[go: up one dir, main page]

WO2018130079A1 - Procédé de chiffrement de protocole de sécurité de protocole internet (ipsec) et dispositif de réseau - Google Patents

Procédé de chiffrement de protocole de sécurité de protocole internet (ipsec) et dispositif de réseau Download PDF

Info

Publication number
WO2018130079A1
WO2018130079A1 PCT/CN2017/119487 CN2017119487W WO2018130079A1 WO 2018130079 A1 WO2018130079 A1 WO 2018130079A1 CN 2017119487 W CN2017119487 W CN 2017119487W WO 2018130079 A1 WO2018130079 A1 WO 2018130079A1
Authority
WO
WIPO (PCT)
Prior art keywords
packet
encrypted
network device
hard
address
Prior art date
Application number
PCT/CN2017/119487
Other languages
English (en)
Chinese (zh)
Inventor
邹远鹏
刘家晓
刘福元
Original Assignee
京信通信系统（中国）有限公司
京信通信系统（广州）有限公司
京信通信技术(广州)有限公司
天津京信通信系统有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 京信通信系统（中国）有限公司, 京信通信系统（广州）有限公司, 京信通信技术(广州)有限公司, 天津京信通信系统有限公司 filed Critical 京信通信系统（中国）有限公司
Publication of WO2018130079A1 publication Critical patent/WO2018130079A1/fr

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H04L63/1441—Countermeasures against malicious traffic

