WO2016165277A1

WO2016165277A1 - Ipsec diversion implementing method and apparatus

Info

Publication number: WO2016165277A1
Application number: PCT/CN2015/089869
Authority: WO
Inventors: 邢业平
Original assignee: 中兴通讯股份有限公司
Priority date: 2015-04-16
Filing date: 2015-09-17
Publication date: 2016-10-20
Also published as: CN106161386B; CN106161386A

Abstract

An internet protocol security (IPsec) diversion implementing method and apparatus. The method comprises: pre-associating different service instance modules and corresponding security policy database (SPD) modules, wherein there are two or more service instance modules, and there are two or more SPD modules. The method further comprises: a service instance module generates a message and sends the message to an SPD module associated therewith; the SPD module judges that it is necessary to perform IPsec processing on the message, and sends the message and information, indicative of necessity to perform IPsec processing on the message, to an authentication header (AH)/encapsulating security payload (ESP) module; and the AH/ESP module encrypts the message, encapsulates the encrypted message with an IPsec header, forwards the message, and then saves a first corresponding relationship between the SPD module and the message. By means of the solution of the present invention, when there are a great number of messages, different SPD modules can be used to process different messages simultaneously, thereby improving the message processing capacity of a protocol stack.

Description

Method and device for realizing IPsec shunt

Technical field

The embodiments of the present invention relate to the field of communications, and in particular, to a method and apparatus for implementing IP layer (Internet Protocol Security) offloading.

Background technique

IPsec is a set of Internet Protocol (IP) security protocols established by the IPsec team of the Internet Engineering Task Force (IETF). IPsec defines the security services used at the Internet layer, and its functions include data encryption, access control to network elements, data source address verification, data integrity checking, and replay prevention attacks.

When IPsec involves encryption and decryption technology, it encrypts and decrypts packets that comply with IPsec filtering rules, which consumes more CPU resources. In order to reduce the consumption of CPU resources, some large-scale devices currently process IPsec services by using a distributed multi-IPsec dedicated service board.

However, on some small devices, or devices that lack IPsec-specific service boards, IPsec services are usually embedded in the system protocol stack. For the case where the IPsec service is embedded in the system protocol stack, the related technologies for implementing IPsec offloading generally include:

As shown in Figure 1, the IPsec outbound processing is implemented. After the service instance module generates a packet, the security policy database (SPD) selection module needs to be based on the source IP address and destination IP address of the packet. If the packet is not required to be IPsec, the processing module directly forwards the packet. If the packet needs to be discarded, the processing module discards the packet. If the packet needs to be encapsulated in IPsec, the processing module encrypts the packet. The IPsec header is encapsulated in the encrypted packet and then forwarded.

As shown in Figure 2, the process of IPsec encapsulation is implemented. When receiving a packet, the demultiplexer determines whether the packet is an IPsec-encapsulated packet according to the protocol number in the packet. Then, the packet is decapsulated by IPsec, and the decapsulated packet is decrypted. Then, the packet is filtered, and the packet that does not comply with the policy is discarded. The packet matching the policy is forwarded to the service instance. Module; if it is not a packet encapsulated by IPsec, the policy is applied to the packet. Filter the packets that do not match the policy and forward the packets that meet the policy to the service instance module.

In the related art method for implementing IPsec offloading, when there are a large number of packets, the policy filtering and encryption and decryption process reduces the ability of the protocol stack to process messages.

Summary of the invention

The following is an overview of the topics detailed in this document. This Summary is not intended to limit the scope of the claims.

The embodiment of the invention provides a method and a device for implementing IPsec offload, which can improve the capability of the protocol stack to process messages.

In order to achieve the above object, an embodiment of the present invention provides a method for implementing IP-based protocol secure IPsec offloading, which is associated with different service instance modules and corresponding security policy database SPD modules in advance;

The service instance module generates a message and sends it to the SPD module associated with itself;

The SPD module determines that the packet needs to be processed by IPsec, and sends the packet and the information indicating that the packet needs to be IPsec processed to the authentication header protocol AH/encapsulated secure payload protocol ESP module.

