Vxlan packet processing method and device, electronic equipment and storage medium

Abstract

Embodiments of the present application provide a VXLAN message processing method and device, electronic equipment and storage medium, when processing service messages based on the VXLAN protocol, the service messages can be encapsulated by using an encapsulation method based on the endogenous security VXLAN protocol, and the service messages can be decapsulated by using a decapsulation method based on the endogenous security VXLAN protocol, so that the VXLAN payload can be transmitted in the form of ciphertext, and the network security device implementing the VXLAN protocol can be protected from replay attacks, thereby not only solving the problem that the traditional VXLAN protocol does not have security capabilities, but also solving the problems that the VXLAN over IPSec level is too many and the VXLAN protocol header and the UDP header are invisible to the intermediate devices in the link, and the network security device cannot quickly identify the tenant to which the message belongs, and is suitable for many VXLAN application scenarios.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data communication, and particularly relates to a VXLAN message processing method, a VXLAN message processing device, an electronic device and a computer readable storage medium. BACKGROUND

[0002] With the rapid development of Internet technology, people's demand for network is also higher and higher, in order to solve the problem of insufficient virtual network of large-scale cloud computing data center at present, VXLAN (Virtual eXtensible Local Area Network) emerges as the times require. VXLAN is a network virtualization technology, which can improve the expansion problem of large-scale cloud computing in deployment, and is an extension of VLAN (Virtual Local Area Network). Compared with VLAN, VXLAN is more powerful, which can penetrate three-layer network to expand two-layer, can expand the traffic to the third layer gateway, so as to solve the portability limitation of VMS (Virtual Memory System), so that it can access the server on the external IP (Internet Protocol) subnet.

[0003] At the same time, through VXLAN, multicast messages and broadcast messages can also be forwarded well, so that VXLAN is widely used in the communication inside the data center, the communication between data centers, the communication between heterogeneous clouds and the communication between SD-WAN POP (Software Defined-Wide Area Network Pop-Point-Of-Presence) points. Further, VXLAN is a kind of NVO3 (Network Virtualization Over Layer 3) tunnel technology, which adopts the message encapsulation mode of encapsulating two-layer message with UDP (User Datagram Protocol), therefore, using VXLAN protocol, two local area networks distributed in different geographical locations can be connected into a virtual large two-layer local area network.

[0004] Currently, the encapsulation or decapsulation of the VXLAN tunnel is completed by the VTEP (VXLAN Tunnel Endpoint, edge device of the VXLAN network), and the traditional VXLAN protocol encapsulates a VXLAN protocol header, an outer UDP layer, an outer IP layer, and an outer Ethernet header outside the original two-layer frame. Since the VXLAN protocol itself does not have security capabilities, especially when the VXLAN is applied to communication between data centers or communication between heterogeneous clouds or communication between SD-WAN POPs, the service data of the message is directly exposed in plaintext form, and in view of this problem, the current mainstream solution is to add an IPSec ESP (Internet Protocol Security Encapsulating Security Payload) tunnel encapsulation outside the VXLAN tunnel, that is, to encapsulate an ESP (Encapsulating Security Payload) header, an IP header, and an ESP tail outside the outer IP header after VXLAN encapsulation. Although this encapsulation method can encrypt and encapsulate the VXLAN payload, the message encapsulation level is high and the processing flow is long during the processing of message encapsulation and decapsulation, which leads to low processing efficiency and greatly prolongs the message recognition delay. SUMMARY

[0005] Embodiments of the present application provide a VXLAN message processing method and device, electronic equipment and computer readable storage medium to solve or partially solve the problem of long processing flow and low processing efficiency of the existing VXLAN protocol encapsulation message.

[0006] The embodiments of the present application disclose a VXLAN message processing method applied to a network security device, and the method comprises:

[0007] A first VXLAN message sent by a first network end is acquired, and the first VXLAN message comprises a security verification field, wherein the security verification field at least comprises an endogenous security flag bit, key version information, and a replay attack detection field;

[0008] If the value of the endogenous security flag bit is 1, it is determined that the first VXLAN message is a first endogenous security encapsulation message encapsulated based on an endogenous security mechanism, and target key information corresponding to the first endogenous security encapsulation message is acquired according to the key version information;

[0009] The network security device is detected for replay attack according to the replay attack detection field, and if the replay attack detection result is passed, the first endogenous security encapsulation message is processed for decapsulation by using the target key information, and corresponding target service message is obtained.

[0010] The target service message is sent to the second network terminal.

[0011] Optionally, the key version information includes at least a first VXLAN identifier field, a key validity flag, and a key version field. The step of obtaining the target key information corresponding to the first intrinsically secure encapsulated message based on the key version information includes:

[0012] At least one key information is obtained through centralized distribution, and the key information is used for encryption and decryption of messages;

[0013] If the value of the key validity flag is 1, then the target key information corresponding to the first intrinsically secure encapsulated message is retrieved from at least one of the key information by combining the first VXLAN identifier field and the key version field.

[0014] Optionally, the method further includes:

[0015] If the value of the key validity flag is 0, the target key information corresponding to the first intrinsically secure encapsulated message is retrieved from at least one of the key information using the first VXLAN identifier field.

[0016] Optionally, the step of decapsulating the first intrinsically secure encapsulated message using the target key information to obtain the corresponding target service message includes:

[0017] Based on the encryption / decryption algorithm and encryption / decryption mode of the target key information, calculate the VXLAN protocol header length of the first intrinsically secure encapsulated message, and determine the decryption start position corresponding to the first intrinsically secure encapsulated message based on the VXLAN protocol header length;

[0018] The encrypted content in the first intrinsically secure encapsulated message is decrypted using the encryption and decryption algorithm and mode of the target key information and the decryption start position to obtain the target service message corresponding to the first intrinsically secure encapsulated message.

[0019] Optionally, the first intrinsically secure encapsulated message includes at least a first VXLAN protocol header, an outer IP header, and an outer UDP header. The step of decapsulating the first intrinsically secure encapsulated message using the target key information to obtain the corresponding target service message includes:

[0020] If the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, then the first VXLAN protocol tail is decapsulated according to the encryption / decryption algorithm and encryption / decryption mode of the target key information.

[0021] Remove the outer IP header and the outer UDP header, and use the encryption / decryption algorithm and encryption / decryption mode of the target key information to remove the first VXLAN protocol header, thereby obtaining the target service message corresponding to the first intrinsically secure encapsulated message.

[0022] Optionally, if the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, then the first VXLAN protocol tail is decapsulated according to the encryption / decryption algorithm and encryption / decryption mode of the target key information, including:

[0023] If the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, and the encryption / decryption algorithm and encryption / decryption mode of the target key information determine that the first VXLAN protocol tail includes a padding data field and a padding length field, then the padding data field and the padding length field are removed.

[0024] If, based on the encryption / decryption algorithm and encryption / decryption mode of the target key information, it is determined that the first VXLAN protocol tail does not include a padding data field and a padding length field, and the first VXLAN protocol tail includes a MAC field, then the MAC field is verified.

[0025] If the verification result indicates that the verification passed, then the MAC field is removed.

[0026] Optionally, the method further includes:

[0027] If the value of the intrinsic security flag is 0, then the first VXLAN packet is determined to be a conventionally encapsulated packet based on the conventional VXLAN encapsulation method. The conventionally encapsulated packet is decapsulated to obtain the corresponding conventional service packet.

[0028] The regular service message is sent to the second network terminal.

[0029] Optionally, obtaining the first VXLAN packet sent by the first network end includes:

[0030] If the destination address of the pending service message sent by the first network terminal is consistent with the local address of the network security device, the message type of the pending service message is UDP, and the destination port of the pending service message is a VXLAN service port, then the pending service message is determined to be a first VXLAN message.

[0031] This invention also discloses a VXLAN packet processing method, applied to a network security device, the method comprising:

[0032] Obtain the service packet to be encapsulated sent by the third network terminal, and determine the VXLAN tunnel corresponding to the service packet to be encapsulated, wherein the VXLAN tunnel corresponds to the second VXLAN identifier field;

[0033] Based on the second VXLAN identifier field, obtain the encryption key information corresponding to the service message to be encapsulated;

[0034] Based on the encryption key information, the service message to be encapsulated is encapsulated using the VXLAN protocol header format based on the intrinsic security mechanism;

[0035] If the encryption / decryption algorithm in the encryption key information does not have authentication functionality, then the VXLAN protocol tail format based on intrinsic security mechanism is used to encapsulate the service message to be encapsulated to obtain the corresponding second intrinsic security encapsulated message.

[0036] The second intrinsically secure encapsulated message is subjected to VXLAN outer encapsulation processing to obtain the corresponding second VXLAN message, and the second VXLAN message is sent to the fourth network terminal.

[0037] Optionally, the step of encapsulating the service message to be encapsulated using the VXLAN protocol header format based on the encryption key information includes:

[0038] Based on the encryption key information, the second VXLAN protocol header corresponding to the service message to be encapsulated is determined. The second VXLAN protocol header includes at least an intrinsic security flag, a key validity flag, and a sequence number validity flag.

[0039] Set the intrinsic security flag and key validity flag of the second VXLAN protocol header to 1, and fill in the key version field of the second VXLAN protocol header;

[0040] If it is determined that replay attack detection is enabled when decapsulating the second target service packet, then the valid sequence number flag is set to 1 and the VXLAN sequence number field of the second VXLAN protocol header is filled in.

[0041] The second VXLAN protocol header, which has been configured, is added to the service message to be encapsulated, and then encapsulation is performed.

[0042] Optionally, the encapsulation process of the service message to be encapsulated using the VXLAN protocol tail format based on intrinsic security mechanisms to obtain the corresponding second intrinsically secure encapsulated message includes:

[0043] Based on the encryption key information, determine the second VXLAN protocol tail corresponding to the service message to be encapsulated, and fill in the MAC field of the second VXLAN protocol tail;

[0044] If the encryption / decryption algorithm of the encryption key information is an algorithm that requires field padding, then fill in the padding data field and padding length field corresponding to the second VXLAN protocol tail;

[0045] The second VXLAN protocol tail, once configured, is appended to the service message to be encapsulated, and encapsulation is performed to obtain the corresponding second intrinsically secure encapsulated message.

[0046] This invention also discloses a VXLAN packet processing device, applied to a network security device, the device comprising:

[0047] The first VXLAN packet acquisition module is used to acquire the first VXLAN packet sent by the network end. The first VXLAN packet includes a security verification field, and the security verification field includes at least an intrinsic security flag, key version information, and a replay attack detection field.

[0048] The first intrinsically secure encapsulated message determination module is used to determine that the first VXLAN message is a first intrinsically secure encapsulated message encapsulated based on the intrinsic security mechanism if the value of the intrinsic security flag bit is 1, and to obtain the target key information corresponding to the first intrinsically secure encapsulated message according to the key version information.

[0049] The decapsulation processing module is used to perform replay attack detection on the network security device according to the replay attack detection field. If the replay attack detection result is passed, the first intrinsic security encapsulation message is decapsulated using the target key information to obtain the corresponding target service message.

[0050] The target service message sending module is used to send the target service message to the second network terminal.

[0051] Optionally, the key version information includes at least a first VXLAN identifier field, a key validity flag, and a key version field, and the first intrinsically secure encapsulated message determination module includes:

[0052] The key information acquisition module is used to acquire at least one key information through centralized distribution, and the key information is used for encryption and decryption processing of messages;

[0053] The target key information retrieval module is used to retrieve the target key information corresponding to the first intrinsically secure encapsulated message from at least one of the key information if the value of the key validity judgment flag bit is 1, in conjunction with the first VXLAN identifier field and the key version field.

