Gateway based on WireGuard protocol

Abstract

The present invention provides an encrypted communication method and gateway architecture based on the WireGuard protocol, which relates to the field of network communication technology. In response to a handshake request initiated by a client based on the WireGuard protocol to a server, the client creates a request packet according to the data to be communicated and a preset encryption algorithm; the preset encryption algorithm includes SM2, SM3, and SM4; the server processes the received request packet based on the preset encryption algorithm to generate a response packet; wherein the response packet includes the data to be communicated; the client processes the response packet based on the preset encryption algorithm to establish a communication connection between the client and the server. The encrypted communication method provided by this solution is more secure and can meet the needs of domestic information innovation.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to an encryption communication method and a gateway based on the WireGuard protocol. Background Art

[0002] With the development of network communication technology, network communication security has become an important link in network communication that cannot be ignored. How to provide a safe and efficient network communication channel is a concern for technicians in related fields, especially for government agencies, finance, and medical fields involving confidentiality and high-tech content, which put forward more stringent requirements for network communication security.

[0003] The current gateway processing solution based on the WireGuard encrypted tunnel protocol is based on the Linux kernel development and deep customization of the WireGuard used in the tunnel protocol between it and the client. The encryption and decryption algorithms involved in the negotiation interaction framework and data processing flow are all public commercial algorithms, which cannot meet the needs of domestic information innovation and have poor security performance. Therefore, an encrypted communication method and gateway based on the WireGuard protocol are urgently needed. Summary of the invention

[0004] The present invention provides an encrypted communication method and a gateway based on the WireGuard protocol. The encrypted communication method has higher security and can meet the needs of domestic information innovation.

[0005] In a first aspect, the present invention provides an encrypted communication method based on the WireGuard protocol, comprising:

[0006] In response to a handshake request initiated by a client based on the WireGuard protocol to a server, the client creates a request packet according to the data to be communicated and a preset encryption algorithm; the preset encryption algorithm includes SM2, SM3, and SM4;

[0007] The server processes the received request packet based on the preset encryption algorithm to generate a response packet; wherein the response packet includes the data to be communicated;

[0008] The client processes the response packet based on the preset encryption algorithm to establish a communication connection between the client and the server.

[0009] Optionally, the client creates a request packet according to the data to be communicated and a preset encryption algorithm, including:

[0010] Obtaining the local public key of the server, the first local public key of the client, and a timestamp;

[0011] Randomly generate a temporary private key, and use SM2 to calculate the temporary private key and the local public key of the server to obtain a first shared key;

[0012] Perform encryption operation on the timestamp and the first shared key using SM4 to obtain an encrypted timestamp;

[0013] Perform encryption operation on the first local public key and the first shared key using SM4 to obtain an encrypted public key;

[0014] The temporary private key is operated by SM2 to obtain a temporary public key;

[0015] Generate handshake data based on the data packet type of the data to be communicated, the temporary public key, the encryption timestamp, and the encryption public key;

[0016] The local public key of the server and the random string are calculated using HMAC-SM3 to obtain a first key value, and the first key value and the handshake data are calculated using HMAC-SM3 to obtain a first code value;

[0017] The handshake data and the first code value are packaged to obtain the request packet.

[0018] Optionally, the server processes the received request packet based on the preset encryption algorithm to generate a response packet, including:

[0019] Obtain the encrypted public key, temporary public key, encrypted timestamp, local private key of the server, and stored public key table included in the request packet;

[0020] The temporary public key and the local private key of the server are operated using SM2 to obtain a second shared key;

[0021] The encrypted public key and the second shared key are decrypted using SM4 to obtain the public key of the client; wherein, when the public key is located in the public key table, the response packet is generated.

[0022] Optionally, it also includes:

[0023] The encrypted timestamp and the second shared key are decrypted using SM4 to obtain a timestamp;

[0024] The timestamp and the randomly obtained random number are hashed to obtain a random value; the random value is operated using HMAC-SM3 to obtain a key parameter.

