CN115766290A - Message forwarding method, device and network equipment - Google Patents

Abstract

The invention relates to the technical field of communication, and provides a message forwarding method, a message forwarding device and network equipment. The device comprises a transceiving module, an analysis module, an encryption and decryption module and a DMA (direct memory access) which are connected through a bus; the receiving and sending module identifies the received message, if the message is identified to be a plaintext, the message to be encrypted is marked to obtain a message to be encrypted, the message to be encrypted is sent to the DMA through the analysis module to be stored in the storage module, so that the CPU packages the message to be encrypted to obtain a packaged message, obtains a target encryption index value according to the packaged message, and sends the target encryption index value to the encryption and decryption module through the DMA; the encryption and decryption module obtains the target encryption parameter according to the target encryption index value, encrypts and authenticates the packaged message to obtain an encrypted message, and then forwards the encrypted message through the transceiving module. The encryption and decryption module is arranged between the transceiving module and the DMA, so that interaction with the CPU is reduced to one time, channel following processing is realized, resources are saved, and time delay is reduced through hardware encryption.

Description

Message forwarding method, device and network equipment

technical field

The present invention relates to the technical field of communication, and specifically relates to a message forwarding method, device 5 and network equipment.

Background technique

With the advent of the era of big data, the security requirements for communication data transmission are also getting higher and higher. At present, the communication data is generally encrypted and decrypted by pure software, but this will cause

Larger delay. Although there are also hardware encryption and decryption methods, due to the need for multiple 0 interactions with the CPU, it often takes up too many resources and causes a large CPU consumption.

Contents of the invention

In view of this, the object of the present invention is to provide a message forwarding method, device and network equipment.

In order to achieve the above object, the technical solution adopted by the present invention is as follows: 5. In the first aspect, the present invention provides a message forwarding method, which is applied to a message forwarding device of a network device, and the device includes a transceiver module connected through a bus, an analysis module, an encryption and decryption module, and a DMA, the DMA communicates with the CPU and the storage module in the network device, and the CPU communicates with the storage module; the method includes:

The transceiver module identifies the received message, if it recognizes that the message is plaintext, 0 then marks the message to be encrypted and obtains the message to be encrypted and sends it to the parsing module;

The parsing module sends the message to be encrypted to the DMA;

The DMA stores the message to be encrypted in the storage module, so that the CPU obtains the message to be encrypted from the storage module, and performs an encapsulation operation on the message to be encrypted to obtain an encapsulated After the message and the target encrypted index value are obtained according to the encapsulated message, store the encapsulated message in the storage module and send the target encrypted index value to the DMA;

The DMA sends the target encryption index value and the encapsulated message obtained from the storage module to the encryption and decryption module;

The encryption and decryption module obtains a target encryption parameter according to the target encryption index value, and performs an encryption operation and an authentication operation on the encapsulated message according to the target encryption parameter to obtain an encrypted message, and sends the encrypted message to Send the text to the transceiver module;

The transceiver module forwards the encrypted message.

In an optional embodiment, the CPU stores a plaintext feature table and a plaintext index table, the plaintext feature table includes a plurality of plaintext feature values and their corresponding plaintext index values; the plaintext index table includes each of the The encrypted index value and encapsulation rules corresponding to the plaintext index value;

The CPU performs an encapsulation operation on the message to be encrypted to obtain an encapsulated message and obtains a target encryption index value according to the encapsulated message, including:

Extracting the plaintext feature value of the message to be encrypted, and obtaining an initial plaintext index value corresponding to the plaintext feature value of the message to be encrypted according to the plaintext feature table;

Obtaining a target encapsulation rule corresponding to the initial plaintext index value according to the plaintext index table;

Encapsulating the message to be encrypted according to the target encapsulation rule to obtain the encapsulated message;

Extracting the plaintext feature value of the encapsulated message, and obtaining a target plaintext index value corresponding to the plaintext feature value of the encapsulated message according to the plaintext feature table;

Obtain a target encrypted index value corresponding to the target plaintext index value according to the plaintext index table.

In an optional implementation, the encryption and decryption module includes a plurality of encryption storage blocks storing encryption parameters, and the address of one encryption storage block corresponds to one encryption index value;

The encryption and decryption module obtains target encryption parameters according to the target encryption index value, including:

Determining a target encrypted storage block in all encrypted storage blocks, the address of the target encrypted storage block corresponds to the target encrypted index value;

Obtain the encryption parameters in the target encrypted storage block to obtain the target encryption parameters.

In an optional implementation manner, after the transceiver module identifies the received message, the method further includes:

If it is recognized that the message is a ciphertext, mark the message to be decrypted with an identifier to obtain the message to be decrypted, and extract the ciphertext feature value of the message to be decrypted and the ciphertext of the message to be decrypted. After obtaining the target decryption index information by the text feature value, sending the target decryption index information and the message to be decrypted to the parsing module;

The analysis module analyzes the target decryption index information to obtain a target decryption index value, and sends the target decryption index value and the message to be decrypted to the encryption and decryption module;

The encryption and decryption module obtains target decryption parameters according to the target decryption index value, and performs authentication and decryption operations on the message to be decrypted according to the target decryption parameter to obtain a decrypted message, and then sends the decrypted message to send the text to the DMA;

The DMA stores the decrypted message in the storage module, so that the CPU obtains the decrypted message from the storage module, and edits the decrypted message to obtain the edited message , storing the edited message in the storage module;

The DMA sends the edited message obtained from the storage module to the transceiver module;

The transceiver module forwards the edited message.

In an optional implementation, the transceiver module stores a ciphertext feature table, the ciphertext feature table includes a plurality of ciphertext feature values and their corresponding ciphertext index values, and the transceiver module includes a plurality of ciphertext feature values stored in Decrypt the storage block of the index information, the address of one storage block corresponds to one of the ciphertext index values;

The transceiver module obtains target decryption index information according to the ciphertext feature value of the message to be decrypted, including:

Obtaining a target ciphertext index value corresponding to the ciphertext feature value of the message to be decrypted according to the ciphertext feature table;

Determining a target storage block in all storage blocks, the address of the target storage block corresponds to the target ciphertext index value;

Obtain decryption index information in the target storage block to obtain the target decryption index information.

