WO2023125993A1 - 隧道加密，转发和解密方法以及装置 - Google Patents

隧道加密，转发和解密方法以及装置 Download PDF

Info

Publication number
WO2023125993A1
WO2023125993A1 PCT/CN2022/144248 CN2022144248W WO2023125993A1 WO 2023125993 A1 WO2023125993 A1 WO 2023125993A1 CN 2022144248 W CN2022144248 W CN 2022144248W WO 2023125993 A1 WO2023125993 A1 WO 2023125993A1
Authority
WO
WIPO (PCT)
Prior art keywords
tunnel
forwarding
encryption
message
encrypted
Prior art date
Application number
PCT/CN2022/144248
Other languages
English (en)
French (fr)
Inventor
成伟
王俊杰
龚海东
Original Assignee
苏州盛科通信股份有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 苏州盛科通信股份有限公司 filed Critical 苏州盛科通信股份有限公司
Publication of WO2023125993A1 publication Critical patent/WO2023125993A1/zh

Links

Images

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4633—Interconnection of networks using encapsulation techniques, e.g. tunneling
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/28—Data switching networks characterised by path configuration, e.g. LAN [Local Area Networks] or WAN [Wide Area Networks]
    • H04L12/46—Interconnection of networks
    • H04L12/4641—Virtual LANs, VLANs, e.g. virtual private networks [VPN]
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L47/00—Traffic control in data switching networks
    • H04L47/10—Flow control; Congestion control
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols
    • Y—GENERAL TAGGING OF NEW TECHNOLOGICAL DEVELOPMENTS; GENERAL TAGGING OF CROSS-SECTIONAL TECHNOLOGIES SPANNING OVER SEVERAL SECTIONS OF THE IPC; TECHNICAL SUBJECTS COVERED BY FORMER USPC CROSS-REFERENCE ART COLLECTIONS [XRACs] AND DIGESTS
    • Y02—TECHNOLOGIES OR APPLICATIONS FOR MITIGATION OR ADAPTATION AGAINST CLIMATE CHANGE
    • Y02D—CLIMATE CHANGE MITIGATION TECHNOLOGIES IN INFORMATION AND COMMUNICATION TECHNOLOGIES [ICT], I.E. INFORMATION AND COMMUNICATION TECHNOLOGIES AIMING AT THE REDUCTION OF THEIR OWN ENERGY USE
    • Y02D30/00—Reducing energy consumption in communication networks
    • Y02D30/50—Reducing energy consumption in communication networks in wire-line communication networks, e.g. low power modes or reduced link rate

