Data packet transmission method, device, equipment and medium

Abstract

Embodiments of the present invention disclose a data packet transmission method, apparatus, device, and medium. The method includes: obtaining a data packet to be transmitted from a transmitting end; encrypting the data packet to be transmitted to obtain an encrypted data packet; controlling a sniffing tool to intercept the encrypted data packet and decrypting the intercepted encrypted data packet to obtain a decrypted data packet; and transmitting the decrypted data packet to a receiving end. By encrypting and decrypting the data packet to be transmitted, the above scheme prevents sniffing by sniffing tools and improves the security of data packet transmission based on L3VPN.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of Internet technology, and in particular to a data packet transmission method, apparatus, device, and medium. Background Art

[0002] Layer 3 Virtual Private Network (L3VPN), a virtual private network based on a three-layer network, mainly uses tunneling technology, encryption technology, key management technology, and user and device authentication technology. Using L3VPN can greatly improve Internet security and is therefore widely used in various fields.

[0003] L3VPN operates at Layer 3 of the network hierarchy. It combines a virtual network interface card (VLAN) with system routing to assign the destination route corresponding to a resource to the VLAN. This allows the VLAN to read data packets sent by upper-layer applications. These packets are forwarded to the VPN (Virtual Private Network) server via an SSL (Secure Sockets Layer) or other encrypted channel. The VPN server then forwards the packets to the destination host on the intranet. The VPN server forwards the response from the destination host to the VPN client, which writes the data to the VLAN. The VLAN then delivers the data to the upper-layer application. Because L3VPN creates a VLAN and configures routing rules within the operating system, the operating system sends packets matching the routing rules to the VLAN. Therefore, by capturing packets on the local operating system's VLAN using network capture tools such as Wireshark, it is possible to sniff the packets, enabling subsequent analysis and attack. Therefore, improving the security of packet transmission over L3VPN is crucial. Summary of the Invention

[0004] The present invention provides a data packet transmission method, device, equipment and medium to improve the security of data packet transmission based on L3VPN.

[0005] According to one aspect of the present invention, a data packet transmission method is provided, which is applied to a physical device deployed with an L3VPN, comprising:

[0006] Get the data packet to be transmitted sent by the sender;

[0007] Encrypting the data packet to be transmitted to obtain an encrypted data packet;

[0008] Controlling the sniffing tool to intercept the encrypted data packet and decrypting the intercepted encrypted data packet to obtain a decrypted data packet;

[0009] The decrypted data packet is transmitted to a receiving end.

[0010] According to another aspect of the present invention, there is provided a data packet transmission apparatus, which is configured on a physical device on which an L3VPN is deployed, and includes:

[0011] The module for acquiring data packets to be transmitted is used to acquire data packets to be transmitted sent by the transmitting end;

[0012] An encrypted data packet acquisition module is used to encrypt the data packet to be transmitted to obtain an encrypted data packet;

[0013] The decrypted data packet acquisition module is used to control the sniffing tool to intercept the encrypted data packet and decrypt the intercepted encrypted data packet to obtain a decrypted data packet;

[0014] The decrypted data packet sending module is used to transmit the decrypted data packet to the receiving end.

[0015] According to another aspect of the present invention, an electronic device is provided, comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program that can be executed by the at least one processor. The computer program is executed by the at least one processor to enable the at least one processor to perform the data packet transmission method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the data packet transmission method according to any embodiment of the present invention when executed.

[0020] An embodiment of the present invention provides a data packet transmission solution for use with physical devices deployed with Layer 3 VPN (L3VPN). The solution obtains a data packet to be transmitted from a sender; encrypts the data packet to be transmitted to obtain an encrypted data packet; controls a sniffing tool to intercept the encrypted data packet and decrypts the intercepted encrypted data packet to obtain a decrypted data packet; and transmits the decrypted data packet to a receiver. By encrypting and decrypting the data packet to be transmitted, the solution prevents sniffing by sniffing tools and improves the security of data packet transmission based on L3VPN.

[0021] It should be understood that the content described in this section is not intended to identify the key or important features of the embodiments of the present invention, nor is it intended to limit the scope of the present invention. Other features of the present invention will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0022] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0023] Figure 1 This is a flow chart of a data packet transmission method provided in Example 1 of the present invention;

[0024] Figure 2 This is a flow chart of a data packet transmission method provided in Embodiment 2 of the present invention;

[0025] Figure 3A This is a flowchart of a method for an upper layer application to send a data packet provided by the third embodiment of the present invention;

[0026] Figure 3B This is a flow chart of a method for sending a data packet on a server side provided in Embodiment 3 of the present invention;

[0027] Figure 4 This is a structural diagram of a data packet transmission device provided by a fourth embodiment of the present invention;

[0028] Figure 5 This is a structural diagram of an electronic device that implements a data packet transmission method not provided in an embodiment of the present invention. DETAILED DESCRIPTION

[0029] The present invention will be further described in detail below with reference to the accompanying drawings and examples. It will be understood that the specific embodiments described herein are intended only to illustrate the present invention and are not intended to limit the present invention. It should also be noted that, for ease of description, the accompanying drawings only illustrate portions relevant to the present invention, not all structures.

[0030] In order to better understand the content of the present invention, the present invention first introduces the existing sniffing tools and the L3VPN anti-sniffing method in the prior art.

[0031] WFP (Windows Filtering Platform): A network layer filtering framework provided by the Windows system that works on all layers of the TCP / IP protocol stack in the operating system kernel.