The AH/ESP module encrypts the packet, encapsulates the IPsec header in the encrypted packet, and forwards the first correspondence between the SPD module and the packet.

The service instance module is two or more; the SPD module is two or more.

Optionally, when the SPD module determines that the packet does not need to perform IPsec processing, the method further includes:

The SPD module sends the message and the information indicating that the packet does not need to be IPsec processed to the AH/ESP module, the AH/ESP module forwards the packet, and saves the SPD module and the The first correspondence between the messages; the end.

Optionally, when the SPD module determines that the packet needs to be discarded, the method further includes: the SPD module directly discards the packet, and ends.

Optionally, the AH/ESP module encrypts the packet, including:

The AH/ESP module searches for the SA index corresponding to the SP information in the packet in the second correspondence between the preset SP information and the SA index, and searches the SA index according to the found SA index. The message is encrypted.

Optionally, the method further includes:

When receiving the packet, the AH/ESP module determines that the received packet is an IPsec-encapsulated packet, and decapsulates the received packet according to the SA in the received packet. The index decrypts the decapsulated packet, and sends the decrypted packet and the packet indicating that the packet is an IPsec encapsulated packet to the SPD module corresponding to the decrypted packet.

The SPD module corresponding to the decrypted packet determines that the decrypted packet needs to be subjected to IPsec processing, and the decrypted packet is sent to the service instance module corresponding to the decrypted packet.

Optionally, when the SPD module corresponding to the packet determines that the decrypted packet does not need to perform IPsec processing, the method further includes: the SPD module corresponding to the packet discards the decrypted packet ,End.

Optionally, the SPD module that sends the decrypted packet and the packet indicating that the packet is an IPsec encapsulated packet to the decrypted packet includes:

The SPD module corresponding to the packet is searched in the first correspondence, and the information of the decrypted packet and the packet indicating that the packet is IPsec encapsulated is sent to the found SPD module.

Optionally, the method further includes:

When receiving the packet, the AH/ESP module determines that the received packet is not an IPsec-encapsulated packet, and the AH/ESP module receives the received packet and the packet that is not encapsulated by IPsec. Sending information of the packet to the SPD module corresponding to the received message;

When the SPD module corresponding to the received packet determines that the received packet needs to perform IPsec processing, the received packet is discarded.

Optionally, when the SPD module corresponding to the received packet determines that the received packet does not need to perform IPsec processing, the method further includes:

The SPD module corresponding to the received packet sends the received packet to the service instance module corresponding to the received packet.

The embodiment of the invention further provides a device for implementing IP IP protocol protocol security IPsec offloading, at least include:

The service instance module is configured to generate a message and send it to the SPD module associated with itself;

The SPD module is configured to determine that the packet needs to be subjected to IPsec processing, and send the packet and the information indicating that the packet needs to be IPsec processed to the authentication header protocol AH/encapsulated secure payload protocol ESP module;

The AH/ESP module is configured to encrypt the packet, encapsulate the IPsec header in the encrypted packet, and forward the first correspondence between the SPD module and the packet.

The service instance module is two or more; the SPD module is two or more.

Optionally, the SPD module is further configured to:

Determining that the packet does not need to be subjected to IPsec processing, and sending the packet and the information indicating that the packet does not need to be IPsec processed to the AH/ESP module;

The AH/ESP module is further configured to: forward the packet, and save a first correspondence between the SPD module and the packet, and end.

Optionally, the SPD module is further configured to: determine that the packet needs to be discarded, directly discard the packet, and end.

Optionally, the AH/ESP module is specifically configured to:

The second index of the pre-set SP information and the SA index is used to search for the SA index corresponding to the SP information in the packet, and encrypt the packet according to the found SA index, and encrypt the packet. After the IPsec header is encapsulated, the packet is forwarded, and the first correspondence between the SPD module and the packet is saved.

Optionally, the AH/ESP module is further configured to:

When receiving the packet, it is determined that the received packet is an IPsec-encapsulated packet, and the received packet is decapsulated, and the decapsulated packet is de-encapsulated according to the SA index in the received packet. The message is decrypted, and the decrypted message and the message indicating that the message is an IPsec encapsulated message are sent to the SPD module corresponding to the decrypted message;

The SPD module is further configured to:

Determining that the decrypted packet needs to perform IPsec processing, and sending the decrypted packet A service instance module corresponding to the decrypted message.