Definitions

  • the present application relates to network communication technology, in particular to a tunnel encryption, forwarding and decryption method and device.
  • VXLAN Virtual Extensible Local Area Network, Virtual Extended Local Area Network
  • VXLAN Virtual Extensible Local Area Network
  • IP Internet Protocol, the protocol for interconnection between networks
  • the encryption node is responsible for encrypting the plaintext of the VXLAN data packet
  • the decryption node is responsible for decrypting the ciphertext of the VXLAN data packet
  • the intermediate node performs routing and forwarding based on the ciphertext of the VXLAN data packet.
  • HOST A host A
  • HOST B host B
  • VXLAN Tunnel End Point VXLAN Tunnel End Point
  • VTEP VXLAN Tunnel Endpoint
  • HOST A and HOST B are in the same network segment, request and obtain the MAC address of HOST B from HOST A;
  • the switch After the message arrives at VTEP-1, the switch performs forwarding table entry search and forwarding processing according to the message analysis result MAC, IP and other information. If it is Layer 2 forwarding, look for FDB (Forwarding Data Base, forwarding database) entries; if it is Layer 3 forwarding, look for the routing table.
  • FDB Forwarding Data Base, forwarding database
  • the MAC_DA of the egress message of VTEP-1 is the device MAC-2 of Router-1 (router); the MAC_SA is the device MAC-1 of VTEP-1; the outer IP_DA is the IP-4 of VTEP-2, and the IP_SA is the device of VTEP-1 IP-1; L4DstPort in the added outer UDP Header (User Datagram Protocol Header, User Datagram Protocol header format) is a specific reserved value, not VXLAN UDP port (this identification is one of the characteristics of the VXLAN packet ciphertext) ;
  • the encrypted packets can still be routed and forwarded on the network according to the VXLAN outer IP address, and finally reach VTEP-2;
  • VTEP-2 After VTEP-2 receives the message, it recognizes the ciphertext of the VXLAN data packet according to the message parsing result (as shown in Figure 4), and first decrypts the ciphertext of the VXLAN data packet inside the switch, and completes the decrypted report.
  • the text is the normal VXLAN data packet plain text.
  • the switch will search for VXLAN Tunnel decapsulation table items according to IP_DA, IP_SA, and VNI (virtual network device interface module) in the VXLAN message analysis result, and perform VXLAN message decapsulation processing and inner layer message analysis according to the search result .
  • IP_DA virtual network device interface module
  • VNI virtual network device interface module
  • the technical problem to be solved by the embodiments of the present application is to solve the problem of data center deployment end-to-end encryption scheme ECMP multi-path load balancing with consistent forwarding paths before and after encryption, avoiding the problem of out-of-order packets caused by data streams, and through unified encryption
  • the protocol data format meets the application requirements of various Overlay (coverage) tunnel data centers, and avoids customizing different encryption schemes for VXLAN and NVGRE multiple tunnel protocols, thereby ensuring the simplicity of the data center network.
  • the embodiment of the present application provides a tunnel encryption method, including: adding unmodified original forwarding information and chip forwarding and configuration information to the preset field of the tunnel encrypted message; the original Forwarding information is used for intermediate forwarding node ECMP multi-path load sharing calculation and path consistency, service quality control, security policy execution, and selection of different encryption granularities.
  • the insertion of the preset field is located at the position after the IP packet L3Header, thereby forming a specific IP Protocol as the encrypted tunnel message feature;
  • the original forwarding information includes at least one of the following forwarding information: L4 Dst Port, L4 Src Port, IP Protocol, VNI, Security Index (Security Index), DSCP (Differentiated Services Code Point, Differentiated Services Code Point), SGT ID, Inner HASH (Inner Hash).
  • the present application also discloses a tunnel forwarding method, including: receiving the tunnel encrypted message generated according to the above-mentioned tunnel encryption implementation method; identifying the message as a tunnel encrypted message; The forwarding path is calculated and forwarded based on the original forwarding information in the preset field of the tunnel encrypted message.
  • the present application also discloses a tunnel decryption method, including: receiving a tunnel encrypted message sent according to the above-mentioned tunnel forwarding method; identifying the message as a tunnel encrypted message, and decrypting it; Forward the decrypted tunnel encrypted packets.
  • this application also discloses a tunnel encryption device, including: an encryption node, which adds unmodified original forwarding information to the preset field of the tunnel encrypted message; the original forwarding information is used in the intermediate Forwarding node ECMP multi-path load sharing calculation and path consistency, service quality control, security policy enforcement, and selection of different encryption granularities.
  • the insertion of the preset field is located at a position after the IP packet L3Header, thereby forming a specific IP Protocol as an encrypted tunnel message feature;
  • the original forwarding information includes at least one of the following forwarding information: L4 Dst Port, L4 Src Port, IP Protocol, VNI, Security Index, DSCP, SGT ID, Inner HASH.
  • the present application also discloses a tunnel forwarding device, including: a forwarding node, used to receive the tunnel encryption message generated by the above-mentioned tunnel encryption implementation device; identify the message as tunnel encryption message; and, calculate and forward the forwarding path according to the original forwarding information in the preset field of the tunnel encrypted message.
  • the present application also discloses a tunnel decryption device, including: receiving the tunnel encrypted message sent by the above-mentioned tunnel forwarding device; identifying the message as a tunnel encrypted message, and decrypting it; The decrypted tunnel encrypted packets are forwarded.
  • the application aims at the problems in the prior art, by defining a reserved preset field in the tunnel encrypted data message, adding the original forwarding information without modification in the preset field, such as the L4 Dst Port of VXLAN, which can be used
  • the intermediate forwarding node realizes the normal ECMP multipath load balancing calculation and forwarding of the message by reading the original forwarding information in the preset field; for example, the VXLAN inner layer IP DSCP allows the intermediate forwarding node to read the original forwarding information in the preset field
  • the original forwarding information can realize different quality of service; such as VXLAN SGT security group, which can enable the intermediate forwarding node to read the original forwarding information in the preset field, and realize the security policy based on the SGT security group, etc.
  • This application defines the encryption protocol and its message format, carries the original forwarding information through the preset field, and realizes the general tunnel encryption scheme, thereby solving the problems existing in the end-to-end encryption of the tunnel.
  • Figure 1 is a schematic diagram of the current topology for routing and forwarding based on VXLAN encrypted data packets
  • Fig. 2 is a schematic diagram of the structure of the tunnel message in Embodiment 1;
  • FIG. 3 is a schematic diagram of the tunnel packet structure in Embodiment 1;
  • FIG. 4 is a schematic diagram of the tunnel packet structure in Embodiment 2.
  • the packet is encapsulated based on the IP protocol.
  • the format of the message after the switch based on the embodiment of the present application encrypts the VXLAN message is shown in FIG. 2 and FIG. 3 .
  • the IP Protocol field in the IP header will be updated to New IP Protocol due to encryption operations such as VXLAN data packets.
  • New IP Protocol is a recognized special identifier, so that it can be uniformly identified as a message that has been encrypted with VXLAN data packets. Text ID.
  • the encrypted message inserts a preset field X-SEC Header behind the IP header, so that this embodiment forms a specific protocol different from the existing common third-layer network layer IP protocol. IP protocol, and use this specific IP Protocol as one of the characteristics of the encrypted tunnel message.
  • the X-SEC Header it is supported to carry one or more of the above forwarding information, such as carrying the IP Protocol of the original message.
  • Type 8bit, which identifies the type of X-SEC Header and is used to distinguish different information carried;