[0054] Optionally, the device further includes:

[0055] The target key information retrieval submodule is used to retrieve the target key information corresponding to the first intrinsically secure encapsulated message from at least one of the key information if the value of the key validity judgment flag is 0.

[0056] Optionally, the decapsulation processing module includes:

[0057] The VXLAN header length calculation module is used to calculate the VXLAN header length of the first intrinsically secure encapsulated message based on the encryption and decryption algorithm and encryption and decryption mode of the target key information, and to determine the decryption start position corresponding to the first intrinsically secure encapsulated message based on the VXLAN header length.

[0058] The target service message generation module is used to decrypt the encrypted content in the first intrinsically secure encapsulated message using the encryption and decryption algorithm and encryption and decryption mode of the target key information and the decryption start position, so as to obtain the target service message corresponding to the first intrinsically secure encapsulated message.

[0059] Optionally, the first intrinsically secure encapsulated message includes at least a first VXLAN protocol header, an outer IP header, and an outer UDP header, and the decapsulation processing module includes:

[0060] The first VXLAN protocol tail decapsulation processing module is used to decapsulate the first VXLAN protocol tail according to the encryption and decryption algorithm and encryption and decryption mode of the target key information if the first intrinsically secure encapsulated message contains the first VXLAN protocol tail.

[0061] The first VXLAN protocol header removal module is used to remove the outer IP header and the outer UDP header, and to remove the first VXLAN protocol header using the encryption and decryption algorithm and encryption and decryption mode of the target key information, so as to obtain the target service message corresponding to the first intrinsically secure encapsulated message.

[0062] Optionally, the first VXLAN protocol tail decapsulation processing module includes:

[0063] The encryption / decryption algorithm determination module is used to remove the padding data field and the padding length field if the first intrinsically secure encapsulated message contains a first VXLAN protocol tail and the encryption / decryption algorithm and encryption / decryption mode of the target key information determine that the first VXLAN protocol tail includes a padding data field and a padding length field.

[0064] The MAC field verification module is used to verify the MAC field if it is determined from the encryption and decryption algorithm and encryption and decryption mode of the target key information that the first VXLAN protocol tail does not include a padding data field and a padding length field, and the first VXLAN protocol tail includes a MAC field.

[0065] The MAC field removal module is used to remove the MAC field if the verification result indicates that the verification passed.

[0066] Optionally, the device further includes:

[0067] The regular service message generation module is used to determine that the first VXLAN message is a regular encapsulated message encapsulated based on the regular VXLAN encapsulation method if the value of the intrinsic security flag bit is 0, and to perform decapsulation processing on the regular encapsulated message to obtain the corresponding regular service message.

[0068] The regular service message sending module is used to send the regular service message to the second network terminal.

[0069] Optionally, the first VXLAN packet acquisition module is specifically used for:

[0070] If the destination address of the pending service message sent by the first network terminal is consistent with the local address of the network security device, the message type of the pending service message is UDP, and the destination port of the pending service message is a VXLAN service port, then the pending service message is determined to be a first VXLAN message.

[0071] This invention also discloses a VXLAN packet processing device, applied to a network security device, the device comprising:

[0072] The module for obtaining the service packet to be encapsulated is used to obtain the service packet to be encapsulated sent by the third network end, and determine the VXLAN tunnel corresponding to the service packet to be encapsulated, wherein the VXLAN tunnel corresponds to the second VXLAN identifier field.

[0073] The encryption key information acquisition module is used to acquire the encryption key information corresponding to the service message to be encapsulated based on the second VXLAN identifier field.

[0074] The protocol header encapsulation module is used to encapsulate the service message to be encapsulated using the VXLAN protocol header format based on the encryption key information and an intrinsic security mechanism.

[0075] The second intrinsically secure encapsulated message generation module is used to encapsulate the service message to be encapsulated using the VXLAN protocol tail format based on intrinsic security mechanism if the encryption and decryption algorithm in the encryption key information does not have authentication function, so as to obtain the corresponding second intrinsically secure encapsulated message.

[0076] The second VXLAN packet generation module is used to perform VXLAN outer encapsulation processing on the second intrinsically secure encapsulated packet to obtain the corresponding second VXLAN packet, and send the second VXLAN packet to the fourth network terminal.

[0077] Optionally, the protocol header encapsulation module includes:

[0078] The second VXLAN protocol header determination module is used to determine the second VXLAN protocol header corresponding to the service message to be encapsulated based on the encryption key information. The second VXLAN protocol header includes at least an intrinsic security flag, a key validity flag, and a sequence number validity flag.

[0079] The second VXLAN protocol header setting module is used to set the values ​​of the intrinsic security flag and the key validity judgment flag of the second VXLAN protocol header to 1, and fill in the key version field of the second VXLAN protocol header.

[0080] The replay attack detection enable module is used to set the sequence number validity judgment flag to 1 and fill in the VXLAN sequence number field of the second VXLAN protocol header if it is determined that replay attack detection is enabled when decapsulating the second target service packet.

[0081] The second VXLAN protocol header encapsulation module is used to add the configured second VXLAN protocol header to the service message to be encapsulated and perform encapsulation processing.

[0082] Optionally, the second intrinsically secure encapsulated message generation module includes:

[0083] The second VXLAN protocol tail determination module is used to determine the second VXLAN protocol tail corresponding to the service message to be encapsulated based on the encryption key information, and fill in the MAC field of the second VXLAN protocol tail.

[0084] The second VXLAN protocol tail setting module is used to fill in the padding data field and padding length field corresponding to the second VXLAN protocol tail if the encryption / decryption algorithm of the encryption key information is an algorithm that requires field padding.

[0085] The second VXLAN protocol tail encapsulation module is used to add the configured second VXLAN protocol tail to the service message to be encapsulated and perform encapsulation processing to obtain the corresponding second intrinsically secure encapsulated message.

[0086] This invention also discloses an electronic device, including a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0087] The memory is used to store computer programs;

[0088] When the processor executes a program stored in the memory, it implements the method described in the embodiments of the present invention.

[0089] This invention also discloses a computer-readable storage medium storing instructions that, when executed by one or more processors, cause the processors to perform the methods described in this invention.

[0090] The embodiments of the present invention have the following advantages:

[0091] In this embodiment of the invention, a VXLAN encapsulation protocol based on an intrinsic security mechanism and encapsulation and decapsulation methods based on the intrinsic security VXLAN protocol are provided. The encapsulation method based on the intrinsic security VXLAN protocol is used to encapsulate service packets, and the decapsulation method based on the intrinsic security VXLAN protocol is used to decapsulate service packets. This ensures that the VXLAN payload is transmitted in encrypted form and protects network security devices or apparatuses implementing the VXLAN protocol from replay attacks. Therefore, it not only solves the problem of the traditional VXLAN protocol lacking security capabilities but also addresses the issue of VXLAN overlay. This invention addresses the issues of excessive IPSec layers and the invisibility of VXLAN and UDP headers to intermediate devices in the link. It also solves the problem of network security devices being unable to quickly identify the tenant to which a packet belongs. Furthermore, the inherently secure VXLAN protocol, derived from the traditional VXLAN protocol, fundamentally endows the VXLAN protocol with the ability to secure business data without sacrificing the flexibility and inherent advantages of the traditional VXLAN protocol, such as the ability to extend Layer 2 through Layer 3 networks, the ability to forward multicast and broadcast packets, and the visibility of tenant information to devices in the link. Moreover, the inherently secure VXLAN protocol proposed in this invention is also compatible with the traditional VXLAN protocol, making it friendly for smooth upgrades to data centers and clouds. It is not only applicable to any traditional VXLAN protocol scenario but also to scenarios that require VXLAN protocol security, such as secure communication within and between data centers, especially secure communication between heterogeneous clouds and secure communication between SD-WAN POP points. Attached Figure Description

[0092] Figure 1a This is a schematic diagram of a traditional VXLAN encapsulation format;

[0093] Figure 1b A schematic diagram of a VXLAN over IPSec encapsulation format;

[0094] Figure 2 This is a schematic diagram of a VXLAN encapsulation format based on an intrinsic security mechanism provided in an embodiment of the present invention;

[0095] Figure 3a This is a schematic diagram of a VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention;

[0096] Figure 3b This is a schematic diagram of another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in this embodiment of the invention;

[0097] Figure 3c This is a schematic diagram of another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in this embodiment of the invention;

[0098] Figure 3d This is a schematic diagram of another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in this embodiment of the invention;

[0099] Figure 3e This is a schematic diagram of another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in this embodiment of the invention;

[0100] Figure 3f This is a schematic diagram of another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in this embodiment of the invention;

[0101] Figure 3g This is a schematic diagram of another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in this embodiment of the invention;

[0102] Figure 3h This is a schematic diagram of another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in this embodiment of the invention;

[0103] Figure 4 This is a flowchart of the steps of a VXLAN packet processing method provided in an embodiment of the present invention;

[0104] Figure 5 This is a schematic diagram of a process for removing the VXLAN protocol tail as needed based on the encryption / decryption algorithm and encryption / decryption mode, provided in an embodiment of the present invention;

[0105] Figure 6 This is a flowchart of another VXLAN packet processing method provided in this embodiment of the invention;

[0106] Figure 7 This is a schematic diagram of a process for encapsulating a VXLAN protocol header according to an encryption / decryption algorithm and encryption / decryption mode, provided in an embodiment of the present invention.

[0107] Figure 8 This is a schematic diagram of a process for encapsulating VXLAN protocol tails on demand according to encryption and decryption algorithms and encryption and decryption modes provided in an embodiment of the present invention;

[0108] Figure 9 This is a structural block diagram of a VXLAN packet processing device provided in an embodiment of the present invention;

[0109] Figure 10 This is a structural block diagram of another VXLAN packet processing device provided in an embodiment of the present invention;

[0110] Figure 11 This is a block diagram of an electronic device provided in an embodiment of the present invention. Detailed Implementation

[0111] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0112] As an example, VXLAN (Virtual eXtensible Local Area Network) is a network virtualization technology that improves scalability during large-scale cloud deployments. It's an extension of VLAN (Virtual Local Area Network). The encapsulation and decapsulation of VXLAN tunnels are handled by VTEP (VXLAN Tunnel Endpoint, the edge device of the VXLAN network), such as... Figure 1aThe diagram illustrates a traditional VXLAN encapsulation format. As can be seen, the traditional VXLAN protocol encapsulates a VXLAN protocol header, an outer UDP layer, an outer IP layer, and an outer Ethernet header outside the original Layer 2 frame (VXLAN payload). Since the VXLAN protocol itself lacks security capabilities, especially when VXLAN is used for communication between data centers / or between heterogeneous clouds / between SD-WAN POPs (Software Defined-Wide Area Network Pop-Point-Of-Presence), the service data of the message is directly exposed in plaintext.

[0113] The current mainstream solution to this problem is to add an IPSec ESP (Internet Protocol Security Encapsulating Security Payload) tunnel encapsulation layer outside the VXLAN tunnel, such as... Figure 1b The diagram illustrates the VXLAN over IPSec encapsulation format. It shows that an ESP (Encapsulating Security Payload) header, an IP header, and an ESP trailer are encapsulated outside the outer IP header following the VXLAN encapsulation. While this encapsulation method encrypts the VXLAN payload, it requires traversing the entire VXLAN and IPSec stacks during packet encapsulation and decapsulation. This multi-layered encapsulation process leads to low efficiency due to its lengthy processing flow. Furthermore, both the VXLAN protocol header and the UDP header encapsulated by the VXLAN protocol are encrypted as IPSec ESP protocol payloads, making them invisible to intermediate devices. Consequently, intermediate devices cannot efficiently forward packets based on information such as the VXLAN VNI (VXLAN Network Identifier) ​​and UDP source address. This compromises the network environment's Equal Cost Multiplication (ECMP) performance for VXLAN services. Features such as Path (equivalent multipath routing) also fail. For VTEP decapsulation, it is impossible to quickly identify packet tenant information and efficiently perform traffic splitting for different tenants. VTEP decapsulation must decapsulate IPSec before it can extract VXLAN VNI and identify the tenant information of the packet. However, IPSec is a very slow protocol, which greatly increases the packet identification latency.