Definitions

  • the embodiments of the present invention relate to the field of communications technologies, and in particular, to an Internet protocol security IPSec protocol encryption method and a network device.
  • the network is becoming more and more popular, and the network security problems that come with it are of great concern.
  • the replay attack suffered by the client the sender sends a protocol (Internet Protocol, IP for short) message to the receiver.
  • IP Internet Protocol
  • IP Internet Protocol
  • the Internet Protocol Security (IPSec) protocol has been used to solve this problem.
  • the IPSec protocol defines a sequence number (SN) field for recording the serial number of the IP packet.
  • the SN is unique when the sender sends packets in the same group of SA information. For example, the receiver receives an IP packet with sequence number 5. When it receives an IP packet with sequence number 5 again, it rejects it. Receive the repeatedly sent message.
  • DSP Digital Signal Processing
  • ARM Advanced Reduced Instruction Set Computer Machine
  • POWERPC Multi-core heterogeneous integrated chips such as Performance Optimization With Enhanced RISC-Performance Computing
  • CPU Central Processing Unit
  • POWERPC Enhanced RISC-Performance Computing
  • the multi-core heterogeneous network device processes the data, multiple threads process the packets in parallel.
  • the IP packets are sent, they are encrypted in different cryptographic modules, which easily leads to the serial number of the IP packets encapsulated by the IPSec protocol received by the receiver.
  • the out-of-order sequence is likely to cause the IP packet to be recognized as a replay packet and discarded incorrectly.
  • the embodiment of the present invention provides an Internet protocol security IPSec protocol encryption method and a network device, which are used to effectively solve the problem that the IP packet sequence number sent by the multi-core heterogeneous network device cannot be saved in the prior art.
  • an embodiment of the present application provides an Internet Protocol Security IPSec protocol encryption method, which is applicable to a control plane processor core including at least one control plane data processing and at least one user plane for processing user plane data.
  • the multi-core heterogeneous network device of the processor core the method includes: the network device acquires the first IP packet by using the control plane processor core; and the network device determines, by using the control plane processor core, that the first IP packet is encrypted.
  • the network device allocates a sequence number to the first IP packet through the hardware encryption module. And performing hard encryption to obtain the encrypted first IP packet; the network device sends the encrypted first IP packet through the network card.
  • the embodiment of the present application provides a network device for encrypting an Internet Protocol security IPSec protocol, including at least one control plane processor core for processing control plane data and at least one processing of user plane data.
  • a user plane processor core the network device includes: a control plane processor core, configured to obtain a first IP packet; and a hardware encryption module, configured to determine, by using a control plane processor core, that the first IP packet is to be encrypted In the case of the first IP packet, and in the case where the first IP packet needs to be hard-encrypted by the control plane processor core, the serial number is assigned to the first IP packet, and hard encryption is performed to obtain the encrypted first An IP packet; the network card is configured to send the encrypted first IP packet.
  • an embodiment of the present application provides a network device, including:
  • At least one processor and,
  • the memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any of the IPSec protocols of the first aspect described above Encryption method.
  • an embodiment of the present application provides a non-transitory computer readable storage medium, where the non-transitory computer readable storage medium stores computer instructions, where the computer instructions are used to cause the computer to perform the first aspect or the A method in any of the possible embodiments on the one hand.
  • an embodiment of the present application provides a computer program product, where the computer program product includes a calculation program stored on a non-transitory computer readable storage medium, the computer program includes program instructions, when the program instruction is When executed by a computer, the computer is caused to perform the method of any of the first aspect or the first aspect of the first aspect.
  • the network device obtains the first IP packet by using the control plane processor core; and the network device determines, by using the control plane processor core, that the first IP packet is the first IP packet to be encrypted. And determining, according to the information of the first IP packet, that the first IP packet needs to be hard-encrypted: the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the first encryption. IP packet; the network device sends the encrypted first IP packet through the network card. It can be seen that, in the embodiment of the present application, the packet to be encrypted is further processed, and the packet to be encrypted and hard-encrypted is encrypted by the hardware encryption module. The packet is encrypted by an encryption module. Therefore, in this embodiment, the sequence number of the packet is guaranteed to be saved, and the packet caused by encrypting the packet by using two encryption modules in the prior art is avoided. The serial number of the text is not guaranteed.
  • FIG. 1 is a schematic structural diagram of an Internet protocol security IPSec protocol encryption system according to an embodiment of the present disclosure
  • FIG. 2 is a schematic flowchart of a method for encrypting an Internet protocol security IPSec protocol according to an embodiment of the present application
  • FIG. 3 is a schematic flowchart of another method for encrypting an Internet protocol security IPSec protocol according to an embodiment of the present application
  • FIG. 4 is a schematic structural diagram of a network device for encrypting an Internet protocol security IPSec protocol according to an embodiment of the present application
  • FIG. 5 is a schematic structural diagram of a network device according to an embodiment of the present disclosure.
  • FIG. 1 is a schematic diagram showing an architecture of an Internet Protocol Security IPSec protocol encryption system to which the embodiment of the present application is applied, the system architecture being applicable to at least one control plane processor core including at least one control plane data processing and at least one A multi-core heterogeneous network device of a user plane processor core that processes user plane data; as shown in FIG. 1, the system architecture 100 includes a control plane processor core 110, a user plane processor core 120, a hardware encryption module 130, and a network card.
  • the control plane processor core 110 includes a network protocol stack 111 and a network card driver 112.
  • the network protocol stack 111 is connected to the network card driver 112.
  • the control plane processor core 110 can be connected to the user plane processor core 120 or can be connected to the network card.
  • control plane processor core 110 may be connected to the user plane processor core 120 through the network card driver 112, or may be connected to the network card 140 through the network card driver 112; optionally, the user plane processor core 120 is connected to the hardware encryption module 130.
  • the network card 140 can also be connected; the hardware encryption module 130 is connected to the network card 140; wherein the control plane processor core 110 is configured to process control plane data, Surface processor core 120 for processing user plane data.
  • the control plane processor core 110 may be a POWERPC core or an ARM core; optionally, the user plane processor core 120 may be a DSP core.
  • the network protocol stack 111 in the control plane processor core 110 processes the first IP packet obtained by the control plane data, and determines whether the first IP packet needs to be encrypted through the network card driver 112.
  • the communication technology sends the encrypted first IP packet to the user plane processor core 120, and then sends it to the hardware encryption module 130 through the user plane processor core 120 for encryption and assigns a serial number, and then encrypts the encrypted number through the network card 140.
  • An IP packet is sent out; on the other hand, the second IP packet obtained by the user plane data processed by the user plane processor 120 is sent to the hardware encryption module 130 for encryption and assigned a serial number, and then encrypted by the network card 140.
  • the first IP packet is sent out.
  • FIG. 2 is a schematic flowchart diagram showing an encryption method of an Internet protocol security IPSec protocol provided by an embodiment of the present application.