[0025] Optionally, in the process of generating the response packet, the Curve25519 encryption algorithm in the WireGuard protocol is replaced by SM2, the ChaCha20-Poly1305 algorithm is replaced by SM4, and the Black2s algorithm is replaced by HMAC-SM3.

[0026] Optionally, before the server processes the received request packet based on the preset encryption algorithm, the method further includes:

[0027] Obtaining a local private key of the server, and obtaining the handshake data and the first code value from the request packet;

[0028] The local private key of the server is calculated using SM2 to obtain a second local public key;

[0029] The second local public key and the preset character string are operated by SM3 to obtain a second key value, and the second key value and the handshake data are operated by HMAC-SM3 to obtain a second code value;

[0030] Determining whether the first code value and the second code value are the same;

[0031] If so, the verification is successful and the request packet will be processed.

[0032] In a second aspect, an embodiment of the present invention further provides a gateway of the WireGuard protocol, characterized in that it includes: a kernel and a user state;

[0033] The kernel includes a physical network card registration interface and a kernel driver module; the physical network card registration interface is used to receive a data packet obtained by the physical network card;

[0034] The user state includes a user state driver module; the kernel driver module is communicatively connected with the user state driver module to pass the data packet from the physical network card directly to the user state;

[0035] The user state is deployed with the WireGuard protocol, and a control plane module and a data plane module are generated in the user state according to the WireGuard protocol; the control plane module is used to establish a WireGuard tunnel using the encrypted communication method described in the first aspect above; the data plane module is used to implement the transmission of the data packet according to the WireGuard tunnel.

[0036] Optionally, the user state further includes a socket interface and a Freebsd user state protocol stack; the data packet transmitted by the kernel is received and processed by the Freebsd user state protocol stack and the socket interface; and / or,

[0037] The data plane module includes a WireGuard encryption unit and a WireGuard decryption unit; the WireGuard encryption unit is used to implement encryption processing of the data packet, and the WireGuard decryption unit is used to implement decryption processing of the data packet.

[0038] Optionally, the gateway further includes: a shared table entry, in which configuration information negotiated by the control plane module is stored, and the data plane module is used to read the configuration information to realize the transmission of the data packet through the WireGuard tunnel.

[0039] Optionally, the user state also includes a proxy server; after the data packet transmitted by the kernel is encrypted or decrypted by the Freebsd user state protocol stack, the proxy server completes the packet receiving process through the socket interface.

[0040] The present invention provides an encrypted communication method and gateway based on the WireGuard protocol. The client and the server are two ends based on the WireGuard protocol. When the client initiates a handshake request to the server, the client creates a request packet according to the data to be communicated and a preset encryption algorithm; the preset encryption algorithm includes SM2, SM3, and SM4; the server processes the received request packet based on the preset encryption algorithm to generate a response packet; the client processes the response packet based on the preset encryption algorithm to establish a communication connection between the client and the server. In this way, the present invention combines the WireGuard protocol with algorithms such as SM2, SM3, and SM4, so that the encryption and decryption algorithms in the encrypted communication network system are more secure, and all meet domestic needs, and can provide efficient and highly secure network communications. BRIEF DESCRIPTION OF THE DRAWINGS

[0041] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0042] Figure 1 It is a flow chart of an encrypted communication method based on the WireGuard protocol provided by one embodiment of the present invention;

[0043] Figure 2 It is a schematic diagram of the structure of a gateway based on the WireGuard protocol provided by one embodiment of the present invention;

[0044] Figure 3It is a schematic diagram of the structure of another gateway based on the WireGuard protocol provided by an embodiment of the present invention;

[0045] Figure 4 It is a structural diagram of another gateway based on the WireGuard protocol provided by an embodiment of the present invention;

[0046] Figure 5 It is a schematic diagram of the structure of a gateway based on the WireGuard protocol in the prior art;

[0047] Figure numerals: 10 - kernel; 20 - user state; 101 - physical network card registration interface; 102 - kernel driver module; 201 - user state driver module; 202 - control plane module; 203 - data plane module; 204 - socket interface; 205 - WireGuard encryption unit; 206 - WireGuard decryption unit; 207 - proxy server; 208 - business processing module. DETAILED DESCRIPTION

[0048] In order to make the purpose, technical solutions and advantages of the embodiments of the present invention clearer, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, rather than all the embodiments. Based on the embodiments in the present invention, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of the present invention.