Optionally, the SPD module is further configured to:

It is determined that the decrypted packet does not need to be IPsec processed, and the decrypted packet is discarded, and the process ends.

Optionally, the AH/ESP module is further configured to:

When receiving the packet, it is determined that the received packet is not a packet encapsulated by IPsec, and the received packet and the packet indicating that the packet is not encapsulated by IPsec are sent to the received packet. Corresponding SPD module;

The SPD module is further configured to: when it is determined that the received packet needs to perform IPsec processing, discard the received packet.

Optionally, the SPD module is further configured to:

Determining that the received packet does not need to be subjected to IPsec processing, and the received packet is sent to the service instance module corresponding to the received packet.

Compared with the prior art, the technical solution provided by the present invention includes: pre-associating different service instance modules and corresponding security policy database SPD modules; wherein the service instance modules are two or more; the SPD modules are two or Two or more; the service instance module generates a message and sends it to the SPD module associated with itself; the SPD module determines that the packet needs to be IPsec processed, and sends the message and the information indicating that the packet needs to be IPsec processed to the AH/ESP module. The AH/ESP module encrypts the packet, encapsulates the IPsec header after the encrypted packet is forwarded, and saves the first correspondence between the SPD module and the packet. With the solution of the present invention, when there are a large number of packets, different SPD modules can be used to simultaneously process different packets, thereby improving the capability of the protocol stack to process messages.

Other aspects will be apparent upon reading and understanding the drawings and detailed description.

BRIEF abstract

The drawings in the following description of the embodiments of the present invention are intended to illustrate the invention, and are not intended to limit the scope of the invention.

1 is a schematic diagram of implementing IPsec outgoing processing in the related art;

2 is a schematic diagram of implementing IPsec inbound processing in the related art;

3 is a flowchart of a method for implementing IPsec offloading according to an embodiment of the present invention;

FIG. 4 is a schematic structural diagram of an apparatus for implementing IPsec offloading according to an embodiment of the present invention.

Preferred embodiment of the invention

In order to facilitate the understanding of those skilled in the art, the present invention is further described below in conjunction with the accompanying drawings, and is not intended to limit the scope of the present invention. It should be noted that the embodiments in the present application and the various manners in the embodiments may be combined with each other without conflict.

Referring to FIG. 3, an embodiment of the present invention provides a method for implementing IPsec offloading. First, different service instance modules and corresponding SPD modules are associated in advance.

Among them, a socket (cord) can be associated with a service instance module and an SPD module. Specifically, how to associate the service instance module and the SPD module is common knowledge of those skilled in the art, and is not intended to limit the scope of protection of the present invention, and details are not described herein again.

The method of the invention comprises:

Step 300: The service instance module generates a message and sends the message to the SPD module associated with itself.

The service instance module is two or more; the SPD module is two or more.

You can set different packets to be generated by different service instance modules. In the case of a large number of packets, different SPD modules can be used to process different packets at the same time. This improves the protocol stack's ability to process packets.

This step emphasizes that multiple service instance modules are used to generate packets. Different service instance modules can generate different packets at the same time. For example, each service instance module may separately generate a remote login protocol (telnet) message carried by a Transmission Control Protocol (TCP), a File Transfer Protocol (FTP) message carried by the TCP protocol, and the Internet. Control Message Protocol (ICMP) messages, and so on.

Step 301: The SPD module determines that the packet needs to be subjected to IPsec processing, and sends the packet to an Authentication Header (AH)/Encapsulating Security Payload (ESP) module.

In this step, the AH/ESP module is used to implement the existing SPD selection module for packaging and Part of the function of encrypting a message, and a module in the demultiplexer for decapsulating and decrypting part of the message.

In this step, when the SPD module determines that the packet does not need to be processed by the IPsec, the SPD module sends the packet and the information indicating that the packet does not need to be processed by the IPsec to the AH/ESP module, and the AH/ESP module directly forwards the packet. And save the first correspondence between the SPD module and the message, and the end.