  • Next Header 8bit, which identifies the analysis of the inner message header of the X-SEC Header
  • X-SEC Header supports carrying one or more forwarding information, which includes but not limited to the following forwarding information fields:
  • L4 Dst Port 16bit, identifying the original inner or outer L4 Dst Port
  • L4 Src Port 16bit, identifying the original inner or outer L4 Src Port
  • IP Protocol 8bit, identifying the original IP Protocol
  • SGT ID 16bit, used for global encryption and decryption Key, which can flexibly map fine services
  • DSCP 6bit, identifies IP DSCP priority
  • VNI 24bit, identifying VXLAN VNI or GRE VSI;
  • Inner HASH 16bit, which identifies the HASH calculation result based on the characteristics of the tunnel inner layer message, and is used to participate in ECMP load balancing forwarding.
  • the parsing process is performed first, and the characteristics of the message are obtained according to the result, such as: IPSA, IPDA, New IP Protocol, and X-SEC Header and other fields. Therefore, when the intermediate node looks up the forwarding table entry, it will search the routing table entry according to the IPDA, and distinguish the encrypted message according to the New IP Protocol (this is the same as the existing practice). Different from the existing technology, after identifying the encrypted message, the intermediate node can participate in the ECMP HASH calculation according to the original IP Protocol of the forwarding information carried by the X-SEC Header, so that the intermediate node ECMP forwards the encrypted message before and after encryption. The extracted HASH factor remains unchanged, meeting the consistency of ECMP HASH route selection.
  • the switch After the switch receives the encrypted message, it first analyzes and processes it, so as to obtain the characteristics of the message according to the result, such as: IPSA, IPDA, New IP Protocol, and X-SEC Header and other fields. Then, according to the New IP Protocol, it is distinguished that it is encrypted. Therefore, first find the table item used to match the decrypted ACL to decrypt the data message, and search for the routing table item according to the IPDA of the decrypted VXLAN message. , and finally perform ECMP forwarding on the decrypted message.
  • the switch After the switch receives the encrypted message, it first analyzes and processes it, so as to obtain the characteristics of the message according to the result, such as: IPSA, IPDA, New IP Protocol, and X-SEC Header and other fields. Then, according to the New IP Protocol, it is distinguished that it is encrypted. Therefore, first find the table item used to match the decrypted ACL to decrypt the data message, and search for the routing table item according to the IP
  • the preset field X-SEC Header is inserted into the position after the L3Header of the IP data packet, and a set of encryption schemes is implemented to satisfy various Overlay tunnel protocol networking in the data center.
  • the original forwarding information is used for intermediate forwarding node ECMP multi-path load sharing calculation and path consistency, service quality control, security policy execution, selection of different encryption granularities, etc.
  • Adding unmodified original forwarding information in the preset field X-SEC such as carrying the L4Dst Port of VXLAN, can enable the intermediate forwarding node to realize normal message ECMP multiplexing by reading the original forwarding information in the preset field.
  • VXLAN inner layer IP DSCP can enable intermediate forwarding nodes to read the original forwarding information in the preset field to achieve different quality of service; also, carrying such as VXLAN SGT security group, The intermediate forwarding node can be made to read the original forwarding information in the preset field, so as to realize the security policy based on the SGT security group, etc.
  • data encryption, decryption and forwarding are performed through a GRE tunnel.
  • the packet format after the switch based on the embodiment of the present application encrypts the VXLAN packet is shown in FIG. 4 .
  • the IP Protocol field in the IP header will be updated to New IP Protocol due to the encryption operation such as GRE/NVGRE data packets.
  • New IP Protocol is a special identifier, which is uniformly recognized as a message that has undergone GRE/NVGRE data packet ciphertext logo.
  • the decryption starting node will use the original GRE inner layer message before encryption
  • the ECMP HASH calculation is completed in advance at the beginning of encryption, and the ECMP HASH calculation result is extracted to the Inner HASH field of the X-SEC Header.
  • the encrypted message inserts the X-SEC Header behind the IP header. In the X-SEC Header, it supports carrying one or more of the above forwarding information, such as carrying the Inner HASH of the original message.
  • the parsing process is performed first, and the characteristics of the message are obtained according to the result, such as: IPSA, IPDA, New IP Protocol, and X-SEC Header and other fields. Therefore, when the intermediate node looks up the forwarding table item, it will look up the routing table item according to IPDA, and distinguish the encrypted message according to the New IP Protocol. After the encrypted message is identified, it can participate in the ECMP HASH calculation according to the forwarding information Inner HASH carried by the X-SEC Header, so that the HASH factor extracted by the intermediate node ECMP forwarding before encryption and after encryption remains unchanged, satisfying the ECMP HASH selection. road consistency.
  • the switch After the switch receives the encrypted message, it first analyzes and processes it, so as to obtain the characteristics of the message according to the result, such as: IPSA, IPDA, New IP Protocol, and X-SEC Header and other fields. Then according to the New IP Protocol, it is distinguished that it is encrypted. Therefore, first find the table item used to match the decrypted ACL to decrypt the data message, and search for the routing table item according to the IPDA of the decrypted GRE message , and finally perform ECMP forwarding on the decrypted message.
  • the tunnel encryption protocol of this application can support multiple tunnels, including but not limited to: VXLAN, GRE/NVGRE, IPv4/IPv6Tunnel, SRv6, GENEVE, and realize the encryption scheme based on IP Header , it supports traversing the intermediate IP three-layer network during deployment, simplifies the capability requirements of intermediate nodes, and has the deployment ability to realize end-to-end security encryption.
  • the invention design enhances the scalability of the encryption protocol by designing the X-SEC Header to carry one or more types of forwarding information, and solves the ECMP multi-path load sharing forwarding path consistency, service quality, security policy and operation and maintenance management, fine Encryption granularity and other issues.
  • This embodiment discloses a tunnel encryption, forwarding and decryption device, including:
  • the encryption node adds unmodified original forwarding information and chip forwarding and configuration information to the preset field of the tunnel encrypted message; the original forwarding information is used for intermediate forwarding node ECMP multipath load sharing calculation and path consistency, Quality of service control, security policy enforcement, and selection of different encryption granularities.
  • the insertion of the preset field is located after the L3Header of the IP data packet.
  • the original forwarding information includes at least one of the following forwarding information: L4 Dst Port, L4 Src Port, VNI, Security Index, DSCP, SGT ID, Inner HASH.
  • the tunnel includes VXLAN, GRE/NVGRE, IPv4/IPv6 Tunnel, SRv6, and GENEVE.
  • the tunnel forwarding device in this embodiment includes: a forwarding node, configured to receive the tunnel encrypted message generated by the above tunnel encryption implementation device; identify the message as a tunnel encrypted message; and, according to the tunnel encrypted message The original forwarding information in the preset field is calculated and forwarded on the forwarding path.
  • the tunnel decryption device of this embodiment includes: receiving the tunnel encrypted message sent by the tunnel forwarding device as described above; identifying the message as a tunnel encrypted message and decrypting it; forwarding the decrypted tunnel encrypted message .
  • Embodiment 4 is based on the same inventive concept as the tunnel encryption, forwarding, and decryption methods in Embodiments 1 to 3, so the content related to this embodiment Reference can be made to the corresponding content above, and details will not be repeated here.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Hardware Design (AREA)
  • Computing Systems (AREA)
  • General Engineering & Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

