Data processing method and apparatus
A data processing method includes an authenticated identifier and a key corresponding to the authenticated identifier are allocated to a terminal that accesses a service supported by an application server. The terminal includes the authenticated identifier and a verification code in a sent data packet such that a network device can identify a legal data packet and an illegal data packet based on the authenticated identifier and the verification code, and forward the legal data packet.
1. A method, comprising:
generating a first key based on a first authenticated identifier and a second key, wherein the second key corresponds to a first service, and wherein the second key is for deriving a third key of a registered terminal that can access the first service;
generating a first verification code based on the first authenticated identifier and the first key;
setting the first authenticated identifier and the first verification code in a network layer protocol header of a first data packet or a transport layer protocol header of the first data packet; and
sending the first data packet comprising the first authenticated identifier and the first verification code.
2. The method of claim 1 , further comprising further generating the first verification code based on at least one of a first locator indicating a target device, a second locator indicating a first terminal, or a dynamic parameter that varies with time.
3. The method of claim 2 , further comprising obtaining a static identifier of the target device, wherein the static identifier comprises the first locator.
4. The method of claim 1 , further comprising further setting the first authenticated identifier and the first verification code in a next header field in the network layer protocol header or an Internet Protocol (IP) address field in the network layer protocol header.
5. The method of claim 1 , further comprising further setting the first authenticated identifier and the first verification code in an option field in a Transmission Control Protocol (TCP) header of the first data packet.
6. The method of claim 1 , wherein a service name of the first service, a service identifier associated with the first service, and the second key are stored in a table.
7. The method of claim 1 , wherein the third key is a root key, and wherein multiple services share the root key.
8. A method, comprising:
receiving a first data packet comprising a first authenticated identifier and a first verification code, wherein either a network layer protocol header of the first data packet or a transport layer protocol header of the first data packet comprises the first authenticated identifier and the first verification code;
generating a first key based on the first authenticated identifier and a second key, wherein the second key corresponds to a first service, and wherein the second key is for deriving a third key of a registered terminal that can access the first service;
generating a second verification code based on the first authenticated identifier and the first key;
comparing the first verification code and the second verification code;
forwarding the first data packet to a target device when the first verification code is the same as the second verification code; and
discarding the first data packet when the first verification code is not the same as the second verification code.
9. The method of claim 8 , further comprising obtaining the second key based on a first locator in the first data packet, wherein the first locator indicates the target device.
10. The method of claim 8 , further comprising:
obtaining a fourth key based on a first locator in the first data packet, wherein the fourth key is for deriving a fifth key corresponding to a service, and wherein the first locator indicates the target device; and
either:
generating the second key based on the fourth key and a first service identifier in the first data packet, wherein the first service identifier indicates the first service running on the target device; or
generating the second key based on the fourth key and the first locator.
11. The method of claim 8 , further comprising further generating the second verification code based on at least one of a first locator, a second locator, or a dynamic parameter, wherein the first data packet further comprises the first locator and the second locator, wherein the first locator indicates the target device, wherein the second locator indicates a first terminal, and wherein the dynamic parameter varies with time.
12. The method of claim 8 , wherein before receiving the first data packet, the method further comprises receiving a filtering request comprising a first locator, a first service identifier, and the second key.
13. The method of claim 8 , further comprising limiting, in response to a volume of traffic corresponding to the first authenticated identifier being greater than or equal to a threshold, the traffic.
14. The method of claim 8 , wherein the third key is a root key, and wherein multiple services share the root key.
15. An apparatus, comprising:
a receiver configured to receive a first authenticated identifier and a first key, wherein the first key is based on the first authenticated identifier and a second key, wherein the second key corresponds to a first service, and wherein the second key is for deriving a third key of a registered terminal that can access the first service;
one or more processors coupled to the receiver and configured to:
generate a first verification code based on the first authenticated identifier and the first key; and
set the first authenticated identifier and the first verification code in a network layer protocol header of a first data packet or a transport layer protocol header of the first data packet; and
a transmitter coupled to the one or more processors and configured to send the first data packet comprising the first authenticated identifier and the first verification code.
16. The apparatus of claim 15 , wherein the one or more processors are further configured to further generate the first verification code based on at least one of a first locator indicating a target device, a second locator indicating a first terminal, and a dynamic parameter that varies with time.
17. The apparatus of claim 16 , wherein the one or more processors are further configured to obtain a static identifier of the target device, and wherein the static identifier comprises the first locator.
18. The apparatus of claim 15 , wherein the one or more processors are further configured to further set the first authenticated identifier and the first verification code in a next header field in the network layer protocol header or an Internet Protocol (IP) address field in the network layer protocol header.
19. The apparatus of claim 15 , wherein the one or more processors are further configured to further set the first authenticated identifier and the first verification code in an option field in a Transmission Control Protocol (TCP) header of the first data packet.
20. The apparatus of claim 15 , wherein a service name of the first service, a service identifier associated with the first service, and the second key are stored in a table.