[0114] One of the core inventive points of this invention is to provide a VXLAN encapsulation protocol based on an intrinsic security mechanism and encapsulation and decapsulation methods based on the intrinsic security VXLAN protocol. The encapsulation method based on the intrinsic security VXLAN protocol is used to encapsulate service packets, and the decapsulation method based on the intrinsic security VXLAN protocol is used to decapsulate service packets. This ensures that the VXLAN payload is transmitted in encrypted form and protects network security devices or apparatuses implementing the VXLAN protocol from replay attacks. Therefore, it not only solves the problem of the traditional VXLAN protocol lacking security capabilities but also addresses the issue of VXLAN over-the-air (VXLAN) attacks. This invention addresses the issues of excessive IPSec layers and the invisibility of VXLAN and UDP headers to intermediate devices in the link. It also solves the problem of network security devices being unable to quickly identify the tenant to which a packet belongs. Furthermore, the inherently secure VXLAN protocol, derived from the traditional VXLAN protocol, fundamentally endows the VXLAN protocol with the ability to secure business data without sacrificing the flexibility and inherent advantages of the traditional VXLAN protocol, such as the ability to extend Layer 2 through Layer 3 networks, the ability to forward multicast and broadcast packets, and the visibility of tenant information to devices in the link. Moreover, the inherently secure VXLAN protocol proposed in this invention is also compatible with the traditional VXLAN protocol, making it friendly for smooth upgrades to data centers and clouds. It is not only applicable to any traditional VXLAN protocol scenario but also to scenarios that require VXLAN protocol security, such as secure communication within and between data centers, especially secure communication between heterogeneous clouds and secure communication between SD-WAN POP points.

[0115] Reference Figure 2 The diagram illustrates a VXLAN encapsulation format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0116] In the diagram, dashed boxes indicate optional fields that will appear under specific conditions, solid boxes indicate required fields, black borders (without shaded areas) indicate traditional VXLAN protocol encapsulation format fields, and relatively light-colored borders (with shaded areas) indicate fields that have been modified or extended based on the traditional VXLAN protocol encapsulation format.

[0117] First, the reserved 6th bit of the first byte of the traditional VXLAN protocol header is designated as an intrinsic security flag, which can be named the "C flag". If the "C flag" is set to 1, it means that the message is encapsulated by the intrinsically secure VXLAN protocol provided by this invention, and the VXLAN payload (i.e., the original Layer 2 frame after the VXLAN protocol header) is encrypted and encapsulated. If the "C flag" is set to 0, it means that the message is encapsulated by the traditional VXLAN protocol.

[0118] The 7th reserved bit of the first byte of the traditional VXLAN protocol header is used as a key validity flag, which can be named "K flag". The value of "K flag" is valid when "C flag" is 1. "K flag" set to 1 means that the value of "key version" field is valid, and "K flag" set to 0 means that the value of "key version" field is invalid.

[0119] The reserved field in the 8th byte of the traditional VXLAN protocol header is used as the key version field, which can be named the "key version" field. The length of the "key version" field is 1 byte. The value of the "key version" field is valid when the "K flag" is set to 1. The "key version" field can be used to mark the round of VXLAN key. That is, every time VXLAN key is changed, the value of "key version" is incremented by 1. After the value of "key version" is incremented to the maximum value, it returns to the value of 0. Since the "key version" field occupies 1 byte, the maximum value of "key version" is (2^8)-1, that is, 255.

[0120] The reserved 8th bit of the first byte of the traditional VXLAN protocol header is used as a serial number validity flag, which can be named "S flag". The value of "S flag" is valid when "C flag" is 1. "S flag" is an optional field used in network security devices implementing the VXLAN protocol, such as VTEP devices or devices with anti-replay attack detection function. Specifically, "S flag" set to 1 means that the "serial number" field value is valid, and "S flag" set to 0 means that the "serial number" field value is invalid.

[0121] The reserved fields in bytes 2 to 4 of the traditional VXLAN protocol header are used as a sequence number field, which can be named the "Sequence Number" field. The "Sequence Number" field is 3 bytes long. The value of the "Sequence Number" field is valid when the "S flag" is 1. Specifically, the "Sequence Number" field can be used to store the sequence number of VXLAN packets. The "Sequence Number" value is incremented by 1 for each VXLAN packet encapsulation of the VTEP device or apparatus. When the value of the "Sequence Number" reaches the maximum value, it returns to the value of 0. Since the "Sequence Number" field occupies 3 bytes, the maximum value of the "Sequence Number" is (2^24)-1, that is, 16777215.

[0122] The "Sequence Number" field can be used for anti-replay attack detection. VTEP implementing the VXLAN protocol uses the four-tuple <Sequence Number, VNI, Source IP Address, UDP Source Port> for anti-replay attack checks. Specifically, the VTEP device or apparatus sets up an anti-replay attack sliding window for packet sequences with the same VNI, source IP address, and UDP source port. The presence of a replay attack is checked by the sliding behavior of the sequence number within this sliding window. For example, assuming the window size is 4, and the current window is processing the position of sequence number 10, data received with sequence numbers 11 to 14 is considered valid data. Data with sequence numbers less than 11 and greater than 14 will be discarded. If data with sequence number 12 is received, since sequence number 12 is within the range of 11 to 14, it is determined to be valid data and is received and processed normally. Afterward, the window will slide to the right to position 12, and the window size after sliding will become 13-16. It is worth noting that the window size in the above example is only an example. This invention does not limit the window size and it can be set to 64 or other values. This invention does not impose any restrictions on this.

[0123] Regarding key information, in this embodiment of the invention, the key information for encrypted communication between various VTEP devices or apparatuses in the same tenant network is obtained through centralized distribution by a third party, rather than through pairwise VTEP key negotiation. Centralized distribution by a third party includes, but is not limited to: static key distribution, loading from storage media, distribution by the controller, distribution via a key distribution protocol, and protocol distribution using the VXLAN control plane. All VTEPs in the same tenant network have identical key information, which includes, but is not limited to: key index value, encryption / decryption algorithm (including encryption / decryption mode), encryption / decryption key, and key length information. The key index value is an index of the key information, and each key index value corresponds one-to-one with the key information; a unique key information can be retrieved through the key index value.

[0124] For example, the symmetric encryption algorithms used for key information encryption and decryption include, but are not limited to, DES (Data Encryption Algorithm), 3DES (Triple Data Encryption Algorithm), AES128 (Advanced Encryption Algorithm 128), AES192 (Advanced Encryption Algorithm 192), AES256 (Advanced Encryption Algorithm 256), BLOWFISH (block encryption algorithm), TWOFISH (a symmetric encryption algorithm), SM1 (SM1 Cryptographic Algorithm), SM4 (a block cipher algorithm), CHACHA20 (a stream symmetric encryption algorithm), and SALSA20 (a stream encryption algorithm).

[0125] For example, when the encryption mode used by the encryption and decryption algorithm is CBC (Cipher Block Chaining), CTR (CounTeR mode), CFB (Cipher Feed Back mode), OFB (Output Feed Back mode), ECB (Electronic Code Book mode), or other modes that do not have AEAD (Authenticated Encryption with Associated Data, an encryption form that simultaneously possesses confidentiality, integrity, and authentication) capabilities, the key information should also include a HASH algorithm. HASH algorithms include, but are not limited to, MD5 (MD5 Message-Digest Algorithm), SHA-1 (Secure Hash Algorithm 1), SHA-256 (Secure Hash Algorithm 256), SHA-512 (Secure Hash Algorithm 512), and SM3 (a cryptographic hash function standard).

[0126] When the encryption mode used by the encryption and decryption algorithm is GCM (Galois Counter Mode, a working mode of block cipher symmetric encryption algorithm) or CCM (Counter with CBC-MAC / Counter with Cipher BlockChaining-Message Authentication Code, an algorithm mode that provides both encryption and authentication services), which has AEAD capabilities, the key information may not contain HASH algorithm information.

[0127] The encryption / decryption key is the key used to encrypt / decrypt the VXLAN payload using encryption / decryption algorithms. The key length is the same as the encryption / decryption key length. The key index value of the key information is consistent with the VXLAN VNI value. During encapsulation or decapsulation, the key information can be retrieved through the tenant VXLAN VNI. Even if the VXLAN network changes keys, the key index value will not change.

[0128] Furthermore, an initialization vector field, which can be named the "IV" field, can be added to the traditional VXLAN protocol header. This field is located after the 8th byte of the traditional VXLAN protocol header, immediately next to the "key version" field. In actual use, the "IV" field exists only as needed.

[0129] Specifically, the "IV" field exists when the encryption / decryption algorithm of the key information is an algorithm that requires an initialization vector to participate in the operation. For example, the encryption modes of the encryption algorithm that require an initialization vector to participate in the operation include, but are not limited to, CBC, CTR, GCM, CCM, etc., while the "IV" field does not exist when the encryption / decryption algorithm of the key information is an algorithm that does not require an initialization vector to participate in the operation.

[0130] The “IV” field has been lengthened to match the block length of the encryption / decryption algorithm for the key information.

[0131] Additionally, a VXLAN protocol tail can be added to the traditional VXLAN protocol. The VXLAN protocol tail contains three fields: "MAC" field (Message Authentication Code), "Padding Data" field, and "Padding Length" field. These three fields are optional; when none of the three fields are needed, the VTEP does not need to encapsulate the message with the VXLAN protocol tail.

[0132] The "MAC" field at the end of the VXLAN protocol is used to verify key matching. It is located after the VXLAN payload (original Layer 2 frame) and immediately adjacent to it. When the "MAC" field exists, it occupies 8 bytes; when it does not exist, it does not occupy space at the end of the VXLAN protocol.

[0133] Specifically, when the encryption and decryption algorithm of the key information is an algorithm with AEAD capability, the "MAC" field is not required. Algorithms with AEAD capability include, but are not limited to, block symmetric encryption algorithms using GCM, CCM, etc., and chacha20-poly1305 (a new type of encryption algorithm) stream encryption. When the encryption and decryption algorithm of the key information is an algorithm without AEAD capability, the "MAC" field is required.

[0134] The value of the “MAC” field is determined by the hash algorithm of the key information and the VXLAN payload (original Layer 2 frame). In the specific implementation, the value of the “MAC” field is the first 8 bytes of the hash result after performing a hash operation on the VXLAN payload (original Layer 2 frame) using the hash algorithm of the key information.

[0135] The purpose of the "MAC" field is to address scenarios using encryption / decryption algorithms without AEAD capabilities. In these scenarios, the decryption VTEP (Virtual Private Transfer Unit) cannot verify the correctness of the decrypted data through decryption operations. When the encapsulation VTEP and decryption VTEP lose key synchronization (i.e., the key obtained by the encapsulation VTEP is not equal to the key obtained by the decryption VTEP), the decryption VTEP uses an incorrect key for decryption. Although the decryption algorithm itself does not report an error, the returned data will be incorrect. Conversely, in scenarios using encryption / decryption algorithms with AEAD capabilities, the decryption VTEP can verify the correctness of the decrypted data through decryption operations. When key synchronization fails, the decryption VTEP uses an incorrect key for decryption, causing the decryption algorithm itself to report an error and the decryption operation to fail. Therefore, when using encryption / decryption algorithms without AEAD capabilities, the "MAC" field is needed to assist the decryption VTEP in determining whether the key used for decryption matches.

