IPsec tunnel recovery method, device and readable storage medium

Abstract

The present invention discloses an IPSec tunnel recovery method, device, and readable storage medium. The method includes, after an IPSec tunnel negotiation process is initiated, detecting, through the IPSec tunnel negotiation process, whether a designated database contains target tunnel data, wherein the designated database records historical data of successful IPSec tunnel negotiations; if the target tunnel data exists in the designated database and query data related to the target tunnel data exists, creating a structure corresponding to the target tunnel based on the query data; and resuming IPSec negotiation based on the created structure. The disclosed method can resume IPSec negotiation based on the created structure as needed. Because the designated database records historical data of successful IPSec tunnel negotiations, only one gateway device is required to quickly restore the IPSec tunnel state. This method also solves the problem of service data packet loss caused by tunnel renegotiation when state synchronization fails in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of information security technology, and in particular to an IPSec tunnel recovery method, device and readable storage medium. Background Art

[0002] Internet Protocol Security (IPsec) is a protocol package that protects the IP protocol's network transmission protocol suite (a collection of interrelated protocols) by encrypting and authenticating IP protocol packets.

[0003] IPsec (IP Security) is a three-layer tunnel encryption protocol developed by the IETF. It provides high-quality, interoperable, cryptographically based security for data transmitted over the Internet. It provides the following security services between specific communicating parties through encryption and data origin authentication at the IP layer:

[0004] Data confidentiality: The IPsec sender encrypts the packet before transmitting it over the network.

[0005] Data Integrity: The IPsec receiver authenticates the packets sent by the sender to ensure that the data has not been tampered with during transmission.

[0006] Data Authentication: IPsec can authenticate the legitimacy of the sender of IPsec packets at the receiving end.

[0007] Anti-Replay: IPsec receivers can detect and reject outdated or duplicate packets.

[0008] SA (Security Association) is the foundation of IPSec. An SA is an agreement established through negotiation between two communicating entities. The SA determines the IPSec protocol, transcoding method, key, and key validity period used to protect data packets.

[0009] SADB: Security Associations Database (SADB) is a storage structure used to store all state data associated with SA.

[0010] SPDB: A security policy database (SPDB) specifies which security services should be used for all IP datagrams and how to obtain these services. The SPDB is typically an ordered structure that uses access control lists to describe data flow characteristics.

[0011] Existing tunnel recovery technologies rely on two devices acting as backup for each other. Tunnel failures require a master-slave switchover between the two devices. Synchronizing the status of the active and standby firewalls takes time, and if there are issues with the synchronization link, synchronization will fail, requiring the IPSec tunnel to be renegotiated, which can lead to packet loss. Summary of the Invention

[0012] The embodiments of the present invention provide an IPSec tunnel recovery method, apparatus, and readable storage medium, which are used to quickly restore the IPSec tunnel state using only one device, while solving the problem of service data packet loss caused by tunnel renegotiation when state synchronization fails in the prior art.

[0013] An embodiment of the present invention provides an IPSec tunnel recovery method, comprising:

[0014] After the IPsec tunnel negotiation process is started, detecting whether a designated database contains target tunnel data through the IPsec tunnel negotiation process, wherein the designated database records historical data of successful IPsec tunnel negotiations;

[0015] If target tunnel data exists in a designated database and query data related to the target tunnel data exists, creating a structure corresponding to the target tunnel according to the query data;

[0016] Resume IPsec negotiation based on the created structure.

[0017] In some embodiments, the historical data is obtained by:

[0018] Through the IPSec tunnel negotiation process, the IKESA data and IPSEC SA data of each tunnel data in the successful negotiation history are regularly saved, and the policies in the kernel SADB database and SPDB database are kept unchanged.

[0019] In some embodiments, the method for obtaining the historical data further includes:

[0020] Calculate summary information of each tunnel data, and save the calculated summary information together with each tunnel information.

