WO2022257643A1 - 网络传输层数据处理方法、设备及存储介质 - Google Patents

网络传输层数据处理方法、设备及存储介质 Download PDF

Info

Publication number
WO2022257643A1
WO2022257643A1 PCT/CN2022/090383 CN2022090383W WO2022257643A1 WO 2022257643 A1 WO2022257643 A1 WO 2022257643A1 CN 2022090383 W CN2022090383 W CN 2022090383W WO 2022257643 A1 WO2022257643 A1 WO 2022257643A1
Authority
WO
WIPO (PCT)
Prior art keywords
transport layer
network transport
layer data
ebpf
kernel
Prior art date
Application number
PCT/CN2022/090383
Other languages
English (en)
French (fr)
Inventor
郭天
Original Assignee
中兴通讯股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 中兴通讯股份有限公司 filed Critical 中兴通讯股份有限公司
Priority to EP22819245.6A priority Critical patent/EP4354285A1/en
Publication of WO2022257643A1 publication Critical patent/WO2022257643A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00—Arrangements for program control, e.g. control units
    • G06F9/06—Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44—Arrangements for executing specific programs
    • G06F9/445—Program loading or initiating
    • G06F9/44505—Configuring for program initiating, e.g. using registry, configuration files
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L43/00—Arrangements for monitoring or testing data switching networks
    • H04L43/18—Protocol analysers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/22—Parsing or analysis of headers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/321—Interlayer communication protocols or service data unit [SDU] definitions; Interfaces between layers
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/30—Definitions, standards or architectural aspects of layered protocol stacks
    • H04L69/32—Architecture of open systems interconnection [OSI] 7-layer type protocol stacks, e.g. the interfaces between the data link level and the physical level
    • H04L69/322—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions
    • H04L69/326—Intralayer communication protocols among peer entities or protocol data unit [PDU] definitions in the transport layer [OSI layer 4]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/16—Implementing security features at a particular protocol layer
    • H04L63/166—Implementing security features at a particular protocol layer at the transport layer
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/16—Implementation or adaptation of Internet protocol [IP], of transmission control protocol [TCP] or of user datagram protocol [UDP]

