Red and black isolated IPSEC message processing method

Abstract

The invention discloses a red and black isolated IPSEC message processing method, which relates to the technical field of network communication, and comprises the following steps: constructing a red area and a black area, and arranging an isolation unit between the red area and the black area; based on a netfilter mechanism of a LINUX kernel, registering a plurality of hook points in a message processing flow to realize message passing; and sending and receiving the message through the constructed message processing flow. The technical problem that logic isolation between the red area and the black area is not thorough in the prior art is solved, and the technical effect of improving the safety and reliability of data transmission between the red area and the black area is achieved by ensuring strict logic isolation between the red area and the black area.

Description

Technical Field

[0001] This application relates to the field of network communication technologies, and particularly to a method for processing packets of red-black isolated IPSEC. Background Art

[0002] In modern network communication, data security and regional isolation are the keys to ensuring the stable operation of the system. However, when the prior art realizes the isolation between the red zone (intranet for processing sensitive data) and the black zone (public network or non-trusted area), it usually relies on simple hardware isolation or a single encryption scheme. This method has problems such as incomplete logical isolation, high risk of data leakage, and performance bottlenecks. For example, during the data transmission process, encryption and decryption operations often consume a large amount of resources, and the processing flow of different types of packets lacks optimization, resulting in low efficiency. In addition, in the face of complex network attacks and illegal access, the existing solutions are difficult to achieve refined data flow filtering and control, and cannot meet the requirements of high-security communication. Therefore, there is an urgent need for a solution that can achieve efficient logical isolation between the red zone and the black zone, and accurately classify and process packets to improve data transmission efficiency and security.

[0003] In the related technologies at the present stage, there is a technical problem of incomplete logical isolation between the red zone and the black zone. Summary of the Invention

[0004] This application solves the technical problem of incomplete logical isolation between the red zone and the black zone in the prior art by providing a method for processing packets of red-black isolated IPSEC.

[0005] This application provides a method for processing packets of red-black isolated IPSEC, including:

[0006] Construct a red zone and a black zone, and construct an isolation unit between the red zone and the black zone; adopt the netfilter mechanism of the LINUX kernel to register multiple hook points in the packet processing flow within the red zone, black zone, and isolation unit to perform passing processing on packets, where the multiple hook points include PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT, POST_ROUTING; based on the constructed packet processing flow, process the packets, where the packet processing flow includes a sending direction and a receiving direction.

[0007] A method for processing packets of red-black isolated IPsec proposed in this application first constructs a red zone and a black zone, and sets an isolation unit between them; based on the netfilter mechanism of the LINUX kernel, multiple hook points are registered in the packet processing flow to enable packet passing; the packets are sent and received through the constructed packet processing flow, achieving the technical effect of improving the security and reliability of data transmission between the red zone and the black zone by ensuring strict logical isolation between the red zone and the black zone. Description of the Drawings

[0008] To more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings of the embodiments of the present disclosure will be briefly introduced below. Flowcharts are used in this application to illustrate the operations performed by the systems according to the embodiments of the present application. It should be understood that the operations before or below do not necessarily need to be executed precisely in sequence. On the contrary, as needed, they can be executed in reverse order or simultaneously. At the same time, other operations can also be added to these processes, or one or several operations can be removed from these processes.

[0009] Figure 1 It is a schematic flowchart of a method for processing packets of red-black isolated IPsec provided by an embodiment of the present application;

[0010] Figure 2 It is a schematic flowchart of the processing flow of encrypted packets in the red zone of a method for processing packets of red-black isolated IPsec provided by an embodiment of the present application;

[0011] Figure 3 It is a schematic flowchart of the forwarding process of the outbound direction of the packets sent to the external network after passing through the isolation unit by the black zone CPU in a method for processing packets of red-black isolated IPsec provided by an embodiment of the present application;

[0012] Figure 4 It is a schematic flowchart of the processing flow of the inbound direction of the packets that need to be decrypted received from the external network by the black zone CPU in a method for processing packets of red-black isolated IPsec provided by an embodiment of the present application;

[0013] Figure 5 It is a schematic flowchart of the processing flow of the inbound direction of the decrypted packets received from the isolation unit by the red zone CPU in a method for processing packets of red-black isolated IPsec provided by an embodiment of the present application;

[0014] Figure 6 It is a schematic flowchart of the encapsulation processing flow of the tunnel encryption authentication mode OB direction in a method for processing packets of red-black isolated IPsec provided by an embodiment of the present application;

[0015] Figure 7Schematic diagram of the encapsulation processing flow in the OB direction of the transmission encryption and authentication mode of a red-black isolated IPSEC message processing method provided by an embodiment of the present application;

[0016] Figure 8 Schematic diagram of the encapsulation processing flow in the OB direction of the authentication-only mode of a red-black isolated IPSEC message processing method provided by an embodiment of the present application;

[0017] Figure 9 Schematic diagram of the encapsulation processing flow in the OB direction of the encryption-only mode of a red-black isolated IPSEC message processing method provided by an embodiment of the present application; Detailed implementation manners

[0018] The above description is only an overview of the technical solution of the present application. In order to be able to understand the technical means of the present application more clearly, it can be implemented according to the content of the specification. And in order to make the above and other purposes, features and advantages of the present application more obvious and understandable, the following specifically gives the detailed implementation manners of the present application.

