Option Type=0x9F indicates that this data message should be discarded if the destination node does not recognize this option.

Opt Data Len=12 indicates that the option length is 12 bytes.

Source-ID Type=0x80 indicates that the source of this packet is sent by a network user of the same type that is trusted outside the network.

CG=10, indicating that this user is trustworthy, but the trust is not high.

DID=0xA0, indicating that the user who sent this data packet is sent from the network with external trusted network number 100. The DID number is only related to the single P network itself, and no global unified number is used.

DUI=0xl l , which indicates that the user of this packet was sent by a user numbered 17 in the trusted external network.

Application example 5

Table 10 below shows the destination extension headers of data packets sent by heterogeneous network users outside the network received by the P-network terminal: Table 10

among them:

Opt Data Len=12 indicates that the option length is 12 bytes.

Source-ID Type=0x81 indicates that the source of this packet is sent by an alien network trusted external network user.

CG=30, indicating the trustworthiness of this user.

DID=3, indicating that the user who sent the data packet is from a network with an externally trusted heterogeneous network sequence number 3. The DID number is the number assigned by the P network itself, and the global unified number is not used.

DUI=0xl 234, which indicates that the user of this packet was sent by a user numbered 0x1234 in the trusted external network.

Application example 6

Table 11 below shows the destination extension headers of data packets sent by untrusted network users received by the P-network terminal:

Table 11 Option ype= ^ _{π T} ~

Next Header Hdr Ext Len= l ^ ^ Opt Data Len=12

0x9F

Source -ID Credibility

Domain Identification (DID)=0

Type=0x82 Grade(CG)=0

Domain Identification (DID)=0

Domain User

among them:

Opt Data Len=12 indicates that the option length is 12 bytes.

Source-ID Type=0x82 indicates that the source of this packet is from an untrusted network user outside the network.

CG=0, indicating that this user is completely untrustworthy.

DID=0, indicating that the DID is not used.

DUI=0, indicating that the DUI is not being used.

The method of the present invention can be implemented based on an Internet network or an Identity and Location Separation Network (SILSN). The following is a basic implementation of the present invention with SILSN as the basis for implementing the P network.

FIG. 5 is a network architecture in which an identity identifier and a location identifier are separated. The network is a separate identity and location identifier network, including an Access Service Node (ASN), a User Equipment (UE), and a User Equipment (UE). Identification & Location Register (IRR), authentication server, Interworking Service Node (ISN), etc. The ASN is used to access the user terminal, and is responsible for realizing the access of the user terminal, and is responsible for charging and switching functions; the ILR is responsible for the location registration function of the user, and the authentication server assumes the user identity identification and authentication function, the ISN user and the external network. Users are interconnected. Each user terminal has a unique identity identifier, Access Identification (AID).

For convenience of description, the user identity and location separation network is simply referred to as a PI network, where UE1 and UE3 are PI network intranet users, and UE2 is an extranet user. UE3 can receive data packets from UE1 of the P1 intranet and UE2 data packets from the external network. The invention helps the intranet user UE3 to distinguish these different sources and different trusts and process them separately.

In Figure 5, ASN1 and ASN2 are access devices for accessing user terminal devices UE1, UE3, UE1 and UE3 respectively having unique identity identifiers AID1 and AID3. The ISN1 is used to process data packets from users outside the network, such as UE2, to perform format conversion on data packets outside the P1 network.

AS processing

Figure 6 shows the process of adding the source identification type to the packets sent by the intranet users on the ASN of the P1 network:

When the user UE accesses the network, the ASN first authenticates to the authentication server, and after the authentication server passes the authentication, the source identifier type is returned. The ASN saves the source identification type of the user. When the subsequent user sends a data packet, the corresponding IPV6 destination extension header option is added to the message sent by the user.

Step 601: The user terminal UE initiates an access request to the ASN.

Step 602: The ASN initiates an authentication process for the UE to the authentication server.

There may be multiple message interactions between 601 and 602 to authenticate each other.

