Implementation method of high-performance SSLVPN gateway based on VPP and OpenVPN

Abstract

The invention discloses an implementation method of a high-performance SSLVPN (Secure Socket Layer Virtual Private Network) gateway based on a VPP (Virtual Private Protocol) and an OpenVPN (Open Virtual Private Network), which is characterized in that an SSLVPN protocol message is directly sent to a kernel for processing, the OpenVPN is implemented through an open source to complete authentication, establishment and maintenance of an SSLVPN tunnel, the related implementation complexity can be reduced, the development and maintenance complexity is reduced, and the message processing performance of the SSLVPN is not influenced; as for SSLVPN data messages, due to the fact that the flow is large, but implementation logic is relatively simple, SSLVPN data message processing (encryption and decryption) is achieved in the VPP, by means of the high-performance message processing capacity of the VPP, the message processing performance of an SSLVPN gateway can be far higher than that achieved in a kernel storage mode and is basically equivalent to that achieved in a pure user mode, and by means of the multiple cores and the acceleration card, the SSLVPN data messages can be encrypted and decrypted. And the message processing capability of the SSLVPN gateway can be further improved. The method is realized based on the VPP and the OpenVPN, the development and maintenance difficulty can be reduced by utilizing the existing open source, and the high-performance message processing capability can be obtained by utilizing the VPP and the acceleration card.

Description

Technical Field

[0001] This invention relates to the field of communication technology, and in particular to a method for implementing a high-performance SSL VPN gateway based on VPP and OpenVPN. Background Technology

[0002] VPP (Vector Packet Processing) is an open-source version of Cisco's vector packet processing technology. It provides a high-performance packet processing stack that can run on commercial CPUs and deliver production-quality switch / router functionality. Due to VPP's rich features, production-grade quality, and excellent framework design, an increasing number of network products based on VPP are being used in live network environments (physical and virtual networks).

[0003] SSLVPN refers to a VPN technology that uses the SSL protocol to achieve remote access. It includes: server authentication, client authentication, data integrity on the SSL link, and data confidentiality on the SSL link.

[0004] OpenVPN is an open-source SSL VPN implementation based on the OpenSSL library. It makes extensive use of the SSLv3 / TLSv1 protocol function library in the OpenSSL cryptographic library and allows single points of interest in establishing the VPN to authenticate using shared keys, digital certificates, or usernames / passwords.

[0005] SSL VPN is the simplest and most secure solution for remote users accessing sensitive company data. Compared to other complex VPNs, SSL achieves remote communication through a relatively simple method. Currently, most SSL VPN implementations fall into two categories: 1. Pure user-space implementation based on user-space network interface card (NIC) drivers (e.g., DPDK). In this implementation, the reception, processing, and transmission of SSL VPN packets are all handled in user space; the kernel and kernel protocol stack do not participate in packet reception, processing, or transmission. 2. Pure kernel-space implementation based on open-source implementations (OpenVPN). Although SSL VPN packets are processed in user-space programs, their transmission and reception are handled by the kernel-space NIC driver, and the packets require processing by the kernel protocol stack. The first approach offers excellent processing performance, but its development and maintenance costs are relatively high. It requires reimplementing (or porting) related functions in user space, or trimming functions, reimplementing (or porting) only some features. Furthermore, the extensive reimplementation (or porting) of numerous functions requires extensive testing, repair, and optimization to achieve product-grade quality for use in actual production environments. Option 2 is relatively simple to implement, using the kernel and existing open-source implementations (or libraries). It has lower development and maintenance costs, and because it uses existing implementations, fewer new implementations are needed. Therefore, it can enable the SSLVPN gateway to reach product-level quality in a short time and be applied in actual production environments. However, since the sending and receiving of SSLVPN packets are in kernel space, and SSLVPN packets need to pass through the kernel protocol stack before being sent to the user-space SSLVPN program for processing, the inefficient packet sending and receiving of the kernel, the performance bottleneck of the kernel protocol stack, and the overhead of packet copying between the kernel and user space result in very low SSLVPN implementation performance of this option, which cannot meet the actual requirements under high traffic demand. Summary of the Invention

[0006] The purpose of this invention is to enable a high-performance SSLVPN gateway to reduce development and maintenance difficulties by leveraging existing open-source implementations, while also achieving high-performance packet processing capabilities through VPP and accelerator cards, by utilizing VPP and open-source OpenVPN.

