A method and device for distinguishing wireguard tunnel aggregate traffic

Abstract

The present invention relates to the field of network communication technology, and in particular to a method and device for distinguishing wireguard tunnel aggregated traffic, the method comprising: obtaining underlying device traffic data sent by each underlying device; performing expansion processing on the message header of the data type message, adding a preset identification field to the message header of the data type message as the load data of the data type message, and encrypting and encapsulating the underlying device traffic data and the load data to obtain an encrypted message; performing aggregation processing on the encrypted message, and sending it to a central security gateway through a wireguard tunnel; the central security gateway receives and decrypts the encrypted message to obtain the load data, parses the load data, and identifies the corresponding underlying device. This method can directly distinguish which underlying device the encrypted message transmitted through the same wireguard tunnel originates from, thereby achieving the purpose of simply, quickly, and conveniently distinguishing the source of the encrypted message.

Description

Technical Field

[0001] The present invention relates to the field of network communication technology, and in particular to a method and device for distinguishing wireguard tunnel aggregate traffic. Background Art

[0002] Currently, based on the zero-trust architecture of SDP (Software Defined Perimeter), VPN (virtual private network) technology is used to encrypt access messages between the SDP client and the SDP gateway.

[0003] VPN tunnel uses wireguard protocol to encrypt tunnel. Wireguard protocol is a P2P protocol, which does not distinguish between client and server. Therefore, the machines at both ends of wireguard tunnel are called peers. At the same time, wireguard protocol requires each peer to have an IP address. Because a peer can be connected to multiple peers at the same time, this IP address can be used to distinguish which peer the encrypted message originated from. For example, refer to the attached Figure 1 , a network device architecture, the right peer is connected to three peers at the same time. For the right peer, three wireguard tunnels are connected to it. Because each peer on the left has an IP, the right peer can independently distinguish the encrypted messages of these three peers.

[0004] With the increasing popularity of IoT devices, network application scenarios are becoming more complex. For example, Figure 2A new type of security client is interconnected through the edge aggregation gateway and the central security gateway of the unified control platform. The network communication tunnel between the edge aggregation gateway and the central security gateway is built based on wireguard. The edge aggregation gateway acts as a peer of the wireguard tunnel. At the same time, it needs to provide network access function, allowing multiple underlying devices (for example, video devices, IoT robotic arm devices, PLC logical link controller devices, etc.) to access the network it provides. Then the edge aggregation gateway aggregates the traffic of these underlying devices in a wireguard tunnel. After the traffic is aggregated, it is transmitted in this wireguard tunnel. After receiving the encrypted message, the central security gateway needs to distinguish the packets transmitted through the same wireguard tunnel. The encrypted message transmitted by the eguard tunnel originates from which underlying device, but the existing central security gateway cannot quickly and simply distinguish the encrypted messages with the participation of the edge aggregation gateway. To address this problem, the VPN tunnel negotiation protocol can be changed to solve it. However, the wireguard tunnel protocol is an open source VPN encryption tunnel protocol. All devices that support the wireguard tunnel protocol can negotiate and encrypt and decrypt data, and the open source protocol cannot be changed at will, otherwise there may be problems in the negotiation. Therefore, how to enable the central security gateway to quickly and simply distinguish the encrypted messages with the participation of the edge aggregation gateway without changing the VPN tunnel negotiation protocol is a problem that needs to be solved urgently by technical personnel in this field. Summary of the invention

[0005] Based on this, it is necessary to provide a method and device for distinguishing wireguard tunnel aggregation traffic to address the above technical problems.