[0019] In order to make the purpose, technical solution and advantages of the present application clearer, the present application will be further described in detail below with reference to the accompanying drawings. The described embodiments should not be regarded as limitations on the present application. All other embodiments obtained by those of ordinary skill in the art without creative efforts fall within the scope of protection of the present application.

[0020] In the following description, reference is made to "some embodiments", which describe a subset of all possible embodiments. However, it can be understood that "some embodiments" can be the same subset or different subsets of all possible embodiments, and can be combined with each other without conflict. The terms "first" and "second" involved are only used to distinguish similar objects and do not represent a specific order for the objects. The terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product or server including a series of steps or units does not necessarily have to be limited to those steps or units clearly listed, but may include other steps or modules not clearly listed or inherent to these processes, methods, products or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by those skilled in the technical field to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application.

[0021] An embodiment of the present application provides a red-black isolated IPSEC message processing method, as Figure 1 shown, the method includes:

[0022] Step S100, construct a red zone and a black zone, and construct an isolation unit between the red zone and the black zone. Specifically, first divide the network environment by defining the red zone and the black zone. The red zone represents the trusted area for processing internal data, while the black zone is the untrusted external area for processing external network traffic. To ensure secure communication between the two, an isolation unit is designed and located between the red zone and the black zone. The isolation unit serves as an intermediary module between the red zone and the black zone and undertakes multiple core functions: encrypting and decrypting the data for cross-zone communication to ensure that the data is not tampered with during transmission; strictly filtering and inspecting the passing packets to prevent the risk data in the black zone from entering the red zone; stripping information according to the packet type to protect sensitive data; and processing the packets as needed. The isolation unit is deployed on the gateway device between the red zone and the black zone, providing strict logical isolation and security policies, effectively improving the security of the network system through encryption protocols and access management, and avoiding the risks of information leakage and data tampering. It realizes the strict logical isolation between the red zone and the black zone, and at the same time provides necessary security guarantees during the data transmission process to protect the security of sensitive information.

[0023] Step S200, using the netfilter mechanism of the LINUX kernel, register multiple hook points in the packet processing flow within the red zone, black zone, and isolation unit to perform traffic processing on the packets. Among them, the multiple hook points include PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT, and POST_ROUTING. Specifically, the netfilter mechanism of the LINUX kernel is used to process network data packets. The netfilter mechanism is a kernel framework that provides multiple hook points for operations during the packet processing process. Specifically, in the packet processing flow of the red zone, black zone, and isolation unit, five hook points are registered through the netfilter mechanism: PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT, and POST_ROUTING. Each hook point corresponds to a different network data processing stage. The PRE_ROUTING hook point processes the packet before it enters the routing decision and is used for source network address translation (SNAT) or packet filtering; LOCAL_IN processes packets destined for the local destination and is applicable to local security policy control; FORWARD is used to forward packets and is applicable to packets in routers or gateways; the LOCAL_OUT hook point is used for packets sent locally to control the forwarding and security of local traffic; the POST_ROUTING hook point processes packets leaving the system and performs destination network address translation (DNAT) or other necessary final operations. By registering customized processing logic at the hook points, netfilter can ensure that packets are processed according to strict security and control policies when passing through the red zone, black zone, and isolation unit, thus effectively ensuring the isolation of the network and the security of the data.

[0024] In a possible implementation, the netfilter mechanism of the LINUX kernel is adopted, and multiple hook points are registered in the packet processing flow within the red zone, black zone, and isolation unit to process the passing of packets. Among them, the multiple hook points include PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT, and POST_ROUTING. Step S200 further includes step S210. The netfilter mechanism is registered at the post-routing of the network card connected to the red zone and the isolation unit, and at the pre-routing of the external network card connected to the black zone and the isolation unit. Among them, if the network card is in bridge mode, the netfilter of the bridge is registered; if the network card is in gateway mode, IP_netfilter is registered. Specifically, the netfilter mechanism is registered at the post-routing hook of the network card connecting the red zone and the isolation unit, and at the pre-routing hook of the external network card connecting the black zone and the isolation unit to ensure that packets are correctly processed according to the predetermined rules. For the packets processed in the red zone, before entering the isolation unit, when passing through the post-routing hook, netfilter performs a final check and routing decision on the packets according to the set rules to ensure data security and compliance. In the receiving direction, the packets sent from the external network first enter the black zone. When passing through the pre-routing hook, netfilter preprocesses the packets and then enters the processing flow of the black zone after confirming compliance with the security policy. Further, the registration method of netfilter depends on the working mode of the network card: when the network card works in bridge mode, netfilter processes the traffic at the link layer and is registered to the bridged netfilter; in gateway mode, netfilter is responsible for processing and routing IP packets and is registered to IP_netfilter, thereby achieving more efficient traffic control and security protection, supporting the processing of IPSEC packets based on the red-black architecture under different network topology modes, supporting both gateway mode and bridge mode, and can switch to support different modes according to changes in the network topology, with high adaptability.