In this step, when the SPD module determines that the packet needs to be discarded, the SPD module directly discards the packet and ends.

In this step, how the SPD module determines whether the packet needs to be processed by the IPsec, and whether the packet needs to be discarded is known to those skilled in the art, and is not intended to limit the scope of the present invention, and details are not described herein.

That is to say, in the technical solution provided by the embodiment of the present invention, the packet policy filtering function and the packet encryption and decryption function in the existing IPsec service processing are separated. In the embodiment of the present invention, only multi-instantiation is used for the SPD module, and only one instance is required for the AH/ESP module, where each instance of the SPD module is reported. The message filtering is performed, and only the packets that need to be encrypted and decrypted by IPsec are sent to the AH/ESP module for processing, and the packets that are discarded or directly passed are directly processed by the SPD module.

Step 302: The AH/ESP module encrypts the packet, encapsulates the IPsec header after the encrypted packet is forwarded, and saves the first correspondence between the SPD module and the packet.

In this step, the AH/ESP module encrypts the packet, including:

The AH/ESP module searches for the SA index corresponding to the SP information in the packet, and encrypts the packet according to the found SA index in the second correspondence between the preset SP information and the SA index.

The SP information includes a source IP address, a destination IP address, and a protocol number. The SP information may also include a source port and a destination port. The SA index includes a key, an encryption algorithm, and the like.

In this step, when the IPsec header is encapsulated, the found SA index is included in the IPsec header.

The embodiment of the invention further includes:

Step 303: When receiving the packet, the AH/ESP module determines that the received packet is an IPsec-encapsulated packet, and decapsulates the received packet according to the SA index in the received packet. The decapsulated packet is decrypted, and the decrypted packet and the packet indicating that the packet is encapsulated by IPsec are sent to the SPD module corresponding to the decrypted packet.

In this step, the SPD module corresponding to the packet and the packet indicating that the packet is an IPsec encapsulated packet is sent to the SPD module.

The SPD module corresponding to the packet is searched in the first correspondence, and the information of the decrypted packet and the packet indicating that the packet is encapsulated by IPsec is sent to the found SPD module.

Step 304: The SPD module corresponding to the decrypted packet determines that the decrypted packet needs to be subjected to IPsec processing, and the decrypted packet is sent to the service instance module corresponding to the decrypted packet.

In this step, when the SPD module corresponding to the packet determines that the decrypted packet does not need to perform IPsec processing, the decrypted packet is discarded and ends.

When the AH/ESP module determines that the received packet is not an IPsec encapsulated packet, the method further includes:

The AH/ESP module sends the received message and the information indicating that the packet is not encapsulated by the IPsec packet to the SPD module corresponding to the received packet; the SPD module corresponding to the received packet determines the received packet. When the IPsec processing is required, the received packet is discarded.

The SPD module corresponding to the received packet, when it is determined that the received packet does not need to be processed by the IPsec, sends the received packet to the service instance module corresponding to the received packet.

Referring to FIG. 4, the present invention further provides an apparatus for implementing IPsec offload, including at least:

The service instance module is configured to generate a message and send the message to the SPD module associated with itself when the message is sent;

The SPD module is configured to determine that the packet needs to be IPsec processed, and send the packet and the information indicating that the packet needs to be IPsec processed to the AH/ESP module;

The AH/ESP module is configured to encrypt the packet, encapsulate the IPsec header in the encrypted packet, and then forward the first correspondence between the SPD module and the packet.

The service instance module is two or more; the SPD module is two or more.

In the apparatus provided by the embodiment of the present invention, the SPD module is further configured to:

It is judged that the packet does not need to be processed by IPsec, and the packet and the packet are not required to be IPsec. The processed information is sent to the AH/ESP module;

The AH/ESP module is also set to:

Forwards the packet and saves the first correspondence between the SPD module and the packet, and ends.

If the packet is discarded, the packet is discarded and the packet is discarded.