In an optional implementation manner, the encryption and decryption module includes a plurality of decryption storage blocks storing decryption parameters, and the address of one decryption storage block corresponds to one decryption index value;

The step of obtaining the target decryption parameter according to the target decryption index value by the encryption and decryption module includes:

Determining a target decrypted storage block in all decrypted storage blocks, the address of the target decrypted storage block corresponds to the target decrypted index value;

Obtain the decryption parameters in the target decryption storage block to obtain the target decryption parameters.

In an optional implementation manner, the transceiver module identifies the received message, including:

Identify the received message;

If it is identified that the message has a preset plaintext feature, then the message is identified as plaintext; wherein the plaintext feature includes network protocol type, source IP address, destination IP address, source port number and destination port number ;

If it is identified that the message has a preset ciphertext feature, then identify the message as ciphertext; wherein the ciphertext feature includes a network protocol type, a destination port number, and an encryption protocol type.

In a second aspect, the present invention provides a message forwarding device, which includes a transceiver module, an analysis module, an encryption and decryption module, and a DMA connected through a bus, and the DMA communicates with a CPU and a storage module in a network device. The CPU is communicatively connected to the storage module;

The transceiver module is used to identify the received message, if it is recognized that the message is plain text, then mark the message to be encrypted to obtain the message to be encrypted and send it to the parsing module;

The parsing module is used to send the message to be encrypted to the DMA;

The DMA is used to store the message to be encrypted in the storage module, so that the CPU obtains the message to be encrypted from the storage module, and obtains a target encryption index value according to the message to be encrypted and after encapsulating the message to be encrypted to obtain the packaged message, storing the packaged message in the storage module and sending the target encryption index value to the DMA;

The DMA is used to send the target encryption index value and the encapsulated message obtained from the storage module to the encryption and decryption module;

The encryption and decryption module is used to obtain a target encryption parameter according to the target encryption index value, and perform an encryption operation and an authentication operation on the encapsulated message according to the target encryption parameter to obtain the encrypted message, and convert the encrypted message The encrypted message is sent to the transceiver module;

The transceiver module is used to forward the encrypted message.

In an optional implementation manner, the transceiver module is also used for:

Identify the received message;

If it is identified that the message has a preset plaintext feature, then the message is identified as plaintext; wherein the plaintext feature includes network protocol type, source IP address, destination IP address, source port number and destination port number ;

If it is identified that the message has a preset ciphertext feature, then identify the message as ciphertext; wherein the ciphertext feature includes a network protocol type, a destination port number, and an encryption protocol type.

In a third aspect, the present invention provides a network device, including a communication-connected CPU and a storage module, and the message forwarding device described in any one of the preceding embodiments, the CPU and the storage module are both connected to the message DMA communication connection in the text forwarding device.

In the message forwarding method, device and network equipment provided by the present invention, the message forwarding device includes a transceiver module, an analysis module, an encryption and decryption module and a DMA connected by a bus, and the DMA communicates with the CPU and the storage module in the network equipment, and the CPU communicates with the storage module. The storage module is connected by communication; the transceiver module identifies the received message, and if it recognizes that the message is plain text, it marks the message to be encrypted to obtain the message to be encrypted and sends it to the DMA through the parsing module; the DMA will The message is stored in the storage module, so that the CPU obtains the message to be encrypted from the storage module, and performs encapsulation operation on the message to be encrypted to obtain the packaged message and obtains the target encryption index value according to the packaged message, and then converts the packaged message to Store in the storage module to send the target encryption index value and the encapsulated message to the encryption and decryption module through DMA; the encryption and decryption module obtains the target encryption parameter according to the target encryption index value, and performs an encryption operation on the encapsulated message according to the target encryption parameter After obtaining the encrypted message through the authentication and authentication operations, the encrypted message is sent to the transceiver module for forwarding. Connect the transceiver module, encryption and decryption module and DMA through the bus to set the encryption and decryption module between the transceiver module and the DMA, and realize the communication interaction between the CPU and the encryption and decryption module through the DMA, so as to reduce the number of interactions with the CPU to one , which realizes road-associated processing and saves CPU resources. At the same time, the encryption and decryption module is used to encrypt the message in hardware, which reduces the delay and improves the processing efficiency.

In order to make the above-mentioned objects, features and advantages of the present invention more comprehensible, preferred embodiments will be described in detail below together with the accompanying drawings.

Description of drawings

In order to illustrate the technical solutions of the embodiments of the present invention more clearly, the accompanying drawings used in the embodiments will be briefly introduced below. It should be understood that the following drawings only show some embodiments of the present invention, and thus It should be regarded as a limitation on the scope, and those skilled in the art can also obtain other related drawings based on these drawings without creative work.

Fig. 1 shows an example diagram of a message forwarding method in the prior art;

FIG. 2 shows an example diagram of another message forwarding method in the prior art;

FIG. 3 shows a schematic block diagram of a network device provided by an embodiment of the present invention;

FIG. 4 shows a schematic flowchart of a message forwarding method provided by an embodiment of the present invention;

FIG. 5 shows an example diagram of a message forwarding method provided by an embodiment of the present invention;

FIG. 6 shows another schematic flow chart of a message forwarding method provided by an embodiment of the present invention;

FIG. 7 shows another example diagram of the packet forwarding method provided by the embodiment of the present invention.

Icons: 10-message forwarding device; 20-CPU; 30-storage module; 110-bus; 120-transceiving module; 130-analysis module; 150-encryption and decryption module; 170-DMA.

Detailed ways

The following will clearly and completely describe the technical solutions in the embodiments of the present invention with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only some, not all, embodiments of the present invention. The components of the embodiments of the invention generally described and illustrated in the figures herein may be arranged and designed in a variety of different configurations.

Accordingly, the following detailed description of the embodiments of the invention provided in the accompanying drawings is not intended to limit the scope of the claimed invention, but merely represents selected embodiments of the invention. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without making creative efforts belong to the protection scope of the present invention.

It should be noted that relative terms such as the terms "first" and "second" are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any relationship between these entities or operations. There is no such actual relationship or order between them. Furthermore, the term "comprises", "comprises" or any other variation thereof is intended to cover a non-exclusive inclusion such that a process, method, article, or apparatus comprising a set of elements includes not only those elements, but also includes elements not expressly listed. other elements of or also include elements inherent in such a process, method, article, or device. Without further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article or apparatus comprising said element.

