Tunnel encryption, forwarding and decryption methods and apparatus

Abstract

The application discloses a tunnel encryption, forwarding and decryption method and device, wherein the tunnel encryption method comprises the following steps: adding original forwarding information which is not modified into a preset field of a tunnel encryption message; the original forwarding information is used for path calculation selection of an intermediate forwarding node, quality of service control, security policy implementation, selection of different encryption granularity, etc. Through the method and device, the problems in the prior art, such as inconsistency of ECMP multi-path load sharing routing, difficulty in deploying end-to-end quality of service, complexity in implementing security policy configuration, inability to flexibly select an encryption granularity, and extension of a traditional encryption tunnel message format, can be solved.

Description

TECHNICAL FIELD

[0001] The present application relates to network communication technology, in particular to a tunnel encryption, forwarding and decryption method and device. BACKGROUND

[0002] The existing VXLAN tunnel-based encryption and decryption protocol can realize end-to-end encryption capability of a data center. The original message assembled by a virtual machine or a physical server is sent out, and after the message is received on the network equipment in transit, decryption and encryption operations need to be performed first, the message MAC address, IP address and other information are used for forwarding, and after reaching the destination, the VXLAN ciphertext is decrypted and sent to the virtual machine or the physical server. In the VXLAN protocol, the encryption node is responsible for VXLAN packet plaintext encryption, the decryption node is responsible for VXLAN packet ciphertext decryption, and the intermediate node performs routing forwarding based on the VXLAN packet ciphertext.

[0003] As shown in Figure 1 When HOST A and HOST B are in the same network segment and are distributed under different VXLAN tunnel end points (VXLAN Tunnel End Point, VTEP), the original message assembled by the physical server is sent out, and after the message is received on the network equipment in transit, decryption and decapsulation and encryption and encapsulation operations need to be performed first. Taking the communication between HOST A and HOST B as an example, the specific processing process is as follows:

[0004] 1. HOST A and HOST B are in the same network segment, HOST A requests and obtains the MAC address of HOST B;

[0005] 2. After the message reaches VTEP-1, the switch performs forwarding table item search and forwarding processing according to the message analysis results MAC, IP and other information. If it is layer 2 forwarding, the FDB table item is searched; if it is layer 3 forwarding, the routing table is searched.

[0006] Taking L2 forwarding as an example, according to the next hop information in the search result, the original message is executed encryption and VXLAN encapsulation processing, and finally the message is sent out. The exit message MAC_DA of VTEP-1 is the device MAC-2 of Router-1; the MAC_SA is the device MAC-1 of VTEP-1; the outer IP_DA is the IP-4 of VTEP-2, and the IP_SA is the IP-1 of VTEP-1; the L4DstPort in the increased outer UDP Header is a specific reserved value, not VXLAN UDP port (this identifier is one of the VXLAN packet ciphertext characteristics);

[0007] 3. If the device in the VXLAN network does not have VXLAN encryption and decryption function, the encrypted message can still be routed and forwarded on the network according to the outer VXLAN IP address, and finally reaches VTEP-2;

[0008] 4. After VTEP-2 receives the message, the message is identified as a VXLAN data packet ciphertext (as shown in Figure Four ), and the decryption of the VXLAN data packet ciphertext is first performed in the switch. The message after decryption is a normal VXLAN data packet plaintext. The switch performs VXLAN Tunnel decapsulation table lookup according to IP_DA, IP_SA, and VNI in the VXLAN message parsing result, and performs VXLAN message decapsulation processing and inner message parsing according to the lookup result. According to the inner message MAC_DA, bridging forwarding or routing forwarding is performed, and the corresponding chip table item is searched. According to the next hop information of the lookup result, the message export is edited, and finally the message is forwarded to HOSTB.