[0049] Please refer to Figure 1 , an embodiment of the present invention provides an encrypted communication method based on the WireGuard protocol, comprising:

[0050] Step 100: In response to a handshake request initiated by a client based on the WireGuard protocol to a server, the client creates a request packet according to the data to be communicated and a preset encryption algorithm; the preset encryption algorithms include SM2, SM3, and SM4;

[0051] Step 102: The server processes the received request packet based on a preset encryption algorithm to generate a response packet; wherein the response packet includes the data to be communicated;

[0052] Step 104: The client processes the response packet based on a preset encryption algorithm to establish a communication connection between the client and the server.

[0053] In the embodiment of the present invention, the client and the server are two ends based on the WireGuard protocol. When the client initiates a handshake request to the server, the client creates a request packet based on the data to be communicated and the preset encryption algorithm; the preset encryption algorithm includes SM2, SM3, and SM4; the server processes the received request packet based on the preset encryption algorithm to generate a response packet; the client processes the response packet based on the preset encryption algorithm to establish a communication connection between the client and the server. In this way, the present invention combines the WireGuard protocol with algorithms such as SM2, SM3, and SM4, so that the encryption and decryption algorithms in the encrypted communication network system are more secure, and all meet domestic needs, and can provide efficient and highly secure network communications.

[0054] It should be noted that SM2, SM3, and SM4 are all cryptographic algorithm standards in the national secret algorithm, which are asymmetric encryption algorithms with better security and performance. The WireGuard protocol is a P2P protocol. The two ends of the WireGuard tunnel are equal and can serve as both clients and servers at the same time. That is, the machines at both ends are called Peers: when sending packets, they are clients, and when receiving packets, they are servers.

[0055] With respect to step 100, the client creates a request packet according to the data to be communicated and a preset encryption algorithm, including:

[0056] Get the server's local public key, the client's first local public key and timestamp;

[0057] A temporary private key is randomly generated, and the temporary private key and the local public key of the server are operated using SM2 to obtain a first shared key;

[0058] The timestamp and the first shared key are encrypted using SM4 to obtain an encrypted timestamp;

[0059] Perform encryption operation on the first local public key and the first shared key using SM4 to obtain an encrypted public key;

[0060] Use SM2 to calculate the temporary private key to obtain the temporary public key;

[0061] Generate handshake data based on the data packet type, temporary public key, encryption timestamp, and encryption public key of the data to be communicated;

[0062] The server's local public key and the random string are calculated using HMAC-SM3 to obtain a first key value, and the first key value and the handshake data are calculated using HMAC-SM3 to obtain a first code value;

[0063] The handshake data and the first code value are packaged to obtain a request packet.

[0064] It should be noted that HMAC is a MAC algorithm that is applicable to hash algorithm implementation. Different hash functions can be combined and named HMAC-x, for example, HMAC-SM3. Specifically, the length of the temporary private key is 256 bits, the length of the temporary public key is 512 bits, and the length of the first key value is 256 bits.

[0065] In the present invention, the SM2 algorithm and the SM4 algorithm are used to implement the creation of the request packet of the client.

[0066] With respect to step 102, the server processes the received request packet based on a preset encryption algorithm and generates a response packet, including:

[0067] Get the encrypted public key, temporary public key, encrypted timestamp, local private key of the server, and the stored public key table included in the request packet;

[0068] The temporary public key and the local private key of the server are operated using SM2 to obtain a second shared key;

[0069] The encrypted public key and the second shared key are decrypted using SM4 to obtain the public key of the client; wherein, when the public key is in the public key table, a response packet is generated.