  • an Internet protocol security IPSec protocol encryption method provided by an embodiment of the present application is applicable to a control plane processor core including at least one control plane data processing. And a multi-core heterogeneous network device of at least one user plane processor core that processes user plane data, the method comprising the steps of:
  • Step S201 The network device acquires the first IP packet by using the control plane processor core.
  • Step S202 The network device determines, by the control plane processor, that the first IP packet is the first IP packet to be encrypted, and the network device determines the first IP packet according to the information of the first IP packet.
  • the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the encrypted first IP packet.
  • Step S203 The network device sends the encrypted first IP packet through the network card.
  • the first IP packet may be an IP packet encapsulated by the control plane data processed by the control plane processor core.
  • the information of the first IP packet includes: a source IP address and a destination IP address in the packet; optionally, the control plane processor core may be a running Linux operating system. Core; determining whether the first IP packet needs to be encrypted in multiple ways, an optional way for the network protocol stack in the control plane processor core to determine whether the first IP packet needs to be encrypted; If the IP packet needs to be encrypted, the first IP packet is sent to the network card driver; the network card driver determines whether the IP packet to be encrypted needs to be hard-encrypted; and the first IP packet needs hard encryption.
  • the first IP packet that needs to be hard-encrypted is sent to the user plane processor core through Inter-Processing Communication (IPC) technology, and then the serial number is assigned to the first IP packet by the hardware encryption module. Hard encryption.
  • IPC Inter-Processing Communication
  • step S203 the hardware encryption module sends the encrypted first IP packet through the network card.
  • the network device obtains the first IP packet by using the control plane processor core; and the network device determines, by using the control plane processor core, that the first IP packet is the first IP packet to be encrypted. And determining, according to the information of the first IP packet, that the first IP packet needs to be hard-encrypted: the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the first encryption. IP packet; the network device sends the encrypted first IP packet through the network card. It can be seen that, in the embodiment of the present application, the packet to be encrypted is further processed, and the packet to be encrypted and hard-encrypted is encrypted by the hardware encryption module. The packet is encrypted by an encryption module. Therefore, in this embodiment, the sequence number of the packet is guaranteed to be saved, and the packet caused by encrypting the packet by using two encryption modules in the prior art is avoided. The serial number of the text is not guaranteed.
  • the network device determines that the first IP packet needs to be hard-encrypted according to the information of the first IP packet, and needs to meet any one of the following two conditions: First, the network device determines the first IP packet. In the case of the tunnel mode, and determining that the source IP address in the first IP packet is an IP address negotiated based on the IPSec protocol, the first IP packet needs to be hard-encrypted; If the IP packet is in the transmission mode, the IP address set in the protected state is obtained, and the destination IP address in the first IP packet is determined to be one of the IP address sets. The first IP packet needs to be hard encrypted.
  • the information of the first IP packet includes: a source IP address and a destination IP address in the packet.
  • the two network devices are respectively a client and a cloud server, where the client The IP address of the IP address is IP 11 and the IP address of the cloud server is IP 21.
  • the IPSec link is set up to send and receive packets.
  • the client sends the first IP packet to the cloud server as an example:
  • an IPSec tunnel is established between the client and the cloud server, and the IP address of the packet is negotiated based on the IPSec protocol, and the client negotiates the IP address based on the IPSec protocol.
  • the IP address of the cloud server based on the IPSec protocol is IP 22.
  • the source IP address of the first packet is set to IP 12 ; After determining that the source IP address in the first packet is IP 12 , it is determined that the first IP packet needs to be hard encrypted.
  • an IPSec link is established between the client and the cloud server, and the set of IP addresses in the protected state is preset in the cloud server: IP 31 , IP 32 , IP 33 , IP 34 , IP 35 , IP 36 , each IP address in the IP address set corresponds to one network device; the client and one network device in the IP address set communicate, first obtain the IP address set, and the client is in the cloud
  • the server sends the first IP packet to be encrypted
  • the network protocol stack of the client sets the destination IP address in the first IP packet to IP 34 , and the network card driver in the client determines the first IP packet.
  • the destination IP address IP 34 in the IP address set: IP 31 , IP 32 , IP 33 , IP 34 , IP 35 , IP 36 determines that the first IP packet needs to be hard encrypted.
  • the determining, by the network device, that the first IP packet does not need to be hard-encrypted includes two cases: in the first case, the network device determines that the first IP packet is in the tunnel mode, and determines the first IP packet.
  • the source IP address in the text is not the IP address negotiated based on the IPSec protocol, and the first IP packet is not required to be hard-encrypted.
  • the network device determines that the first IP packet is in the transmission mode. Obtaining the preset IP address set in the cloud server. If the destination IP address in the first IP packet is not in the IP address set, the first IP packet does not need to be hard. encryption.
  • the information about the first IP packet is determined by the network card driver, and then the first IP packet needs to be hard-encrypted. Therefore, the IP packet that needs to be hard-encrypted can be effectively determined. And sent to the hardware encryption module for encryption, thereby avoiding the problem that the serial number of the transmitted message caused by the soft encryption of the first IP packet directly on the control plane processor core is not preserved.
  • the method further includes: the network device determining, by the control plane processor core, that the first IP packet is the first IP packet that is not required to be encrypted. In case: the network device sends the first IP packet through the network card.
  • the control plane processor determines that the first IP packet is the first IP packet that is not to be encrypted, the first IP packet is sent to the network card driver through the sending interface of the common IP packet; The IP packets that need to be encrypted are directly sent out through the network card, which avoids wasting resources caused by sending the first IP packet that does not need to be encrypted to the network card driver.
  • the network device further includes: determining, by the network device, that the first IP packet is not required according to the information of the first IP packet In the case of hard encryption: the network device sends the first IP packet through the network card.
  • the network card driver can determine whether the first IP packet needs to be hard-encrypted, and the first IP packet that does not need to be hard-encrypted is directly sent to the network card, thus avoiding the first step that does not require hard encryption. The waste of resources caused by the sending of IP packets to the user plane processor core.
  • the method for encrypting the Internet protocol security IPSec protocol further includes: the network device acquiring the second IP packet by using the user plane processor core; and determining, by the network device, the second IP packet according to the information of the second IP packet
  • the network device assigns a serial number to the second IP packet through the hardware encryption module, and performs hard encryption to obtain the encrypted second IP packet; the network device sends the encrypted second IP packet through the network card.
  • the user plane data processed by the user plane processor core obtains the second IP packet; if the second IP packet needs to be hard encrypted, the second IP packet to be hard encrypted is required. Sending to the hardware encryption module for hard encryption; if the second IP packet does not require hard encryption, sending the second IP packet through the network card; therefore, the first IP packet of the control plane processor core that needs to be hard encrypted The second IP packet to be encrypted and sent by the user plane processor core is sent to the hardware encryption module for encryption.