Definitions

  • the embodiments of the present application relate to the communication field, and in particular to a data processing method, device, and storage medium of a network transport layer.
  • IPSec Internet Protocol Security
  • TLS Transport Layer Security
  • OSI model Open System Interconnection Reference Model
  • TLS Protect all IP-based communication; while TLS works at the transport layer of the fourth layer of the OSI model, generally in a reliable transport layer protocol, such as connection-oriented Transmission Control Protocol (Transmission Control Protocol, TCP), wireless Based on the connected User Datagram Protocol (UDP), it provides data security and integrity protection for upper-layer applications. Specifically, it uses a client-server model to create a secure transmission connection between two applications. /tunnel to prevent eavesdropping or tampering of interactive data.
  • TCP Transmission Control Protocol
  • UDP User Datagram Protocol
  • the above-mentioned encryption processing method or mechanism can realize the encryption or decryption processing of data in the kernel
  • the method based on the IPSec protocol requires the system administrator to modify the network configuration or connection topology of the system in practical applications, such as creating a new virtual network device, Modify the global routing table, etc., that is, there is an intrusive configuration requirement for the system operating environment; and based on the TLS protocol, in practical applications, the application program needs to actively initiate and participate in the establishment of the transmission connection/tunnel, related configuration parameters and sensitive data , such as digital certificates, etc. generally also need to be maintained by the application itself, that is, there is an intrusive configuration requirement for the empirical program itself.
  • the embodiment of the present application provides a network transport layer data processing method, which is applied to the extended Berkeley packet filter eBPF program running in the kernel.
  • the network transport layer data processing method includes: obtaining the network transport layer data packets that need to be distributed; Analyzing the network transport layer data packet, determining the network transport layer data processing method that needs to be performed on the network transport layer data packet; according to the network transport layer data processing method, processing the network transport layer data packet .
  • the embodiment of the present application also provides a network transport layer data processing method, including: applied to a management program running on the user plane, the network transport layer data processing method includes: after the management program is started, monitoring whether For the operation instructions of the eBPF program running in the kernel and/or the statistical data of the eBPF program during the processing of the network transport layer data packet; if the operation instruction for the eBPF program is received, according to the operation instruction The eBPF program performs processing; if the statistical data collected by the eBPF program during the processing of network transport layer data packets is received, the statistical data is processed.
  • the embodiment of the present application also provides a data processing device at the network transport layer, including: a management program running on the user plane, an eBPF program running on the kernel, at least one processor; and a communication connection with the at least one processor Memory; wherein, the management program is used to load the eBPF program to the kernel of the environment, so that the eBPF program runs on the kernel, and the memory stores instructions executable by the at least one processor, The instructions are executed by the at least one processor, so that the at least one processor can execute any one of the above-mentioned network transport layer data processing methods.
  • the embodiment of the present application also provides a computer-readable storage medium storing a computer program.
  • the computer program is executed by the processor, any one of the above-mentioned network transport layer data processing methods is realized.
  • Fig. 1 is a schematic diagram of the corresponding relationship between the traditional IPSec protocol, the TLS protocol and the OSI model;
  • FIG. 2 is a schematic flow diagram of a network transport layer data processing method applied to a management program provided by an embodiment of the present application
  • Fig. 3 is another schematic flow chart of the network transport layer data processing method applied to the management program provided by the embodiment of the present application;
  • FIG. 4 is a schematic diagram of the interaction between the management program and the eBPF program involved in the network transport layer data processing method shown in FIG. 2 or FIG. 3;
  • Fig. 5 is a schematic flow chart of a method for processing network transport layer data applied to an eBPF program provided by an embodiment of the present application
  • Fig. 6 is another schematic flowchart of the network transport layer data processing method applied to the eBPF program provided by the embodiment of the present application;
  • Fig. 7 is a schematic diagram of realizing fully transparent transmission encryption between node A and node B based on the network transport layer data processing method provided by the embodiment of the present application;
  • Fig. 8 is a schematic diagram of realizing joint encryption with an upper-layer application program between node A and node B based on the data processing method of the network transport layer provided by the embodiment of the present application;
  • FIG. 9 is a schematic structural diagram of a network transport layer data processing device provided by an embodiment of the present application.
  • the network transport layer data processing method, device, and storage medium proposed in the embodiments of the present application load and run a management program capable of managing eBPF programs on the user plane, and then use the management program to pre-register the eBPF program in the kernel, and the eBPF program will go to the kernel.
  • Interception requires kernel distribution, such as sending out network transport layer data packets, receiving network transport layer data packets, and determining the network transport layer data processing method of the network transport layer data packets that need to be distributed, and finally the eBPF program is based on the determined network transmission Layer data processing method, which processes the currently intercepted network transport layer data packets.
  • the entire network transport layer data processing process can be completed by the rewritten eBPF program in the kernel, without the need for the system environment or upper-layer applications to change their own state, and participate in the actual network transport layer data processing process, so that the system environment or
  • the transparency of upper-layer applications eliminates the need for additional deployment, configuration, operation and maintenance, and development costs, and also ensures good compatibility between the system environment and upper-layer applications.
  • the network transport layer data processing solution provided by this embodiment in addition to simply encrypting or decrypting network transport layer data packets based on the eBPF program loaded in the kernel, can also set the eBPF program and upper-layer applications, such as The application program running on the user plane cooperates to realize joint encryption or decryption processing, so as to further improve the network transport layer by combining the encryption/decryption method of the upper-layer application while minimizing the modification of the uploaded application according to the actual business needs Security of data packets during transmission.
  • FIG. 2 is a flow chart of a method for processing network transport layer data provided by an embodiment of the present application.
  • the method is mainly applied to a management program running on a user plane.
  • the network transport layer data processing method provided by this embodiment includes the following steps:
  • Step 201 after the hypervisor is started, monitor whether the operating instructions for the eBPF program running in the kernel and/or the statistical data during the processing of the network transport layer data packets collected by the eBPF program are received.
  • eBPF programs are essentially special codes that run in the kernel. Users can write functional codes within the limits specified by them. After compiling these codes into bytecodes, they will be loaded into a special virtual machine in the kernel for execution. Therefore, in order to manage the eBPF program according to actual business requirements, this embodiment provides a management program running on the user plane, so that the user can manage the eBPF program running in the kernel through the management program.
  • the management program is not only responsible for loading or registering eBPF programs into the kernel, but also provides user interaction interfaces.
  • the above-mentioned management program loads the eBPF program into the kernel, which is to load the bytecode of the eBPF program to realize the corresponding function to the specified location of the kernel, so that when the network transport layer data packet needs to be distributed by the kernel, such as sending out , or when receiving, the network transport layer data packet arriving at the kernel can be intercepted by the eBPF program loaded in the kernel, and then the eBPF program will process the network transport layer data packet according to the corresponding functional interface/function.
  • the user interaction interface provided by the hypervisor is specifically used to receive the user's operation instructions for the eBPF program running in the kernel.
  • the management program is also used to feed back the statistical data generated during the process of processing network transport layer data packets, such as the number of successful encryption/decryption, etc., to the eBPF program through the user interaction interface, and/or the running of the eBPF program The status, current configuration parameters and other information are fed back to the user for the user to perform follow-up operations according to the current running status of the eBPF program.
  • step 202 if it is monitored that an operation instruction for the eBPF program running on the kernel is received, then enter step 202; if it is monitored that the network transport layer data packet output by the eBPF program running on the kernel is received, then enter step 203.
  • the management program can store and/or display the above information received according to the pre-configured business requirements, or through user interaction Interface feedback to the user.
  • Step 202 process the eBPF program according to the operation instruction.
  • the operation instructions received by the management program through the user interaction interface for the eBPF program running in the kernel are divided into the following three types: the operation instruction is a configuration information update instruction, or an eBPF program replacement instruction, or an eBPF program uninstallation instruction .
  • the hypervisor processes the eBPF program already running in the kernel differently, as follows:
  • the configuration information to be updated is extracted from the configuration information update instruction.
  • configuration information mentioned in this embodiment includes any one or more of encryption and decryption conditions, encryption rules, and decryption rules.
  • the package needs to be encrypted, or decrypted.
  • the encryption rules mentioned above at least include the specific encryption algorithm used to encrypt the network transport layer data packets that need to be encrypted.
  • the encryption rule also needs to include the required key for encryption using the specified encryption algorithm.
  • the above-mentioned decryption rule at least includes a specific decryption algorithm used for decrypting the network transport layer data packets that need to be decrypted.
  • the decryption rule also needs to include the key required for decryption using the specified decryption algorithm.
  • encryption processing and decryption processing usually occur in pairs, so for the sender of the network transport layer data packet, for example, the configuration information about the encryption processing of the eBPF program running in the kernel in node A needs to communicate with the network
  • the receiver of the transport layer data packet such as the eBPF program running in the kernel in the B node, cooperates with each other in relation to the configuration information about the decryption process.
  • the configuration information mapping table mentioned in this embodiment is the BPF MAP involved in the eBPF technology.
  • a corresponding BPF MAP can be designed for different eBPF programs that can run in the kernel, or a global BPF MAP can be designed, and all eBPF programs that can run in the kernel share a BPF MAP.
  • BPF MAP the parameters required for encryption and decryption of eBPF programs need to be defined in BPF MAP.
  • the management program when the management program manages the eBPF program running in the kernel, such as modifying the configuration information, it only needs to update the configuration information that needs to be modified into the BPF MAP, and the eBPF program is After the kernel is activated, it will actively search for the required configuration information in the BPF MAP, and then make corresponding operations according to the found configuration information.
  • BFP MAP is essentially a switching mechanism/communication mechanism provided by the kernel. Based on BPF MAP, the management program running on the user plane and the eBPF program running on the kernel can realize interaction.
  • the replacement eBPF program is extracted from the eBPF program replacement directive.
  • Step 203 process the statistical data.
  • the management program when the hypervisor receives statistical data provided by the eBPF program when encrypting/decrypting data packets at the network transport layer, such as the number of successful encryptions or the number of successful decryptions, the management program performs The processing of the statistic data may be storing the statistical data in a preset storage area and/or displaying it in a preset format.
  • the management program will exit the current message processing operation and stop executing the network transmission provided by this embodiment, except that the received operation command is an eBPF program uninstall command and the eBPF program is uninstalled. Layer data processing method. In other cases, such as modifying instructions according to configuration parameters, or eBPF program replacement instructions, after processing eBPF programs already running in the kernel and processing statistical data, it will automatically enter the next message deal with.
  • the network transport layer data processing method provided by this embodiment is deployed on the user plane, and the management program is started, and the management program loads the eBPF program capable of encryption and decryption processing into the kernel, and monitors the eBPF program running on the The feedback of the eBPF program in the kernel and the operation instructions made by the user, and then according to the monitored results, the corresponding results are directly made on the user plane, or the eBPF program running in the kernel is managed, so as to realize the dynamic management of the eBPF program .
  • the hypervisor directly manages the eBPF program running in the kernel, it can activate and deactivate the eBPF program for encryption and decryption, and configure information without the system environment and upper-layer applications being aware of it. Change and other operations, so as to dynamically adjust the data to be transmitted, that is, the encryption and decryption of network transport layer data packets, so that the network transport layer data processing can better meet the actual changing business needs.
  • the network transport layer data processing method provided in this embodiment truly achieves transparency to the system environment or upper-layer applications, thereby eliminating the need for additional deployment, configuration, operation and maintenance, and development costs, and also ensuring a good system environment and Compatibility of upper layer applications.
  • the eBPF program can also cooperate with upper-layer applications to complete data encryption or protection.
  • an upper-layer application can intentionally send an illegal data packet. If the corresponding eBPF program is deployed in the receiver's environment (and the parameters are configured correctly), then the eBPF program can send the illegal data before the receiver's kernel sees the data.
  • node such as node A
  • no hypervisor may be deployed on the user plane, and eBPF may not be loaded in the kernel program.
  • node B that receives node A's encrypted network transport layer data packets through the upper layer application, it is necessary to deploy a management program on the user plane and record the eBPF program in the kernel, so as to cooperate to realize the processing of network transport layer data packets.
  • FIG. 3 is another flow chart of a method for processing network transport layer data provided by an embodiment of the present application.
  • the method is mainly applied to a management program running on a user plane.
  • the network transport layer data processing method includes the following steps:
  • Step 301 read configuration information from a preset address.
  • the kernel in order to ensure that the kernel has network transport layer data that needs to be distributed, whether it is inward, that is, the network transport layer data packets that the kernel receives from other nodes, or outward, that is, the network that the kernel needs to send to other nodes
  • the transport layer data packet can be intercepted by the eBPF program running in the kernel when it reaches the kernel, and the eBPF program will perform corresponding network transport layer data processing on the intercepted network transport layer data packet, such as encryption processing or decryption processing, which needs to be guaranteed
  • the eBPF program is already running in the kernel. Therefore, when the network transport layer data processing method provided by this embodiment is executed for the first time, when the management program is deployed to the user plane and started, the management program needs to read configuration information from a preset address, such as from the Read from one of the configuration information files.
  • the configuration information read by the management program from the preset address also includes any one or more of encryption and decryption conditions, encryption rules, and decryption rules.
  • Step 302 checking the integrity of eBPF programs and configuration information that need to be registered in the kernel.
  • the management program registers the pre-designed eBPF program to the kernel, and configures the read configuration information to the eBPF Before configuring the configuration information mapping table corresponding to the program, you need to check the integrity of the eBPF program and configuration information.
  • Step 303 if the eBPF program and configuration information are complete, register the eBPF program into the kernel, so that the eBPF program runs on the kernel.
  • the management program loads the bytecode of the eBPF program to the kernel of the environment, and loads the eBPF program into the kernel, and then exchanges data with the eBPF program through a system call function/interface (syscall).
  • system call function/interface seyscall
  • management program also provides external management and query interfaces, such as user interaction interfaces, so that the eBPF programs running in the kernel can be processed accordingly according to the operation instructions input from the outside.
  • external management and query interfaces such as user interaction interfaces
  • Step 304 configure the configuration information into the configuration information mapping table corresponding to the eBPF program.
  • the configuration information mapping table mentioned in this embodiment is the BPF MAP involved in the eBPF technology.
  • the eBPF program provided in this embodiment and the hypervisor may interact with configuration data or runtime statistical data through one or more BPF MAPs.
  • Step 305 enter message processing cycle operation.
  • the above-mentioned entry into the message processing loop operation refers to the pre-construction of the message queue, and each time a message that needs to be processed is detected, such as the operation instruction for the eBPF program and/or the eBPF program is written in the BPF MAP
  • a message that needs to be processed is detected, such as the operation instruction for the eBPF program and/or the eBPF program is written in the BPF MAP
  • Step 306 if a configuration information update instruction for the eBPF program is received, extract the configuration information to be updated from the configuration information update instruction, and update the configuration information mapping table corresponding to the eBPF program according to the extracted configuration information to be updated.
  • Step 307 if the eBPF program replacement instruction for the eBPF program is received, extract the replacement eBPF program from the eBPF program replacement instruction, register the replacement eBPF program into the kernel, and after the replacement eBPF program is registered into the kernel, uninstall the The eBPF program.
  • Step 308 if an eBPF program uninstallation instruction for the eBPF program is received, uninstall the eBPF program running in the kernel.
  • Step 309 if the eBPF program counts statistical data during the processing of network transport layer data packets, the statistical data will be stored in a preset storage area and/or displayed in a preset format.
  • steps 306 to 307 in this embodiment are roughly the same as several specific processing methods given in steps 202 and 203 in the embodiment shown in FIG. 2 , so details will not be repeated here.
  • the network transport layer data processing method uses the management program running on the user plane to load the eBPF program into the kernel before performing the network transport layer data processing, and configures and manages the eBPF program.
  • the eBPF program The configuration information used in the encryption and decryption processing is configured in the configuration information mapping table, so that when there is a network transport layer data packet that needs to be distributed by the kernel, the eBPF program can perform corresponding encryption and decryption processing.
  • FIG. 5 is a flowchart of a method for processing network transport layer data provided by an embodiment of the present application.
  • the method is mainly applied to an eBPF program running on a kernel.
  • the network transport layer data processing method mentioned in this embodiment specifically refers to the encryption or decryption of the network transport layer data packets to be distributed by the kernel by the eBPF program running in the kernel.
  • the network transport layer data processing method provided in this embodiment includes the following steps:
  • Step 501 acquiring network transport layer data packets to be distributed.
  • the network transport layer data packets that need to be distributed in this embodiment specifically refer to the need for the kernel to distribute the received network transport layer data packets to the upper layer applications of the node, such as applications running on the user plane, That is, the network transport layer data packets that need to be distributed come from other nodes.
  • the network transport layer data packets that need to be distributed may also be distributed by the kernel to other nodes, that is, the network transport layer data packets that need to be distributed need to be sent by the kernel to other nodes.
  • the eBPF program loaded into the kernel is not always running, or activated.
  • the kernel triggers, and then executes the network transport layer data processing method provided in this embodiment.
  • the obtained network transport layer data packets to be distributed are essentially transmitted to the eBPF program after the kernel triggers the eBPF program.
  • Step 502 analyzing the network transport layer data packet, and determining the network transport layer data processing method that needs to be performed on the network transport layer data packet.
  • the protocol header of the network transport layer data packet will carry information such as the protocol and quadruple used to transmit the network transport layer data packet, so it is determined that the network transport layer data packet needs to be processed
  • the protocol header of the network transport layer data packet is extracted by analyzing the network transport layer data packet, and then according to the protocol header and pre-configured encryption and decryption conditions, it is judged whether the network transport layer data packet needs Encrypt or decrypt.
  • the network transport layer data processing method that needs to be carried out to the network transport layer data is an encryption processing method; if it is determined by judgment that the network transport layer data packet needs to be decrypted, Then it is determined that the network transport layer data processing method that needs to be performed on the network transport layer data is decryption processing.
  • the encryption and decryption conditions mentioned in this embodiment are specifically provided by the management program running on the user plane.
  • the encryption and decryption conditions may be predetermined protocols for encrypting or decrypting network transport layer data packets transmitted.
  • encryption and decryption conditions may also be specified for a specific port number (source port number and/or destination port number), a specific IP address (source IP address and/or destination IP address).
  • the network transport layer data processing methods for the network transport layer data packets that need to be distributed are roughly divided into encryption processing and decryption processing.
  • the network transport layer data packets that need to be sent to other nodes are usually encrypted, and the network transport layer data packets received from other nodes are decrypted. Based on this, when determining the network transport layer data processing method that needs to be performed on the network transport layer data packets, it can be specifically determined whether the current network data needs to be sent out or received.
  • Step 503 process the network transport layer data packet according to the network transport layer data processing mode.
  • the processing of the network transport layer data packets is specifically:
