CN105471832A - Processing method and device of IP packet in satellite communication - Google Patents

Abstract

The invention discloses a method and device for processing IP messages in satellite communication, wherein the method includes: receiving source data from the first small station sent by the master station, wherein the source data includes: a data part and a TCP /UDP packet header, TCP/UDP packet header is data in transparent transmission mode; decrypt the key encrypted by the first transmission key carried in the source data, where the first transmission key is the first small station The corresponding transmission key, which is the key for decrypting the data carried by the data part; use the second transmission key to encrypt the decrypted key to obtain the key encrypted by the second transmission key, wherein , the second transmission key is the transmission key corresponding to the second small station, and the second small station is the receiver of the source data; the encrypted key of the first transmission key is replaced by the encrypted key of the second transmission key key, and send the replaced and processed source data to the master station. Through the invention, the IP message encryption processing of the star network is realized.

Description

Method and device for processing IP message in satellite communication

technical field

The invention relates to the communication field, in particular to a method and device for processing IP messages in satellite communication.

Background technique

Transmission Control Protocol (Transmission Control Protocol, referred to as TCP) is used in satellite communications. Due to certain differences between satellite communications and computer network communications, new problems arise when TCP is applied to satellite communications environments. For example, the high transmission rate of satellite channels Delay, large bit error rate, and unequal bandwidth.

Currently, there is no effective solution to the problem of how to encrypt IP packets in satellite communications.

Contents of the invention

Aiming at the problem of encryption of IP message in satellite communication, the present invention provides a method and device for processing IP message in satellite communication, so as to at least solve the above problem.

According to one aspect of the present invention, the processing method of IP message in satellite communication is provided, comprising:

Receiving source data from the first small station sent by the master station, wherein the source data includes: a data part and a TCP/UDP packet header, wherein the TCP/UDP packet header is data in a transparent transmission mode;

Decrypt the key encrypted by the first transmission key carried in the source data, where the first transmission key is the transmission key corresponding to the first small station, and the key is a key for decrypting the data carried by the data portion;

Use the second transmission key to encrypt the decrypted key to obtain a key encrypted by the second transmission key, wherein the second transmission key is the transmission key corresponding to the second small station, and the The second small station is the receiver of the source data;

The key encrypted by the first transmission key is replaced by the key encrypted by the second transmission key, and the replaced information source data is sent to the main station.

Optionally, the source data carries indication information for indicating whether the data carried by the data part is encrypted, wherein, when the encryption is performed, the indication information indicates an encrypted transmission mode; when When the encryption is not performed, the indication information indicates a transparent transmission mode;

Before decrypting the key carried in the source data encrypted by the first transmission key, it also includes: judging whether to perform decryption processing according to the instruction information;

Decrypting the key encrypted by the first transmission key carried in the source data includes: when the indication information indicates the secret transmission mode, decrypting the encrypted key carried in the source data after the first transmission The encrypted key is used to decrypt the key.

Optionally, the method further includes: when the indication information indicates the transparent transmission mode, directly sending the source data to the main station without performing decryption processing.

According to another aspect of the present invention, a processing device for IP messages in satellite communications is provided, including:

The receiving module is configured to receive the source data from the first small station sent by the master station, wherein the source data includes: a data part and a TCP/UDP packet header, wherein the TCP/UDP packet header is transparently transmitted way data;

A decryption module, configured to decrypt the key encrypted by the first transmission key carried in the source data, where the first transmission key is the transmission key corresponding to the first small station, The key is a key for decrypting the data carried by the data part;

An encryption module, configured to use the second transmission key to encrypt the decrypted key to obtain a key encrypted by the second transmission key, wherein the second transmission key is the transmission key corresponding to the second small station a key, the second small station is the receiver of the source data;

A sending module, configured to replace the key encrypted by the first transmission key with the key encrypted by the second transmission key, and send the replaced information source data to the main station.

Optionally, the source data carries indication information for indicating whether the first encryption is performed on the data carried by the data part, wherein, when the first encryption is performed, the indication information indicates that the encryption is encrypted. A transmission mode; when the first encryption is not performed, the indication information indicates a transparent transmission mode;

The device further includes: a judging module, connected to the receiving module, for judging whether to perform decryption processing according to the indication information;

The decryption module is connected to the judging module, and is configured to decrypt the key encrypted by the first transmission key carried in the source data when the indication information indicates the encryption mode.