With the advent of the era of big data, the security requirements for communication data transmission are also getting higher and higher. As shown in Figure 1, it is an example diagram of encryption during message forwarding by pure software at present, that is, the transceiver module sends the received plaintext message to DMA (Direct Memory Access, direct memory access module), and then DMA Send the plaintext message to the CPU, the CPU encrypts the plaintext message through software to obtain a ciphertext message, and sends the ciphertext message to the transceiver module through DMA for forwarding through the transceiver module, but this pure software encryption The decryption method will generate a large delay, and since the encryption and decryption are all performed by the CPU, it will consume too much CPU resources.

As shown in Figure 2, it is an example diagram of encryption during message forwarding by hardware, that is, the transceiver module sends the received plaintext message to the first DMA, and then the first DMA sends the plaintext message to To the CPU, the CPU sends the plaintext message to the encryption and decryption module through the second DMA, and the encryption and decryption module encrypts the plaintext message through each hardware component to obtain the ciphertext message, and sends the ciphertext message through the second DMA To the CPU, the CPU sends the ciphertext message to the transceiver module through the first DMA, so as to be forwarded by the transceiver module. It can be seen that this method will interact with the CPU twice, which will occupy too many resources and cause a large CPU consumption. That is to say, the current encryption and decryption method in the message forwarding process has the problems of high delay and excessive CPU resource occupation. Furthermore, the embodiment of the present invention provides a message forwarding method to solve the above problems.

Please refer to FIG. 3 , which is a schematic block diagram of a network device provided by an embodiment of the present invention. The network device includes a packet forwarding device 10 , a CPU 20 and a storage module 30 . The message forwarding device 10 includes a transceiver module 120 , an analysis module 130 , an encryption and decryption module 150 and a DMA170 connected through a bus 110 .

The transceiver module 120 is used for receiving and forwarding messages. The parsing module 130 can parse out part of the information in the message. The encryption and decryption module 150 is used to encrypt and decrypt messages. The DMA170 communicates with the CPU20 and the storage module 30 , and is used to implement data transmission between the message forwarding device 10 and the CPU20 .

The CPU 20 is an integrated circuit chip, which has signal processing capabilities and can perform operations such as encapsulation and editing of messages. The storage module 30 may be DDR (Double Data Rate, double-rate synchronous dynamic random access memory), or SRAM (Static Random-Access Memory, static random access memory).

It can be understood that the structure shown in FIG. 3 is only a schematic structural diagram of a network device, and the network device may include more or less components than those shown in FIG. 3 , or have a configuration different from that shown in FIG. 3 . Each component shown in FIG. 3 may be implemented by hardware, software or a combination thereof.

The network device provided in the embodiment of the present invention is a dedicated hardware device used to form an information communication network, which may be a router, a switch, etc., which is not limited in the embodiment of the present invention.

In the following, the above-mentioned message forwarding device 10 will be used as an execution subject to execute each step in each method provided by the embodiment of the present invention, and achieve corresponding technical effects.

Please refer to FIG. 4 . FIG. 4 is a schematic flowchart of a message forwarding method provided by an embodiment of the present invention.

Step S202, the transceiver module identifies the received message, if the message is recognized as plain text, then marks the message to be encrypted to obtain the message to be encrypted and sends it to the parsing module;

Step S204, the parsing module sends the message to be encrypted to the DMA;

In this embodiment, the identifier to be encrypted can be understood as a label used to indicate that the message needs to be encrypted. The identifier to be encrypted can be set according to the actual application, which is not limited in this embodiment of the present invention.

The network device receives the message sent by other devices through the transceiver module 120, and the transceiver module 120 identifies the received message to determine whether it is plain text or cipher text. If the transceiver module 120 recognizes that the received message is plain text, it marks the message to be encrypted to mark that the message needs to be encrypted, that is, obtains the message to be encrypted and sends it to the parsing module 130 .

The parsing module 130 receives the message to be encrypted, and then analyzes part of the key information of the message to be encrypted to obtain information such as the receiving time stamp, receiving port information, message type, namely flowid, and then converts the message to be encrypted and part of the key information Send to DMA170.

Step S206, DMA stores the message to be encrypted in the storage module, so that the CPU obtains the message to be encrypted from the storage module, and performs encapsulation operation on the message to be encrypted to obtain the encapsulated message and obtains the target encryption index value according to the encapsulated message After that, store the encapsulated message to the storage module and send the target encryption index value to the DMA;

Step S208, the DMA sends the target encryption index value and the encapsulated message obtained from the storage module 30 to the encryption and decryption module;

In this embodiment, DMA170 includes receiving channel RX and transmitting channel TX, and both have ring buffer ring buffer, the ring buffer of receiving channel can be represented by RX Ring, the ring buffer of transmitting channel can be represented by TX Ring . Each pointer in the RX Ring points to each RX direction descriptor, and each pointer in the TX Ring points to each TX direction descriptor. The descriptor Packet Descriptor is used to express the status of the message, which is a hardware-related data structure.

The storage module 30 includes a cache unit such as a Packet Buffer for caching packets. The DMA170 stores the received message to be encrypted into the Packet Buffer in the storage module 30, and uses a descriptor in the RX direction to record the state of the message to be encrypted. For example, the RX direction descriptor records information such as receiving time stamp, receiving port information, packet type, address of the packet to be encrypted in the storage space, and the like.

Then, the CPU 20 obtains the message to be encrypted from the storage module 30 through the address in the RX direction descriptor, and performs an encapsulation operation on the message to be encrypted to obtain the encapsulated message, and then obtains the target encryption index value according to the encapsulated message, and then Store the encapsulated message in the storage module 30, and update the address and target encryption index value of the encapsulated message in the storage module 30 into the TX direction descriptor.

DMA170 obtains the target encryption index value through the TX direction descriptor, and obtains the encapsulated message from the storage module 30 according to the address in the TX direction descriptor, and then sends the encapsulated message and the target encryption index value to the encryption and decryption module 150 .

Step S210, the encryption and decryption module obtains the target encryption parameter according to the target encryption index value, and performs encryption and authentication operations on the encapsulated message according to the target encryption parameter to obtain the encrypted message, and then sends the encrypted message to the transceiver module;

Step S212, the transceiver module forwards the encrypted message;

In this embodiment, the encryption and decryption module 150 obtains the target encryption parameter according to the received target encryption index value, and performs encryption and authentication operations on the encapsulated message according to the target encryption parameter to obtain the encrypted message, and then encrypts the encrypted message The message is sent to the transceiver module 120, so that the encrypted message is forwarded to other devices through the transceiver module 120.