  • the aforementioned pre-configured encryption rules are also provided by the management program running on the user plane. Specifically, the management program reads the configuration information including encryption rules from the preset address, and then configures the read configuration information into the configuration information mapping table corresponding to the eBPF program. Therefore, the above-mentioned operation of selecting the target encryption rule specifically selects an encryption rule from the configuration information mapping table that is suitable for the current network transport layer data packets that need to be encrypted.
  • the encryption rule needs to include at least a specific encryption algorithm.
  • the encryption rule also needs to include the encryption key, which can be understood as an encryption parameter.
  • how to select a target encryption rule suitable for the current network transport layer data packets that need to be encrypted can be determined according to the content of the protocol header of the current network transport layer data packets that need to be encrypted.
  • the specific encryption method and key corresponding to a certain protocol, or a specific port number, or a certain IP address are specified in advance, and then when selecting the target encryption rule, it is even more necessary to encrypt the data packets of the network transport layer.
  • the protocol header can quickly and accurately select an encryption rule suitable for the network transport layer data packet.
  • all network transport layer data packets that need to be encrypted may adopt the same encryption rule.
  • the payload part of the network transport layer data packet is encrypted.
  • the protocol header is updated to obtain the encrypted network transport layer data packet.
  • the length of the encrypted payload part is usually different from the length of the payload part before encryption. Therefore, in order to ensure that the encrypted network transport layer data packets are transmitted to other nodes, they will not be affected by the protocol header.
  • the length information recorded in and the length of the payload part of the actually received network transport layer data packet are inconsistent, and the encrypted network transport layer data packet is mistaken for illegal data. Therefore, after encrypting the payload part of the network transport layer data packet according to the target encryption rules, it is necessary to update the protocol header according to the encrypted payload part, so as to ensure that the information recorded in the protocol header of the encrypted network transport layer data packet is finally obtained It is consistent with the length of the encrypted payload.
  • the encrypted network transport layer data packets are handed over to the kernel, and the encrypted network transport layer data packets are distributed by the kernel.
  • the specific processing mode for the network transport layer data packet is as follows: first, select the target decryption rule from the pre-configured decryption rules; then, decrypt according to the target According to the rules, the payload part of the network transport layer data packet is decrypted; then, according to the decrypted payload part, the protocol header is updated to obtain the decrypted network transport layer data packet; finally, the decrypted network transport layer data packet is delivered to The kernel distributes the decrypted network transport layer data packets by the kernel.
  • the decryption rules need to correspond to the encryption rules. Ensure that the encrypted network transport layer data packets can be decrypted, and then restore the original network transport layer data packets.
  • the network transport layer data processing method loads and runs a management program capable of managing eBPF programs on the user plane, and then uses the management program to pre-register the eBPF program in the kernel, and the eBPF program intercepts the required kernel Distribution, such as sending out network transport layer data packets, receiving network transport layer data packets, and determining the network transport layer data processing method of the network transport layer data packets that need to be distributed, and finally the eBPF program processes according to the determined network transport layer data way to process the currently intercepted network transport layer packets.
  • the entire network transport layer data processing process can be completed by the rewritten eBPF program in the kernel, without the need for the system environment or upper-layer applications to change their own state, and participate in the actual network transport layer data processing process, so that the system environment or
  • the transparency of upper-layer applications eliminates the need for additional deployment, configuration, operation and maintenance, and development costs, and also ensures good compatibility between the system environment and upper-layer applications.
  • the eBPF program can also cooperate with upper-layer applications to complete data encryption or protection.
  • an upper-layer application can intentionally send an illegal data packet. If the corresponding eBPF program is deployed in the receiver's environment (and the parameters are configured correctly), then the eBPF program can send the illegal data before the receiver's kernel sees the data.
  • node such as node A
  • no hypervisor may be deployed on the user plane, and eBPF may not be loaded in the kernel program.
  • node B that receives node A's encrypted network transport layer data packets through the upper layer application, it is necessary to deploy a management program on the user plane and record the eBPF program in the kernel, so as to cooperate to realize the processing of network transport layer data packets.
  • the eBPF program is loaded into the kernel by the hypervisor running on the user plane, and the hypervisor can manage the eBPF program. Therefore, in practical applications, if the eBPF program running in the kernel receives the configuration information update instruction issued by the management program of the user plane, it will update the pre-configured configuration information according to the configuration information update instruction, that is, the configuration in the configuration information mapping
  • the configuration information in the table may specifically be any one or more of encryption and decryption conditions, encryption rules, and decryption rules.
  • the dynamic update of the eBPF program running in the kernel is realized, so that the eBPF program running in the kernel can better adapt to the actual data processing requirements of the network transport layer.
  • FIG. 6 is a flow chart of a method for processing network transport layer data provided by an embodiment of the present application.
  • the method is mainly applied to an eBPF program running on a kernel.
  • the network transport layer data processing method provided in this embodiment includes the following steps:
  • Step 601 acquiring network transport layer data packets to be distributed.
  • step 601 in this embodiment is substantially the same as step 501 in the embodiment shown in FIG. 5 , and will not be repeated here.
  • Step 602 analyzing the network transport layer data packet to determine whether the network transport layer data packet needs to be processed.
  • the current network transport layer data packet that needs to be distributed can be determined according to the identification information carried in the protocol header of the parsed network transport layer data packet Whether encryption or decryption is required.
  • step 603 determines the specific network transport layer data processing method that needs to be performed on the network transport layer data packet.
  • step 610 directly enters step 610, that is, directly hand over the intercepted network transport layer data packet to the kernel, and the kernel distributes it.
  • Step 603 determine whether the network transport layer data packet is a network transport layer data packet to be sent or a received network transport layer data packet.
  • the network transport layer data processing that needs to be performed is encryption processing.
  • the network transport layer data packet that needs to be processed by the network transport layer needs to be fed back by the kernel to the upper layer application, that is, the application program located in the user plane, or the network transport layer data packet is the network transmission received by the kernel from other nodes
  • the data processing method of the network transport layer that needs to be performed is the decryption processing method.
  • the network transport layer data packet is a network transport layer data packet that needs to be sent, go to step 603 .
  • it is determined that the network transport layer data packet is the received network transport layer data packet go to step 607 .
  • Step 604 encrypt the payload part of the network transport layer data packet.
  • Step 605 updating the protocol header of the network transport layer data packet.
  • Step 606 hand over the encrypted network transport layer data packet to the kernel, and the kernel distributes the encrypted network transport layer data packet.
  • Step 607 decrypt the payload part of the network transport layer data packet.
  • Step 608 updating the protocol header of the network transport layer data packet.
  • Step 609 hand over the decrypted network transport layer data packet to the kernel, and the kernel distributes the decrypted network transport layer data packet.
  • Step 610 hand over the network transport layer data packets to the kernel, and the kernel distributes the network transport layer data packets.
  • the network transport layer data processing method provided by this embodiment by using the eBPF program, well solves the intrusion impact of the traditional network transport layer data transmission encryption protocol on the system environment and upper-layer applications during use, and provides More flexible and powerful data transmission encryption and protection functions, and better isolation and guarantee in terms of security.
  • eBPF technology supports a variety of program types, and different types of programs are suitable for different purposes.
  • the type that is more suitable for implementing the transmission encryption function is traffic control (Traffic Control, TC). Therefore, the eBPF program for encrypting or encrypting data packets at the network transport layer mentioned in this embodiment is specifically a TC-type eBPF program.
  • the Linux kernel can directly intercept the processing entry and exit of the network transport layer data packet.
  • the TC program can directly access the cache original The memory buffer area of the network transport layer data packet, and then according to the memory buffer address corresponding to the original network transport layer data packet, obtain the network transport layer data packet to be processed from the memory buffer area, and then obtain the network transport layer data packet Carry out the corresponding network transport layer data processing operations, and after completing the corresponding network transport layer data processing operations, hand them over to the kernel for distribution and processing.
  • the specific implementation and configuration logic of data encryption and decryption can be integrated into a software and hardware unit, so that the network transport layer data can be completed without the system environment and upper-layer applications knowing any details. encryption and decryption.
  • the eBPF program like the kernel, can be dynamically loaded/unloaded at runtime, so the network transport layer data processing method provided in this embodiment can activate/deactivate the encryption and decryption function at runtime, or dynamically replace the encryption Algorithms and configuration data, while the operating system and upper-layer applications can be unaware of these behavior changes.
  • TC-type eBPF program used in this embodiment is determined based on the current status of eBPF technology. If other suitable types appear in the subsequent rapid evolution of eBPF technology, this implementation can still be implemented. Example implementation method. That is, the use of TC-type eBPF programs in this embodiment to implement network transmission data processing is only a specific implementation manner, and does not constitute any limitation on the technical solution provided in this embodiment itself.
  • the eBPF program can also cooperate with upper-layer applications to complete data encryption or protection.
  • an upper-layer application can intentionally send an illegal data packet. If the corresponding eBPF program is deployed in the receiver's environment (and the parameters are configured correctly), then the eBPF program can send the illegal data before the receiver's kernel sees the data.
  • FIG. 7 and Figure 8 illustrates the data processing of the network transport layer based on the cooperation of the management program and the eBPF program, specifically the encryption and decryption process.
  • the receiver of the network transport layer data packet (hereinafter referred to as the data receiver) and the sender of the network transport layer data packet (hereinafter referred to as the data sender) must both use Linux System, and the kernel version must be greater than 4.3, and eBPF-related functions must be enabled.
  • the two parties of data communication that is, the data sender and the data receiver need to use a standard network transport layer protocol stack, such as IP, TCP/UDP communication.
  • a standard network transport layer protocol stack such as IP, TCP/UDP communication.
  • the management program running on the user plane and the eBPF program running on the kernel can be packaged in a software package SDK for distribution and deployment in the form of software, or can be packaged in a Distributed and deployed in the form of hardware units in portable hardware.
  • the network cards of some mainstream manufacturers currently on the market already support the direct loading and running of eBPF programs.
  • Figure 7 is a schematic diagram of fully transparent transmission encryption between node A and node B, that is, the application program (upper layer application) on the user plane does not participate in encryption and decryption, and the entire transmission encryption process, for node A and node B
  • the application program upper layer application
  • the system environment and upper-layer applications are not aware of it.
  • the upper-layer application communicates with another remote application using TCP protocol on port 1080, such as node A and node B in Figure 7; the network devices of node A and node B are both eth0; the file name of the eBPF program is eBPF.elf ;
  • the function responsible for encryption in the eBPF program is named encrypt; the function responsible for decryption in the eBPF program is named decrypt.
  • the management program For the management program, it needs to run on Node A and Node B, and load the eBPF program (specifically load the encryption function and decryption function in the eBPF program) through the following command:
  • both the kernel of node A and the kernel of node B will call the encrypt function in the previously mounted eBPF program when sending network transport layer packets (egress) to eth0, and Pass the raw kernel data buffer (socket kernel buffer, skb for short) pointer to the function.
  • IP protocol analysis (parsing and stripping the IP header) is carried out to the load part, if the load protocol indication of the IP header is not TCP, then directly end the processing, that is, enter step (10).
  • the kernel of node A or the kernel of node B receives the network transport layer data packet (ingress) from eth0, it will call the decrypt function in the eBPF program mounted before, and Pass the raw data buffer (sk_buff, skb for short) pointer to the function.
  • TCP protocol analysis parsing and stripping the TCP header
  • the load part if the format is correct, it means that the data is not encrypted, and the processing is directly ended, and the step (9) is entered.
  • BPF MAP configuration information mapping table
  • the management program is also responsible for the following work: pass necessary parameters to the encrypt function and decrypt function through the BPF MAP, such as RC4 encryption algorithm related parameters, TCP port number, etc.
  • BPF MAP Through BPF MAP, read and summarize the statistical data recorded by the encrypt function and decrypt function at runtime, such as the total number of encrypted/decrypted packets, the number of successes/failures, etc.; through the interface of the command line (or other forms, such as Restful, etc.), the user can Manage and query the operating parameters of the eBPF program, such as four-tuple information (port number, address, etc.) and operating status, such as the number of successful encryption/decryption, how much illegal or legal data is detected, etc.
  • the operating parameters of the eBPF program such as four-tuple information (port number, address, etc.) and operating status, such as the number of successful encryption/decryption, how much illegal or legal data is detected, etc.
  • the upper-layer application does not participate in the encryption and decryption process of the network transmission layer, so it is completely unaware of the algorithm, parameters, timing and other details adopted by the underlying transmission encryption system. Encryption and decryption are not considered when receiving network data, and all are processed in plain text format. In this way, the upper-layer application can realize the encryption and decryption of network transport layer data without any operation or configuration modification, and the upper-layer application knows nothing about the details of the encryption process. Even if it is compromised by an attacker, it cannot understand the actual details of the encryption and decryption process.
  • Figure 8 is a schematic diagram of implementing joint encryption with upper-layer applications between Node A and Node B, that is, the application program located on the user plane participates in the eBPF program running in the kernel for the network transport layer data packets that need to be distributed Encryption processing or decryption processing.
  • the upper-layer applications will cooperate with the encryption system to complete the encryption and decryption process of the transmitted data.
  • the encryption system there are many ways to cooperate, such as:
  • Method 1 The application program is responsible for encrypting the sent data, and the peer eBPF program is responsible for decrypting the received data.
  • Method 2 The application program is responsible for decrypting the received data, and the peer eBPF program is responsible for encrypting the sent data.
  • Method 3 The application program is responsible for the encryption and decryption of sending and receiving data, and the eBPF program is responsible for scrambling and descrambling the encrypted data when sending and receiving data, that is, the eBPF program performs secondary encryption and decryption on the data encrypted or decrypted by the upper layer application. deal with.
  • both node A and node B need to deploy a management program and an eBPF program, and both eBPF programs support the call of the encrypt function and the decrypt function.
  • Its general implementation is similar to the description of FIG. 7 , except that encryption and encryption operations are added to the application program on the user plane.
  • the application program uses a preset encryption algorithm, such as an asymmetric encryption algorithm, to encrypt the data to be sent
  • a management program is deployed on the user plane, and The eBPF program for decryption is loaded into the kernel.
  • This method is especially suitable for scenarios with the following characteristics or requirements: the application of the data sending end is completely controlled (code and configuration can be modified); the data transmission channel is untrusted and uncontrolled; the application of the data receiving end is not controlled (the code or configuration cannot be modified). Configuration); the network configuration of the environment where the sending end and the receiving end are located cannot or is not convenient to modify; only the sending data is required to be encrypted, and the response data sent back by the remote end is not required to be encrypted.
  • the upper-layer application communicates with another remote application using the TCP protocol on port 1080, such as node A and node B in Figure 8; the network devices of node A and node B are both eth0; the user plane of node B runs a management program , the kernel of node B runs an eBPF program, the file name of the eBPF program is eBPF.elf, and the eBPF program is only responsible for decryption, and the function responsible for decryption is named decrypt.
  • the upper layer application uses an asymmetric encryption algorithm (such as X25519 elliptic curve encryption algorithm or other similar algorithms), and uses the public key to encrypt the TCP payload data to be sent, Then send it again.
  • node A does not need to reside in a management program, nor does it need to load any eBPF program.
  • the management program needs to reside on the user plane, and the eBPF program needs to reside on the kernel, and for the management program in node B, the eBPF program needs to be loaded through the following command (specifically load Decryption function in eBPF program): load the decryption function in eBPF program: tc filter add dev eth0 inressbpf da objeBPF.elf sec decrypt.
  • the kernel of node B after executing the above loading command, if the kernel of node B receives the network transport layer data packet (ingress) sent from node A from eth0, it will call the decrypt function in the previously mounted eBPF program, and The skb pointer is passed to the function.
  • the decryption method used by the eBPF program for decryption needs to correspond to the encryption method adopted by the application program in node A.
  • the eBPF program in the kernel is used to complete the decryption of the network transport layer data packet.
  • the decrypt function also needs to perform the following operations: obtain the necessary parameters passed by the management program from the specified BPF MAP, such as X25519 encryption algorithm related parameters, private key, TCP port number, etc.; Record to the specified BPF MAP, such as the total number of encrypted/decrypted packets, success/failure times, etc.
  • the management program running on the user plane of Node B is also responsible for the following tasks: passing necessary parameters to the decrypt function through the BPF MAP, Such as X25519 encryption algorithm related parameters, private key, TCP port number, etc.; through BPF MAP, read and summarize the statistical data recorded by the decrypt function at runtime, such as the total number of decrypted packets, success/failure times, etc.; through the command line (or other forms, Such as Restful, etc.) interface, allowing users to manage and query the running parameters and running status of eBPF programs.
  • BPF MAP Such as X25519 encryption algorithm related parameters, private key, TCP port number, etc.
  • BPF MAP read and summarize the statistical data recorded by the decrypt function at runtime, such as the total number of decrypted packets, success/failure times, etc.
  • the command line or other forms, Such as Restful, etc.
  • the network transport layer data processing method provided by this embodiment can realize network transport layer communication encryption without the system environment configuration and upper-layer applications being aware, so it has a lower deployment cost and a good environment and application compatibility.
  • the encryption algorithm, parameters, and activation switch can be changed at any time during operation, and the upper-layer application can also choose to cooperate with the system to realize a custom joint encryption protection mechanism, so it has good flexibility and scalability.
  • the method is also guaranteed in terms of security and performance.
  • FIG. 9 is a schematic structural diagram of a network transport layer data processing device provided by an embodiment of the present application.
  • the network transport layer data processing device includes: at least one processor 901 ; and a memory 902 communicatively connected to the at least one processor.
  • the network transmission layer data processing equipment also includes a management program running on the user plane and an eBPF program running on the kernel.
  • the hypervisor is used to load into the kernel of the environment, or to register the eBPF program, so that the eBPF program can run in the kernel
  • the memory 902 stores instructions executable by at least one processor 901, and the instructions are executed by at least one processor 901 is executed, so that at least one processor 901 can execute the network transport layer data processing method described in the method embodiment applied to the management program, or the network transport layer data processing method described in the method embodiment applied to the eBPF program.
  • the memory 902 and the processor 901 are connected by a bus, and the bus may include any number of interconnected buses and bridges, and the bus connects one or more processors 901 and various circuits of the memory 902 together.
  • the bus may also connect together various other circuits such as peripherals, voltage regulators, and power management circuits, all of which are well known in the art and therefore will not be further described herein.
  • the bus interface provides an interface between the bus and the transceivers.
  • a transceiver may be a single element or multiple elements, such as multiple receivers and transmitters, providing means for communicating with various other devices over a transmission medium.
  • the data processed by the processor 901 is transmitted on the wireless medium through the antenna, and further, the antenna also receives the data and transmits the data to the processor 901 .
  • Processor 901 is responsible for managing the bus and general processing, and may also provide various functions, including timing, peripheral interface, voltage regulation, power management, and other control functions. And the memory 902 may be used to store data used by the processor 901 when performing operations.
  • the embodiment of the present application also relates to a computer-readable storage medium storing a computer program.
  • the computer program is executed by the processor, the network transport layer data processing method described in the above method embodiments is implemented.
  • a storage medium includes several instructions to make a device ( It may be a single-chip microcomputer, a chip, etc.) or a processor (processor) to execute all or part of the steps of the methods described in the various embodiments of the present application.
  • the aforementioned storage media include: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), magnetic disk or optical disc, etc., which can store program codes. .