  • the encrypted IP packet sent by the multi-core heterogeneous network device is assigned a serial number through the hardware encryption module.
  • Hard encryption on the one hand, avoids the problem that the serial number is not preserved due to multi-thread parallel encryption IP packets in multi-core heterogeneous network devices; on the other hand, there is no need to do any shared memory between multiple cores in a multi-core heterogeneous network device. Or other mutually exclusive, synchronous operations, to avoid resource mutual exclusion issues.
  • the first IP packet is determined by the control plane processor to be the first IP packet to be encrypted, and the network device determines a preset security policy route, where the security policy route includes at least one IP address. And determining, by the network device, that the first IP packet is the first IP packet to be encrypted, if the destination IP address in the first IP packet belongs to one of the at least one IP address.
  • the control plane processor core includes a network protocol stack of a Linux operating system; the application determines the first IP packet to be encrypted by modifying the network protocol stack; optionally, the network protocol stack preset security policy routing
  • the security policy route includes at least one IP address.
  • the IP address is 192.168.10.15 to 192.168.10.30 corresponding to a secure route. If the destination IP address in the first IP packet is 192.168.10.25 Then, the network protocol stack finds the secure route corresponding to the IP address of 192.168.10.25 according to the security policy route, and determines that the first IP packet is the first IP packet to be encrypted.
  • the network device can determine whether the first IP packet needs to be encrypted through the control plane processor, and then send the packet to be encrypted to the network card driver, thereby avoiding the first IP packet to be encrypted on the control plane processor core.
  • Soft encryption is performed to prevent the CPU from consuming too many resources for soft encryption, which improves the performance of the system.
  • the present application provides an optional method for hard-encrypting the first IP packet on the control plane processor core; the control plane processor core uses an ARM core as an example, and the user plane processor core uses a DSP.
  • the xfrm_lookup function is set in the network protocol stack of the ARM core. The xfrm_lookup function is used to identify the sending interface that needs to be used for the IPSec protocol to perform the encapsulation processing and return the first IP packet; for example, in the network protocol stack.
  • the security policy corresponding to the IP address in the first IP packet is determined by the xfrm_lookup function, and the first IP packet is encrypted.
  • the sending interface is sent to the network card driver; the network card driver determines whether the first IP packet needs to be hard-encrypted. If hard encryption is required, the first IP packet that needs to be hard-encrypted is sent to the DSP core through the IPC technology; Sending the first IP packet to the hardware encryption module to allocate the serial number and performing hard encryption; meanwhile, for the second IP packet processed on the DSP core that needs to be hard-encrypted, the DSP core will need to be performed.
  • the encrypted second IP packet is also sent to the hardware encryption module to allocate the serial number and is hard-encrypted; thus, the IP packets sent by the nuclear heterogeneous network device are all assigned the serial number through the hardware encryption module, and are hard.
  • the effect of the single-threaded encrypted IP packet in the multi-core heterogeneous network device is achieved, so that the sequence number of the hard-encrypted IP packet is increased in order to avoid the problem that the packet is discarded by the peer anti-replay mechanism.
  • FIG. 3 is a schematic flowchart of another Internet protocol security IPSec protocol encryption method provided by the embodiment of the present application.
  • the system architecture shown in FIG. 1 is shown in FIG.
  • Another Internet Protocol Security IPSec protocol encryption method is applicable to a multi-core heterogeneous network including at least one control plane processor core for processing control plane data and at least one user plane processor core for processing user plane data Device, the method includes the following steps:
  • Step S301 The network device acquires the first IP packet by using the control plane processor core.
  • Step S302 The network device determines, by the control plane, that the destination IP address in the first IP packet belongs to one of the at least one IP address in the preset security policy route; if yes, step S303 is performed; if not, Then executing step S313;
  • Step S303 The network device determines, by using the network protocol stack, that the first IP packet is the first IP packet to be encrypted.
  • Step S304 The network device determines that the first IP packet is the tunnel mode or the transmission mode by using the network card driver; if it is the tunnel mode, step S305 is performed; if it is the transmission mode, step S306 is performed;
  • Step S305 The network device determines, by the network card driver, whether the source IP address in the first IP packet is an IP address negotiated based on the IPSec protocol; if yes, step S307 is performed; if not, step S313 is performed;
  • Step S306 The network device acquires the IP address set in the protected state preset in the cloud server, and determines whether the destination IP address in the first IP packet is one of the IP address sets; if yes, step S307 is performed; if not, Then executing step S313;
  • Step S307 The network device determines that the first IP packet needs to be hard-encrypted.
  • Step S308 Send the first IP packet to the user plane processor core by using the network card driver in the control plane processor core;
  • Step S309 The network device acquires the second IP packet by using the user plane processor core.
  • Step S310 The network device determines whether the second IP packet needs to be hard-encrypted according to the information of the second IP packet; if yes, step S311 is performed; if not, step S314 is performed;
  • Step S311 The network device sends the first IP packet and the second IP packet to the hardware encryption module through the user plane processor core.
  • Step S312 The network device allocates a serial number to the first IP packet and the second IP packet by using the hardware encryption module, and performs hard encryption respectively to obtain the encrypted first IP packet and the encrypted second IP packet.
  • Step S313 Send the first IP packet to the network card by using a network card driver
  • Step S314 The network device sends the first IP packet and the encrypted second IP packet through the network card.
  • the network device obtains the first IP packet through the control plane processor core; the network device determines that the first IP packet is the first IP packet to be encrypted through the control plane processor core. If the first IP packet needs to be hard-encrypted according to the information of the first IP packet, the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the encrypted IP address.
  • the packet to be encrypted is further processed, and the packet to be encrypted and hard-encrypted is encrypted by the hardware encryption module, that is, only one encryption is performed in the embodiment of the present application.
  • the module encrypts the packet, so that the sequence number of the packet can be guaranteed in the embodiment of the present application, and the packet is avoided by using two encryption modules as in the prior art.
  • the problem that the sequence number of the packet caused by the encryption is not preserved; moreover, the problem that the IP packet is discarded is avoided in the anti-replay detection process, and the security of the data is increased.
  • the method in the embodiment of the present application avoids the problem of system performance degradation caused by soft encryption of the first IP packet in the control plane processor core, and does not need to do any shared memory between multiple cores in the multi-core heterogeneous network device.
  • Other mutually exclusive and synchronous operations avoid the problem of mutual exclusion of resources and greatly simplify the programming.
  • FIG. 4 is a schematic structural diagram of a network device for Internet Protocol Security IPSec protocol encryption provided by an embodiment of the present application.
  • a network device for encrypting the Internet protocol security IPSec protocol provided by the embodiment of the present application is used to execute the foregoing method, as shown in FIG. 4, which is used for security protocol IPSec encryption of the Internet protocol.
  • the network device 400 includes a control plane processor core 401, a hardware encryption module 403, and a network card 404, and a user plane processor core 402; wherein:
  • control plane processor core 401 configured to acquire a first IP packet