[0136] The "Padding Data" and "Padding Length" fields in the VXLAN protocol tail are located at the very end of the VXLAN message. The "Padding Data" field is located after the "MAC" field, and the "Padding Length" field is located after the "Padding Data" field. When the "Padding Data" and "Padding Length" fields exist, the "Padding Length" field occupies 1 byte, and the length of the "Padding Data" field increases. When the "Padding Data" and "Padding Length" fields do not exist, they do not occupy VXLAN protocol tail space.

[0137] When the encryption / decryption algorithm of the key information is a block symmetric encryption / decryption algorithm that requires padding to be an integer multiple of the block length, the "padding data" field and the "padding length" field must be present. For example, encryption modes that require padding to be an integer multiple of the block length include, but are not limited to, CBC, ECB, and CCM modes. However, when the encryption / decryption algorithm of the key information is a block symmetric encryption / decryption algorithm or a stream symmetric encryption / decryption algorithm that does not require padding to be an integer multiple of the block length, the "padding data" field and the "padding length" field do not need to be present.

[0138] The "padding length" field takes the number of bytes of the "padding data" field. The length of the "padding data" field is increased to the number of bytes required to padded all VXLAN payloads plus the "MAC" field (if the "MAC" field exists) into an integer multiple of the length of the symmetric encryption / decryption algorithm, minus 1.

[0139] The VXLAN protocol encryption process involves encrypting all data after concatenating the VXLAN payload (the original Layer 2 frame) with the VXLAN protocol tail (if the VXLAN protocol tail exists).

[0140] Furthermore, due to the diversity of encryption and decryption algorithm choices in the key information, the VXLAN protocol encapsulation format based on intrinsic security mechanisms proposed in this invention can be subdivided into the following eight formats:

[0141] Reference Figure 3a The diagram illustrates a VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0142] Format 1: When the encryption and decryption algorithm is an algorithm with AEAD capability, does not require initialization vectors to participate in the operation, and does not require padding, the VXLAN protocol header has no "IV" field and no VXLAN protocol tail. The encryption and decryption algorithm and encryption key are used to encrypt the VXLAN payload (original layer 2 frame).

[0143] Reference Figure 3b This illustration shows another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0144] Format 2: When the encryption / decryption algorithm is an algorithm with AEAD capability, requires initialization vectors to participate in the operation, and does not require padding, the VXLAN protocol header "IV" field must be filled in, and there is no VXLAN protocol tail. The encryption / decryption algorithm and encryption key are used to encrypt the VXLAN payload (original layer 2 frame).

[0145] Reference Figure 3c This illustration shows another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0146] Format 3: When the encryption / decryption algorithm is an algorithm with AEAD capability, does not require initialization vectors to participate in the calculation, and requires padding, the VXLAN protocol header does not have an "IV" field, and the values ​​of each field in the VXLAN protocol tail need to be filled in. The encryption / decryption algorithm and encryption key are used to encrypt the VXLAN payload (original layer 2 frame) and the VXLAN protocol tail. The VXLAN protocol tail includes a "pad data" field and a "pad length" field.

[0147] Reference Figure 3d This illustration shows another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0148] Format 4: When the encryption / decryption algorithm is an algorithm with AEAD capability, requires initialization vectors to participate in the operation, and requires padding, the VXLAN protocol header "IV" field and the VXLAN protocol tail field values ​​must be filled in. The encryption / decryption algorithm and encryption key are used to encrypt the VXLAN payload (original layer 2 frame) and the VXLAN protocol tail. The VXLAN protocol tail includes the "pad data" field and the "pad length" field.

[0149] Reference Figure 3e This illustration shows another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0150] Format 5: When the encryption / decryption algorithm is one that does not have AEAD capability, does not require initialization vectors to participate in the calculation, and does not require padding, the VXLAN protocol header does not have an "IV" field, and the values ​​of each field in the VXLAN protocol tail need to be filled in. The encryption / decryption algorithm and encryption key are used to encrypt the VXLAN payload (original Layer 2 frame) and the VXLAN protocol tail. The VXLAN protocol tail contains a "MAC" field.

[0151] Reference Figure 3f This illustration shows another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0152] Format 6: When the encryption / decryption algorithm is an algorithm that does not have AEAD capability, requires initialization vectors to participate in the operation, and does not require padding, the VXLAN protocol header "IV" field and the VXLAN protocol tail field values ​​must be filled in. The encryption / decryption algorithm and encryption key are used to encrypt the VXLAN payload (original layer 2 frame) and the VXLAN protocol tail. The VXLAN protocol tail contains the "MAC" field.

[0153] Reference Figure 3g This illustration shows another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0154] Format 7: When the encryption / decryption algorithm is an algorithm that does not have AEAD capability, does not require initialization vectors to participate in the calculation, and requires padding, the VXLAN protocol header does not have an "IV" field, and the values ​​of each field in the VXLAN protocol tail need to be filled in. The encryption / decryption algorithm and encryption key are used to encrypt the VXLAN payload (original layer 2 frame) and the VXLAN protocol tail. The VXLAN protocol tail includes a "MAC" field, a "pad data" field, and a "pad length" field.

[0155] Reference Figure 3h This illustration shows another VXLAN encapsulation subdivision format based on an intrinsic security mechanism provided in an embodiment of the present invention:

[0156] Format 8: When the encryption / decryption algorithm is one that does not have AEAD capability, requires initialization vectors to participate in the calculation, or requires padding, the VXLAN protocol header "IV" field and the values ​​of each field in the VXLAN protocol tail must be filled in. The encryption / decryption algorithm and encryption key are used to encrypt the VXLAN payload (original Layer 2 frame) and the VXLAN protocol tail. The VXLAN protocol tail includes the "MAC" field, the "pad data" field, and the "pad length" field.

[0157] This allows for the selection and setting of various fields in the VXLAN encapsulation format according to actual needs, improving the flexibility of encapsulation and decapsulation.

[0158] It should be noted that the embodiments of the present invention include, but are not limited to, the examples described above. It is understood that those skilled in the art can make further settings according to actual needs under the guidance of the ideas in the embodiments of the present invention, and the present invention does not limit such settings.

[0159] In this embodiment of the invention, a VXLAN protocol encapsulation format based on an intrinsic security mechanism is provided. By encapsulating or decapsulating packets using the intrinsically secure VXLAN protocol encapsulation format provided by this invention, the VXLAN payload can be transmitted in encrypted form. Simultaneously, network security devices or apparatuses implementing the VXLAN protocol can be protected from replay attacks. This not only solves the problem of the traditional VXLAN protocol lacking security capabilities but also addresses the issue of VXLAN overlay. This invention addresses the issues of excessive IPSec layers and the invisibility of VXLAN and UDP headers to intermediate devices in the link. It also solves the problem of network security devices being unable to quickly identify the tenant to which a packet belongs. Furthermore, the inherently secure VXLAN protocol, derived from the traditional VXLAN protocol, fundamentally endows the VXLAN protocol with the ability to secure business data without sacrificing the flexibility and inherent advantages of the traditional VXLAN protocol, such as the ability to extend Layer 2 through Layer 3 networks, the ability to forward multicast and broadcast packets, and the visibility of tenant information to devices in the link. Moreover, the inherently secure VXLAN protocol proposed in this invention is also compatible with the traditional VXLAN protocol, making it friendly for smooth upgrades to data centers and clouds. It is not only applicable to any traditional VXLAN protocol scenario but also to scenarios that require VXLAN protocol security, such as secure communication within and between data centers, especially secure communication between heterogeneous clouds and secure communication between SD-WAN POP points.

[0160] Reference Figure 4 This diagram illustrates a flowchart of a VXLAN packet processing method provided in an embodiment of the present invention, which is applied to a network security device and may specifically include the following steps:

[0161] Step 401: Obtain the first VXLAN packet sent by the first network terminal. The first VXLAN packet includes a security verification field, which includes at least an intrinsic security flag, key version information, and a replay attack detection field.

[0162] In this embodiment, the decapsulation process of VXLAN packets will be illustrated. Specifically, the network security device can be a VTEP. The VTEP can obtain the first VXLAN packet sent by the first network end. The first VXLAN packet includes a security verification field, which includes at least an intrinsic security flag (i.e., the "C flag" in the VXLAN protocol header in the aforementioned embodiment), key version information, and a replay attack detection field. Thus, the security verification field can be used to verify the service packets in the subsequent decapsulation process to implement more targeted packet decapsulation processing.

[0163] In practical applications, service packets can be encapsulated based on different protocols. VTEP can also receive service packets from different tenants in the network. Before processing the service packets, VTEP needs to confirm whether the received service packets are service packets encapsulated based on VXLAN. If the destination address of the packet is the local address, the packet is a UDP packet, and the UDP destination port is a VXLAN service port, then the packet is identified as a VXLAN tunnel encapsulated packet. At this time, the outer IP header and UDP of the packet can be removed, and the next step of the VXLAN decapsulation process can be entered.

[0164] In a specific implementation, obtaining the first VXLAN packet sent by the network end can be achieved by: receiving the pending service packet sent by the network end; if the destination address of the pending service packet is consistent with the local address of the network security device, the packet type of the pending service packet is UDP, and the destination port of the pending service packet is a VXLAN service port, then the pending service packet is determined to be the first VXLAN packet. By confirming some information in the service packet, service packets based on VXLAN encapsulation can be filtered out, thus accelerating the packet processing efficiency.

[0165] Step 402: If the value of the intrinsic security flag is 1, then the first VXLAN packet is determined to be a first intrinsic security encapsulated packet based on the intrinsic security mechanism, and the target key information corresponding to the first intrinsic security encapsulated packet is obtained according to the key version information.

[0166] Specifically, if the intrinsic security flag is 1, the first VXLAN packet is determined to be a first intrinsic security encapsulated packet based on the intrinsic security mechanism, and the target key information corresponding to the first intrinsic security encapsulated packet is obtained according to the key version information, so as to realize the decapsulation processing of the service packet according to the target key information.

[0167] VTEPs can obtain key information through centralized distribution by a third party, rather than through pairwise VTEP key negotiation. Centralized distribution methods include, but are not limited to: static key distribution, loading from storage media, distribution by the controller, distribution through a key distribution protocol, and protocol distribution using the VXLAN control plane.

[0168] Next, the VTEP can extract the "C flag" value (i.e., the intrinsic security flag) of the VXLAN protocol header of the first VXLAN message. If the "C flag" value is 1, it indicates that the message is a VXLAN message encapsulated based on the intrinsic security mechanism provided by this invention. In this case, the intrinsic security decapsulation method is used to decapsulate it. If the "C flag" value is 0, that is, the intrinsic security flag value is 0, it indicates that the message is a VXLAN message encapsulated in the traditional way. In this case, it is determined that the original service message is a conventionally encapsulated message based on the conventional VXLAN encapsulation method. The conventionally encapsulated message can then be decapsulated using the conventional VXLAN protocol decapsulation method to obtain the corresponding conventional service message. The conventional service message is then sent to the second network end. Thus, the intrinsic security flag can be used to determine whether the service message is encapsulated based on the intrinsic security mechanism, and the corresponding decapsulation method can be used to process it according to the determination result, thereby improving processing efficiency.