[0032] NDIS (Network Driver Interface Specification): The Windows network interface specification forms part of the logical link control sublayer in the network protocol stack. It serves as the connection layer between the operating system and the network card, connecting downward to the media access control (MAC) sublayer and upward to the network layer. There are four main types of NDIS drivers: NDIS miniport drivers, NDIS midlayer drivers, NDIS filter drivers, and NDIS protocol drivers. NDIS miniport drivers operate at the lowest layer, directly processing data received by the network card; NDIS protocol drivers operate at the highest layer, implementing various network protocols (such as the TCP / IP protocol stack driver); NDIS midlayer drivers and filter drivers connect downward to the miniport driver and upward to the protocol driver, implementing the functionality of the midlayer. Developing an NDIS midlayer driver is complex, requiring the simultaneous development of both the miniport driver (downward) and the protocol driver (upward). Therefore, the latest NDIS specification provides a simpler filter driver as an alternative to the original midlayer driver.

[0033] Currently, Windows traffic sniffing tools primarily include those based on the NDIS protocol driver (e.g., Winpcap) and those based on the NDIS filter driver (e.g., Npcap). The Wireshark sniffing tool's packet capture engine integrates Winpcap and Npcap, enabling traffic sniffing on virtual network cards (NICs) built using L3VPN.

[0034] Specifically, a sniffing tool based on the NDIS protocol driver means that the NDIS protocol driver receives all traffic captured from the NDIS miniport driver, that is, the traffic received by the network card. Based on this function, a protocol driver can be designed in parallel with the Microsoft TCP / IP protocol stack driver to monitor all traffic passing through the network card. On the one hand, this driver is bound to the miniport driver corresponding to the network card used for traffic sniffing and receives all traffic incoming from the miniport driver; on the other hand, it is registered as an I / O (Input / Output) device and sends the captured data to the user-mode program. The end user can obtain the traffic on the network card by using the user-mode program that receives the sent data.

[0035] Specifically, a sniffing tool based on an NDIS filter driver is one that can intercept data transmitted between lower-level and upper-level NDIS drivers, allowing it to monitor traffic on the NDIS driver stack. This capability allows the design of a filter driver that sits between the TCP / IP protocol stack driver and the miniport driver. This filter driver then registers an I / O device and transmits the captured data to a user-mode program, enabling traffic sniffing.

[0036] Prior art methods for preventing L3VPN sniffing on Windows systems include monitoring whether network capture tools such as Wireshark are active during L3VPN operation and proactively disabling them if enabled. However, this method is not universally applicable because users often need to use network capture tools such as Wireshark during L3VPN operation and cannot directly disable them.

[0037] Prior art methods for preventing L3VPN sniffing on Windows systems could also include abandoning virtual network card routing and using a custom Windows kernel driver to retrieve L3 network data, thereby avoiding sniffing at the virtual network card level. This method, which replaces the virtual network card with a custom kernel driver, significantly alters the existing system, is highly invasive, and inevitably presents performance and stability issues.

[0038] Example 1

[0039] Figure 1 This is a flowchart of a data packet transmission method provided in Example 1 of the present invention. This embodiment can be applied to prevent data packets transmitted via L3VPN from being sniffed. The method can be executed by a data packet transmission device, which can be implemented in the form of hardware and / or software. The device can be configured in an electronic device that carries the data packet transmission function.

[0040] See also Figure 1 The packet transmission method shown is applied to a physical device deployed with L3VPN and includes:

[0041] S110: Acquire a data packet to be transmitted sent by a transmitting end.

[0042] The "sender" refers to the party that sends the data packet to be transmitted. Specifically, the sender can be an upper-layer application or a server. Servers include servers and VPN servers. The "data packet to be transmitted" refers to a data packet that can be transmitted. Specifically, the data packet to be transmitted can be a data packet sent from an upper-layer application to a server, or a data packet sent from a server to an upper-layer application.

[0043] In an optional embodiment, obtaining the data packet to be transmitted sent by the sending end includes: if the sending end is a server end, decrypting the data packet to be transmitted according to a preset decryption protocol corresponding to the server end to update the data packet to be transmitted.

[0044] Specifically, the VPN server on the server side can encrypt the data packet to be transmitted sent by the server according to the preset encryption protocol; the VPN client can decrypt the data packet to be transmitted according to the preset decryption protocol corresponding to the preset encryption protocol to update the data packet to be transmitted.

[0045] It should be noted that the embodiments of the present invention do not impose any restrictions on the preset encryption protocol and the preset decryption protocol, which can be set by technicians based on experience, and it is only necessary to ensure that the preset encryption protocol and the preset decryption protocol correspond one to one.

[0046] It is understandable that by introducing a preset decryption protocol, the data packets to be transmitted sent by the server are decrypted and updated, which facilitates subsequent processing of the data packets to be transmitted and improves the accuracy of the data packets to be transmitted.

[0047] S120: Encrypt the data packet to be transmitted to obtain an encrypted data packet.

[0048] The encrypted data packet refers to the data packet to be transmitted after being encrypted.

[0049] It should be noted that the embodiment of the present invention does not impose any limitation on the encryption processing method, which can be set by technicians based on experience.

[0050] S130: Control the sniffing tool to intercept the encrypted data packet, and decrypt the intercepted encrypted data packet to obtain a decrypted data packet.

[0051] The sniffing tool refers to a tool that can sniff data packets to be transmitted. The embodiments of the present invention do not impose any restrictions on the type of sniffing tool, and a technician can set it based on experience. For example, the sniffing tool can be a sniffing tool based on the NDIS protocol driver, such as Winpcap; the sniffing tool can also be a sniffing tool based on the NDIS filter driver, such as Npcap.