[0006] According to a first aspect of the present invention, a method for distinguishing wireguard tunnel aggregated traffic is provided, which is applied to an edge aggregation gateway, multiple underlying devices interacting with the edge aggregation gateway, and a central security gateway interacting with the edge aggregation gateway, and a network communication tunnel is constructed between the edge aggregation gateway and the central security gateway through the wireguard tunnel. The method comprises: the edge aggregation gateway obtains underlying device traffic data sent by each underlying device; the message header of the data type message in the wireguard tunnel protocol is extended, a preset identification field is added to the message header of the data type message as the load data of the data type message, and the underlying device traffic data and the load data are encrypted and encapsulated to obtain an encrypted message, and the load data is used to determine the underlying device corresponding to the underlying device traffic data; the edge aggregation gateway aggregates the encrypted message, and sends the aggregated encrypted message to the central security gateway through the wireguard tunnel; the central security gateway receives the encrypted message sent by the edge aggregation gateway, decrypts the encrypted message, obtains the underlying device traffic data and the load data, and parses the load data to obtain the message header of the data type message containing the identification field, and identifies the corresponding underlying device based on the parsed message header of the data type message containing the identification field.

[0007] In some optional implementations of some embodiments, the underlying device traffic data includes session information.

[0008] In some optional implementations of some embodiments, the adding of a preset identification field to the message header of the data type message as the payload data of the data type message includes: adding an identification field of preset bytes to the end of the message header of the data type message as the payload data of the data type message.

[0009] In some optional implementations of some embodiments, the identification field includes a magic word field and a feature field of session communication.

[0010] In some optional implementations of some embodiments, the characteristic field of the session communication includes one of an underlying device ID and a source IP address connected to an edge aggregation gateway.

[0011] According to a second aspect of the present invention, a device for distinguishing wireguard tunnel aggregated traffic is provided, which is applied to an edge aggregation gateway, multiple underlying devices interacting with the edge aggregation gateway, and a central security gateway interacting with the edge aggregation gateway. A network communication tunnel is constructed between the edge aggregation gateway and the central security gateway through a wireguard tunnel. The edge aggregation gateway includes a traffic data receiving module, an expansion module, an encryption and encapsulation module, an aggregation module, an encrypted message sending module and a communication module. The central security gateway includes an encrypted message receiving module, a decryption module and a parsing module; the traffic data receiving module is used to obtain the underlying device traffic data sent by each underlying device; the expansion module is used to expand the message header of the data type message in the wireguard tunnel protocol, and add a preset identification field to the message header of the data type message as the load data of the data type message; the encryption and encapsulation ... The installation module is used to encrypt and encapsulate the flow data and load data of the underlying device to obtain an encrypted message, and the load data is used to determine the underlying device corresponding to the flow data of the underlying device; the aggregation module is used to aggregate the encrypted message; the encrypted message sending module is used to send the encrypted message after aggregation to the central security gateway through the wireGuard tunnel; the communication module is used to build a network communication tunnel between the edge aggregation gateway and the central security gateway based on the wireGuard tunnel; the encrypted message receiving module is used to receive the encrypted message sent by the encrypted message sending module; the decryption module is used to decrypt the encrypted message to obtain the flow data and load data of the underlying device; the parsing module is used to parse the load data to obtain the message header of the data type message containing the identification field, and identify the corresponding underlying device based on the parsed message header of the data type message containing the identification field.

[0012] In some optional implementations of some embodiments, the underlying device includes a flow data sending module, which is used to send the underlying device flow data including session information to the flow data receiving module.

[0013] In some optional implementations of some embodiments, the communication module includes: an inner communication sub-module, used to establish a communication connection through the virtual IP of the edge aggregation gateway and the virtual IP of the central security gateway; an outer communication sub-module, used to establish a communication connection through the physical port IP of the edge aggregation gateway and the physical port IP of the central security gateway.

[0014] According to a third aspect of the present invention, there is provided a computer-readable storage medium on which a computer program is stored, and when the program is executed by a processor, the method described above is implemented.

[0015] According to a fourth aspect of the present invention, a computer device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above-described method when executing the program.

