WO2023124880A1 - 一种基于MACSec网络的报文处理方法和装置 - Google Patents

一种基于MACSec网络的报文处理方法和装置 Download PDF

Info

Publication number
WO2023124880A1
WO2023124880A1 PCT/CN2022/137616 CN2022137616W WO2023124880A1 WO 2023124880 A1 WO2023124880 A1 WO 2023124880A1 CN 2022137616 W CN2022137616 W CN 2022137616W WO 2023124880 A1 WO2023124880 A1 WO 2023124880A1
Authority
WO
WIPO (PCT)
Prior art keywords
macsec
message
processing
information
network
Prior art date
Application number
PCT/CN2022/137616
Other languages
English (en)
French (fr)
Inventor
朱涛
龚海东
杨八双
Original Assignee
苏州盛科通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州盛科通信股份有限公司 filed Critical 苏州盛科通信股份有限公司
Publication of WO2023124880A1 publication Critical patent/WO2023124880A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L69/00—Network arrangements, protocols or services independent of the application payload and not provided for in the other groups of this subclass
    • H04L69/18—Multiprotocol handlers, e.g. single devices capable of handling multiple protocols
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks

Definitions

  • the present application relates to network communication technology, in particular to a message processing method and device based on MACSec network.
  • MACsec Media Access Control Security, MAC security
  • IEEE802 LAN/MAN Standards Committee
  • MACsec can provide users with secure MAC (Media Access Control) layer data sending and receiving services, including user data encryption, data frame integrity check, data source authenticity check and replay protection.
  • MACsec is not a replacement for the existing end-to-end IPSec (Internet Protocol Security, Internet Security Protocol), TLS (Transport Layer Security, Transport Layer Security Protocol) and other three-layer security technologies, but their complementary technologies.
  • IPSec Internet Protocol Security, Internet Security Protocol
  • TLS Transmission Layer Security, Transport Layer Security Protocol
  • MACsec uses two-layer encryption technology to provide secure data transmission of hop-by-hop devices. It is suitable for government, military, financial and other occasions that require high data confidentiality.
  • the optical transmission equipment between two switch devices in the LAN is encrypted by MACsec Technology can ensure the safe transmission of data on intermediate transmission devices.
  • MACsec encrypts and decrypts the data following the original message macDa (mac Destination address, mac destination address) and macSa (mac Source address, mac source address). After encryption, the MACsec message will add a secTag (security tag) header to identify the MACsec message.
  • macDa mac Destination address, mac destination address
  • macSa mac Source address, mac source address
  • the data packets in the link will generally be encrypted for transmission, and the plaintext packets need to be discarded.
  • Some protocols do not allow messages to be encrypted, such as MKA (MACsec Key Agreement, MACsec Key Agreement), LLDP (Link Layer Discovery Protocol, Link Layer Discovery Protocol), LACP (Link Aggregation Control Protocol, Link Aggregation Control Protocol ), etc., these protocol packets will affect services after being encrypted.
  • MKA MACsec Key Agreement, MACsec Key Agreement
  • LLDP Link Layer Discovery Protocol, Link Layer Discovery Protocol
  • LACP Link Aggregation Control Protocol, Link Aggregation Control Protocol
  • Type 1 plaintext always adopt the strategy of plaintext transmission.
  • Type 2 plaintext choose the encryption/decryption or plaintext transmission strategy based on the negotiation result.
  • Type 3 plaintext users can configure different policies according to application scenarios, such as:
  • Traffic priority strategy At this time, it is necessary to give priority to ensuring that the traffic does not lose packets, and it is enough to encrypt as much as possible. Adopt the pass processing strategy for the received residual plaintext.
  • Security priority strategy At this time, security needs to be guaranteed first to prevent user information leakage caused by plaintext message transmission. Once the MACsec function is enabled on a port, it immediately adopts a discard policy for all other plaintext packets that are not Type 1 plaintext packets.
  • a method in the prior art is that when the MACsec function is enabled on a port, all packets are encrypted and decrypted, and received plaintext packets are discarded. This approach will have an impact on services such as LLDP and LACP; at the same time, packet loss will occur in the intermediate state of MACsec negotiation.
  • Another method is to identify different traffic through the access control list (Access Control List, ACL) module, and then take corresponding encryption and decryption, pass, and discard operations as required.
  • ACL Access Control List
  • the ACL matches the special plaintext characteristics, and the pass operation is adopted;
  • the ACL matches the MACsec packet characteristics, and the decryption operation is adopted;
  • configure a default ACL take drop action.
  • the ACL module must be performed before the MACsec module, so that for the decrypted data packets, ACL-related processing can no longer be performed, which will have an impact on services such as firewalls and QoS (Quality of Service).
  • the technical problem to be solved by the embodiments of the present application is how to solve the problem in the prior art that other services will be affected when the corresponding encryption, decryption, pass, and discard operations are performed on the MACsec message through the ACL.
  • the embodiment of the present application provides a message processing method based on a MACSec network, which is applied to an ASIC (Application Specific Integrated Circuit, application specific integrated circuit) chip, including: parsing the received message, and The obtained analysis information matches the preset processing strategy; according to the preset processing strategy, the message is selected to be processed, discarded or decrypted; for the plaintext message after the processing, or the ciphertext after the decryption process Packets, perform normal forwarding operations.
  • ASIC Application Specific Integrated Circuit, application specific integrated circuit
  • the analyzing the received message includes: analyzing the second, third and fourth layer information and port information of the message.
  • the matching of the obtained analysis information to the preset processing strategy includes: identifying the data flow characteristic information of the message according to the obtained analysis information, and combining the data flow characteristic information The same packets are identified as the same data flow; in the MACSec flow table, corresponding actions are matched according to the identified characteristic information of the data flow.
  • the action corresponding to the data flow characteristic information of the MKA message is pass.
  • the MACSec flow table issued by each peer is set separately, and the port information and different SCI values are used as the data flow characteristic information, And decryption and different decryption parameters are used as the corresponding action; when the network security policy is traffic priority, set pass as the corresponding action; when security is priority, set discard as the corresponding action.
  • the message processing method based on the MACSec network after performing the conventional forwarding operation, it also includes: parsing the received message, and matching the obtained analysis information with a preset processing strategy; according to the preset processing Policy, choose to pass processing, discard processing or encryption processing on the message; perform normal forwarding operation on the message after processing or encryption processing.