Step 603: After the authentication is passed, the authentication server returns the source identification type of the user to the ASN. Step 604: The ASN saves the source identification type of the user for subsequent check and use. Step 605, the ASN notifies the UE that the authentication passes, and allows access;

Step 606: The UE starts to send a data packet.

Step 607: The ASN adds the corresponding source address identifier type extension to the IPV6 sent by the UE. In the above steps, 603, 604, 607 are the key steps to implement the source identification type check.

Figure 7 is P1

The method, this figure is equivalent to the refinement of step 607. Users add different destination extension header options to the IPV6 header of the data packets sent by these users:

701. The ASN receives the data packet sent by the intranet user, extracts the source identifier, and then searches for the source identifier type corresponding to the source identifier.

This source identification type is obtained by the ASN from the authentication server.

702-703, if the data "3⁄4 text" comes from ordinary users in the network, assign the source identification type (SIDT) to 0;

704-705, if the data message is from a group user in the network, the source identification type (SIDT) is assigned a value of 1;

706-707, if the data message is from an intranet user, the source identification type (SIDT) is assigned a value of 2;

708-709, if the data "3" is from another type of user, assign the source identification type (SIDT) to XXX (ie, the type not defined by the present invention);

710 sends the data message to the next hop of the destination.

IS processing

FIG. 8 is a schematic diagram of the ISN of the P1 network processing the data originating from the external network and the intranet. In the present invention, the ISN needs to do the following work:

1. Differentiate the source extension of the data packet from the external network, and identify different destination extension header options for the trusted external network peer P network users, the external network heterogeneous trusted users, and the external network untrusted users.

2. For some data packets sent by users in the network to users outside the network, the IPV6 destination extension header option needs to be modified or deleted according to the trusted condition of the external network.

Step 801: The external network user sends a data packet to the ISN.

Step 802: The ISN determines, according to the source of the data packet, whether the source of the packet is a trusted network user of the same type, or a trusted heterogeneous network user, or another network user that is not trusted, in each case, respectively, in the data packet. Add or modify the corresponding destination extension header option;

Step 803: The ISN sends the converted data packet to the ASN, and the ASN forwards the packet to the actual Intranet user;

Text

Step 805, the ISN according to the trusted situation of the network where the destination address is located, or modify the destination extension header option (for a trusted peer network, and a trusted heterogeneous network), or delete the destination extension header option (for untrusted The internet) .

Step 806: The ISN sends the converted data packet to the external network.

E.g:

For the data packets sent by the users in the network to the trusted network of the same type, the source identifier type is changed to 0x80, the DID is set to the network number of the network, and the DUI is set to 0.

For the data packets sent by the users in the network to the trusted heterogeneous network, change the source identifier type to 0x81, set the DID to the network number of the network, and set the DUI to 0.

For the data packets sent by the users in the network to the untrusted external network, the source label i in the IPV6 destination extension header is deleted and only extended.

Detailed flow chart, after receiving the data packet from the external network, the ISN determines whether the source network is a trusted P network network, a trusted heterogeneous network, or an untrusted network, and respectively respectively data from these sources. The source identification type is set to 0x80, 0x81, 0x82, etc.:

The 901 receives the data packet sent by the external network user, and starts the process of adding the source identifier according to the attribute of the source network.

902 - 903, if the data packet is from a similar network user that the external network can trust, set the source identifier type to 0x80;

904 - 905, if the data message is from a trusted heterogeneous network user, set the source identity type to 0x81;

906 - 907, if the data message comes from other untrusted network users, set the source identification type to 0x82; 908-909, if the data message is from other users not defined by the present invention, the source identification type is set to the reserved XX;

910 sends the data packet to the next hop of the destination.