[0070] Specifically, the obtained public key of the client is matched with the public key table stored in the server. If the match is successful, that is, the public key is in the public key table, a response packet is generated; if the match is unsuccessful, the request packet is discarded.

[0071] In the present invention, after receiving the request packet from the client, the server uses the SM2 algorithm and the SM4 algorithm to process the request packet to obtain the public key of the client.

[0072] In a preferred embodiment, it also includes:

[0073] The encrypted timestamp and the second shared key are decrypted using SM4 to obtain a timestamp;

[0074] The timestamp and the randomly obtained random number are hashed to obtain a random value; the random value is operated using HMAC-SM3 to obtain the key parameters.

[0075] In the present invention, the random value is nonce, which is calculated by the hash algorithm and the geometric timestamp, and finally generated by the HMAC-SM3 algorithm, and used as the key parameter for data packet encryption and decryption. In this way, one negotiation between the client and the server corresponds to a session, and the encryption and decryption of all data packets under the session will reuse this key parameter, thereby further improving the efficiency of communication using the preset encryption algorithm, and also using the timestamp to ensure the security of communication.

[0076] In a preferred embodiment, in the process of generating a response packet, the Curve25519 encryption algorithm in the WireGuard protocol is replaced with SM2, the ChaCha20-Poly1305 algorithm is replaced with SM4, and the Black2s algorithm is replaced with HMAC-SM3.

[0077] Specifically, in the process of generating a response packet: obtain the first local public key of the client, use SM2 to operate the temporary private key generated in step 100 to obtain a first temporary public key; use SM2 to operate the temporary private key and the first local public key to obtain a second shared key; use SM4 to encrypt the second shared key to obtain encrypted data; generate response data based on the data packet type of the data to be communicated, the first temporary public key, and the encrypted data; use HMAC-SM3 to operate the first local public key and the random string (that is, the random string in step 100) to obtain a third key value, and use HMAC-SM3 to operate the third key value and the response data to obtain a third code value; package the response data and the third code value to generate a response packet.

[0078] Before the server processes the received request packet based on the preset encryption algorithm in step 102, the following steps are also included:

[0079] Get the local private key of the server, and get the handshake data and the first code value from the request packet;

[0080] The local private key of the server is calculated using SM2 to obtain the second local public key;

[0081] The second local public key and the preset character string are operated by SM3 to obtain a second key value, and the second key value and the handshake data are operated by HMAC-SM3 to obtain a second code value;

[0082] Determine whether the first code value and the second code value are the same;

[0083] If yes, the verification is successful and the request packet will be processed.

[0084] It should be noted that the second local public key in step 102 is the local public key of the server in step 100. The preset character string is the random character string in step 100.

[0085] In the present invention, after receiving the request packet, the server also needs to perform packet verification on the request packet to further confirm whether the data has been changed by verifying the first code value and the second code value, thereby further improving data security.

[0086] With respect to step 104, in the process of processing the response packet, the Curve25519 encryption algorithm in the WireGuard protocol is replaced with SM2, the ChaCha20-Poly1305 algorithm is replaced with SM4, and the Black2s algorithm is replaced with HMAC-SM3.

[0087] In the present invention, the implementation of the packet encryption and decryption algorithm (whether it is the message or the key part) uses the SM4 algorithm, in which the packet mode also supports the free switching of multiple modes, including parallel ECB and serial CBC, etc. The use of algorithms such as SM2, SM3, and SM4, a longer public key length, and a more complex nonce calculation method further improves the rigor and security of encrypted communication.

[0088] Specifically, processing the response packet includes:

[0089] Obtaining the first temporary public key, the encrypted data, the third code value, and the response data included in the response packet;

[0090] The client's local private key and the first temporary public key are operated using SM2 to obtain a third shared key;

[0091] The encrypted data and the second shared key are decrypted using SM4 to obtain the decrypted data; and whether the handshake is successful is determined based on the decrypted data;

[0092] The client's local public key and the random string in step 100 are operated using HMAC-SM3 to obtain a fourth key value, and the fourth key value and the response data are operated using HMAC-SM3 to obtain a fourth code value; determine whether the third code value and the fourth code value are consistent, if they are consistent, the single packet authentication is successful, otherwise the authentication fails.