[0007] An implementation method for a high-performance SSL VPN gateway based on VPP and OpenVPN, comprising the following specific steps: Step 1: Perform initialization Step 2: Based on the interface type of the received message, perform the following processing flow for the messages received by each type of interface. (2.1) Messages received by the physical interface: (2.1.1) Parse the message and obtain its type; (2.1.2) If the message is an SSLVPN protocol message, then obtain its receiving interface and send the message to the kernel through the tap interface corresponding to the receiving interface. OpenVPN will then process the message to complete the authentication, establishment, and maintenance of the SSLVPN tunnel. (2.1.3) If the message is an SSLVPN data packet, the tunnel information of the message is obtained by querying the global tunnel table. If tunnel information exists, the message is parsed, decrypted, and decapsulated to restore the original message, and then sent to the VPP protocol stack through the tun interface. Finally, the message is forwarded or dropped according to the routing table. If tunnel information does not exist, the packet will be forwarded or dropped directly according to the routing table;

[0008] (2.1.4) If it is another type of message, the message is forwarded / dropped directly according to the routing table.

[0009] (2.2) Messages received by the tap interface: (2.2.1) The tap interface receives messages; (2.2.2) Obtain the corresponding physical interface based on the tap receiving interface of the message; (2.2.3) Send the message from the corresponding physical interface.

[0010] (2.3) Messages received by the tun interface: (2.3.1) The tun interface receives messages. (2.3.2) The global tunnel table is searched using the information in the message to obtain the tunnel information to which the message belongs. (2.3.3) If tunnel information exists, the packets received by the tun interface are encrypted and encapsulated to obtain SSLVPN data packets; the generated SSLVPN data packets will be forwarded or discarded according to the routing table. (2.3.4) If the tunnel information does not exist, the message is discarded.

[0011] Furthermore, the method also includes initialization, the initialization process of which includes: initializing the physical interface, starting the OpenVPN service, and initializing and starting the detection thread. Furthermore, the specific steps for initializing the physical interface also include: creating a corresponding tap interface for the physical interface, with a one-to-one correspondence between the tap interface and the physical interface. Furthermore, the specific steps for starting the OpenVPN service also include: the OpenVPN service sending and receiving SSLVPN protocol messages through the tap interface, and completing the authentication, establishment, and maintenance of the SSLVPN tunnel. Furthermore, the specific steps for detecting threads include: First, check if the tunnel information of the OpenVPN service has changed. If it has changed, the SSLVPN tunnel information in VPP needs to be updated to ensure that the SSLVPN tunnel information in VPP is always the same as the tunnel information in OpenVPN. Then, the tun interface of the OpenVPN service is detected, and the tun interface in VPP is updated when the tun interface changes.

[0012] A computer-readable storage medium storing one or more programs, said one or more programs including instructions that, when executed by a computing device, cause the computing device to perform the method as described above.

[0013] An electronic device includes one or more processors, one or more memories, and one or more programs, wherein the one or more programs are stored in the one or more memories and configured to be executed by the one or more processors, and the one or more programs include instructions for performing the methods described above. Beneficial effects

[0014] This invention discloses a high-performance SSL VPN security gateway based on VPP and OpenVPN. It directly sends SSL VPN protocol packets into the kernel for processing, and uses the open-source implementation of OpenVPN to complete the authentication, establishment, and maintenance of the SSL VPN tunnel. This reduces the complexity of the implementation, lowers development and maintenance complexity, and does not affect the packet processing performance of SSL VPN. For SSL VPN data packets, due to the large traffic volume but relatively simple implementation logic, SSL VPN data packet processing (encryption and decryption) is implemented in VPP. Leveraging VPP's high-performance packet processing capabilities, the packet processing performance of the SSL VPN gateway is significantly higher than that of a kernel-based implementation, essentially equivalent to a pure user-space implementation. Furthermore, the packet processing capabilities of the SSL VPN gateway can be further improved through multi-core processors and accelerator cards. This invention, based on VPP and OpenVPN, utilizes existing open-source implementations to reduce development and maintenance difficulties, and leverages VPP and accelerator cards to achieve high-performance packet processing capabilities. Attached Figure Description

[0015] Figure 1 This is the initialization process.

[0016] Figure 2 It detects the thread execution flow.

[0017] Figure 3 This refers to the physical interface message receiving and processing procedure.