[0025] Step S300: Process the message based on the completed message processing flow, where the message processing flow includes a sending direction and a receiving direction. Specifically, in the message processing method of red-black isolated IPSEC, the message processing flow in the sending direction first filters the plaintext data sent by the user through the red zone. The red zone checks and processes the message according to the security policy, such as checking the validity of the message or whether it meets the predetermined transmission standard. The processed data is added with a control header and encapsulation information to ensure that the data can be correctly identified in the network and relevant control operations are executed. Then, the encapsulated data is transmitted to the isolation unit, which is responsible for encrypting the data to ensure the confidentiality and integrity of the data. The encrypted ciphertext is then transmitted to the black zone, where the black zone strips the information from the ciphertext, removes the redundant encapsulation, and extracts the effective encrypted content (such as ESP ciphertext). Finally, the black zone sends the decapsulated ciphertext to the external network to complete the message processing in the sending direction. In the receiving direction, the message from the external network is first received by the black zone, which filters the message and adds control header information to ensure that the received data meets the expected standard. Then, the encrypted message with the control header is sent to the isolation unit for decryption to be restored to plaintext. The decrypted plaintext data is sent to the red zone, where the red zone further checks the integrity of the data, strips unnecessary content, and performs the final filtering process. Finally, the processed original message is sent to the target receiving end to complete the message processing in the receiving direction. In this way, the entire message sending and receiving process is strictly controlled and processed among different areas of the red zone, black zone, and isolation unit, thus ensuring the security, integrity, and correctness of the data. A dynamically loadable driver for encapsulating and decapsulating messages based on the Linux-netfilter framework does not affect the original message processing flow when this driver is not loaded. When this driver is loaded, it not only supports the processing of IPSEC traffic but also supports special processing of some special types of messages, such as the transparent transmission special processing of ARP messages.

[0026] In a possible implementation, based on the completed message processing flow, the message is processed. Among them, the message processing flow includes a sending direction and a receiving direction. Step S300 further includes step S310, where the plaintext data sent by the user is filtered by the red zone and then a control header and encapsulation information are added. Specifically, the plaintext data sent by the user is first filtered by the red zone. The red zone ensures that the data packet conforms to the specified format and security requirements by implementing data legality checks, integrity verification, and compliance reviews. Next, the red zone adds a control header and encapsulation information to the data packet. The control header includes information such as the priority of the data packet, source and destination addresses, protocol type, etc., to ensure that the data can be transmitted to the destination smoothly and securely. Subsequently, the red zone further adds encapsulation information to the data packet, mainly including data required for encryption and authentication, to ensure the confidentiality, integrity, and security during transmission of the data. Finally, the processed plaintext data with the control header and encapsulation information is sent from the red zone to the isolation unit to prepare for subsequent encryption and transmission. This process effectively guarantees the secure transmission of data in the network.

[0027] Step S320, send the plaintext data with the control header and encapsulation information to the isolation unit for encryption to obtain ciphertext. Specifically, in the message processing flow, first, the plaintext data sent by the user will go through the filtering step in the red zone. This filtering ensures the legality and integrity of the data and removes potential risky content. The filtered data will be added with a control header and encapsulation information, including information such as data source, destination, authentication information, and timestamp, for correct routing and verification of the data during subsequent transmission. Next, the processed plaintext data will be sent to the isolation unit, where encryption processing is performed. The isolation unit encrypts the plaintext data using encryption algorithms (such as AES or RSA) to convert it into ciphertext, thus ensuring the confidentiality of the data. The encrypted ciphertext will be transmitted to the black zone for further processing.

[0028] Step S330: Send the ciphertext to the black zone, strip information from the ciphertext to obtain the ESP ciphertext, and then send it to the external network. Specifically, first transfer the encrypted ciphertext from the isolation unit to the black zone, which is responsible for further processing the ciphertext. Specifically, the black zone strips information from the ciphertext, removing redundant encapsulation headers and control information, and only retaining the most core encrypted data. After this step, the ciphertext is transformed into a packet conforming to the ESP (Encapsulating_Security_Payload) format. The ESP-format ciphertext contains the encrypted data and necessary authentication information to ensure the confidentiality and integrity of the data. Finally, the processed ESP ciphertext is sent to the external network to ensure that it can be transmitted securely in the external network and the data will not be leaked or tampered with. After receiving it, according to the preset rules, the system will decrypt the ESP ciphertext to restore the original packet content.

