State strategy matching method and device for network encryption equipment

Abstract

The invention discloses a state strategy matching method and device for network encryption equipment, and the method comprises the steps: carrying out the quintuple matching processing of a network message through a quintuple matching strategy after the network message enters an Ipsec processing unit; if the network message meets the quintuple matching strategy, performing subsequent state strategy matching processing; if the network message does not meet the quintuple matching strategy, discarding the network message; performing state strategy matching processing on the network message subjected to quintuple matching processing through a state matching strategy; if the network message does not meet the state matching strategy, a state hash fast table is added to the node, and subsequent message state judgment processing is carried out; performing message state judgment processing on the state of the network message, and if the state of the network message is incorrect, discarding the network message; and if the state of the network message is correct, performing subsequent operation processing. According to the invention, the security and anti-attack performance of the network encryption machine in a complex network environment can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of network encryption machine IPsecVPN, and in particular to a state policy matching method and device for network encryption equipment. Background Art

[0002] In a complex network environment, hackers may use network terminals with relatively weak security as a springboard to launch illegal TCP access to the central master station equipment, causing damage and impact to the master station equipment;

[0003] At present, the policy matching of network encryption equipment has limitations. If you need to encrypt TCP data, according to the current IPsecVPN technology, the policy needs to be configured as bidirectional to ensure the normal operation of TCP services (because TCP services are bidirectional interactions). After configuring the bidirectional policy, the terminal side can initiate a TCP connection to the main station. Using this feature, hackers can scan the port to launch attacks on the main station.

[0004] Therefore, how to invent a strategy matching method to improve the security and anti-attack capability of network encryption machines in complex network environments has become an urgent problem to be solved. Summary of the invention

[0005] To this end, the present invention provides a state policy matching method and apparatus for a network encryption device, which can improve the security and anti-attack capability of the network encryption machine in a complex network environment.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a state policy matching method for a network encryption device, comprising:

[0007] After the network message enters the IPsec processing unit, the network message is subjected to five-tuple matching processing through the five-tuple matching strategy; if the network message satisfies the five-tuple matching strategy, subsequent state strategy matching processing is performed; if the network message does not satisfy the five-tuple matching strategy, the network message is discarded;

[0008] For the network message processed by the five-tuple matching, the state policy matching process is performed through the state matching strategy; if the network message does not meet the state matching strategy, a state hash table is added to the node to perform subsequent message state judgment processing;

[0009] The network message status is judged and processed. If the network message status is incorrect, the network message is discarded; if the network message status is correct, subsequent operation processing is performed.

[0010] As a preferred solution of a state policy matching method for a network encryption device, in the process of performing the five-tuple matching process on the network message by using the five-tuple matching strategy, the five-tuple matching process comprises:

[0011] Performing quintuple matching on the network message;

[0012] The network message direction is compared with the five-tuple matching strategy direction. If the directions are consistent, subsequent state strategy matching processing is performed; if the directions are inconsistent, the network message is discarded.

[0013] As a preferred solution of a state policy matching method for a network encryption device, in the process of performing the state policy matching processing on the network message through the state matching policy, the steps of the state policy matching processing are:

[0014] Hash the five-tuple of the outgoing message; swap the five-tuple of the received message and hash them so that the hash values ​​are the same;

[0015] Performing the state policy matching process on the network message;

[0016] The network message direction is compared with the state matching strategy direction. If the directions are consistent, subsequent operation processing is performed; if the directions are inconsistent, the state hash table is added to the node to compare the message direction.

[0017] As a preferred solution for a state policy matching method for network encryption devices, in the process of maintaining a state hash table, the five-tuple of the sent message is hashed; the five-tuple of the received message is swapped and hashed to make the hash value the same; when the total number of hash nodes reaches the upper limit, the newly established hash is replaced; when the hash node times out, a connection cleanup thread is established to regularly clean up the timed-out nodes.

[0018] As a preferred solution for a state policy matching method for a network encryption device, the hash node includes source IP, destination IP, source port, destination port, protocol number, timeout, time and connection status information.