[0018] Figure 4 This is the message receiving and processing flow of the tap interface.

[0019] Figure 5 This is the message receiving and processing flow of the TUN interface. Detailed Implementation

[0020] This invention introduces a high-performance SSL VPN security gateway based on VPP and OpenVPN. For SSL VPN protocol packets, the authentication, establishment, and maintenance of the SSL VPN tunnel are directly fed into the kernel through the open-source implementation of OpenVPN, reducing the complexity of the implementation and lowering the difficulty of development and maintenance. The processing (encryption and decryption) of SSL VPN data packets is implemented in VPP. Leveraging VPP's high-performance packet processing capabilities, the packet processing performance of the SSL VPN gateway is significantly higher than that of a kernel-based implementation, essentially equivalent to a pure user-space implementation. Furthermore, the packet processing capabilities of the SSL VPN gateway can be further enhanced through multi-core processors and accelerator cards.

[0021] The specific process of this invention consists of two parts: 1) initialization and 2) message processing.

[0022] Initialization process First, initialize the physical interface and create a corresponding tap interface for the physical interface. There is a one-to-one correspondence between the tap interface and the physical interface. The tap interface is mainly used to send the packets that need to be processed by the kernel (SSLVPN protocol packets) into the kernel for processing, and to send the packets that the kernel needs to send (SSLVPN protocol packets) through the corresponding physical interface. The OpenVPN service is started. It sends and receives SSLVPN protocol messages through the tap interface and completes the authentication, establishment, and maintenance of the SSLVPN tunnel. Finally, the detection thread is initialized and started. The specific process is as follows: Figure 1 As shown.

[0023] The detection thread is mainly used to periodically detect OpenVPN tunnel information and tun interface, and to update the SSLVPN tunnel information and tun interface in VPP in a timely manner when the OpenVPN tunnel information and tun interface change.

[0024] First, check if the tunnel information of the OpenVPN service has changed. If it has changed, the SSLVPN tunnel information in VPP needs to be updated to ensure that the SSLVPN tunnel information in VPP is always the same as the tunnel information in OpenVPN. Then, the OpenVPN service's tun interface is checked, and the tun interface in VPP is updated promptly when it changes. The tun interface is mainly used for packet encapsulation and encryption. Finally, the thread sleeps (waits) for a few seconds before re-executing the detection process. The specific process is as follows: Figure 2 As shown.

[0025] Message processing flow: The processing flow is specifically divided into three cases: messages received by the physical interface, messages received by the tap interface, and messages received by the tun interface.

[0026] Scenario 1 (Messages received by the physical interface) First, the message is received from the physical network card; then the message is parsed to determine its type. If the message is an SSLVPN protocol message, the receiving interface is obtained, and the message is sent to the kernel through the corresponding tap interface. OpenVPN receives and processes the SSLVPN protocol message from the kernel, completing the authentication, establishment, and maintenance of the SSLVPN tunnel. This indicates processing is complete. The processing of protocol messages differs from other types of messages (including data packets); they are generated, processed, and terminated by the SSLVPN gateway.

[0027] If it is another type of message (other than SSLVPN protocol messages and SSLVPN data messages), the message will be looked up in the routing table and forwarded / dropped according to the routing rules; If it is an SSLVPN data packet, obtain the packet information, query the global tunnel table using the packet information to obtain the tunnel information to which the packet belongs. If the tunnel information exists, proceed to the next processing step; otherwise, end the current packet processing step. The subsequent processing of the packet is the same as the processing of other types of packets in the previous step. Again, based on the obtained tunnel information, parse, decrypt, and decapsulate the packet to restore the original packet encapsulated in the tunnel header. If packet parsing fails, discard the packet directly; otherwise, proceed to the next processing step. Finally, send the restored original packet from the previous step to the VPP protocol stack via the tun interface. In the VPP protocol, the packet will look up the routing table and forward / drop according to the routing rules. The specific process is as follows: Figure 3 As shown.

[0028] Scenario 2 (messages received via the tap interface): First, the message is received from the tap interface; then, the corresponding physical interface is obtained based on the message's receiving interface (tap interface); finally, the message is sent out from the corresponding physical interface. The specific process is as follows: Figure 4 As shown.