[0052] The decrypted data packet refers to a data packet obtained by decrypting the encrypted data packet. It should be noted that the embodiment of the present invention does not impose any restrictions on the decryption processing method, which can be set by technicians based on experience, as long as the encryption processing method and the decryption processing method correspond to each other.

[0053] Specifically, the sniffing tool is controlled to intercept the encrypted data packet. After the sniffing tool intercepts the data packet, the intercepted encrypted data packet is decrypted to obtain a decrypted data packet.

[0054] S140: Transmit the decrypted data packet to the receiving end.

[0055] The receiving end refers to the recipient of the decrypted data packet. Specifically, if the sending end is an upper-layer application, the receiving end is the server; if the sending end is a server, the receiving end is the upper-layer application.

[0056] It should be noted that when the sending end is an upper-layer application and the receiving end is a server, the VPN client needs to re-encrypt the decrypted data packet according to the first encryption protocol and send the encrypted decrypted data packet to the server. The VPN server on the server can decrypt the encrypted decrypted data packet according to the first decryption protocol corresponding to the first encryption protocol. The server then receives the decrypted data packet. It should be noted that the embodiments of the present invention do not impose any restrictions on the content of the first encryption protocol and the first decryption protocol. These can be set by technicians based on their experience, as long as the first encryption protocol and the first decryption protocol correspond to each other.

[0057] An embodiment of the present invention provides a data packet transmission solution for use with physical devices deployed with Layer 3 VPN (L3VPN). The solution obtains a data packet to be transmitted from a sender; encrypts the data packet to be transmitted to obtain an encrypted data packet; controls a sniffing tool to intercept the encrypted data packet and decrypts the intercepted encrypted data packet to obtain a decrypted data packet; and transmits the decrypted data packet to a receiver. By encrypting and decrypting the data packet to be transmitted, the solution prevents sniffing by sniffing tools and improves the security of data packet transmission based on L3VPN.

[0058] Example 2

[0059] Figure 2 This is a flow chart of a data packet transmission method provided in the second embodiment of the present invention. Based on the above embodiments, this embodiment further refines the operation of "encrypting the data packet to be transmitted to obtain an encrypted data packet" into "determining the header information of the data packet to be transmitted; obfuscating the header information, and encrypting the body of the data packet to be transmitted to obtain an encrypted data packet"; and refines the operation of "decrypting the intercepted encrypted data packet to obtain a decrypted data packet" into "restoring the header information of the encrypted data packet after interception by the sniffing tool, decrypting the body of the encrypted data packet to obtain a decrypted data packet" to improve the encryption and decryption mechanism of the data packet to be transmitted. It should be noted that for the parts not described in detail in the embodiments of the present invention, reference can be made to the descriptions of other embodiments.

[0060] See also Figure 2 The data packet transmission method shown includes:

[0061] S210: Obtain a data packet to be transmitted sent by a transmitting end.

[0062] S220: Determine the header information of the data packet to be transmitted.

[0063] The header information refers to the information of the header of the data packet to be transmitted, and specifically, the header information may include at least one of the source port sourcePort, the source address sourceIp, the destination port destPort, the destination address destIp, and the network protocol protocol.

[0064] S230: Obfuscate the packet header information and encrypt the packet body of the data packet to be transmitted to obtain an encrypted data packet.

[0065] The present invention does not impose any restrictions on the method for obfuscating packet header information, and a technician can set it based on experience. Preferably, when obfuscating packet header information, the transformation should be performed according to a preset obfuscation algorithm, but the obfuscated packet header information must comply with port rules and IP address rules. The present invention does not impose any restrictions on the preset obfuscation algorithm, and a technician can set it based on experience. For example, the port rule can be 0-65535, and the IP address rule can include IPv4 rules and IPv6 rules.

[0066] The embodiments of the present invention do not impose any restrictions on the method for encrypting the body of the data packet to be transmitted; this method can be set by a skilled person based on experience. For example, the body of the data packet to be transmitted can be encrypted using stream encryption. Specifically, a key of a preset length is used to perform a bit-by-bit XOR operation on the data in the body of the data packet to be transmitted to generate the encrypted body. For example, the stream encryption algorithm can be RC4 (Rivest Cipher 4) or Chacha20. The embodiments of the present invention do not impose any restrictions on the size of the preset length; this method can be set by a skilled person based on experience. For example, the preset length can be the same as the length of the data in the body.

[0067] S240: Control the sniffing tool to intercept the encrypted data packet. After the sniffing tool intercepts the encrypted data packet, restore the header information of the encrypted data packet and decrypt the body of the encrypted data packet to obtain a decrypted data packet.

[0068] The present embodiment of the present invention does not impose any restrictions on the method for restoring packet header information, and may be configured by a technician based on experience. For example, the header information of an encrypted data packet may be restored according to a preset restoration algorithm. It should be noted that the present embodiment of the present invention does not impose any restrictions on the preset restoration algorithm; it only requires that the preset restoration algorithm correspond to the preset obfuscation algorithm.

[0069] The present invention does not impose any limitations on the method for decrypting the body of an encrypted data packet; a skilled person may configure the method based on their experience. For example, if the packet body is encrypted using stream encryption, a key of a preset length is used to perform a bit-by-bit XOR operation on the data in the encrypted packet body to obtain the decrypted packet body.