  • the embodiment of the present application also provides a message processing device based on a MACSec network, which is applied to an ASIC chip, and includes: a MACSec decryption engine unit, which is configured to parse received messages, and obtain The parsing information matches the preset processing strategy; and, is set to select to pass processing, discard processing or decryption processing on the message according to the preset processing strategy; the inbound direction processing unit is set to pass processing The plaintext message, or the decrypted ciphertext message, performs the normal forwarding operation.
  • a MACSec decryption engine unit which is configured to parse received messages, and obtain The parsing information matches the preset processing strategy; and, is set to select to pass processing, discard processing or decryption processing on the message according to the preset processing strategy
  • the inbound direction processing unit is set to pass processing
  • the plaintext message, or the decrypted ciphertext message performs the normal forwarding operation.
  • the analysis unit analyzes the second, third and fourth layer information and port information of the message.
  • the MACSec decryption engine unit is set to, according to the obtained analysis information, identify the data flow characteristic information of the message, and identify the packets with the same data flow characteristic information are the same data flow; in the MACSec flow table, match the corresponding action according to the identified characteristic information of the data flow.
  • the action corresponding to the data flow characteristic information of the MKA message is pass.
  • the MACSec flow table issued by each peer is set separately, and the port information and different SCI values are used as the data flow characteristic information, And decryption and different decryption parameters are used as the corresponding action; when the network security policy is traffic priority, set pass as the corresponding action; when security is priority, set discard as the corresponding action.
  • the message processing device based on the MACSec network, it also includes: a MACSec encryption engine unit configured to analyze the received message, and match the obtained analysis information with a preset processing strategy; and, according to the preset According to the processing strategy, choose to pass processing, discard processing or encryption processing on the packets.
  • a MACSec encryption engine unit configured to analyze the received message, and match the obtained analysis information with a preset processing strategy; and, according to the preset According to the processing strategy, choose to pass processing, discard processing or encryption processing on the packets.
  • This application aims at the problems in the prior art, by matching the corresponding preset processing strategy for the received message according to the message information before processing the message in the inbound direction, it is possible to flexibly control various traffic at the front end Passing, discarding, and decrypting operations in the inbound direction, and correspondingly, passing, discarding, and encrypting operations in the outgoing direction can also be implemented correspondingly. Therefore, normal business processing, such as ACL, can still be performed on the plaintext message generated after decryption, and will not be affected.
  • FIG. 1 is a schematic flow chart of chip processing levels in the embodiment of the present application.
  • Fig. 2 is a schematic diagram of the processing flow inside the ASIC chip in the embodiment of the present application.
  • Fig. 3 is a schematic diagram of the internal processing flow of the MACSec decryption engine in the embodiment of the present application;
  • FIG. 4 is a schematic diagram of the internal processing flow of the MACSec encryption engine in the embodiment of the present application.
  • one method for processing MACSec plaintext messages is that after the MACsec function is enabled on a port, all messages are encrypted and decrypted, and received plaintext messages are discarded. This approach will have an impact on services such as LLDP and LACP; at the same time, packet loss will occur in the intermediate state of MACsec negotiation.
  • Another method is to identify different traffic through the access control list (Access Control List, ACL) module, and then take corresponding encryption and decryption, pass, and discard operations as required.
  • ACL Access Control List
  • the ACL matches the special plaintext characteristics, and the pass operation is adopted; for the received ciphertext traffic, the ACL matches the MACSec packet characteristics, and the decryption operation is adopted; for other received plaintext traffic, configure a default ACL, take drop action.
  • the ACL module must be performed before the MACSec module, so that the ACL-related processing cannot be performed on the decrypted data message. Therefore, it will have a great impact on services such as firewalls and QoS.
  • the embodiment of the present application matches the corresponding preset processing strategy for the received message according to the message information before processing the message in the inbound direction, so that the front-end can flexibly control each
  • the passing, discarding, and decrypting operations of this kind of traffic in the inbound direction can be correspondingly implemented in the outbound direction. Therefore, normal business processing, such as ACL, can still be performed on the plaintext message generated after decryption, and will not be affected.
  • a packet processing method based on a MACSec network in the embodiment of the present application can be applied to an ASIC chip.
  • ASIC Application Specific Integrated Circuit
  • ASIC Application Specific Integrated Circuit
  • a kind of message processing method based on MACSec network of the embodiment of the present application comprises:
  • Step S101 parsing the received message, and matching the obtained parsing information with a preset processing strategy
  • a message when a message is received from the network inlet, it is first processed by the MACSec decryption engine, and then transferred to the next inbound direction processing unit for data forwarding and other actions.
  • the packet received at this time may be a data packet that has been encrypted and transmitted on the link after the MACSec negotiation is successful, or may be a special plaintext that is allowed to be transmitted on the link.
  • the function of the MACSec decryption engine in this embodiment is not only to decrypt the received MACSec message, but also to pass or discard the received plaintext message.
  • the ASIC chip can control whether to enable the MACSec decryption function on a per-port basis. Therefore, if the MACSec decryption function is not enabled on the ingress port, it is equivalent to passing processing, and the packet is forwarded normally.
  • the MACSec engine is mainly composed of three parts: a packet parsing unit, a MACSec flow table, and an encryption and decryption engine.
  • the message parsing unit is configured to parse the messages entering the MACSec decryption engine, including plaintext and ciphertext, and use the parsed message information to search the MACSec flow table.
  • the MACSec Flow consists of two parts: KEY and Action.
  • KEY indicates the characteristic information of the data flow, and all packets with the same characteristic information of the data flow will be automatically identified as the same data flow.
  • MACSec Flow it generally analyzes the second and third layer information, including the secTag header information:
