A message processing method and device based on a CloudSec network

Abstract

The application discloses a message processing method and device based on a CloudSec network, wherein the method comprises the following steps: analyzing a received message, and matching acquired analysis information with a preset processing strategy; according to the preset processing strategy, selecting to perform pass processing, discard processing or decryption processing on the message; performing a regular forwarding operation on a plaintext message after pass processing or a ciphertext message after decryption processing. Through the device and the method, the problem that other management control functions are affected when the corresponding encryption and decryption, pass, and discard operations are performed on the CloudSec message through ACL in the prior art can be solved.

Description

TECHNICAL FIELD

[0001] The present application relates to network communication technology, in particular to a message processing method and device based on a CloudSec network. BACKGROUND

[0002] CloudSec defines a data security communication method of a VXLAN network, and can provide a user with a secure IP layer data sending and receiving service, including user data encryption and decryption, data encryption data integrity check, and replay protection.

[0003] CloudSec uses IP layer encryption technology, provides point-to-point data security transmission of an Overlay network, and is suitable for government, finance, military, and other data center scenarios with high requirements for data confidentiality. CloudSec is complementary to MACSec technology, and the forwarding plane multiplexes the MACSec encryption algorithm, can support VXLAN message encryption and decryption, and can also meet the needs of Overlay VXLAN network forwarding for IP layer information. In combination with the MACSec technology, complete end-to-end security communication services can be provided.

[0004] After the original message of a VM or a physical server is assembled and MACSec encryption is completed, the message is sent out, and after the message is received on a network device in transit, the message needs to be decrypted (decapsulated) and encrypted (capsulated) first, the message is forwarded using the MAC / IP, and after the message reaches the destination, the MACSec encrypted message is decrypted by a tunnel termination point and sent to the VM or the physical server. In the VXLAN protocol, the termination point of the tunnel is called a VTEP, which is responsible for CloudSec encryption and encapsulation of a VXLAN tunnel header and CloudSec decryption and decapsulation of the VXLAN tunnel header.

[0005] According to the protocol, after successful CloudSec negotiation on the VTEP, the data message in the link is generally encrypted for transmission, and the plaintext message needs to be discarded.

[0006] However, at this time, some special plaintexts are still allowed to be transmitted in the link, and these special plaintexts can be divided into three categories.

[0007] 1) CloudSec control plane protocol MKAinVxlan, which is used to negotiate and generate a CloudSec key and cannot be encrypted.

[0008] 2) The CloudSec negotiation result is still transmitted in plaintext, and at this time, the data message does not need to be encrypted.

[0009] 3) Residual plaintext, for example, the intermediate state from the CloudSec enablement to the successful negotiation, and the data message has not been encrypted.

[0010] For the first type of plaintext, always take the strategy of plaintext transmission.

[0011] For the second type of plaintext, select the strategy of encryption and decryption or plaintext transmission according to the negotiation result.

[0012] For the third type of plaintext, the user can configure different strategies according to the application scenario:

[0013] 1) Traffic priority strategy

[0014] At this time, it is necessary to prioritize traffic to ensure that there is no packet loss, and encryption is sufficient. The residual plaintext received is processed by the strategy.

[0015] 2) Security priority strategy

[0016] At this time, it is necessary to prioritize security to prevent plaintext message transmission from causing user information leakage. Once the CloudSec function is enabled on the VTEP, all other plaintext messages except the first type of plaintext are discarded.

[0017] For this, one approach in the prior art is to not distinguish messages when the VTEP enables the CloudSec function, that is, all messages are encrypted and decrypted, and the received plaintext messages are also processed normally. This approach cannot guarantee security, and residual plaintext may leak user information.

[0018] Another approach is to identify different traffic through an Access Control List (ACL) module, and then take corresponding encryption, decryption, pass, and discard operations as needed.

[0019] For example: For special plaintext traffic received, the ACL matches special plaintext features, and takes the pass operation; for ciphertext traffic received, the ACL matches CloudSec message features, and takes the decryption operation; for other plaintext traffic received, a default ACL is configured, and the discard operation is taken.