[0021] In some embodiments, before creating the structure corresponding to the target tunnel according to the query data, the method further includes:

[0022] When the target tunnel data exists in the specified database, data integrity verification is performed based on the corresponding summary information.

[0023] In some embodiments, a method of determining whether query data related to the target tunnel data exists in the designated database includes:

[0024] In a case where the target tunnel data exists in the designated database, corresponding query data is acquired based on the IKE SA data and the IPSEC SA data.

[0025] In some embodiments, the process further includes starting a monitor process while starting the IPsec tunnel negotiation process;

[0026] The monitor process is configured to periodically detect whether the IPSec tunnel negotiation process is running;

[0027] In the case that it is detected that the IPSec tunnel negotiation process is not running, a designated interface is called to start the negotiation process.

[0028] An embodiment of the present invention further provides an IPSec tunnel recovery device, comprising a processor, wherein the processor is configured to:

[0029] After the IPsec tunnel negotiation process is started, detecting whether a designated database contains target tunnel data through the IPsec tunnel negotiation process, wherein the designated database includes historical data of successful IPsec tunnel negotiations;

[0030] If target tunnel data exists in a designated database and query data related to the target tunnel data exists, creating a structure corresponding to the target tunnel according to the query data;

[0031] Resume IPsec negotiation based on the created structure.

[0032] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the IPSec tunnel recovery method described in each embodiment of the present disclosure are implemented.

[0033] In an embodiment of the present invention, when target tunnel data exists in a designated database and query data related to the target tunnel data exists, a structure corresponding to the target tunnel is created according to the query data, so that IPsec negotiation can be restored on demand based on the created structure. Since historical data of successful IPsec tunnel negotiations is recorded in the designated database, only one gateway device is needed to quickly restore the IPsec tunnel status. At the same time, the problem of service data packet loss caused by tunnel renegotiation when status synchronization fails in the prior art is solved.

[0034] The above description is only an overview of the technical solution of the present invention. In order to more clearly understand the technical means of the present invention, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are specifically listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0035] Various other advantages and benefits will become apparent to those skilled in the art upon reading the detailed description of the preferred embodiment below. The accompanying drawings are for illustration purposes only and are not to be considered as limiting the present invention. The same reference symbols are used throughout the drawings to represent the same components. In the drawings:

[0036] Figure 1 A basic flow chart of the IPSec tunnel recovery method disclosed herein;

[0037] Figure 2 This is the overall process of the IPSec tunnel recovery method disclosed in the present invention;

[0038] Figure 3 This is an interactive diagram of the IPSec tunnel recovery method disclosed in the present invention. DETAILED DESCRIPTION

[0039] Exemplary embodiments of the present disclosure will be described in more detail below with reference to the accompanying drawings. Although exemplary embodiments of the present disclosure are shown in the accompanying drawings, it should be understood that the present disclosure can be implemented in various forms and should not be limited by the embodiments set forth herein. Rather, these embodiments are provided to enable a more thorough understanding of the present disclosure and to fully convey the scope of the present disclosure to those skilled in the art.

[0040] IPsec has the following advantages:

[0041] Support for IKE (Internet Key Exchange) enables automatic key negotiation, reducing key negotiation overhead. IKE can be used to establish and maintain SAs, simplifying the use and management of IPsec.

[0042] All application systems and services that use the IP protocol for data transmission can use IPsec without making any modifications to the application systems and services themselves.

[0043] Data encryption is based on data packets rather than the entire data stream, which is not only flexible but also helps to further improve the security of IP data packets and can effectively prevent network attacks.

[0044] The definitions of terms used in this disclosure are as follows:

[0045] IPsec protocol: Internet Protocol Security (English: Internet Protocol Security, abbreviated as IPsec) is a protocol package that protects the IP protocol's network transmission protocol suite (a collection of interrelated protocols) by encrypting and authenticating IP protocol packets.