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • General Engineering & Computer Science (AREA)
  • Software Systems (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • Theoretical Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • General Physics & Mathematics (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请实施例涉及通信领域，公开了一种网络传输层数据处理方法、设备及存储介质，本申请的网络传输层数据处理方法应用于运行在内核的扩展伯克利包过滤器eBPF程序，所述方法包括：获取需要分发的网络传输层数据包；对所述网络传输层数据包进行解析，确定需要对所述网络传输层数据包进行的网络传输层数据处理方式；根据所述网络传输层数据处理方式，对所述网络传输层数据包进行处理。

Description

网络传输层数据处理方法、设备及存储介质
相关申请的交叉引用
本申请基于申请号为“202110655627.0”、申请日为2021年06月11日的中国专利申请提出，并要求该中国专利申请的优先权，该中国专利申请的全部内容在此以引入方式并入本申请。
技术领域
本申请实施例涉及通信领域，特别涉及一种网络传输层数据处理方法、设备及存储介质。
背景技术
当前，随着日益严峻的网络安全环境，系统间进程的网络传输层通信加密和其他安全保护措施变得越来越重要。Linux作为目前业界主流的商用产品运行系统，提供了多种内置的网络传输层加密协议与相关实现。目前较为常见的网络传输层加密处理方法或机制有：互联网安全协议(Internet Protocol Security，IPSec)和传输层安全协议(Transport Layer Security，TLS)。如图1所示，在实际应用中，IPSec是工作在开发式系统互联通信参考模块(Open System Interconnection Reference Model，OSI模型)位于第三层的网络层，通过对IP协议包进行加密和认证来保护所有基于IP协议的通信；而TLS则是工作在OSI模型位于第四层的传输层，一般在一种可靠的传输层协议，如面向连接的传输控制协议(Transmission Control Protocol，TCP)、无连接的用户数据报协议(User Datagram Protocol，UDP)基础上为上层应用提供数据安全和完整性保护，具体是采用客户端-服务器模型的方式，在两个应用程序之间创建一个安全的传输连接/隧道，以防止交互的数据被窃听或篡改。
虽然上述加密处理方法或机制可以实现数据在内核的加密或解密处理，但是基于IPSec协议的方式，在实际应用中需要系统管理员修改系统的网络配置或连接拓扑，如创建新的虚拟网络设备、修改全局路由表等，即对系统运行环境有侵入式的配置需求；而基于TLS协议的方式，在实际应用中需要应用程序主动发起并参与传输连接/隧道的建立过程，相关配置参数和敏感数据，如数字证书等一般也需要应用程序自身来维护，即对经验程序自身有侵入式配置需求。
也就是说，对于传统的网络传输层加密处理方法，其对系统环境或上层应用是不透明的。它们需要系统环境或上层应用改变自身的状态，并参与到实际的加解密流程中。这种不透明带来了额外的部署、配置、运维以及开发的负担，同时也带来了额外的风险，如任何一个错误的配置或实现都可能导致数据保护失效，或是对系统环境造成不利影响，进而影响到其他应用。
发明内容
本申请的实施例提供了一种网络传输层数据处理方法，应用于运行在内核的扩展伯克利包过滤器eBPF程序，所述网络传输层数据处理方法包括：获取需要分发的网络传输层数据包；对所述网络传输层数据包进行解析，确定需要对所述网络传输层数据包进行的网络传输 层数据处理方式；根据所述网络传输层数据处理方式，对所述网络传输层数据包进行处理。
本申请实施例还提供了一种网络传输层数据处理方法，包括：应用于运行在用户面的管理程序，所述网络传输层数据处理方法包括：在所述管理程序启动后，监测是否接收到针对运行在内核的eBPF程序的操作指令和/或所述eBPF程序统计的针对网络传输层数据包处理过程中的统计数据；如果接收到针对所述eBPF程序的操作指令，根据所述操作指令对所述eBPF程序进行处理；如果接收到所述eBPF程序统计的针对网络传输层数据包处理过程中的统计数据，对所述统计数据进行处理。
本申请实施例还提供了一种网络传输层数据处理设备，包括：运行在用户面的管理程序和运行在内核的eBPF程序，至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；其中，所述管理程序用于向所在环境的内核加载所述eBPF程序，以使所述eBPF程序运行在所述内核，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如上所述的任意一种网络传输层数据处理方法。
本申请实施例还提供了一种计算机可读存储介质，存储有计算机程序。所述计算机程序被处理器执行时实现上述所述的任意一种网络传输层数据处理方法。
附图说明
一个或多个实施例通过与之对应的附图中的图片进行示例性说明，这些示例性说明并不构成对实施例的限定。
图1是传统的IPSec协议、TLS协议与OSI模型的对应关系示意图；
图2是本申请实施例提供的应用于管理程序的网络传输层数据处理方法的流程示意图；
图3是本申请实施例提供的应用于管理程序的网络传输层数据处理方法的又一流程示意图；
图4针对图2或图3所示的网络传输层数据处理方法中涉及的管理程序与eBPF程序之间的交互示意图；
图5是本申请实施例提供的应用于eBPF程序的网络传输层数据处理方法的流程示意图；
图6是本申请实施例提供的应用于eBPF程序的网络传输层数据处理方法的又一流程示意图；
图7是基于本申请实施例提供的网络传输层数据处理方法在节点A和节点B之间实现全透明传输加密的示意图；
图8是基于本申请实施例提供的网络传输层数据处理方法在节点A和节点B之间实现与上层应用程序联合加密的示意图；
图9是本申请实施例提供的网络传输层数据处理设备的结构示意图。
具体实施方式
本申请实施例中术语“和/或”，描述关联对象的关联关系，表示可以存在三种关系，例如，A和/或B，可以表示：单独存在A，同时存在A和B，单独存在B这三种情况。字符“/”一般表示前后关联对象是一种“或”的关系。
本申请实施例中术语“多个”是指两个或两个以上，其它量词与之类似。
为使本申请实施例的目的、技术方案和优点更加清楚，下面将结合附图对本申请的各实施例进行详细的阐述。然而，本领域的普通技术人员可以理解，在本申请各实施例中，为了使读者更好地理解本申请而提出了许多技术细节。但是，即使没有这些技术细节和基于以下各实施例的种种变化和修改，也可以实现本申请所要求保护的技术方案。以下各个实施例的划分是为了描述方便，不应对本申请的具体实现方式构成任何限定，各个实施例在不矛盾的前提下可以相互结合相互引用。
本申请实施例提出的网络传输层数据处理方法、设备及存储介质，通过在用户面加载并运行能够管理eBPF程序的管理程序，进而利用管理程序预先将eBPF程序注册到内核中，由eBPF程序去拦截需要内核分发，如发送出去的网络传输层数据包、接收的网络传输层数据包，并确定需要分发的网络传输层数据包的网络传输层数据处理方式，最终由eBPF程序根据确定的网络传输层数据处理方式，对当前拦截的网络传输层数据包进行处理。整个网络传输层数据处理过程在改写后的内核中的eBPF程序便可以完成，无需系统环境或上层应用改变自身的状态，并参与到实际的网络传输层数据处理过程中，做到了对系统环境或上层应用的透明化，从而无需额外的部署、配置、运维以及开发成本，也保证了良好的系统环境与上层应用的兼容性。
除此之外，本实施例提供的网络传输层数据处理方案，除了单纯的基于加载在内核中的eBPF程序对网络传输层数据包进行加密或解密处理，还可以设置eBPF程序与上层应用，如运行在用户面的应用程序配合，实现联合加密或解密处理，从能够根据实际业务需求，在尽可能减小对上传应用修改的情况下，联合上层应用的加密/解密方式，进一步提升网络传输层数据包在传输过程中的安全性。
此外，基于eBPF技术自身的安全性和高性能，也保证了本实施例提供的网络传输层数据处理方案的安全性和整体性能。
参见图2，图2是本申请实施例提供的网络传输层数据处理方法的流程图，在本实施例中，该方法主要应用于运行在用户面的管理程序。
如图2所示，本实施例提供的网络传输层数据处理方法，包括以下步骤：
步骤201，在管理程序启动后，监测是否接收到针对运行在内核的eBPF程序的操作指令和/或eBPF程序统计的针对网络传输层数据包处理过程中的统计数据。
需要说明的，本实施例中所说的eBPF程序(extended Berkeley Packet Filter，扩展伯克利过滤器)其原本的目标是实现一种全新的包过滤器，以取代IPTABLE(一种网络防火墙)，但是后续的演进对其功能进行了扩展。现在eBPF程序本质上是运行在内核里的特殊代码，用户可以在其规定的限制下编写功能代码，这些代码编译成字节码后将加载到内核里一个特殊的虚拟机内执行。因此，为了能够根据实际的业务需求对eBPF程序进行管理，本实施例提供了运行在用户面的管理程序，从而使得用户能够通过管理程序，实现对运行在内核中的eBPF程序的管理。
基于上述论述，为了保证本实施例提供的网络传输层数据处理方法的实现，以及对eBPF程序的管理，管理程序不仅要负责向内核中加载，或者说注册eBPF程序，还提供了用户交互接口。
本实施例中，上述所说管理程序向内核中加载eBPF程序，是将eBPF程序实现相应功能的字节码加载到内核的指定位置，以便当网络传输层数据包需要内核分发，如向外发送，或者接收时，到达内核的网络传输层数据包能够被加载在内核中的eBPF程序拦截，进而由eBPF程序根据对应的功能接口/函数对网络传输层数据包进行相应处理。
相应地，管理程序提供的用户交互接口，具体用于接收用户作出的针对运行在内核中的eBPF程序的操作指令。
在一个例子中，管理程序还用于通过用户交互接口将eBPF程序反馈的处理网络传输层数据包过程中产生的统计数据，如成功加密的数量/解密的数量等，和/或eBPF程序的运行状态、当前配置参数等信息反馈给用户，供用户根据eBPF程序的当前运行情况进行后续操作。
通过上述描述可知，管理程序启动后，具体是通过监测用户交互接口来确定当前是否有针对运行在内核的eBPF程序的操作指令，通过监测与内核中运行的eBPF程序交互的接口，如系统调用函数/接口(syscall)来确定是否接收到eBPF程序统计的针对网络传输层数据包处理过程中的统计数据。
相应地，如果监测到接收到了针对运行在内核的eBPF程序的操作指令，则进入步骤202；如果监测到接收到了运行在内核的eBPF程序输出的网络传输层数据包，则进入步骤203。
此外，应当理解的，在一个例子中，管理程序如果接收到运行在内核的eBPF程序反馈的当前状态信息，如解密成功的网络传输层数据包的数量、加密成功的网络传输层数据包的数量，以及eBPF程序当前进行加解密时依据的加解密条件、规则等，管理程序可以根据预先配置的业务需求，对接收到的上述信息进行存储和/或以预设形式展示，还或者通过用户交互接口反馈给用户。
步骤202，根据操作指令对eBPF程序进行处理。
在一个例子中，管理程序通过用户交互接口接收到的针对运行在内核中的eBPF程序的操作指令分为如下3种：操作指令为配置信息更新指令，或者eBPF程序替换指令，或者eBPF程序卸载指令。
相应地，针对上述3中不同的操作指令，管理程序对已经运行在内核中的eBPF程序进行的处理也有所差异，具体如下：
(1)在操作指令为配置信息更新指令时，对已经运行在内核中的eBPF程序进行的处理具体为：
首先，从配置信息更新指令中提取需要更新的配置信息。
可理解的，本实施例中所说的配置信息包括加解密条件、加密规则、解密规则中的任意一种或几种。
关于上述所说的加解密条件，具体为预先约定的针对采用哪类网络传输层协议、对应的四元组(源端口号、目的端口号、源IP地址、目的IP地址)的网络传输层数据包需要进行加密处理，或解密处理。
相应地，上述所说的加密规则，至少包括了对需要进行加密处理的网络传输层数据包进行加密处理所采用的具体加密算法。
本实施例中，如果规定的加密算法需要用到密钥，则加密规则中还需要包括采用规定的加密算法进行加密所需的密钥。
相应地，上述所述的解密规则，至少包括了对需要进行解密处理的网络传输层数据包进行解密处理所采用的具体解密算法。
本实施例中，如果规定的解密算法需要用到密钥，则解密规则中还需要包括采用规定的解密算法进行解密所需的密钥。
此外，应当理解的，加密处理和解密处理通常是成对出现的，因而对于网络传输层数据包的发送方，比如节点A中运行在内核中的eBPF程序关于加密处理的相关配置信息需要与网络传输层数据包的接收方，比如B节点中运行在内核中的eBPF程序关于解密处理的相关配置信息是相互配合的。
