WO2018130079A1

WO2018130079A1 - Method for encrypting internet protocol security (ipsec) protocol and network device

Info

Publication number: WO2018130079A1
Application number: PCT/CN2017/119487
Authority: WO
Inventors: 邹远鹏; 刘家晓; 刘福元
Original assignee: 京信通信系统（中国）有限公司; 京信通信系统（广州）有限公司; 京信通信技术(广州)有限公司; 天津京信通信系统有限公司
Priority date: 2017-01-11
Filing date: 2017-12-28
Publication date: 2018-07-19
Also published as: CN106790221B; CN106790221A

Abstract

Embodiments of the present application relates to the technical field of communications, and in particular, to a method for encrypting an Internet protocol security (IPSec) protocol and a network device, for use in effectively resolving the problem in the prior art of being unable to preserve the order of the sequence number of an IP packet sent by a multi-core heterogeneous network device. The method comprises: a network device acquires a first IP packet by means of a control-plane processor core; when the network device determines, by means of the control-plane processor core, that the first IP packet is a first IP packet to be encrypted, and determines, according to information of the first IP packet, that the first IP packet needs to be hard encrypted, the network device assigns a sequence number to the first IP packet by means of a hardware encryption module and hard encrypts the first IP packet to obtain an encrypted first IP packet; the network device sends the encrypted first IP packet by means of a network interface card. Thus, the present invention effectively resolves the problem in the prior art of being unable to preserve the order of the sequence number of an IP packet sent by a multi-core heterogeneous network device.

Description

Internet protocol security IPSec protocol encryption method and network device

This application claims the priority of the Chinese patent application filed on January 11, 2017, the Intellectual Property Office of the People's Republic of China, the application number is 201710021178.8, and the invention name is "an Internet protocol security IPSec protocol encryption method and network equipment". The entire contents of this application are incorporated herein by reference.

Technical field

The embodiments of the present invention relate to the field of communications technologies, and in particular, to an Internet protocol security IPSec protocol encryption method and a network device.

Background technique

The network is becoming more and more popular, and the network security problems that come with it are of great concern. For example, the replay attack suffered by the client: the sender sends a protocol (Internet Protocol, IP for short) message to the receiver. If the IP packet is captured by a malicious user, the malicious user repeatedly sends the IP packet to the receiving end, causing the network application to be bombarded by the continuously replayed data packet. The Internet Protocol Security (IPSec) protocol has been used to solve this problem. The IPSec protocol defines a sequence number (SN) field for recording the serial number of the IP packet. The SN is unique when the sender sends packets in the same group of SA information. For example, the receiver receives an IP packet with sequence number 5. When it receives an IP packet with sequence number 5 again, it rejects it. Receive the repeatedly sent message.

In the prior art, when a single-core device forwards a thread, the packets are sequentially encapsulated and sent in sequence, and the sequence number of the IPSec encapsulated packets received by the receiving end does not appear out of order. For multi-core heterogeneous network devices, for example, Digital Signal Processing (DSP) technology + Advanced Reduced Instruction Set Computer Machine (ARM), DSP + reduced instruction set architecture of the central processor (Multi-core heterogeneous integrated chips such as Performance Optimization With Enhanced RISC-Performance Computing, referred to as POWERPC), usually use DSP for business processing, use POWERPC or ARM core to run Linux operating system as control service; control for POWERPC or ARM core processing The face data is usually encrypted by a Central Processing Unit (CPU) core running software encryption program, and the user plane data processed by the DSP core is usually encrypted by a hard encryption module. As the multi-core heterogeneous network device processes the data, multiple threads process the packets in parallel. When the IP packets are sent, they are encrypted in different cryptographic modules, which easily leads to the serial number of the IP packets encapsulated by the IPSec protocol received by the receiver. The out-of-order sequence is likely to cause the IP packet to be recognized as a replay packet and discarded incorrectly.

In the prior art, in order to solve the problem that the sequence number of IP packets in the multi-core heterogeneous network device is not preserved, the shared memory between multiple cores is used in the multi-core heterogeneous network device, but the synchronization and mutual between the heterogeneous CPUs are used. The extra processing is very cumbersome and increases the complexity of programming. Therefore, an IPSec encryption method is needed to effectively solve the problem that the IP packet sequence number sent by the multi-core heterogeneous network device in the prior art is not guaranteed.

Summary of the invention

The embodiment of the present invention provides an Internet protocol security IPSec protocol encryption method and a network device, which are used to effectively solve the problem that the IP packet sequence number sent by the multi-core heterogeneous network device cannot be saved in the prior art.