[0169] If an intrinsically secure decapsulation method is used for decapsulation, the VTEP can extract the "VNI" field (VXLAN identifier field), the "K flag" (key validity flag), and the "key version" field from the VXLAN protocol header of the first VXLAN message, and retrieve the obtained key information. Specifically, if the "K flag" value is 1, the "key version" field of the VXLAN protocol header is further extracted, and the key information used to decrypt this service message is retrieved by combining the "VNI" field value and the "key version" field value. If the "K flag" value is 0, the key information used to decrypt this original service message is retrieved by using the "VNI" field value. If the key information retrieval fails, the message is discarded, and the process ends.

[0170] In a specific implementation, the key version information may include at least a first VXLAN identifier field, a key validity flag, and a key version field. Obtaining the target key information corresponding to the first intrinsically secure encapsulated message based on the key version information can be achieved by: obtaining at least one key information through centralized distribution. This key information is used for encryption and decryption of the message. If the key validity flag is 1, the first VXLAN identifier field and the key version field are used together to retrieve the target key information corresponding to the first intrinsically secure encapsulated message from the at least one key information. If the key validity flag is 0, the first VXLAN identifier field is used to retrieve the target key information corresponding to the first intrinsically secure encapsulated message from the at least one key information. Thus, the key information corresponding to the message can be determined through some fields in the VXLAN protocol header, enabling subsequent decapsulation processing of the message.

[0171] Step 403: Perform replay attack detection on the network security device according to the replay attack detection field. If the replay attack detection result is passed, use the target key information to decapsulate the first intrinsic security encapsulated message to obtain the corresponding target service message.

[0172] Before decapsulation, VTEP can extract the "Sequence Number" field of the VXLAN protocol header, the source address of the IP header, and the source port of the UDP header. Combined with the <Sequence Number, Source Address, Source Port, VNI> quadruple, it performs replay attack detection. If the replay attack detection result is successful, the packet decapsulation process continues. If the replay attack detection result is an attack, the packet is discarded and the process ends.

[0173] In specific implementations, the replay attack detection field includes the source IP address of the original service message, the source UDP port of the message, and the VXLAN sequence number field. Therefore, replay attack detection on network security devices based on the replay attack detection field can be achieved by: extracting the first VXLAN identifier field of the key version information, and combining the first VXLAN identifier field, the source IP address of the message, the source UDP port of the message, and the VXLAN sequence number field to perform replay attack detection on the network security device VTEP. This allows for replay attack detection on the network security device VTEP through the replay attack detection field, ensuring that the received service messages are free from abnormal risks.

[0174] Next, the VTEP can calculate the length of the VXLAN protocol header based on the encryption / decryption algorithm and mode in the key information. Specifically, it determines whether the VXLAN protocol header contains an "IV" field by checking if the encryption / decryption algorithm in the key information requires an initialization vector to participate in the operation. If the encryption / decryption algorithm requires an initialization vector to participate in the operation, the VXLAN protocol header contains an "IV" field, and the total length of the VXLAN protocol header is 8 bytes plus the length of the initialization vector corresponding to the encryption / decryption algorithm. If the encryption / decryption algorithm does not require an initialization vector to participate in the operation, the VXLAN protocol header does not contain an "IV" field, and the total length of the VXLAN protocol header is 8 bytes.

[0175] The process of decapsulating the first intrinsically secure encapsulated message using the target key information to obtain the corresponding target service message can be as follows: Calculate the VXLAN header length of the first intrinsically secure encapsulated message based on the encryption / decryption algorithm and encryption / decryption mode of the target key information, determine the decryption start position corresponding to the first intrinsically secure encapsulated message based on the VXLAN header length, and then decrypt the encrypted content in the first intrinsically secure encapsulated message using the encryption / decryption algorithm and encryption / decryption mode of the target key information and the decryption start position to obtain the target service message corresponding to the first intrinsically secure encapsulated message.

[0176] As an optional embodiment, the first intrinsically secure encapsulated message includes at least a first VXLAN protocol header, an outer IP header, and an outer UDP header. Then, the target key information is used to decapsulate the first intrinsically secure encapsulated message to obtain the corresponding target service message. This can be done as follows: If the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, the first VXLAN protocol tail is decapsulated according to the encryption / decryption algorithm and encryption / decryption mode of the target key information. Then, the outer IP header and outer UDP header are removed, and the first VXLAN protocol header is removed using the encryption / decryption algorithm and encryption / decryption mode of the target key information to obtain the target service message corresponding to the first intrinsically secure encapsulated message. The encryption / decryption algorithm and encryption / decryption mode related content of the key information are described in detail in the aforementioned VXLAN protocol format of the intrinsic security mechanism, and will not be repeated here.

[0177] Furthermore, if the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, then the first VXLAN protocol tail is decapsulated according to the encryption / decryption algorithm and encryption / decryption mode of the target key information. This can be done as follows: If the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, and the encryption / decryption algorithm and encryption / decryption mode of the target key information determine that the first VXLAN protocol tail includes a padding data field and a padding length field, then the padding data field and the padding length field are removed. If the encryption / decryption algorithm and encryption / decryption mode of the target key information determine that the first VXLAN protocol tail does not include a padding data field and a padding length field, and the first VXLAN protocol tail includes a MAC field, then the MAC field is verified. If the verification result indicates that the verification passed, then the MAC field is removed.

[0178] In a specific implementation, VTEP can decrypt the VXLAN encrypted payload according to the encryption and decryption algorithm in the key information. The decrypted data contains the original VXLAN payload (original Layer 2 frame) and may contain the VXLAN protocol tail.

[0179] When the encryption / decryption algorithm is an algorithm with AEAD capability and no padding required, the decrypted data does not contain the VXLAN protocol tail. In this case, there is no need to perform VXLAN protocol tail removal operation, and all decrypted data belongs to the original VXLAN payload (original layer 2 frame).

[0180] If the decrypted data contains a VXLAN protocol tail, the VXLAN protocol tail can be decapsulated as needed based on the encryption / decryption algorithm in the key information.

[0181] For example, refer to Figure 5 This illustration shows a flowchart of a method for removing VXLAN protocol tails on demand based on encryption / decryption algorithms and encryption / decryption modes, provided in an embodiment of the present invention.

[0182] S501: Determine whether the encryption / decryption algorithm is one that requires padding;

[0183] By determining whether the encryption / decryption algorithm is one that requires padding, it can be determined whether the VXLAN protocol tail contains a padding data field and a padding length field.

[0184] If the encryption / decryption algorithm is an algorithm that requires padding, then the VXLAN protocol tail contains a padding data field and a padding length field, and then jump to S502;

[0185] If the encryption / decryption algorithm is a no-padding algorithm, then the VXLAN protocol tail does not contain a padding data field or a padding length field, and then jumps to S503;

[0186] S502: Remove the padding data field and padding length field from the VXLAN protocol tail;

[0187] Specifically, the last byte of the decrypted data is parsed, which is the VXLAN protocol tail padding length field. Let the padding length field value be n. Then, the (n+1)th byte to the second-to-last byte of the decrypted data is parsed, which is the VXLAN protocol tail padding data field. Then, the last (n+1) bytes of the decrypted data are removed, completing the removal of the VXLAN protocol tail padding data field and padding length field. The remaining decrypted data is the original VXLAN payload (original Layer 2 frame).

[0188] S503: Determine whether the encryption / decryption algorithm has AEAD capability;

[0189] By determining whether the encryption / decryption algorithm has AEAD capability, it can be determined whether the VXLAN protocol tail contains a MAC field.

[0190] If the encryption / decryption algorithm does not have AEAD capability, the VXLAN protocol tail contains a MAC field, and it jumps to S504.

[0191] If the encryption / decryption algorithm has AEAD capability, the VXLAN protocol tail does not contain a MAC field, and it jumps to S505.

[0192] S504: Remove the MAC field from the VXLAN protocol tail and verify the correctness of the MAC field;

[0193] First, the last 8 bytes of the decrypted data, after removing the padding data field and the padding length field, are parsed. This is the VXLAN protocol tail MAC field. Then, the VXLAN protocol tail MAC field is removed. At this point, all fields of the VXLAN protocol tail have been removed, and the remaining decrypted data is the original VXLAN payload (original Layer 2 frame).

[0194] Then, the HASH algorithm in the key information is used to perform a HASH operation on the decrypted data after stripping the VXLAN protocol tail. The first 8 bytes of the HASH operation result are extracted and compared with the last 8 bytes of the decrypted data. If they are equal, the authentication is successful. If they are not equal, the authentication is unsuccessful, indicating that the VTEP of the encapsulation party and the VTEP of the decapsulation party have lost synchronization or that the data has changed during transmission. The message is then discarded and the process ends.

[0195] S505: Remove the VXLAN protocol header and forward the decapsulated VXLAN original payload (original Layer 2 frame).

[0196] Step 404: Send the target service message to the second network terminal.

[0197] After the VTEP removes the VXLAN protocol header from the service message, it can forward the decapsulated original payload (original Layer 2 frame), which means the target service message can be sent to the second network end.

[0198] It should be noted that the embodiments of the present invention include, but are not limited to, the examples described above. It is understood that those skilled in the art can make further settings according to actual needs under the guidance of the ideas in the embodiments of the present invention, and the present invention does not limit such settings.

[0199] In this embodiment of the invention, during the decapsulation of service packets encapsulated based on the VXLAN protocol, a decapsulation method based on the intrinsically secure VXLAN protocol is used to decapsulate the service packets. This ensures that the VXLAN payload is transmitted in encrypted form and protects network security devices or apparatuses implementing the VXLAN protocol from replay attacks. Therefore, it not only solves the problem of the traditional VXLAN protocol lacking security capabilities but also addresses the issue of VXLAN over-the-air (VXLAN) attacks. This invention addresses the issues of excessive IPSec layers and the invisibility of VXLAN and UDP headers to intermediate devices in the link. It also solves the problem of network security devices being unable to quickly identify the tenant to which a packet belongs. Furthermore, the inherently secure VXLAN protocol, derived from the traditional VXLAN protocol, fundamentally endows the VXLAN protocol with the ability to secure business data without sacrificing the flexibility and inherent advantages of the traditional VXLAN protocol, such as the ability to extend Layer 2 through Layer 3 networks, the ability to forward multicast and broadcast packets, and the visibility of tenant information to devices in the link. Moreover, the inherently secure VXLAN protocol proposed in this invention is also compatible with the traditional VXLAN protocol, making it friendly for smooth upgrades to data centers and clouds. It is not only applicable to any traditional VXLAN protocol scenario but also to scenarios that require VXLAN protocol security, such as secure communication within and between data centers, especially secure communication between heterogeneous clouds and secure communication between SD-WAN POP points.

[0200] Reference Figure 6 This diagram illustrates a flowchart of another VXLAN packet processing method provided in an embodiment of the present invention, which is applied to a network security device and may specifically include the following steps:

[0201] Step 601: Obtain the service packet to be encapsulated sent by the third network terminal, and determine the VXLAN tunnel corresponding to the service packet to be encapsulated, wherein the VXLAN tunnel corresponds to the second VXLAN identifier field;

[0202] In this embodiment, the encapsulation process of VXLAN packets will be illustrated. Specifically, the network security device can be a VTEP. The VTEP can obtain the service packet to be encapsulated sent by the third network end and determine the VXLAN tunnel corresponding to the service packet to be encapsulated. The VXLAN tunnel corresponds to the second VXLAN identifier field.

[0203] Specifically, the VTEP can receive service packets from different tenants in the backend network, query the Layer 2 forwarding table, select the tenant's VXLAN tunnel, and then the VTEP can extract the VNI identifier field of the VXLAN tunnel so that the encryption key information used to encrypt this service packet can be retrieved in subsequent processing using the VNI identifier field value.