然后，根据提取的需要更新的配置信息对已经运行在内核中的eBPF程序对应的配置信息映射表更新。
本实施例中所说的配置信息映射表，即eBPF技术中涉及的BPF MAP。在具体应用中，可以针对能够运行在内核中的不同eBPF程序分别设计一个对应的BPF MAP，也可以设计一个全局的BPF MAP，对于所有能够运行在内核中的eBPF程序都统一共用一个BPF MAP。但不论哪种方式，在根据业务需要预先设计BPF MAP时，均需将eBPF程序进行加密、解密等出来所需的参数定义到BPF MAP中。
相应地，基于设计好的BPF MAP，管理程序在对运行在内核中的eBPF程序进行管理时，如配置信息的修改时，只需将需要修改的配置信息更新到该BPF MAP中，eBPF程序被内核激活后，便会主动去BPF MAP中查找需要的配置信息，然后根据查找到的配置信息作出相应操作。
也就是说，BFP MAP实质是内核提供的一种交换机制/通信机制，基于BPF MAP运行在用户面的管理程序和运行在内核的eBPF程序便可以实现交互。
(2)在操作指令为eBPF程序替换指令时，对已经运行在内核中的eBPF程序进行的处理具体为：
首先，从eBPF程序替换指令中提取替换eBPF程序。
然后，将替换eBPF程序注册到内核中，并在替换eBPF程序注册到内核后，卸载内核中运行的eBPF程序。
(3)在操作指令为eBPF程序卸载指令时，对已经运行在内核中的eBPF程序进行的处理具体为：卸载内核中运行的eBPF程序。
步骤203，对统计数据进行处理。
在一个例子中，管理程序在接收到eBPF程序提供的对网络传输层数据包进行加密/解密处理时统计的统计数据，如成功加密的数量或成功解密的数量时，对接收到的统计数据进行的处理可以是将统计数据存储到预设存储区域和/或以预设形式展示。
此外，值得一提的是，在实际应用中，管理程序除了在接收到的操作指令是eBPF程序卸载指令，并卸载eBPF程序后会退出当前的消息处理操作，停止执行本实施例提供的网络传输层数据处理方法，其他情况下，如根据配置参数修改指令，或eBPF程序替换指令完成对已经运行在内核中的eBPF程序的处理后，以及对统计数据进行处理后，均会自动进入下一次消息处理。
通过上述描述不难发现，本实施例提供的网络传输层数据处理方法，通过在用户面部署，并启动管理程序，由管理程序向内核中加载能够实现加解密处理的eBPF程序，并监测运行 在内核中的eBPF程序的反馈，以及用户作出的操作指令，进而根据监测到的结果，在用户面直接作出相应结果，或者对运行在内核中的eBPF程序进行管理，从而实现对eBPF程序的动态管理。由于整个过程，无需系统环境或上层应用改变自身的状态，并参与到实际的网络传输层数据处理过程中，因此在系统环境、上层应用没有任何变更的情况下，便可以实现网络传输层数据的加解密处理。
此外，由于管理程序直接对运行在内核中eBPF程序进行管理，因此能够在系统环境、上层应用没有感知的情况下，就可以实现对进行加解密处理的eBPF程序的激活、去激活，配置信息的变更等操作，从而能够动态的调整对需要传输的数据，即网络传输层数据包进行加解密处理，使得网络传输层数据处理能够更加满足实际变动的业务需要。
基于此，本实施例提供的网络传输层数据处理方法，真正做到了对系统环境或上层应用的透明化，从而无需额外的部署、配置、运维以及开发成本，也保证了良好的系统环境与上层应用的兼容性。
此外，基于eBPF技术自身的安全性和高性能，也保证了本实施例提供的网络传输层数据处理方案的安全性和整体性能。
此外，在一个例子中，如果不追求绝对的透明，或者是有特殊的数据保护需求，eBPF程序也可以和上层应用配合起来完成对数据的加密或保护。例如，上层应用可以有意发送内容不合法的数据包，如果接收方的环境部署了对应的eBPF程序(同时参数配置正确)，那么在接收方内核看到数据前，eBPF程序可以将不合法的数据修复，然后再交由内核处理，从而让接收方应用能正确读取信息；如果接收方环境没有部署对应的eBPF程序(或者参数配置不正确)，那么接收方内核(以及可能正在监听传输线路的恶意中间人)会认为数据包非法而将其丢弃，从而保护了数据的安全。
对于这种联合加密方式，如果节点，比如节点A是通过上层应用进行加密，则对于仅作为向外发送网络传输层数据包的节点A，在用户面可以不部署管理程序，内核中不加载eBPF程序。
相应地，对于接收节点A通过上层应用加密的网络传输层数据包的节点B，则需要在用户面部署管理程序，在内核中记载eBPF程序，从而配合实现对网络传输层数据包的处理。
参见图3，图3是本申请实施例提供的网络传输层数据处理方法的又一流程图，在本实施例中，该方法主要应用于运行在用户面的管理程序。
在本实施例中，引入了管理程序向内核加载eBPF程序的具体操作，如图3所示，本实施例提供的网络传输层数据处理方法，包括以下步骤：
步骤301，从预设地址读取配置信息。
本实施例中，为了保证内核有需要分发的网络传输层数据时，不管是向内，即内核从其他节点接收到的网络传输层数据包，还是向外，即内核需要发送给其他节点的网络传输层数据包，能够在到达内核时，被内核中运行的eBPF程序拦截，并由eBPF程序对拦截的网络传输层数据包进行相应的网络传输层数据处理，如加密处理或解密处理，需要保证内核中已经运行了eBPF程序。因此，在初次执行本实施例提供的网络传输层数据处理方法时，当管理程序被部署到用户面，并启动后，管理程序需要先从预设地址读取配置信息，比如从存储在用户面的某一配置信息文件中读取。
此外，在本实施例中，管理程序从预设地址读取的配置信息同样包括加解密条件、加密 规则、解密规则中的任意一种或几种。
步骤302，检查需要注册到内核的eBPF程序和配置信息的完整性。
本实施例中，为了保证基于被注册到内核的eBPF程序处理网络传输层数据包的性能、安全性，管理程序在将预先设计好的eBPF程序注册到内核，将读取的配置信息配置到eBPF程序对应的配置信息映射表前，需要先检查eBPF程序和配置信息的完整性。
步骤303，如果eBPF程序和配置信息均完整，将eBPF程序注册到内核中，以使eBPF程序运行在内核。
具体为管理程序向所在环境的内核加载eBPF程序的字节码，并在将eBPF程序加载到内核中，后续通过系统调用函数/接口(syscall)与eBPF程序进行数据交换。
此外，管理程序也向外提供管理和查询接口，如用户交互接口，以便根据外部输入的操作指令，对运行在内核中的eBPF程序进行相应处理。
步骤304，将配置信息配置到eBPF程序对应的配置信息映射表中。
本实施例中，本实施例中所说的配置信息映射表，即eBPF技术中涉及到的BPF MAP。在实际应用中，本实施例中提供的eBPF程序与管理程序之间可以通过一个或多个BPF MAP进行配置数据或运行时统计的统计数据的交互。
应当理解的是，上述示例仅是为了更好的理解本实施例的技术方案而列举的示例，不作为对本实施例的唯一限制。
步骤305，进入消息处理循环操作。
本实施例中，上述所说的进入消息处理循环操作是指预先构建消息队列，在每次监测到有需要处理的消息，如针对eBPF程序的操作指令和/或eBPF程序在BPF MAP中写入针对网络传输层数据包处理过程中统计的统计数据时，先将接收到的需要处理的消息添加到消息队列，然后依次从消息队列读取需要处理信息，根据当前读取的需要处理的信息的具体类型，进入步骤306至步骤309任一步骤，并执行对应的操作。
步骤306，如果接收到针对eBPF程序的配置信息更新指令，从配置信息更新指令中提取需要更新的配置信息，根据提取的需要更新的配置信息对eBPF程序对应的配置信息映射表更新。
步骤307，如果接收到针对eBPF程序的eBPF程序替换指令，从eBPF程序替换指令中提取替换eBPF程序，将替换eBPF程序注册到内核中，并在替换eBPF程序注册到内核后，卸载内核中运行的所述eBPF程序。
步骤308，如果接收到针对eBPF程序的eBPF程序卸载指令，卸载内核中运行的所述eBPF程序。
步骤309，如果eBPF程序统计的针对网络传输层数据包处理过程中的统计数据，将将统计数据存储到预设存储区域和/或以预设形式展示。
不难发现，本实施例中的步骤306至步骤307与图2所示的实施例中步骤202和步骤203给出的几种具体处理方式大致相同，在此就不再赘述。
此外，关于本实施例中所涉及的管理程序、需要读取的配置信息、eBPF程序以及外部输入之间的交互，具体如图4所示，此处不再赘述。
由此，本实施例提供的网络传输层数据处理方法，在进行网络传输层数据处理之前，利用运行在用户面的管理程序向内核加载eBPF程序，并对eBPF程序进行配置管理，如将eBPF 程序进行加解密处理时用到的配置信息配置到配置信息映射表，从而在有需要内核分发的网络传输层数据包时，能够由eBPF程序进行相应的加密处理、解密处理。
参见图5，图5是本申请实施例提供的网络传输层数据处理方法的流程图，在本实施例中，该方法主要应用于运行在内核的eBPF程序。
需要说明的，本实施例所说的网络传输层数据处理方法，具体是指运行在内核的eBPF程序对内核需要分发的网络传输层数据包的加密处理或解密处理。
如图5所示，本实施例提供的网络传输层数据处理方法，包括以下步骤：
步骤501，获取需要分发的网络传输层数据包。
可理解的，本实施例中所说的需要分发的网络传输层数据包具体是指需要内核向本节点的上层应用，如运行在用户面上的应用程序分发接收到的网络传输层数据包，即需要分发的网络传输层数据包来自其他节点。
此外，在一个例子中，需要分发的网络传输层数据包还可以是由内核向其他节点分发，即需要分发的网络传输层数据包是需要内核向其他节点发送的。
此外，值得一提的是，在实际应用中，加载到内核中的eBPF程序，并非一直处于运行状态，或者说激活状态，只有在有需要分发的网络传输层数据包到达内核时，才会由内核触发，进而去执行本实施例中提供的网络传输层数据处理方法。
相应地，上述获取到的需要分发的网络传输层数据包，实质是在内核触发eBPF程序后，传输给eBPF程序的。
步骤502，对网络传输层数据包进行解析，确定需要对网络传输层数据包进行的网络传输层数据处理方式。
本实施例中，通常情况下网络传输层数据包的协议头中会携带传输该网络传输层数据包所采用的的协议、四元组等信息，因此在确定需要对网络传输层数据包进行的网络传输层数据处理方式时，通过对网络传输层数据包进行解析，进而提取网络传输层数据包的协议头，然后根据协议头和预先配置的加解密条件，判断该网络传输层数据包是否需要加密或解密。
相应地，如果通过判断确定网络传输层数据包需要进行加密，则确定需要对网络传输层数据进行的网络传输层数据处理方式为加密处理方式；如果通过判断确定网络传输层数据包需要进行解密，则确定需要对网络传输层数据进行的网络传输层数据处理方式为解密处理。
需要说明的是，本实施例中所说的加解密条件具体是由运行在用户面的管理程序提供的。在实际应用中，加解密条件可以是预先规定的好的针对哪些协议传输的网络传输层数据包进行加密或解密。
进一步，加解密条件还可以是规定针对某一具体端口号(源端口号和/或目的端口号)、某一具体IP地址(源IP地址和/或目的IP地址)。
应当理解的是，上述示例仅是为了更好的理解本实施例的技术方案而列举的示例，不作为对本实施例的唯一限制。
此外，需要说明的，在实际应用中，在确定需要对网络传输层数据包进行的网络传输层数据处理方式之前，可以先确定网络传输层数据包是否需要进行网络传输层数据处理，如果不需要则直接交由内核进行后续分发操作，如果需要再确定需要进行的网络传输层数据处理方式。
此外，在本实施例中，对需要分发的网络传输层数据包进行的网络传输层数据处理方式 大致分为加密处理和解密处理。而在实际应用中，通常是对需要发送给其他节点的网络传输层数据包才进行加密处理，对从其他节点接收到的网络传输层数据包要进行的是解密处理。基于此，在确定需要对网络传输层数据包进行的网络传输层数据处理方式时，具体可以先确定当前的网络数据是需要发送出去的，还是接收到的。
相应地，如果是接收到的，具体是判断网络传输层数据包是否需要解密；如果是需要发送出的，具体是判断网络传输层数据包是否需要加密。
步骤503，根据网络传输层数据处理方式，对网络传输层数据包进行处理。
本实施例中，在确定的网络传输层数据处理方式为加密处理方式时，对网络传输层数据包进行的处理具体为：
首先，从预先配置的加密规则中选取目标加密规则。
本实施例中，上述预先配置的加密规则同样是由运行在用户面的管理程序提供的。具体是由管理程序从预设地址读取包括了加密规则的配置信息，然后将读取到的配置信息配置到eBPF程序对应的配置信息映射表中。故而，上述选取目标加密规则的操作，具体是从配置信息映射表中选取适合当前需要进行加密处理的网络传输层数据包的加密规则。
需要说明的是，在实际应用中，加密规则至少需要包括具体的加密算法。
对于需要涉及密钥的，加密规则还需要包括加密密钥，可以理解为加密参数。
此外，关于如何选取适合当前需要进行加密处理的网络传输层数据包的目标加密规则，在实际应用中可以根据当前需要进行加密处理的网络传输层数据包的协议头的内容确定。
