Secure communication implementation method with software and hardware collaborative encryption and network device

A secure communication implementation method with software and hardware collaborative encryption, applied to a network device, wherein the network device comprises an extended framework for routing and management (XFRM) module and a programmable logic (PL) hardware module, the method comprising:

• obtaining, by the XFRM module, message identification information and security association (SA) information corresponding to a first network packet, and recording a corresponding relationship between the message identification information and the SA information in a first mapping table;
• sending, by the XFRM module, the message identification information and the SA information to the PL hardware module;
• wherein the PL hardware module records the corresponding relationship between the message identification information and the SA information in a second mapping table;
• after receiving the first network packet, querying, by the XFRM module, the first mapping table through the message identification information of the first network packet to obtain the SA information corresponding to the message identification information;
• encapsulating, by the XFRM module, the SA information in the first network packet and sending an encapsulated first network packet to the PL hardware module;
• and
• after receiving the encapsulated first network packet, parsing, by the PL hardware module, the SA information from the encapsulated first network packet, performing Internet protocol security (IPSec) protection on the first network packet based on the SA information to obtain a secured first network packet, and sending the secured first network packet,
• wherein after querying, by the XFRM module, the first mapping table through the message identification information of the first network packet to obtain the SA information corresponding to the message identification information, the method further comprises:
• checking, by the XFRM module, whether an offload function is enabled, wherein, if the offload function is enabled, it indicates that the IP Sec protection is disabled, and if the offload function is disabled, it indicates that the IPSec protection is enabled;
• if the offload function is disabled, performing, by the XFRM module, the IPSec protection on the first network packet based on the SA information to obtain the secured first network packet, and sending the secured first network packet;
• if the offload function is enabled, performing, by the XFRM module, operations of encapsulating the SA information in the first network packet and sending the encapsulated first network packet to the PL hardware module.