FIG. 10 is a specific application scenario of the present invention, which is an example of classifying processing when different types of information are received by a P1 network user. Since the P1 network has been classified into different sources, the users in the P1 network can clearly know which data packets are from external users, which are from intranet users, and which data packets are available. Trusted, how trustworthy, and then based on these category information, when doing business, take the classification process:

When the source address type is verified and distinguished by the above method, the user terminal in the P network can perform classification processing according to the source identification type when receiving the data packets of the above types of identifiers, for example, for a relatively confidential server. A class terminal can deny users whose source ID is 0x82 (untrusted external network users) to access confidential information. In addition, for some politically sensitive BBS forum servers, you can perform some functional restrictions on Internet cafe users who are not easy to trace, such as allowing only browsing forum content but not allowing new posts to be posted, thus ensuring the order of the BBS forum and avoiding the use of criminals. The BBS Forum publishes malicious information.

Step 1001: The P1 network user receives a data packet, and analyzes the types of users allowed by the service according to the attributes of the user and the confidentiality of the service application. 802-804 is an example of the corresponding policy implementation: Step 1002, when the network user When it is a private network user such as the public security network, it can limit the users of the network to not process any data packets of the external network users. Therefore, only the data packets whose source identification type is 0, 1 can be accepted. When the user of the local network is a group The user can only receive data packets with source ID type 1. The data packets of other Internet cafe users (2) and external network users (0x80 ~ 0x82) will be blocked. Step 1003, when the local network user is a group user For a server, only data packets with source ID type 1 (group user) can be accepted, and messages from other sources are not accepted.

Step 1004: When the user of the local network is a politically sensitive BBS server, the user of the Internet cafe and the user of the external network are only allowed to browse the BBS information, and the BBS information is not allowed to be modified or released to avoid attacks from the external network user. . It should be noted that although the above embodiment uses the network with the identity and location identifier separated by P1 as an example, it is also applicable to other IPV6-based networks, and other IPV6 extension headers provided by the method are used for source identification. A method of distinguishing processing is also within the scope of the present invention.

It is worth noting that in the above embodiments based on the P1 network, the addition and modification of the category information of the source identification type (SIDT) is mainly explained, the trustworthiness (CG) and the domain identifier for tracing ( DID) and Intra-domain User Identifier (DUI) are not described in detail above. It is conceivable that replacing SIDT with CG, or adding CG and/or DID for DTP, DUI can be used as an alternative implementation of the present invention. Does not affect the scope of protection of the present invention.

To achieve the above method, the present invention further provides a network for classifying data data, the network comprising:

The terminal is configured to send and receive data packets, where the packet header of the received data packet carries category information indicating a source category of the packet, and is further configured to receive the received data packet according to the category information in the received data packet. Perform differential processing;

When the terminal performs the difference processing on the received data packet, the method for processing the data packet is determined according to the source type of the packet and the confidentiality of the service application in combination with the attribute of the terminal itself.

The intermediate node is connected to the terminal through the network, and is configured to receive and forward the data packet, and add the category information of the source of the packet to the packet header of the received data packet according to the category of the source of the packet before forwarding. .

The intermediate node may be an access device that implements access by the terminal or an interworking service node (ISN) between the network and the external network.

When the intermediate node is an access device, the network further includes an authentication server connected to the access device, where the server is configured to perform user identification and authentication on the terminal, and notify the category of the terminal in the authentication process. The access device where the terminal is located; the access device adds the corresponding category information to the packet header of the data packet sent by the terminal according to the terminal category obtained from the authentication server.

When the intermediate node is an interworking service node (ISN) between the network and an external network, the ISN include:

The receiving module is configured to receive an external network data packet sent by the external network to the data packet classification processing network, and is further configured to receive the internal network data packet sent by the network packet classification processing network to the other network;

a category information determining module, configured to be connected to the receiving module, configured to determine the category information of the source of the data packet of the external network in the data packet classification processing network; and further configured to determine according to the trusted situation of the external network The source information of the packet of the intranet data packet in the external network;

The data packet conversion module is connected to the category information determining module, and is configured to convert the external network data packet into an intranet data packet, including adding category information or modifying the packet header according to the determined category information. The original category information in the packet header is further used to convert the intranet data packet into an external network data packet, including deleting or modifying the category information in the packet header according to the determined category information;

a data packet forwarding module, configured to be connected to the data packet conversion module, configured to forward and forward the intranet data packet converted by the data packet conversion module in the data packet classification processing network; And transmitting, by the data packet conversion module, the external network data packet to the external network.