  • the hardware encryption module 403 is configured to: when the first IP packet is determined by the control plane processor core 401 as the first IP packet to be encrypted, and pass through the control plane processor core 401 When the first IP packet is to be hard-encrypted, the first IP packet is assigned a serial number, and hard encryption is performed to obtain the encrypted first IP packet.
  • the network card 404 is configured to send the encrypted first IP packet.
  • control plane processor core 401 is configured to: when determining that the first IP packet is in a tunnel mode, and determine that the source IP address in the first IP packet is based on an IPSec protocol If the IP address of the negotiation is performed, the first IP packet needs to be hard-encrypted; and when the first IP packet is determined to be in the transmission mode, the IP address set preset in the cloud server is obtained. And determining that the first IP packet needs to be hard-encrypted if the destination IP address in the first IP packet is one of the IP address sets.
  • the network card 404 is further configured to: when the first IP packet is not required to be hard-encrypted by the control plane processor core 401: sending the first IP packet.
  • the network card 404 is further configured to: when the first IP packet is determined by the control plane processor core 401 as a first IP packet that is not required to be encrypted: the network device The first IP packet is sent by the network card 404.
  • the network device further includes: a user plane processor core 402, configured to acquire a second IP packet;
  • the hardware encryption module 403 is further configured to: when the user plane processor core 402 determines that the second IP packet needs to be hard-encrypted: assign a serial number to the second IP packet, and Performing hard encryption to obtain the encrypted second IP packet; the network card 404 is further configured to: send the encrypted second IP packet.
  • control plane processor core 401 is configured to: determine a preset security policy route, where the security policy route includes at least one IP address; and determine the first IP packet. If the destination IP address belongs to one of the at least one IP address, the first IP packet is determined to be the first IP packet to be encrypted.
  • the network device obtains the first IP packet through the control plane processor core; the network device determines that the first IP packet is the first IP packet to be encrypted through the control plane processor core. If the first IP packet needs to be hard-encrypted according to the information of the first IP packet, the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the encrypted IP address.
  • the packet to be encrypted is further processed, and the packet to be encrypted and hard-encrypted is encrypted by the hardware encryption module, that is, only one encryption is performed in the embodiment of the present application.
  • the module encrypts the packet, so that the sequence number of the packet can be guaranteed in the embodiment of the present application, and the packet is avoided by using two encryption modules as in the prior art. Packet sequence number does not guarantee the problem caused by the encryption row sequence; and, to avoid the problem of IP packets are discarded in antkeplay detection process, increase data security.
  • the method in the embodiment of the present application avoids the problem of system performance degradation caused by soft encryption of the first IP packet in the control plane processor core, and does not need to do any shared memory between multiple cores in the multi-core heterogeneous network device.
  • Other mutually exclusive and synchronous operations avoid the problem of mutual exclusion of resources and greatly simplify the programming.
  • the present application provides a network device including at least one processor; and a memory communicatively coupled to the at least one processor; the memory storing instructions executable by the at least one processor, The instructions are executed by the at least one processor to enable the at least one processor to perform the IPSec protocol encryption method in the above embodiments.
  • FIG. 5 is a schematic structural diagram of a network device provided by the present application.
  • the network device includes a transceiver 501, a processor 502, a memory 503, and a communication interface 504; wherein the transceiver 501, the processor 502, the memory 503, and the communication interface 504 are connected to one another via a bus 505.
  • the memory 503 is used to store programs.
  • the program can include program code, the program code including computer operating instructions.
  • the memory 503 may be a volatile memory, such as a random-access memory (RAM), or a non-volatile memory, such as a flash memory.
  • RAM random-access memory
  • non-volatile memory such as a flash memory.
  • HDD hard disk drive
  • SSD solid-state drive
  • the memory 503 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof:
  • Operation instructions include various operation instructions for implementing various operations.
  • Operating system Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.
  • the bus 505 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus.
  • PCI peripheral component interconnect
  • EISA extended industry standard architecture
  • the bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 5, but it does not mean that there is only one bus or one type of bus.
  • the communication interface 504 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface.
  • the Ethernet interface can be an optical interface, an electrical interface, or a combination thereof.
  • the wireless communication interface can be a WLAN interface.
  • the processor 502 can be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP. It can also be a hardware chip.
  • the hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof.
  • the PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination.
  • the transceiver 501 is configured to obtain a first IP packet, and send the encrypted first IP packet.
  • the processor 502 is configured to read a program in the memory 503 and perform the following methods:
  • the first IP packet is determined to be the first IP packet to be encrypted, in the case that the first IP packet needs to be hard-encrypted, the first IP packet is allocated a sequence. Number, and perform hard encryption to obtain the encrypted first IP packet;
  • the memory 503 is configured to store one or more executable programs, and may store data used by the processor 502 when performing operations.
  • the processor 502 is configured to: when determining that the first IP packet is in a tunnel mode, and determine that the source IP address in the first IP packet is negotiated according to an IPSec protocol. And determining, by the IP address, that the first IP packet is to be hard-encrypted; and determining that the first IP packet is in the transmission mode, acquiring a preset IP address set in a protection state in the cloud server, determining When the destination IP address in the first IP packet is one of the IP address sets, it is determined that the first IP packet needs to be hard encrypted.
  • the transceiver 501 is further configured to: when the processor 502 determines that the first IP packet does not need to be hard-encrypted: sending the first IP packet.
  • the transceiver 501 is further configured to: when the first IP packet is determined by the processor 502 to be a first IP packet that does not need to be encrypted: sending the first IP Message.
  • the transceiver 501 is further configured to obtain a second IP packet, and send the encrypted second IP packet.
  • the processor 502 is further configured to: determine that the second IP packet needs to be performed. In the case of hard encryption, a serial number is assigned to the second IP packet, and hard encryption is performed to obtain an encrypted second IP packet.
  • the processor 502 is configured to: determine a preset security policy route, where the security policy route includes at least one IP address; and determine a destination IP address in the first IP packet. In the case of one of the at least one IP address, the first IP packet is determined to be the first IP packet to be encrypted.
  • embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • the present application also provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the IPSec described in any of the above Protocol encryption method.
  • the present application also provides a computer program product comprising a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer And causing the computer to perform the IPSec protocol encryption method described in any of the above.
  • Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG.
  • These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device.
  • the computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device.
  • the apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.
  • These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device.
  • the instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