[0046] IKE: IKE is a hybrid protocol consisting of the Internet Security Association and Key Management Protocol (ISAKMP) and two key exchange protocols, OAKLEY and SKEME. IKE is built on the framework defined by ISAKMP, utilizing the key exchange model of OAKLEY and the sharing and rekeying techniques of SKEME. It also defines two key exchange modes of its own: Main Mode and Aggressive Mode. IKE Phase 1 (Main Mode and Aggressive Mode) creates an IKE SA, while Phase 2 (Quick Mode) creates an IPSEC SA.

[0047] Conventional IPSec state recovery methods involve switching between active and standby firewalls if active firewall A fails. Active firewall A becomes standby, and standby firewall B becomes active. Active firewall B then initiates reverse IKE negotiation to establish an IPSec tunnel with remote firewall C. However, this solution requires two firewalls, one active and one standby, to complete the switchover, and tunnel renegotiation can also result in packet loss.

[0048] Based on this, the embodiment of the present disclosure provides an IPsec tunnel recovery method, such as Figure 1 Shown, including:

[0049] Step S101: After the IPsec tunnel negotiation process is initiated, the IPsec tunnel negotiation process detects whether a designated database contains target tunnel data, where the designated database records historical data of successful IPsec tunnel negotiations. Specifically, if the negotiation process exits, the IPsec tunnel negotiation process can be restarted by calling a designated interface. Alternatively, a predetermined monitoring program or monitoring process can be used to restart the negotiation process after the negotiation process exits, and the IPsec negotiation can be resumed according to subsequent steps.

[0050] Step S102: If the target tunnel data exists in the designated database and query data related to the target tunnel data exists, a structure corresponding to the target tunnel is created based on the query data. For example, if the target tunnel data exists in the designated database, the tunnel data may be read and the kernel interface may be called to search for the corresponding query data, thereby creating a structure for the tunnel state in memory based on the query data.

[0051] Step S103: Restore the IPsec negotiation based on the created structure. For example, according to the IPsec tunnel to be restored, modify the IPsec tunnel from the current gateway to the target gateway and complete the negotiation, thereby restoring the IPsec tunnel.

[0052] In an embodiment of the present invention, when target tunnel data exists in a designated database and query data related to the target tunnel data exists, a structure corresponding to the target tunnel is created according to the query data, so that IPsec negotiation can be restored on demand based on the created structure. Since historical data of successful IPsec tunnel negotiations is recorded in the designated database, only one gateway device is needed to quickly restore the IPsec tunnel status. At the same time, the problem of service data packet loss caused by tunnel renegotiation when status synchronization fails in the prior art is solved.

[0053] In some embodiments, the method for obtaining the historical data includes: through the IPsec tunnel negotiation process, regularly saving the IKE SA data and IPSEC SA data of each tunnel data in the successful negotiation history, and keeping the policies in the kernel SADB database and SPDB database unchanged. For example, when the IPsec tunnel negotiation process is successfully negotiated, the IKE SA and IPSEC SA data can be regularly saved to a designated location of the device at regular intervals, and the policies in the kernel-state SADB and SPDB databases remain unchanged. Through the method disclosed in the present invention, the IPsec tunnel can quickly restore the negotiation state and data based on the last saved data, and since the kernel-state SADB and SPDB states have not changed, the service communication will not be affected during the IPsec tunnel recovery process.

[0054] In some embodiments, the method for acquiring historical data further includes calculating summary information for each piece of tunnel data and storing the calculated summary information together with the tunnel information. In some embodiments, before creating a structure corresponding to the target tunnel based on the query data, the method further includes: if the target tunnel data exists in a designated database, performing data integrity verification based on the corresponding summary information. By storing the calculated summary information together with the tunnel information, data integrity verification based on the summary information is facilitated, ensuring effective recovery of the IPSec tunnel.