[0070] It should be noted that the network protocol in the packet header information does not participate in the obfuscation or restoration of the packet header information.

[0071] S250: Transmit the decrypted data packet to the receiving end.

[0072] An embodiment of the present invention provides a data packet transmission scheme, which encrypts a data packet to be transmitted to obtain an encrypted data packet operation, which is further refined into determining the header information of the data packet to be transmitted; obfuscating the header information and encrypting the body of the data packet to be transmitted to obtain an encrypted data packet; and decrypting the intercepted encrypted data packet to obtain a decrypted data packet operation, which is further refined into restoring the header information of the encrypted data packet and decrypting the body of the encrypted data packet after interception by a sniffing tool to obtain a decrypted data packet operation, thereby improving the encryption and decryption mechanism of the data packet to be transmitted. The above scheme avoids the data packet to be transmitted from being cracked by obfuscating and restoring the header information and encrypting and decrypting the body, thereby improving the security of the data packet to be transmitted.

[0073] On the basis of the above technical solution, in order to improve the transmission efficiency of data packets, in an optional embodiment, it can be determined whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet based on the packet header information.

[0074] It can be understood that by determining whether to process the data packet to be transmitted based on the packet header information, invalid processing of the data packet to be transmitted is avoided, the efficiency of processing the data packet to be transmitted is improved, and resource waste is avoided.

[0075] Specifically, based on the packet header information, determining whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet includes: obtaining the interaction address in the packet header information; and determining whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet based on the consistency between the interaction address and the Internet Protocol (IP) address of the virtual network card.

[0076] The interaction address refers to the IP addresses of the sender and receiver, and the virtual network card refers to the virtual network adapter built by L3VPN.

[0077] It can be understood that by introducing the interactive address and Internet Protocol address, it is determined whether the data packet to be transmitted can be encrypted or the encrypted data packet can be decrypted, thereby avoiding the situation where the data packet to be transmitted or the encrypted data packet is processed invalidly, reducing resource waste and improving data packet transmission efficiency.

[0078] In an optional embodiment, if the sending end is an upper layer application, obtaining the interactive address in the packet header information includes: obtaining the source address sourceIp in the packet header information, and using the source address in the packet header information as the interactive address.

[0079] In another optional embodiment, if the sending end is a server end, obtaining the interactive address in the packet header information includes: obtaining the destination address destIp in the packet header information, and using the destination address in the packet header information as the interactive address.

[0080] It can be understood that, for different sending ends, different interaction addresses in the packet header information are determined, which improves the accuracy and applicability of the determined interaction addresses.

[0081] Example 3

[0082] The embodiment of the present invention provides an optional embodiment of a data packet transmission method based on L3VPN. It should be noted that for parts not described in detail in the embodiment of the present invention, reference can be made to the descriptions of other embodiments.

[0083] In the embodiment of the present invention, from the perspective of upper layer applications, L3VPN-based data packet transmission is divided into the upper layer application sending the data packet to the server, and the upper layer application receiving the data packet sent by the server.

[0084] In the prior art, the specific process for an upper-layer application to send a data packet is as follows: the upper-layer application sends a data packet to be transmitted, and the packet header information of the data packet to be transmitted is located in the L3VPN routing list; during the process of sending the data packet to be transmitted to the virtual network card, a sniffer tool based on the NDIS protocol driver or filter driver can intercept the data packet to be transmitted sent to the L3VPN virtual network card, clone the data packet to be transmitted, and forward the cloned data packet to the sniffer tool's application layer for display; the original data packet to be transmitted continues to be sent to the L3VPN application layer; after receiving the data packet to be transmitted, the L3VPN application layer encrypts the data packet to be transmitted using a constructed first encryption protocol and sends the encrypted data packet to the server. In the above scheme, after the upper-layer application (such as a browser) sends a data packet to be transmitted, if the packet header information of the data packet to be transmitted is located in the L3VPN routing list, the data packet to be transmitted will first be sent to the virtual network card constructed by the L3VPN, and then the data packet to be transmitted will be sent to the L3VPN application layer through the virtual network card, and then forwarded to the server. During this process, network sniffing tools can capture and sniff packets on the virtual network card built by L3VPN to obtain the data packets to be transmitted for subsequent analysis or attack.

[0085] An embodiment of the present invention provides a data packet transmission method based on L3VPN. For an upper-layer application to send a data packet, a WFP kernel driver protection module is used to obfuscate the header information of the data packet to be transmitted through a virtual network card, and the packet body is encrypted to obtain an encrypted data packet. During the process of transmitting the encrypted data packet to the virtual network card, a sniffing tool can capture the encrypted data packet. Since the header information of the encrypted data packet at this time is obfuscated data and cannot be matched, and the packet body is encrypted data and cannot be restored, network sniffing cannot be performed. The virtual network card forwards the encrypted data packet to the application layer of L3VPN. At the application layer of L3VPN, an application layer protection module is used to decrypt and restore the specified encrypted data packet, thereby ensuring the correctness of the decrypted data packet finally sent.

[0086] For example, see Figure 3A The flowchart of the method for an upper layer application to send a data packet includes:

[0087] S311. The upper layer application sends a data packet to be transmitted.

[0088] It should be noted that the packet header information of the data packet to be transmitted is located in the L3VPN traffic diversion list.

[0089] S312 , the WFP kernel driver protection module receives the data packet to be transmitted, and encrypts the data packet to be transmitted to obtain an encrypted data packet.

[0090] The WFP kernel driver protection module may include a WFP kernel driver encryption unit.