It should be understood that the encryption and decryption module 150 can only perform encryption operations on the message, or only perform authentication operations, or perform encryption operations before performing authentication operations, or perform authentication operations before performing encryption operations, or do not perform any operations. . That is, the operations performed by the encryption and decryption module 150 may be set according to actual applications, which is not limited in this embodiment of the present invention.

It can be seen that the transceiver module, the encryption and decryption module and the DMA are connected through the bus so that the encryption and decryption module is set between the transceiver module and the DMA, and the communication interaction between the CPU and the encryption and decryption module is realized through the DMA, so that the message can be processed The encryption process only needs to interact with the CPU once, thereby reducing the number of interactions and saving CPU resources, and realizing on-road encryption processing. At the same time, the hardware encryption method is adopted through the encryption and decryption module, which reduces the delay and improves the processing efficiency.

It can be seen that based on the above steps, the message forwarding device includes a transceiver module, an analysis module, an encryption and decryption module and a DMA connected by the bus, and the DMA communicates with the CPU and the storage module in the network equipment, and the CPU communicates with the storage module; If it is recognized that the message is plaintext, then the message is marked to be encrypted to obtain the message to be encrypted and sent to the DMA through the parsing module; the DMA stores the message to be encrypted to the storage module, so that The CPU obtains the message to be encrypted from the storage module, and encapsulates the message to be encrypted to obtain the packaged message and obtains the target encryption index value according to the packaged message, then stores the packaged message to the storage module, so that the The target encryption index value and the encapsulated message are sent to the encryption and decryption module; the encryption and decryption module obtains the target encryption parameter according to the target encryption index value, and performs encryption and authentication operations on the encapsulated message according to the target encryption parameter to obtain the encrypted message , and send the encrypted message to the transceiver module for forwarding. Connect the transceiver module, encryption and decryption module and DMA through the bus to set the encryption and decryption module between the transceiver module and the DMA, and realize the communication interaction between the CPU and the encryption and decryption module through the DMA, so as to reduce the number of interactions with the CPU to one , which realizes road-associated processing and saves CPU resources. At the same time, the encryption and decryption module is used to encrypt the message in hardware, which reduces the delay and improves the processing efficiency.

Optionally, for the process of identifying the received message by the transceiver module in step 202 above, this embodiment of the present invention provides a possible implementation, namely:

Identify the received message; if it recognizes that the message has preset plaintext features, then identify the message as plaintext; where the plaintext features include network protocol type, source IP address, destination IP address, source port number and Destination port number; if it is identified that the message has a preset ciphertext feature, the message is identified as ciphertext; wherein, the ciphertext feature includes a network protocol type, a destination port number, and an encryption protocol type.

In this embodiment, both the plaintext feature and the ciphertext feature are preset. The plaintext feature may be network protocol type, source IP address, destination IP address, source port number, and destination port number, that is, the plaintext feature may be 5-tuple information of the packet.

The ciphertext feature can be represented by network protocol type such as ipProtocol[7:0], destination port number such as represented by 14DestPort[15:0] and encryption protocol type such as represented by spi[31:0]. It should be understood that both the plaintext feature and the ciphertext feature can be set according to actual applications, which are not limited in this embodiment of the present invention.

The transceiver module 120 parses the received message through hardware parsing, and then identifies the message. If it is identified that the message has plaintext features, that is, network protocol type, source IP address, destination IP address, source port number, and destination port number, the message will be identified as plaintext, so that the message can be encrypted in accordance with the encryption process. . If it is identified that the message has ciphertext characteristics, that is, network protocol type, destination port number, and encryption protocol type, the message is identified as ciphertext, so that the message can be decrypted according to the decryption process.

Optionally, the embodiment of the present invention provides a possible implementation for the process of the CPU performing an encapsulation operation on the to-be-encrypted message to obtain the encapsulated message and obtaining the target encryption index value according to the encapsulated message, namely:

Extract the plaintext feature value of the message to be encrypted, and obtain the initial plaintext index value corresponding to the plaintext feature value of the message to be encrypted according to the plaintext feature table; obtain the target encapsulation rule corresponding to the initial plaintext index value according to the plaintext index table; according to the target Encapsulation rules Encapsulate the encrypted message to obtain the encapsulated message; extract the plaintext feature value of the encapsulated message, and obtain the target plaintext index value corresponding to the plaintext feature value of the encapsulated message according to the plaintext feature table; according to the plaintext The index table obtains the target encrypted index value corresponding to the target plaintext index value.

In this embodiment, the CPU 20 stores a plaintext feature table and a plaintext index table, the plaintext feature table includes a plurality of plaintext feature values and their corresponding plaintext index values; the plaintext index table includes an encrypted index value and a package corresponding to each plaintext index value rule. Wherein, the plaintext feature value is the value of the plaintext feature, and the encapsulation rules include security policies, encapsulation policies, and the like. It should be understood that the plaintext feature value, plaintext index value, encrypted index value, and encapsulation rule may be set according to actual applications, which are not limited in this embodiment of the present invention.

After the CPU 20 obtains the message to be encrypted from the storage module 30, it is parsed to extract the plaintext feature value of the message to be encrypted, that is, the five-tuple information value, and obtains the plaintext feature of the message to be encrypted in the plaintext feature table. value corresponding to the plaintext index value, that is, get the initial plaintext index value such as adindex1; then obtain the encapsulation rule corresponding to the initial plaintext index value adindex1 in the plaintext index table, that is, obtain the target encapsulation rule such as rule1; and then treat encryption according to the target encapsulation rule rule1 The packet is encapsulated, such as encapsulating the inner layer route of the encrypted packet, adding the Tunnel header and adding the check value icv of all 0s, etc., to obtain the encapsulated packet.

Then extract the plaintext feature value of the encapsulated message, that is, the quintuple information value, and obtain the plaintext index value corresponding to the plaintext feature value of the encapsulated message in the plaintext feature table, that is, obtain the target plaintext index value such as adindex1'; finally Obtain the encrypted index value corresponding to the target plaintext index value adindex1' in the plaintext index table, that is, obtain the target encrypted index value such as saindex1.