[0020] However, according to the above scheme, the ACL module must be before the CloudSec module, so that the decrypted data message cannot be processed by the ACL related process. Therefore, it will have a great impact on firewall, QoS and other services. SUMMARY

[0021] The technical problem to be solved by the embodiments of the present application is how to solve the problem that in the prior art, when the ACL takes corresponding encryption, decryption, pass, and discard operations on the CloudSec message, other management control functions are affected.

[0022] To solve the above technical problems, the embodiment of the present application provides a message processing method based on a CloudSec network, applied to an ASIC chip, comprising: analyzing a received message and matching acquired analysis information with a preset processing strategy; selecting, according to the preset processing strategy, pass processing, discard processing or decryption processing for the message; performing a regular forwarding operation on a plaintext message after pass processing or a ciphertext message after decryption processing.

[0023] In the above message processing method based on the CloudSec network, the analyzing the received message comprises: analyzing outer three-layer and four-layer information, inner two-layer information and port information of the message.

[0024] In the above message processing method based on the CloudSec network, the matching the acquired analysis information with the preset processing strategy comprises: identifying data flow characteristic information of the message according to the acquired analysis information, and identifying messages with the same data flow characteristic information as the same data flow; and matching corresponding actions in a CloudSec flow table according to the identified data flow characteristic information.

[0025] In the above message processing method based on the CloudSec network, in the CloudSec flow table issued under the MKAin Vxlan protocol, the action corresponding to the data flow characteristic information of the MKAin Vxlan message is pass.

[0026] In the above message processing method based on the CloudSec network, when there is one or more CloudSec opposite ends, the CloudSec flow table issued by each opposite end is set respectively, different five-tuples are used as the data flow characteristic information, and decryption and different decryption parameters are used as the corresponding actions; when there is one or more CloudSec opposite ends, the CloudSec flow table issued by each opposite end is set respectively, different five-tuples are used as the data flow characteristic information, and pass is set as the corresponding action when traffic is prioritized; and discard is set as the corresponding action when security is prioritized.

[0027] In the above message processing method based on the CloudSec network, after the regular forwarding operation is performed, the method further comprises: analyzing a received message and matching acquired analysis information with a preset processing strategy; selecting, according to the preset processing strategy, pass processing, discard processing or encryption processing for the message; and performing a regular forwarding operation on the message after pass processing or encryption processing.

[0028] To solve the above technical problems, the embodiment of the present application also provides a message processing device based on a CloudSec network, which is applied to an ASIC chip and comprises a CloudSec decryption engine unit for parsing a received message and matching acquired parsing information with a preset processing strategy; and for selecting pass processing, discard processing or decryption processing of the message according to the preset processing strategy; and an inbound processing unit for performing a regular forwarding operation on a plaintext message after pass processing or a ciphertext message after decryption processing.

[0029] In the message processing device based on the CloudSec network, the parsing unit parses outer three or four layer information, inner two layer information and port information of the message.

[0030] In the message processing device based on the CloudSec network, the CloudSec decryption engine unit is used for identifying data flow characteristic information of the message according to the acquired parsing information, and identifying messages with the same data flow characteristic information as the same data flow; and in a CloudSec flow table, matching corresponding actions according to the identified data flow characteristic information.

[0031] In the message processing device based on the CloudSec network, in a CloudSec flow table issued under an MKAin Vxlan protocol, the action corresponding to the data flow characteristic information of the MKAin Vxlan message is pass.

[0032] In the message processing device based on the CloudSec network, when there is one or more CloudSec opposite ends, the CloudSec flow table issued by each opposite end is set respectively, different five tuples are set as the data flow characteristic information, and decryption and different decryption parameters are set as the corresponding actions; and when there is one or more CloudSec opposite ends, the CloudSec flow table issued by each opposite end is set respectively, different five tuples are set as the data flow characteristic information, pass is set as the corresponding action when traffic priority is considered, and discard is set as the corresponding action when security priority is considered.

[0033] In the message processing device based on the CloudSec network, the device further comprises a CloudSec encryption engine unit for parsing a received message and matching acquired parsing information with a preset processing strategy; and for selecting pass processing, discard processing or encryption processing of the message according to the preset processing strategy.