[0091] Specifically, the WFP kernel is used to drive the encryption unit to obfuscate the header information of the data packet to be transmitted, and to encrypt the body of the data packet to be transmitted to obtain an encrypted data packet.

[0092] It should be noted that the WFP kernel driver encryption unit performs obfuscation encryption on the data packets to be transmitted whose source addresses are consistent with the Internet Protocol address of the virtual network card.

[0093] S313. The sniffer tool based on the NDIS protocol driver or the filter driver intercepts the encrypted data packet sent to the virtual network card, clones the encrypted data packet, and forwards the cloned encrypted data packet to the application layer of the sniffer tool for display.

[0094] It should be noted that, since the data packets intercepted by the sniffing tool at this time are encrypted data packets, the sniffing tool cannot perform sniffing based on the packet header information and the data body.

[0095] S314: The virtual network card forwards the received encrypted data packet to the application layer of the L3VPN.

[0096] S315. The application layer uses the application layer protection module to decrypt the encrypted data packet to obtain a decrypted data packet.

[0097] The application layer protection module may include an application layer decryption unit.

[0098] Specifically, the application layer decryption unit can restore the header information of the received encrypted data packet and decrypt the body of the encrypted data packet to obtain a decrypted data packet.

[0099] It should be noted that the application layer decryption unit decrypts and restores the encrypted data packet whose source address is consistent with the Internet Protocol address of the virtual network card.

[0100] S316. The application layer encrypts the decrypted data packet according to the first encryption protocol to obtain an encrypted decrypted data packet, and sends the encrypted decrypted data packet to the server.

[0101] Compared to existing technologies, this solution obfuscates the header information of the original data packet and encrypts the body of the packet before the sniffing tool captures the virtual network card (VNIC). This generates an encrypted data packet, which the sniffing tool then captures. After the L3VPN application layer receives the encrypted data packet from the VNIC, the application layer protection module decrypts it, ensuring the accuracy of the decrypted data packet.

[0102] In the prior art, the specific process for upper-layer applications to receive data packets is as follows: L3VPN decrypts the data packets to be transmitted from the server to update the data packets to be transmitted and sends them to the virtual network card; after the virtual network card constructed by L3VPN receives the data packets to be transmitted, it forwards the data packets to be transmitted to the NDIS protocol layer; a sniffer tool based on the NDIS protocol driver or filter driver can intercept the data packets to be transmitted, clone the data packets to be transmitted, and forward the cloned data packets to the application layer of the sniffer tool for display, while the original data packets to be transmitted continue to be sent to the upper-layer application; after the upper-layer application receives the data packets to be transmitted, it displays the content and performs subsequent operations. In the above scheme, after the L3VPN client receives the data packets to be transmitted from the server, it forwards the data packets to the virtual network card. After the virtual network card obtains the data packets to be transmitted, it forwards them to the NDIS protocol layer. During this process, the network sniffer tool can capture and sniff the virtual network card constructed by L3VPN to obtain the data packets to be transmitted, thereby performing subsequent analysis or attacks.

[0103] An embodiment of the present invention provides a data packet transmission method based on L3VPN. For an upper-layer application receiving a data packet, the method obtains a data packet to be transmitted sent by a server and updates the data packet to be transmitted. An application layer protection module based on L3VPN obfuscates the header information of the data packet to be transmitted and encrypts the body of the data packet to obtain an encrypted data packet. During the process of transmitting the encrypted data packet to a virtual network card, a sniffing tool can capture the encrypted data packet. Since the header information of the encrypted data packet at this time is obfuscated data and cannot be mapped, and the body of the data packet is encrypted data and cannot be restored, network sniffing cannot be performed. A WFP kernel driver protection module decrypts and restores the specified encrypted data packet, thereby ensuring the correctness of the final decrypted data packet received by the upper-layer application.

[0104] For example, see Figure 3B The flowchart of the method for an upper layer application to receive a data packet shown includes:

[0105] S321 , after receiving the data packet to be transmitted sent by the server, the application layer of the L3VPN decrypts the data packet to be transmitted according to a preset decryption protocol to update the data packet to be transmitted.

[0106] S322: The application layer protection module encrypts the data packet to be transmitted to obtain an encrypted data packet, and sends the encrypted data packet to the virtual network card.

[0107] The application layer protection module may include an application layer encryption unit.

[0108] Specifically, the application layer encryption unit obfuscates the header information of the data packet to be transmitted, and encrypts the body of the data packet to be transmitted to obtain an encrypted data packet.

[0109] It should be noted that the application layer encryption unit encrypts and obfuscates the data packets to be transmitted whose destination addresses are consistent with the Internet Protocol address of the virtual network card.

[0110] S323. The virtual network card forwards the encrypted data packet to the NDIS protocol layer.

[0111] S324. The sniffer tool based on the NDIS protocol driver or the filter driver intercepts the encrypted data packet, clones the encrypted data packet, and forwards the cloned encrypted data packet to the application layer of the sniffer tool for display.

[0112] It should be noted that, since the data packets intercepted by the sniffing tool at this time are encrypted data packets, the sniffing tool cannot perform sniffing based on the packet header information and the data body.

[0113] S325. The WFP kernel driver protection module decrypts the encrypted data packet received from the virtual network card to obtain a decrypted data packet, and sends the decrypted data packet to the upper layer application.

[0114] The WFP kernel driver protection module may include a WFP kernel driver decryption unit.