[0016] The advantages and beneficial effects of the present invention are as follows: the present invention provides a method and device for distinguishing wireguard tunnel aggregated traffic, the method is applied to a network device based on a point-to-point wireguard encrypted VPN tunnel, receives underlying device traffic data sent by each underlying device through an edge aggregation gateway, and before aggregating the underlying device traffic data, performs expansion processing on the message header of the data type message in the wireguard tunnel protocol, expands the identification field in the message header of the data type message, and then encrypts, encapsulates and aggregates the underlying device traffic data and load data, and transmits them to a central security gateway through the same wireguard tunnel, the central security gateway receives, decrypts and parses the encrypted message, obtains the message header of the data type message containing the identification field, and through the identification field of the message header of the data type message, it is possible to directly distinguish which underlying device the encrypted message transmitted through the same wireguard tunnel originates from without changing the VPN tunnel negotiation protocol, thereby achieving the purpose of simply, quickly and conveniently distinguishing the source of the encrypted message. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] Figure 1 It is a schematic diagram of a network device architecture in the background technology.

[0018] Figure 2 This is a network diagram of the zero-trust system architecture based on the SDP architecture.

[0019] Figure 3 A flowchart of a method for distinguishing wireguard tunnel aggregate traffic.

[0020] Figure 4 A schematic diagram of a device that distinguishes WireGuard tunnel aggregate traffic.

[0021] Figure 5 Schematic diagram of edge aggregation gateway aggregating encrypted messages.

[0022] Figure 6 A schematic diagram of a computer device. DETAILED DESCRIPTION

[0023] In order to make the purpose, technical solution and advantages of the present invention more clearly understood, the present invention is further described in detail below through specific implementation methods in conjunction with the accompanying drawings. It should be understood that the specific embodiments described herein are only used to explain the present invention and are not used to limit the present invention.

[0024] Embodiment 1

[0025] Figure 2 This is a network diagram of a zero-trust system architecture based on the SDP architecture. During the data interaction between the security client and the unified control platform, the security client is interconnected through the edge aggregation gateway and the central security gateway of the unified control platform. A network communication tunnel is built between the edge aggregation gateway and the central security gateway through the wireguard tunnel. The edge aggregation gateway is located at the edge of the network and is responsible for connecting the scattered underlying devices to the network and aggregating the underlying device traffic data of different underlying devices. The encrypted message is sent to the central security gateway through the wireguard tunnel. The central security gateway is located on the data center side and is responsible for receiving the encrypted message transmitted from the edge aggregation gateway, decrypting and parsing it, so as to separately count the session information of each underlying device involved in the edge aggregation gateway. Since the wireguard tunnel protocol is an open source V PN encrypted tunnel protocol, this public protocol defines a total of four message types, including the initiation (INIT) for negotiation, the response (RESPONSE) for negotiation, the COOKIE in negotiation, and the data message (DATA) for encrypted data transmission after the negotiation is completed. Since the open source protocol may be arbitrarily modified, there may be problems in the negotiation. Therefore, in order to distinguish the data streams of the same wireguard tunnel without changing the VPN tunnel negotiation protocol, the present invention extends the message header of the data message (i.e., the data type message) in the wireguard tunnel transmission process, adds the identification field for identifying the underlying device to the end of the message header of the data message, and obtains the identification field after the central security gateway receives, decrypts and parses the encrypted message. Through the identification field, it is possible to simply determine which underlying device the encrypted message originated from.

[0026] like Figure 3 As shown, the present application proposes a method for distinguishing wireguard tunnel aggregate traffic, which includes the following steps.

[0027] S1. The edge aggregation gateway obtains the underlying device traffic data sent by each underlying device.

[0028] In some embodiments, the underlying device traffic data includes session information.

[0029] S2. Expand the message header of the data type message in the wireguard tunnel protocol, add a preset identification field to the message header of the data type message as the load data of the data type message, and encrypt and encapsulate the underlying device flow data and load data to obtain an encrypted message.

[0030] The load data is used to determine the underlying device corresponding to the underlying device flow data.

[0031] In some embodiments, a preset identification field is added to the message header of the data type message as the load data of the data type message, including: adding an identification field of preset bytes at the end of the message header of the data type message as the load data of the data type message; the identification field includes a magic word field and a characteristic field of session communication; the characteristic field of session communication includes one of the underlying device ID and the source IP address connected to the edge aggregation gateway.