Optionally, for the process of obtaining the target encryption parameter by the encryption and decryption module according to the target encryption index value in the above step S210, this embodiment of the present invention provides a possible implementation, namely:

The target encrypted storage block is determined in all the encrypted storage blocks, the address of the target encrypted storage block corresponds to the target encrypted index value; the encryption parameters in the target encrypted storage block are obtained to obtain the target encrypted parameters.

In this embodiment, the encryption and decryption module 150 includes a storage unit such as an SRAM, and the SRAM includes a plurality of encrypted storage blocks that store encryption parameters. The address of an encrypted storage block corresponds to an encrypted index value, and a first address table such as SRAM1 can be used. The table records the mapping relationship between the address of each encrypted storage block and each encrypted index value.

After the encryption and decryption module 150 receives the encapsulated message and the target encryption index value, it determines the first target address corresponding to the target encryption index value according to the SRAM1 table, and determines the point it points to in all encrypted storage blocks according to the first target address The encrypted storage block, that is, the target encrypted storage block is determined.

Then, obtain the encryption parameters in the target encryption storage block, that is, obtain the target encryption parameters, and perform encryption and authentication operations on the encapsulated message based on the target encryption parameters, such as based on the target encryption parameters and the length of the encrypted message, get The length of the encrypted content and the length of the authenticated content are encrypted and authenticated according to the preset encryption algorithm and authentication algorithm, and then the check value obtained by the authentication operation is used to replace the check value of all 0s generated by the above CPU20, and the encrypted message.

For ease of understanding, the embodiment of the present invention provides an example diagram, please refer to FIG. 5 , and the process of encrypting a message will be described below in conjunction with FIG. 5 .

The transceiver module 120 identifies the received message, recognizes that the message has a plaintext feature, that is, quintuple information, is about to identify the message as plaintext, then marks the message to be encrypted to obtain the message to be encrypted and sends it to the analysis module 130.

The parsing module 130 sends part of the key information obtained by parsing and the message to be encrypted to the DMA170.

The DMA170 stores the received message to be encrypted in the cache unit in the storage module 30 , and uses the RX direction descriptor to record the state of the message to be encrypted, including the address of the message to be encrypted in the storage module 30 .

The CPU 20 obtains the message to be encrypted from the storage module 30 through the address in the RX direction descriptor and extracts its plaintext feature value; then obtains the target encapsulation rule according to the plaintext feature table and the plaintext index table, and treats the encrypted message according to the target encapsulation rule After performing the encapsulation operation to obtain the encapsulated message and obtaining the target encryption index value according to the encapsulated message, the encapsulated message is stored in the cache unit of the storage module 30; then the target encryption index value and the packaged message are stored in the storage module 30 The address in the package, the length of the encapsulated message, the forwarding exit information of the encapsulated message, the start flag and the end flag of the encapsulated message and other information are updated to the TX direction descriptor.

According to the TX direction descriptor, the DMA170 transcodes and parses the information therein to obtain the target encryption index value and the address of the encapsulated message in the storage module 30, and obtains the encapsulated message from the storage module 30 according to this address; then The target encryption index value and the encapsulated message are sent to the encryption and decryption module 150 .

The encryption and decryption module 150 obtains the target encryption parameter from the corresponding target encryption storage block according to the target encryption index value and the first address table, and performs encryption and authentication operations on the encapsulated message according to the target encryption parameter to obtain the encrypted message , and then send it to the transceiver module 120 to forward the encrypted message through the transceiver module 120.

Optionally, in the case that the transceiver module recognizes the received message as ciphertext, this embodiment of the present invention provides an implementation manner of decrypting the message, please refer to FIG. 6 .

Step S214, if it is identified that the message is ciphertext, mark the message to be decrypted to obtain the message to be decrypted, and extract the ciphertext feature value of the message to be decrypted and obtain the target according to the ciphertext feature value of the message to be decrypted After decrypting the index information, send the target decryption index information and the message to be decrypted to the analysis module;

Step S216, the analysis module analyzes the target decryption index information to obtain the target decryption index value, and sends the target decryption index value and the message to be decrypted to the encryption and decryption module;

In this embodiment, the identifier to be encrypted can be understood as a label used to indicate that the message needs to be decrypted. The identifier to be decrypted can be set according to the actual application, which is not limited in this embodiment of the present invention.

If the transceiver module 120 recognizes that the received message is a ciphertext, the message is marked with an identifier to be decrypted to mark that the message needs to be decrypted to obtain a message to be decrypted, and the ciphertext feature value of the message to be decrypted is extracted based on The target decryption index information is obtained from the ciphertext feature value, and then the target decryption index information and the message to be decrypted are sent to the parsing module 130 .

After receiving the target decryption index information and the message to be decrypted, the parsing module 130 analyzes the target decryption index information to obtain the target decryption index value, and analyzes some key information of the message to be decrypted to obtain the receiving time stamp, receiving port information, information such as message type and message length, and then send the target decryption index value, the message to be encrypted and these key information to the encryption and decryption module 150.

Step S218, the encryption and decryption module obtains the target decryption parameter according to the target decryption index value, and performs authentication and decryption operations on the message to be decrypted according to the target decryption parameter to obtain the decrypted message, and then sends the decrypted message to the DMA;

In this embodiment, the encryption and decryption module 150 obtains the target decryption parameter according to the received target decryption index value, and performs authentication and decryption operations on the message to be decrypted according to the target decryption parameter, and then sends the decrypted message to the DMA170.

It should be understood that the encryption and decryption module 150 can only perform decryption operations on the message, or only perform authentication operations, or perform decryption operations first and then perform authentication operations, or perform authentication operations before performing decryption operations, or do not perform any operations. . That is, the operations performed by the encryption and decryption module 150 may be set according to actual applications, which is not limited in this embodiment of the present invention.

Step S220, the DMA stores the decrypted message in the storage module, so that the CPU obtains the decrypted message from the storage module, and performs an editing operation on the decrypted message to obtain the edited message, and then stores the edited message in the storage module module;

Step S222, the DMA sends the edited message obtained from the storage module to the transceiver module;

Step S224, the transceiver module forwards the edited message;

In this embodiment, the DMA 170 stores the received decrypted message into the cache unit in the storage module 30, and uses an RX direction descriptor to record the status of the decrypted message. For example, the descriptor records information such as receiving time stamp, receiving port information, message type, address of the decrypted message in the storage module 30, whether the decryption is successful, and whether the check is passed.