[0115] Specifically, the WFP kernel drives the decryption unit to restore the header information of the encrypted data packet and decrypt the body of the encrypted data packet to obtain a decrypted data packet.

[0116] It should be noted that the WFT kernel drives the decryption unit to decrypt and restore the encrypted data packet whose destination address is consistent with the Internet Protocol address of the virtual network card.

[0117] Compared to existing technologies, this solution obfuscates the updated header information of the transmitted data packet and encrypts the body of the transmitted data packet before the sniffing tool captures the packet on the virtual network card (NIC). This encrypts the data packet, rendering it inaccessible to sniffers. After the WFP kernel driver protection module obtains the encrypted data packet, it decrypts it and sends the decrypted data packet to the upper-layer application, ensuring the accuracy of the decrypted data packet.

[0118] In embodiments of the present invention, the L3VPN application layer can include an application layer policy setting module, an application layer data filtering module, and an application layer protection module. The application layer policy setting module can be used to transmit L3VPN-related configuration policies, such as at least one of the virtual network card's IP address, a packet header obfuscation algorithm, and a data encryption algorithm. The data filtering module can be used to determine whether to process a received data packet based on the packet header information. The application layer protection module can be used to protect received data packets. Specifically, the application layer protection module can include an application layer encryption unit and an application layer decryption unit.

[0119] Accordingly, in an embodiment of the present invention, a WFP kernel driver policy setting module, a WFP kernel driver data filtering module, and a WFP kernel driver protection module may be introduced into the WFP kernel driver. The WFP kernel driver policy setting module may be used to transmit relevant L3VPN configuration policies, such as at least one of the virtual network card's IP address, a packet header information obfuscation algorithm, and a data encryption algorithm. The WFP kernel driver data filtering module may be used to determine whether to process a received data packet based on the packet header information. The WFP kernel driver protection module may be used to protect the received data packet. Specifically, the WFP kernel driver protection module may include a WFP kernel driver encryption unit and a WFP kernel driver decryption unit.

[0120] In an embodiment of the present invention, based on the WFP kernel-mode driver's ability to filter and modify network traffic at different levels in Windows systems, a method for implementing L3VPN anti-sniffing in Windows systems is proposed. When data flows from an upper-layer application to a server, the WFP kernel-mode driver is used to encrypt and obfuscate packets passing through the virtual network card (NIC). The L3VPN layer then decrypts and restores the packets sent by the virtual NIC. This ensures that packets passing through the NIC cannot be sniffed by packet capture tools such as Wireshark, while also preventing the application from ultimately sending the packet. Similarly, when data flows from a server to an upper-layer application, the technical solution provided by the embodiment of the present invention can also achieve anti-sniffing effects, improving the security of packet transmission based on L3VPN. Furthermore, the packet transmission method proposed in the embodiment of the present invention requires only minor modifications to the existing L3VPN system to effectively prevent attacks by network card sniffing tools such as Wireshark. This modification is minimally invasive to the existing L3VPN system and can be easily applied to existing L3VPN systems, avoiding major modifications to the existing L3VPN, while balancing security and development efficiency.

[0121] It should be noted that the data packet transmission method provided in the embodiment of the present invention can also be combined with SDP (Session Description Protocol, software-defined boundary) to protect the data packets sent and received by the virtual network card constructed by SDP, so as to improve the function of SDP and enhance the user experience.

[0122] This embodiment of the present invention briefly describes the TCP / IP reference model and WFP driver layer in Windows systems. The TCP / IP reference model consists of the application layer, transport layer, internet layer, and data link layer. The application layer corresponds to the higher layers of the OSI (Open System Interconnect) reference model, providing various services required by users, such as HTTP (Hypertext Transfer Protocol), HTTPS (Hypertext Transfer Protocol over Secure Socket Layer), FTP (File Transfer Protocol), Telnet (Teletype Network), DNS (Domain Name System), and SMTP (Simple Mail Transfer Protocol). The transport layer corresponds to the transport layer of the OSI reference model, providing end-to-end communication for application layer entities and ensuring the sequential delivery of data packets and data integrity. This layer defines two main protocols: Transmission Control Protocol (TCP) and User Datagram Protocol (UDP). The TCP (Transmission Control Protocol) provides a reliable data transmission service connected via a three-way handshake. The UDP (User Datagram Protocol) provides an unreliable, connectionless data transmission service. The Internet layer corresponds to the network layer of the OSI reference model and primarily addresses host-to-host communication. The protocols it contains design the logical transmission of data packets across the network. It focuses on reassigning IP addresses to hosts for addressing and also handles data packet routing across various networks. This layer includes three primary protocols: the Internet Protocol (IP), the Internet Group Management Protocol (IGMP), and the Internet Control Message Protocol (ICMP). The Data Link layer corresponds to the physical and data link layers of the OSI reference model. It oversees data exchange between hosts and networks and then connects to the TCP / IP network access layer. The Address Resolution Protocol (ARP) operates at this layer, the data link layer of the OSI reference model.

[0123] Specifically, based on the TCP / IP communication protocol stack, the WFP framework is divided into four fixed filtering layers, all of which are integrated into the four-layer TCP / IP protocol stack. Specifically, the WFP framework includes the application layer, transport layer, internet layer, and link layer. The application layer includes the control information layer (ALE) and the data stream layer. The control information layer may include at least one of the bind, connect, accept, and listen commands. The data stream layer is used to receive raw data packets from the application layer, which have already been stripped of various TCP / IP header information. The transport layer is used to receive and send TCP or UDP data packets, which already include TCP or UDP header information. The internet layer is used to receive or send IP data packets. The link layer is used for link layer data packets containing the Ethernet card's MAC (Media Access Control, LAN) address.