[0032] In some embodiments, the number of bytes of the message header of the data type message is generally 16 bytes, and a preset byte identification field is added at the end thereof to identify the corresponding underlying device, wherein the number of bytes of the identification field can be flexibly set as needed, for example, the number of bytes of the identification field is 8 bytes, including a 4-byte magic word field and a 4-byte feature field of session communication, and the position of the magic word field setting may include three cases, case one: 4-byte magic word field + 4-byte feature field of session communication, that is, the 4-byte magic word field is placed in front of the 4-byte feature field of session communication, and in subsequent parsing and identification, by identifying the 4-byte magic word field and searching back for the 4-byte feature field of session communication, the corresponding underlying device can be identified. Device, Case 2: 4-byte session communication feature field + 4-byte magic word field, that is, the 4-byte magic word field is placed behind the 4-byte session communication feature field. In the subsequent parsing and identification, by identifying the 4-byte magic word field, the 4-byte session communication feature field is searched forward to identify the corresponding underlying device. Case 3: 2-byte magic word field + 4-byte session communication feature field + 2-byte magic word field, that is, 2-byte magic word fields are set on both sides of the front and back of the 4-byte session communication feature field. In the subsequent parsing and identification, by identifying the 2-byte magic word fields on the front and back sides, the 4-byte session communication feature field in the middle segment is located and searched, and the corresponding underlying device can be identified.

[0033] Furthermore, the magic word field can be flexibly set according to the needs of actual business application scenarios. For example, the magic word field can use the special character 0xFE. By adding the characteristic field of session communication, the final 8-byte identification field may be FE FE 32 C0 A1 76 FE FE. The characteristic field in the middle used to identify the session communication of different access underlying devices under the edge aggregation gateway can be the underlying device ID, or it may be the source IP address of the access to the edge aggregation gateway.

[0034] Furthermore, since the WireGuard tunnel protocol itself is based on the IP layer, that is, the data packet header in the WireGuard tunnel protocol is followed by an IP packet, it should be noted that no matter whether it is IPv4 or IPv6, the data packet header is followed by an IP packet. Therefore, by using the preset magic word, it is possible to distinguish whether it is an IP packet of data or a defined special field.

[0035] Furthermore, using the identification field designed above, the edge aggregation gateway fills the characteristic field identifying the session communication as a special identifier identifying the session communication into the message header of the wireguard tunnel data type message before aggregating the session communication, and the peer at the other end of the wireguard tunnel (i.e., the central security gateway) can identify the characteristic field of the session communication by parsing the magic word field in the message header of the data type message, thereby determining the underlying device corresponding to the underlying device traffic data.

[0036] S3. The edge aggregation gateway aggregates the encrypted messages and sends the aggregated encrypted messages to the central security gateway through the WireGuard tunnel.

[0037] In some embodiments, refer to the attached Figure 5 It should be noted that when encrypting the message, only the underlying device traffic data and load data are encrypted (i.e. the encrypted part), and the message header of the data type message in the wireguard tunnel protocol (i.e. the standard wireguard protocol message header) does not need to be encrypted. After encapsulation, the encrypted message includes the standard wireguard protocol message header, the underlying device traffic data and load data. The encrypted message is then aggregated through the edge aggregation gateway, and the IP header and UDP header are encapsulated for the encrypted message to obtain the encrypted message after aggregation (i.e. IP header + UDP header + standard wireguard protocol message header + encryption part), which is then sent to the central security gateway through a unified wireguard tunnel.

[0038] S4. The central security gateway receives the encrypted message sent by the edge aggregation gateway, decrypts the encrypted message, obtains the traffic data and load data of the underlying device, and parses the load data to obtain the message header of the data type message containing the identification field, and identifies the corresponding underlying device based on the parsed message header of the data type message containing the identification field.