In a first aspect, an embodiment of the present application provides an Internet Protocol Security IPSec protocol encryption method, which is applicable to a control plane processor core including at least one control plane data processing and at least one user plane for processing user plane data. The multi-core heterogeneous network device of the processor core, the method includes: the network device acquires the first IP packet by using the control plane processor core; and the network device determines, by using the control plane processor core, that the first IP packet is encrypted. In the case of an IP packet, and the network device determines that the first IP packet needs to be hard-encrypted according to the information of the first IP packet: the network device allocates a sequence number to the first IP packet through the hardware encryption module. And performing hard encryption to obtain the encrypted first IP packet; the network device sends the encrypted first IP packet through the network card.

In a second aspect, the embodiment of the present application provides a network device for encrypting an Internet Protocol security IPSec protocol, including at least one control plane processor core for processing control plane data and at least one processing of user plane data. a user plane processor core, the network device includes: a control plane processor core, configured to obtain a first IP packet; and a hardware encryption module, configured to determine, by using a control plane processor core, that the first IP packet is to be encrypted In the case of the first IP packet, and in the case where the first IP packet needs to be hard-encrypted by the control plane processor core, the serial number is assigned to the first IP packet, and hard encryption is performed to obtain the encrypted first An IP packet; the network card is configured to send the encrypted first IP packet.

In a third aspect, an embodiment of the present application provides a network device, including:

At least one processor; and,

a memory communicatively coupled to the at least one processor; wherein

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform any of the IPSec protocols of the first aspect described above Encryption method.

In a fourth aspect, an embodiment of the present application provides a non-transitory computer readable storage medium, where the non-transitory computer readable storage medium stores computer instructions, where the computer instructions are used to cause the computer to perform the first aspect or the A method in any of the possible embodiments on the one hand.

In a fifth aspect, an embodiment of the present application provides a computer program product, where the computer program product includes a calculation program stored on a non-transitory computer readable storage medium, the computer program includes program instructions, when the program instruction is When executed by a computer, the computer is caused to perform the method of any of the first aspect or the first aspect of the first aspect.

In the embodiment of the present application, the network device obtains the first IP packet by using the control plane processor core; and the network device determines, by using the control plane processor core, that the first IP packet is the first IP packet to be encrypted. And determining, according to the information of the first IP packet, that the first IP packet needs to be hard-encrypted: the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the first encryption. IP packet; the network device sends the encrypted first IP packet through the network card. It can be seen that, in the embodiment of the present application, the packet to be encrypted is further processed, and the packet to be encrypted and hard-encrypted is encrypted by the hardware encryption module. The packet is encrypted by an encryption module. Therefore, in this embodiment, the sequence number of the packet is guaranteed to be saved, and the packet caused by encrypting the packet by using two encryption modules in the prior art is avoided. The serial number of the text is not guaranteed.

DRAWINGS

In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings used in the description of the embodiments will be briefly described below.

FIG. 1 is a schematic structural diagram of an Internet protocol security IPSec protocol encryption system according to an embodiment of the present disclosure;

2 is a schematic flowchart of a method for encrypting an Internet protocol security IPSec protocol according to an embodiment of the present application;

FIG. 3 is a schematic flowchart of another method for encrypting an Internet protocol security IPSec protocol according to an embodiment of the present application;

4 is a schematic structural diagram of a network device for encrypting an Internet protocol security IPSec protocol according to an embodiment of the present application;

FIG. 5 is a schematic structural diagram of a network device according to an embodiment of the present disclosure.

detailed description

In order to make the objects, technical solutions and beneficial effects of the present application more clear, the present application will be further described in detail below with reference to the accompanying drawings and embodiments. It is understood that the specific embodiments described herein are merely illustrative of the application and are not intended to be limiting.

FIG. 1 is a schematic diagram showing an architecture of an Internet Protocol Security IPSec protocol encryption system to which the embodiment of the present application is applied, the system architecture being applicable to at least one control plane processor core including at least one control plane data processing and at least one A multi-core heterogeneous network device of a user plane processor core that processes user plane data; as shown in FIG. 1, the system architecture 100 includes a control plane processor core 110, a user plane processor core 120, a hardware encryption module 130, and a network card. The control plane processor core 110 includes a network protocol stack 111 and a network card driver 112. The network protocol stack 111 is connected to the network card driver 112. Alternatively, the control plane processor core 110 can be connected to the user plane processor core 120 or can be connected to the network card. Further, the control plane processor core 110 may be connected to the user plane processor core 120 through the network card driver 112, or may be connected to the network card 140 through the network card driver 112; optionally, the user plane processor core 120 is connected to the hardware encryption module 130. The network card 140 can also be connected; the hardware encryption module 130 is connected to the network card 140; wherein the control plane processor core 110 is configured to process control plane data, Surface processor core 120 for processing user plane data. Optionally, the control plane processor core 110 may be a POWERPC core or an ARM core; optionally, the user plane processor core 120 may be a DSP core.

