IMPLEMENTING NETWORK COMMUNICATION

• US 20160164845A1
• Filed: 08/27/2014
• Published: 06/09/2016
• Est. Priority Date: 08/30/2013
• Status: Abandoned Application

• Current Assignee: Hewlett Packard Enterprise Development LP (Hewlett-Packard Enterprise Company)
• Original Assignee: Hangzhou H3C Technologies Co Ltd (Tsinghua Holdings Co., Ltd.)
• Inventors: MAO, Yu
• Application Number:
  US14/899,759
• Publication Number:
  US 20160164845A1
• Time in Patent Office: Days
• US Class Current: 1/1
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 63/0227 Filtering policies mail message filtering H04L51/212
• CPC Class Codes: H04L 63/0272 Virtual private networks
• CPC Class Codes: H04L 63/0428 wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/164 at the network layer

Abstract

When a node device receives a packet transmitted from a device connecting with the node device, the node device searches a public network address of a next hop in a first table according to a private address of the next hop, searches for an IPsec security association (SA) in a second table according to the public network address searched out, performs IPsec encapsulation for the received packet by use of the IPsec SA corresponding to the public network address, and transmits the packet.

Claims

1. A method for implementing network communication, comprising:

searching for, by a node device, a public network address of a next hop in a first table according to a private address of the next hop when receiving a packet transmitted from a device connecting with the node device;

searching for, by the node device, an IPsec security association (SA) corresponding to the public network address in a second table according to the public network address searched out; and

performing, by the node device, IPsec encapsulation for the received packet by use of the IPsec SA corresponding to the public network address.

2. The method of claim 1, further comprising:

querying, by the node device, the public network address of the next hop to a control server when the public network address is not searched out from the first table according to the private address of the next hop;

adding, by the node device, an entry of a map between the private network address and the public network address of the next hop into the first table;

performing, by the node device, the IKE negotiation with a node device corresponding to the public network address to obtain the IPsec SA corresponding to the public network address;

adding, by the node device, an entry of a map between the public network address and the obtained IPsec SA into the first table,

wherein the process of performing the IKE negotiation with the node device corresponding to the public network address comprises;

filling information of protected data stream in a negotiation packet with a packet any to any.

3. The method of claim 1, further comprising:

performing, by the node device, the IKE negotiation with a node device corresponding to the public network address to obtain the IPsec SA corresponding to the public network address when the IPsec SA corresponding to the public network address is not searched out in the second table;

adding, by the node device, an entry of a map between the public network address and the IPsec SA into the second table,

wherein the process of performing the IKE negotiation with the node device corresponding to the public network address comprises;

filling information of protected data stream in a negotiation packet with a packet any to any.

4. The method of claim 1, further comprising:

when the node device is a Spoke device and the public network address is not searched out according to the private address of the next hop, obtaining, by the node device, a public network address of a Hub device in the first table;

obtaining, by the node device, an IPsec SA corresponding to the Hub device in the second table according to the public network address of the Hub device;

performing, by the node device, the IPsec encapsulation for the received packet by use of the IPsec SA, and transmitting the packet to the Hub device.

5. The method of claim 1, further comprising:

when the node device is a Spoke device and the IPsec SA corresponding to the public network address is not searched out in the second table, obtaining, by the node device, a public network address of a Hub device in the first table;

obtaining, by the node device, an IPsec SA corresponding to the Hub device in the second table according to the public network address of the Hub device;

performing, by the node device, the IPsec encapsulation for the received packet by use of the IPsec SA, and transmitting the packet to the Hub device.

6. The method of claim 1, further comprising:

discarding the received packet when the node device is a Hub device and the public network address is not searched out according to the private address of the next hop.

7. The method of claim 1, further comprising:

discarding the received packet when the node device is a Hub device and the IPsec SA corresponding to the public network address is not searched out in the second table.

8. The method of claim 1, further comprising:

when receiving an IPsec packet from another node device and determining that a target IP address of the received IPsec packet is same with that of the node device, decapsulating the IPsec packet, and forwarding the decapsulated packet according to a target IP address of the decapsulated packet;

when receiving an IPsec packet from another node device and determining that a target IP address of the received IPsec packet is different from that of the node device, forwarding the IPsec packet according to the target IP address of the IPsec packet;

9. An apparatus for implementing network communication, comprising:

a process for executing instructions stored in a non-transitory machine readable storage medium, the instructions comprise;

a receiving instruction, to receive a packet transmitted from a device connecting with the apparatus;

a searching instruction, to search for a public network address of a next hop in a first table according to a private address of the next hop, search for an IPsec security association (SA) corresponding the public network address in a second table according to the public network address searched out; and

a processing instruction, to perform IPsec encapsulation for the received packet by use of the IPsec SA corresponding to the public network address.

10. The apparatus of claim 9, wherein the processing instruction is further to when the public network address is not searched out from the first table according to the private address of the next hop, query the public network address of the next hop to a control server, add an entry of a map between the private network address and the public network address of the next hop into the first table, perform the IKE negotiation with a node device corresponding to the public network address to obtain the IPsec SA corresponding to the public network address, add an entry of a map between the public network address and the obtained IPsec SA into the first table;

the processing instruction is to fill information of protected data stream in a negotiation packet with a packet any to any.

11. The apparatus of claim 9, wherein the processing instruction is further to when the IPsec SA corresponding to the public network address is not searched out in the second table, perform the IKE negotiation with a node device corresponding to the public network address to obtain the IPsec SA corresponding to the public network address, add an entry of a map between the public network address and the IPsec SA into the second table;

the processing instruction is to fill information of protected data stream in a negotiation packet with a packet any to any.

12. The apparatus of claim 9, wherein the processing instruction is further to when the apparatus is a Spoke device and the public network address is not searched out according to the private address of the next hop, obtain a public network address of a Hub device in the first table, obtain an IPsec SA corresponding to the Hub device in the second table according to the public network address of the Hub device, perform the IPsec encapsulation for the received packet by use of the IPsec SA, and transmit the packet to the Hub device.

13. The apparatus of claim 9, wherein the processing instruction is further to when the apparatus is a Spoke device and the IPsec SA corresponding to the public network address is not searched out in the second table, obtain a public network address of a Hub device in the first table, obtain an IPsec SA corresponding to the Hub device in the second table according to the public network address of the Hub device, perform the IPsec encapsulation for the received packet by use of the IPsec SA, and transmit the packet to the Hub device.

14. The apparatus of claim 9, wherein the processing instruction is further to discard the received packet when the apparatus is a Hub device and the public network address is not searched out according to the private address of the next hop.

15. The apparatus of claim 9, wherein

the receiving instruction is to receive an IPsec packet from a node device;

the processing instruction is to decapsulate the IPsec packet and forward the decapsulated packet according to a target IP address of the decapsulated packet when determining that a target IP address of the received IPsec packet is same with that of the apparatus, forward the IPsec packet according to the target IP address of the IPsec packet when determining that a target IP address of the received IPsec packet is different from that of the apparatus.