比如，预先规定采用某一协议，或者某一特定端口号，或者某一IP地址对应的具体加密方法和密钥，进而在选取目标加密规则时，更加需要进行加密处理的网络传输层数据包的协议头便可以快速、准确的选取一个适合该网络传输层数据包的加密规则。
此外，值得一提的是，在一个例子中，也可以是所有需要进行加密的网络传输层数据包均采用同一加密规则。
然后，根据目标加密规则，对网络传输层数据包的载荷部分进行加密处理。
接着，根据加密后的载荷部分，更新协议头，得到加密后的网络传输层数据包。
由于进行加密处理之后，加密后的载荷部分的长度通常会与加密前的载荷部分的长度存在差异，因而为了保证加密处理后的网络传输层数据包在传输到其他节点后，不会因为协议头中记录的长度信息和实际接收到的网络传输层数据包的载荷部分的长度不一致，而将加密后的网络传输层数据包误认为非法数据。因此，在根据目标加密规则对网络传输层数据包的载荷部分进行加密处理之后，需要根据加密后的载荷部分更新协议头，进而保证最终得到加密后的网络传输层数据包的协议头记录的信息与加密后的载荷部份的长度一致。
最后，将加密后的网络传输层数据包交由内核，由内核对加密后的网络传输层数据包进行分发。
由此，实现了对需要分发网络传输层数据的加密处理。
相应地，在确定的网络传输层数据处理方式为解密处理方式时，对网络传输层数据包进行的处理方式具体为：首先，从预先配置的解密规则中选取目标解密规则；然后，根据目标解密规则，对网络传输层数据包的载荷部分进行解密处理；接着，根据解密后的载荷部分，更新协议头，得到解密后的网络传输层数据包；最后，将解密后的网络传输层数据包交由内核，由内核对解密后的网络传输层数据包进行分发。
可理解的，为了保证经eBPF程序加密处理后的网络传输层数据包在到达对端节点的内核中，能够运行在对端节点内核中的eBPF程序解密，解密规则需要与加密规则相对应，以保证加密后的网络传输层数据包能够被解密，进而还原出原始的网络传输层数据包。
由此，本实施例提供的网络传输层数据处理方法，通过在用户面加载并运行能够管理eBPF程序的管理程序，进而利用管理程序预先将eBPF程序注册到内核中，由eBPF程序去拦截需要内核分发，如发送出去的网络传输层数据包、接收的网络传输层数据包，并确定需要分发的网络传输层数据包的网络传输层数据处理方式，最终由eBPF程序根据确定的网络传输层数据处理方式，对当前拦截的网络传输层数据包进行处理。整个网络传输层数据处理过程在改写后的内核中的eBPF程序便可以完成，无需系统环境或上层应用改变自身的状态，并参与到实际的网络传输层数据处理过程中，做到了对系统环境或上层应用的透明化，从而无需额外的部署、配置、运维以及开发成本，也保证了良好的系统环境与上层应用的兼容性。
此外，在一个例子中，如果不追求绝对的透明，或者是有特殊的数据保护需求，eBPF程序也可以和上层应用配合起来完成对数据的加密或保护。例如，上层应用可以有意发送内容不合法的数据包，如果接收方的环境部署了对应的eBPF程序(同时参数配置正确)，那么在接收方内核看到数据前，eBPF程序可以将不合法的数据修复，然后再交由内核处理，从而让接收方应用能正确读取信息；如果接收方环境没有部署对应的eBPF程序(或者参数配置不正确)，那么接收方内核(以及可能正在监听传输线路的恶意中间人)会认为数据包非法而将其丢弃，从而保护了数据的安全。
对于这种联合加密方式，如果节点，比如节点A是通过上层应用进行加密，则对于仅作为向外发送网络传输层数据包的节点A，在用户面可以不部署管理程序，内核中不加载eBPF程序。
相应地，对于接收节点A通过上层应用加密的网络传输层数据包的节点B，则需要在用户面部署管理程序，在内核中记载eBPF程序，从而配合实现对网络传输层数据包的处理。
此外，基于eBPF技术自身的安全性和高性能，也保证了本实施例提供的网络传输层数据处理方案的安全性和整体性能。
此外，值得一提的是，由于eBPF程序是由运行在用户面的管理程序加载到内核中的，并且管理程序能够管理eBPF程序。因此，在实际应用中，如果运行在内核中的eBPF程序接收到了用户面的管理程序下发的配置信息更新指令，则根据配置信息更新指令，更新预先配置的配置信息，即配置在配置信息映射表中的配置信息，具体可以是加解密条件、加密规则、解密规则中的任意一种或几种。由此，实现了对运行在内核中的eBPF程序的动态更新，使得运行在内核中的eBPF程序能够更好的适应于实际的网络传输层数据处理需求。
参见图6，图6是本申请实施例提供的网络传输层数据处理方法的流程图，在本实施例中，该方法主要应用于运行在内核的eBPF程序。
如图6所示，本实施例提供的网络传输层数据处理方法，包括以下步骤：
步骤601，获取需要分发的网络传输层数据包。
不难发现，本实施例中的步骤601与图5所示的实施例中的步骤501大致相同，在此就不再赘述。
步骤602，对网络传输层数据包进行解析，确定网络传输层数据包是否需要处理。
本实施例中，需要内核分发的网络传输层数据包并非每一个都需要进行加密或解密处理，比如对于仅仅是相对端节点作出的收到其发送的信息或请求的响应。因此，在确定需要分发的网络传输层数据包的网络传输层数据处理方式前，可以先根据解析出的网络传输层数据包的协议头中携带的标识信息确定当前需要分发的网络传输层数据包是否需要进行加密处理或解密处理。
相应地，如果确定网络传输层数据包需要进行处理，则进入步骤603，确定网络传输层数据包具体需要进行的网络传输层数据处理方式。反之，如果确定网络传输层数据包不需要处理，则直接进入步骤610，即直接将拦截的网络传输层数据包交由内核，由内核对其进行分发即可。
步骤603，确定网络传输层数据包是需要发送的网络传输层数据包，还是接收到的网络传输层数据包。
根据上述论述可知，对于需要进行网络传输层数据处理的网络传输层数据包，在网络传输层数据包是需要由内核发送至其他节点的网络传输层数据包时，需要进行的网络传输层数据处理方式为加密处理方式。
相应地，对于需要进行网络传输层数据处理的网络传输层数据包是需要由内核反馈给上层应用，即位于用户面应用程序，或者说网络传输层数据包是内核从其他节点接收到的网络传输层数据包时，需要进行的网络传输层数据处理方式为解密处理方式。
基于此，只需确定网络传输层数据包是需要发送的网络传输层数据包，还是接收到的网络传输层数据包便可以快速确定需要进行处理的网络传输层数据包的具体处理方式。
相应地，如果确定网络传输层数据包是需要发送的网络传输层数据包，则进入步骤603。反之，如果确定网络传输层数据包是接收到的网络传输层数据包，则进入步骤607。
步骤604，对网络传输层数据包的载荷部分进行加密。
步骤605，更新网络传输层数据包的协议头。
步骤606，将加密后的网络传输层数据包交由内核，由内核对加密后的网络传输层数据包进行分发。
步骤607，对网络传输层数据包的载荷部分进行解密。
步骤608，更新网络传输层数据包的协议头。
步骤609，将解密后的网络传输层数据包交由内核，由内核对解密后的网络传输层数据包进行分发。
步骤610，将网络传输层数据包交由内核，由内核对网络传输层数据包进行分发。
由此，本实施例提供的网络传输层数据处理方法，通过利用eBPF程序，很好地解决了传统网络传输层数据传输加密协议在使用中对系统环境和上层应用带来的侵入影响，提供了更灵活、更强大的数据传输加密与保护功能，同时在安全性上有更好的隔离与保证。
此外，需要说明的是，eBPF技术支持多种程序类型，不同类型的程序适用于不同的用途，而当前比较适合实现传输加密功能的类型是流量控制(Traffic Control，TC)。因此，本实施例中所说的对网络传输层数据包进行加密处理或加密处理的eBPF程序，具体为TC类型的eBPF程序。通过在内核中加载TC类型的eBPF程序能够直接拦截Linux内核对于网络传输层数据包的处理入口和出口，在内核对网络传输层数据包进行接收或发送前，TC程序就可以直接访问到缓存原始的网络传输层数据包的内存缓存区，然后根据原始的网络传输层数据包 对应的内存缓存区地址，从内存缓存区获取需要处理的网络传输层数据包，接着对获取到网络传输层数据包进行相应的网络传输层数据处理操作，并在完成相应的网络传输层数据处理操作后，再交由内核，由内核对其进行分发处理。
显然，通过利用TC类型的eBPF程序，就可以将数据加解密的具体实现和配置逻辑集成到一个软硬件单元中，从而在系统环境和上层应用都不了解任何细节的情况下完成网络传输层数据的加解密。再加上eBPF程序和内核一样，都是可以在运行时动态加载/卸载的，因此本实施例提供的网络传输层数据处理方法可以实现运行时的加解密功能激活/去激活，或动态替换加密算法和配置数据，而与此同时操作系统和上层应用对这些行为变更可以一无所知。
此外，需要说明的是，本实施例中采用TC类型的eBPF程序是基于目前eBPF技术的现状而确定的，如果在后续eBPF技术的快速演进中，出现了其他适合的类型，依旧可以实现本实施例实现的方法。即，本实施例中采用TC类型的eBPF程序实现网络传输数据处理，只是一种具体的实现方式，对本实施例提供的技术方案本身并不构成任何限定。
此外，在一个例子中，如果不追求绝对的透明，或者是有特殊的数据保护需求，eBPF程序也可以和上层应用配合起来完成对数据的加密或保护。例如，上层应用可以有意发送内容不合法的数据包，如果接收方的环境部署了对应的eBPF程序(同时参数配置正确)，那么在接收方内核看到数据前，eBPF程序可以将不合法的数据修复，然后再交由内核处理，从而让接收方应用能正确读取信息；如果接收方环境没有部署对应的eBPF程序(或者参数配置不正确)，那么接收方内核(以及可能正在监听传输线路的恶意中间人)会认为数据包非法而将其丢弃，从而保护了数据的安全。
此外，为了更好的理解基于本实施例提供的应用于运行在用户面的管理程序的网络传输层数据处理方法和应用于运行在内核的eBPF程序的网络传输层数据处理，以下结合图7和图8，对基于管理程序和eBPF程序的配合实现的网络传输层数据处理，具体为加密和解密过程进行具体说明。
首先，需要说明的是，在实际应用中，网络传输层数据包的接收方(以下称为数据接收方)和网络传输层数据包的发送方(以下称为数据发送方)必须是都使用Linux系统的，同时内核版本需要大于4.3，且开启了eBPF相关功能。
进一步地，数据通信双方，即数据发送方和数据接收方需要使用标准的网络传输层协议栈，如IP、TCP/UDP通信。
此外，可以理解的，在实际应用中，运行在用户面的管理程序和运行在内核的eBPF程序可以是封装在一个软件包SDK中，以软件形态进行分发与部署的，也可以是封装到一个便携式硬件内，以硬件单元的形态分发与部署的。
此外，当前市面上一些主流厂商的网卡已经支持直接加载并运行eBPF程序。这意味着具体的网络传输层数据处理工作不再依赖操作系统内核完成，而是由网卡内的专用芯片来完成。因此，对于此类设备，eBPF程序可以直接加载到该设备内运行，只需要单独管理需要运行在用户面的管理程序，并建立二者通信即可。
参见图7，图7为节点A和节点B之间实现全透明传输加密的示意图，即位于用户面的应用程序(上层应用)不参与加密、解密，整个传送加密过程，对于节点A和节点B的系统环境、上层应用均是没有感知的。
为了便于后续描述，首先假定上层应用，即应用程序与加密系统(管理程序+eBPF程序) 符合如下设定：
上层应用以TCP协议在1080端口与另一个远端的相同应用通信，如图7中的节点A和节点B；节点A和节点B的网络设备均为eth0；eBPF程序的文件名称为eBPF.elf；eBPF程序中负责加密的函数名为encrypt；eBPF程序中负责解密的函数名为decrypt。
对于管理程序，其需要在节点A和节点B上运行，并通过如下命令加载eBPF程序(具体是加载eBPF程序中的加密函数和解密函数)：
加载eBPF程序中的加密函数：tc filter add dev eth0 egress bpf da objeBPF.elf sec encrypt
加载eBPF程序中的解密函数：tc filter add dev eth0 inressbpf da objeBPF.elf sec decrypt
执行完上述两条加载命令后，不论是节点A的内核，还是节点B的内核在向eth0发送网络传输层数据包时(egress)，均会调用之前挂载的eBPF程序中的encrypt函数，并将原始的内核数据缓存(socket kernel buffer，简称skb)指针传递给函数。
对于encrypt函数的处理流程，具体如下：
(1)对skb进行以太网协议分析(解析并剥离ethernet头)。
(2)确定网络传输层数据包的载荷部分是否为IP协议，如果不是，则直接结束处理，即进入步骤(10)。
(3)对载荷部分进行IP协议分析(解析并剥离IP头)，如果IP头的载荷协议指示不为TCP，则直接结束处理，即进入步骤(10)。
(4)对载荷部分进行TCP协议分析(解析并剥离TCP头)，确定目的端口是否为1080，如果不是，则直接结束处理，即进入步骤(10)。
(5)计算IP协议的数据载荷范围(起始指针与结束指针)。