  • the data flow feature information of the message can be identified, and the message with the same data flow feature information can be identified as the same data flow, and then the corresponding action can be matched in the MACSec flow table Action.
  • Step S102 according to the preset processing strategy, select to pass processing, discard processing or decryption processing on the message;
  • Action indicates the processing policy of the flow table, including four types: pass, discard, encrypt, and decrypt.
  • MACSec Flow can be divided into decryption Flow and encryption Flow. As shown in Figure 2, the former is located in the MACSec decryption engine and supports three processing strategies: pass, discard, and decrypt. The latter is located in the MACSec encryption engine In , three processing strategies are supported: pass, discard, and encrypt.
  • the message is directly forwarded conventionally; if the Action is discarded, the message is discarded; if the Action is decrypted, the decryption parameters will be output at the same time, and the MACSec decryption engine uses the decryption parameters to process the message. Decryption processing.
  • protocol messages such as MKA, LACP, or LLDP are allowed to be received in plain text, and in the MACSec flow table issued by the relevant protocol, the action corresponding to the data flow characteristic information of the MKA message is pass.
  • the relevant configuration is:
  • etherType 0x8809 (the Ethernet type of LACP packets is 0x8809)
  • etherType 0x88CC (the ether type of LLDP packets is 0x88CC)
  • etherType 0x888E (the ether type of the MKA message is 0x888E);
  • MACsec peers when decrypting a MACSec message, there may be one or more MACsec peers, and these different MACsec peers will assign different sci values and apply different decryption parameters. At this time, the corresponding MACsec Flow is sent to each peer to decrypt the ciphertext.
  • Relevant configurations include:
  • a corresponding policy can be issued on the port according to user requirements. If it is a traffic priority policy, the action is pass, which allows plaintext to pass; if it is a security priority policy, the action is discard, and the plaintext is discarded; if user requirements change, it is very convenient to modify the policy, just modify the action on the port directly.
  • Step S103 performing a normal forwarding operation.
  • the inbound processing unit receives the plaintext packets after MACSec decryption or the plaintext packets allowed by the MACSec engine. At this time, normal forwarding processing, including ACL processing, is performed on these plaintext packets. After the processing unit in the inbound direction completes the processing, it will transfer to the scheduling unit to perform regular scheduling processing on the plaintext message. Then there is an outbound processing unit to perform regular editing processing on the plaintext message, including ACL processing.
  • Step S104 parsing the received message, and matching the obtained parsing information with a preset processing strategy
  • the parsing unit in the MACSec encryption engine performs a similar message parsing action.
  • the packet is analyzed and processed, mainly to obtain layer 2 and layer 3 information.
  • Step S105 according to the preset processing strategy, select to pass processing, discard processing or encryption processing on the message;
  • the MACSec encryption engine can control to encrypt, pass or discard the received plaintext message by matching the MACSec flow table. If the Action is Pass, the message will be sent directly; if the Action is Discard, the message will be discarded; if the Action is Encryption, the encryption parameters will be given at the same time, and the encryption parameters will be used to complete the encryption process on the message.
  • protocol messages such as MKA, LACP, and LLDP are allowed to be sent in plain text, and corresponding MACsec Flow can be issued for protocols such as MKA, LACP, and LLDP to allow special messages to pass in plain text.
  • protocol messages such as MKA, LACP, and LLDP are allowed to be sent in plain text
  • corresponding MACsec Flow can be issued for protocols such as MKA, LACP, and LLDP to allow special messages to pass in plain text.
  • the relevant configuration is:
  • etherType 0x8809 (the Ethernet type of the LACP message is 0x8809);
  • etherType 0x88CC (the ether type of the LLDP message is 0x88CC);
  • etherType 0x888E (the ether type of the MKA message is 0x888E);
  • corresponding policies can be issued on the port according to user requirements.
  • Step S106 performing a conventional forwarding operation on the processed or encrypted message.
  • the encrypted ciphertext or the directly forwarded plaintext message is sent normally.
  • a packet parsing and MACSec Flow module are added to the MACSec engine, and the operations of passing, discarding, encrypting, and decrypting packets can be flexibly controlled based on Flow.
  • MACSec plaintext policies by adding or deleting MACSec flow tables or modifying MACSec flow table Actions according to your actual needs.
  • the normal processing of the message such as ACL business processing, will not be affected and can be set normally.
  • this application also discloses a corresponding MACSec network-based message processing device embodiment, including:
  • the MACSec decryption engine unit is set to parse the received message, and matches the acquired analysis information to a preset processing strategy; and is set to select to process the message according to the preset processing strategy, Discard processing or decryption processing; the inbound direction processing unit is configured to perform a normal forwarding operation on the processed plaintext message or the decrypted ciphertext message.
  • the parsing unit parses layer 2, 3, and 4 information and port information of the message.
  • the MACSec decryption engine unit is configured to, according to the obtained analysis information, identify the data flow characteristic information of the message, and identify the packets with the same data flow characteristic information as the same data flow; In the MACSec flow table, match corresponding actions according to the identified data flow characteristic information.
  • the action corresponding to the data flow characteristic information of the MKA message is pass.
  • the MACSec flow tables delivered by each peer are set separately, port information and different SCI values are used as the data flow characteristic information, and decryption and different decryption parameter as the corresponding action; when the network security policy is traffic priority, set pass as the corresponding action; when security is priority, set discard as the corresponding action.
  • the MACSec network-based message processing device further includes: a MACSec encryption engine unit configured to analyze the received message, and match the obtained analysis information to a preset processing strategy; and, According to the preset processing strategy, the message is selected to be passed, discarded or encrypted.
  • a MACSec encryption engine unit configured to analyze the received message, and match the obtained analysis information to a preset processing strategy; and, According to the preset processing strategy, the message is selected to be passed, discarded or encrypted.
  • the packet processing device based on the MACSec network in this embodiment is based on the same inventive concept as the aforementioned packet processing method based on the MACSec network, so the content of related embodiments can refer to the foregoing Corresponding content will not be repeated here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)
  • Small-Scale Networks (AREA)