[0029] Scenario 3 (Messages received from the tun interface): First, the message is received from the tun interface. Then, the message is parsed to obtain its information. The global tunnel table is then queried using this information to retrieve the tunnel information to which the message belongs. If the tunnel information exists, the next processing step is executed; otherwise, the current message processing flow ends, and the message is discarded. Next, based on the obtained SSLVPN tunnel information, the message is encrypted and encapsulated to obtain an SSLVPN data packet. Finally, the SSLVPN data packet generated in the previous step is sent to the VPP routing module for processing. The VPP routing module selects the correct outgoing interface for the SSLVPN data packet and sends it out from the corresponding interface. The specific process is as follows: Figure 5 As shown.

[0030] Based on the same technical solution, the present invention also discloses a computer-readable storage medium storing one or more programs, the one or more programs including instructions, which, when executed by a computing device, cause the computing device to perform the above-described implementation method of a high-performance SSL VPN gateway based on VPP and OpenVPN.

[0031] Based on the same technical solution, the present invention also discloses a computing device, including one or more processors, one or more memories, and one or more programs, wherein the one or more programs are stored in the one or more memories and configured to be executed by the one or more processors, and the one or more programs include instructions for executing the above-described implementation method of a high-performance SSLVPN gateway based on VPP and OpenVPN.

[0032] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0033] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0034] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0035] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

Claims

1. A method for implementing a high-performance SSLVPN gateway based on VPP and OpenVPN, characterized in that , the method comprises the following specific steps: Step 1, initialization; Step 2: According to the type of interface receiving the message, the following processing flow is performed for the message received by each type of interface: Packets received by the physical interface (2.1.1) Parse the message and get its type: (2.1.2) If the message is an SSLVPN protocol message, obtain its receiving interface and send the message to the kernel through the tap interface corresponding to the receiving interface. The message will be processed by OpenVPN to complete the authentication, establishment and maintenance of the SSLVPN tunnel. (2.1.3) If the message is an SSLVPN data message, the tunnel information of the message is obtained by querying the global tunnel table: If the tunnel information exists, the message is parsed, decrypted, and unsealed, and the original message obtained by unsealing is sent to the VPP protocol stack through the tun interface. Finally, the original message is forwarded or discarded according to the routing table; If the tunnel information does not exist, the message is directly forwarded or discarded according to the routing table; (2.1.4) If it is another type of message, the message is directly forwarded or discarded according to the routing table; (2.2) Messages received by the tap interface (2.2.1) The tap interface receives the message; (2.2.2) According to the tap receiving interface of the message, obtain the corresponding physical interface; (2.2.3) Send the message from the corresponding physical interface; (2.3) Messages received by the tun interface (2.3.1) Tun interface receives messages (2.3.2) Search the global tunnel table based on the message information and obtain the tunnel information to which the message belongs: (2.3.3) If the tunnel information exists, encrypt and encapsulate the message received by the tun interface to obtain the SSLVPN data message, which will be forwarded or discarded according to the routing table; (2.3.4) If the tunnel information does not exist, the message is discarded.

2. The method according to claim 1, characterized in that The initialization process includes: Initialize the physical interface; Start the OpenVPN service; Initialize and start the detection thread.

3. The method according to claim 2, characterized in that The specific steps of initializing the physical interface also include: Create a corresponding tap interface for the physical interface. The tap interface and the physical interface have a one-to-one correspondence.

4. The method according to claim 2, characterized in that: The specific steps to start the OpenVPN service also include: The OpenVPN service sends and receives SSLVPN protocol messages through the tap interface and completes the authentication, establishment, and maintenance of the SSLVPN tunnel.

5. The method according to claim 2, characterized in that: The specific steps of thread detection include: First, check whether the tunnel information of the OpenVPN service has changed. If so, update the SSLVPN tunnel information in VPP to ensure that the SSLVPN tunnel information in VPP is always the same as the tunnel information in OpenVPN. Then detect the tun interface of the OpenVPN service and update the tun interface in VPP when the tun interface changes.

6. A computer-readable storage medium storing one or more programs, wherein the one or more programs include instructions, characterized in that: When the instructions are executed by a computing device, the computing device is caused to perform the method according to any one of claims 1 to 5.

7. An electronic device, characterized in that: The method comprises one or more processors, one or more memories and one or more programs, wherein the one or more programs are stored in the one or more memories and are configured to be executed by the one or more processors, and the one or more programs include instructions for executing the method as claimed in any one of claims 1 to 5.

Images