[0029] In a possible implementation, as Figure 2 shown, the plaintext data sent by the user is filtered by the red zone and then control headers and encapsulation information are added. Step S310 further includes step S311: Determine whether the packet is a negotiation packet. If so, hand it over to the protocol stack for processing. Specifically, when processing an incoming packet, first determine whether the packet is a negotiation packet. Negotiation packets are usually used for protocol establishment or update and contain key exchange information, encryption algorithm negotiation, or identity authentication, etc. If the packet is a negotiation packet, the system will hand it over to the protocol stack for processing. The protocol stack is responsible for parsing the packet and performing necessary protocol negotiation or key exchange operations. In this way, the protocol stack ensures the correct negotiation of keys, encryption algorithms, and authentication methods, guaranteeing that subsequent data transmission can be encrypted and protected according to the agreed-upon encryption and authentication methods. After the negotiation is completed, the protocol stack generates or updates information such as keys and algorithm settings to ensure that the subsequent encryption and decryption of data meet security requirements, ultimately ensuring the security and integrity of the communication.

[0030] Step S312: If the answer is no, extract the network layer information of the packet, and determine whether it is a TCP or UDP packet. If it is, extract the five-tuple information; if not, extract the three-tuple information. Specifically, if the packet is not a negotiation packet, the system will first extract the network layer information of the packet and determine whether the packet belongs to the TCP or UDP protocol. If it is a TCP or UDP packet, the system will further extract the five-tuple information, which includes the source IP address, destination IP address, source port number, destination port number, and protocol type. This helps the system identify the flow and source of the packet and supports subsequent network management functions such as routing selection and traffic control. If the packet is not of the TCP or UDP protocol, the system will determine whether it belongs to other types and extract the three-tuple information, which usually includes the source IP address, destination IP address, and protocol type. Although it does not include the port number, it can still help the system identify and process this type of traffic. Through these steps, the system can make reasonable processing decisions for different types of network traffic.

[0031] Step S313: Search the policy table according to the five-tuple information or three-tuple information. If the policy is not hit, process it according to the default policy. If the policy is hit, parse the policy actions of the SAD table and SPD, and discard, forward to the CPU, pass through, or add control header information to the packet according to the policy actions. Specifically, first, the system will search the preset policy table according to the five-tuple information or three-tuple information in the packet. The policy table is used to store packet processing rules based on information such as source address, destination address, port number, and protocol type. If the system fails to find a policy matching the packet in the policy table, it will process it according to the default policy, usually discarding or allowing the packet to pass through. If there is a matching policy in the policy table, the system will, according to the indication of the policy, further parse the entries in the Security Association Database (SAD) and Security Policy Database (SPD) and process them according to the preset actions. Specifically, if the policy requires, the system may discard packets that do not meet the conditions or forward the packets to the CPU for more complex analysis. If the policy indicates pass-through processing, the packet will be allowed to pass through without modification, and at the same time, control header information such as packet identification and encryption mark will be added to the packet. The information will be passed to the subsequent network layer or application layer to ensure the security and traffic management of the packet, supporting four different actions for the packet, namely encryption / decryption, pass-through, forwarding to the CPU, and discarding, so as to implement the IPsec function of red-black isolation and the special processing function of the device for the packet.

[0032] In a possible implementation, such as Figure 3As shown, the ciphertext is sent to the black zone, and information stripping is performed on the ciphertext to obtain the ESP ciphertext, which is then sent to the external network. Step S330 further includes step S331, which performs information stripping on the ciphertext received from the isolation unit. Specifically, after receiving the ciphertext from the isolation unit, the system performs information stripping on the ciphertext to remove additional information related to the encryption process. First, the system identifies and removes the control headers in the encrypted data packet. These control headers usually contain markers for identifying the encryption process, key information, or encryption algorithms. Next, the system removes any additional checksum or verification information, which is not required in the later stage of data processing. In addition, the system also strips all unnecessary encapsulation data, which increases the size of the data packet during encryption but is no longer required after decryption. This process ensures that the ciphertext data is cleaned into a valid encrypted payload, facilitating subsequent decryption operations, enabling the data to be restored to the original plaintext data for subsequent processing and transmission.

[0033] Step S332, determine whether it is a negotiation message. If so, hand it over to the protocol stack for processing. Specifically, after receiving the message, the system first determines whether the message is a negotiation message. Negotiation messages are usually used to establish the parameters for encrypted communication and the key exchange process, such as the ISAKMP or IKE messages used in the IPsec protocol. If it is determined that the message is a negotiation message, the system will hand it over to the protocol stack for processing. The protocol stack is a key component in network communication and is responsible for processing messages at different protocol layers. When processing a negotiation message, the protocol stack performs operations such as key negotiation, authentication, and selection of encryption algorithms according to predefined protocol rules. In this way, the protocol stack can ensure that both parties in the network communication agree on parameters such as the encryption method and key, ensuring the security of subsequent data transmission. If the message is not a negotiation message, the system skips the protocol stack processing and proceeds to the next message processing flow.