Optionally, the sending module is configured to directly send the source data to the master station when the indication information indicates a transparent transmission mode.

The invention realizes the encryption processing of the IP message under the star network, guarantees the processing speed of the IP message while ensuring the safety of the satellite communication, and satisfies the requirements of encryption and QoS at the same time.

Description of drawings

The accompanying drawings described here are used to provide a further understanding of the present invention and constitute a part of the application. The schematic embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute improper limitations to the present invention. In the attached picture:

Fig. 1 is the flow chart of the processing method of IP message in the satellite communication according to the embodiment of the present invention;

Fig. 2 is the flowchart of the encryption method of IP message in the satellite communication according to the embodiment of the present invention;

Fig. 3 is the flow chart of the decryption method of IP message in the satellite communication according to the embodiment of the present invention;

Fig. 4 is a structural block diagram of a device for processing IP messages in satellite communications according to an embodiment of the present invention;

Fig. 5 is the structural block diagram of the encryption device of IP message in the satellite communication according to the embodiment of the present invention;

Fig. 6 is the structural block diagram of the decryption device of IP message in the satellite communication according to the embodiment of the present invention;

Fig. 7 is a flow chart of secret transmission data uploaded by the small station to the master station.

detailed description

Hereinafter, the present invention will be described in detail with reference to the drawings and examples. It should be noted that, in the case of no conflict, the embodiments in the present application and the features in the embodiments can be combined with each other.

When the IP protocol is applied to satellite communications, satellite communications have certain requirements for data encryption to meet the requirements of secure communications. Therefore, an embodiment of the present invention provides an encryption technology for an IP message in satellite communication, including two parts of encryption and decryption. Since the satellite communication has a relatively high delay requirement, in order to improve the processing speed of the TCP/UDP message, in the embodiment of the present invention, the data part of the TCP/UDP message is encrypted, and the TCP/IP packet header part is transparently transmitted.

FIG. 1 is a flowchart of a method for processing IP packets in satellite communication according to an embodiment of the present invention. As shown in FIG. 1 , the method includes steps 101 to 104.

Step 101, receiving source data from the first small station sent by the master station, wherein the source data includes: a data part and a TCP/UDP packet header, wherein the TCP/UDP packet header is data in a transparent transmission mode;

Step 102, decrypt the key encrypted by the first transmission key carried in the above-mentioned information source data, wherein the first transmission key is the transmission key corresponding to the first small station, and the key is the A key for decrypting the data carried by the data part;

Step 103, use the second transmission key to encrypt the decrypted key to obtain the key encrypted by the second transmission key, wherein the second transmission key is the transmission key corresponding to the second small station , the second small station is the receiver of the source data;

Step 104, replacing the key encrypted by the first transmission key with the key encrypted by the second transmission key, and sending the replaced information source data to the main station.

In an optional implementation manner of the embodiment of the present invention, the information source data carries indication information for indicating whether to encrypt the data carried by the data part, wherein, when the encryption is performed, the indication information Indicates the secret transmission mode; when the encryption is not performed, the indication information indicates the transparent transmission mode.

Before decrypting the key encrypted by the first transmission key carried in the source data in the above step 102, it may also be determined whether to perform decryption processing according to the above instruction information.

The above step 102 is, when the indication information indicates the secret transmission mode, decrypt the key encrypted by the first transmission key carried in the information source data.

Optionally, when the indication information indicates the transparent transmission mode, no decryption process is performed, and the information source data is directly sent to the master station.

In the embodiment of the present invention, the first small station and the second small station are small stations located under the same main station. Before sending data to the main station, the small station or the encryption machine corresponding to the small station can perform encryption processing. After the data sent by the master station, the small station or the encryption machine corresponding to the small station can perform decryption processing.

The optional encryption and decryption methods in the embodiment of the present invention are described below.

FIG. 2 is a flowchart of a method for encrypting an IP packet in satellite communication according to an embodiment of the present invention. As shown in FIG. 2 , the method includes steps 201 to 203.

Step 201, receiving source data, wherein the source data includes: a data part and a TCP/UDP header part.

Step 202, encrypting the data carried by the data part to obtain the ciphertext data part.

Step 203, sending an IP packet including a TCP/UDP packet header and a ciphertext data portion, wherein the TCP/UDP packet header is not encrypted.