Abstract

本申请公开了一种基于MACSec网络的报文处理方法和装置，其中所述方法包括：解析收到的报文，并将获取的解析信息匹配预设的处理策略；根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或解密处理；对通过处理后的明文报文，或解密处理后的密文报文，执行常规的转发操作。通过所述装置和方法，可以解决现有技术中通过ACL对MACSec报文采取对应的加解密、通过、丢弃的操作时，会影响到其他管理控制功能的问题。

Description

一种基于MACSec网络的报文处理方法和装置
本申请要求于2021年12月31日提交中国专利局、申请号为202111673375.0、发明名称“一种基于MACSec网络的报文处理方法和装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络通信技术，特别是涉及一种基于MACSec网络的报文处理方法和装置。
背景技术
MACsec(Media Access Control Security，MAC安全)定义了基于IEEE802(局域网/城域网标准委员会)局域网络的数据安全通信的方法。MACsec可为用户提供安全的MAC(Media Access Control，媒体介入控制层)层数据发送和接收服务，包括用户数据加密、数据帧完整性检查、数据源真实性校验及重放保护。
MACsec不是对现有端到端IPSec(Internet Protocol Security，互联网安全协议)、TLS(Transport Layer Security，传输层安全性协议)等三层安全技术的替代，而是它们的互补技术。MACsec使用二层加密技术，提供逐跳设备的数据安全传输，适用于政府、军队、金融等对数据机密性要求较高的场合，如局域网两台交换机设备之间经过光传输设备，通过MACsec加密技术可保证数据在中间传输设备上安全传输。
MACsec对原报文macDa(mac Destination address，mac目的地址)和macSa(mac Source address，mac源地址)后面的数据进行加解密。加密之后，MACsec报文会添加一个secTag(安全标签)头，用来识别是MACsec报文。
按照协议，当在端口上MACsec协商成功之后，链路中的数据报文一 般会被进行加密传输，对于明文报文需要被丢弃处理。
但此时仍有一些特殊的明文被允许在链路中传输，这些特例明文可以分为3类：
1)一些协议不允许报文被加密，例如MKA(MACsec Key Agreement，MACsec密钥协议)、LLDP(Link Layer Discovery Protocol，链路层发现协议)、LACP(Link Aggregation Control Protocol，链路聚合控制协议)等，这些协议报文加密之后会影响业务。
2)MACsec协商结果仍然采用明文传输，此时数据报文不需要进行加密。
3)残留的明文，例如MACsec从使能到协商成功之前的中间状态，数据报文还都没有被加密。
对于第1类明文，永远采取明文传输的策略。对于第2类明文，根据协商结果选择加解密还是明文传输的策略。对于第3类明文，用户可以根据应用场景配置不同的策略，如：
1)流量优先策略：此时需要优先保证流量不丢包，尽力加密即可。对收到的残留明文采取通过处理策略。
2)安全优先策略：此时需要优先保证安全性，防止明文报文传输导致用户信息泄漏。端口上一旦使能MACsec功能，立即对非第1类明文的其他所有明文报文采取丢弃处理策略。
对此，现有技术中的一种做法是当端口使能MACsec功能后，所有报文都被加解密处理，收到的明文报文都会被丢弃。这种做法对LLDP、LACP等业务将会产生影响；同时在MACsec协商的中间状态，会出现丢包问题。
另一种做法是通过访问控制列表(Access Control List，ACL)模块来识别出不同流量，然后根据需要采取对应的加解密、通过、丢弃操作。例如：对收到的特殊明文流量，ACL匹配特殊明文特征，采取通过操作；对收到的密文流量，ACL匹配MACsec报文特征，采取解密操作；对收到的其他明文流量，配置一条默认ACL，采取丢弃操作。
然而按照上述方案，ACL模块必须在MACsec模块之前进行，这样 对于解完密的数据报文，就无法再进行ACL相关处理，对防火墙、QoS(Quality of Service，服务质量)等业务会有影响。
发明内容
本申请实施例所要解决的技术问题是，如何解决现有技术中，通过ACL对MACsec报文采取对应的加解密、通过、丢弃的操作时，会影响到其他业务的问题。
为了解决上述的技术问题，本申请实施例提供了一种基于MACSec网络的报文处理方法，应用于ASIC(Application Specific Integrated Circuit，专用集成电路)芯片，包括：解析收到的报文，并将获取的解析信息匹配预设的处理策略；根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或解密处理；对通过处理后的明文报文，或解密处理后的密文报文，执行常规的转发操作。
上述的基于MACSec网络的报文处理方法中，所述解析收到的报文包括：解析报文的二三四层信息及端口信息。
上述的基于MACSec网络的报文处理方法中，所述将获取的解析信息匹配预设的处理策略包括：根据获取的所述解析信息，识别报文的数据流特征信息，并将数据流特征信息相同的报文识别为同一条数据流；在MACSec流表中，根据识别出的所述数据流特征信息，匹配对应的动作。
上述的基于MACSec网络的报文处理方法中，对MKA协议，或LACP协议，或LLDP协议报文下发的MACSec流表中，MKA报文的数据流特征信息所对应的动作为通过。
上述的基于MACSec网络的报文处理方法中，存在一个或多个MACSec对端时，每个对端下发的MACSec流表分别设置，端口信息和不同的SCI值作为所述数据流特征信息，以及解密和不同的解密参数作为对应的所述动作；当网络安全策略为流量优先时，设置通过为对应的所述动作；当为安全优先时，设置丢弃为对应的所述动作。
上述的基于MACSec网络的报文处理方法中，于执行常规的转发操作后，还包括：解析收到的报文，并将获取的解析信息匹配预设的处理策略； 根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或加密处理；对通过处理后或加密处理后的报文，执行常规的转发操作。
为了解决上述的技术问题，本申请实施例还提供了一种基于MACSec网络的报文处理装置，应用于ASIC芯片，包括：MACSec解密引擎单元，被设置为解析收到的报文，并将获取的解析信息匹配预设的处理策略；以及，被设置为根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或解密处理；入方向处理单元，被设置为对通过处理后的明文报文，或解密处理后的密文报文，执行常规的转发操作。
上述的基于MACSec网络的报文处理装置中，所述解析单元所述解析单元解析报文的二三四层信息及端口信息。