[0039] In some embodiments, the central security gateway decrypts the transmitted encrypted message to obtain the underlying device traffic data and load data, and then parses the load data. By parsing the preset magic word field to quickly identify the characteristic field of the session communication, it can directly distinguish which underlying device the encrypted message transmitted through the wireguard tunnel originates from, without changing the VPN tunnel negotiation protocol, that is, the device is compatible with other devices that do not have extended wireguard tunnel messages. Among them, the device compatibility issue can refer to the gateway architecture and device based on the user-mode WireGuard protocol with publication number CN117640289A, which will not be repeated here; in addition, the identification of the extended magic word field The process is also relatively simple. For the underlying devices without extended processing, they can still be easily judged on the central security gateway side, because the underlying devices without this extended processing, the encrypted messages transmitted, the data type message header is 16 bytes, followed by ordinary IP messages, and there is no magic word field marked between the data type message header and the ordinary IP message. Therefore, the central security gateway side cannot quickly and easily distinguish the encrypted messages with the participation of the edge aggregation gateway. In view of this, without adding other additional overhead, based on the magic word field in the data type message header and the characteristic field of the session communication, multiple access session communications under the edge aggregation gateway can be quickly and easily distinguished.

[0040] Embodiment 2

[0041] This embodiment provides a device for distinguishing wireguard tunnel aggregate traffic based on the above embodiment 1. Figure 4 , a method for distinguishing wireguard tunnel aggregation traffic in embodiment one is implemented. The device is applied to an edge aggregation gateway, multiple underlying devices interacting with the edge aggregation gateway, and a central security gateway interacting with the edge aggregation gateway. A network communication tunnel is constructed between the edge aggregation gateway and the central security gateway through a wireguard tunnel. The edge aggregation gateway includes a traffic data receiving module 202, an expansion module 203, an encryption and encapsulation module 204, an aggregation module 205, an encrypted message sending module 206 and a communication module 207. The central security gateway includes an encrypted message receiving module 208, a decryption module 209 and a parsing module 210.

[0042] In some embodiments, the traffic data receiving module 202 is used to obtain the underlying device traffic data sent by each underlying device.

[0043] In some embodiments, the expansion module 203 is used to expand the message header of the data type message in the wireguard tunnel protocol, and add a preset identification field to the message header of the data type message as the payload data of the data type message.

[0044] In some embodiments, the encryption and encapsulation module 204 is used to encrypt and encapsulate the underlying device traffic data and load data to obtain an encrypted message, and the load data is used to determine the underlying device corresponding to the underlying device traffic data.

[0045] In some embodiments, the aggregation module 205 is used for aggregation processing of encrypted messages.

[0046] In some embodiments, the encrypted message sending module 206 is used to send the encrypted message after aggregation processing to the central security gateway through the wireGuard tunnel.

[0047] In some embodiments, the communication module 207 is used to build a network communication tunnel between the edge aggregation gateway and the central security gateway based on the WireGuard tunnel.

[0048] In some embodiments, the encrypted message receiving module 208 is used to receive the encrypted message sent by the encrypted message sending module 206 .

[0049] In some embodiments, the decryption module 209 is used to decrypt the encrypted message to obtain the underlying device traffic data and load data.

[0050] In some embodiments, the parsing module 210 is used to parse the load data to obtain a message header of a data type message containing an identification field, and identify the corresponding underlying device based on the parsed message header of the data type message containing the identification field.

[0051] In some embodiments, the underlying device includes a traffic data sending module 201 for sending underlying device traffic data including session information to a traffic data receiving module 202 .

[0052] In some embodiments, the communication module 207 includes: an inner communication sub-module, used to communicate through the virtual IP of the edge aggregation gateway and the virtual IP of the central security gateway; an outer communication sub-module, used to communicate through the physical port IP of the edge aggregation gateway and the physical port IP of the central security gateway.

[0053] Embodiment 3

[0054] Based on the above-mentioned embodiment 1, this embodiment further provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the above-mentioned method are implemented.

[0055] It should be noted that the computer-readable medium mentioned above in some embodiments of the present disclosure may be a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In some embodiments of the present disclosure, the computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, device or device. In some embodiments of the present disclosure, the computer-readable signal medium may include a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer readable signal media may also be any computer readable medium other than computer readable storage media, which may send, propagate or transmit a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer readable medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (radio frequency), etc., or any suitable combination of the above.