In the embodiment of the present application, on the one hand, the network protocol stack 111 in the control plane processor core 110 processes the first IP packet obtained by the control plane data, and determines whether the first IP packet needs to be encrypted through the network card driver 112. The communication technology sends the encrypted first IP packet to the user plane processor core 120, and then sends it to the hardware encryption module 130 through the user plane processor core 120 for encryption and assigns a serial number, and then encrypts the encrypted number through the network card 140. An IP packet is sent out; on the other hand, the second IP packet obtained by the user plane data processed by the user plane processor 120 is sent to the hardware encryption module 130 for encryption and assigned a serial number, and then encrypted by the network card 140. The first IP packet is sent out.

FIG. 2 is a schematic flowchart diagram showing an encryption method of an Internet protocol security IPSec protocol provided by an embodiment of the present application.

Based on the system architecture shown in FIG. 1 , as shown in FIG. 2 , an Internet protocol security IPSec protocol encryption method provided by an embodiment of the present application is applicable to a control plane processor core including at least one control plane data processing. And a multi-core heterogeneous network device of at least one user plane processor core that processes user plane data, the method comprising the steps of:

Step S201: The network device acquires the first IP packet by using the control plane processor core.

Step S202: The network device determines, by the control plane processor, that the first IP packet is the first IP packet to be encrypted, and the network device determines the first IP packet according to the information of the first IP packet. In the case of hard encryption, the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the encrypted first IP packet.

Step S203: The network device sends the encrypted first IP packet through the network card.

Based on the foregoing embodiment, in step S201, optionally, the first IP packet may be an IP packet encapsulated by the control plane data processed by the control plane processor core.

Based on the foregoing embodiment, in step S202, optionally, the information of the first IP packet includes: a source IP address and a destination IP address in the packet; optionally, the control plane processor core may be a running Linux operating system. Core; determining whether the first IP packet needs to be encrypted in multiple ways, an optional way for the network protocol stack in the control plane processor core to determine whether the first IP packet needs to be encrypted; If the IP packet needs to be encrypted, the first IP packet is sent to the network card driver; the network card driver determines whether the IP packet to be encrypted needs to be hard-encrypted; and the first IP packet needs hard encryption. The first IP packet that needs to be hard-encrypted is sent to the user plane processor core through Inter-Processing Communication (IPC) technology, and then the serial number is assigned to the first IP packet by the hardware encryption module. Hard encryption.

Based on the foregoing embodiment, in step S203, the hardware encryption module sends the encrypted first IP packet through the network card.

Optionally, the network device determines that the first IP packet needs to be hard-encrypted according to the information of the first IP packet, and needs to meet any one of the following two conditions: First, the network device determines the first IP packet. In the case of the tunnel mode, and determining that the source IP address in the first IP packet is an IP address negotiated based on the IPSec protocol, the first IP packet needs to be hard-encrypted; If the IP packet is in the transmission mode, the IP address set in the protected state is obtained, and the destination IP address in the first IP packet is determined to be one of the IP address sets. The first IP packet needs to be hard encrypted.

In the embodiment of the present application, the information of the first IP packet includes: a source IP address and a destination IP address in the packet. For example, the two network devices are respectively a client and a cloud server, where the client The IP address of the IP address is IP ₁₁ and the IP address of the cloud server is IP _21. Before the client and the cloud server start to communicate, the IPSec link is set up to send and receive packets. The client sends the first IP packet to the cloud server as an example:

For the first case in the foregoing embodiment, in the case of the tunnel mode, an IPSec tunnel is established between the client and the cloud server, and the IP address of the packet is negotiated based on the IPSec protocol, and the client negotiates the IP address based on the IPSec protocol. For the IP ₁₂ , the IP address of the cloud server based on the IPSec protocol is IP _22. When the client sends the first IP packet to be encrypted to the cloud server, the source IP address of the first packet is set to IP ₁₂ ; After determining that the source IP address in the first packet is IP ₁₂ , it is determined that the first IP packet needs to be hard encrypted.

For the second case in the foregoing embodiment, in the case of the transmission mode, an IPSec link is established between the client and the cloud server, and the set of IP addresses in the protected state is preset in the cloud server: IP ₃₁ , IP ₃₂ , IP ₃₃ , IP ₃₄ , IP ₃₅ , IP ₃₆ , each IP address in the IP address set corresponds to one network device; the client and one network device in the IP address set communicate, first obtain the IP address set, and the client is in the cloud When the server sends the first IP packet to be encrypted, for example, the network protocol stack of the client sets the destination IP address in the first IP packet to IP ₃₄ , and the network card driver in the client determines the first IP packet. The destination IP address IP ₃₄ in the IP address set: IP ₃₁ , IP ₃₂ , IP ₃₃ , IP ₃₄ , IP ₃₅ , IP ₃₆ , determines that the first IP packet needs to be hard encrypted.