[0055] In some embodiments, the method for determining whether the query data related to the target tunnel data exists in the designated database includes: when the target tunnel data exists in the designated database, obtaining the corresponding query data based on the IKE SA data and the IPSEC SA data. The query data in this example can be obtained based on the parameters of the IKE SA and IPSEC SA (specifically, it can include information such as random numbers, working keys, and session keys of both parties) after successful historical negotiations, wherein the IKE SA mainly includes parameter information after the successful negotiation of the first phase of the IPSec tunnel, and the IPSEC SA mainly includes parameter information of the second phase of the IPSec tunnel negotiation. The tunnel recovery disclosed in the present invention is achieved by utilizing the previously saved IKESA data and IPSECSA data, wherein each successful IPSEC SA can correspond one-to-one to the data in the SADB and SPDB. When restoring the tunnel, the corresponding relationship can be queried to achieve the recovery of the corresponding tunnel.

[0056] In some embodiments, a monitor process is initiated simultaneously with the initiation of the IPsec tunnel negotiation process. The monitor process is configured to periodically detect whether the IPsec tunnel negotiation process is running. If the IPsec tunnel negotiation process is not detected, a designated interface is invoked to initiate the negotiation process. Specifically, the monitor process can be initiated simultaneously with the initiation of the IPsec tunnel negotiation process. The monitor process is configured to periodically monitor the status of the IPsec tunnel negotiation process. For example, if the IPsec tunnel negotiation process exits due to an external process exit signal, the monitor process can be used to initiate the negotiation process by invoking an interface.

[0057] The method disclosed herein is that the IPSec negotiation process calls the kernel interface based on the read tunnel data, queries the kernel SADB and SPDB databases, and checks whether the corresponding tunnel exists. If the data in the SADB and SPDB exists, then based on the queried data, a structure used for the tunnel status is created in the memory. For example, the local device IPSEC negotiation process can save the successfully negotiated IKE SA and IPSEC SA to the device's specified location before exiting. After the IPSEC negotiation process is restarted, the IKE SA and IPSEC SA information are read from the device's specified location, and the tunnel data structure is constructed based on the read data. The method disclosed herein can achieve rapid recovery of the IPSec tunnel status without borrowing other backup devices, and restore the tunnel status data of the IPSec negotiation process to the state at the last save point. The method disclosed herein can also achieve no packet loss of business data when restoring the IPSec tunnel status, and can ensure the stability of business data transmission.

[0058] The method disclosed in this disclosure also proposes an implementation case of an IPsec tunnel recovery method, such as Figure 2 、 Figure 3 The following steps are shown:

[0059] Gateway A starts the IPsec tunnel negotiation process and the monitor process.

[0060] The IPsec negotiation process in gateway A checks whether there is tunnel data in the specified file / database. If tunnel data exists, it reads the corresponding data and verifies the integrity of the data based on the digest value saved in each tunnel.

[0061] The IPsec negotiation process in gateway A calls the kernel interface based on the read tunnel data, queries the kernel SADB and SPDB databases, and checks whether the corresponding tunnel exists. If the data in SADB and SPDB exists, the structure used for the tunnel status is created in memory based on the queried data.

[0062] Modify the tunnel from Gateway A to Gateway B according to user needs and complete the negotiation.

[0063] The negotiation process in gateway A regularly saves the successfully negotiated IKE SA data and IPSEC SA data to the specified location of the device, and the policies in the kernel-state SADB and SPDB databases remain unchanged.

[0064] The monitor process in gateway A periodically checks whether the IPsec negotiation process is running. If it is not running, it calls the interface to start the negotiation process.

[0065] Repeat the above recovery steps when the IPsec tunnel negotiation process in gateway A receives a process exit signal sent from the outside and causes the process to exit.

[0066] The recovery method disclosed in the present invention can enable the IPSec tunnel to quickly restore the negotiation state and data based on the last saved data, and since the kernel state SADB and SPDB states have not changed, the tunnel recovery process will not affect business communications.