In the device provided by the embodiment of the present invention, the AH/ESP module is specifically configured to:

In the second correspondence between the preset SP information and the SA index, the SA index corresponding to the SP information in the packet is searched, and the packet is encrypted according to the found SA index, and the encrypted packet is encapsulated. The IPsec header is forwarded and the first correspondence between the SPD module and the packet is saved.

In the apparatus provided by the embodiment of the present invention, the AH/ESP module is further configured to:

When receiving a packet, it determines that the received packet is an IPsec-encapsulated packet, decapsulates the received packet, and decrypts the decapsulated packet according to the SA index in the received packet. And sending the decrypted packet and the information indicating that the packet is an IPsec encapsulated packet to the SPD module corresponding to the decrypted packet;

The SPD module is also set to:

It is determined that the decrypted packet needs to be subjected to IPsec processing, and the decrypted packet is sent to the service instance module corresponding to the decrypted packet.

It is determined that the decrypted packet does not need to be processed by IPsec, and the decrypted packet is discarded.

When receiving a packet, it is determined that the received packet is not an IPsec-encapsulated packet, and the received packet and the packet indicating that the packet is not encapsulated by IPsec are sent to the SPD corresponding to the received packet. Module

The SPD module is also set to:

When it is determined that the received packet needs to be IPsec processed, the received packet is discarded.

It is determined that the received packet does not need to be processed by IPsec, and the received packet is sent to the service instance module corresponding to the received packet.

It should be noted that the above-mentioned embodiments are only for the purpose of facilitating the understanding of those skilled in the art, and are not intended to limit the scope of the present invention, and those skilled in the art will Any obvious substitutions and improvements made by the invention are within the scope of the invention.

Industrial applicability

The method and device for implementing IP layer protocol security (IPsec) offloading according to the embodiment of the present invention include: pre-associating different service instance modules and corresponding security policy database SPD modules; wherein the service instance modules are two or more The SPD module is two or more; the service instance module generates a message and sends it to the SPD module associated with itself; the SPD module determines that the packet needs to be IPsec processed, and the packet and the representation message need to be performed. The information processed by the IPsec is sent to the authentication header protocol AH/encapsulated secure payload protocol ESP module. The AH/ESP module encrypts the packet, encapsulates the IPsec header after the encrypted packet is forwarded, and saves the SPD module and the packet. The first correspondence between the two. With the solution of the present invention, when there are a large number of packets, different SPD modules can be used to simultaneously process different packets, thereby improving the capability of the protocol stack to process messages.

Claims

A method for implementing the IP layer protocol security IPsec offloading, wherein the different service instance modules and the corresponding security policy database SPD modules are associated in advance; and the method further includes:

The service instance module generates a message and sends it to the SPD module associated with itself;

The SPD module determines that the packet needs to be processed by IPsec, and sends the packet and the information indicating that the packet needs to be IPsec processed to the authentication header protocol AH/encapsulated secure payload protocol ESP module.

The AH/ESP module encrypts the packet, encapsulates the IPsec header in the encrypted packet, and forwards the first correspondence between the SPD module and the packet.

The service instance module is two or more; the SPD module is two or more.
The method of claim 1, when the SPD module determines that the packet does not need to perform IPsec processing, the method further includes:

The SPD module sends the message and the information indicating that the packet does not need to be IPsec processed to the AH/ESP module, the AH/ESP module forwards the packet, and saves the SPD module and the The first correspondence between the messages; the end.
The method of claim 1, when the SPD module determines that the packet needs to be discarded, the method further includes: the SPD module directly discarding the packet, and ending.
The method of claim 1, the encrypting the message by the AH/ESP module comprises:

The AH/ESP module searches for the SA index corresponding to the SP information in the packet in the second correspondence between the preset SP information and the SA index, and performs the packet according to the found SA index. encryption.
The method of claim 1 or 2 or 3, further comprising:

When receiving the packet, the AH/ESP module determines that the received packet is an IPsec-encapsulated packet, and decapsulates the received packet according to the SA in the received packet. The index decrypts the decapsulated packet, and sends the decrypted packet and the packet indicating that the packet is an IPsec encapsulated packet to the SPD module corresponding to the decrypted packet.