Optionally, the determining, by the network device, that the first IP packet does not need to be hard-encrypted includes two cases: in the first case, the network device determines that the first IP packet is in the tunnel mode, and determines the first IP packet. The source IP address in the text is not the IP address negotiated based on the IPSec protocol, and the first IP packet is not required to be hard-encrypted. In the second case, the network device determines that the first IP packet is in the transmission mode. Obtaining the preset IP address set in the cloud server. If the destination IP address in the first IP packet is not in the IP address set, the first IP packet does not need to be hard. encryption.

In the embodiment of the present application, optionally, the information about the first IP packet is determined by the network card driver, and then the first IP packet needs to be hard-encrypted. Therefore, the IP packet that needs to be hard-encrypted can be effectively determined. And sent to the hardware encryption module for encryption, thereby avoiding the problem that the serial number of the transmitted message caused by the soft encryption of the first IP packet directly on the control plane processor core is not preserved.

Optionally, after the network device obtains the first IP packet by using the control plane processor core, the method further includes: the network device determining, by the control plane processor core, that the first IP packet is the first IP packet that is not required to be encrypted. In case: the network device sends the first IP packet through the network card. Optionally, when the control plane processor determines that the first IP packet is the first IP packet that is not to be encrypted, the first IP packet is sent to the network card driver through the sending interface of the common IP packet; The IP packets that need to be encrypted are directly sent out through the network card, which avoids wasting resources caused by sending the first IP packet that does not need to be encrypted to the network card driver.

Optionally, after determining that the first IP packet is the first IP packet to be encrypted, the network device further includes: determining, by the network device, that the first IP packet is not required according to the information of the first IP packet In the case of hard encryption: the network device sends the first IP packet through the network card. Optionally, the network card driver can determine whether the first IP packet needs to be hard-encrypted, and the first IP packet that does not need to be hard-encrypted is directly sent to the network card, thus avoiding the first step that does not require hard encryption. The waste of resources caused by the sending of IP packets to the user plane processor core.

Optionally, the method for encrypting the Internet protocol security IPSec protocol further includes: the network device acquiring the second IP packet by using the user plane processor core; and determining, by the network device, the second IP packet according to the information of the second IP packet In the case of hard encryption, the network device assigns a serial number to the second IP packet through the hardware encryption module, and performs hard encryption to obtain the encrypted second IP packet; the network device sends the encrypted second IP packet through the network card.

In the embodiment of the present application, optionally, the user plane data processed by the user plane processor core obtains the second IP packet; if the second IP packet needs to be hard encrypted, the second IP packet to be hard encrypted is required. Sending to the hardware encryption module for hard encryption; if the second IP packet does not require hard encryption, sending the second IP packet through the network card; therefore, the first IP packet of the control plane processor core that needs to be hard encrypted The second IP packet to be encrypted and sent by the user plane processor core is sent to the hardware encryption module for encryption. Thus, the encrypted IP packet sent by the multi-core heterogeneous network device is assigned a serial number through the hardware encryption module. Hard encryption, on the one hand, avoids the problem that the serial number is not preserved due to multi-thread parallel encryption IP packets in multi-core heterogeneous network devices; on the other hand, there is no need to do any shared memory between multiple cores in a multi-core heterogeneous network device. Or other mutually exclusive, synchronous operations, to avoid resource mutual exclusion issues.

Optionally, the first IP packet is determined by the control plane processor to be the first IP packet to be encrypted, and the network device determines a preset security policy route, where the security policy route includes at least one IP address. And determining, by the network device, that the first IP packet is the first IP packet to be encrypted, if the destination IP address in the first IP packet belongs to one of the at least one IP address.

Optionally, the control plane processor core includes a network protocol stack of a Linux operating system; the application determines the first IP packet to be encrypted by modifying the network protocol stack; optionally, the network protocol stack preset security policy routing The security policy route includes at least one IP address. For example, in the preset security policy route, the IP address is 192.168.10.15 to 192.168.10.30 corresponding to a secure route. If the destination IP address in the first IP packet is 192.168.10.25 Then, the network protocol stack finds the secure route corresponding to the IP address of 192.168.10.25 according to the security policy route, and determines that the first IP packet is the first IP packet to be encrypted. In this way, the network device can determine whether the first IP packet needs to be encrypted through the control plane processor, and then send the packet to be encrypted to the network card driver, thereby avoiding the first IP packet to be encrypted on the control plane processor core. Soft encryption is performed to prevent the CPU from consuming too many resources for soft encryption, which improves the performance of the system.

