Packet processing method, apparatus, and system

A packet processing method of forwarding a packet between a first node and a second node, comprising:

• generating, by the second node, a second packet, wherein second address information in a second packet header of the second packet indicates that a first receiving party of the second packet is a relay device, wherein a sending party of the second packet is the second node, wherein a second receiving party of the second packet is the first node, and wherein the second address information in the second packet header includes a second sequence of addresses;
• generating, by the second node, second additional authentication data according to the second address information in the second packet header of the second packet using a second rule, and encrypting data in the second packet to form an encrypted second packet using the second additional authentication data and a session key between the first node and the second node;
• and
• sending, by the second node, the encrypted second packet to the relay device, wherein the first node receives a first packet from the relay device, wherein the first packet comprises the data in the second packet, wherein first address information that is part of a first packet header of the first packet indicates that a receiving party of the first packet is the first node, a first sending party of the first packet is the relay device, and a second sending party of the first packet is the second node, and wherein the first address information in the first packet header includes a first sequence of addresses that is different than the second sequence of addresses in the second packet header,
• wherein after receiving the first packet, the first node:
• generates first additional authentication data according to the first address information in the first packet header of the first packet by using a first rule;
• and
• decrypts data in the first packet by using the first additional authentication data and the session key between the first node and the second node, wherein the first additional authentication data is the same as the second additional authentication data.

A packet processing apparatus, comprising:

• a communications interface;
• a memory coupled to the communications interface;
• a processor coupled to the memory;
• and
• a communications bus coupled to the processor, wherein the processor is configured to perform the following steps according to instructions saved in the memory:
• receive a first packet from a relay device, wherein the first packet comprises data in a second packet from a second node to the relay device, wherein the data in the second packet is encrypted by using second additional authentication data and a session key between a first node and the second node, wherein the second additional authentication data is generated by the second node according to second address information in a second packet header of the second packet by using a second rule, wherein the second address information in the second packet header includes a second sequence of addresses, and wherein the second address information in the second packet header of the second packet indicates that a first receiving party of the second packet is the relay device, a sending party of the second packet is the second node, and a second receiving party of the second packet is the first node;
• generate first additional authentication data according to first address information in a first packet header of the first packet by using a first rule, wherein the first address information in the first packet header includes a first sequence of addresses that is different than the second sequence of addresses in the second packet header, wherein the first address information that is part of the first packet header of the first packet indicates that a receiving party of the first packet is the first node, a first sending party of the first packet is the relay device, and a second sending party of the first packet is the second node, and wherein the first additional authentication data generated by using the first rule is the same as the second additional authentication data generated by using the second rule;
• and
• decrypt data in the first packet using the first additional authentication data and the session key between the first node and the second node, wherein the first additional authentication data is the same as the second additional authentication data.

A packet processing apparatus, comprising:

• a communications interface;
• a memory;
• a processor;
• and
• a communications bus coupled to the communications interface, the memory, and the processor, wherein the processor is configured to perform the following steps according to instructions saved in the memory:
• generate a second packet, wherein second address information in a second packet header of the second packet indicates that a first receiving party of the second packet is a relay device, a sending party of the second packet is a second node, and a second receiving party of the second packet is a first node, and wherein the second address information in the second packet header includes a second sequence of addresses;
• generate second additional authentication data according to the second address information in the second packet header of the second packet using a second rule;
• encrypt data in the second packet to form an encrypted second packet using the second additional authentication data and a session key between the first node and the second node;
• and
• send the encrypted second packet to the relay device so that after receiving the second packet, the relay device sends a first packet to the first node, wherein the first packet comprises data in the second packet, wherein first address information that is part of a first packet header of the first packet indicates that a receiving party of the first packet is the first node, a first sending party of the first packet is the relay device, and a second sending party of the first packet is the second node, and wherein the first address information in the first packet header includes a first sequence of addresses that is different than the second sequence of addresses in the second packet header,
• wherein after receiving the first packet, the first node generates first additional authentication data according to at least the first address information in the first packet header of the first packet by using a first rule, and decrypts data in the first packet by using the first additional authentication data and the session key between the first node and the second node, and
• wherein the first additional authentication data is the same as the second additional authentication data.