本申请公开了一种隧道加密，转发和解密方法以及装置，其中所述隧道加密方法包括：于隧道加密报文的预设字段中添加未做修改的原始转发信息；所述原始转发信息用于中间转发节点的路径计算选择，服务质量控制，安全策略执行，不同加密粒度的选择等。通过所述方法和装置，可以解决现有数据中心端到端加密方案部署的挑战，如ECMP多路径负载分担选路不一致，端到端服务质量难以部署，安全策略配置实施复杂，无法灵活选择加密粒度，以及传统加密隧道报文格式扩展性等问题。

Description

隧道加密，转发和解密方法以及装置
本申请要求于2021年12月31日提交中国专利局、申请号为202111673386.9、发明名称“隧道加密，转发和解密方法以及装置”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及网络通信技术，特别是涉及一种隧道加密，转发和解密方法以及装置。
背景技术
现有基于VXLAN(Virtual Extensible Local Area Network，虚拟扩展局域网)隧道的加解密协议，能够实现数据中心端到端的加密能力，将虚拟机或物理服务器组装的原始报文后发出，在途经的网络设备上接收到该报文后，需要先进行解密和加密操作，使用报文的MAC(Media Access Control Address，媒体存取控制位址)地址，IP(Internet Protocol，网络之间互连的协议)地址等信息进行转发，到达目的地后由解密VXLAN密文，并发送给虚拟机或物理服务器。在VXLAN协议中，加密节点负责VXLAN数据包明文加密，解密节点负责VXLAN数据包密文解密，中间节点基于VXLAN数据包密文进行路由转发。
如图1所示，当HOST A(主机A)与HOST B(主机B)在同一网段，分布在不同的VXLAN隧道端点(VXLAN Tunnel End Point，VTEP(VXLAN Tunnel Endpoint))下面，物理服务器组装的原始报文后发出，在途经的网络设备上接收到该报文后，需要先进行解密以及解封装，和加密以及加封装)操作。以HOST A与HOST B的通信为例，可选的处理过程详细如下：
1.HOST A与HOST B处于同一网段，在HOST A请求并获得HOST B的MAC地址；
2.报文到达VTEP-1后，交换机根据报文解析结果MAC，IP等信息进行转发表项查找和转发处理。如果是二层转发，就查找FDB(Forwarding Data Base，转发数据库)表项；如果是三层转发，就查找路由表。
以L2转发为例，根据查找的结果中的下一跳信息对原始报文执行加密和VXLAN加封装处理，最终将报文转发出去。VTEP-1的出口报文MAC_DA为Router-1(路由器)的设备MAC-2；MAC_SA为VTEP-1的设备MAC-1；外层IP_DA为VTEP-2的IP-4，IP_SA为VTEP-1的IP-1；增加的外层UDP Header(User Datagram Protocol Header，用户数据报协议首部格式)中的L4DstPort为特定预留数值，而不是VXLAN UDP port(该标识为VXLAN数据包密文特征之一)；
3.如果VXLAN网络中的设备不具备VXLAN加解密功能，加密报文在网络上依然可以根据VXLAN外层IP地址进行路由转发，最终到达VTEP-2；
4.VTEP-2收到报文后，根据报文解析结果识别为VXLAN数据包密文(如图四所示)，在交换机内部首先进行VXLAN数据包密文的解密处理，完成解密后的报文为正常的VXLAN数据包明文。交换机会根据VXLAN报文解析结果中的IP_DA，IP_SA，VNI(虚拟网络设备接口模块)进行VXLAN Tunnel解封装表项查找，并根据查找结果，执行VXLAN报文的解封装处理和内层报文解析。根据内层报文MAC_DA判断执行Bridging转发或者Routing转发，并查找对应的芯片表项。根据查找结果的下一跳信息进行报文出口编辑，最终将该报文转发给HOSTB。
传统的隧道加密方案在数据中心的部署，存在以下问题：
1.由于VXLAN加密报文格式的设计是基于UDP Header的，加密时会将用于表示VXLAN加密的特定标识替换掉原始的L4 Dst Port，因此需要更新UDP Length，导致在加密节点需要对UDP Checksum进行重新计算，带来两个风险：一是用于ECMP(Equal Cost Multi-path，等价多路径路由)负载均衡计算的HASH因子中，如果包含UDP Dst Port，会导致在加密前和加密后的路径不一致；二是在穿越中间网络的转发节点时，如果一旦 Checksum未被正确更新，VXLAN数据包密文的转发就存在被丢弃的风险；
传统的VXLAN，NVGRE(Network Virtualization using Generic Routing Encapsulation，使用通用路由协议封装的网络虚拟化)等多种协议在设计之初对加密的考虑不足，导致数据中心部署端到端加密方案使得报文关键信息被加密，无法用于转发，此外，这些隧道协议报文在加密报文格式的定义上扩展性差，难以携带多种信息，无法配合网络的运维和安全策略，导致在部署加密后，需要全网对加密数据流的下发转发配置，运维挑战大，并且加密后导致部分转发信息丢失，中间节点难以部署精细化的安全策略，难以统一实现整网的安全保障。
发明内容
本申请实施例所要解决的技术问题是解决数据中心的部署端到端加密方案ECMP多路径负载均衡在加密前后的转发路径一致，避免带来数据流的报文乱序问题，以及通过统一的加密协议数据格式满足多种Overlay(覆盖)隧道数据中心应用需求，避免为VXLAN，NVGRE多种隧道协议定制不同的加密方案，从而保证数据中心网络的简洁性。