上述的基于MACSec网络的报文处理装置中，所述MACSec解密引擎单元被设置为，根据获取的所述解析信息，识别报文的数据流特征信息，并将数据流特征信息相同的报文识别为同一条数据流；在MACSec流表中，根据识别出的所述数据流特征信息，匹配对应的动作。
上述的基于MACSec网络的报文处理装置中，对MKA协议，或LACP协议，或LLDP协议报文下发的MACSec流表中，MKA报文的数据流特征信息所对应的动作为通过。
上述的基于MACSec网络的报文处理装置中，存在一个或多个MACSec对端时，每个对端下发的MACSec流表分别设置，端口信息和不同的SCI值作为所述数据流特征信息，以及解密和不同的解密参数作为对应的所述动作；当网络安全策略为流量优先时，设置通过为对应的所述动作；当为安全优先时，设置丢弃为对应的所述动作。
上述的基于MACSec网络的报文处理装置中，还包括：MACSec加密引擎单元，被设置为解析收到的报文，并将获取的解析信息匹配预设的处理策略；以及，根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或加密处理。
本申请针对现有技术中的问题，通过在入方向对报文进行处理之前，对收到的报文按照报文信息匹配相应的预设处理策略，就能在前端非常灵 活地控制各种流量在入方向的通过、丢弃、解密操作，相应的，在出方向的通过、丢弃、加密操作也可以对应实施。因此对于解密后生成的明文报文，仍然可以进行常规的业务处理，如ACL，不会受到影响。
附图说明
图1是本申请实施例中芯片处理层级的流程示意图；
图2是本申请实施例中ASIC芯片内部的处理流程示意图；
图3是本申请实施例中MACSec解密引擎内部的处理流程示意图；
图4是本申请实施例中MACSec加密引擎内部的处理流程示意图。
具体实施方式
现有技术中对MACSec明文报文的处理，一种做法是当端口使能MACsec功能后，所有报文都被加解密处理，收到的明文报文都会被丢弃。这种做法对LLDP、LACP等业务将会产生影响；同时在MACsec协商的中间状态，会出现丢包问题。另一种做法是通过访问控制列表(Access Control List，ACL)模块来识别出不同流量，然后根据需要采取对应的加解密、通过、丢弃操作。
例如：对收到的特殊明文流量，ACL匹配特殊明文特征，采取通过操作；对收到的密文流量，ACL匹配MACSec报文特征，采取解密操作；对收到的其他明文流量，配置一条默认ACL，采取丢弃操作。然而按照上述方案，ACL模块必须在MACSec模块之前进行，这样对于解完密的数据报文，就无法再进行ACL相关处理。因此，对防火墙、QoS等业务会产生很大影响。
针对现有技术中的问题，本申请实施例通过在入方向对报文进行处理之前，对收到的报文按照报文信息匹配相应的预设处理策略，就能在前端非常灵活地控制各种流量在入方向的通过、丢弃、解密操作，相应的，在 出方向的通过、丢弃、加密操作也可以对应实施。因此对于解密后生成的明文报文，仍然可以进行常规的业务处理，如ACL，不会受到影响。
为使本申请的上述目的、特征和优点能够更为明显易懂，下面结合附图对本申请的可选实施例做详细的说明。
本申请实施例的一种基于MACSec网络的报文处理方法，可应用于ASIC芯片。ASIC(Application Specific Integrated Circuit)是为专门目的设计的集成电路，在本实施例中其主要功能是被设置为转发数据报文。因此如图1所示，在本方案中，关于MACSec的相关处理将会移到ASIC芯片中进行，而不是在PHY芯片(物理介质层)中。本申请实施例的一种基于MACSec网络的报文处理方法包括：
步骤S101，解析收到的报文，并将获取的解析信息匹配预设的处理策略；
如图2所示，当从入网口接收到报文后，首先通过MACSec解密引擎进行处理，然后才会转给下一步的入方向处理单元进行数据转发等动作。此时收到的报文，可能是MACSec协商成功之后，链路中已经被加密传输的数据报文，也可能是在链路中被允许传输的特殊明文。MACSec解密引擎在本实施例中的作用是，既可以对收到的MACSec报文进行解密处理，也可以对收到的明文报文可控制采取通过或者丢弃处理。
在可选实施中，首先会判断MACSec解密引擎是否使能，以及ASIC芯片支持选择是否打开MACSec解密功能。如果未使能MACSec的场景或者不支持MACSec解密功能，则等于通过处理，报文会跳过MACSec解密/加密引擎处理，此时报文只需进行入方向处理、调度、出方向处理3个步骤，这3个步骤也称为常规处理，与现有技术相同。
在可选实施中，完成了上述MACSec解密引擎是否使能的判断后，还会进一步判断报文入端口是否使能MACSec解密功能。ASIC芯片能够支持按端口控制是否打开MACSec解密功能，因此如果入端口上未使能MACSec解密功能，则同样等于通过处理，报文进行常规转发处理。
本实施例中，所述MACSec引擎主要由报文解析单元、MACSec流表、加解密引擎三部分组成。其中，报文解析单元被设置为解析进入MACSec解密引擎的报文，包括明文和密文，并利用解析后的报文信息去查找MACSec流表。
所述MACSec Flow由两部分构成：KEY和Action。KEY表示数据流特征信息，所有数据流特征信息相同的报文会被自动识别成同一条数据流Flow。对于MACSec Flow而言，一般主要解析出二三层信息，包括secTag头信息：
1、源MAC地址(macSa)
2、目的MAC地址(macDa)
3、以太类型(etherType)
4、s-tag vlan信息(svlanId)
5、c-tag vlan信息(cvlanId)
6、secTag sci信息(sci)
7、端口号(port)
8、其他
根据获取的所述解析信息，就可以识别报文的数据流特征信息，并将数据流特征信息相同的报文识别为同一条数据流，进而在MACSec流表中，即可匹配到对应的动作Action。
步骤S102，根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或解密处理；
如果在MACSec Flow中，可匹配到出Action，则优先执行该动作；如果未查找到，则可以在端口Port上匹配默认的预设动作Action执行。
在MACSec流表中，Action表示该流表的处理策略，包括通过(pass)、丢弃(discard)、加密(encrypt)、解密(decrypt)共四种。MACSec Flow可以分为解密Flow和加密Flow，如图2所示，前者位于MACSec解密引擎中，支持通过(pass)、丢弃(discard)、解密(decrypt)三种处理策略，后者位于MACSec加密引擎中，支持通过(pass)、丢弃(discard)、 加密(encrypt)三种处理策略。
在本实施例中，如果Action为通过，报文直接进行常规转发处理；如果Action为丢弃，将报文丢弃；如果Action为解密，同时会出解密参数，MACSec解密引擎利用解密参数对报文进行解密处理。
在可选实施中，对于一些的典型需求，可以进行相应设置：