The SPD module corresponding to the decrypted packet determines that the decrypted packet needs to be subjected to IPsec processing, and the decrypted packet is sent to the service instance corresponding to the decrypted packet. Piece.
The method of claim 5, when the SPD module corresponding to the packet determines that the decrypted packet does not need to be processed by IPsec, the method further includes: the SPD module corresponding to the packet discarding the The decrypted message ends.
The method according to claim 5, wherein the SPD module corresponding to the decrypted message and the message indicating that the message is an IPsec-encapsulated message is sent to the decrypted message includes:

The SPD module corresponding to the packet is searched in the first correspondence, and the information of the decrypted packet and the packet indicating that the packet is IPsec encapsulated is sent to the found SPD module.
The method of claim 1 or 2 or 3, further comprising:

When receiving the packet, the AH/ESP module determines that the received packet is not an IPsec-encapsulated packet, and the AH/ESP module receives the received packet and the packet that is not encapsulated by IPsec. Sending information of the packet to the SPD module corresponding to the received message;

When the SPD module corresponding to the received packet determines that the received packet needs to perform IPsec processing, the received packet is discarded.
The method according to claim 8, wherein when the SPD module corresponding to the received message determines that the received message does not need to be processed by IPsec, the method further includes:

The SPD module corresponding to the received packet sends the received packet to the service instance module corresponding to the received packet.
An apparatus for implementing IP-based protocol secure IPsec offloading, comprising: at least:

The service instance module is configured to generate a message and send it to the SPD module associated with itself;

The SPD module is configured to determine that the packet needs to be subjected to IPsec processing, and send the packet and the information indicating that the packet needs to be IPsec processed to the authentication header protocol AH/encapsulated secure payload protocol ESP module;

The AH/ESP module is configured to encrypt the packet, encapsulate the IPsec header in the encrypted packet, and forward the first correspondence between the SPD module and the packet.

The service instance module is two or more; the SPD module is two or more.
The apparatus according to claim 10, wherein the SPD module is further configured to:

Determining that the packet does not need to be subjected to IPsec processing, and sending the packet and the information indicating that the packet does not need to be IPsec processed to the AH/ESP module;

The AH/ESP module is further configured to: forward the packet, and save a first correspondence between the SPD module and the packet, and end.
The device according to claim 10, wherein the SPD module is further configured to: determine that the packet needs to be discarded, directly discard the packet, and end.
The device according to claim 10, wherein the AH/ESP module is specifically configured to:

The second index of the pre-set SP information and the SA index is used to search for the SA index corresponding to the SP information in the packet, and encrypt the packet according to the found SA index, and encrypt the packet. After the IPsec header is encapsulated, the packet is forwarded, and the first correspondence between the SPD module and the packet is saved.
The apparatus according to claim 10 or 11 or 12, wherein the AH/ESP module is further configured to:

When receiving the packet, it is determined that the received packet is an IPsec-encapsulated packet, and the received packet is decapsulated, and the decapsulated packet is de-encapsulated according to the SA index in the received packet. The message is decrypted, and the decrypted message and the message indicating that the message is an IPsec encapsulated message are sent to the SPD module corresponding to the decrypted message;

The SPD module is further configured to:

It is determined that the decrypted packet needs to be subjected to IPsec processing, and the decrypted packet is sent to the service instance module corresponding to the decrypted packet.
The apparatus of claim 14, the SPD module is further configured to:

It is determined that the decrypted packet does not need to be IPsec processed, and the decrypted packet is discarded, and the process ends.
The apparatus according to claim 10 or 11 or 12, wherein said AH/ESP module is further provided for:

When receiving the packet, it is determined that the received packet is not a packet encapsulated by IPsec, and the received packet and the packet indicating that the packet is not encapsulated by IPsec are sent to the received packet. Corresponding SPD module;

The SPD module is further configured to:

When it is determined that the received packet needs to perform IPsec processing, the received packet is discarded.
The apparatus of claim 16, the SPD module further configured to:

Determining that the received packet does not need to be subjected to IPsec processing, and the received packet is sent to the service instance module corresponding to the received packet.