[0034] The present application aims at the problems in the prior art, and by matching the received message with a preset processing strategy according to message information before processing the message in the incoming direction, the passing, discarding and decryption operation of various flows in the incoming direction can be controlled very flexibly in the front end, and the passing, discarding and encryption operation in the outgoing direction can also be implemented correspondingly. Therefore, the plaintext message generated after decryption can still be subjected to the regular service processing such as ACL, and will not be affected. BRIEF DESCRIPTION OF DRAWINGS

[0035] Figure 1 is a flowchart of the chip processing level in the embodiment of the present application;

[0036] Figure 2 is a processing flowchart in the ASIC chip in the embodiment of the present application;

[0037] Figure 3 is a processing flowchart in the CloudSec decryption engine in the embodiment of the present application;

[0038] Figure 4 is a processing flowchart in the CloudSec encryption engine in the embodiment of the present application. DETAILED DESCRIPTION

[0039] In the prior art, the processing of the CloudSec plaintext message is as follows: when the VTEP enables the CloudSec function, the message is not distinguished, that is, all messages are subjected to encryption and decryption processing, and the received plaintext message is also subjected to normal processing. This method cannot guarantee security, and the residual plaintext may leak user information. Another method is to identify different flows through an access control list (ACL) module, and then take corresponding encryption and decryption, passing and discarding operations according to needs.

[0040] For example, for the received special plaintext flow, the ACL matches the special plaintext characteristics, and takes the passing operation; for the received ciphertext flow, the ACL matches the CloudSec message characteristics, and takes the decryption operation; and for the received other plaintext flow, a default ACL is configured, and the discarding operation is taken. However, according to the above scheme, the ACL module must be before the CloudSec module, so that the ACL related processing cannot be performed on the decrypted data message. Therefore, the firewall, QoS and other services will be greatly affected.

[0041] In view of the problems in the prior art, the embodiments of the present application can control the passing, discarding and decryption operation of various flows in the incoming direction very flexibly by matching the received message with the preset processing strategy according to the message information before processing the message in the incoming direction, and the passing, discarding and encryption operation in the outgoing direction can also be implemented correspondingly. Therefore, the plaintext message generated after decryption can still be processed normally, such as ACL, and will not be affected.

[0042] In order to make the above objectives, characteristics and advantages of the present application more obvious and easy to understand, the specific embodiments of the present application will be described in detail below with reference to the drawings.

[0043] The message processing method based on the CloudSec network in the embodiments of the present application can be applied to an ASIC chip. The ASIC (Application Specific Integrated Circuit) is an integrated circuit designed for a specific purpose, and in the embodiments, the main function thereof is to forward data messages. Therefore, as shown in the figure, in the present scheme, the related processing of CloudSec will be moved to the ASIC chip for processing, instead of the PHY chip (physical medium layer). Specifically, the message processing method based on the CloudSec network in the embodiments of the present application comprises the following steps: Figure 1

[0044] In step S101, the received message is parsed, and the parsed information obtained is matched with the preset processing strategy.

[0045] As shown in the figure, when receiving the message from the network access port, the message is first processed by the CloudSec decryption engine, and then transferred to the next step of the incoming direction processing unit for data forwarding and the like. At this time, the received message can be a data message encrypted and transmitted in the link after the successful negotiation of CloudSec, or a special plaintext allowed to be transmitted in the link. The role of the CloudSec decryption engine in the embodiments is to decrypt the received CloudSec message, or to control the passing or discarding of the received plaintext message. Figure 2

[0046] In the specific implementation, firstly, it is judged whether the CloudSec decryption engine is enabled and whether the ASIC chip supports the selection of opening the CloudSec decryption function. If it is not in the CloudSec scenario or the CloudSec decryption function is not supported, it is equal to passing processing, and the message will skip the CloudSec decryption / encryption engine processing. At this time, the message only needs to perform the incoming direction processing, scheduling and outgoing direction processing steps, and the three steps are also called the conventional processing, which is the same as the prior art.

[0047] ​​In a specific implementation, after the judgment of whether the CloudSec decryption engine is enabled is completed, it is further judged whether the message entry port enables the CloudSec decryption function. The ASIC chip can support the control of whether to open the CloudSec decryption function according to the port, so if the CloudSec decryption function is not enabled on the entry port, it is equal to pass the message through processing, and the message is processed by the regular forwarding processing.