[0034] Step S333: If the answer is no, then it is determined whether it is the seal-only encapsulation mode. If it is, the four-layer checksum is recalculated and then sent to the external network. If not, it is directly sent to the external network. Specifically, when the received ciphertext is not a negotiation message, the system further determines whether the message belongs to the "seal-only encapsulation mode". In the seal-only encapsulation mode, the message content is only encrypted and not authenticated, so additional processing is required. The system first checks whether the message conforms to this mode. If so, the system recalculates the four-layer checksum. The four-layer checksum is to ensure the integrity of the data during transmission because the encryption operation modifies the message content, making the original checksum invalid. After recalculating the checksum, the ciphertext is sent to the external network. If the message does not belong to the seal-only encapsulation mode, it means that it has undergone more complex encapsulation processing (such as encryption and authentication at the same time). At this time, the system directly sends the ciphertext to the external network without recalculating the checksum. In this way, by processing different message modes separately, the security and integrity of the data are ensured.

[0035] In a possible implementation manner, based on the constructed message processing flow, the message is processed. Among them, the message processing flow includes a sending direction and a receiving direction. Step S300 further includes step S340. The black zone receives the message sent by the external network, filters it, and then adds control header information. Specifically, after the black zone receives the message from the external network, it first performs filtering processing to ensure that the message meets the predetermined security standards and policies. This process includes checking information such as the source address, destination address, and protocol type of the message and performing security verification on it, such as using firewall rules or an intrusion detection system (IDS) to prevent the incoming of risky content. After filtering, the black zone will add control header information to the legitimate message. These control header information are used to identify the transmission status and routing metadata of the message, such as timestamp, protocol type, encryption identifier, checksum, etc., to ensure that the message can be correctly encrypted in the isolation unit. After adding the control header information, the message is transmitted to the isolation unit for further encryption processing, preparing for subsequent decryption and transmission to the red zone, ensuring the secure and compliant processing of the message, and finally sending the plaintext data to the user.

[0036] Step S350: Send the message with the added control header information to the isolation unit for decryption to obtain the plaintext. Specifically, after receiving the filtered message with the added control header information, the black zone forwards it to the isolation unit for decryption processing. The isolation unit decrypts the encrypted data using a predefined key to restore its original plaintext. This decryption process may use symmetric encryption (such as AES) or asymmetric encryption (such as RSA) methods, depending on the way the message was encrypted. During the decryption process, the isolation unit verifies the integrity and identity of the message to ensure that the data has not been tampered with or forged during transmission. After decryption is completed, the restored plaintext data, including the original data payload and the added control header information, will continue to be transmitted to the red zone for further processing. The red zone will perform additional security verifications on the plaintext data, such as filtering and information stripping, to ensure that the data complies with the internal security rules of the system and finally send it to the target user.

[0037] Step S360: Send the plaintext to the red zone for filtering and information stripping to obtain the original message and send it to the user. Specifically, after the message is decrypted by the isolation unit and restored to plaintext, the received message will be forwarded to the red zone for further processing. In the red zone, first, the message will be filtered to ensure that it meets the security requirements and standards of the system. The filtering process includes examining the protocol headers, data content, etc. in the message to check for the presence of risk data, illegal content, or non-compliant parts. For example, it may check for the existence of insecure transport protocols, viruses, or other potential threats. Then, the information stripping operation is performed. This means that the red zone will remove all redundant control headers, identification information, or encrypted metadata from the message, leaving only the pure data content. These redundant parts include encryption identifiers for the data, protocol types, routing information, etc., which are completely removed in this step to ensure that the message received by the end user contains only the necessary data content. After processing, the message will be sent to the user side as it is, which means that the data will not be modified or damaged during transmission. At the same time, the transmitted data is content that meets the security requirements and can be used directly. The user system will receive this data that has been security-reviewed and confirmed to ensure the integrity and confidentiality of the data and prevent information leakage or tampering.

[0038] In a possible implementation, such as Figure 4As shown, the black area receives the packets sent by the external network, filters them, and adds control header information. Step S340 further includes step S341, which determines whether the packets sent by the external network need to be fragmented and reassembled. If so, the fragmentation and reassembly are performed; if not, the fragmentation and reassembly are not performed. Specifically, when receiving the packets sent by the external network, it is first necessary to determine whether the packets have been split into multiple segments. If so, the system will start the fragmentation and reassembly process. By using the identifier and offset information of each fragment, all the fragments are combined in order into a complete original packet. If the packet has not been fragmented, there is no need for reassembly, and the system will directly process the complete packet. The fragmentation and reassembly process ensure that the network layer can correctly recover the split data, avoid data loss or errors caused by packet splitting, and ensure that the received packets can be correctly processed in the original order. This process is particularly important when processing large data packets and can effectively guarantee the integrity and accuracy of the data.