[0204] Step 602: Obtain the encryption key information corresponding to the service message to be encapsulated based on the second VXLAN identifier field;

[0205] Similarly, VTEPs can obtain key information through centralized distribution by a third party, without obtaining it through pairwise VTEP key negotiation. Centralized distribution methods include, but are not limited to: static key distribution, loading from storage media, distribution by the controller, distribution through a key distribution protocol, and protocol distribution using the VXLAN control plane.

[0206] In a specific implementation, at least one key information can be obtained through centralized distribution, and the encryption key information corresponding to the service message to be encapsulated can be retrieved from the at least one key information using the second VXLAN identifier field, so as to realize the encapsulation processing of the service message based on the encryption key information.

[0207] Step 603: Based on the encryption key information, encapsulate the service message to be encapsulated using the VXLAN protocol header format based on the intrinsic security mechanism;

[0208] In the specific implementation, based on the encryption key information, the VXLAN protocol header format based on the intrinsic security mechanism is used to encapsulate the service message to be encapsulated. This can be done as follows: Based on the encryption key information, the second VXLAN protocol header corresponding to the service message to be encapsulated is determined. The second VXLAN protocol header includes at least an intrinsic security flag, a key validity flag, and a sequence number validity flag. Then, the values ​​of the intrinsic security flag and the key validity flag of the second VXLAN protocol header are both set to 1, and the key version field of the second VXLAN protocol header is filled in. If it is determined from the encryption key information that replay attack detection needs to be enabled when decapsulating the second target service message, the sequence number validity flag is set to 1, and the VXLAN sequence number field of the second VXLAN protocol header is filled in. Then, the second VXLAN protocol header with the settings completed is added to the service message to be encapsulated, and encapsulation processing is performed.

[0209] When encapsulating messages, the VTEP can encapsulate the VXLAN protocol header of the message according to the encryption / decryption algorithm and encryption / decryption mode in the key information. For example, refer to... Figure 7 This illustration shows a flowchart of encapsulating a message VXLAN protocol header according to an encryption / decryption algorithm and encryption / decryption mode, provided in an embodiment of the present invention. The VXLAN protocol header format in this example is the intrinsically secure VXLAN protocol header format mentioned in the previous embodiments.

[0210] S701: Set the C flag bit in the VXLAN protocol header to 1;

[0211] S702: Set the K flag bit in the VXLAN protocol header to 1, and fill in the key version field of the VXLAN protocol header with the key version extracted from the key information;

[0212] S703: Determine whether the VTEP has enabled the anti-replay attack detection function. If enabled, set the S flag bit of the VXLAN protocol header to 1 and fill in the sequence number field for the VXLAN protocol header.

[0213] S704: An algorithm to determine whether the encryption / decryption algorithm in the key information requires the initialization vector to participate in the operation. If the initialization vector is required, the IV field is filled in the VXLAN protocol header, and the length of the initialization vector field becomes longer, consistent with the block length of the encryption / decryption algorithm.

[0214] Therefore, the VXLAN protocol header format based on the intrinsic security mechanism provided by the embodiments of the present invention can be used to encapsulate the service message to be encapsulated, making the message encapsulated based on the VXLAN protocol more secure.

[0215] Step 604: If the encryption and decryption algorithm in the encryption key information does not have authentication function, the VXLAN protocol tail format based on the intrinsic security mechanism is used to encapsulate the service message to be encapsulated to obtain the corresponding second intrinsic security encapsulated message.

[0216] Specifically, if the encryption / decryption algorithm in the encryption key information does not have authentication functionality, the VXLAN protocol tail format based on intrinsic security mechanisms is used to encapsulate the service message to be encapsulated, obtaining the corresponding second intrinsically secure encapsulated message. Further, encapsulating the service message to be encapsulated using the VXLAN protocol tail format based on intrinsic security mechanisms to obtain the corresponding second intrinsically secure encapsulated message can be achieved by: determining the second VXLAN protocol tail corresponding to the service message to be encapsulated based on the encryption key information, filling in the MAC field of the second VXLAN protocol tail; if the encryption / decryption algorithm in the encryption key information is an algorithm requiring field padding, then filling in the padding data field and padding length field corresponding to the second VXLAN protocol tail; adding the configured second VXLAN protocol tail to the service message to be encapsulated, and performing encapsulation processing to obtain the corresponding second intrinsically secure encapsulated message. This allows for on-demand encapsulation of the VXLAN protocol tail based on actual needs, making message encapsulation more flexible.

[0217] In specific implementations, when the encryption / decryption algorithm in the encryption key information is an algorithm with AEAD capability and no padding required, there is no need to encapsulate the VXLAN protocol tail. When the VXLAN protocol tail needs to be encapsulated, the VTEP can encapsulate the VXLAN protocol tail as needed according to the encryption / decryption algorithm in the encryption key information. Then, the VTEP can encrypt the VXLAN payload and the VXLAN protocol tail (if the VXLAN protocol tail exists) according to the encryption / decryption algorithm in the encryption key information to obtain the corresponding second intrinsically secure encapsulated message.

[0218] For example, refer to Figure 8 The diagram illustrates a process for on-demand encapsulation of VXLAN protocol trailers based on encryption / decryption algorithms and modes, as provided in an embodiment of the present invention.

[0219] S801: Determine whether the encryption / decryption algorithm has AEAD capability. If it has AEAD capability, there is no need to fill in the VXLAN protocol tail MAC field. If it does not have AEAD capability, the VXLAN protocol tail MAC field must be filled in.

[0220] The MAC field occupies 8 bytes. The calculation method is as follows: use the HASH algorithm in the key information to perform a HASH operation on the VXLAN payload, and then extract the first 8 bytes of the HASH operation result.

[0221] S802: Determine whether the encryption / decryption algorithm is an algorithm that requires padding. If it is an algorithm that requires padding, the VXLAN protocol tail padding data field and padding length field must be filled in. If it is an algorithm that does not require padding, the VXLAN protocol tail padding data field and padding length field do not need to be filled in.

[0222] The padding data field has an increased length, occupying a length that is one less than the number of bytes required to concatenate the VXLAN payload and the MAC field (if the MAC field is required) in the VXLAN protocol tail and pad it to an integer multiple of the length of the symmetric encryption / decryption algorithm. The padding length field occupies 1 byte and takes the length of the padding data field. The values ​​of each byte in the padding data field can be selected in various ways, including but not limited to random numbers, all zeros, and ordered sequence values.

[0223] It should be noted that the above two steps are merely simple illustrative examples. Those skilled in the art can flexibly set the various relevant fields of the VXLAN protocol tail according to the actual situation. It is understood that the present invention does not impose any limitations on this.

[0224] Step 605: Perform VXLAN outer encapsulation processing on the second intrinsically secure encapsulated message to obtain the corresponding second VXLAN message, and send the second VXLAN message to the fourth network terminal.

[0225] Finally, the second intrinsically secure encapsulated message can be encapsulated with a VXLAN outer layer to obtain the corresponding second VXLAN message, and then the second VXLAN message can be sent to the fourth network end. For example, the VTEP can encapsulate the VXLAN outer UDP header and IP header, and then forward the message.

[0226] It should be noted that the embodiments of the present invention include, but are not limited to, the examples described above. It is understood that those skilled in the art can make further settings according to actual needs under the guidance of the ideas in the embodiments of the present invention, and the present invention does not limit such settings.

[0227] In this embodiment of the invention, during the encapsulation of service packets based on the VXLAN protocol, an encapsulation method based on the intrinsically secure VXLAN protocol is used to encapsulate the service packets. This ensures that the VXLAN payload is transmitted in encrypted form and protects network security devices or apparatuses implementing the VXLAN protocol from replay attacks. Therefore, it not only solves the problem of the traditional VXLAN protocol lacking security capabilities but also addresses the issue of VXLAN over-the-air (VXLAN) attacks. This invention addresses the issues of excessive IPSec layers and the invisibility of VXLAN and UDP headers to intermediate devices in the link. It also solves the problem of network security devices being unable to quickly identify the tenant to which a packet belongs. Furthermore, the inherently secure VXLAN protocol, derived from the traditional VXLAN protocol, fundamentally endows the VXLAN protocol with the ability to secure business data without sacrificing the flexibility and inherent advantages of the traditional VXLAN protocol, such as the ability to extend Layer 2 through Layer 3 networks, the ability to forward multicast and broadcast packets, and the visibility of tenant information to devices in the link. Moreover, the inherently secure VXLAN protocol proposed in this invention is also compatible with the traditional VXLAN protocol, making it friendly for smooth upgrades to data centers and clouds. It is not only applicable to any traditional VXLAN protocol scenario but also to scenarios that require VXLAN protocol security, such as secure communication within and between data centers, especially secure communication between heterogeneous clouds and secure communication between SD-WAN POP points.

[0228] It should be noted that, for the sake of simplicity, the method embodiments are all described as a series of actions. However, those skilled in the art should understand that the embodiments of the present invention are not limited to the described order of actions, because according to the embodiments of the present invention, some steps can be performed in other orders or simultaneously. Furthermore, those skilled in the art should also understand that the embodiments described in the specification are preferred embodiments, and the actions involved are not necessarily essential to the embodiments of the present invention.

[0229] Reference Figure 9 This diagram illustrates a structural block diagram of a VXLAN packet processing device provided in an embodiment of the present invention. Applied to network security devices, it may specifically include the following modules:

[0230] The first VXLAN packet acquisition module 901 is used to acquire the first VXLAN packet sent by the first network end. The first VXLAN packet includes a security verification field, and the security verification field includes at least an intrinsic security flag, key version information and a replay attack detection field.

[0231] The first intrinsically secure encapsulated message determination module 902 is used to determine that the first VXLAN message is a first intrinsically secure encapsulated message encapsulated based on the intrinsic security mechanism if the value of the intrinsic security flag bit is 1, and to obtain the target key information corresponding to the first intrinsically secure encapsulated message according to the key version information.

[0232] The decapsulation processing module 903 is used to perform replay attack detection on the network security device according to the replay attack detection field. If the replay attack detection result is passed, the first intrinsic security encapsulation message is decapsulated using the target key information to obtain the corresponding target service message.

[0233] The target service message sending module 904 is used to send the target service message to the second network terminal.

[0234] In one optional embodiment, the key version information includes at least a first VXLAN identifier field, a key validity determination flag, and a key version field, and the first intrinsically secure encapsulated message determination module 902 includes:

[0235] The key information acquisition module is used to acquire at least one key information through centralized distribution, and the key information is used for encryption and decryption processing of messages;

[0236] The target key information retrieval module is used to retrieve the target key information corresponding to the first intrinsically secure encapsulated message from at least one of the key information if the value of the key validity judgment flag bit is 1, in conjunction with the first VXLAN identifier field and the key version field.

[0237] In one alternative embodiment, the device further includes:

[0238] The target key information retrieval submodule is used to retrieve the target key information corresponding to the first intrinsically secure encapsulated message from at least one of the key information if the value of the key validity judgment flag is 0.

[0239] In one optional embodiment, the decapsulation processing module 903 includes:

[0240] The VXLAN header length calculation module is used to calculate the VXLAN header length of the first intrinsically secure encapsulated message based on the encryption and decryption algorithm and encryption and decryption mode of the target key information, and to determine the decryption start position corresponding to the first intrinsically secure encapsulated message based on the VXLAN header length.

[0241] The target service message generation module is used to decrypt the encrypted content in the first intrinsically secure encapsulated message using the encryption and decryption algorithm and encryption and decryption mode of the target key information and the decryption start position, so as to obtain the target service message corresponding to the first intrinsically secure encapsulated message.