[0093] like Figure 2 As shown, the present invention also provides a gateway based on the WireGuard protocol, including: a kernel 10 and a user state 20;

[0094] The kernel 10 includes a physical network card registration interface 101 and a kernel driver module 102; the physical network card registration interface 101 is used to receive data packets obtained by the physical network card;

[0095] The user state 20 includes a user state driver module 201; the kernel driver module 102 is in communication connection with the user state driver module 201 to pass the data packet from the physical network card directly to the user state;

[0096] The user state 20 is deployed with the WireGuard protocol, and a control plane module 202 and a data plane module 203 are generated in the user state 20 according to the WireGuard protocol; the control plane module 202 is used to establish a WireGuard tunnel using any of the above-mentioned encrypted communication methods based on the WireGuard protocol; the data plane module 203 is used to implement the transmission of data packets according to the WireGuard tunnel.

[0097] In an embodiment of the present invention, the gateway applies a communication connection between a kernel driver module located in the kernel and a user state driver module located in the user state, directly passes the data packet from the physical network card to the user state, and then reconstructs and adapts the WireGuard protocol into a control plane module and a data plane module in the application state, and performs encryption and decryption processing on the data plane module in a multi-threaded concurrent manner, and then completes related business functions such as data packet screening, identification and cleaning through the gateway processing entity. In this way, since each module of the WireGuard protocol runs in the user state, it is convenient to debug the function, and also realizes a zero-copy and lock-free queue with the help of the communication-connected kernel driver module and the user state driver module, thereby avoiding multiple copy processing of the data packet and improving the forwarding throughput of the data plane. At the same time, the gateway also supports horizontal expansion, and when more storage is needed, packets can be received through multiple business ports.

[0098] In the present invention, the WireGuard tunnel protocol originally bound to the kernel is stripped into a control plane module 202 and a data plane module 203, and the negotiation to establish a WireGuard tunnel and the transmission of data packets using the WireGuard tunnel are divided into two parts, so that they can all be migrated to the user state, abandoning the Linux kernel protocol stack loaded in the traditional gateway based on the WireGuard tunnel. Compared with the complex and inconvenient kernel to debug, the application state is more convenient for debugging and business expansion. After the WireGuard protocol is migrated to the application state, it is more convenient to debug its functions. At the same time, multi-core multi-threaded concurrent technology can be used in the user state to accelerate the data forwarding performance.

[0099] In the present invention, with the help of the kernel driver module and the user state driver module connected by communication, it is possible to directly allow the user state to access the data packet of the physical network card, without having to copy it from the physical network card to the kernel and then to the user state, and repeating this twice to complete one forwarding (receiving and sending) process, thereby achieving zero copy of the message, thereby accelerating the forwarding processing flow and shortening the processing delay.

[0100] In a more preferred embodiment, Figure 3As shown, the kernel driver module and the user state driver module of the communication connection use the data plane development tool kit DPDK (Data Plane Development Kit), that is, the bottom layer uses the DPDK platform to make the data message pass directly from the physical network card to the user state.

[0101] In a preferred embodiment, the user state 20 further includes a socket interface 204 and a Freebsd user state protocol stack; the data packets transmitted by the kernel 10 are received and processed by the Freebsd user state protocol stack and the socket interface 204 .

[0102] In the present invention, WireGuard is an open source Layer 3 network tunnel tool written in C language, and its control plane module relies on the socket, so the user state uses the Freebsd open source user state protocol stack and the PosixSOCKET API provided by it.

[0103] In a preferred embodiment, Figure 3 As shown, the data plane module includes a WireGuard encryption unit 205 and a WireGuard decryption unit 206; the WireGuard encryption unit 205 is used to implement encryption processing of data packets, and the WireGuard decryption unit 206 is used to implement decryption processing of data packets.