Optionally, the present application provides an optional method for hard-encrypting the first IP packet on the control plane processor core; the control plane processor core uses an ARM core as an example, and the user plane processor core uses a DSP. As an example, the xfrm_lookup function is set in the network protocol stack of the ARM core. The xfrm_lookup function is used to identify the sending interface that needs to be used for the IPSec protocol to perform the encapsulation processing and return the first IP packet; for example, in the network protocol stack. When the first IP packet is sent, the security policy corresponding to the IP address in the first IP packet is determined by the xfrm_lookup function, and the first IP packet is encrypted. The sending interface is sent to the network card driver; the network card driver determines whether the first IP packet needs to be hard-encrypted. If hard encryption is required, the first IP packet that needs to be hard-encrypted is sent to the DSP core through the IPC technology; Sending the first IP packet to the hardware encryption module to allocate the serial number and performing hard encryption; meanwhile, for the second IP packet processed on the DSP core that needs to be hard-encrypted, the DSP core will need to be performed. The encrypted second IP packet is also sent to the hardware encryption module to allocate the serial number and is hard-encrypted; thus, the IP packets sent by the nuclear heterogeneous network device are all assigned the serial number through the hardware encryption module, and are hard. Encryption, the effect of the single-threaded encrypted IP packet in the multi-core heterogeneous network device is achieved, so that the sequence number of the hard-encrypted IP packet is increased in order to avoid the problem that the packet is discarded by the peer anti-replay mechanism.

In order to introduce the above method flow more clearly, the following examples are provided in the embodiments of the present application.

FIG. 3 is a schematic flowchart of another Internet protocol security IPSec protocol encryption method provided by the embodiment of the present application. The system architecture shown in FIG. 1 is shown in FIG. Another Internet Protocol Security IPSec protocol encryption method is applicable to a multi-core heterogeneous network including at least one control plane processor core for processing control plane data and at least one user plane processor core for processing user plane data Device, the method includes the following steps:

Step S301: The network device acquires the first IP packet by using the control plane processor core.

Step S302: The network device determines, by the control plane, that the destination IP address in the first IP packet belongs to one of the at least one IP address in the preset security policy route; if yes, step S303 is performed; if not, Then executing step S313;

Step S303: The network device determines, by using the network protocol stack, that the first IP packet is the first IP packet to be encrypted.

Step S304: The network device determines that the first IP packet is the tunnel mode or the transmission mode by using the network card driver; if it is the tunnel mode, step S305 is performed; if it is the transmission mode, step S306 is performed;

Step S305: The network device determines, by the network card driver, whether the source IP address in the first IP packet is an IP address negotiated based on the IPSec protocol; if yes, step S307 is performed; if not, step S313 is performed;

Step S306: The network device acquires the IP address set in the protected state preset in the cloud server, and determines whether the destination IP address in the first IP packet is one of the IP address sets; if yes, step S307 is performed; if not, Then executing step S313;

Step S307: The network device determines that the first IP packet needs to be hard-encrypted.

Step S308: Send the first IP packet to the user plane processor core by using the network card driver in the control plane processor core;

Step S309: The network device acquires the second IP packet by using the user plane processor core.

Step S310: The network device determines whether the second IP packet needs to be hard-encrypted according to the information of the second IP packet; if yes, step S311 is performed; if not, step S314 is performed;

Step S311: The network device sends the first IP packet and the second IP packet to the hardware encryption module through the user plane processor core.

Step S312: The network device allocates a serial number to the first IP packet and the second IP packet by using the hardware encryption module, and performs hard encryption respectively to obtain the encrypted first IP packet and the encrypted second IP packet.

Step S313: Send the first IP packet to the network card by using a network card driver;

Step S314: The network device sends the first IP packet and the encrypted second IP packet through the network card.

It can be seen from the above that the network device obtains the first IP packet through the control plane processor core; the network device determines that the first IP packet is the first IP packet to be encrypted through the control plane processor core. If the first IP packet needs to be hard-encrypted according to the information of the first IP packet, the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the encrypted IP address. An IP packet; the network device sends the encrypted first IP packet through the network card; and the second IP packet processed by the user plane processor core is also assigned a serial number to the hardware encryption module and uniformly hard-encrypted; In the application embodiment, the packet to be encrypted is further processed, and the packet to be encrypted and hard-encrypted is encrypted by the hardware encryption module, that is, only one encryption is performed in the embodiment of the present application. The module encrypts the packet, so that the sequence number of the packet can be guaranteed in the embodiment of the present application, and the packet is avoided by using two encryption modules as in the prior art. The problem that the sequence number of the packet caused by the encryption is not preserved; moreover, the problem that the IP packet is discarded is avoided in the anti-replay detection process, and the security of the data is increased. Further, the method in the embodiment of the present application avoids the problem of system performance degradation caused by soft encryption of the first IP packet in the control plane processor core, and does not need to do any shared memory between multiple cores in the multi-core heterogeneous network device. Other mutually exclusive and synchronous operations avoid the problem of mutual exclusion of resources and greatly simplify the programming.

FIG. 4 is a schematic structural diagram of a network device for Internet Protocol Security IPSec protocol encryption provided by an embodiment of the present application.