(6)使用流加密算法(Rivest Cipher 4，RC4)对IP协议载荷进行加密。
可理解的，上述给出的仅为一种具体的加密算法，在实际应用中，本领域技术人员可以根据需要选择加密算法，并将选择的加密算法发送至管理程序，由管理程序进行配置。
(7)将加密后的数据写回(可利用内核中的bpf helper函数中的bpf_skb_store_bytes)，并更新IP头(主要是长度与校验码，可以利用bpf helper函数中的bpf_l3_csum_replace)。
(8)调用内核中的bpf helper函数：bpf_skb_adjust_room，更新skb。
(9)结束处理(内核会继续完成更新后数据的发送工作)。
由此，完成了eBPF程序对网络传输层数据包的加密处理。
相应地，在执行加载命令后，不论是节点A的内核，还是节点B的内核从eth0接收到网络传输层数据包时(ingress)，均会调用之前挂载的eBPF程序中的decrypt函数，并将原始数据缓存(sk_buff，简称skb)指针传递给函数。
对于decrypt函数的处理流程，具体如下：
(1)对skb进行以太网协议分析(解析并剥离ethernet头)。
(2)确定载荷部分是否为IP协议，如果不是，则直接结束处理，即进入步骤(9)。
(3)进行IP协议分析(解析并剥离IP头)，如果IP头的载荷协议指示不为TCP，则直接结束处理，即进入步骤(9)。
(4)对载荷部分进行TCP协议分析(解析并剥离TCP头)，如果格式正确，说明数据未加密，直接结束处理，即进入步骤(9)。
(5)使用RC4算法对IP载荷部分进行解密处理。
可理解的，由于上述加密过程是采用的RC4算法，因此解密过程中同样需要采用RC4算法。
(6)对解密后的数据进行TCP协议头检查，如果数据是非法的，比如某个字段的取值不再合法范围内，或目的端口不为1080，则直接结束处理，即进入步骤(9)。
(7)将解密后的数据写回(可利用bpf helper函数:bpf_skb_store_bytes)，并更新IP头(主要是长度与校验码，可以利用bpf helper函数：bpf_l3_csum_replace)。
(8)调用内核中的bpf helper函数：bpf_skb_adjust_room，更新skb。
(9)结束处理(内核会继续完成更新后数据的接收工作)。
由此，完成了eBPF程序对网络传输层数据包的解密处理。
此外，值得一提的是，在实际应用中encrypt函数和decrypt函数还需要执行如下操作：
从指定的配置信息映射表(BPF MAP)中获取管理程序传递的必要参数，如RC4加密算法相关参数、TCP端口号等；将一些运行统计数据记录到指定的BPF MAP中，如加/解密包总数、成功/失败次数等。
此外，值得一提的是，管理程序除了在初始化阶段加载eBPF程序外，还要负责如下工作：通过BPF MAP向encrypt函数和decrypt函数传递必要的参数，如RC4加密算法相关参数、TCP端口号等；通过BPF MAP读取汇总encrypt函数和decrypt函数在运行时记录的统计数据，如加/解密包总数、成功/失败次数等；通过命令行(或其他形式，如Restful等)接口，让用户可以管理查询eBPF程序的运行参数，如四元组信息(端口号、地址等)和运行状态，如成功加密/解密的数量，检测到多少非法或合法的数据等。
通过上述描述可以发现，在全透明传输加密方式下，上层应用并不参与到网络传输层的加解密流程中，因此其完全不知晓底层传输加密系统采用的算法、参数、时机等细节，在发送和接收网络数据时也不考虑加解密，全部以明文格式处理。这样上层应用无需作任何操作或配置修改即可实现网络传输层数据的加解密，而且上层应用对加密流程细节一无所知，即使被攻击者攻陷，其也无法了解实际的加解密流程细节，也无法获取关键的加解密敏感数据，如密钥等，从而既解决了传统不透明的传输加密所带来的额外的部署、配置、运维、开发负担，以及风险的技术问题，又保证了传输的网络传输层数据包中数据内容的安全性。
参见图8，图8为节点A和节点B之间实现与上层应用程序联合加密的示意图，即位于用户面的应用程序参与到了运行在内核的eBPF程序的对需要分发的网络传输层数据包的加密处理或解密处理。
具体的说，在有上层应用参与的合作传输加密方式下，上层应用会与加密系统配合完成传输数据的加解密流程。配合的方法有很多种，如：
方式1：应用程序负责发送数据的加密，对端eBPF程序负责对收到的数据解密。
方式2：应用程序负责对收到的数据解密，对端eBPF程序负责发送数据的加密。
方式3：应用程序负责发送和接收数据的加解密，eBPF程序负责在发送和接收数据时对已加密的数据进行加扰和解扰，即由eBPF程序对上层应用加密或解密后的数据进行二次处理。
需要说明的是，上述不同配合方式的目标只有一个：必须在上层应用和eBPF程序都存在的情况下才能正常完成数据的加解密过程。缺失任何一个环节都会导致数据无法正常解密。 这种灵活多样的联合加解密机制虽然损失了部分透明性(上层业务需要参与到加解密过程中来)，但有效提升了数据加密的整体安全度。
关于上述方式3，在实际应用中，与节点A和节点B中均需要部署管理程序和eBPF程序，并eBPF程序均支持encrypt函数和decrypt函数的调用。其大致实现与针对图7的描述类似，只是用户面的应用程序增加了加密和加密操作。
以下结合图8针对上述所说的方式1进行具体说明，其他联合加密方式的思路类似，只是具体实施动作和适用的场景不同。
关于上述所说的方式1，具体为在节点A中，应用程序利用预设的加密算法，如非对称加密算法对需要发送的数据进行加密，在节点B中，在用户面部署管理程序，在内核中加载用于解密的eBPF程序。该方法特别适用于有以下特征或需求的场景：数据发送端的应用完全受控(可修改代码及配置)；数据传输信道不可信且不受控；数据接收端的应用不受控(不可修改代码或配置)；发送端与接收端所在环境的网络配置不能或不便于修改；只要求对发送数据进行加密，对远端发回的响应数据不要求加密。
为了便于后续描述，首先假定上层应用与加密系统符合如下设定：
上层应用以TCP协议在1080端口与另一个远端的相同应用通信，如图8中的节点A和节点B；节点A和节点B的网络设备均为eth0；节点B的用户面运行有管理程序，节点B的内核运行有eBPF程序，该eBPF程序的文件名称为eBPF.elf，且该eBPF程序仅负责解密，负责解密的函数名为decrypt。
对于数据发送端，即图8中的节点A，上层应用使用一种非对称加密算法(如X25519椭圆曲线加密算法或类似的其他算法)，并使用公钥对要发送的TCP载荷数据进行加密，然后再发送。同时，节点A不需要驻留管理程序，也无须加载任何eBPF程序。
对于数据接收端，即图8中的节点B，在用户面需要驻留管理程序，在内核需要驻留eBPF程序，并且对于节点B中的管理程序，需要通过如下命令加载eBPF程序(具体是加载eBPF程序中的解密函数)：加载eBPF程序中的解密函数：tc filter add dev eth0 inressbpf da objeBPF.elf sec decrypt。
相应地，在执行完上述加载命令后，如节点B的内核从eth0接收到来自节点A发送的网络传输层数据包时(ingress)，会调用之前挂载的eBPF程序中的decrypt函数，并将skb指针传递给函数。
关于decrypt函数的处理流程，具体如下：
(1)对skb进行以太网协议分析(解析并剥离ethernet头)。
(2)确定载荷部分是否为IP协议，如果不是，则直接结束处理，即进入步骤(8)。
(3)进行IP协议分析(解析并剥离IP头)，如果IP头的载荷协议指示不为TCP，则直接结束处理，即进入步骤(8)。
(4)对载荷部分进行TCP协议分析(解析并剥离TCP头)，如果格式非法或目的端口号不等于1080，则直接结束处理，即进入步骤(8)。
(5)使用X25519算法和私钥对TCP载荷部分进行解密处理。
可理解的，上述给出的仅为一种具体的解密算法，在实际应用中，本领域技术人员可以根据需要选择加密算法，并将选择的解密算法发送至管理程序，由管理程序进行配置。
此外，可理解的，eBPF程序进行解密时所依据解密方法，需要与节点A中应用程序采 用的加密方法相对应。
(6)将解密后的数据写回(可利用bpf helper函数中的bpf_skb_store_bytes)，并更新TCP与IP头(主要是长度与校验码，可以利用bpf helper函数中的bpf_l3_csum_replace以及bpf_l4_csum_replace)。
(7)调用内核中的bpf helper函数中的bpf_skb_adjust_room，更新skb。
(8)结束处理(内核会继续完成更新后数据的接收工作)。
由此，在节点B中利用内核中的eBPF程序完成了对网络传输层数据包的解密。
此外，值得一提的是，decrypt函数还需要执行以下操作：从指定的BPF MAP中获取管理程序传递的必要参数，如X25519加密算法相关参数、私钥、TCP端口号等；将一些运行统计数据记录到指定的BPF MAP中，如加/解密包总数、成功/失败次数等。
此外，值得一提的是，在实际应用中，运行在节点B的用户面中的管理程序除了在初始化阶段加载eBPF程序外，还要负责如下工作：通过BPF MAP向decrypt函数传递必要的参数，如X25519加密算法相关参数、私钥、TCP端口号等；通过BPF MAP读取汇总decrypt函数在运行时记录的统计数据，如解密包总数、成功/失败次数等；通过命令行(或其他形式，如Restful等)接口，让用户可以管理查询eBPF程序的运行参数和运行状态。
由此，实现了上层应用与eBPF程序的联合加密，在尽可能保证透明化的情况下，进一步提升了传输的数据的安全性。
通过上述描述可知，本实施例提供的网络传输层数据处理方法，能够在系统环境配置与上层应用没有感知的情况下实现网络传输层通信加密，因此具备较低的部署成本和良好的环境与应用兼容性。同时，能够在运行时随时变更加密的算法、参数以及激活开关，上层应用也可以选择与该系统配合以实现自定义的联合加密保护机制，因此具备良好的灵活性和扩展能力。最后，由于基于eBPF技术，该方法在安全性和性能上也有保证。
此外，应当理解的是，上面各种方法的步骤划分，只是为了描述清楚，实现时可以合并为一个步骤或者对某些步骤进行拆分，分解为多个步骤，只要包括相同的逻辑关系，都在本专利的保护范围内；对算法中或者流程中添加无关紧要的修改或者引入无关紧要的设计，但不改变其算法和流程的核心设计都在该专利的保护范围内。
参见图9，图9是本申请实施例提供的网络传输层数据处理设备的结构示意图。
如图9所示，本实施例提供的网络传输层数据处理设备包括：包括至少一个处理器901；以及，与至少一个处理器通信连接的存储器902。
此外，为了能够实现全透明传输加密，或者根据业务需求与上层应用程序联合实现传输加密，网络传输层数据处理设备还包括运行在用户面的管理程序和运行在内核的eBPF程序。
其中，管理程序用于向所在环境的内核加载，或者说注册eBPF程序，以使eBPF程序能够运行在内核中，存储器902存储有可被至少一个处理器901执行的指令，指令被至少一个处理器901执行，以使至少一个处理器901能够执行上述应用于管理程序的方法实施例所描述的网络传输层数据处理方法，或者应用于eBPF程序的方法实施例所描述的网络传输层数据处理方法。
其中，存储器902和处理器901采用总线方式连接，总线可以包括任意数量的互联的总线和桥，总线将一个或多个处理器901和存储器902的各种电路连接在一起。总线还可以将诸如外围设备、稳压器和功率管理电路等之类的各种其他电路连接在一起，这些都是本领域 所公知的，因此，本文不再对其进行进一步描述。总线接口在总线和收发机之间提供接口。收发机可以是一个元件，也可以是多个元件，比如多个接收器和发送器，提供用于在传输介质上与各种其他装置通信的单元。经处理器901处理的数据通过天线在无线介质上进行传输，进一步，天线还接收数据并将数据传送给处理器901。
处理器901负责管理总线和通常的处理，还可以提供各种功能，包括定时，外围接口，电压调节、电源管理以及其他控制功能。而存储器902可以被用于存储处理器901在执行操作时所使用的数据。
本申请实施例还涉及一种计算机可读存储介质，存储有计算机程序。计算机程序被处理器执行时实现上述方法实施例所描述的网络传输层数据处理方法。
即，本领域技术人员可以理解，实现上述实施例方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序存储在一个存储介质中，包括若干指令用以使得一个设备(可以是单片机，芯片等)或处理器(processor)执行本申请各个实施例所述方法的全部或部分步骤。而前述的存储介质包括：U盘、移动硬盘、只读存储器(ROM，Read-Only Memory)、随机存取存储器(RAM，Random Access Memory)、磁碟或者光盘等各种可以存储程序代码的介质。
本领域的普通技术人员可以理解，上述各实施例是实现本申请的具体实施例，而在实际应用中，可以在形式上和细节上对其作各种改变，而不偏离本申请的精神和范围。