Des modes de réalisation de la présente invention concernent le domaine technique des communications, et en particulier un procédé de chiffrement d'une sécurité de protocole Internet (IPSec) et un dispositif de réseau, destiné à être utilisé pour résoudre efficacement le problème dans l'état de la technique d'incapacité à préserver l'ordre du numéro de séquence d'un paquet IP envoyé par un dispositif de réseau hétérogène multi-cœur. Le procédé comprend les étapes suivantes : un dispositif de réseau acquiert un premier paquet IP au moyen d'un cœur de processeur de plan de commande ; lorsque le dispositif de réseau détermine, au moyen du cœur de processeur de plan de commande, que le premier paquet IP est un premier paquet IP à chiffrer, et détermine, en fonction des informations du premier paquet IP, que le premier paquet IP doit être chiffré physiquement, le dispositif de réseau attribue un numéro de séquence au premier paquet IP au moyen d'un module de chiffrement matériel et crypte le premier paquet IP pour obtenir un premier paquet IP chiffré ; le dispositif de réseau envoie le premier paquet IP chiffré au moyen d'une carte d'interface réseau. Ainsi, la présente invention résout efficacement le problème dans l'état de la technique d'incapacité à préserver l'ordre du numéro de séquence d'un paquet IP envoyé par un dispositif de réseau hétérogène multi-cœur.
PCT/CN2017/119487 2017-01-11 2017-12-28 Procédé de chiffrement de protocole de sécurité de protocole internet (ipsec) et dispositif de réseau WO2018130079A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201710021178.8A CN106790221B (zh) 2017-01-11 2017-01-11 一种英特网协议安全IPSec协议加密方法和网络设备
CN201710021178.8 2017-01-11