Based on the same concept, a network device for encrypting the Internet protocol security IPSec protocol provided by the embodiment of the present application is used to execute the foregoing method, as shown in FIG. 4, which is used for security protocol IPSec encryption of the Internet protocol. The network device 400 includes a control plane processor core 401, a hardware encryption module 403, and a network card 404, and a user plane processor core 402; wherein:

a control plane processor core 401, configured to acquire a first IP packet;

The hardware encryption module 403 is configured to: when the first IP packet is determined by the control plane processor core 401 as the first IP packet to be encrypted, and pass through the control plane processor core 401 When the first IP packet is to be hard-encrypted, the first IP packet is assigned a serial number, and hard encryption is performed to obtain the encrypted first IP packet.

The network card 404 is configured to send the encrypted first IP packet.

Optionally, the control plane processor core 401 is configured to: when determining that the first IP packet is in a tunnel mode, and determine that the source IP address in the first IP packet is based on an IPSec protocol If the IP address of the negotiation is performed, the first IP packet needs to be hard-encrypted; and when the first IP packet is determined to be in the transmission mode, the IP address set preset in the cloud server is obtained. And determining that the first IP packet needs to be hard-encrypted if the destination IP address in the first IP packet is one of the IP address sets.

Optionally, the network card 404 is further configured to: when the first IP packet is not required to be hard-encrypted by the control plane processor core 401: sending the first IP packet.

Optionally, the network card 404 is further configured to: when the first IP packet is determined by the control plane processor core 401 as a first IP packet that is not required to be encrypted: the network device The first IP packet is sent by the network card 404.

Optionally, the network device further includes: a user plane processor core 402, configured to acquire a second IP packet;

The hardware encryption module 403 is further configured to: when the user plane processor core 402 determines that the second IP packet needs to be hard-encrypted: assign a serial number to the second IP packet, and Performing hard encryption to obtain the encrypted second IP packet; the network card 404 is further configured to: send the encrypted second IP packet.

Optionally, the control plane processor core 401 is configured to: determine a preset security policy route, where the security policy route includes at least one IP address; and determine the first IP packet. If the destination IP address belongs to one of the at least one IP address, the first IP packet is determined to be the first IP packet to be encrypted.

It can be seen from the above that the network device obtains the first IP packet through the control plane processor core; the network device determines that the first IP packet is the first IP packet to be encrypted through the control plane processor core. If the first IP packet needs to be hard-encrypted according to the information of the first IP packet, the network device allocates a serial number to the first IP packet through the hardware encryption module, and performs hard encryption to obtain the encrypted IP address. An IP packet; the network device sends the encrypted first IP packet through the network card; and the second IP packet processed by the user plane processor core is also assigned a serial number to the hardware encryption module and uniformly hard-encrypted; In the application embodiment, the packet to be encrypted is further processed, and the packet to be encrypted and hard-encrypted is encrypted by the hardware encryption module, that is, only one encryption is performed in the embodiment of the present application. The module encrypts the packet, so that the sequence number of the packet can be guaranteed in the embodiment of the present application, and the packet is avoided by using two encryption modules as in the prior art. Packet sequence number does not guarantee the problem caused by the encryption row sequence; and, to avoid the problem of IP packets are discarded in antkeplay detection process, increase data security. Further, the method in the embodiment of the present application avoids the problem of system performance degradation caused by soft encryption of the first IP packet in the control plane processor core, and does not need to do any shared memory between multiple cores in the multi-core heterogeneous network device. Other mutually exclusive and synchronous operations avoid the problem of mutual exclusion of resources and greatly simplify the programming.

It should be understood that the division of each unit above is only a division of logical functions, and the actual implementation may be integrated into one physical entity in whole or in part, or may be physically separated.

Based on the same concept, the present application provides a network device including at least one processor; and a memory communicatively coupled to the at least one processor; the memory storing instructions executable by the at least one processor, The instructions are executed by the at least one processor to enable the at least one processor to perform the IPSec protocol encryption method in the above embodiments.

Taking a processor as an example, FIG. 5 is a schematic structural diagram of a network device provided by the present application.

The network device includes a transceiver 501, a processor 502, a memory 503, and a communication interface 504; wherein the transceiver 501, the processor 502, the memory 503, and the communication interface 504 are connected to one another via a bus 505.

The memory 503 is used to store programs. In particular, the program can include program code, the program code including computer operating instructions. The memory 503 may be a volatile memory, such as a random-access memory (RAM), or a non-volatile memory, such as a flash memory. A hard disk drive (HDD) or a solid-state drive (SSD); or any combination of any one or more of the above-mentioned volatile memory and non-volatile memory.

The memory 503 stores the following elements, executable modules or data structures, or a subset thereof, or an extended set thereof:

Operation instructions: include various operation instructions for implementing various operations.

Operating system: Includes a variety of system programs for implementing various basic services and handling hardware-based tasks.