Through the embodiment of the present invention, the speed carried by the data part of the TCP/UDP message is encrypted, and the header part of the TCP/UDP packet is transmitted in a transparent transmission mode, which can ensure the processing speed of the IP message while ensuring the security of the satellite communication , thus meeting both encryption and QoS requirements.

The data part of the TCP/UDP message may be data or signaling. Data encryption can improve data security. However, the encryption of the signaling will reduce the processing speed of the TCP/UDP message, thereby increasing the message processing delay.

For this reason, in an optional implementation manner of the embodiment of the present invention, before the above step 202, it may also be judged whether the data carried by the data part is signaling data of the IP layer. The above step 202 may include: when the data carried by the data part is not signaling data of the IP layer, encrypting the data carried by the data part; when the data carried by the data part is signaling data of the IP layer, not carrying the data part The data is encrypted. That is to say, compared with the encrypted transmission of the non-signaling data carried by the data part, in this optional implementation manner, the signaling data is transparently transmitted.

Through the above optional implementation manner, data is encrypted and signaling is transparently transmitted, thereby ensuring data encryption and processing delay of signaling data.

In the embodiment of the present invention, in order to facilitate the decryption by the data receiver, indication information for indicating whether the data carried by the data part has been encrypted can also be added to the IP message, wherein, when the encryption is performed, The indication information indicates the secret transmission mode; when no encryption processing is performed, the indication information indicates the transparent transmission mode.

In an optional implementation manner of the embodiment of the present invention, a key encrypted by the transmission key may also be added to the IP message, where the key is a key for decrypting data carried by the data part.

The following describes the decryption method of the IP message in the satellite communication according to the embodiment of the present invention.

FIG. 3 is a flowchart of a method for decrypting an IP message in satellite communication according to an embodiment of the present invention. As shown in FIG. 3 , the method includes steps 301 to 302.

Step 301, receiving source data, wherein the source data includes a data part and a TCP/UDP packet header, wherein the TCP/UDP packet header is data in a transparent transmission mode.

Step 302, decrypting the data carried by the data part.

Corresponding to the above encryption method, in an optional implementation manner of the embodiment of the present invention, the source data may also carry indication information for indicating whether to encrypt the data carried by the data part, wherein, when the During the encryption process, the indication information indicates the secret transmission mode; when the encryption process is not performed, the indication information indicates the transparent transmission mode.

Before the above step 302, it is also possible to judge according to the indication information whether to decrypt the data carried by the data part; the above step 302 may include: when the indication information indicates that the data is in secret transmission mode, decrypt the data carried by the data part; When the indication information indicates the transparent transmission mode, the data carried in the data part will not be decrypted.

Optionally, the source data also carries a key for decrypting the data carried by the data part, and the above step 202 may decrypt the data carried by the data part according to the key. In the embodiment of the present invention, the key has been encrypted, and the encrypted key may be decrypted before decryption.

Fig. 4 is the structure block diagram of the processing device of IP message in the satellite communication according to the embodiment of the present invention, as shown in Fig. 4, comprises:

The receiving module 410 is configured to receive the source data sent by the master station from the first small station, wherein the source data includes: a data part and a TCP/UDP packet header, wherein the TCP/UDP packet header is a transparent data in transmission mode;

Decryption module 420, configured to decrypt the key encrypted by the first transmission key carried in the source data, where the first transmission key is the transmission key corresponding to the first small station , the key is a key for decrypting the data carried by the data part;

The encryption module 430 is configured to use the second transmission key to encrypt the decrypted key to obtain a key encrypted by the second transmission key, wherein the second transmission key is the key corresponding to the second small station transmitting a key, the second small station is the receiver of the source data;

The sending module 440 is configured to replace the key encrypted by the first transmission key with the key encrypted by the second transmission key, and send the replaced information source data to the main station.

Optionally, the source data carries indication information for indicating whether the first encryption is performed on the data carried by the data part, wherein, when the first encryption is performed, the indication information indicates that the encryption is encrypted. A transmission mode; when the first encryption is not performed, the indication information indicates a transparent transmission mode;

The device also includes: a judging module 450, connected to the receiving module 410, for judging whether to perform decryption processing according to the instruction information;

The decryption module 420 is connected to the judging module, and is used to decrypt the key encrypted by the first transmission key carried in the source data when the indication information indicates the encryption mode .

Optionally, the sending module 440 is configured to directly send the source data to the master station when the indication information indicates a transparent transmission mode.