Publications (1)

Publication Number Publication Date
WO2018130079A1 true WO2018130079A1 (fr) 2018-07-19

Family

ID=58949241

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2017/119487 WO2018130079A1 (fr) 2017-01-11 2017-12-28 Procédé de chiffrement de protocole de sécurité de protocole internet (ipsec) et dispositif de réseau

Country Status (2)

Country Link
CN (1) CN106790221B (fr)
WO (1) WO2018130079A1 (fr)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111049758A (zh) * 2019-11-22 2020-04-21 东软集团股份有限公司 一种实现报文QoS处理的方法、系统及设备
CN112543197A (zh) * 2020-12-04 2021-03-23 中船重工（武汉）凌久电子有限责任公司 一种xfrm框架下对ipsec实现硬件加解密的方法
CN113422753A (zh) * 2021-02-09 2021-09-21 阿里巴巴集团控股有限公司 数据处理方法、装置、电子设备及计算机存储介质
CN114079572A (zh) * 2020-08-11 2022-02-22 华为技术有限公司 网络攻击的防御方法、cp设备及up设备
CN115378764A (zh) * 2022-08-19 2022-11-22 山石网科通信技术股份有限公司 通信方法、装置、存储介质及电子装置
CN118694514A (zh) * 2024-08-28 2024-09-24 浙江省通信产业服务有限公司 一种元数据资产的加密通讯方法及系统
CN119538325A (zh) * 2024-09-26 2025-02-28 芯云晟(杭州)电子科技有限公司 多核并行加解密装置

Families Citing this family (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106790221B (zh) * 2017-01-11 2020-11-03 京信通信系统（中国）有限公司 一种英特网协议安全IPSec协议加密方法和网络设备
CN109714292B (zh) * 2017-10-25 2021-05-11 华为技术有限公司 传输报文的方法与装置
CN112015564B (zh) * 2019-05-28 2024-05-17 普天信息技术有限公司 加解密处理方法及装置
CN111800436B (zh) * 2020-07-29 2022-04-08 郑州信大捷安信息技术股份有限公司 IPSec隔离网卡设备及安全通信方法
CN118381684B (zh) * 2024-06-25 2024-09-10 杭州海康威视数字技术股份有限公司 软硬件协同加密的安全通信实现方法及网络设备

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102843235A (zh) * 2012-09-06 2012-12-26 汉柏科技有限公司 一种报文加/解密方法
CN104468309A (zh) * 2014-10-31 2015-03-25 成都卫士通信息产业股份有限公司 一种低速smp与高速密码卡的高效适配方法
US20160277358A1 (en) * 2015-03-20 2016-09-22 Vamsi K. Ambati Flow-Based Anti-Replay Checking
CN106341404A (zh) * 2016-09-09 2017-01-18 西安工程大学 基于众核处理器的IPSec VPN系统及加解密处理方法
CN106790221A (zh) * 2017-01-11 2017-05-31 京信通信技术(广州)有限公司 一种英特网协议安全IPSec协议加密方法和网络设备

Family Cites Families (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
TWI230532B (en) * 2002-03-05 2005-04-01 Admtek Inc Pipelined engine for encryption/authentication in IPSEC
JP2006050267A (ja) * 2004-08-04 2006-02-16 Matsushita Electric Ind Co Ltd ＩＰｓｅｃ通信方法及び通信制御装置並びにネットワークカメラ
KR101601790B1 (ko) * 2009-09-22 2016-03-21 삼성전자주식회사 암호키 선택장치를 구비하는 스토리지 시스템 및 암호 키 선택방법
CN102263794B (zh) * 2011-08-25 2013-10-23 北京星网锐捷网络技术有限公司 安全性处理方法、装置及处理芯片、网络设备
CN102968399A (zh) * 2012-10-22 2013-03-13 华为技术有限公司 多核处理器及其管理网口的复用方法