[0048] In the embodiment, the CloudSec engine mainly consists of a message analysis unit, a CloudSec flow table and a decryption engine. The message analysis unit is used to analyze the message entering the CloudSec decryption engine, including plaintext and ciphertext, and the analyzed message information is used to search the CloudSec flow table.

[0049] The CloudSec Flow consists of two parts: KEY and Action. KEY represents data flow characteristic information, and all messages with the same data flow characteristic information are automatically identified as the same data flow Flow. For the CloudSec Flow, the outer three or four layer information, the inner two layer information and the port information of the message are generally used:

[0050] 1. Source IPv4 / IPv6 address (ipv4Sa / ipv6Sa);

[0051] 2. Destination IPv4 / IPv6 address (ipv4Da / ipv6Da);

[0052] 3. IP protocol number (ipProtocol);

[0053] 4. Source port number (l4SourcePort);

[0054] 5. Destination port number (l4DestPort);

[0055] 6. Inner source MAC address (innerMacSa);

[0056] 7. Inner destination MAC address (innerMacDa);

[0057] 8. Inner Ethernet type (innerEtherType);

[0058] 9. Port number (port);

[0059] 10. Other.

[0060] Based on the obtained parsing information, the data flow feature information of the packets can be identified, and packets with the same data flow feature information can be identified as the same data flow. Then, the corresponding action can be matched in the CloudSec flow table.

[0061] Step S102: According to the preset processing strategy, select whether to process the message by passing through, discarding, or decrypting it.

[0062] If an Action can be matched in the CloudSec Flow, that Action will be executed first; if no Action is found, the default preset Action can be matched and executed on the Port.

[0063] In CloudSec flow tables, Action represents the processing strategy for that flow, including four types: pass, discard, encrypt, and decrypt. CloudSec Flows can be divided into decryption Flows and encryption Flows, such as... Figure 2 As shown, the former is located in the CloudSec decryption engine and supports three processing strategies: pass, discard, and decrypt. The latter is located in the CloudSec encryption engine and supports three processing strategies: pass, discard, and encrypt.

[0064] In this embodiment, if the Action is passed, the packet is forwarded normally; if the Action is dropped, the packet is dropped; if the Action is decrypted, decryption parameters are generated, and the CloudSec decryption engine uses the decryption parameters to decrypt the packet.

[0065] In practical implementation, corresponding settings can be made for some typical requirements:

[0066] For example, to allow plaintext reception of MKA in Vxlan control plane messages, the action corresponding to the data flow characteristic information of the MKA in Vxlan message can be set to "pass" in the CloudSec flow table issued under the MKA in Vxlan protocol. The configuration for allowing plaintext reception of special cases messages in the corresponding CloudSec Flow issued under the MKA in Vxlan protocol is as follows: Set Key: innerEtherType = 0x888E (the inner Ethernet type of the MKA in Vxlan message is 0x888E), Action: pass.

[0067] For example, when decrypting CloudSec packets, different peers may use different decryption parameters. In this case, different 5-tuples can be set in the CloudSec flow table issued by each peer, with different parameters representing the data flow characteristics, and different decryption methods and parameters representing the corresponding actions. Specifically, the configuration is: Key: ipv4Sa / ipv6Sa+ipv4Da / ipv6Da+ipProtocol+l4SourcePort+l4DestPort (where l4DestPort is the CloudSec port number), Action: Decrypt + decryption parameters.

[0068] Depending on different network security priorities, corresponding policies can be set. For example, a traffic-first policy would have the action "pass," allowing plaintext traffic to pass; while a security-first policy would have the action "discard," discarding plaintext. This way, if user needs change, modifying the policy is convenient; the action can be changed directly.

[0069] There is also a situation where non-Vxlan and non-CloudSec traffic may pass through the port, so the port can be configured to allow traffic to pass through, i.e., Action: pass.

[0070] Step S103: Perform the normal forwarding operation.

[0071] like Figure 2 As shown, after the CloudSec decryption engine completes the corresponding Action, except for packets that are discarded, the inbound processing unit receives plaintext packets decrypted by CloudSec or plaintext packets allowed by the CloudSec engine. At this point, these plaintext packets undergo regular forwarding processing, including ACL processing. After the inbound processing unit completes its processing, it forwards the plaintext packets to the scheduling unit for regular scheduling processing. Then, the outbound processing unit performs regular editing processing on the plaintext packets, including ACL processing.