Fig. 5 is the structural block diagram of the encryption device of IP message in the satellite communication according to the embodiment of the present invention, as shown in Fig. 5, this device comprises: receiving module 510, is used for receiving information source data, wherein, information source data comprises: The data part and the TCP/UDP packet header part; the encryption module 520 is used to encrypt the data carried by the data part to obtain the ciphertext data part; the sending module 530 is used to send the ciphertext data part including the TCP or UDP packet header part and the ciphertext data part In the IP packet, the TCP/UDP packet header is not encrypted.

In an optional implementation manner of the embodiment of the present invention, the above-mentioned device may also include: a judging module 540, connected to the receiving module 510, for judging whether the data carried by the data part is signaling data of the IP layer; an encryption module 520 , is connected with the judging module 540, and is used for encrypting the data carried by the data part when the judging result of the judging module 540 is No; when the judging result is Yes, not encrypting the data carried by the data part.

Optionally, the above-mentioned apparatus may further include: a first adding module 550, configured to add indication information for indicating whether encryption processing is performed on the data carried by the data part in the IP packet, wherein, when the encryption processing is performed , the indication information indicates the secret transmission mode; when no encryption processing is performed, the indication information indicates the transparent transmission mode.

Optionally, the above device further includes: a second adding module 560, configured to add the key encrypted by the joint key to the IP message, where the key is a key for decrypting data carried by the data part.

Fig. 6 is a structural block diagram of an apparatus for decrypting IP messages in satellite communications according to an embodiment of the present invention. As shown in Fig. 6, the apparatus may include: a receiving module 610 for receiving information source data, wherein the information source data includes The data part and the TCP/UDP packet header, wherein the TCP/UDP packet header is data in a transparent transmission mode; the decryption module 620 is used to decrypt the data carried by the data part.

Corresponding to the above method, the information source data may carry indication information for indicating whether encryption processing has been performed on the data carried by the data part, wherein, when encryption processing is performed, the indication information indicates the secret transmission mode; when encryption processing is not performed , the indication information indicates the transparent transmission mode.

In an optional implementation manner of the embodiment of the present invention, the above-mentioned device may further include: a judging module 630, connected to the receiving module 610, for judging whether to decrypt the data carried by the data part according to the above-mentioned instruction information; 620, connected to the judging module 630, used for decrypting the data carried by the data part when the indication information indicates the secret transmission mode; when the indication information indicates the transparent transmission mode, not performing decryption processing on the data carried by the data part .

Optionally, the source data also carries a key for decrypting the data carried by the data part; the decryption module 620 is configured to decrypt the data carried by the data part according to the key.

Optional implementation manners of the embodiments of the present invention are described below.

In summary of this optional embodiment, the IP data communication process and data format are respectively designed based on the star network and mesh network topology of the satellite communication system, and the encryption algorithm adopted is the international standard AES algorithm.

1. Design of IP encrypted data format in secret transmission and transparent transmission mode

Secret transmission: After the source data enters the cipher machine, the data part of the TCP data packet and UDP data packet is encrypted, the header is not encrypted, and it is transmitted to the destination in the form of cipher text, and the corresponding decryption processing is required.

Transparent transmission: After the source data enters the cipher machine, the data content and header of the TCP data packet and UDP data packet are not encrypted, and are transmitted to the destination in a transparent form without decryption processing.

Use the configuration file to manually select whether the cipher machine uses the transparent transmission mode or the secret transmission mode. If the cipher machine is configured to use secret transmission mode, the data structure of the source data after being processed by the source encryption and decryption machine is as follows:

Table 1

Among them, the 8bits flag in the data format indicates that the data is in secret transmission mode, SK is the key for encrypting data, 256bits is the SK encrypted by the transmission key, the joint key is calculated by both parties according to ECDH, and Ciphertext is encrypted The ciphertext part of .