为了解决上述的技术问题，本申请实施例提供了一种隧道加密方法，包括：于隧道加密报文的预设字段中添加未做修改的原始转发信息，以及芯片转发与配置信息；所述原始转发信息用于中间转发节点ECMP多路径负载分担计算与路径一致性，服务质量控制，安全策略执行，以及不同加密粒度的选择。
上述的隧道加密方法中，所述预设字段的插入位于IP数据包L3Header之后的位置，从而形成特定IP Protocol作为加密后的隧道报文特征；所述原始转发信息包括以下至少一个转发信息：L4 Dst Port，L4 Src Port，IP Protocol，VNI，Security Index(安全索引)，DSCP(Differentiated Services Code Point，差分服务代码点)，SGT ID，Inner HASH(内层哈希)。
为了解决上述的技术问题，本申请还公开了一种隧道转发方法，包括：接收到根据如上述的隧道加密实现方法生成的隧道加密报文；识别所述报 文为隧道加密报文；根据所述隧道加密报文预设字段中的原始转发信息进行转发路径计算并转发。
为了解决上述的技术问题，本申请还公开了一种隧道解密方法，包括：接收到根据如上述的隧道转发方法发送的隧道加密报文；识别所述报文为隧道加密报文，并解密；对解密后的隧道加密报文进行转发。
为了解决上述的技术问题，本申请还公开了一种隧道加密装置，包括：加密节点，于隧道加密报文的预设字段中添加未做修改的原始转发信息；所述原始转发信息用于中间转发节点ECMP多路径负载分担计算与路径一致性，服务质量控制，安全策略执行，以及不同加密粒度的选择。
上述的隧道加密装置中，所述预设字段的插入位于IP数据包L3Header之后的位置，从而形成特定IP Protocol作为加密后的隧道报文特征；所述原始转发信息包括以下至少一个转发信息：L4 Dst Port，L4 Src Port，IP Protocol，VNI，Security Index，DSCP，SGT ID，Inner HASH。
为了解决上述的技术问题，本申请还公开了一种隧道转发装置，包括：转发节点，用于接收到根据如上述的隧道加密实现装置生成的隧道加密报文；识别所述报文为隧道加密报文；以及，根据所述隧道加密报文预设字段中的原始转发信息进行转发路径计算并转发。
为了解决上述的技术问题，本申请还公开了一种隧道解密装置，包括：接收到根据上述的隧道转发装置发送的隧道加密报文；识别所述报文为隧道加密报文，并解密；对解密后的隧道加密报文进行转发。
本申请针对现有技术中的问题，通过在隧道加密数据报文中定义一保留的预设字段，所述预设字段中添加未做修改的原始转发信息，如VXLAN的L4 Dst Port，可使中间转发节点通过读取该预设字段中的原始转发信息，实现正常的报文ECMP多路径负载均衡计算和转发；如VXLAN内层IP DSCP，可使中间转发节点读取该预设字段中的原始转发信息，实现不同的服务质量；如VXLAN SGT安全组，可使中间转发节点读取该预设字段中的原始转发信息，实现基于SGT安全组的安全策略等。本申请通过定义加密协议及其报文格式，经由预设字段携带原始转发信息，实现了通用 的隧道加密方案，从而解决了隧道端到端加密中存在的问题。
附图说明
图1是现有基于VXLAN加密数据包进行路由转发的拓扑示意图；
图2是实施例1的隧道报文结构示意图；
图3是实施例1的隧道报文结构示意图；
图4是实施例2的隧道报文结构示意图。
具体实施方式
本申请实施例基于IP协议对报文封装。
在加密起始节点，基于本申请实施例的交换机将VXLAN报文加密处理后的报文格式如图2和图3所示。IP头部的IP Protocol字段，由于进行如VXLAN数据包的加密操作，会被更新为New IP Protocol，New IP Protocol为公认的特殊标识，这样就能够被统一识别为报文进行了VXLAN数据包密文的标识。如图2所示，加密后的报文在IP头部后插入了一预设字段X-SEC Header，这样，本实施例就形成了有别于现有普通第三层网络层IP协议的特定IP协议，并以此特定IP Protocol作为加密后的隧道报文特征之一。在X-SEC Header中，支持携带上述一个或多个转发信息，如携带了原始报文的IP Protocol。
在X-SEC Header中，包括如下两个标识类型的字段：
(1)Type：8bit，标识X-SEC Header的类型，用于区分携带不同信息；
(2)Next Header：8bit，标识X-SEC Header的内层报文头部的解析；
X-SEC Header支持携带一个或多个转发信息，其包含但不限于下列的转发信息字段：
(1)L4 Dst Port：16bit，标识原始内层或者外层L4 Dst Port；
(2)L4 Src Port：16bit，标识原始内层或者外层L4 Src Port；
(3)IP Protocol：8bit，标识原始IP Protocol；
(4)Security Index：16bit，用于加解密的Key索引，可灵活映射精细业务；
(5)SGT ID：16bit，用于全局加解密Key，可灵活映射精细业务；
(6)DSCP：6bit，标识IP DSCP优先级；
(7)VNI：24bit，标识VXLAN VNI或者GRE VSI；
(8)Inner HASH：16bit，标识基于隧道内层报文特征的HASH计算结果，用于参与ECMP负载均衡转发。
在中间转发节点，首先进行解析处理，根据结果获取到报文的特征，比如：IPSA，IPDA，New IP Protocol，以及X-SEC Header等字段。因此，中间节点在转发表项查找，会根据IPDA查找路由表项，并根据New IP Protocol区分出是加密后的报文(这与现有做法相同)。与现有技术不同的是，在识别出为加密报文后，中间节点可以根据X-SEC Header携带的转发信息原始IP Protocol，参与ECMP HASH计算，使得中间节点ECMP转发在加密前和加密后所提取的HASH因子保持不变，满足ECMP HASH选路一致性。