[0072] The processing flow of the CloudSec decryption engine in steps S101 to S103 can be found in [reference needed]. Figure 3 The flowchart shown is shown.

[0073] Step S104: Parse the received message and match the obtained parsing information with the preset processing strategy;

[0074] In contrast to step S101, a similar message parsing action is performed by the parsing unit in the CloudSec encryption engine.

[0075] In practical implementation, you can first determine whether the CloudSec encryption engine is enabled. The ASIC chip supports selecting whether to enable or disable the CloudSec encryption function. If the CloudSec encryption engine is not enabled, it is equivalent to processing the message before sending. Next, determine whether the message output port has the CloudSec encryption function enabled. The ASIC chip supports controlling whether to enable or disable the CloudSec encryption function on a port-by-port basis. If it is not enabled, it is equivalent to processing the message before sending.

[0076] In practice, the messages are parsed and processed, mainly extracting the second and third layer information.

[0077] Step S105: According to the preset processing strategy, select whether to process the message by passing through, discarding, or encrypting it.

[0078] Similarly, the CloudSec encryption engine controls the processing of received plaintext packets by matching the CloudSec flow table, allowing them to be encrypted, passed through, or discarded. If the Action is "pass," the packet is sent directly; if the Action is "discard," the packet is discarded; if the Action is "encrypt," encryption parameters are provided, and the packet is encrypted using these parameters.

[0079] Step S106: Perform a regular forwarding operation on the processed or encrypted message.

[0080] After successful encryption, the encrypted ciphertext or the plaintext message that is directly forwarded is sent according to the usual process.

[0081] The processing flow of the CloudSec encryption engine in steps S104 to S106 can be found in [reference needed]. Figure 4 The flowchart shown is shown.

[0082] This embodiment adds packet parsing and CloudSec Flow modules to the CloudSec engine, enabling flexible control over packet passage, dropping, encryption, and decryption operations based on Flow. Users can easily apply various CloudSec plaintext policies by adding, deleting, or modifying CloudSec flow table actions according to their needs. For decrypted plaintext packets, normal packet processing, such as ACL service processing, remains unaffected and can be configured normally.

[0083] Corresponding to the foregoing method embodiments, the present invention also discloses corresponding embodiments of a packet processing apparatus based on a CloudSec network, including:

[0084] The CloudSec decryption engine unit is used to parse the received packets and match the obtained parsing information with a preset processing strategy; and to select whether to process, discard, or decrypt the packets according to the preset processing strategy; the inbound processing unit is used to perform regular forwarding operations on the plaintext packets after processing or the ciphertext packets after decryption.

[0085] In specific implementation, the parsing unit parses the outer third and fourth layer information, the inner second layer information, and the port information of the message.

[0086] In specific implementation, the CloudSec decryption engine unit is used to identify the data flow feature information of the packets based on the obtained parsing information, and identify packets with the same data flow feature information as the same data flow; in the CloudSec flow table, it matches the corresponding action based on the identified data flow feature information.

[0087] In practice, the action corresponding to the data flow characteristic information of the MKA inVxlan packet in the CloudSec flow table issued by the MKA inVxlan protocol is "pass".

[0088] In practical implementation, when one or more CloudSec peers exist, each peer's CloudSec flow table is configured with different 5-tuples as data flow feature information, and different decryption parameters as corresponding actions; and,

[0089] When there are one or more CloudSec peers, the CloudSec flow table issued by each peer is configured with different five-tuples as the data flow feature information, and when traffic is prioritized, the pass is set as the corresponding action; when security is prioritized, the drop is set as the corresponding action.

[0090] In a specific implementation, the message processing device based on the CloudSec network further includes: a CloudSec encryption engine unit, used to parse the received message and match the obtained parsing information with a preset processing strategy; and, according to the preset processing strategy, to select whether to process the message by passing, discarding, or encrypting it.

[0091] Those skilled in the art will understand that the packet processing device based on the CloudSec network in this embodiment and the aforementioned packet processing method based on the CloudSec network are based on the same inventive concept. Therefore, the content of the relevant embodiments can be referred to the corresponding content above, and will not be repeated here.