[0242] In one optional embodiment, the first intrinsically secure encapsulated message includes at least a first VXLAN protocol header, an outer IP header, and an outer UDP header, and the decapsulation processing module 903 includes:

[0243] The first VXLAN protocol tail decapsulation processing module is used to decapsulate the first VXLAN protocol tail according to the encryption and decryption algorithm and encryption and decryption mode of the target key information if the first intrinsically secure encapsulated message contains the first VXLAN protocol tail.

[0244] The first VXLAN protocol header removal module is used to remove the outer IP header and the outer UDP header, and to remove the first VXLAN protocol header using the encryption and decryption algorithm and encryption and decryption mode of the target key information, so as to obtain the target service message corresponding to the first intrinsically secure encapsulated message.

[0245] In one optional embodiment, the first VXLAN protocol tail decapsulation processing module includes:

[0246] The encryption / decryption algorithm determination module is used to remove the padding data field and the padding length field if the first intrinsically secure encapsulated message contains a first VXLAN protocol tail and the encryption / decryption algorithm and encryption / decryption mode of the target key information determine that the first VXLAN protocol tail includes a padding data field and a padding length field.

[0247] The MAC field verification module is used to verify the MAC field if it is determined from the encryption and decryption algorithm and encryption and decryption mode of the target key information that the first VXLAN protocol tail does not include a padding data field and a padding length field, and the first VXLAN protocol tail includes a MAC field.

[0248] The MAC field removal module is used to remove the MAC field if the verification result indicates that the verification passed.

[0249] In one alternative embodiment, the device further includes:

[0250] The regular service message generation module is used to determine that the first VXLAN message is a regular encapsulated message encapsulated based on the regular VXLAN encapsulation method if the value of the intrinsic security flag bit is 0, and to perform decapsulation processing on the regular encapsulated message to obtain the corresponding regular service message.

[0251] The regular service message sending module is used to send the regular service message to the second network terminal.

[0252] In one optional embodiment, the first VXLAN packet acquisition module 901 is specifically used for:

[0253] If the destination address of the pending service message sent by the first network terminal is consistent with the local address of the network security device, the message type of the pending service message is UDP, and the destination port of the pending service message is a VXLAN service port, then the pending service message is determined to be a first VXLAN message.

[0254] Reference Figure 10 This diagram illustrates a structural block diagram of another VXLAN packet processing device provided in an embodiment of the present invention, which is applied to network security devices and may specifically include the following modules:

[0255] The un-encapsulated service packet acquisition module 1001 is used to acquire the un-encapsulated service packet sent by the third network end, and determine the VXLAN tunnel corresponding to the un-encapsulated service packet, wherein the VXLAN tunnel corresponds to the second VXLAN identifier field.

[0256] The encryption key information acquisition module 1002 is used to acquire the encryption key information corresponding to the service message to be encapsulated based on the second VXLAN identifier field.

[0257] The protocol header encapsulation module 1003 is used to encapsulate the service message to be encapsulated using the VXLAN protocol header format based on the encryption key information and an intrinsic security mechanism.

[0258] The second intrinsically secure encapsulated message generation module 1004 is used to encapsulate the service message to be encapsulated using the VXLAN protocol tail format based on intrinsic security mechanism if the encryption and decryption algorithm in the encryption key information does not have authentication function, so as to obtain the corresponding second intrinsically secure encapsulated message.

[0259] The second VXLAN packet generation module 1005 is used to perform VXLAN outer encapsulation processing on the second intrinsically secure encapsulated packet to obtain the corresponding second VXLAN packet, and send the second VXLAN packet to the fourth network terminal.

[0260] In one optional embodiment, the protocol header encapsulation module 1003 includes:

[0261] The second VXLAN protocol header determination module is used to determine the second VXLAN protocol header corresponding to the service message to be encapsulated based on the encryption key information. The second VXLAN protocol header includes at least an intrinsic security flag, a key validity flag, and a sequence number validity flag.

[0262] The second VXLAN protocol header setting module is used to set the values ​​of the intrinsic security flag and the key validity judgment flag of the second VXLAN protocol header to 1, and fill in the key version field of the second VXLAN protocol header.

[0263] The replay attack detection enable module is used to set the sequence number validity judgment flag to 1 and fill in the VXLAN sequence number field of the second VXLAN protocol header if it is determined that replay attack detection is enabled when decapsulating the second target service packet.

[0264] The second VXLAN protocol header encapsulation module is used to add the configured second VXLAN protocol header to the service message to be encapsulated and perform encapsulation processing.

[0265] In one optional embodiment, the second intrinsically secure encapsulated message generation module 1004 includes:

[0266] The second VXLAN protocol tail determination module is used to determine the second VXLAN protocol tail corresponding to the service message to be encapsulated based on the encryption key information, and fill in the MAC field of the second VXLAN protocol tail.

[0267] The second VXLAN protocol tail setting module is used to fill in the padding data field and padding length field corresponding to the second VXLAN protocol tail if the encryption / decryption algorithm of the encryption key information is an algorithm that requires field padding.

[0268] The second VXLAN protocol tail encapsulation module is used to add the configured second VXLAN protocol tail to the service message to be encapsulated and perform encapsulation processing to obtain the corresponding second intrinsically secure encapsulated message.

[0269] As the device embodiment is basically similar to the method embodiment, the description is relatively simple, and relevant parts can be found in the description of the method embodiment.

[0270] In addition, this invention also provides an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor. When the computer program is executed by the processor, it implements the various processes of the above-described VXLAN message processing method embodiments and achieves the same technical effect. To avoid repetition, it will not be described again here.

[0271] This invention also provides a computer-readable storage medium storing a computer program. When executed by a processor, the computer program implements the various processes of the above-described VXLAN message processing method embodiments and achieves the same technical effects. To avoid repetition, it will not be described again here. The computer-readable storage medium may be a read-only memory (ROM), a random access memory (RAM), a magnetic disk, or an optical disk.

[0272] Figure 11 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0273] The electronic device 1100 includes, but is not limited to, components such as: a radio frequency unit 1101, a network module 1102, an audio output unit 1103, an input unit 1104, a sensor 1105, a display unit 1106, a user input unit 1107, an interface unit 1108, a memory 1109, a processor 1110, and a power supply 1111. Those skilled in the art will understand that the electronic device structure involved in the embodiments of the present invention does not constitute a limitation on the electronic device. An electronic device may include more or fewer components than illustrated, or combine certain components, or have different component arrangements. In the embodiments of the present invention, the electronic device includes, but is not limited to, mobile phones, tablet computers, laptop computers, PDAs, in-vehicle terminals, wearable devices, and pedometers.

[0274] It should be understood that, in this embodiment of the invention, the radio frequency unit 1101 can be used for receiving and transmitting signals during information transmission or calls. Specifically, it receives downlink data from the base station and processes it with the processor 1110; additionally, it transmits uplink data to the base station. Typically, the radio frequency unit 1101 includes, but is not limited to, an antenna, at least one amplifier, a transceiver, a coupler, a low-noise amplifier, a duplexer, etc. Furthermore, the radio frequency unit 1101 can also communicate with networks and other devices through a wireless communication system.

[0275] The electronic device provides users with wireless broadband internet access through network module 1102, such as helping users send and receive emails, browse web pages, and access streaming media.

[0276] The audio output unit 1103 can convert audio data received by the radio frequency unit 1101 or the network module 1102 or stored in the memory 1109 into audio signals and output them as sound. Furthermore, the audio output unit 1103 can also provide audio output related to specific functions performed by the electronic device 1100 (e.g., call signal reception sound, message reception sound, etc.). The audio output unit 1103 includes a speaker, a buzzer, and a receiver, etc.

[0277] Input unit 1104 is used to receive audio or video signals. Input unit 1104 may include a graphics processing unit (GPU) 11041 and a microphone 11042. GPU 11041 processes image data of still images or videos acquired by an image capture device (such as a camera) in video capture mode or image capture mode. The processed image frames can be displayed on display unit 1106. The image frames processed by GPU 11041 can be stored in memory 1109 (or other storage medium) or transmitted via radio frequency unit 1101 or network module 1102. Microphone 11042 can receive sound and process such sound into audio data. The processed audio data can be converted into a format that can be transmitted to a mobile communication base station via radio frequency unit 1101 in telephone call mode.

[0278] The electronic device 1100 also includes at least one sensor 1105, such as a light sensor, a motion sensor, and other sensors. Specifically, the light sensor includes an ambient light sensor and a proximity sensor. The ambient light sensor can adjust the brightness of the display panel 11061 according to the ambient light level, and the proximity sensor can turn off the display panel 11061 and / or backlight when the electronic device 1100 is moved to the ear. As a type of motion sensor, an accelerometer sensor can detect the magnitude of acceleration in various directions (generally three axes). When stationary, it can detect the magnitude and direction of gravity and can be used to identify the posture of the electronic device (such as landscape / portrait switching, related games, magnetometer posture calibration), vibration recognition related functions (such as pedometer, tapping), etc. The sensor 1105 may also include a fingerprint sensor, pressure sensor, iris sensor, molecular sensor, gyroscope, barometer, hygrometer, thermometer, infrared sensor, etc., which will not be described in detail here.

[0279] The display unit 1106 is used to display information input by the user or information provided to the user. The display unit 1106 may include a display panel 11061, which may be configured in the form of a liquid crystal display (LCD), an organic light-emitting diode (OLED), or the like.

[0280] User input unit 1107 can be used to receive input numerical or character information, and generate key signal inputs related to user settings and function control of electronic devices. Specifically, user input unit 1107 includes a touch panel 11071 and other input devices 11072. Touch panel 11071, also known as a touch screen, can collect touch operations performed by the user on or near it (such as operations performed by the user using a finger, stylus, or any suitable object or accessory on or near touch panel 11071). Touch panel 11071 may include two parts: a touch detection device and a touch controller. The touch detection device detects the user's touch position and the signal generated by the touch operation, and transmits the signal to the touch controller; the touch controller receives touch information from the touch detection device, converts it into touch point coordinates, and sends it to processor 1110, which receives and executes commands from processor 1110. In addition, touch panel 11071 can be implemented using various types such as resistive, capacitive, infrared, and surface acoustic wave. In addition to the touch panel 11071, the user input unit 1107 may also include other input devices 11072. Specifically, other input devices 11072 may include, but are not limited to, physical keyboards, function keys (such as volume control buttons, power buttons, etc.), trackballs, mice, joysticks, etc., which will not be described in detail here.

[0281] Furthermore, the touch panel 11071 can cover the display panel 11061. When the touch panel 11071 detects a touch operation on or near it, it transmits the information to the processor 1110 to determine the type of touch event. Subsequently, the processor 1110 provides corresponding visual output on the display panel 11061 according to the type of touch event. It is understood that in one embodiment, the touch panel 11071 and the display panel 11061 are implemented as two independent components to realize the input and output functions of the electronic device. However, in some embodiments, the touch panel 11071 and the display panel 11061 can be integrated to realize the input and output functions of the electronic device. The specific implementation is not limited here.

[0282] Interface unit 1108 serves as an interface for connecting external devices to electronic device 1100. For example, external devices may include a wired or wireless headphone port, an external power supply (or battery charger) port, a wired or wireless data port, a memory card port, a port for connecting a device with an identification module, an audio input / output (I / O) port, a video I / O port, a headphone port, and so on. Interface unit 1108 can be used to receive input from external devices (e.g., data, power, etc.) and transmit the received input to one or more components within electronic device 1100, or it can be used to transmit data between electronic device 1100 and external devices.

[0283] The memory 1109 can be used to store software programs and various data. The memory 1109 may primarily include a program storage area and a data storage area. The program storage area may store the operating system, applications required for at least one function (such as sound playback, image playback, etc.), etc.; the data storage area may store data created based on the use of the mobile phone (such as audio data, phonebook, etc.). Furthermore, the memory 1109 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device.

