Packet processing method, apparatus, and system

1. A packet processing method of forwarding a packet between a first node and a second node, comprising:

receiving, by the first node, a first packet from a relay device, wherein the first packet comprises data in a second packet from the second node to the relay device, wherein the data in the second packet is encrypted using second additional authentication data and a session key between the first node and the second node, wherein the second additional authentication data is generated by the second node according to second address information in a second packet header of the second packet by using a second rule, wherein the second address information in the second packet header includes a second sequence of addresses, and wherein the second address information in the second packet header of the second packet indicates that a first receiving party of the second packet is the relay device, a sending party of the second packet is the second node, and a second receiving party of the second packet is the first node;

generating, by the first node, first additional authentication data according to first address information in a first packet header of the first packet using a first rule, wherein the first address information in the first packet header includes a first sequence of addresses that is different than the second sequence of addresses in the second address information, wherein the first address information that is part of the first packet header of the first packet indicates that a receiving party of the first packet is the first node, a first sending party of the first packet is the relay device, and a second sending party of the first packet is the second node, and wherein the first additional authentication data is the same as the second additional authentication data; and

decrypting, by the first node, data in the first packet using the first additional authentication data and the session key between the first node and the second node.

2. The method of claim 1 , wherein the first rule is that a third sequence of addresses in the first additional authentication data is the same as the first sequence of addresses in the first packet header of the first packet, wherein the second rule is that a fourth sequence of addresses in the second additional authentication data is different from the second sequence of addresses in the second packet header of the second packet, and wherein the fourth sequence of the addresses in the second additional authentication data is the same as the third sequence of the addresses in the first additional authentication data.

3. The method of claim 1 , wherein the first rule is that a third sequence of addresses in the first additional authentication data is different from the fit sequence of addresses in the first packet header of the first packet, wherein the second rule is that a fourth sequence of addresses in the second additional authentication data is the same as the second sequence of addresses in the second packet header of the second packet, and wherein the fourth sequence of the addresses in the second additional authentication data is the same as the third sequence of the addresses in the first additional authentication data.

4. The method of claim 1 , wherein a fourth sequence of addresses in the second additional authentication data is the same as a third sequence of addresses in the first additional authentication data.

5. The method of claim 1 , wherein the second packet further comprises relay message authentication information, wherein the relay message authentication information is generated by the second node using a message authentication key between the relay device and the second node, and wherein after receiving the second packet, the relay device verifies the relay message authentication information using the message authentication key and sends the first packet to the first node when the verification succeeds.

6. A packet processing method of forwarding a packet between a first node and a second node, comprising:

generating, by the second node, a second packet, wherein second address information in a second packet header of the second packet indicates that a first receiving party of the second packet is a relay device, wherein a sending party of the second packet is the second node, wherein a second receiving party of the second packet is the first node, and wherein the second address information in the second packet header includes a second sequence of addresses;

generating, by the second node, second additional authentication data according to the second address information in the second packet header of the second packet using a second rule, and encrypting data in the second packet to form an encrypted second packet using the second additional authentication data and a session key between the first node and the second node; and

sending, by the second node, the encrypted second packet to the relay device, wherein the first node receives a first packet from the relay device, wherein the first packet comprises the data in the second packet, wherein first address information that is part of a first packet header of the first packet indicates that a receiving party of the first packet is the first node, a first sending party of the first packet is the relay device, and a second sending party of the first packet is the second node, and wherein the first address information in the first packet header includes a first sequence of addresses that is different than the second sequence of addresses in the second packet header,

wherein after receiving the first packet, the first node:

generates first additional authentication data according to the first address information in the first packet header of the first packet by using a first rule; and

decrypts data in the first packet by using the first additional authentication data and the session key between the first node and the second node, wherein the first additional authentication data is the same as the second additional authentication data.

7. The method of claim 6 , wherein the first rule is that a third sequence of addresses in the first additional authentication data is the same as the first sequence of addresses in the first packet header of the first packet, wherein the second rule is that a fourth sequence of addresses in the second additional authentication data is different from the second sequence of addresses in the second packet header of the second packet, and wherein the fourth sequence of the addresses in the second additional authentication data is the same as the third sequence of the addresses in the first additional authentication data.

8. The method of claim 6 , wherein the first rule is that a third sequence of addresses in the first additional authentication data is different from the first sequence of addresses in the first packet header of the first packet, wherein the second rule is that a fourth sequence of addresses in the second additional authentication data is the same as the second sequence of addresses in the second packet header of the second packet, and wherein the fourth sequence of the addresses in the second additional authentication data is the same as the third sequence of the addresses in the first additional authentication data.

9. The method of claim 6 , wherein a fourth sequence of addresses in the second additional authentication data is the same as a third sequence of addresses in the first additional authentication data.

10. The method of claim 6 , wherein the second packet further comprises relay message authentication information, wherein the relay message authentication information is generated by the second node using a message authentication key between the relay device and the second node, and wherein after receiving the second packet, the relay device verifies the relay message authentication information using the message authentication key and sends the first packet to the first node when the verification succeeds.