Then, the CPU 20 acquires the decrypted message from the storage module 30 through the address in the RX direction descriptor and parses it, then edits it according to the preset editing strategy to obtain the edited message, and then sends the edited message to The text is stored in the storage module, and the address of the edited message in the storage module 30 is updated in the TX direction descriptor. The DMA170 obtains the edited message from the storage module 30 through the address in the TX direction descriptor and sends it to the transceiver module 120, so that the encrypted message can be forwarded to other devices through the transceiver module 120.

Optionally, for the process of obtaining the target decryption index information by the transceiver module according to the ciphertext feature value of the message to be decrypted in the above step S214, the embodiment of the present invention provides a possible implementation, namely:

Obtain the target ciphertext index value corresponding to the ciphertext feature value of the message to be decrypted according to the ciphertext feature table; determine the target storage block in all storage blocks, and the address of the target storage block corresponds to the target ciphertext index value; obtain the target storage block The decryption index information in the block is obtained to obtain the target decryption index information.

In this embodiment, the transceiver module 120 stores a ciphertext feature table, the ciphertext feature table includes a plurality of ciphertext feature values and their corresponding ciphertext index values, and the transceiver module 120 includes a plurality of storage blocks storing decryption index information , the address of a storage block corresponds to a ciphertext index value, and an address table such as an AD table can be used to record the mapping relationship between the address of each storage block and each ciphertext index value. It should be understood that the ciphertext feature value and the ciphertext index value may be set according to actual applications, which are not limited in this embodiment of the present invention.

After the transceiver module 120 extracts the ciphertext feature value of the message to be decrypted, that is, the value of the network protocol type, the destination port number and the encryption protocol type, the ciphertext corresponding to the ciphertext feature value of the message to be decrypted is obtained in the ciphertext feature table Index value, that is, obtain the target ciphertext index value such as adindex2, and determine the target address corresponding to the target ciphertext index value adindex2 according to the AD table, and then determine the storage block it points to in all storage blocks according to the target address, that is, determine output the target storage block; then obtain the decryption index information in the target storage block, that is, obtain the target decryption index information.

Optionally, for the process of obtaining the target decryption parameters by the encryption and decryption module in S218 according to the received target decryption index value, this embodiment of the present invention provides a possible implementation, namely:

Determining the target decryption storage block in all the decryption storage blocks, the address of the target decryption storage block corresponds to the target decryption index value; obtaining the decryption parameters in the target decryption storage block to obtain the target decryption parameters.

In this embodiment, the encryption and decryption module 150 includes a storage unit such as an SRAM, and the SRAM includes a plurality of decryption storage blocks storing decryption parameters, an address of a decryption storage block and a decryption index

Corresponding to the reference value, a second address table such as the SRAM2 table can be used to record the mapping relationship between the address of each decrypted storage block and each decrypted index value.

After the encryption and decryption module 150 receives the message to be decrypted and the target decryption index value, it determines the second target address corresponding to the target decryption index value according to the SRAM2 table, and determines its pointing position in all decrypted storage blocks according to the second target address The decrypted storage block, that is, the target decrypted storage block is determined.

0 Then, obtain the encryption parameter in the target decryption storage block, that is, obtain the target decryption parameter, and perform authentication and decryption operations on the message to be decrypted based on the target decryption parameter, such as based on the target decryption parameter and the length of the message to be decrypted, get The length of the authentication content and the length of the decrypted content are determined, and the length of the check value is determined, and then the authentication and decryption are performed according to the preset authentication algorithm and decryption algorithm, and the decrypted message is obtained.

5 For ease of understanding, the embodiment of the present invention provides an example diagram, please refer to FIG. 7 , and the process of decrypting a message will be described below in conjunction with FIG. 7 .

The transceiver module 120 identifies the received message, recognizes that the message has ciphertext features, that is, network protocol type, destination port number and encryption protocol type, and is about to identify the message as ciphertext, then

The message is marked to be decrypted to obtain the message to be decrypted, and the ciphertext feature value of the message to be decrypted is extracted, and then based on the ciphertext feature value and the ciphertext feature table of the message to be decrypted, it is obtained from the corresponding target storage block The target decrypts the index information, and then sends the target decryption index information and the message to be decrypted to the parsing module 130 .

The analysis module 130 analyzes the target decryption index information to obtain the target decryption index value, and sends the target decryption index value, the message to be decrypted and some key information to the encryption and decryption module 150. 5 The encryption and decryption module 150 uses the target decryption index value and the first The second address table obtains the target decryption parameters from the corresponding target decryption storage block, and performs authentication and decryption operations on the message to be decrypted according to the target decryption parameter to obtain the decrypted message, and then sends the decrypted message to the DMA170.

The DMA170 stores the received decrypted message into the cache unit in the storage module 30 , and uses the RX direction descriptor to record the state of the decrypted message, including the address of the decrypted message in the storage module 30 .

The CPU 20 obtains the decrypted message from the storage module 30 through the address in the RX direction descriptor and performs an editing operation to obtain the edited message, then stores the edited message to the cache unit of the storage module 30, and stores the edited message The address of the file in the storage module 30 is updated to the TX direction descriptor.

The DMA170 obtains the edited message from the storage module 30 according to the address in the TX direction descriptor and sends it to the transceiver module 120 , so as to forward the encrypted message through the transceiver module 120 .

In order to execute the corresponding steps in the foregoing embodiments and various possible manners, an implementation manner of the packet forwarding device 10 is given below. It should be noted that the basic principles and technical effects of the message forwarding device 10 provided by the embodiment of the present invention are the same as those of the above-mentioned embodiment. corresponding content in the example. The message forwarding device 10 includes:

The transceiver module 120 is used to identify the received message, if it is recognized that the message is plain text, then mark the message to be encrypted to obtain the message to be encrypted and send it to the parsing module 130;

The parsing module 130 is used to send the message to be encrypted to the DMA170;

DMA170 is used to store the message to be encrypted in the storage module 30, so that the CPU20 obtains the message to be encrypted from the storage module 30, and performs encapsulation operation on the message to be encrypted to obtain the encapsulated message and obtains the target encryption index according to the encapsulated message After the value, the encapsulated message is stored in the storage module 30 and the target encryption index value is sent to the DMA170;

The DMA170 is used to send the target encryption index value and the encapsulated message obtained from the storage module 30 to the encryption and decryption module 150;

The encryption and decryption module 150 is used to obtain the target encryption parameter according to the target encryption index value, and perform an encryption operation and an authentication operation on the encapsulated message according to the target encryption parameter to obtain the encrypted message, and then send the encrypted message to the transceiver module 120;

The transceiver module 120 is used for forwarding encrypted messages.