[0284] The processor 1110 is the control center of the electronic device. It connects various parts of the electronic device via various interfaces and lines. By running or executing software programs and / or modules stored in the memory 1109, and by calling data stored in the memory 1109, it performs various functions and processes data, thereby providing overall monitoring of the electronic device. The processor 1110 may include one or more processing units; preferably, the processor 1110 may integrate an application processor and a modem processor. The application processor mainly handles the operating system, user interface, and applications, while the modem processor mainly handles wireless communication. It is understood that the modem processor may not be integrated into the processor 1110.

[0285] The electronic device 1100 may also include a power supply 1111 (such as a battery) for supplying power to various components. Preferably, the power supply 1111 can be logically connected to the processor 1110 through a power management system, thereby enabling functions such as managing charging, discharging, and power consumption through the power management system.

[0286] In addition, the electronic device 1100 includes some functional modules not shown, which will not be described in detail here.

[0287] It should be noted that, in this document, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Unless otherwise specified, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes that element.

[0288] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of the present invention.

[0289] The embodiments of the present invention have been described above with reference to the accompanying drawings. However, the present invention is not limited to the specific embodiments described above. The specific embodiments described above are merely illustrative and not restrictive. Those skilled in the art can make many other forms under the guidance of the present invention without departing from the spirit and scope of the claims, and all of these forms are within the protection scope of the present invention.

[0290] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed in this invention can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0291] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0292] In the embodiments provided in this application, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between apparatuses or units may be electrical, mechanical, or other forms.

[0293] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0294] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0295] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0296] Furthermore, the embodiments of the present invention may involve the use of user data. In practical applications, user-specific personal data may be used in the scheme described herein within the scope permitted by applicable laws and regulations, provided that it complies with the applicable laws and regulations of the country in which it is located (e.g., with the user's explicit consent, with the user being properly notified, etc.).

[0297] The above description is merely a specific embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the technical scope disclosed in the present invention should be included within the scope of protection of the present invention. Therefore, the scope of protection of the present invention should be determined by the scope of the claims.

Claims

1. A VXLAN message processing method, characterized in that, Applied to network security devices, the method includes: Obtain a first VXLAN packet sent by a first network terminal. The first VXLAN packet includes a security verification field, which includes at least an intrinsic security flag, key version information, and a replay attack detection field. If the value of the intrinsic security flag is 1, then the first VXLAN packet is determined to be a first intrinsic security encapsulated packet based on the intrinsic security mechanism, and the target key information corresponding to the first intrinsic security encapsulated packet is obtained according to the key version information. The network security device is subjected to replay attack detection based on the replay attack detection field. If the replay attack detection result is passed, the first intrinsic security encapsulated message is decapsulated using the target key information to obtain the corresponding target service message. The target service message is sent to the second network terminal.

2. The method according to claim 1, characterized in that, The key version information includes at least a first VXLAN identifier field, a key validity flag, and a key version field. Obtaining the target key information corresponding to the first intrinsically secure encapsulated message based on the key version information includes: At least one key information is obtained through centralized distribution, and the key information is used for encryption and decryption of messages; If the value of the key validity flag is 1, then the target key information corresponding to the first intrinsically secure encapsulated message is retrieved from at least one of the key information by combining the first VXLAN identifier field and the key version field.

3. The method according to claim 2, characterized in that, Also includes: If the value of the key validity flag is 0, the target key information corresponding to the first intrinsically secure encapsulated message is retrieved from at least one of the key information using the first VXLAN identifier field.

4. The method according to claim 1, characterized in that, The step of decapsulating the first intrinsically secure encapsulated message using the target key information to obtain the corresponding target service message includes: Based on the encryption / decryption algorithm and encryption / decryption mode of the target key information, calculate the VXLAN protocol header length of the first intrinsically secure encapsulated message, and determine the decryption start position corresponding to the first intrinsically secure encapsulated message based on the VXLAN protocol header length; The encrypted content in the first intrinsically secure encapsulated message is decrypted using the encryption and decryption algorithm and mode of the target key information and the decryption start position to obtain the target service message corresponding to the first intrinsically secure encapsulated message.

5. The method according to claim 1 or 4, characterized in that, The first intrinsically secure encapsulated message includes at least a first VXLAN protocol header, an outer IP header, and an outer UDP header. The step of decapsulating the first intrinsically secure encapsulated message using the target key information to obtain the corresponding target service message includes: If the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, then the first VXLAN protocol tail is decapsulated according to the encryption / decryption algorithm and encryption / decryption mode of the target key information. Remove the outer IP header and the outer UDP header, and use the encryption / decryption algorithm and encryption / decryption mode of the target key information to remove the first VXLAN protocol header, thereby obtaining the target service message corresponding to the first intrinsically secure encapsulated message.

6. The method according to claim 5, characterized in that, If the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, then the first VXLAN protocol tail is decapsulated according to the encryption / decryption algorithm and encryption / decryption mode of the target key information, including: If the first intrinsically secure encapsulated message contains a first VXLAN protocol tail, and the encryption / decryption algorithm and encryption / decryption mode of the target key information determine that the first VXLAN protocol tail includes a padding data field and a padding length field, then the padding data field and the padding length field are removed. If, based on the encryption / decryption algorithm and encryption / decryption mode of the target key information, it is determined that the first VXLAN protocol tail does not include a padding data field and a padding length field, and the first VXLAN protocol tail includes a MAC field, then the MAC field is verified. If the verification result indicates that the verification passed, then the MAC field is removed.

7. The method according to claim 1, characterized in that, Also includes: If the value of the intrinsic security flag is 0, then the first VXLAN packet is determined to be a conventionally encapsulated packet based on the conventional VXLAN encapsulation method. The conventionally encapsulated packet is decapsulated to obtain the corresponding conventional service packet. The regular service message is sent to the second network terminal.

8. The method according to claim 1, characterized in that, The step of obtaining the first VXLAN packet sent by the first network end includes: If the destination address of the pending service message sent by the first network terminal is consistent with the local address of the network security device, the message type of the pending service message is UDP, and the destination port of the pending service message is a VXLAN service port, then the pending service message is determined to be a first VXLAN message.

9. A VXLAN message processing method, characterized in that, Applied to network security devices, the method includes: Obtain the service packet to be encapsulated sent by the third network terminal, and determine the VXLAN tunnel corresponding to the service packet to be encapsulated, wherein the VXLAN tunnel corresponds to the second VXLAN identifier field; Based on the second VXLAN identifier field, obtain the encryption key information corresponding to the service message to be encapsulated; Based on the encryption key information, the service message to be encapsulated is encapsulated using the VXLAN protocol header format based on the intrinsic security mechanism; If the encryption / decryption algorithm in the encryption key information does not have authentication functionality, then the VXLAN protocol tail format based on intrinsic security mechanism is used to encapsulate the service message to be encapsulated to obtain the corresponding second intrinsic security encapsulated message. The second intrinsically secure encapsulated message is subjected to VXLAN outer encapsulation processing to obtain the corresponding second VXLAN message, and the second VXLAN message is sent to the fourth network terminal; The step of encapsulating the service message to be encapsulated using the encryption key information and the VXLAN protocol header format based on intrinsic security mechanisms includes: Based on the encryption key information, the second VXLAN protocol header corresponding to the service message to be encapsulated is determined. The second VXLAN protocol header includes at least an intrinsic security flag, a key validity flag, and a sequence number validity flag. Set the intrinsic security flag and key validity flag of the second VXLAN protocol header to 1, and fill in the key version field of the second VXLAN protocol header; If it is determined that replay attack detection is enabled when decapsulating the second intrinsically secure encapsulated message, then the valid sequence number flag is set to 1, and the VXLAN sequence number field of the second VXLAN protocol header is filled in. The second VXLAN protocol header, which has been configured, is added to the service message to be encapsulated, and then encapsulation is performed.

10. The method according to claim 9, characterized in that, The encapsulation process of the service message to be encapsulated using the VXLAN protocol tail format based on intrinsic security mechanisms to obtain the corresponding second intrinsically secure encapsulated message includes: Based on the encryption key information, determine the second VXLAN protocol tail corresponding to the service message to be encapsulated, and fill in the MAC field of the second VXLAN protocol tail; If the encryption / decryption algorithm of the encryption key information is an algorithm that requires field padding, then fill in the padding data field and padding length field corresponding to the second VXLAN protocol tail; The second VXLAN protocol tail, once configured, is appended to the service message to be encapsulated, and encapsulation is performed to obtain the corresponding second intrinsically secure encapsulated message.

11. A VXLAN message processing device, characterized in that, Applied to network security devices, the device includes: The first VXLAN packet acquisition module is used to acquire the first VXLAN packet sent by the network end. The first VXLAN packet includes a security verification field, and the security verification field includes at least an intrinsic security flag, key version information, and a replay attack detection field. The first intrinsically secure encapsulated message determination module is used to determine that the first VXLAN message is a first intrinsically secure encapsulated message encapsulated based on the intrinsic security mechanism if the value of the intrinsic security flag bit is 1, and to obtain the target key information corresponding to the first intrinsically secure encapsulated message according to the key version information. The decapsulation processing module is used to perform replay attack detection on the network security device according to the replay attack detection field. If the replay attack detection result is passed, the first intrinsic security encapsulation message is decapsulated using the target key information to obtain the corresponding target service message. The target service message sending module is used to send the target service message to the second network terminal.

12. A VXLAN message processing device, characterized in that, Applied to network security devices, the device includes: The module for obtaining the service packet to be encapsulated is used to obtain the service packet to be encapsulated sent by the third network end, and determine the VXLAN tunnel corresponding to the service packet to be encapsulated, wherein the VXLAN tunnel corresponds to the second VXLAN identifier field. The encryption key information acquisition module is used to acquire the encryption key information corresponding to the service message to be encapsulated based on the second VXLAN identifier field. The protocol header encapsulation module is used to encapsulate the service message to be encapsulated using the VXLAN protocol header format based on the encryption key information and an intrinsic security mechanism. The second intrinsically secure encapsulated message generation module is used to encapsulate the service message to be encapsulated using the VXLAN protocol tail format based on intrinsic security mechanism if the encryption and decryption algorithm in the encryption key information does not have authentication function, so as to obtain the corresponding second intrinsically secure encapsulated message. The second VXLAN packet generation module is used to perform VXLAN outer encapsulation processing on the second intrinsically secure encapsulated packet to obtain the corresponding second VXLAN packet, and send the second VXLAN packet to the fourth network terminal; The protocol header encapsulation module includes: The second VXLAN protocol header determination module is used to determine the second VXLAN protocol header corresponding to the service message to be encapsulated based on the encryption key information. The second VXLAN protocol header includes at least an intrinsic security flag, a key validity flag, and a sequence number validity flag. The second VXLAN protocol header setting module is used to set the values ​​of the intrinsic security flag and the key validity judgment flag of the second VXLAN protocol header to 1, and fill in the key version field of the second VXLAN protocol header. The replay attack detection enable module is used to set the sequence number validity judgment flag to 1 and fill in the VXLAN sequence number field of the second VXLAN protocol header if it is determined that replay attack detection is enabled when decapsulating the second intrinsically secure encapsulated message. The second VXLAN protocol header encapsulation module is used to add the configured second VXLAN protocol header to the service message to be encapsulated and perform encapsulation processing.

13. An electronic device, characterized in that, It includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus; The memory is used to store computer programs; When the processor executes a program stored in the memory, it implements the method as described in any one of claims 1-10.

14. A computer-readable storage medium having instructions stored thereon that, when executed by one or more processors, cause the processors to perform the method as described in any one of claims 1-10.

Images