[0009] The traditional tunnel encryption scheme has the following problems in the deployment of data centers:

[0010] 1. Since the design of the VXLAN encrypted message format is based on the UDP Header, the specific identifier for indicating VXLAN encryption is replaced with the original L4 Dst Port during encryption, so the UDP Length needs to be updated, which requires the recalculation of the UDP Checksum at the encryption node, which brings two risks: one is that if the UDP Dst Port is included in the HASH factor used for ECMP load balancing calculation, the path before encryption and the path after encryption will be inconsistent; two is that when the forwarding node traverses the intermediate network, if the Checksum is not updated correctly, the VXLAN data packet ciphertext will be discarded during forwarding;

[0011] 2. The traditional VXLAN, NVGRE and other multiple protocols lack consideration of encryption at the beginning of design, which leads to the fact that the deployment of end-to-end encryption scheme in data centers causes the key information of the message to be encrypted and unable to be used for forwarding. In addition, these tunnel protocol messages have poor extensibility in the definition of encrypted message format, and are difficult to carry multiple information, which cannot cooperate with the network operation and security policy, resulting in the fact that after the deployment of encryption, the whole network needs to be configured for the delivery and forwarding of encrypted data flow, which brings great challenges to operation and maintenance. In addition, after encryption, part of the forwarding information is lost, and it is difficult for the intermediate node to deploy fine security policy, and it is difficult to uniformly implement the security protection of the whole network. SUMMARY

[0012] The technical problem to be solved by the embodiment of the present application is to solve the problem of consistent forwarding path before and after encryption of the ECMP multi-path load balancing of the deployment end-to-end encryption scheme of the data center, avoid the message disorder problem of the data stream, and meet the application requirements of various Overlay tunnel data centers through unified encryption protocol data format, avoid customizing different encryption schemes for VXLAN, NVGRE and various tunnel protocols, so as to ensure the simplicity of the data center network.

[0013] In order to solve the above technical problems, the embodiment of the present application provides a tunnel encryption method, comprising: adding original forwarding information which is not modified and chip forwarding and configuration information in a preset field of a tunnel encrypted message; the original forwarding information is used for ECMP multi-path load sharing calculation and path consistency of an intermediate forwarding node, quality of service control, security policy execution, and selection of different encryption granularity.

[0014] In the above-mentioned tunnel encryption method, the insertion of the preset field is located after the IP packet L3 Header, so as to form a specific IP Protocol as a characteristic of the encrypted tunnel message; the original forwarding information includes at least one of the following forwarding information: L4 Dst Port, L4 Src Port, IP Protocol, VNI, Security Index, DSCP, SGT ID, and Inner HASH.

[0015] In order to solve the above technical problems, the present application also discloses a tunnel forwarding method, comprising: receiving a tunnel encrypted message generated according to the tunnel encryption implementation method as described above; identifying the message as a tunnel encrypted message; and performing forwarding path calculation and forwarding according to the original forwarding information in the preset field of the tunnel encrypted message.

[0016] In order to solve the above technical problems, the present application also discloses a tunnel decryption method, comprising: receiving a tunnel encrypted message sent according to the tunnel forwarding method as described above; identifying the message as a tunnel encrypted message and decrypting; and forwarding the decrypted tunnel encrypted message.

[0017] In order to solve the above technical problems, the present application also discloses a tunnel encryption device, comprising: an encryption node, adding original forwarding information which is not modified in a preset field of a tunnel encrypted message; the original forwarding information is used for ECMP multi-path load sharing calculation and path consistency of an intermediate forwarding node, quality of service control, security policy execution, and selection of different encryption granularity.

[0018] The insertion of the preset field is located after the position of the IP data packet L3 Header, so that a specific IP Protocol is formed as a characteristic of the encrypted tunnel message; the original forwarding information includes at least one of the following forwarding information: L4 Dst Port, L4 Src Port, IP Protocol, VNI, Security Index, DSCP, SGT ID, and Inner HASH.

[0019] To solve the above technical problems, the application further discloses a tunnel forwarding device, which comprises: a forwarding node, configured to receive a tunnel encrypted message generated according to the tunnel encryption implementation device; identify the message as a tunnel encrypted message; and perform forwarding path calculation and forwarding according to the original forwarding information in the preset field of the tunnel encrypted message.

[0020] To solve the above technical problems, the application further discloses a tunnel decryption device, which comprises: receiving a tunnel encrypted message sent according to the tunnel forwarding device; identifying the message as a tunnel encrypted message, and decrypting; and forwarding the decrypted tunnel encrypted message.