[0104] The present invention does not rely on the kernel's WireGuard encryption and decryption processing, so that the gateway function processing of the data plane becomes a more flexible and changeable framework, which facilitates the use of various parallel frameworks for acceleration and improves gateway performance.

[0105] In a preferred embodiment, Figure 3 As shown, it also includes: a shared table entry, in which the configuration information negotiated by the control plane module 202 is stored, and the data plane module 203 is used to read the configuration information to realize the transmission of data packets through the WireGuard tunnel.

[0106] In a preferred embodiment, the shared entry adopts a single-write-multiple-read mechanism.

[0107] The existing WireGuard tunnel protocol completes the encryption and decryption of data packets in the Linux kernel protocol stack, and needs to be negotiated through the control plane first, establish communication, and obtain some table information (i.e., configuration information). Only from these configuration information can the encryption and decryption keys, indexes, timestamps and other parameters be obtained to complete the encryption and decryption and transmission of data packets based on these parameters during data transmission. In the present invention, the WireGuard encryption unit and the WireGuard decryption unit also rely on table items, and the aforementioned preset encryption algorithms including SM2, SM3, and SM4 are used for encrypted communication. The WireGuard control plane module 202 maintains and updates the configuration information, and the data plane module 203 process is only responsible for reading the configuration information, that is, multiple processes, through shared memory, only one process (i.e., the control plane module) can change the configuration information, that is, a single-write and multiple-read shared table entry mechanism, so the table entry search loss between processes due to shared memory is also small, and the performance is better.

[0108] In a preferred embodiment, Figure 3 As shown, the user state 20 also includes a socket interface 204, a Freebsd user state protocol stack, and a proxy server 207; the data packet transmitted by the kernel 10 is encrypted or decrypted by the Freebsd user state protocol stack, and then the proxy server 207 completes the packet receiving process through the socket interface 204.

[0109] In a preferred embodiment, Figure 3 As shown, the user state 20 further includes a service processing module 208 and a FreeBSD user state protocol stack. The service processing module 208 performs service processing on the data packet based on the FreeBSD user state protocol stack.

[0110] Specifically, the business processing module includes but is not limited to L2 / 3 / 4 parsing processing, flow creation processing, etc. before encryption and decryption processing, and access control list, etc. after encryption and decryption processing.

[0111] like Figure 3 As shown, the proxy server can be an Nginx proxy server, and the processing of the WireGuard encryption unit, the WireGuard decryption unit, and the business processing module are all completed based on the Freebsd user-mode protocol stack.

[0112] In a specific implementation, after the encryption and decryption processing of the data packet is completed in the user state, it is quickly transferred to the back-end gateway processing entity to perform processing on the data packet, including session flow establishment, DPI protocol identification, IPS data packet installation detection and related policy linkage, thereby shortening the processing delay.

[0113] In a preferred embodiment, the control plane module 202 includes a construction unit, a configuration unit and an adding unit; the construction unit is used to establish a virtual network card, the configuration unit is used to set the IP address, listening port and routing table for the virtual network card, the routing table includes the public key and IP list corresponding to the server and client for establishing the connection; the adding unit is used to add the server and client according to the routing table.

[0114] It should be noted that the WireGuard protocol is a P2P protocol. Both ends of the WireGuard tunnel are equal and can serve as both the client and the server. That is, the machines at both ends are called peers: when sending packets, they are clients, and when receiving packets, they are servers. The routing table records the information of all peers that establish tunnels with the virtual network card, including the public key and the allowed IP list, which is used to correctly encrypt, decrypt, and verify all network packets flowing through the virtual network card.

[0115] Specifically, the control plane module 202 performs the following steps: Figure 1 The encrypted communication method shown establishes communication between the client and the server based on the WireGuard protocol, that is, establishes a WireGuard tunnel.