[0039] Step S342, determines whether the packet is a negotiation packet. If so, it is handed over to the negotiation unit for processing. Specifically, during the packet processing, it is first necessary to determine whether the received packet is a negotiation packet. Negotiation packets are usually used for operations such as protocol establishment, parameter negotiation, or key exchange. When the packet is identified as a negotiation packet, it will be directly handed over to a dedicated negotiation unit for processing. The task of the negotiation unit is to parse the negotiation information in the packet and process the negotiation steps of encryption, authentication, or communication protocols therein. For example, when establishing a secure connection, the negotiation unit may need to verify certificates, negotiate encryption algorithms, exchange keys, etc. This processing flow ensures that the negotiation packet can be accurately parsed and processed, thus ensuring that the secure communication between systems can be successfully established. If the packet is not a negotiation packet, it will enter the subsequent processing flow and perform corresponding operations according to the type or content of the packet.

[0040] Step S343, if not, then determine whether it is a TCP or UDP packet. If so, extract the five-tuple information; if not, extract the three-tuple information. Specifically, when processing the received packet, first determine whether the packet is a TCP or UDP protocol. If it is, extract the five-tuple information from the packet. The five-tuple includes the source IP address, destination IP address, source port number, destination port number, and protocol type. With these five elements, the system can accurately identify and manage traffic, perform access control based on ports and IP addresses, traffic forwarding, and security policy judgment. For example, if it is detected that traffic from a certain source IP is continuously sent to a specific port, the system can implement traffic rate limiting, blocking, or preferential processing of the traffic based on the five-tuple information. If the packet is not a TCP or UDP protocol, the system then extracts the three-tuple information, namely the source IP address, destination IP address, and protocol type, which is also effective for processing traffic of other protocols such as ICMP (Internet Control Message Protocol). Based on the extracted five-tuple or three-tuple information, the system will then query the policy table (such as the SPD table) to determine whether the packet conforms to the preset security policy. If the policy is not hit, it will be processed according to the default policy; if the policy is hit, the system will perform actions such as discarding the packet, sending it to the CPU for processing, or passing it through according to the policy defined in the SPD table.

[0041] Step S344: Determine whether the SPD table is hit according to the quintuple information or the triple information. If not, process it according to the default policy action. If so, parse the SAD table and the policy action of the SPD in the received packet processing flow, and discard, send the packet to the CPU, or transparently transmit the packet according to the policy action. Specifically, after receiving a packet and extracting the quintuple information (including source IP, destination IP, source port, destination port, and protocol type) or the triple information (including source IP, destination IP, and protocol type), the system will query the SPD (Security Policy Database) table based on this information to determine whether the packet conforms to the preset security policy. The SPD table records the security policy rules for network traffic, such as allowed, denied, or encrypted traffic. If the quintuple or triple information of the packet does not match any policy in the SPD table, the system will process it according to the default policy, usually discarding the packet or applying the basic forwarding rules. If the packet matches a policy in the SPD table, the system will further parse the SAD (Security Association Database) table to obtain the security action corresponding to the policy. According to the policy action, the system may take three processing methods: First, if the policy requires discarding the packet, the system will directly discard the packet without any further processing; Second, if the policy requires in-depth analysis of the packet, the system will send the packet to the CPU for further inspection or generate a security report; Finally, if the packet is considered to conform to the security policy and can be normally transmitted, the system will transparently transmit the packet according to the policy action, that is, allow the packet to continue to be transmitted without any modification. Through this mechanism, the system can effectively manage packet traffic, ensure compliance with security policy requirements, and ensure that non-compliant traffic is correctly processed, thereby improving network security and efficiency.

[0042] In a possible implementation, such as Figure 5As shown, the plaintext is sent to the red zone for filtering and information stripping to obtain the original message, which is then sent to the user. Step S360 further includes step S361, where information is stripped from the plaintext and the destination MAC of the plaintext is replaced with the MAC address of the network card or bridge interconnected by the isolation unit. Specifically, during the message processing, first, information needs to be stripped from the plaintext data, that is, unnecessary redundancy or irrelevant data in the message is removed, and only the valid information is retained. The goal of this operation is to simplify the message content, ensure that the core data in the message can be correctly processed, and improve the transmission efficiency. Information stripping usually involves removing useless header information and control markers, etc., to reduce interference and data volume in subsequent steps. Subsequently, the destination MAC address of the message is replaced with the MAC address of the network card or bridge connected by the isolation unit. The destination MAC address points to the final destination of the data packet, but since the message needs to pass through the isolation unit to enter the security zone, the original destination MAC address must be changed to the MAC address of the network interface where the isolation unit is located. If the isolation unit is connected through a network card, the destination MAC address will be replaced with the MAC address of the network card; if it is connected through a bridge, it will be replaced with the MAC address of the bridge. This operation ensures that the message can pass through the isolation unit smoothly and continue to be delivered to the final destination along the correct path, thus guaranteeing the integrity and security of data during transmission between different security zones.

