Internet safety protocol high-speed processing IP burst method

Abstract

The method includes procedures: when processing first IP banding, network device of starting use of Internet secure protocol picks up information for unique identifying the IP message from the IP banding; then, building mapping from the information to relevant security policy; when processing other bandings of the IP message, Internet secure protocol maps to relevant security policy through the said unique information so as to implement process in high speed for the IP banding by the Internet secure protocol. Comparing with prior art, the invention overcomes disadvantages of using lots of memory, weighting process burden of gateway, lowering network throughput. The invention raises service range supported by network device, and guarantees high forwarding performance of network device.

Description

technical field [0001] The present invention relates to the computer field, in particular to information security technology in the Internet field. Background technique [0002] As the Internet penetrates into every aspect of social life day by day, Internet security issues are receiving more and more widespread attention. In general, IPsec (IP Security, Internet Security Protocol) is often used on the Internet to provide encryption and authentication protection for communication between network entities. The most typical application is to deploy a VPN (Virtual Private Network, Virtual Private Network), using the IPsec protocol Provide encryption and authentication protection for IP tunnels between VPN gateways that traverse the public network. The IPsec protocol provides security protection for IP (Internet Protocol, Internet Protocol) packets through AH (Authentication Head, IP Authentication Head Protocol) and ESP (Encapsulating Security Payload, IP Encapsulating Securit...

AI Technical Summary

Problems solved by technology

[0004] The technical problem to be solved by the present invention is to overcome the high-performance network equipment (such as high-performance reasoner and high-performance routing switch) that enables IPsec technology that exists in the prior art when supporting port-level security granularity, it is necessary to reorganize the IP fragmentation before Obtaining the port information of the upper layer protocol can implement IPsec processing for all IP fragments, which will take up a large amount of memory, increase the processing burden of IPsec gateways, reduce network throughput performance, and cannot process IP fragments at high speed. A method for high-speed processing of IP fragments by an Internet security protocol capable of processing IP fragments at high speed, effectively reducing the processing burden of IPsec gateways, and improving network throughput performance

Images