11. A packet processing apparatus, comprising:

a communications interface;

a memory coupled to the communications interface;

a processor coupled to the memory; and

a communications bus coupled to the processor, wherein the processor is configured to perform the following steps according to instructions saved in the memory:

receive a first packet from a relay device, wherein the first packet comprises data in a second packet from a second node to the relay device, wherein the data in the second packet is encrypted by using second additional authentication data and a session key between a first node and the second node, wherein the second additional authentication data is generated by the second node according to second address information in a second packet header of the second packet by using a second rule, wherein the second address information in the second packet header includes a second sequence of addresses, and wherein the second address information in the second packet header of the second packet indicates that a first receiving party of the second packet is the relay device, a sending party of the second packet is the second node, and a second receiving party of the second packet is the first node;

generate first additional authentication data according to first address information in a first packet header of the first packet by using a first rule, wherein the first address information in the first packet header includes a first sequence of addresses that is different than the second sequence of addresses in the second packet header, wherein the first address information that is part of the first packet header of the first packet indicates that a receiving party of the first packet is the first node, a first sending party of the first packet is the relay device, and a second sending party of the first packet is the second node, and wherein the first additional authentication data generated by using the first rule is the same as the second additional authentication data generated by using the second rule; and

decrypt data in the first packet using the first additional authentication data and the session key between the first node and the second node, wherein the first additional authentication data is the same as the second additional authentication data.

12. The apparatus of claim 11 , wherein the first rule is that a third sequence of addresses in the first additional authentication data is the same as the first sequence of addresses in the fit packet header of the first packet, wherein the second rule is that a fourth sequence of addresses in the second additional authentication data is different from the second sequence of addresses in the second packet header of the second packet, and wherein the fourth sequence of the addresses in the second additional authentication data is the same as the third sequence of the addresses in the first additional authentication data.

13. The apparatus of claim 11 , wherein the first rule is that a third sequence of addresses in the first additional authentication data is different from the first sequence of addresses in the first packet header of the first packet, wherein the second rule is that a fourth sequence of addresses in the second additional authentication data is the same as the second sequence of addresses in the second packet header of the second packet, and wherein the fourth sequence of the addresses in the second additional authentication data is the same as the third sequence of the addresses in the first additional authentication data.

14. The apparatus of claim 11 , wherein a fourth sequence of addresses in the second additional authentication data is the same as a third sequence of addresses in the first additional authentication data.

15. The apparatus of claim 11 , wherein the second packet further comprises relay message authentication information, wherein the relay message authentication information is generated by the second node using a message authentication key between the relay device and the second node, and wherein after receiving the second packet, the relay device verifies the relay message authentication information using the message authentication key and sends the first packet to the first node when the verification succeeds.

16. A packet processing apparatus, comprising:

a communications interface;

a memory;

a processor; and

a communications bus coupled to the communications interface, the memory, and the processor, wherein the processor is configured to perform the following steps according to instructions saved in the memory:

generate a second packet, wherein second address information in a second packet header of the second packet indicates that a first receiving party of the second packet is a relay device, a sending party of the second packet is a second node, and a second receiving party of the second packet is a first node, and wherein the second address information in the second packet header includes a second sequence of addresses;

generate second additional authentication data according to the second address information in the second packet header of the second packet using a second rule;

encrypt data in the second packet to form an encrypted second packet using the second additional authentication data and a session key between the first node and the second node; and

send the encrypted second packet to the relay device so that after receiving the second packet, the relay device sends a first packet to the first node, wherein the first packet comprises data in the second packet, wherein first address information that is part of a first packet header of the first packet indicates that a receiving party of the first packet is the first node, a first sending party of the first packet is the relay device, and a second sending party of the first packet is the second node, and wherein the first address information in the first packet header includes a first sequence of addresses that is different than the second sequence of addresses in the second packet header,

wherein after receiving the first packet, the first node generates first additional authentication data according to at least the first address information in the first packet header of the first packet by using a first rule, and decrypts data in the first packet by using the first additional authentication data and the session key between the first node and the second node, and

wherein the first additional authentication data is the same as the second additional authentication data.

17. The apparatus of claim 16 , wherein the first rule is that a third sequence of addresses in the first additional authentication data is the same as the first sequence of addresses in the first packet header of the first packet, wherein the second rule is that a fourth sequence of addresses in the second additional authentication data is different from the second sequence of addresses in the second packet header of the second packet, and wherein the fourth sequence of the addresses in the second additional authentication data is the same as the third sequence of the addresses in the first additional authentication data.

18. The apparatus of claim 16 , wherein the first rule is that a third sequence of addresses in the first additional authentication data is different from the first sequence of addresses in the first packet header of the first packet, wherein the second rule is that a fourth sequence of addresses in the second additional authentication data is the same as the second sequence of addresses in the second packet header of the second packet, and wherein the fourth sequence of the addresses in the second additional authentication data is the same as the third sequence of the addresses in the first additional authentication data.

19. The apparatus of claim 16 , wherein a fourth sequence of addresses in the second additional authentication data is the same as a third sequence of addresses in the first additional authentication data.

20. The apparatus of claim 16 , wherein the second packet further comprises relay message authentication information, wherein the relay message authentication information is generated by the second node using a message authentication key between the relay device and the second node, and wherein after receiving the second packet, the relay device verifies the relay message authentication information using the message authentication key and sends the first packet to the first node when the verification succeeds.