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN102843235A (zh) * 2012-09-06 2012-12-26 汉柏科技有限公司 一种报文加/解密方法
CN104468309A (zh) * 2014-10-31 2015-03-25 成都卫士通信息产业股份有限公司 一种低速smp与高速密码卡的高效适配方法
US20160277358A1 (en) * 2015-03-20 2016-09-22 Vamsi K. Ambati Flow-Based Anti-Replay Checking
CN106341404A (zh) * 2016-09-09 2017-01-18 西安工程大学 基于众核处理器的IPSec VPN系统及加解密处理方法
CN106790221A (zh) * 2017-01-11 2017-05-31 京信通信技术(广州)有限公司 一种英特网协议安全IPSec协议加密方法和网络设备

Cited By (11)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN111049758A (zh) * 2019-11-22 2020-04-21 东软集团股份有限公司 一种实现报文QoS处理的方法、系统及设备
CN111049758B (zh) * 2019-11-22 2022-12-09 东软集团股份有限公司 一种实现报文QoS处理的方法、系统及设备
CN114079572A (zh) * 2020-08-11 2022-02-22 华为技术有限公司 网络攻击的防御方法、cp设备及up设备
CN112543197A (zh) * 2020-12-04 2021-03-23 中船重工（武汉）凌久电子有限责任公司 一种xfrm框架下对ipsec实现硬件加解密的方法
CN113422753A (zh) * 2021-02-09 2021-09-21 阿里巴巴集团控股有限公司 数据处理方法、装置、电子设备及计算机存储介质
CN113422753B (zh) * 2021-02-09 2023-06-13 阿里巴巴集团控股有限公司 数据处理方法、装置、电子设备及计算机存储介质
CN115378764A (zh) * 2022-08-19 2022-11-22 山石网科通信技术股份有限公司 通信方法、装置、存储介质及电子装置
CN115378764B (zh) * 2022-08-19 2024-04-05 山石网科通信技术股份有限公司 通信方法、装置、存储介质及电子装置
CN118694514A (zh) * 2024-08-28 2024-09-24 浙江省通信产业服务有限公司 一种元数据资产的加密通讯方法及系统
CN118694514B (zh) * 2024-08-28 2024-10-25 浙江省通信产业服务有限公司 一种元数据资产的加密通讯方法及系统
CN119538325A (zh) * 2024-09-26 2025-02-28 芯云晟(杭州)电子科技有限公司 多核并行加解密装置

Also Published As

Publication number Publication date
CN106790221B (zh) 2020-11-03
CN106790221A (zh) 2017-05-31

Similar Documents

Publication Publication Date Title
WO2018130079A1 (fr) Procédé de chiffrement de protocole de sécurité de protocole internet (ipsec) et dispositif de réseau
US11336629B2 (en) Deterministic load balancing of IPSec packet processing
US10541984B2 (en) Hardware-accelerated payload filtering in secure communication
EP3215939B1 (fr) Procédé et dispositif de la communication sécurisée avec services en nuage partagés
US11729042B2 (en) IPSec acceleration method, apparatus, and system
US11509638B2 (en) Receive-side processing for encapsulated encrypted packets
US8677004B2 (en) Migration of logical partitions between two devices
US9992223B2 (en) Flow-based anti-replay checking
US11539747B2 (en) Secure communication session resumption in a service function chain
US20170155625A1 (en) Scalable intermediate network device leveraging ssl session ticket extension
WO2023005773A1 (fr) Procédé et appareil de transfert de message basés sur un stockage direct des données à distance, et carte réseau et dispositif
CN104639512B (zh) 网络安全方法和设备
US11133933B1 (en) Rapid secure authentication and communications through multitenant components in provider networks
US11102100B2 (en) Optimized and scalable method of detecting dead internet key exchange (IKE) peers
CN113810397B (zh) 协议数据的处理方法及装置
US9948568B2 (en) Packet size control using maximum transmission units for facilitating packet transmission
US10880265B1 (en) Systems and methods for improving network efficiency
US11805109B1 (en) Data transfer encryption offloading using session pairs
CN104601645A (zh) 一种数据包处理方法及装置
US11283768B1 (en) Systems and methods for managing connections
CN104104569B (zh) 建立vpn隧道的方法及服务器
CN105407137A (zh) 一种数据迁移方法、ip硬盘、ip盘网关及存储系统
US11722525B2 (en) IPsec processing of packets in SoCs
Barone Toward High-Speed Tunneling Technologies: A New WireGuard Parallel Architecture for Linear Throughput Scaling
CN119072901A (zh) 与安全关联相关的cpu和方法

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 17890962

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

32PN Ep: public notification in the ep bulletin as address of the adressee cannot be established

Free format text: NOTING OF LOSS OF RIGHTS PURSUANT TO RULE 112(1) EPC (EPO FORM 1205A DATED 28/10/2019)

122 Ep: pct application non-entry in european phase

Ref document number: 17890962

Country of ref document: EP

Kind code of ref document: A1