[0056] In this embodiment, the client and the server may communicate using any currently known or future developed network protocol such as HTTP (HyperTextTransferProtocol), and may be interconnected with any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include a local area network ("LAN"), a wide area network ("WAN"), an internet (e.g., the Internet), and a peer-to-peer network (e.g., an adhoc peer-to-peer network), as well as any currently known or future developed network.

[0057] The computer-readable medium may be included in the apparatus, or may exist independently without being installed in the computer device. The computer-readable medium carries one or more programs. When the one or more programs are executed by the computer device, the computer device: obtains training data, converts the training data into initial data; determines an initial rule base based on the initial data, and optimizes the parameters of the initial rule base to obtain a target rule base; calculates the rules in the target rule base according to a preset activation weight calculation formula to obtain activation weights; determines abnormal information according to the test data and the activation weights.

[0058] Computer program code for performing the operations of some embodiments of the present disclosure may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0059] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present disclosure. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0060] The units described in some embodiments of the present disclosure may be implemented by software or hardware. The units described may also be provided in a processor, for example, may be described as: a processor including a data acquisition unit, a rule determination unit, a weight calculation unit, and an anomaly determination unit. The names of these units do not, in some cases, constitute limitations on the units themselves, for example, the data acquisition unit may also be described as a "unit for acquiring training data".

[0061] The functions described above herein may be performed at least in part by one or more hardware logic components. For example, exemplary types of hardware logic components that may be used include, without limitation, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), etc.

[0062] Embodiment 4

[0063] Based on the above-mentioned embodiment 1, this embodiment further provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, and the processor implements the steps of the above-mentioned method when executing the program.

[0064] Please see attached Figure 6 , Figure 6 The computer device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present disclosure.

[0065] like Figure 6 As shown, the computer device may include a processing device (such as a central processing unit, a graphics processing unit, etc.) 301, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage device 308 to a random access memory (RAM) 303. Various programs and data required for the operation of the computer device are also stored in RAM 303. The processing device 301, ROM 302, and RAM 303 are connected to each other via a bus 304. An input / output (I / O) interface 305 is also connected to the bus 304.

[0066] Typically, the following devices may be connected to the I / O interface 305: an input device 306 including, for example, a touch screen, a touch pad, a keyboard, a mouse, a camera, etc., an output device 307 including, for example, a liquid crystal display (LCD), a speaker, etc., a storage device 308 including, for example, a magnetic tape, a hard disk, etc., and a communication device 309. The communication device 309 may allow the computer device to communicate with other devices wirelessly or by wire to exchange data. Figure 6A computer device having various devices is shown, but it should be understood that it is not required to implement or possess all the devices shown. More or fewer devices may be implemented or possessed instead. Figure 6 Each block shown in the figure may represent one device, or may represent multiple devices as required.

[0067] In particular, according to some embodiments of the present disclosure, the process described above with reference to the flowchart can be implemented as a computer software program. For example, some embodiments of the present disclosure include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In some such embodiments, the computer program can be downloaded and installed from the network through the communication device 309, or installed from the storage device 308, or installed from the ROM 302. When the computer program is executed by the processing device 301, the above-mentioned functions defined in the method of some embodiments of the present disclosure are executed.

[0068] Obviously, it should be understood by those skilled in the art that the above-mentioned various steps of the present invention can be performed in a manner different from the present invention, and the simulation method and experimental equipment include but are not limited to the above description. The above-mentioned various steps of the present invention can be performed in an order different from that here in some cases, and the steps shown or described above can be performed separately. Therefore, the present invention is not limited to any specific combination of hardware and software.

[0069] The above contents are further detailed descriptions of the present invention in combination with specific implementation methods, and it cannot be determined that the specific implementation of the present invention is limited to these descriptions. For ordinary technicians in the technical field to which the present invention belongs, several simple deductions or substitutions can be made without departing from the concept of the present invention, which should be regarded as falling within the scope of protection of the present invention.