[0043] Step S362: Determine whether it is a TCP or UDP message. If so, extract the five-tuple information; if not, extract the three-tuple information. Specifically, during the message processing, first, the system determines whether the message is a TCP or UDP protocol. If it is a TCP or UDP protocol, the system extracts the five-tuple information from the message. The five-tuple contains five key pieces of information: source IP address, destination IP address, source port, destination port, and protocol type. Through these five elements, the system can accurately identify the communication peer and transport layer protocol of the message, providing a basis for subsequent security policy matching. These five-tuple information will be used to search the security policy database (SPD). If the message matches a specific policy, the system will take corresponding processing measures according to the policy, such as discarding, sending it to the CPU, or passing it through. If the message is not a TCP or UDP protocol, the system will extract the three-tuple information. The three-tuple includes the source IP address, destination IP address, and protocol type, which is applicable to non-transport layer protocols such as ICMP, etc. These information will also be used for policy judgment and subsequent processing. Therefore, regardless of whether the message is a TCP, UDP, or other type of protocol, the system can extract the necessary identification information and perform security processing on the message according to the policy table. The policy matching is implemented by using a flow table to match the policy, and the message can be processed with relatively high performance.

[0044] Step S363: Determine whether the spd table is hit according to the quintuple information or triple information. If not, process it according to the default policy action. If so, parse the sad table and the policy action of the spd in the received packet processing flow, and discard, send the packet to the CPU, or pass the packet through according to the policy action. Specifically, after receiving a packet, the system first looks up whether there is a matching processing policy in the policy database (SPD) according to the quintuple or triple information of the packet. The quintuple includes the source IP, destination IP, source port, destination port, and protocol type, and the triple includes the source IP, destination IP, and protocol type. These information are used to identify the source and destination of the packet. If the packet does not find a matching policy in the SPD table, it means that the packet does not meet any specific security requirements, and the system will process it according to the preset default policy, usually including discarding the packet or performing basic traffic filtering. If the packet finds a matching policy in the SPD table, the system will further parse the corresponding security association database (SAD). The SAD contains specific security policy actions, such as encryption, decryption, verification, etc. According to the parsing result, the system will perform corresponding operations according to the instructions in the SAD. Specifically, it may include discarding the packet (when the packet does not meet the policy or there is a security risk), sending the packet to the CPU for further processing, or passing the packet through, allowing it to continue flowing without further intervention. This process ensures that all data flows in and out of the network are processed according to the predefined security policies, maximizing the security of the system and the integrity of the data.

[0045] In a possible implementation, such as Figure 6 , Figure 7 , Figure 8 , Figure 9, based on the completed message processing flow, the message is processed. Among them, the message processing flow includes a sending direction and a receiving direction. Step S300 further includes: IPSEC message processing involving four encapsulation modes, specifically including tunnel encryption authentication encapsulation mode, transport encryption authentication encapsulation mode, authentication-only encapsulation mode, and encryption-only encapsulation mode. Each encapsulation mode uses a different encapsulation format to adapt to different security requirements and ensure the confidentiality, integrity, and network transmission security of data. In the sending direction, the message processing flow includes an encapsulation operation on the data. In the tunnel encryption authentication encapsulation mode, the entire IP packet (including the IP header and payload) is encrypted and authenticated, thus ensuring the confidentiality and integrity of data transmission and being applicable to scenarios such as VPNs that require hiding the content of the packet. The transport encryption authentication encapsulation mode only encrypts and authenticates the data payload part, which is suitable for end-to-end encryption requirements and can reduce performance overhead, and is usually used in scenarios where there is no need to hide the IP address. The authentication-only encapsulation mode only performs data integrity verification without encrypting the data, and is applicable to scenarios where data integrity checking is required without encryption. The encryption-only encapsulation mode encrypts the data but does not perform authentication, and is applicable to scenarios where data security protection is required but the requirement for data integrity is relatively low. Each encapsulation mode uses a different encapsulation format to adapt to different security requirements. In the receiving direction, the processing flow performs decapsulation according to different encapsulation modes. In the tunnel encryption authentication encapsulation mode, the receiving party decrypts the entire packet and performs integrity verification. In the transport encryption authentication encapsulation mode, only the data payload part is decrypted and its integrity is verified. In the authentication-only encapsulation mode, the receiving party verifies the integrity of the data, but the data remains in plaintext. Finally, in the encryption-only encapsulation mode, the receiving party decrypts the data content but does not perform integrity verification. It also supports switching between the four encapsulation modes and can select the appropriate message processing method according to actual security requirements. In addition, the system also supports the encapsulation processing of fragmented messages to ensure that even in the case of fragmentation in the network, the message encapsulation and decapsulation can still be correctly processed, further improving the adaptability and flexibility of the system. By supporting different encapsulation formats and flexible switching of encapsulation modes, the system provides higher processing efficiency and flexibility while ensuring data security and is applicable to various complex network environments.