[0124] Example 4

[0125] Figure 4 This is a structural diagram of a data packet transmission device provided in Example 4 of the present invention. This embodiment can be used to prevent data packets transmitted through L3VPN from being sniffed. The method can be executed by a data packet transmission device, which can be implemented in the form of hardware and / or software. The device can be configured in an electronic device that carries the data packet transmission function.

[0126] like Figure 4 As shown, the device is configured on a physical device where L3VPN is deployed. The device includes: a data packet acquisition module 410 for transmission, an encrypted data packet acquisition module 420, a decrypted data packet acquisition module 430 and a decrypted data packet sending module 440.

[0127] The data packet to be transmitted acquisition module 410 is used to acquire the data packet to be transmitted sent by the sending end;

[0128] The encrypted data packet acquisition module 420 is used to encrypt the data packet to be transmitted to obtain an encrypted data packet;

[0129] The decrypted data packet acquisition module 430 is used to control the sniffing tool to intercept the encrypted data packet and decrypt the intercepted encrypted data packet to obtain a decrypted data packet;

[0130] The decrypted data packet sending module 440 is used to transmit the decrypted data packet to the receiving end.

[0131] An embodiment of the present invention provides a data packet transmission solution, applicable to a physical device deployed with an L3VPN. A data packet acquisition module acquires data packets to be transmitted from a transmitter. An encrypted data packet acquisition module encrypts the data packets to be transmitted to obtain encrypted data packets. A decrypted data packet acquisition module controls a sniffing tool to intercept the encrypted data packets and decrypts the intercepted encrypted data packets to obtain decrypted data packets. The decrypted data packet transmission module transmits the decrypted data packets to a receiver. This solution, by encrypting and decrypting the data packets to be transmitted, prevents sniffing by sniffing tools and improves the security of data packet transmission based on L3VPN.

[0132] Optionally, the encrypted data packet acquisition module 420 includes:

[0133] A packet header information determining unit, configured to determine packet header information of a data packet to be transmitted;

[0134] The encrypted data packet acquisition unit is used to obfuscate the packet header information and encrypt the packet body of the data packet to be transmitted to obtain an encrypted data packet;

[0135] Accordingly, the decrypted data packet acquisition module 430 includes:

[0136] The decrypted data packet determination unit is used to restore the header information of the encrypted data packet and decrypt the body of the encrypted data packet to obtain a decrypted data packet after the sniffing tool intercepts the data packet.

[0137] Optionally, the device method further includes:

[0138] The encryption / decryption processing determination module is used to determine whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet according to the packet header information.

[0139] Optionally, the encryption and decryption processing determination module includes:

[0140] An interactive address obtaining unit, configured to obtain the interactive address in the packet header information;

[0141] The encryption and decryption processing unit is used to determine whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet according to the consistency between the interaction address and the Internet Protocol address of the virtual network card.

[0142] Optionally, if the sending end is an upper layer application, the interactive address acquisition unit is specifically used to:

[0143] Obtain the source address in the packet header information and use the source address in the packet header information as the interaction address.

[0144] Optionally, if the sending end is a server, the interactive address acquisition unit is specifically configured to:

[0145] Obtain the destination address in the packet header information, and use the destination address in the packet header information as the interaction address.

[0146] Optionally, the module 410 for acquiring data packets to be transmitted includes:

[0147] The data packet updating unit to be transmitted is used to decrypt the data packet to be transmitted according to the preset decryption protocol corresponding to the server if the sending end is the server end, so as to update the data packet to be transmitted.

[0148] The data packet transmission device provided in the embodiment of the present invention can execute the data packet transmission method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects for executing each data packet transmission method.

[0149] In the technical solution of the present invention, the collection, storage, use, processing, transmission, provision and disclosure of data packets to be transmitted, packet header information, Internet Protocol addresses and preset decryption protocols, etc., all comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0150] Example 5

[0151] Figure 5 : This is a schematic diagram of the structure of an electronic device that implements a data packet transmission method provided in Example 5 of the present invention. Electronic device 510 is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or claimed herein.

[0152] like Figure 5As shown, electronic device 510 includes at least one processor 511 and memory, such as read-only memory (ROM) 512 and random access memory (RAM) 513, communicatively connected to the at least one processor 511. The memory stores computer programs executable by the at least one processor. Processor 511 can perform various appropriate actions and processes based on the computer programs stored in ROM 512 or loaded from storage unit 518 into RAM 513. RAM 513 can also store various programs and data required for the operation of electronic device 510. Processor 511, ROM 512, and RAM 513 are interconnected via bus 514. An input / output (I / O) interface 515 is also connected to bus 514.

[0153] Multiple components in the electronic device 510 are connected to the I / O interface 515, including an input unit 516, such as a keyboard, a mouse, etc.; an output unit 517, such as various types of displays, speakers, etc.; a storage unit 518, such as a magnetic disk, an optical disk, etc.; and a communication unit 519, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 519 allows the electronic device 510 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0154] Processor 511 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of processor 511 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any other suitable processor, controller, microcontroller, etc. Processor 511 executes the various methods and processes described above, such as the packet transmission method.

[0155] In some embodiments, the data packet transmission method may be implemented as a computer program tangibly embodied in a computer-readable storage medium, such as storage unit 518. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 510 via ROM 512 and / or communication unit 519. When the computer program is loaded into RAM 513 and executed by processor 511, one or more steps of the data packet transmission method described above may be performed. Alternatively, in other embodiments, processor 511 may be configured to perform the data packet transmission method in any other suitable manner (e.g., via firmware).