The category information is carried by the IPV6 extended header. Preferably, the category information is carried by the Destination Options header of the IPV6 extended header, and the option type of the Destination Options header ( The first two digits of Option Type are 00 or 01, indicating that the destination node does not know the normal part of the data or discards the data packet when it does not recognize this option.

The category information includes a source identifier type (SIDT) determined according to a terminal type and/or a trustworthiness (CG) determined according to a terminal trustworthiness, wherein the source identifier type includes at least one of the following: Trusted users, intranet group users, intranet cafe users, trusted network users of the same network, heterogeneous network users that can be trusted outside the network, and untrusted network users outside the network. Identifier (DID) and/or the intra-domain identifier of the terminal.

In addition, the present invention also provides a terminal, and the specific functions are the same as those described above, and are not traced here. While the preferred embodiments of the present invention have been disclosed for purposes of illustration, those skilled in the art will recognize that various modifications, additions and substitutions are possible, and the scope of the invention should not be limited to the embodiments described above.

One of ordinary skill in the art will appreciate that all or a portion of the steps above may be accomplished by a program to instruct the associated hardware, such as a read-only memory, a magnetic disk, or an optical disk. Alternatively, all or part of the steps of the above embodiments may also be implemented using one or more integrated circuits. Correspondingly, each module/unit in the above embodiment may be implemented in the form of hardware or in the form of a software function module. The invention is not limited to any specific form of combination of hardware and software.

Industrial applicability

The present invention utilizes the category information of the source class of the packet carried in the packet header, so that the terminal that receives the packet can distinguish the user outside the network from the user and/or the trusted user according to the category information in the packet header. For untrusted users, the security of the user and the upper-layer services can be differentiated according to the category, which not only satisfies the interconnection and intercommunication requirements required by the user for common services, but also enables the P-network users to identify untrusted users for corresponding processing. While improving the flexibility of networking, it also ensures the security of the network. For example, for a highly confidential service, only trusted user access is allowed. For a low security level service, users with low trust levels such as an external network can be appropriately accessed.

Claims

Claim

A method for implementing a data packet classification process, the method is characterized in that the method is based on a network for classifying a data packet, and the method includes the terminal processing the received data packet, the processing comprising:

The implementation method of claim 1, wherein the category information in the packet header of the data packet is determined by the intermediate node according to the category of the source of the packet and added to the packet header.

The implementation method of claim 2, wherein the intermediate node is an access device that is responsible for accessing the source end of the packet, and the implementation method further includes the original datagram sent by the access device to the source end of the packet. The processing of the text, the processing includes:

Receiving, by the access device, the original data packet sent by the source end of the packet;

Transmitting, by the access device, the processed data packet;

The implementation method of claim 2, wherein, when the data packet classification processing network communicates with the external network, the intermediate node refers to an interworking service node (ISN) that connects the data packet classification processing network with the external network. The implementation method further includes: processing, by the service node, an external network data packet, where the processing includes:

The ISN receives an external network data packet sent by the external network to the data packet classification processing network; the ISN determines, according to the source of the data packet, the data packet source end in the data packet classification processing network. The category information, and converting the external network data packet into an intranet data packet, including adding category information to the packet header or modifying the original class in the packet header according to the determined category information. No information; and

The ISN forwards the converted intranet data packet to the intranet route.

The method of claim 4, the method further includes: processing, by the ISN, an intranet data packet, where the processing includes:

The implementation method according to any one of claims 1 to 5, wherein the step of performing differentiating processing on the received data packet by the terminal includes: according to the source end category of the packet, combined with the The terminal's own attribute determines the processing method of the data packet based on the confidentiality of the service application.

The implementation method according to any one of claims 1 to 5, wherein the data message classification processing network is an Internet network or an identity and location separation network (SILSN).

The implementation method according to any one of claims 1 to 5, wherein the category information is carried by an IPV6 extension header.