Claims (11)

  1. 一种网络传输层数据处理方法，应用于运行在内核的扩展伯克利包过滤器eBPF程序，所述网络传输层数据处理方法包括：
    获取需要分发的网络传输层数据包；
    对所述网络传输层数据包进行解析，确定需要对所述网络传输层数据包进行的网络传输层数据处理方式；
    根据所述网络传输层数据处理方式，对所述网络传输层数据包进行处理。
  2. 如权利要求1所述的网络传输层数据处理方法，其中，所述对所述网络传输层数据包进行解析，确定需要对所述网络传输层数据包进行的网络传输层数据处理方式，包括：
    对所述网络传输层数据包进行解析，提取出所述网络传输层数据包的协议头；
    根据所述协议头和预先配置的加解密条件，判断所述网络传输层数据包是否需要加密或解密，所述加解密条件由运行在用户面的管理程序提供；
    如果所述网络传输层数据包需要进行加密，确定需要对所述网络数据进行的网络传输层数据处理方式为加密处理方式；
    如果所述网络传输层数据包需要进行解密，确定需要对所述网络数据进行的网络传输层数据处理方式为解密处理方式。
  3. 如权利要求2所述的网络传输层数据处理方法，其中，所述网络传输层数据处理方式为所述加密处理方式；
    所述根据所述网络传输层数据处理方式，对所述网络传输层数据包进行处理，包括：
    从预先配置的加密规则中选取目标加密规则，所述加密规则由所述管理程序提供；
    根据所述目标加密规则，对所述网络传输层数据包的载荷部分进行加密处理；
    根据加密后的所述载荷部分，更新所述协议头，得到加密后的所述网络传输层数据包；
    将加密后的所述网络传输层数据包交由内核，由所述内核对加密后的所述网络传输层数据包进行分发。
  4. 如权利要求2所述的网络传输层数据处理方法，其中，所述网络传输层数据处理方式为所述解密处理方式；
    所述根据所述网络传输层数据处理方式，对所述网络传输层数据包进行处理，包括：
    从预先配置的解密规则中选取目标解密规则，所述解密规则由所述管理程序提供；
    根据所述目标解密规则，对所述网络传输层数据包的载荷部分进行解密处理；
    根据解密后的所述载荷部分，更新所述协议头，得到解密后的所述网络传输层数据包；
    将解密后的所述网络传输层数据包交由内核，由所述内核对解密后的所述网络传输层数据包进行分发。
  5. 如权利要求1至4中任一项所述的网络传输层数据处理方法，其中，所述方法还包括：
    接收运行在用户面的管理程序下发的配置信息更新指令；
    根据所述配置信息更新指令，更新预先配置的配置信息，所述配置信息包括加解密条件、加密规则、解密规则中的任意一种或几种。
  6. 一种网络传输层数据处理方法，应用于运行在用户面的管理程序，所述网络传输层数据处理方法包括：
    在所述管理程序启动后，监测是否接收到针对运行在内核的eBPF程序的操作指令和/或所述eBPF程序统计的针对网络传输层数据包处理过程中的统计数据；
    如果接收到针对所述eBPF程序的操作指令，根据所述操作指令对所述eBPF程序进行处理；
    如果接收到所述eBPF程序统计的针对网络传输层数据包处理过程中的统计数据，对所述统计数据进行处理。
  7. 如权利要求6所述的网络传输层数据处理方法，其中，所述操作指令为配置信息更新指令，或者eBPF程序替换指令，或者eBPF程序卸载指令；
    所述如果接收到针对所述eBPF程序的操作指令，根据所述操作指令对所述eBPF程序进行处理，包括：
    在所述操作指令为所述配置信息更新指令时，从所述配置信息更新指令中提取需要更新的配置信息，根据提取的所述需要更新的配置信息对所述eBPF程序对应的配置信息映射表更新；
    在所述操作指令为所述eBPF程序替换指令时，从所述eBPF程序替换指令中提取替换eBPF程序，将所述替换eBPF程序注册到内核中，并在所述替换eBPF程序注册到所述内核后，卸载所述内核中运行的所述eBPF程序；
    在所述操作指令为所述eBPF程序卸载指令时，卸载所述内核中运行的所述eBPF程序。
  8. 如权利要求6或7所述的网络传输层数据处理方法，其中，所述如果接收到所述eBPF程序统计的针对网络传输层数据包处理过程中的统计数据，对所述统计数据进行处理，包括：
    将所述统计数据存储到预设存储区域和/或以预设形式展示。
  9. 如权利要求6至8中任一项所述的网络传输层数据处理方法，其中，在所述管理程序启动后，监测是否接收到针对运行在内核的eBPF程序的操作指令和/或所述eBPF程序统计的针对网络传输层数据包处理过程中的统计数据之前，所述方法还包括：
    从预设地址读取配置信息，所述配置信息包括加解密条件、加密规则、解密规则中的任意一种或几种；
    检查需要注册到内核的所述eBPF程序和所述配置信息的完整性；
    如果所述eBPF程序和所述配置信息均完整，将所述eBPF程序注册到内核中，以使所述eBPF程序运行在所述内核；
    将所述配置信息配置到所述eBPF程序对应的配置信息映射表中。
  10. 一种网络传输层数据处理设备，包括：运行在用户面的管理程序和运行在内核的eBPF 程序，至少一个处理器；以及，与所述至少一个处理器通信连接的存储器；
    其中，所述管理程序用于向所在环境的内核加载所述eBPF程序，以使所述eBPF程序运行在所述内核，所述存储器存储有可被所述至少一个处理器执行的指令，所述指令被所述至少一个处理器执行，以使所述至少一个处理器能够执行如权利要求1至5中任一项所述的网络传输层数据处理方法，或者权利要求6至9中任一项所述的网络传输层数据处理方法。
  11. 一种计算机可读存储介质，存储有计算机程序，所述计算机程序被处理器执行时实现权利要求1至5中任一项所述的网络传输层数据处理方法，或者权利要求6至9中任一项所述的网络传输层数据处理方法。
PCT/CN2022/090383 2021-06-11 2022-04-29 网络传输层数据处理方法、设备及存储介质 WO2022257643A1 (zh)

Priority Applications (1)

Application Number Priority Date Filing Date Title
EP22819245.6A EP4354285A1 (en) 2021-06-11 2022-04-29 Network transport layer data processing method, and device and storage medium

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202110655627.0A CN115473660A (zh) 2021-06-11 2021-06-11 网络传输层数据处理方法、设备及存储介质
CN202110655627.0 2021-06-11

Publications (1)

Publication Number Publication Date
WO2022257643A1 true WO2022257643A1 (zh) 2022-12-15

Family

ID=84365362

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/090383 WO2022257643A1 (zh) 2021-06-11 2022-04-29 网络传输层数据处理方法、设备及存储介质

Country Status (3)

Country Link
EP (1) EP4354285A1 (zh)
CN (1) CN115473660A (zh)
WO (1) WO2022257643A1 (zh)

Cited By (3)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116016702A (zh) * 2022-12-26 2023-04-25 浪潮云信息技术股份公司 一种应用可观测数据采集处理方法、装置及介质
CN117544506A (zh) * 2023-11-09 2024-02-09 北京中电汇通科技有限公司 一种基于eBPF技术的容器云DNS性能优化方法
CN117857646A (zh) * 2024-02-28 2024-04-09 荣耀终端有限公司 数据网络共享方法、电子设备及存储介质

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20190173841A1 (en) * 2017-12-06 2019-06-06 Nicira, Inc. Load balancing ipsec tunnel processing with extended berkeley packet filer (ebpf)
CN110352400A (zh) * 2017-03-08 2019-10-18 华为技术有限公司 用于处理报文的方法和装置
CN111580931A (zh) * 2020-05-10 2020-08-25 江苏省互联网行业管理服务中心 支持多元协议变量的组合表达式的匹配规则引擎
CN112817597A (zh) * 2021-01-12 2021-05-18 山东兆物网络技术股份有限公司 运行在用户空间的基于ebpf的软件容器实现方法
CN112860484A (zh) * 2021-01-29 2021-05-28 深信服科技股份有限公司 容器运行时异常行为检测、模型训练方法及相关装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN110352400A (zh) * 2017-03-08 2019-10-18 华为技术有限公司 用于处理报文的方法和装置
US20190173841A1 (en) * 2017-12-06 2019-06-06 Nicira, Inc. Load balancing ipsec tunnel processing with extended berkeley packet filer (ebpf)
CN111580931A (zh) * 2020-05-10 2020-08-25 江苏省互联网行业管理服务中心 支持多元协议变量的组合表达式的匹配规则引擎
CN112817597A (zh) * 2021-01-12 2021-05-18 山东兆物网络技术股份有限公司 运行在用户空间的基于ebpf的软件容器实现方法
CN112860484A (zh) * 2021-01-29 2021-05-28 深信服科技股份有限公司 容器运行时异常行为检测、模型训练方法及相关装置

Cited By (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN116016702A (zh) * 2022-12-26 2023-04-25 浪潮云信息技术股份公司 一种应用可观测数据采集处理方法、装置及介质
CN117544506A (zh) * 2023-11-09 2024-02-09 北京中电汇通科技有限公司 一种基于eBPF技术的容器云DNS性能优化方法
CN117544506B (zh) * 2023-11-09 2024-05-24 北京中电汇通科技有限公司 一种基于eBPF技术的容器云DNS性能优化方法
CN117857646A (zh) * 2024-02-28 2024-04-09 荣耀终端有限公司 数据网络共享方法、电子设备及存储介质

Also Published As

Publication number Publication date
EP4354285A1 (en) 2024-04-17
CN115473660A (zh) 2022-12-13

Similar Documents

Publication Publication Date Title
WO2022257643A1 (zh) 网络传输层数据处理方法、设备及存储介质
US10250571B2 (en) Systems and methods for offloading IPSEC processing to an embedded networking device
CN111480328B (zh) 将通信安全操作卸载到网络接口控制器
EP1427164B1 (en) Tagging mechanism for data path security processing
US7587587B2 (en) Data path security processing
CN1926839B (zh) 用于高速传输网际网络协议安全（ipsec）处理之两个并行引擎
US8826003B2 (en) Network node with network-attached stateless security offload device employing out-of-band processing
US8418244B2 (en) Instant communication with TLS VPN tunnel management
CN104935593A (zh) 数据报文的传输方法及装置
WO2021207231A1 (en) Application aware tcp performance tuning on hardware accelerated tcp proxy services
US11251972B2 (en) Remote control of a computing device
CN113055269B (zh) 虚拟专用网络数据的传输方法及装置
US20170359214A1 (en) IPSEC Acceleration Method, Apparatus, and System
US20130219171A1 (en) Network node with network-attached stateless security offload device employing in-band processing
US20200322158A1 (en) Method and apparatus for determining trust status of tpm, and storage medium
US20080199012A1 (en) Method for identifying a server device in a network
WO2023061158A1 (zh) 加解密方法、装置及计算机可读存储介质
US11677727B2 (en) Low-latency MACsec authentication
EP4181431A1 (en) Service transmission method and apparatus, network device, and storage medium
JP2004328359A (ja) パケット処理装置
JP2003198530A (ja) パケット通信装置及び暗号アルゴリズム設定方法
US20230403136A1 (en) Computer and Network Interface Controller Securely Offloading Encryption Keys and Encryption Processing to the Network Interface Controller
US11722525B2 (en) IPsec processing of packets in SoCs
WO2024027419A1 (zh) 报文发送方法、装置及系统
US20230308424A1 (en) Secure Session Resumption using Post-Quantum Cryptography

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22819245

Country of ref document: EP

Kind code of ref document: A1

ENP Entry into the national phase

Ref document number: 2023575990

Country of ref document: JP

Kind code of ref document: A

WWE Wipo information: entry into national phase

Ref document number: 18568817

Country of ref document: US

WWE Wipo information: entry into national phase

Ref document number: 2022819245

Country of ref document: EP

NENP Non-entry into the national phase

Ref country code: DE

ENP Entry into the national phase

Ref document number: 2022819245

Country of ref document: EP

Effective date: 20240111