[0156] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0157] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when the computer program is executed by the processor, the functions / operations specified in the flowcharts and / or block diagrams are implemented. The computer program may be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0158] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, device, or apparatus. A computer-readable storage medium may include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device, or apparatus, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. More specific examples of machine-readable storage media may include an electrical connection based on one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0159] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device that has: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, voice input, or tactile input).

[0160] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0161] A computing system may include clients and servers. The clients and servers are typically remote from each other and typically interact via a communication network. This client-server relationship arises through computer programs running on the respective computers, creating a client-server relationship. The server may be a cloud server, also known as a cloud computing server or cloud host. This server is a hosting product within the cloud computing service ecosystem that addresses the management difficulties and limited scalability of traditional physical hosting and VPS services.

[0162] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in the present invention can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solution of the present invention can be achieved. This is not limited herein.

[0163] The above specific embodiments do not limit the scope of protection of the present invention. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of the present invention are intended to be included within the scope of protection of the present invention.

Claims

1. A data packet transmission method, applied to a physical device deployed with L3VPN, characterized in that: include: Obtaining the data packet to be transmitted sent by the server, and updating the data packet to be transmitted; Obfuscating the header information of the updated data packet to be transmitted through the L3VPN application layer protection module and encrypting the packet body to obtain an encrypted data packet; During the process of transmitting the encrypted data packet to the virtual network card, controlling the sniffing tool to intercept the encrypted data packet, and decrypting the intercepted encrypted data packet through the WFP kernel driver protection module to obtain a decrypted data packet; The decrypted data packet is transmitted to an upper layer application.

2. The method according to claim 1, characterized in that The decrypting of the intercepted encrypted data packet to obtain the decrypted data packet includes: After being intercepted by the sniffing tool, the header information of the encrypted data packet is restored, and the body of the encrypted data packet is decrypted to obtain the decrypted data packet.

3. The method according to claim 2, characterized in that The method further comprises: According to the packet header information, it is determined whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet.

4. The method according to claim 3, characterized in that The determining, based on the packet header information, whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet includes: Obtaining the interactive address in the packet header information; wherein the interactive address refers to the IP address of the server and the upper layer application; According to the consistency between the interactive address and the Internet Protocol address of the virtual network card, it is determined whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet.

5. The method according to claim 4, characterized in that The obtaining of the interaction address in the packet header information includes: The destination address in the packet header information is obtained, and the destination address in the packet header information is used as the interaction address.

6. The method according to claim 1, characterized in that Get the data packets to be transmitted sent by the server, including: The data packet to be transmitted is decrypted according to a preset decryption protocol corresponding to the server side to update the data packet to be transmitted.

7. A data packet transmission method, applied to a physical device deployed with L3VPN, characterized in that: include: Get the data packets to be transmitted sent by the upper layer application; The WFP kernel driver protection module obfuscates the header information of the data packet to be transmitted through the virtual network card and encrypts the packet body to obtain an encrypted data packet; During the process of transmitting the encrypted data packet to the virtual network card, controlling the sniffing tool to intercept the encrypted data packet, and decrypting the intercepted encrypted data packet through the L3VPN application layer protection module to obtain a decrypted data packet; The decrypted data packet is transmitted to the server.

8. The method according to claim 7, characterized in that The method further comprises: Obtaining the interactive address in the packet header information; wherein the interactive address refers to the IP address of the server and the upper layer application; the interactive address is the source address in the packet header information; According to the consistency between the interactive address and the Internet Protocol address of the virtual network card, it is determined whether to encrypt the data packet to be transmitted or to decrypt the encrypted data packet.

9. A data packet transmission device, configured on a physical device deployed with L3VPN, characterized in that: include: The module for acquiring data packets to be transmitted is used to acquire data packets to be transmitted sent by the server and update the data packets to be transmitted; The encrypted data packet acquisition module is used to obfuscate the header information of the updated data packet to be transmitted through the L3VPN application layer protection module, encrypt the packet body, and obtain an encrypted data packet; The decrypted data packet acquisition module is used to control the sniffing tool to intercept the encrypted data packet during the process of transmitting the encrypted data packet to the virtual network card, and decrypt the intercepted encrypted data packet through the WFP kernel driver protection module to obtain a decrypted data packet; The decrypted data packet sending module is used to transmit the decrypted data packet to the upper layer application.

10. A data packet transmission device, configured on a physical device deployed with L3VPN, characterized in that: include: The module for acquiring data packets to be transmitted is used to acquire data packets to be transmitted sent by upper layer applications; The encrypted data packet acquisition module is used to obfuscate the header information of the data packet to be transmitted sent through the virtual network card through the WFP kernel driver protection module, encrypt the packet body, and obtain an encrypted data packet; The decrypted data packet acquisition module is used to control the sniffing tool to intercept the encrypted data packet during the process of transmitting the encrypted data packet to the virtual network card, and decrypt the intercepted encrypted data packet through the L3VPN application layer protection module to obtain a decrypted data packet; The decrypted data packet sending module is used to transmit the decrypted data packet to the server.

11. An electronic device, characterized in that: include: one or more processors; a memory for storing one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the data packet transmission method according to any one of claims 1 to 8.

12. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the program is executed by a processor, a data packet transmission method according to any one of claims 1 to 8 is implemented.

Images