The implementation method according to any one of claims 1 to 5, wherein the category information is carried by a destination option header of an IP V6 extension header, the destination option header ( The first two digits of the Option Type of the Destination Options header are 00 or 01, indicating that the destination node does not know the option to process the rest of the data packet or discard the data packet.

The implementation method according to any one of claims 1 to 5, wherein the category information includes a source identification type (SIDT) determined according to a terminal type and/or a trust degree determined according to a terminal trustworthiness ( CG ) , wherein the source identification type includes: a trusted user in the network, a group user in the network, an internet cafe user in the network, a similar network user trusted outside the network, a heterogeneous network user trusted outside the network, or an untrusted network outside the network. Internet users.

The method according to claim 10, wherein the header of the data packet further includes a domain identifier (DID) determined according to a domain where the terminal is located and/or an intra-domain identifier of the terminal.

12. A terminal, wherein the terminal is implemented based on a communication network, where the terminal comprises:

The terminal according to claim 12, wherein the data packet processing module is configured to: determine, according to the source category of the packet, combined with the attribute of the terminal, the confidentiality of the service application, The processing method of data packets.

The terminal according to claim 12, wherein the category information is carried by an IPV6 extended message header.

The terminal according to claim 12, wherein the category information is carried by a destination option header of an IPV6 extended packet header, and the first two digits of the option type of the destination option header are 00 or 01, indicating a purpose When the node does not recognize this option, it processes the rest of the data packet or discards the data packet.

The terminal according to claim 12, wherein the category information includes a source identification type (SIDT) determined according to a terminal type and/or a trust degree (CG) determined according to a terminal trustworthiness, wherein the source The identification types include: Trusted users in the network, group users in the network, Internet cafe users in the network, trusted network users who are trusted outside the network, heterogeneous network users that can be trusted outside the network, or untrusted network users outside the network.

17. A network >3⁄4 text classification processing network, the network comprising:

The terminal is configured to: send and receive data packets, where the received data packets are carried in the packet header And indicating category information of the source category of the packet; and distinguishing the received data packet according to the category information in the received data packet;

The network of claim 17, wherein the intermediate node is an access device that implements the terminal access, and the network further includes an authentication server that is connected to the access device;

The server is configured to: perform user identification and authentication on the terminal, and notify the access device where the terminal is located in the authentication process;

The access device is configured to add the corresponding category information to a packet header of a data packet sent by the terminal according to a terminal category acquired from the authentication server.

The network of claim 17, wherein the intermediate node is an interworking service node (ISN) between the network and an external network, and the ISN includes:

20. The network of claim 19, wherein:

The receiving module of the ISN is further configured to: receive an intranet data packet sent by the network packet classification processing network to another network;

The category information determining module of the ISN is further configured to: determine according to the trust situation of the external network The source information of the packet of the intranet data packet in the external network;

The network according to any one of claims 17 to 20, wherein the terminal is configured to perform differentiating processing on the received data packet in the following manner: according to the source type of the packet, and The processing manner of the data packet is determined according to the confidentiality of the service application in combination with the attribute of the terminal itself.

The network according to any one of claims 17 to 20, wherein the category information is carried by an IPV6 extended packet header.

The network according to any one of claims 17 to 20, wherein the category information is carried by a destination option header of an IPV6 extended header, and the first two digits of the option type of the destination option header are 00 Or 01 indicates that the destination node does not know the option to process the rest of the data packet or discard the data packet.

The network according to any one of claims 17 to 20, wherein the category information includes a source identification type (SIDT) determined according to a terminal type and/or a trustworthiness determined according to a terminal trustworthiness (CG) The source identification type includes: a trusted user in the network, a group user in the network, an Internet cafe user in the network, a similar network user that can be trusted outside the network, a heterogeneous network user that is trusted outside the network, or an untrusted network outside the network. user.

The network according to any one of claims 17 to 20, wherein the header of the data packet further includes a domain identifier (DID) determined according to a domain in which the terminal is located and/or an intra-domain identifier of the terminal. .