Optionally, the CPU 20 performs encapsulation operation on the message to be encrypted to obtain the packaged message and obtains the target encryption index value according to the packaged message in the following manner: extract the plaintext feature value of the message to be encrypted, and Obtain the initial plaintext index value corresponding to the plaintext feature value of the message to be encrypted; obtain the target encapsulation rule corresponding to the initial plaintext index value according to the plaintext index table; perform encapsulation operation on the encrypted message according to the target encapsulation rule to obtain the encapsulated message ; Extract the plaintext feature value of the encapsulated message, and obtain the target plaintext index value corresponding to the plaintext feature value of the packaged message according to the plaintext feature table; obtain the target encryption index value corresponding to the target plaintext index value according to the plaintext index table.

Optionally, the encryption and decryption module 150 is also used to determine the target encrypted storage block in all encrypted storage blocks, the address of the target encrypted storage block corresponds to the target encryption index value; obtain the encryption parameters in the target encrypted storage block, and obtain the target encryption parameters .

Optionally, the transceiver module 120 is also used to mark the message to be decrypted to obtain the message to be decrypted if it is identified that the message is a ciphertext, and extract the ciphertext feature value of the message to be decrypted and according to the After the ciphertext feature value of the target decryption index information is obtained, the target decryption index information and the message to be decrypted are sent to the analysis module 130;

The analysis module 130 is also used to analyze the target decryption index information to obtain the target decryption index value, and send the target decryption index value and the message to be decrypted to the encryption and decryption module 150;

The encryption and decryption module 150 is also used to obtain the target decryption parameter according to the target decryption index value, and after performing authentication and decryption operations on the message to be decrypted according to the target decryption parameter to obtain the decrypted message, send the decrypted message to the DMA170;

DMA170 is also used for storing the decrypted message to the storage module 30, so that the CPU 20 obtains the decrypted message from the storage module 30, and edits the decrypted message to obtain the edited message, then stores the edited message to the storage module 30;

The DMA170 is also used to send the edited message obtained from the storage module 30 to the transceiver module 120;

The transceiver module 120 is also used for forwarding the edited message.

Optionally, the transceiver module 120 is also used to obtain the target ciphertext index value corresponding to the ciphertext feature value of the message to be decrypted according to the ciphertext feature table; determine the target storage block in all storage blocks, the address of the target storage block and Corresponding to the target ciphertext index value; obtaining the decryption index information in the target storage block to obtain the target decryption index information.

Optionally, the encryption and decryption module 150 is also used to determine the target decryption storage block in all the decryption storage blocks, the address of the target decryption storage block corresponds to the target decryption index value; obtain the decryption parameter in the target decryption storage block, and obtain the target decryption parameter .

Optionally, the transceiver module 120 is also used to identify the received message; if it is identified that the message has a preset plaintext feature, then the message is identified as plaintext; where the plaintext feature includes network protocol type, source IP address, destination IP address, source port number, and destination port number; if it is identified that the message has preset ciphertext features, the message will be identified as ciphertext; where the ciphertext features include network protocol type, destination port number, and Encryption protocol type.

The embodiment of the present invention also provides a network device, which includes a communication-connected CPU and a storage module, and the message forwarding device provided by the embodiment of the present invention. Both the CPU and the storage module are connected in communication with the DMA in the message forwarding device.

In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods may also be implemented in other ways. The device embodiments described above are only illustrative. For example, the flowcharts and block diagrams in the accompanying drawings show the architecture, functions and possible implementations of devices, methods and computer program products according to multiple embodiments of the present invention. operate. In this regard, each block in a flowchart or block diagram may represent a module, program segment, or part of code that includes one or more Executable instructions. It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks in succession may, in fact, be executed substantially concurrently, or they may sometimes be executed in the reverse order, depending upon the functionality involved. It should also be noted that each block of the block diagrams and/or flowchart illustrations, and combinations of blocks in the block diagrams and/or flowchart illustrations, can be implemented by a dedicated hardware-based system that performs the specified function or action , or may be implemented by a combination of dedicated hardware and computer instructions.

In addition, each functional module in each embodiment of the present invention can be integrated together to form an independent part, or each module can exist independently, or two or more modules can be integrated to form an independent part.

If the functions are implemented in the form of software function modules and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the essence of the technical solution of the present invention or the part that contributes to the prior art or the part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including Several instructions are used to make a computer device (which may be a personal computer, a server, or a network device, etc.) execute all or part of the steps of the methods described in various embodiments of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disk and other media that can store program codes. .

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (10)

1. A message forwarding method is characterized in that the message forwarding device is applied to network equipment and comprises a transceiving module, an analysis module, an encryption and decryption module and a DMA (direct memory access) which are connected through a bus, wherein the DMA is in communication connection with a CPU (central processing unit) and a storage module in the network equipment, and the CPU is in communication connection with the storage module; the method comprises the following steps:

the receiving and sending module identifies the received message, if the message is identified as a plaintext, the message is marked with an identifier to be encrypted to obtain a message to be encrypted, and the message to be encrypted is sent to the analysis module;

the analysis module sends the message to be encrypted to the DMA;

the DMA stores the message to be encrypted to the storage module so that the CPU obtains the message to be encrypted from the storage module, packages the message to be encrypted to obtain a packaged message, obtains a target encryption index value according to the packaged message, stores the packaged message to the storage module and sends the target encryption index value to the DMA;

the DMA sends the target encryption index value and the packaged message acquired from the storage module to the encryption and decryption module;

the encryption and decryption module obtains a target encryption parameter according to the target encryption index value, and sends the encrypted message to the transceiver module after carrying out encryption operation and authentication operation on the packaged message according to the target encryption parameter to obtain the encrypted message;

and the transceiver module forwards the encrypted message.