[0092] Those skilled in the art will understand that all or part of the steps in the various methods of the above embodiments can be implemented by a program instructing related hardware. The program can be stored in a computer-readable storage medium, which may include ROM, RAM, disk, or optical disk, etc.

[0093] While the present invention has been disclosed above, it is not limited thereto. Any person skilled in the art can make various modifications and alterations without departing from the spirit and scope of the invention; therefore, the scope of protection of the present invention should be determined by the scope defined in the claims.

Claims

1. A message processing method based on a CloudSec network, characterized in that, Applied to ASIC chips, including: Parse the received messages and match the obtained parsing information with the preset processing strategy; According to the preset processing strategy, the message is selected to be processed by passing through, discarding, or decrypting. Perform regular forwarding operations on the processed plaintext message or the decrypted ciphertext message; The process of matching the acquired parsing information with a preset processing strategy includes: identifying the data flow feature information of the packets based on the acquired parsing information, and identifying packets with the same data flow feature information as the same data flow; and matching the corresponding action in the CloudSec flow table based on the identified data flow feature information. In the CloudSec flow table issued by the MKA in Vxlan protocol, the action corresponding to the data flow feature information of the MKA in Vxlan packet is "pass"; when there are one or more CloudSec peers, the CloudSec flow table issued by each peer is set with different 5-tuples as the data flow feature information, as well as decryption and different decryption parameters as the corresponding action; When there are one or more CloudSec peers, the CloudSec flow table issued by each peer is configured with different five-tuples as the data flow feature information, and when traffic is prioritized, the pass is set as the corresponding action; when security is prioritized, the drop is set as the corresponding action.

2. The message processing method based on CloudSec network as described in claim 1, characterized in that, The parsed received message includes: the outer third and fourth layer information, the inner second layer information, and the port information.

3. The message processing method based on CloudSec network as described in claim 1, characterized in that, After performing the regular forwarding operation, it also includes: Parse the received messages and match the obtained parsing information with the preset processing strategy; According to the preset processing strategy, the message is selected to be processed by passing through, discarding, or encrypting. Perform regular forwarding operations on messages that have been processed or encrypted.

4. A packet processing apparatus based on a CloudSec network, employing the packet processing method based on a CloudSec network as described in any one of claims 1-3, characterized in that, Applied to ASIC chips, including: The CloudSec decryption engine unit is used to parse received messages and match the obtained parsed information with a preset processing strategy; and, Used to select whether to process, discard, or decrypt a message according to the preset processing strategy. The inbound processing unit is used to perform regular forwarding operations on the processed plaintext message or the decrypted ciphertext message.

5. The message processing apparatus based on the CloudSec network as described in claim 4, characterized in that, The CloudSec decryption engine unit parses the outer third and fourth layer information, the inner second layer information, and the port information of the message.

6. The message processing apparatus based on the CloudSec network as described in claim 4 or 5, characterized in that, The CloudSec decryption engine unit is used for, Based on the obtained parsing information, the data flow feature information of the messages is identified, and messages with the same data flow feature information are identified as the same data flow; In the CloudSec flow table, the corresponding action is matched based on the identified data flow feature information.

7. The message processing apparatus based on the CloudSec network as described in claim 6, characterized in that, In the CloudSec flow table issued under the MKA in Vxlan protocol, the action corresponding to the data flow characteristic information of the MKA in Vxlan message is "pass".

8. The message processing apparatus based on the CloudSec network as described in claim 6, characterized in that, When one or more CloudSec peers exist, each peer sends a CloudSec flow table with different 5-tuples as the data flow characteristic information, and different decryption parameters as the corresponding actions; and, When there are one or more CloudSec peers, the CloudSec flow table issued by each peer is configured with different five-tuples as the data flow feature information, and when traffic is prioritized, the pass is set as the corresponding action; when security is prioritized, the drop is set as the corresponding action.

9. The message processing apparatus based on the CloudSec network as described in claim 4, characterized in that, Also includes: The CloudSec encryption engine unit is used to parse the received messages and match the obtained parsing information with a preset processing strategy. as well as, According to the preset processing strategy, the message can be processed by passing through, discarding, or encrypting.

Images