在解密节点，交换机接收到加密后的报文后，同样首先进行解析处理，从而根据结果获取到报文的特征，比如：IPSA，IPDA，New IP Protocol，以及X-SEC Header等字段。然后根据New IP Protocol区分出是加密后的，因此，首先查找到用于匹配解密的ACL的表项来进行该数据报文的解密处理，并根据解密后的VXLAN报文的IPDA查找路由表项，最终对解密后的报文进行ECMP转发。
本实施例将预设字段X-SEC Header插入位于IP数据包L3Header之后的位置，通过实施一套加密方案满足数据中心多种Overlay隧道协议组网。所述原始转发信息用于中间转发节点ECMP多路径负载分担计算与路径一致性，服务质量控制，安全策略执行，不同加密粒度的选择等。所述预设字段X-SEC中添加未做修改的原始转发信息，如携带VXLAN的L4Dst Port，可使中间转发节点通过读取该预设字段中的原始转发信息，实现正常的报文ECMP多路径负载均衡计算和转发；再如，携带VXLAN内 层IP DSCP，可使中间转发节点读取该预设字段中的原始转发信息，实现不同的服务质量；还有，携带如VXLAN SGT安全组，可使中间转发节点读取该预设字段中的原始转发信息，实现基于SGT安全组的安全策略等。
本申请实施例通过GRE隧道进行数据的加解密和转发。
在加密起始节点，基于本申请实施例的交换机将VXLAN报文加密处理后的报文格式如图4所示。IP头部的IP Protocol字段，由于进行如GRE/NVGRE数据包的加密操作，会被更新为New IP Protocol，New IP Protocol为特殊标识，被统一识别为报文进行了GRE/NVGRE数据包密文的标识。
为了避免中间节点ECMP转发时，无法提取到加密后的报文中的原始GRE内层IP五元组信息参与ECMP HASH计算，在解密起始节点会从加密前的原始GRE内层报文中的IP五元组等字段，在加密起始加点提前完成ECMP HASH计算，并将ECMP HASH计算结果抽取到X-SEC Header的Inner HASH字段。如图4所示，加密后的报文在IP头部后面插入了X-SEC Header，在X-SEC Header中，支持携带上述一个或多个转发信息，如携带了原始报文的Inner HASH。
在中间转发节点，首先进行解析处理，根据结果获取到报文的特征，比如：IPSA，IPDA，New IP Protocol，以及X-SEC Header等字段。因此，中间节点在转发表项查找，会根据IPDA查找路由表项，并根据New IP Protocol区分出是加密后的报文。在识别出为加密报文后，可以根据X-SEC Header携带的转发信息Inner HASH参与ECMP HASH计算，使得中间节点ECMP转发在加密前和加密后所提取的HASH因子保持不变，满足ECMP HASH选路一致性。
在解密节点，交换机接收到加密后的报文后，同样首先进行解析处理，从而根据结果获取到报文的特征，比如：IPSA，IPDA，New IP Protocol，以及X-SEC Header等字段。然后根据New IP Protocol区分出是加密后的，因此，首先查找到用于匹配解密的ACL的表项来进行该数据报文的解密处理，并根据解密后的GRE报文的IPDA查找路由表项，最终对解密后 的报文进行ECMP转发。
综合上述的实施例一至实施例二，通过本申请的隧道加密协议能够支持多种隧道，包含但不限于如：VXLAN，GRE/NVGRE，IPv4/IPv6Tunnel，SRv6，GENEVE，实现了基于IP Header加密方案，在部署时支持穿越中间IP三层网络，简化了中间节点能力要求，具备实现端到端安全加密的部署能力。同时，发明设计通过设计X-SEC Header携带一种或者多种转发信息，增强了加密协议的扩展性，解决了ECMP多路径负载分担转发路径一致性，服务质量，安全策略与运维管理，精细化加密粒度等问题。
本实施例公开了一种隧道加密，转发以及解密装置，包括：
加密节点，于隧道加密报文的预设字段中添加未做修改的原始转发信息，以及芯片转发与配置信息；所述原始转发信息用于中间转发节点ECMP多路径负载分担计算与路径一致性，服务质量控制，安全策略执行，以及不同加密粒度的选择。
在可选实施中，所述预设字段的插入位于IP数据包L3Header之后的位置。所述原始转发信息包括以下至少一个转发信息：L4 Dst Port，L4 Src Port，VNI，Security Index，DSCP，SGT ID，Inner HASH。
在可选实施中，所述隧道包括VXLAN，GRE/NVGRE，IPv4/IPv6Tunnel，SRv6，GENEVE。
本实施例的隧道转发装置，包括：转发节点，用于接收到上述的隧道加密实现装置生成的隧道加密报文；识别所述报文为隧道加密报文；以及，根据所述隧道加密报文预设字段中的原始转发信息进行转发路径计算并转发。
本实施例的隧道解密装置，包括：接收到根据如上述的隧道转发装置发送的隧道加密报文；识别所述报文为隧道加密报文，并解密；对解密后的隧道加密报文进行转发。
本领域技术人员可以理解的是，本实施例四的一种隧道加密，转发以及解密装置与实施例一至三的隧道加密，转发以及解密方法为基于同一发明构思，因此关于相关本实施例的内容可以参照前文相应内容处，此处不 再赘述。
本领域普通技术人员可以理解上述实施例的各种方法中的全部或部分步骤是可以通过程序来指令相关的硬件来完成，该程序可以存储于一计算机可读存储介质中，存储介质可以包括：ROM(Read-Only Memory，只读存储器)、RAM(Random Access Memory，随机存取存储器)、磁盘或光盘等。
虽然本申请披露如上，但本申请并非限定于此。任何本领域技术人员，在不脱离本申请的精神和范围内，均可作各种更动与修改，因此本申请的保护范围应当以权利要求所限定的范围为准。