[0116] In a specific implementation, a method for communicating between a user state and a kernel in a gateway based on the WireGuard protocol includes:

[0117] Get the data packet of the physical network card registration interface;

[0118] The data packet is transmitted to the user state driver module in the user state through the kernel driver module in the kernel; wherein the kernel driver module is communicatively connected with the user state driver module;

[0119] Deploy the WireGuard protocol in user mode: According to the kernel WireGuard protocol implementation, generate a control plane module and a data plane module in user mode; the control plane module is used to negotiate the establishment of a WireGuard tunnel; the data plane module is used to implement data packet transmission based on the WireGuard tunnel.

[0120] In a specific embodiment, in Figure 4In the gateway shown, the WireGuard control plane is the control plane module; the WireGuard data plane is the data plane module, which includes the WireGuard encryption unit and the WireGuard decryption unit to implement encryption and decryption processing; the Dpdk pmd driver interface is connected to the Dpdk kernel driver for communication, and the flow control service and flow table creation are both service processing modules; the kernel also includes the registration interface of the physical network card ethx; the Nginx agent is the proxy server; the WireGuard control plane and the WireGuard data plane communicate through shared table entries. The WireGuard control plane relies on the socket API in the user state, and negotiates to establish a WireGuard tunnel based on the Freebsd user state protocol stack, the Dpdk pmd driver interface and the communication connection of the Dpdk kernel driver, as shown in the figure. Figure 4 The processing flow marked by the left line in the middle; the WireGuard data plane uses the established WireGuard tunnel based on the shared table entry. After the data packet is directly passed from the physical network card registration interface to the user state through DPDK, it can be encrypted and decrypted through the flow table built by the Freebsd user state protocol stack, and then the subsequent DPI protocol identification, IPS security detection and other processing can be carried out, such as Figure 4 The processing flow is marked by the line on the right in the middle. The Nginx proxy service supported by this gateway is also based on the Posix socket API provided by the Freebsd protocol stack. That is, after the data packets directly transmitted from the physical network card pass through the Freebsd protocol stack, the upper-layer Nginx application can receive and process the packets through the socket API provided by Freebsd, such as Figure 4 The processing flow indicated by the second line from the center left.

[0121] like Figure 5 As shown in the figure, in the current gateway solution based on the WireGuard encrypted tunnel protocol, the WireGuard tunnel protocol is in the Linux kernel protocol stack, and the encryption and decryption processing is also completed in the kernel protocol stack. Therefore, the data packet must copy the message from the physical network card eth0 to the kernel, and then copy it from the kernel to the user state, and then give it to the Nginx proxy server through the standard socket API, as shown in Figure 5 The two arrows in the figure represent two message copy operations (the two copies are only the receiving direction processing of the forwarding process, and the sending process also requires two copies). Figure 4 From the processing flow shown, the message data stored in the physical network card receiving queue can be directly used without the need for copying operations.

[0122] The present invention also provides a gateway device based on the WireGuard protocol, including mounting the gateway based on the WireGuard protocol of any of the above embodiments on a server.

[0123] It is understood that the structure illustrated in the embodiment of the present invention does not constitute a specific limitation on a gateway based on the WireGuard protocol. In other embodiments of the present invention, a gateway based on the WireGuard protocol may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or arrange the components differently. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0124] The information interaction, execution process and other contents between the modules in the above-mentioned device are based on the same concept as the embodiment of the method of the present invention. For the specific contents, please refer to the description in the embodiment of the method of the present invention, and no further description is given here.

[0125] It should be noted that, in this article, relational terms such as first and second are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the statement "comprise a ..." do not exclude the presence of other identical factors in the process, method, article or device including the elements.