The bus 505 can be a peripheral component interconnect (PCI) bus or an extended industry standard architecture (EISA) bus. The bus can be divided into an address bus, a data bus, a control bus, and the like. For ease of representation, only one thick line is shown in Figure 5, but it does not mean that there is only one bus or one type of bus.

The communication interface 504 can be a wired communication access port, a wireless communication interface, or a combination thereof, wherein the wired communication interface can be, for example, an Ethernet interface. The Ethernet interface can be an optical interface, an electrical interface, or a combination thereof. The wireless communication interface can be a WLAN interface.

The processor 502 can be a central processing unit (CPU), a network processor (NP) or a combination of a CPU and an NP. It can also be a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD) or a combination thereof. The PLD may be a complex programmable logic device (CPLD), a field-programmable gate array (FPGA), a general array logic (GAL) or any combination.

The transceiver 501 is configured to obtain a first IP packet, and send the encrypted first IP packet.

The processor 502 is configured to read a program in the memory 503 and perform the following methods:

When the first IP packet is determined to be the first IP packet to be encrypted, in the case that the first IP packet needs to be hard-encrypted, the first IP packet is allocated a sequence. Number, and perform hard encryption to obtain the encrypted first IP packet;

The memory 503 is configured to store one or more executable programs, and may store data used by the processor 502 when performing operations.

Optionally, the processor 502 is configured to: when determining that the first IP packet is in a tunnel mode, and determine that the source IP address in the first IP packet is negotiated according to an IPSec protocol. And determining, by the IP address, that the first IP packet is to be hard-encrypted; and determining that the first IP packet is in the transmission mode, acquiring a preset IP address set in a protection state in the cloud server, determining When the destination IP address in the first IP packet is one of the IP address sets, it is determined that the first IP packet needs to be hard encrypted.

Optionally, the transceiver 501 is further configured to: when the processor 502 determines that the first IP packet does not need to be hard-encrypted: sending the first IP packet.

Optionally, the transceiver 501 is further configured to: when the first IP packet is determined by the processor 502 to be a first IP packet that does not need to be encrypted: sending the first IP Message.

Optionally, the transceiver 501 is further configured to obtain a second IP packet, and send the encrypted second IP packet. The processor 502 is further configured to: determine that the second IP packet needs to be performed. In the case of hard encryption, a serial number is assigned to the second IP packet, and hard encryption is performed to obtain an encrypted second IP packet.

Optionally, the processor 502 is configured to: determine a preset security policy route, where the security policy route includes at least one IP address; and determine a destination IP address in the first IP packet. In the case of one of the at least one IP address, the first IP packet is determined to be the first IP packet to be encrypted.

Those skilled in the art will appreciate that embodiments of the present application can be provided as a method, system, or computer program product. Therefore, the embodiments of the present application may take the form of an entirely hardware embodiment, an entirely software embodiment, or an embodiment combining software and hardware. Moreover, embodiments of the present application can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) including computer usable program code.

In addition, the present application also provides a non-transitory computer readable storage medium storing computer instructions for causing the computer to perform the IPSec described in any of the above Protocol encryption method.

In addition, the present application also provides a computer program product comprising a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer And causing the computer to perform the IPSec protocol encryption method described in any of the above.

Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, devices (systems), and computer program products according to embodiments of the present application. It will be understood that each flow and/or block of the flowchart illustrations and/or FIG. These computer program instructions can be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing device to produce a machine for the execution of instructions for execution by a processor of a computer or other programmable data processing device. Means for implementing the functions specified in one or more of the flow or in a block or blocks of the flow chart.

The computer program instructions can also be stored in a computer readable memory that can direct a computer or other programmable data processing device to operate in a particular manner, such that the instructions stored in the computer readable memory produce an article of manufacture comprising the instruction device. The apparatus implements the functions specified in one or more blocks of a flow or a flow and/or block diagram of the flowchart.

These computer program instructions can also be loaded onto a computer or other programmable data processing device such that a series of operational steps are performed on a computer or other programmable device to produce computer-implemented processing for execution on a computer or other programmable device. The instructions provide steps for implementing the functions specified in one or more of the flow or in a block or blocks of a flow diagram.

It is apparent that those skilled in the art can make various modifications and variations to the embodiments of the present application without departing from the spirit and scope of the application. Thus, it is intended that the present invention cover the modifications and variations of the embodiments of the present invention.

Claims

An Internet Protocol Security IPSec protocol encryption method, characterized in that it is applicable to a multi-core of a control plane processor core including at least one control plane data processing and at least one user plane processor core for processing user plane data A heterogeneous network device, the method comprising:

The network device obtains the first IP packet by using the control plane processor core;

The network device, when the first IP packet is determined by the control plane processor to be the first IP packet to be encrypted:

The network device determines, according to the information of the first IP packet, that the first IP packet needs to be hard encrypted:

The network device allocates a serial number to the first IP packet by using the hardware encryption module, and performs hard encryption to obtain the encrypted first IP packet.