Claims (8)

  1. 一种隧道加密方法，包括：
    于隧道加密报文的预设字段中添加未做修改的原始转发信息；所述原始转发信息用于中间转发节点ECMP多路径负载分担计算与路径一致性，服务质量控制，安全策略执行，以及不同加密粒度的选择。
  2. 如权利要求1所述的隧道加密方法，其中，
    所述预设字段的插入位于IP数据包L3 Header之后的位置，从而形成特定IP Protocol作为加密后的隧道报文特征；
    所述原始转发信息包括以下至少一个转发信息：L4 Dst Port，L4 Src Port，IP Protocol，VNI，Security Index，DSCP，SGT ID，Inner HASH。
  3. 一种隧道转发方法，包括：
    接收到根据如权利要求1或2所述的隧道加密实现方法生成的隧道加密报文；
    识别所述报文为隧道加密报文；
    根据所述隧道加密报文预设字段中的原始转发信息进行转发路径计算并转发。
  4. 一种隧道解密方法，包括：
    接收到根据如权利要求3所述的隧道转发方法发送的隧道加密报文；
    识别所述报文为隧道加密报文，并解密；
    对解密后的隧道加密报文进行转发。
  5. 一种隧道加密装置，包括：
    加密节点，于隧道加密报文的预设字段中添加未做修改的原始转发信息，以及芯片转发与配置信息；所述原始转发信息用于中间转发节点ECMP多路径负载分担计算与路径一致性，服务质量控制，安全策略执行，以及不同加密粒度的选择。
  6. 如权利要求5所述的隧道加密装置，其中，
    所述预设字段的插入位于IP数据包L3 Header之后的位置，从而形成 特定IP Protocol作为加密后的隧道报文特征；
    所述原始转发信息包括以下至少一个转发信息：L4 Dst Port，L4 Src Port，IP Protocol，VNI，Security Index，DSCP，SGT ID，Inner HASH。
  7. 一种隧道转发装置，包括：
    转发节点，用于接收到根据如权利要求5或6所述的隧道加密实现装置生成的隧道加密报文；
    识别所述报文为隧道加密报文；以及，
    根据所述隧道加密报文预设字段中的原始转发信息进行转发路径计算并转发。
  8. 一种隧道解密装置，包括：
    接收到根据如权利要求7所述的隧道转发装置发送的隧道加密报文；
    识别所述报文为隧道加密报文，并解密；
    对解密后的隧道加密报文进行转发。
PCT/CN2022/144248 2021-12-31 2022-12-30 隧道加密，转发和解密方法以及装置 WO2023125993A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202111673386.9 2021-12-31
CN202111673386.9A CN116418537A (zh) 2021-12-31 2021-12-31 隧道加密，转发和解密方法以及装置