If the cipher machine is configured to use transparent transmission mode, the data structure of the source data after being processed by the source encryption and decryption machine is as follows:

Table 2

After the sink cipher machine receives the data from the gateway, it interprets the 8Bits flag in the data format, so as to decide to decrypt the incoming data or perform post-processing of transparent transmission. The data structure of the secret transmission data or transparent transmission data processed by the sink cipher machine is exactly the same as the data structure and content before entering the source cipher machine, which is the standard IP data packet format:

table 3

IP header TCP header plaintext

2. Star network key negotiation and encrypted data process design

key agreement process

1. Start the star network encryption and decryption machine of the star network station A;

2. Calculate the Diffie-Hellman parameters of small station A;

3. The encryption and decryption machine of star network station A sends its Diffie-Hellman parameters and star network identity information to VSATHUB;

4. VSATHUB obtains the Diffie-Hellman parameters of the star network station A and its star network identity information from the DVB data;

5. VSATHUB forwards the Diffie-Hellman parameters of star station A and its star network identity information to KMC;

6. KMC receives the Diffie-Hellman parameter of star network station A and its star network identity information, and calculates the transmission key between KMC and star network station A based on it;

7. KMC sends its own Diffie-Hellman parameters to VSATHUB;

8. VSATHUB uses DVB to package the Diffie-Hellman parameters of KMC;

9. VSATHUB sends the Diffie-Hellman parameters of KMC to star network station A;

10. The star network substation A calculates its transmission key with the KMC, and completes the star network key negotiation process.

Encrypted data flow

Taking the PC of small station A to upload data files to the FTP server data of the main station as an example, the encrypted data process design in the case of a star network is introduced. The key management center (KMC) in the figure below only shows the passwords involved in the encrypted process devices and key management devices.

Figure 7 is a flow chart of the secret transmission data uploaded by the small station to the master station, as shown in Figure 7, including the following process:

1. The small station A uses the standard TCP format data output by the PC (as shown in Table 4).

Table 4

IP header TCP header plaintext

In the above message, the source address of the IP header is the PC, and the destination address is the FTP server.

2. The small station A cipher machine performs encryption, and the encrypted data is shown in Table 5.

table 5

In the above message, the source address of the IP header is the PC, and the destination address is the FTP server.

3. The small station Amoderm performs processing, and the processed data is shown in Table 6.

Table 6

In the above message, the source address of the IP header is the PC, and the destination address is the FTP server.

4. After being processed by the DPS of the master station, the data is forwarded to the border router forcibly, and the data format is shown in Table 7.

Table 7

In the above message, the source address of the IP header is the PC, and the destination address is the FTP server.

5. Define a GRE tunnel between the border router and the key management device, and the data will be processed and forwarded in the following format:

Table 8

In the above message, the source address of the leftmost IP header is the address of the border router, and the destination address is the address of the key management device.

6. After the key management device receives the data, it judges that it is encrypted data by interpreting the 8bits flag, and splits the data packet into three parts: IP header, encryption header and data load part, and deciphers the data from the IP header. After the source address (PC of small station A) and destination address (FTPSever) of the IP packet, find out its corresponding transmission key from the database, and send the encryption header and the joint key calculated by small station A and the center to Decryption device decryption module, the data format is as follows:

Table 9

In the above message, the source address of the leftmost IP header is the address of the key management device, and the destination address is the address of the decryption device.

7. Decryption device The decryption module uses the joint key of the A-center to decrypt the session key in the current encrypted header, and then sends the plaintext session key back to the key management device. The data format is as follows:

Table 10

In the above message, the source address of the leftmost IP header is the address of the decryption device, and the destination address is the address of the key management device.

8. The key management device sends the plaintext session key and the transmission key of the destination FTP server to the encryption module of the encryption device. The format of the data sent to the encryption module is as follows:

Table 11

In the above message, the source address of the leftmost IP header is the address of the key management device, and the destination address is the address of the encryption device.

9. The encryption module encrypts the session key with the joint key of FTPSever and the center, and sends it back to the key management device. The format of the message sent back to the key management device is as follows:

Table 12

In the above message, the source address of the leftmost IP header is the address of the encryption device, and the destination address is the address of the key management device.

10. The key management device will integrate the ciphertext data of the new encryption header, and add a new IP header. The source address is the key management center (KMC) key management device, and the destination address is the border router. The format of the sent data is:

Table 13

In the above message, the source address of the leftmost IP header is the address of the key management device, and the destination address is the address of the border router.

11. The border router will send the data in the following format:

Table 14

12. After receiving the ciphertext data, the cipher machine at the master station decrypts the data and sends it to the FTPServer. The data format is:

Table 15

IP header TCP header plaintext

From the above description, it can be seen that the present invention achieves the following technical effects:

First, the key negotiation and data encryption process under star network and mesh network topology are designed, which can be applied to VSAT satellite communication system;

Second, the encryption scheme encrypts the payload data of the IP data packet, transparently transmits the IP and TCP headers, and directly transmits the Qos priority byte of the packet header without affecting the Qos technology;

Third, the IP encrypted data format stipulates the secret transmission and transparent transmission modes of data, and the transparent transmission mode can be used for business data that does not need to be encrypted;

Fourth, the IP cipher machine does not perform any processing on the signaling data of the IP layer, such as the three-way handshake, and the ACK information accelerated by TCP, and transmits it directly without affecting TCP acceleration. encryption and decryption processing speed.