[0046] The embodiment of this application adopts the construction of a red zone and a black zone, and an isolation unit is set between the two; based on the netfilter mechanism of the LINUX kernel, multiple hook points are registered in the message processing flow to achieve message passing; the message is sent and received through the constructed message processing flow, achieving the technical effect of improving the security and reliability of data transmission between the red zone and the black zone by ensuring strict logical isolation between the red zone and the black zone.

[0047] The above specific embodiments do not constitute a limitation on the protection scope of this application. Those skilled in the art should understand that various modifications, combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principle of this application shall be included within the protection scope of this application.

Claims

1. A message processing method for red-black isolation IPSEC, characterized in that: The method comprises: constructing a red area and a black area, and constructing an isolation unit between the red area and the black area; The netfilter mechanism of the LINUX kernel is adopted to register multiple hook points in the message processing flow in the red zone, the black zone and the isolation unit to perform pass processing on the message, wherein the multiple hook points include PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT and POST_ROUTING; Based on the constructed message processing flow, the message is processed, wherein the message processing flow includes a sending direction and a receiving direction.

2. The message processing method of red-black isolation IPSEC according to claim 1, characterized in that: The message sending process in the sending direction includes: The plaintext data sent by the user is filtered by the red zone and then a control header and encapsulation information are added; Sending the plaintext data with the control header and encapsulation information to the isolation unit for encryption to obtain ciphertext; The ciphertext is sent to the black area, information is stripped from the ciphertext, an ESP ciphertext is obtained, and the ciphertext is sent to an external network.

3. The message processing method of red-black isolation IPSEC according to claim 1 is characterized in that: The receiving message processing flow in the receiving direction includes: The black zone receives the message sent from the external network, filters it and then adds the control header information; Sending the message with added control header information to the isolation unit for decryption to obtain plain text; The plain text is sent to the red zone for filtering and information stripping to obtain the original message and send it to the user.

4. The message processing method of red-black isolation IPSEC according to claim 1 is characterized in that: The netfilter mechanism is registered at the post-routing of the network card to which the red zone and the isolation unit are connected, and at the pre-routing of the external network card to which the black zone and the isolation unit are connected, wherein if the network card is in bridge mode, the netfilter of the bridge is registered, and if the network card is in gateway mode, the IP-netfilter is registered.

5. The message processing method of red-black isolation IPSEC according to claim 2 is characterized in that: In the message sending process, the steps performed by the red zone also include: Determine whether the message is a negotiation message. If so, submit it to the protocol stack for processing; If not, extract the network layer information of the message to determine whether it is a TCP or UDP message. If so, extract the five-tuple information. If not, extract the three-tuple information. The policy table is searched according to the five-tuple information or the three-tuple information. If the policy is not hit, it is processed according to the default policy. If the policy is hit, the policy action of the sad table and spd is parsed, and the message is discarded, sent to the CPU, or transparently transmitted according to the policy action, and the control header information is added.

6. The message processing method of red-black isolation IPSEC according to claim 2 is characterized in that: In the message sending process, the steps performed by the black area further include: Stripping the ciphertext received from the isolation unit; Determine whether it is a negotiation message. If so, submit it to the protocol stack for processing; If not, determine whether it is an encryption-only encapsulation mode. If so, recalculate the four-layer checksum and send it to the external network. If not, send it directly to the external network.

7. The message processing method of red-black isolation IPSEC according to claim 3 is characterized in that: In the received message processing flow, the steps performed by the black area further include: Determine whether the message sent from the external network needs to be fragmented and reassembled. If so, reassemble the message, otherwise do not reassemble the message; Determine whether the message is a negotiation message, if so, hand it over to the negotiation unit for processing; If not, determine whether it is a TCP or UDP message. If so, extract the five-tuple information. If not, extract the three-tuple information. Determine whether the spd table is hit according to the five-tuple information or the three-tuple information. If not, process it according to the default policy action. If so, parse the sad table and the spd policy action of the received message processing flow, and discard, send to the CPU, or transmit the message according to the policy action.

8. The message processing method of red-black isolation IPSEC according to claim 3 is characterized in that: In the received message processing flow, the steps performed by the red zone also include: Strip the plain text and replace the destination MAC address of the plain text with the MAC address of the network card or bridge that interconnects the isolation unit; Determine whether it is a TCP or UDP message. If so, extract the five-tuple information. If not, extract the three-tuple information. Determine whether the spd table is hit according to the five-tuple information or the three-tuple information. If not, process it according to the default policy action. If so, parse the sad table and the spd policy action of the received message processing flow, and discard, send to the CPU or transmit the message according to the policy action.

9. The message processing method of red-black isolation IPSEC according to claim 1, characterized in that: The sending message processing flow and the receiving message processing flow in the sending direction and the receiving direction, the modes of encapsulating and decapsulating ESP messages in the sending message processing flow and the receiving message processing flow include tunnel encryption authentication encapsulation mode, transmission encryption authentication encapsulation mode, authentication-only encapsulation mode, and encryption-only encapsulation mode.

Images