Method for IPSec (Internet protocol security) tunnel to rapidly process messages

Abstract

The invention discloses a method for an IPSec tunnel to rapidly process messages. A ciphertext conversation is looked up according to an encrypted message; if the ciphertext conversation is not found, an ciphertext conversation is established; if the ciphertext conversation is found, a secret key is looked up in an IPSec safety association data bank; if the secret key is found, direct decryption is performed, otherwise, the secret key is looked up in a global IPSec safety association data bank; if the secret key is found in the global IPSec safety association data bank, the secret key is added to the IPSec safety association data bank, and the encrypted message is decrypted according to the secret key; a corresponding plaintext conversation is looked up according to a new decrypted IP head; and if the plaintext conversation is found, the plaintext conversation and the ciphertext conversation are associated, otherwise, a new plaintext conversation is established, and the newly established plaintext conversation and the ciphertext are associated. According to an IP quintuple of the decrypted message, the look-up is performed in the plaintext conversation associated with the ciphertext conversation, so that the look-up range is narrowed, the searching time is shortened, the decryption time is further shortened, and the efficiency for processing the messages is accelerated.

Description

technical field [0001] The invention relates to the technical field of network communication, in particular to a method for quickly processing messages in an IPSec tunnel. Background technique [0002] IPSec (Internet Protocol Security, a security standard framework defined by Internet Engineering Task Force (IETF)) protocol is a VPN technology used to realize remote access, and to provide end-to-end encryption and authentication services for public and private networks. The IPsec protocol is not a separate protocol. It provides a complete set of architecture for network data security on the IP layer, including the network authentication protocol AH (Authentication Header, authentication header), ESP (Encapsulating Security Payload, encapsulating security payload), IKE (Internet Key Exchange, Internet Key Exchange) and some algorithms for network authentication and encryption, etc. Among them, the AH protocol and the ESP protocol are used to provide security services. The ...

AI Technical Summary

Problems solved by technology

[0006] The network device processes the packets in a flow-by-flow manner, according to the IP quintuple of the packet, and if it is not a UDP packet or a non-TCP packet, it classifies the flow according to the IP address of the packet, and usually encrypts the IPSec tunnel The subsequent messages usually use a session (session) method, that is to say, only the plaintext message is processed in the session mode, but the encrypted message cannot be processed in the session mode, especially when the forwarding CPU and the encryption and decryption CPU are used together. When in use, on

Images