2. The method according to claim 1, wherein the CPU stores a plaintext feature table and a plaintext index table, the plaintext feature table comprising a plurality of plaintext feature values and corresponding plaintext index values; the plaintext index table comprises an encryption index value and an encapsulation rule corresponding to each plaintext index value;

the CPU carries out encapsulation operation on the message to be encrypted to obtain an encapsulated message and obtains a target encryption index value according to the encapsulated message, and the method comprises the following steps:

extracting a plaintext characteristic value of the message to be encrypted, and acquiring an initial plaintext index value corresponding to the plaintext characteristic value of the message to be encrypted according to the plaintext characteristic table;

acquiring a target encapsulation rule corresponding to the initial plaintext index value according to the plaintext index table;

performing encapsulation operation on the message to be encrypted according to the target encapsulation rule to obtain the encapsulated message;

extracting a plaintext feature value of the packaged message, and acquiring a target plaintext index value corresponding to the plaintext feature value of the packaged message according to the plaintext feature table;

and acquiring a target encryption index value corresponding to the target plaintext index value according to the plaintext index table.

3. The method according to claim 2, wherein the encryption/decryption module comprises a plurality of encrypted memory blocks storing encryption parameters, and an address of one of the encrypted memory blocks corresponds to one of the encryption index values;

the encryption and decryption module obtains the target encryption parameter according to the target encryption index value, and the method comprises the following steps:

determining a target encryption storage block in all encryption storage blocks, wherein the address of the target encryption storage block corresponds to the target encryption index value;

and acquiring the encryption parameters in the target encryption storage block to obtain the target encryption parameters.

4. The method of claim 1, wherein after the transceiver module identifies the received message, the method further comprises:

if the message is identified to be a ciphertext, marking a to-be-decrypted identifier on the message to obtain a to-be-decrypted message, extracting a ciphertext characteristic value of the to-be-decrypted message and target decryption index information according to the ciphertext characteristic value of the to-be-decrypted message, and then sending the target decryption index information and the to-be-decrypted message to the analysis module;

the analysis module analyzes the target decryption index information to obtain a target decryption index value, and sends the target decryption index value and the message to be decrypted to the encryption and decryption module;

the encryption and decryption module obtains a target decryption parameter according to the target decryption index value, performs authentication operation and decryption operation on the message to be decrypted according to the target decryption parameter to obtain a decrypted message, and then sends the decrypted message to the DMA;

the DMA stores the decrypted message into the storage module so that a CPU obtains the decrypted message from the storage module, edits the decrypted message to obtain an edited message, and then stores the edited message into the storage module;

the DMA sends the edited message acquired from the storage module to the transceiving module 5;

and the transceiver module forwards the edited message.

5. The method of claim 4, wherein the transceiver module stores a ciphertext feature table, the ciphertext feature table comprising a plurality of ciphertext feature values and corresponding ciphertext index values, the transceiver module comprises a plurality of storage blocks storing decryption index information, and a 0-address of one of the storage blocks corresponds to one of the ciphertext index values;

the receiving and sending module obtains target decryption index information according to the ciphertext characteristic value of the message to be decrypted, and the method comprises the following steps:

acquiring a target ciphertext index value corresponding to the ciphertext characteristic value of the message to be decrypted according to the ciphertext characteristic table;

5, determining a target storage block in all storage blocks, wherein the address of the target storage block corresponds to the target ciphertext index value;

and acquiring decryption index information in the target storage block to obtain the target decryption index information.

6. The method according to claim 5, wherein the encryption/decryption module comprises a plurality of decryption memory blocks storing decryption parameters, an address of one of the decryption memory blocks corresponding to one of the decryption 0 key values;

the step that the encryption and decryption module obtains the target decryption parameters according to the target decryption index value comprises the following steps:

determining a target decryption storage block in all decryption storage blocks, wherein the address of the target decryption storage block corresponds to the target decryption index value;

and 5, acquiring the decryption parameter in the target decryption storage block to obtain the target decryption parameter.

7. The method of claim 1, wherein the transceiver module identifies the received message, comprising:

identifying the received message;

if the message is identified to have the preset plaintext characteristics, identifying the message as a plaintext; wherein the plaintext characteristics comprise a network protocol type, a source IP address, a destination IP address, a source port number, and a destination port number;

if the message is identified to have the preset ciphertext characteristic, identifying the message as a ciphertext; wherein the ciphertext feature comprises a network protocol type, a destination port number, and an encryption protocol type.

8. A message forwarding device is characterized by comprising a transceiving module, an analysis module, an encryption and decryption module and a DMA (direct memory access) which are connected through a bus, wherein the DMA is in communication connection with a CPU (central processing unit) and a storage module in network equipment, and the CPU is in communication connection with the storage module;

the receiving and sending module is used for identifying the received message, if the message is identified as a plaintext, marking an identifier to be encrypted on the message to obtain a message to be encrypted, and sending the message to the analysis module;

the analysis module is used for sending the message to be encrypted to the DMA;

the DMA is used for storing the message to be encrypted to the storage module so that the CPU obtains the message to be encrypted from the storage module, obtains a target encryption index value according to the message to be encrypted, performs packaging operation on the message to be encrypted to obtain a packaged message, stores the packaged message to the storage module and sends the target encryption index value to the DMA;

the DMA is used for sending the target encryption index value and the packaged message acquired from the storage module to the encryption and decryption module;

the encryption and decryption module is used for obtaining a target encryption parameter according to the target encryption index value, carrying out encryption operation and authentication operation on the packaged message according to the target encryption parameter to obtain an encrypted message, and then sending the encrypted message to the transceiver module;

the transceiver module is used for forwarding the encrypted message.

9. The apparatus of claim 8, wherein the transceiver module is further configured to:

identifying the received message;

if the message is identified to have the preset plaintext characteristics, identifying the message as a plaintext; wherein the plaintext characteristics comprise a network protocol type, a source IP address, a destination IP address, a source port number, and a destination port number;

if the message is identified to have the preset ciphertext characteristics, identifying the message as a ciphertext; wherein the ciphertext feature comprises a network protocol type, a destination port number, and an encryption protocol type.

10. A network device comprising a CPU and a memory module communicatively coupled, and a message forwarding apparatus as claimed in any one of claims 8 and 9, the CPU and the memory module both communicatively coupled to a DMA in the message forwarding apparatus.

Images