例如对MKA，或LACP，或LLDP等协议报文允许明文接收，可在相关协议下发的MACSec流表中，MKA报文的数据流特征信息所对应的动作为通过。具体来说，相关配置为：
1)LACP Flow：
key：etherType＝0x8809(LACP报文的以太类型为0x8809)
action：pass
2)LLDP Flow：
key：etherType＝0x88CC(LLDP报文的以太类型为0x88CC)
action：pass
3)MKA Flow：
Key：etherType＝0x888E(MKA报文的以太类型为0x888E)；
Action：pass。
再如对MACSec报文进行解密处理时，可能存在一个或多个MACsec对端，这些不同的MACsec对端会分配不同的sci值，应用不同的解密参数。此时针对每个对端下发对应的MACsec Flow来对密文进行解密处理。相关配置包括：
Key：port+sci；
Action：Decrypt+解密参数。
再有对于普通明文报文，可根据用户需求在端口上出对应策略。如果是流量优先策略，action为pass，允许明文通过；如果是安全优先策略，action为discard，丢弃明文；如果用户需求发生变化，修改策略也很方便，直接修改端口上的action即可。
步骤S103，执行常规的转发操作。
如图2所示，在MACSec解密引擎完成相应的Action动作后，除被丢弃处理的报文，入方向处理单元对收到的是MACSec解密后的明文报文或者MACSec引擎允许通过的明文报文，此时对这些明文报文进行常规的转发处理，包括ACL处理。入方向处理单元完成处理后，会转给调度单元对明文报文进行常规的调度处理。然后再有出方向处理单元对明文报文进行常规的编辑处理，包括ACL处理。
步骤S101～步骤S103的MACSec解密引擎的处理流程可以参见图3所示的流程示意图。
步骤S104，解析收到的报文，并将获取的解析信息匹配预设的处理策略；
此处与步骤S101相对的，由MACSec加密引擎中的解析单元执行相类似的报文解析动作。
在可选实施中，也可以首先判断MACSec加密引擎是否使能，ASIC芯片支持选择是否打开MACSec加密功能。如果未使能MACSec加密引擎，则等于通过处理，报文进行发送处理。判断报文出端口是否使能MACSec加密功能，ASIC芯片支持按端口控制是否打开MACSec加密功能，如果未使能，等于通过处理，报文进行发送处理。
在可选实施中，对报文进行解析处理，主要解析出二三层信息。
步骤S105，根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或加密处理；
同样的，MACSec加密引擎通过匹配MACSec流表，对收到的明文报文可控制采取加密、通过或者丢弃处理。如果Action为通过，报文直接进行发送处理；如果Action为丢弃，将报文丢弃；如果Action为加密，则同时还会给出加密参数，利用加密参数对报文完成加密处理。
在可选实施中，对于一些的典型需求，也可以进行相应设置：
例如对MKA、LACP、LLDP等协议报文允许明文发送，可针对MKA、LACP、LLDP等协议下发对应的MACsec Flow来允许特例报文明文通过。具体来说，相关配置为：
1)LACP Flow：
key：etherType＝0x8809(LACP报文的以太类型为0x8809)；
action：pass；
2)LLDP Flow：
key：etherType＝0x88CC(LLDP报文的以太类型为0x88CC)；
action：pass；
3)MKA Flow：
Key：etherType＝0x888E(MKA报文的以太类型为0x888E)；
Action：pass。
再如，在MACsec协商成功前，对于普通明文报文，可根据用户需求在端口上出对应策略
1)如果是流量优先策略，action为pass，允许明文通过；
2)如果是安全优先策略，action为discard，丢弃明文。
又如，当MACsec协商成功后，按照协议，此时只需下发一条MACsec Flow来对密文进行加密处理。
key：port；
action：encrypt+加密参数。
步骤S106，对通过处理后或加密处理后的报文，执行常规的转发操作。
加密成功后，对加密后的密文或者直接转发的明文报文进行常规的发送处理。
步骤S104～步骤S106的MACSec加密引擎的处理流程可以参见图4所示的流程示意图。
本实施例在MACSec引擎中增加了报文解析和MACSec Flow模块，可以基于Flow来灵活的控制报文的通过、丢弃、加密、解密操作。作为用户来说，可以根据自己的实际需要，通过添加、删除MACSec流表或者修改MACSec流表Action的方式，非常方便的应用各种MACSec明文策略。对于解密后的明文报文，报文的常规处理，如ACL业务处理则不会 受到影响，可以正常设置。
与前述方法实施例相应的，本申请还公开了相应的基于MACSec网络的报文处理装置实施例，包括：
MACSec解密引擎单元，被设置为解析收到的报文，并将获取的解析信息匹配预设的处理策略；以及，被设置为根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或解密处理；入方向处理单元，被设置为对通过处理后的明文报文，或解密处理后的密文报文，执行常规的转发操作。
在可选实施中，所述解析单元解析报文的二三四层信息及端口信息。
在可选实施中，所述MACSec解密引擎单元被设置为，根据获取的所述解析信息，识别报文的数据流特征信息，并将数据流特征信息相同的报文识别为同一条数据流；在MACSec流表中，根据识别出的所述数据流特征信息，匹配对应的动作。
在可选实施中，对MKA协议，或LACP协议，或LLDP协议报文下发的MACSec流表中，MKA报文的数据流特征信息所对应的动作为通过。
在可选实施中，存在一个或多个MACSec对端时，每个对端下发的MACSec流表分别设置，端口信息和不同的SCI值作为所述数据流特征信息，以及解密和不同的解密参数作为对应的所述动作；当网络安全策略为流量优先时，设置通过为对应的所述动作；当为安全优先时，设置丢弃为对应的所述动作。
在可选实施中，所述基于MACSec网络的报文处理装置，还包括：MACSec加密引擎单元，被设置为解析收到的报文，并将获取的解析信息匹配预设的处理策略；以及，根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或加密处理。
本领域技术人员可以理解的是，本实施例的一种基于MACSec网络的报文处理装置与前述的基于MACSec网络的报文处理方法为基于同一发明构思，因此关于相关实施例的内容可以参照前文相应内容处，此处不再赘述。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部 分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：ROM、RAM、磁盘或光盘等。
虽然本申请披露如上，但本申请并非限定于此。任何本领域技术人员，在不脱离本申请的精神和范围内，均可作各种更动与修改，因此本申请的保护范围应当以权利要求所限定的范围为准。