[0021] The application defines a reserved preset field in the tunnel encrypted data message, adds original forwarding information, such as L4 Dst Port of VXLAN, in the preset field without modification, so that the intermediate forwarding node can read the original forwarding information in the preset field to realize normal message ECMP multi-path load balancing calculation and forwarding; the intermediate forwarding node can read the original forwarding information in the preset field to realize different quality of service, such as inner IP DSCP of VXLAN; the intermediate forwarding node can read the original forwarding information in the preset field to realize security policies based on SGT security groups, such as VXLAN SGT security groups. The application defines an encryption protocol and its message format, carries original forwarding information through a preset field, realizes a general tunnel encryption scheme, and solves the problems existing in end-to-end tunnel encryption. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is a topology diagram of existing routing and forwarding of VXLAN encrypted data packets;

[0023] Figure 2 is a tunnel message structure diagram of embodiment 1;

[0024] Figure 3 is a tunnel message structure diagram of embodiment 1;

[0025] Figure 4 is a tunnel message structure diagram of embodiment 2. DETAILED DESCRIPTION

[0026] Embodiment One

[0027] The embodiment of the present application encapsulates a message based on an IP protocol.

[0028] At the encryption starting node, the VXLAN message processed by the switch based on the embodiment of the present application is shown in FIG. 1 and FIG. 2. The IP Protocol field of the IP header is updated to New IP Protocol, which is a special identifier, so that the message can be identified as a VXLAN data packet. As shown in FIG. 3, a preset field X-SEC Header is inserted after the IP header of the encrypted message, so that the embodiment forms a specific IP protocol different from the existing third layer network layer IP protocol, and the specific IP Protocol is used as one of the characteristics of the encrypted tunnel message. In the X-SEC Header, one or more forwarding information is supported, such as the IP Protocol of the original message. Figure 2 Figure 3 Figure 2

[0029] In the X-SEC Header, the following two types of fields are included:

[0030] (1) Type: 8 bits, identifying the type of the X-SEC Header, used to distinguish the carrying of different information;

[0031] (2) Next Header: 8 bits, identifying the analysis of the inner message header of the X-SEC Header;

[0032] The X-SEC Header supports the carrying of one or more forwarding information, which includes but is not limited to the following forwarding information fields:

[0033] (1) L4 Dst Port: 16 bits, identifying the original inner or outer L4 Dst Port;

[0034] (2) L4 Src Port: 16 bits, identifying the original inner or outer L4 Src Port;

[0035] (3) IP Protocol: 8 bits, identifying the original IP Protocol;

[0036] ​​​(4)Security Index: 16bit, used for Key index of encryption and decryption, which can flexibly map fine business;

[0037] (5)SGT ID: 16bit, used for global encryption and decryption Key, which can flexibly map fine business;

[0038] (6)DSCP: 6bit, indicating IP DSCP priority;

[0039] (7)VNI: 24bit, indicating VXLAN VNI or GRE VSI;

[0040] (8)Inner HASH: 16bit, indicating HASH calculation result based on tunnel inner layer message characteristics, used for participating in ECMP load balancing forwarding.

[0041] In the intermediate forwarding node, first parsing processing is performed, and the characteristics of the message are obtained according to the results, such as: IPSA, IPDA, New IP Protocol, and X-SEC Header and the like. Therefore, the intermediate node in the forwarding table entry lookup will look up the routing table item according to IPDA, and distinguish the encrypted message according to New IP Protocol (which is the same as the existing method). Different from the prior art, after identifying the encrypted message, the intermediate node will further participate in the ECMP HASH calculation according to the original IP Protocol carried by the X-SEC Header, so that the HASH factor extracted by the intermediate node ECMP forwarding before and after encryption remains unchanged, satisfying the ECMP HASH routing consistency.

[0042] In the decryption node, after the switch receives the encrypted message, the same first parsing processing is performed, so as to obtain the characteristics of the message according to the results, such as: IPSA, IPDA, New IP Protocol, and X-SEC Header and the like. Then according to New IP Protocol, it is distinguished that it is encrypted, therefore, the table item for matching decryption ACL is first found to perform decryption processing of the data message, and the routing table item is found according to the IPDA of the decrypted VXLAN message, and finally the decrypted message is ECMP forwarded.