Publications (1)

Publication Number Publication Date
WO2023125993A1 true WO2023125993A1 (zh) 2023-07-06

Family

ID=86998233

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2022/144248 WO2023125993A1 (zh) 2021-12-31 2022-12-30 隧道加密，转发和解密方法以及装置

Country Status (2)

Country Link
CN (1) CN116418537A (zh)
WO (1) WO2023125993A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106161225A (zh) * 2015-03-23 2016-11-23 华为技术有限公司 用于处理vxlan报文的方法、装置及系统
WO2017143611A1 (zh) * 2016-02-27 2017-08-31 华为技术有限公司 用于处理vxlan报文的方法、设备及系统
CN107181662A (zh) * 2017-05-18 2017-09-19 迈普通信技术股份有限公司 一种vxlan隧道负载均衡的方法及系统
CN109525477A (zh) * 2018-09-30 2019-03-26 华为技术有限公司 数据中心中虚拟机之间的通信方法、装置和系统
CN113055268A (zh) * 2019-12-26 2021-06-29 中国移动通信集团有限公司 隧道流量负载均衡的方法、装置、设备及介质
US20210288935A1 (en) * 2020-03-11 2021-09-16 Dell Products L.P. Security for virtual extensible local area networks

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN106161225A (zh) * 2015-03-23 2016-11-23 华为技术有限公司 用于处理vxlan报文的方法、装置及系统
WO2017143611A1 (zh) * 2016-02-27 2017-08-31 华为技术有限公司 用于处理vxlan报文的方法、设备及系统
CN107181662A (zh) * 2017-05-18 2017-09-19 迈普通信技术股份有限公司 一种vxlan隧道负载均衡的方法及系统
CN109525477A (zh) * 2018-09-30 2019-03-26 华为技术有限公司 数据中心中虚拟机之间的通信方法、装置和系统
CN113055268A (zh) * 2019-12-26 2021-06-29 中国移动通信集团有限公司 隧道流量负载均衡的方法、装置、设备及介质
US20210288935A1 (en) * 2020-03-11 2021-09-16 Dell Products L.P. Security for virtual extensible local area networks

Also Published As

Publication number Publication date
CN116418537A (zh) 2023-07-11

Similar Documents

Publication Publication Date Title
RU2735725C1 (ru) Способ и устройство обработки и отправки пакетов, узел pe и узел
USRE49485E1 (en) Overlay management protocol for secure routing based on an overlay network
CN109218178B (zh) 一种报文处理方法及网络设备
WO2019105462A1 (zh) 报文的发送、处理方法及装置，pe节点，节点
US9967372B2 (en) Multi-hop WAN MACsec over IP
US7688829B2 (en) System and methods for network segmentation
US8830834B2 (en) Overlay-based packet steering
US7568047B1 (en) Method and apparatus for adaptive service label management
US8966240B2 (en) Enabling packet handling information in the clear for MACSEC protected frames
US20140153577A1 (en) Session-based forwarding
US20130061034A1 (en) Transparent Mode Encapsulation
CN103188351B (zh) IPv6环境下IPSec VPN通信业务处理方法与系统
US20090175194A1 (en) Ip security within multi-topology routing
US11418434B2 (en) Securing MPLS network traffic
WO2021009554A1 (en) Method and system for secured information exchange between intermediate and endpoint nodes in a communications network
US20210258251A1 (en) Method for Multi-Segment Flow Specifications
WO2013139270A1 (zh) 实现三层虚拟专用网络的方法、设备及系统
JP5426024B2 (ja) 内側のｍｐｌｓラベルと外側のｍｐｌｓラベルとの連結
US20180302378A1 (en) Context specific keys
US11297037B2 (en) Method and network device for overlay tunnel termination and mirroring spanning datacenters
US11818035B2 (en) Augmented routing of data
WO2023125993A1 (zh) 隧道加密，转发和解密方法以及装置
EP4387190A1 (en) Packet sending method, network device, storage medium, and program product
CN113709091B (zh) 用于基于策略的分组处理的方法、设备和系统
Herbert et al. INTERNET-DRAFT K. Bogineni Intended Status: Informational Verizon Expires: September 2018 A. Akhavain Huawei Technologies Canada

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 22915240

Country of ref document: EP

Kind code of ref document: A1