[0126] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A gateway based on the WireGuard protocol, characterized in that: include: Kernel and user mode; The kernel includes a physical network card registration interface and a kernel driver module; The physical network card registration interface is used to receive a data packet obtained by the physical network card; The user state includes a user state driver module; the kernel driver module is communicatively connected with the user state driver module to pass the data packet from the physical network card directly to the user state; The user state is deployed with a WireGuard protocol, and a control plane module and a data plane module are generated in the user state according to the WireGuard protocol; the control plane module is used to establish a WireGuard tunnel using an encrypted communication method; the data plane module is used to implement transmission of the data packet according to the WireGuard tunnel; The encrypted communication method comprises: In response to a handshake request initiated by a client based on the WireGuard protocol to a server, the client creates a request packet according to the data to be communicated and a preset encryption algorithm; the preset encryption algorithm includes SM2, SM3, and SM4; The server processes the received request packet based on the preset encryption algorithm to generate a response packet; wherein the response packet includes the data to be communicated; The client processes the response packet based on the preset encryption algorithm to establish a communication connection between the client and the server; The client creates a request packet according to the data to be communicated and a preset encryption algorithm, including: Obtaining the local public key of the server, the first local public key of the client, and a timestamp; Randomly generate a temporary private key, and use SM2 to calculate the temporary private key and the local public key of the server to obtain a first shared key; Perform encryption operation on the timestamp and the first shared key using SM4 to obtain an encrypted timestamp; Perform encryption operation on the first local public key and the first shared key using SM4 to obtain an encrypted public key; The temporary private key is operated by SM2 to obtain a temporary public key; Generate handshake data based on the data packet type of the data to be communicated, the temporary public key, the encryption timestamp, and the encryption public key; The local public key of the server and the random string are calculated using HMAC-SM3 to obtain a first key value, and the first key value and the handshake data are calculated using HMAC-SM3 to obtain a first code value; The handshake data and the first code value are packaged to obtain the request packet.

2. The gateway according to claim 1, characterized in that: The user state also includes a socket interface and a FreeBSD user state protocol stack; the data packet transmitted by the kernel is received and processed by the FreeBSD user state protocol stack and the socket interface; and / or, The data plane module includes a WireGuard encryption unit and a WireGuard decryption unit; the WireGuard encryption unit is used to implement encryption processing of the data packet, and the WireGuard decryption unit is used to implement decryption processing of the data packet.

3. The gateway according to claim 2, characterized in that: Also includes: A shared table entry, wherein the shared table entry stores configuration information negotiated by the control plane module, and the data plane module is used to read the configuration information to realize the transmission of the data packet through the WireGuard tunnel.

4. The gateway according to claim 2, characterized in that: The user state also includes a proxy server; after the data packet transmitted by the kernel is encrypted or decrypted by the Freebsd user state protocol stack, the proxy server completes the packet receiving process through the socket interface.

5. The gateway according to claim 1, characterized in that: The server processes the received request packet based on the preset encryption algorithm to generate a response packet, including: Obtain the encrypted public key, temporary public key, encrypted timestamp, local private key of the server, and stored public key table included in the request packet; The temporary public key and the local private key of the server are operated using SM2 to obtain a second shared key; The encrypted public key and the second shared key are decrypted using SM4 to obtain the public key of the client; wherein, when the public key is located in the public key table, the response packet is generated.

6. The gateway according to claim 5, characterized in that: Also includes: Perform a decryption operation on the encrypted timestamp and the second shared key using SM4 to obtain a timestamp; The timestamp and the randomly obtained random number are hashed to obtain a random value; the random value is operated using HMAC-SM3 to obtain a key parameter.

7. The gateway according to claim 5, characterized in that: In the process of generating the response packet, the Curve25519 encryption algorithm in the WireGuard protocol is replaced with SM2, the ChaCha20-Poly1305 algorithm is replaced with SM4, and the Black2s algorithm is replaced with HMAC-SM3.

8. The gateway according to claim 1, characterized in that: Before the server processes the received request packet based on the preset encryption algorithm, the method further includes: Obtaining a local private key of the server, and obtaining the handshake data and the first code value from the request packet; The local private key of the server is calculated using SM2 to obtain a second local public key; The second local public key and the preset character string are operated by SM3 to obtain a second key value, and the second key value and the handshake data are operated by HMAC-SM3 to obtain a second code value; Determining whether the first code value and the second code value are the same; If so, the verification is successful and the request packet will be processed.

Images