[0067] An embodiment of the present invention further provides an IPSec tunnel recovery device, comprising a processor, wherein the processor is configured to:

[0068] After the IPsec tunnel negotiation process is started, detecting whether a designated database contains target tunnel data through the IPsec tunnel negotiation process, wherein the designated database includes historical data of successful IPsec tunnel negotiations;

[0069] If target tunnel data exists in a designated database and query data related to the target tunnel data exists, creating a structure corresponding to the target tunnel according to the query data;

[0070] Resume IPsec negotiation based on the created structure.

[0071] An embodiment of the present invention further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the IPSec tunnel recovery method described in each embodiment of the present disclosure are implemented.

[0072] It should be noted that, in this document, the terms "comprises," "includes," or any other variations thereof are intended to encompass non-exclusive inclusion, such that a process, method, article, or apparatus comprising a series of elements includes not only those elements but also other elements not explicitly listed, or elements inherent to such process, method, article, or apparatus. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of other identical elements in the process, method, article, or apparatus comprising the element.

[0073] The serial numbers of the above embodiments of the present invention are for description only and do not represent the advantages or disadvantages of the embodiments.

[0074] Through the description of the above embodiments, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus the necessary general hardware platform, and of course can also be implemented by hardware, but in many cases the former is a better embodiment. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for enabling a terminal (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present invention.

[0075] The embodiments of the present invention are described above in conjunction with the accompanying drawings, but the present invention is not limited to the above-mentioned specific implementation methods. The above-mentioned specific implementation methods are merely illustrative and not restrictive. Under the guidance of the present invention, ordinary technicians in this field can also make many forms without departing from the scope of protection of the present invention and the claims, all of which are protected by the present invention.

Claims

1. A method for restoring an IPsec tunnel, characterized in that: include: After the IPSec tunnel negotiation process is started, detecting whether a designated database contains target tunnel data through the IPSec tunnel negotiation process, wherein the designated database records historical data of successful IPSec tunnel negotiations, and obtaining the historical data includes: periodically saving, through the IPSec tunnel negotiation process, IKE SA data and IPSEC SA data of each tunnel data in the successful negotiation history, and keeping policies in a kernel SADB database and an SPDB database unchanged; If target tunnel data exists in a designated database and query data related to the target tunnel data exists, creating a structure corresponding to the target tunnel according to the query data; Resume IPsec negotiation based on the created structure.

2. The IPSec tunnel recovery method according to claim 1, wherein: The method for obtaining the historical data also includes: Calculate summary information of each tunnel data, and save the calculated summary information together with each tunnel information.

3. The IPSec tunnel recovery method according to claim 2, wherein: Before creating the structure corresponding to the target tunnel according to the query data, the method further includes: When the target tunnel data exists in the specified database, data integrity verification is performed based on the corresponding summary information.

4. The IPSec tunnel recovery method according to claim 1, wherein: The method of determining whether the query data related to the target tunnel data exists in the designated database includes: In a case where the target tunnel data exists in the designated database, corresponding query data is acquired based on the IKE SA data and the IPSEC SA data.

5. The IPSec tunnel recovery method according to claim 1, wherein: It also includes starting the monitor process at the same time as the IPsec tunnel negotiation process starts; The monitor process is configured to periodically detect whether the IPSec tunnel negotiation process is running; In the case that it is detected that the IPSec tunnel negotiation process is not running, a designated interface is called to start the negotiation process.

6. An IPsec tunnel recovery device, characterized in that: comprising a processor configured to: After the IPSec tunnel negotiation process is initiated, detecting whether a designated database contains target tunnel data through the IPSec tunnel negotiation process, wherein the designated database contains historical data of successful IPSec tunnel negotiations, and obtaining the historical data includes: periodically saving, through the IPSec tunnel negotiation process, IKE SA data and IPSEC SA data of each tunnel data in the successful negotiation history, and maintaining unchanged policies in a kernel SADB database and an SPDB database; If target tunnel data exists in a designated database and query data related to the target tunnel data exists, creating a structure corresponding to the target tunnel according to the query data; Resume IPsec negotiation based on the created structure.

7. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of the IPSec tunnel recovery method according to any one of claims 1 to 5.

Images