Claims

1. A method for distinguishing wireguard tunnel aggregated traffic, applied to an edge aggregation gateway, multiple underlying devices interacting with the edge aggregation gateway, and a central security gateway interacting with the edge aggregation gateway, wherein a network communication tunnel is constructed between the edge aggregation gateway and the central security gateway through a wireguard tunnel, characterized in that: The method includes: The edge aggregation gateway obtains the underlying device traffic data sent by each underlying device; The message header of the data type message in the wireguard tunnel protocol is extended, and a preset identification field is added to the message header of the data type message as the load data of the data type message, and the underlying device flow data and the load data are encrypted and encapsulated to obtain an encrypted message, and the load data is used to determine the underlying device corresponding to the underlying device flow data; The edge aggregation gateway aggregates the encrypted messages and sends them to the central security gateway through the wireGuard tunnel. The central security gateway receives the encrypted message sent by the edge aggregation gateway, decrypts the encrypted message, obtains the traffic data and load data of the underlying device, and parses the load data to obtain the message header of the data type message containing the identification field, and identifies the corresponding underlying device based on the parsed message header of the data type message containing the identification field; The step of adding a preset identification field to a message header of a data type message as the load data of the data type message comprises: adding an identification field of preset bytes at the end of the message header of the data type message as the load data of the data type message; The identification field includes a magic word field and a characteristic field of session communication.

2. A method for distinguishing wireguard tunnel aggregate traffic according to claim 1, characterized in that: The underlying device traffic data includes session information.

3. A method for distinguishing wireguard tunnel aggregation traffic according to claim 1, characterized in that: The characteristic field of the session communication includes one of an underlying device ID and a source IP address connected to an edge aggregation gateway.

4. A device for distinguishing wireguard tunnel aggregated traffic, applied to an edge aggregation gateway, multiple underlying devices interacting with the edge aggregation gateway, and a central security gateway interacting with the edge aggregation gateway, wherein a network communication tunnel is constructed between the edge aggregation gateway and the central security gateway through a wireguard tunnel, characterized in that: The edge aggregation gateway includes a traffic data receiving module, an expansion module, an encryption and encapsulation module, an aggregation module, an encrypted message sending module and a communication module, and the central security gateway includes an encrypted message receiving module, a decryption module and a parsing module; The flow data receiving module is used to obtain the underlying device flow data sent by each underlying device; The expansion module is used to perform expansion processing on the message header of the data type message in the wireguard tunnel protocol, and add a preset identification field to the message header of the data type message as the load data of the data type message; The encryption and encapsulation module is used to encrypt and encapsulate the flow data and load data of the bottom-level device to obtain an encrypted message, and the load data is used to determine the bottom-level device corresponding to the flow data of the bottom-level device; The aggregation module is used for aggregation processing of encrypted messages; The encrypted message sending module is used to send the encrypted message after aggregation processing to the central security gateway through the wireGuard tunnel; The communication module is used to build a network communication tunnel between the edge aggregation gateway and the central security gateway based on the wireGuard tunnel; The encrypted message receiving module is used to receive the encrypted message sent by the encrypted message sending module; The decryption module is used to decrypt the encrypted message to obtain the flow data and load data of the underlying device; The parsing module is used to parse the load data to obtain a message header of a data type message containing an identification field, and identify a corresponding underlying device based on the parsed message header of the data type message containing the identification field; The step of adding a preset identification field to a message header of a data type message as the load data of the data type message comprises: adding an identification field of preset bytes at the end of the message header of the data type message as the load data of the data type message; The identification field includes a magic word field and a characteristic field of session communication.

5. The device for distinguishing wireguard tunnel aggregate traffic according to claim 4, characterized in that: The bottom layer device comprises a flow data sending module, which is used to send the bottom layer device flow data including session information to the flow data receiving module.

6. The device for distinguishing wireguard tunnel aggregate traffic according to claim 4, characterized in that: The communication module comprises: The inner communication submodule is used to establish a communication connection through the virtual IP of the edge aggregation gateway and the virtual IP of the central security gateway; The outer communication submodule is used to establish a communication connection through the physical port IP of the edge aggregation gateway and the physical port IP of the central security gateway.

7. A computer-readable storage medium having a computer program stored thereon, wherein when the program is executed by a processor, the method according to any one of claims 1 to 3 is implemented.

8. A computer device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the method according to any one of claims 1 to 3 when executing the program.

Images