Claims (12)

  1. 一种基于MACSec网络的报文处理方法，应用于ASIC芯片，包括：
    解析收到的报文，并将获取的解析信息匹配预设的处理策略；
    根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或解密处理；
    对通过处理后的明文报文，或解密处理后的密文报文，执行常规的转发操作。
  2. 如权利要求1所述的基于MACSec网络的报文处理方法，其中，所述解析收到的报文包括：解析报文的二三四层信息及端口信息。
  3. 如权利要求1或2所述的基于MACSec网络的报文处理方法，其中，所述将获取的解析信息匹配预设的处理策略包括：
    根据获取的所述解析信息，识别报文的数据流特征信息，并将数据流特征信息相同的报文识别为同一条数据流；
    在MACSec流表中，根据识别出的所述数据流特征信息，匹配对应的动作。
  4. 如权利要求3所述的基于MACSec网络的报文处理方法，其中，对MKA协议，或LACP协议，或LLDP协议报文下发的MACSec流表中，MKA报文的数据流特征信息所对应的动作为通过。
  5. 如权利要求3所述的基于MACSec网络的报文处理方法，其中，
    存在一个或多个MACSec对端时，每个对端下发的MACSec流表分别设置，端口信息和不同的SCI值作为所述数据流特征信息，以及解密和不同的解密参数作为对应的所述动作；
    当网络安全策略为流量优先时，设置通过为对应的所述动作；当为安全优先时，设置丢弃为对应的所述动作。
  6. 如权利要求1所述基于MACSec网络的报文处理方法，其中，于执行常规的转发操作后，还包括：
    解析收到的报文，并将获取的解析信息匹配预设的处理策略；
    根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或加密处理；
    对通过处理后或加密处理后的报文，执行常规的转发操作。
  7. 一种基于MACSec网络的报文处理装置，应用于ASIC芯片，包括：
    MACSec解密引擎单元，被设置为解析收到的报文，并将获取的解析信息匹配预设的处理策略；以及，
    被设置为根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或解密处理；
    入方向处理单元，被设置为对通过处理后的明文报文，或解密处理后的密文报文，执行常规的转发操作。
  8. 如权利要求7所述的基于MACSec网络的报文处理装置，其中，所述解析单元解析报文的二三四层信息及端口信息。
  9. 如权利要求7或8所述的基于MACSec网络的报文处理装置，其中，所述MACSec解密引擎单元被设置为，
    根据获取的所述解析信息，识别报文的数据流特征信息，并将数据流特征信息相同的报文识别为同一条数据流；
    在MACSec流表中，根据识别出的所述数据流特征信息，匹配对应的动作。
  10. 如权利要求9所述的基于MACSec网络的报文处理装置，其中，对MKA协议，或LACP协议，或LLDP协议报文下发的MACSec流表中，MKA报文的数据流特征信息所对应的动作为通过。
  11. 如权利要求9所述的基于MACSec网络的报文处理装置，其中，
    存在一个或多个MACSec对端时，每个对端下发的MACSec流表分别设置，端口信息和不同的SCI值作为所述数据流特征信息，以及解密和不同的解密参数作为对应的所述动作；
    当网络安全策略为流量优先时，设置通过为对应的所述动作；当为安全优先时，设置丢弃为对应的所述动作。
  12. 如权利要求7所述基于MACSec网络的报文处理装置，其中，还包括：
    MACSec加密引擎单元，被设置为解析收到的报文，并将获取的解析信息匹配预设的处理策略；以及，
    根据所述预设的处理策略，选择对报文进行通过处理，丢弃处理或加密处理。
PCT/CN2022/137616 2021-12-31 2022-12-08 一种基于MACSec网络的报文处理方法和装置 WO2023124880A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111673375.0A CN114244626B (zh) 2021-12-31 2021-12-31 一种基于MACSec网络的报文处理方法和装置
CN202111673375.0 2021-12-31