Obviously, those skilled in the art should understand that each module or each step of the above-mentioned present invention can be realized by a general-purpose computing device, and they can be concentrated on a single computing device, or distributed in a network formed by multiple computing devices Alternatively, they may be implemented in program code executable by a computing device so that they may be stored in a storage device to be executed by a computing device, and in some cases, in an order different from that shown here The steps shown or described are carried out, or they are separately fabricated into individual integrated circuit modules, or multiple modules or steps among them are fabricated into a single integrated circuit module for implementation. As such, the present invention is not limited to any specific combination of hardware and software.

The above descriptions are only preferred embodiments of the present invention, and are not intended to limit the present invention. For those skilled in the art, the present invention may have various modifications and changes. Any modifications, equivalent replacements, improvements, etc. made within the spirit and principles of the present invention shall be included within the protection scope of the present invention.

Claims (6)

1. the processing method of IP message in satellite communication, is characterized in that, comprising:

Receive the information source data from the first small station that main website sends, wherein, described information source data comprise: data division and TCP/UDP header part, and wherein, described TCP/UDP header part is the data of transparent transmission mode;

Be decrypted the key after the first transmission security key encryption carried in described information source data, wherein, described first transmission security key is transmission security key corresponding to described first small station, and described key is the key to the decrypt data that described data division carries;

Utilizing the second transmission security key to be encrypted deciphering the key that obtains, obtaining the key after the second transmission security key encryption, wherein, described second transmission security key is transmission security key corresponding to the second small station, and described second small station is the recipient of described information source data;

Key after first transmission security key encryption is replaced with the key after the second transmission security key encryption, sends the information source data after replacing process to described main website.

2. method according to claim 1, it is characterized in that, described information source data carry the indication information being used to indicate the data that whether carry described data division and encrypting, wherein, when having carried out described encryption, described indication information has been designated as close arq mode; When not carrying out described encryption, described indication information is designated as transparent transmission mode;

Before the key after the first transmission security key encryption carried in described information source data is decrypted, also comprise: judge whether to be decrypted process according to described indication information;

The key after the first transmission security key encryption carried in described information source data is decrypted, comprises: when described indication information is designated as close arq mode, the key after the first transmission security key encryption carried in described information source data is decrypted.

3. method according to claim 2, is characterized in that, described method also comprises: when described indication information is designated as transparent transmission mode, be not decrypted process, sends described information source data directly to main website.

4. the processing unit of IP message in satellite communication, is characterized in that, comprising:

Receiver module, for receiving the information source data from the first small station that main website sends, wherein, described information source data comprise: data division and TCP/UDP header part, and wherein, described TCP/UDP header part is the data of transparent transmission mode;

Deciphering module, for being decrypted the key after the first transmission security key encryption carried in described information source data, wherein, described first transmission security key is transmission security key corresponding to described first small station, and described key is the key to the decrypt data that described data division carries;

Encrypting module, for utilizing the second transmission security key to be encrypted deciphering the key obtained, obtain the key after the second transmission security key encryption, wherein, described second transmission security key is transmission security key corresponding to the second small station, and described second small station is the recipient of described information source data;

Sending module, for the key after the first transmission security key encryption is replaced with the key after the second transmission security key encryption, sends the information source data after replacing process to described main website.

5. device according to claim 4, it is characterized in that, described information source data carry to be used to indicate whether carried out the first indication information encrypted to the data that described data division carries, wherein, when having carried out described first encryption, described indication information has been designated as close arq mode; When not carrying out described first encryption, described indication information is designated as transparent transmission mode;

Described device also comprises: judge module, is connected with described receiver module, for judging whether to be decrypted process according to described indication information;

Described deciphering module, is connected with described judge module, for when described indication information is designated as close arq mode, is decrypted the key after the first transmission security key encryption carried in described information source data.

6. device according to claim 5, is characterized in that, described sending module, for when described indication information is designated as transparent transmission mode, sends described information source data directly to main website.