[0043] The embodiment inserts a preset field X-SEC Header into a position after an IP packet L3 Header, and satisfies data center multi-overlay tunnel protocol networking by implementing a set of encryption schemes. The original forwarding information is used for intermediate forwarding node ECMP multi-path load sharing calculation and path consistency, quality of service control, security policy implementation, selection of different encryption granularity, etc. The original forwarding information is added in the preset field X-SEC, such as carrying L4Dst Port of VXLAN, so that the intermediate forwarding node can read the original forwarding information in the preset field to realize normal message ECMP multi-path load balancing calculation and forwarding; for example, carrying inner IP DSCP of VXLAN, so that the intermediate forwarding node can read the original forwarding information in the preset field to realize different quality of service; and for example, carrying VXLAN SGT security group, so that the intermediate forwarding node can read the original forwarding information in the preset field to realize security policy based on SGT security group, etc.

[0044] Embodiment two

[0045] The embodiment of the application performs data encryption and decryption and forwarding through a GRE tunnel.

[0046] In the encryption starting node, the format of the VXLAN message after encryption processing by the switch based on the embodiment of the application is as shown in Figure 4 The IP Protocol field of the IP header is updated to New IP Protocol because of the encryption operation of the GRE / NVGRE packet, and the New IP Protocol is a special identifier and is uniformly identified as a message that has been encrypted as GRE / NVGRE packet ciphertext.

[0047] In order to avoid that the intermediate node cannot extract the original GRE inner IP five-tuple information in the encrypted message to participate in ECMP HASH calculation during ECMP forwarding, the IP five-tuple and other fields in the original GRE inner message before encryption are extracted at the decryption starting node, the ECMP HASH calculation is completed in advance at the encryption starting node, and the ECMP HASH calculation result is extracted to the Inner HASH field of the X-SEC Header. As shown in Figure 4 The encrypted message is inserted with the X-SEC Header after the IP header, and the X-SEC Header supports carrying one or more forwarding information, such as carrying the Inner HASH of the original message.

[0048] At the intermediate forwarding node, first, the parsing processing is performed, and the characteristics of the message are obtained according to the result, such as IPSA, IPDA, New IP Protocol, and X-SEC Header and the like. Therefore, the intermediate node performs the forwarding table entry lookup according to the IPDA, and distinguishes the encrypted message according to the New IP Protocol. After identifying the encrypted message, the Inner HASH carried in the X-SEC Header is further used for participating in the ECMP HASH calculation, so that the extracted HASH factor of the intermediate node ECMP forwarding remains unchanged before and after encryption, and the ECMP HASH routing consistency is met.

[0049] At the decryption node, after the switch receives the encrypted message, first, the parsing processing is performed, and the characteristics of the message are obtained according to the result, such as IPSA, IPDA, New IP Protocol, and X-SEC Header and the like. Then, the encrypted message is distinguished according to the New IP Protocol. Therefore, the table entry for matching the decryption ACL is first found to perform the decryption processing of the data message, and the routing table entry is found according to the IPDA of the decrypted GRE message, and finally, the decrypted message is subjected to the ECMP forwarding.

[0050] In summary of the above embodiment one to embodiment two, the tunnel encryption protocol of the application can support various tunnels, including but not limited to VXLAN, GRE / NVGRE, IPv4 / IPv6 Tunnel, SRv6, GENEVE, realizes the IPHeader-based encryption scheme, supports passing through the intermediate IP three-layer network in deployment, simplifies the intermediate node capability requirement, and has the deployment capability of realizing end-to-end security encryption. Meanwhile, the application designs carry one or more forwarding information in the X-SEC Header, enhances the expansibility of the encryption protocol, solves the problems of ECMP multi-path load sharing forwarding path consistency, service quality, security policy and operation and maintenance management, and fine encryption granularity.

[0051] Embodiment three

[0052] The embodiment discloses a tunnel encryption, forwarding and decryption device, which comprises:

[0053] The encryption node adds the original forwarding information which is not modified and chip forwarding and configuration information in the preset field of the tunnel encrypted message. The original forwarding information is used for ECMP multi-path load sharing calculation and path consistency of the intermediate forwarding node, service quality control, security policy execution, and selection of different encryption granularity.