Publications (1)

Publication Number Publication Date
WO2023124880A1 true WO2023124880A1 (zh) 2023-07-06

Family

ID=80745420

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/137616 WO2023124880A1 (zh) 2021-12-31 2022-12-08 一种基于MACSec网络的报文处理方法和装置

Country Status (2)

Country Link
CN (1) CN114244626B (zh)
WO (1) WO2023124880A1 (zh)

Families Citing this family (1)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN114244626B (zh) * 2021-12-31 2024-03-15 苏州盛科通信股份有限公司 一种基于MACSec网络的报文处理方法和装置

Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130091349A1 (en) * 2011-10-05 2013-04-11 Cisco Technology, Inc. Enabling Packet Handling Information in the Clear for MACSEC Protected Frames
CN105635154A (zh) * 2016-01-05 2016-06-01 盛科网络（苏州）有限公司 灵活的MACSec报文加密认证的芯片实现方法及实现装置
CN109040124A (zh) * 2018-09-17 2018-12-18 盛科网络（苏州）有限公司 用于交换机的处理报文的方法和装置
CN110636078A (zh) * 2019-10-12 2019-12-31 盛科网络（苏州）有限公司 实现Cloudsec的方法及装置
CN114244626A (zh) * 2021-12-31 2022-03-25 苏州盛科通信股份有限公司 一种基于MACSec网络的报文处理方法和装置

Family Cites Families (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN112217765B (zh) * 2019-07-10 2023-06-30 深圳市中兴微电子技术有限公司 报文解析方法和装置
CN110868362B (zh) * 2019-10-22 2022-04-08 苏州盛科科技有限公司 一种MACsec非受控端口报文的处理方法及装置

Patent Citations (5)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20130091349A1 (en) * 2011-10-05 2013-04-11 Cisco Technology, Inc. Enabling Packet Handling Information in the Clear for MACSEC Protected Frames
CN105635154A (zh) * 2016-01-05 2016-06-01 盛科网络（苏州）有限公司 灵活的MACSec报文加密认证的芯片实现方法及实现装置
CN109040124A (zh) * 2018-09-17 2018-12-18 盛科网络（苏州）有限公司 用于交换机的处理报文的方法和装置
CN110636078A (zh) * 2019-10-12 2019-12-31 盛科网络（苏州）有限公司 实现Cloudsec的方法及装置
CN114244626A (zh) * 2021-12-31 2022-03-25 苏州盛科通信股份有限公司 一种基于MACSec网络的报文处理方法和装置

Also Published As

Publication number Publication date
CN114244626A (zh) 2022-03-25
CN114244626B (zh) 2024-03-15

Similar Documents

Publication Publication Date Title
US7596806B2 (en) VPN and firewall integrated system
US8775790B2 (en) System and method for providing secure network communications
US9461975B2 (en) Method and system for traffic engineering in secured networks
US8386772B2 (en) Method for generating SAK, method for realizing MAC security, and network device
EP2916492B1 (en) Methods and apparatuses for sending and receiving data across virtual firewalls
US9461914B2 (en) Path maximum transmission unit handling for virtual private networks
US6674743B1 (en) Method and apparatus for providing policy-based services for internal applications
US20100138909A1 (en) Vpn and firewall integrated system
US7000120B1 (en) Scheme for determining transport level information in the presence of IP security encryption
JP6529694B2 (ja) 転送装置および通信ネットワーク
WO2023124880A1 (zh) 一种基于MACSec网络的报文处理方法和装置
CN110868362B (zh) 一种MACsec非受控端口报文的处理方法及装置
CN110691074B (zh) 一种IPv6数据加密方法、IPv6数据解密方法
CN110768958B (zh) 一种IPv4数据加密方法、IPv4数据解密方法
EP3907964A1 (en) Method device and system for policy based packet processing
Cisco Configuring IPSec Network Security
Cisco Intranet and Extranet VPN Business Scenarios
JP5319777B2 (ja) ネットワークセキュリティ方法および装置
CN115277190B (zh) 一种链路层透明加密系统在网络上实现邻居发现的方法
Burande et al. Wireless network security by SSH tunneling
WO2023125993A1 (zh) 隧道加密，转发和解密方法以及装置
Li-shen et al. Research of Cooperation of IPSec and Firewall
Mende et al. All your packets are belong to us

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22914135

Country of ref document: EP

Kind code of ref document: A1