The network device sends the encrypted first IP packet by using a network card.
The method of claim 1, wherein the network device determines that the first IP packet needs to be hard-encrypted according to the information of the first IP packet, including:

And determining, by the network device, that the first IP packet is in a tunnel mode, and determining that the source IP address in the first IP packet is an IP address negotiated based on the IPSec protocol, determining the first IP packets need to be hard encrypted.

And determining, by the network device, that the first IP packet is in a transmission mode, acquiring a preset IP address set in the cloud server, and determining that the destination IP address in the first IP packet is In the case of one of the IP address sets, it is determined that the first IP packet needs to be hard encrypted.
The method of claim 1, wherein the network device, after determining that the first IP packet is the first IP packet to be encrypted, further includes:

The network device determines, according to the information of the first IP packet, that the first IP packet does not need to be hard encrypted:

The network device sends the first IP packet by using the network card.
The method of claim 1, wherein after the network device obtains the first IP packet by using the control plane processor core, the method further includes:

The network device, when the first IP packet is determined by the control plane processor to be the first IP packet that does not need to be encrypted:

The network device sends the first IP packet by using a network card.
The method of any of claims 1 to 4, further comprising:

The network device acquires a second IP packet by using the user plane processor core;

The network device determines, according to the information of the second IP packet, that the second IP packet needs to be hard encrypted:

The network device allocates a serial number to the second IP packet by using the hardware encryption module, and performs hard encryption to obtain an encrypted second IP packet.

The network device sends the encrypted second IP packet by using a network card.
The method according to any one of claims 1 to 4, wherein the determining, by the control plane processor, the first IP packet is a first IP packet to be encrypted, comprising:

Determining, by the network device, a preset security policy route, where the security policy route includes at least one IP address;

And determining, by the network device, that the first IP packet is the first IP packet to be encrypted, if the destination IP address in the first IP packet belongs to one of the at least one IP address. .
A network device for Internet Protocol Security IPSec protocol encryption, comprising: at least one control plane processor core for processing control plane data and at least one user plane processor core for processing user plane data The network device further includes a hardware encryption module and a network card;

The control plane processor core is configured to acquire a first IP packet;

The hardware encryption module is configured to: when the first IP packet is determined by the control plane processor core as a first IP packet to be encrypted: determined by the control plane processor core In the case that the first IP packet needs to be hard-encrypted, a sequence number is assigned to the first IP packet, and hard encryption is performed to obtain the encrypted first IP packet.

The network card is configured to send the encrypted first IP packet.
The network device according to claim 7, wherein said control plane processor core is configured to:

When the first IP packet is determined to be in the tunnel mode, and the source IP address in the first IP packet is determined to be an IP address negotiated based on the IPSec protocol, the first IP packet needs to be determined. Hard encryption;

When the first IP packet is determined to be in the transmission mode, the IP address set in the protected state is obtained in the cloud server, and the destination IP address in the first IP packet is determined to be the IP address. In the case of one of the sets, it is determined that the first IP packet needs to be hard encrypted.
The network device according to claim 7, wherein the network card is further configured to:

And sending, by the control plane processor, that the first IP packet does not need to be hard-encrypted: sending the first IP packet.
The network device according to claim 7, wherein the network card is further configured to:

When the first IP packet is determined by the control plane processor to be the first IP packet that is not required to be encrypted, the network device sends the first IP packet by using the network card.
The network device according to any one of claims 7 to 10, wherein the user plane processor core is configured to acquire a second IP packet;

The hardware encryption module is further configured to: when the user plane processor core determines that the second IP packet needs to be hard-encrypted: assign a serial number to the second IP packet, and perform hard Encrypted to obtain the encrypted second IP packet;

The network card is further configured to: send the encrypted second IP packet.
The network device according to any one of claims 7 to 10, wherein the control plane processor core is configured to:

Determining a preset security policy route; wherein the security policy route includes at least one IP address;

And determining, in the case that the destination IP address in the first IP packet belongs to one of the at least one IP address, determining that the first IP packet is the first IP packet to be encrypted.
A network device, comprising:

At least one processor; and,

a memory communicatively coupled to the at least one processor; wherein

The memory stores instructions executable by the at least one processor, the instructions being executed by the at least one processor to enable the at least one processor to perform the IPSec protocol of any of claims 1-6 Encryption method.
A non-transitory computer readable storage medium, wherein the non-transitory computer readable storage medium stores computer instructions for causing the computer to perform any of claims 1 to 6 Method.
A computer program product, comprising: a computing program stored on a non-transitory computer readable storage medium, the computer program comprising program instructions, when the program instructions are executed by a computer, The computer performs the method of any of claims 1 to 6.