[0054] In a specific implementation, the preset field is inserted after the IP packet L3 Header. The original forwarding information includes at least one of the following forwarding information: L4 Dst Port, L4 Src Port, VNI, SecurityIndex, DSCP, SGT ID, Inner HASH.

[0055] In a specific implementation, the tunnel includes VXLAN, GRE / NVGRE, IPv4 / IPv6 Tunnel, SRv6, GENEVE.

[0056] The tunnel forwarding device of the embodiment includes: a forwarding node, configured to receive a tunnel encrypted message generated by the tunnel encryption implementation device; identify the message as a tunnel encrypted message; and perform forwarding path calculation and forwarding according to the original forwarding information in the preset field of the tunnel encrypted message.

[0057] The tunnel decryption device of the embodiment includes: receiving a tunnel encrypted message sent by the tunnel forwarding device; identifying the message as a tunnel encrypted message and decrypting; and forwarding the decrypted tunnel encrypted message.

[0058] Those skilled in the art can understand that the tunnel encryption, forwarding and decryption device of the fourth embodiment is based on the same inventive concept as the tunnel encryption, forwarding and decryption methods of the first to third embodiments, and therefore the content of the related embodiments can be referred to the corresponding content in the foregoing, which will not be described here.

[0059] Those skilled in the art can understand that all or part of the steps in the various methods of the above embodiments can be completed by programs instructing related hardware, and the programs can be stored in a computer readable storage medium, which can include ROM, RAM, magnetic disk or optical disk, etc.

[0060] Although the present application is disclosed as above, the present application is not limited thereto. Any person skilled in the art can make various changes and modifications without departing from the spirit and scope of the present application, and therefore the protection scope of the present application should be subject to the scope defined by the claims.

Claims

1. A tunneling encryption method, characterized by, The method comprises the following steps: adding original forwarding information which is not modified into a preset field of a tunnel encrypted packet; the original forwarding information is used for ECMP multi-path load sharing calculation and path consistency of an intermediate forwarding node, quality of service control, security policy implementation, and selection of different encryption granularity; the preset field is inserted after an IP packet L3 Header, adjacent to an IP Header, so as to form a specific IP Protocol as a characteristic of the encrypted tunnel packet; the original forwarding information comprises at least one of the following forwarding information: L4 Dst Port, L4 Src Port, IP Protocol, VNI, Security Index, DSCP, SGT ID, and Inner HASH; an intermediate node receives the generated tunnel encrypted packet and identifies the packet as a tunnel encrypted packet; the intermediate node performs forwarding path calculation according to the original forwarding information in the preset field of the tunnel encrypted packet and forwards the packet.

2. A tunnel decryption method characterized by comprising: The method comprises the following steps: receiving a tunnel encrypted packet sent according to the tunnel encryption method in claim 1; identifying the packet as a tunnel encrypted packet and decrypting the packet; forwarding the decrypted tunnel encrypted packet.

3. A tunneling encryption apparatus characterized by comprising: The method comprises the following steps: an encryption node adds original forwarding information which is not modified into a preset field of a tunnel encrypted packet, and a chip forwarding and configuration information; the original forwarding information is used for ECMP multi-path load sharing calculation and path consistency of an intermediate forwarding node, quality of service control, security policy implementation, and selection of different encryption granularity; the preset field is inserted after an IP packet L3 Header, so as to form a specific IP Protocol as a characteristic of the encrypted tunnel packet; the original forwarding information comprises at least one of the following forwarding information: L4 Dst Port, L4 Src Port, IP Protocol, VNI, Security Index, DSCP, SGT ID, and Inner HASH; a forwarding node receives a tunnel encrypted packet generated by the tunnel encryption implementation device; identifying the packet as a tunnel encrypted packet; and performing forwarding path calculation according to the original forwarding information in the preset field of the tunnel encrypted packet and forwarding the packet.

4. A tunnel decryption apparatus characterized by comprising: The method comprises the following steps: receiving a tunnel encrypted packet sent according to the tunnel encryption device in claim 3; identifying the packet as a tunnel encrypted packet and decrypting the packet; forwarding the decrypted tunnel encrypted packet.

Images