[0019] The present invention also provides a state policy matching device for a network encryption device, based on the above state policy matching method for a network encryption device, comprising:

[0020] A five-tuple matching processing module, which is used to perform five-tuple matching processing on the network message through the five-tuple matching strategy after the network message enters the IPsec processing unit; if the network message satisfies the five-tuple matching strategy, then perform subsequent state strategy matching processing; if the network message does not satisfy the five-tuple matching strategy, then discard the network message;

[0021] A state policy matching processing module, used to perform the state policy matching processing on the network message processed by the five-tuple matching through the state matching policy; if the network message does not meet the state matching policy, a state hash table is added to the node to perform subsequent message state judgment processing;

[0022] The message status judgment processing module is used to perform the message status judgment processing on the status of the network message. If the status of the network message is incorrect, the network message is discarded; if the status of the network message is correct, subsequent operation processing is performed.

[0023] As a preferred solution for a state policy matching device for a network encryption device, in the five-tuple matching processing module, the five-tuple matching processing submodule includes:

[0024] A five-tuple matching submodule, used for performing five-tuple matching on the network message;

[0025] The first submodule of message direction comparison processing is used to compare the network message direction with the five-tuple matching strategy direction. If the directions are consistent, subsequent state strategy matching processing is performed; if the directions are inconsistent, the network message is discarded.

[0026] As a preferred solution of a state policy matching device for a network encryption device, in the state policy matching processing module, the state policy matching processing submodule includes:

[0027] The state hash table maintenance submodule is used to hash the five-tuple of the sent message; the five-tuple of the received message is swapped and hashed to make the hash values ​​the same;

[0028] A state policy matching processing submodule, used for performing the state policy matching processing on the network message;

[0029] The second submodule of message direction comparison processing is used to compare the network message direction with the state matching strategy direction. If the directions are consistent, subsequent operation processing is performed; if the directions are inconsistent, the state hash table is added to the node to compare the message direction.

[0030] As a preferred solution for a state policy matching device for a network encryption device, in the state policy matching processing module, in the process of maintaining the state hash table, the five-tuple of the sent message is hashed; the five-tuple of the received message is swapped and hashed to make the hash value the same; when the total number of hash nodes reaches the upper limit, the newly established hash is replaced; when the hash node times out, a connection cleanup thread is established to regularly clean up the timed-out nodes.

[0031] As a preferred solution for a state policy matching device for a network encryption device, in the state hash table maintenance submodule of the state policy matching processing module, the hash node includes source IP, destination IP, source port, destination port, protocol number, timeout, time and connection status information.

[0032] The present invention has the following advantages: after a network message enters an IPsec processing unit, a five-tuple matching process is performed on the network message through a five-tuple matching strategy; if the network message satisfies the five-tuple matching strategy, a subsequent state strategy matching process is performed; if the network message does not satisfy the five-tuple matching strategy, the network message is discarded; the steps of the five-tuple matching process are: five-tuple matching is performed on the network message; the direction of the network message is compared with the direction of the five-tuple matching strategy, if the directions are consistent, a subsequent state strategy matching process is performed; if the directions are inconsistent, the network message is discarded. The network message processed by the five-tuple matching is subjected to the state policy matching process through the state matching strategy; if the network message does not meet the state matching strategy, the state hash table is added to the node to perform subsequent message state judgment processing; the steps of the state policy matching process are: hashing the five-tuple of the sent message; swapping the five-tuple of the received message and hashing it so that the hash value is the same; performing the state policy matching process on the network message; comparing the direction of the network message with the direction of the state matching strategy, if the directions are consistent, performing subsequent operation processing; if the directions are inconsistent, adding the state hash table to the node to compare the message directions. The message state judgment process is performed on the state of the network message, if the state of the network message is incorrect, the network message is discarded; if the state of the network message is correct, subsequent operation processing is performed. The present invention can improve the security and anti-attack performance of the network encryption machine in a complex network environment. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0034] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0035] Figure 1 A schematic diagram of a flow chart of a state policy matching method for a network encryption device provided in Embodiment 1 of the present invention;

[0036] Figure 2 A schematic diagram of the processing flow of an IPsec function module in a state policy matching method for a network encryption device provided in Embodiment 1 of the present invention;

[0037] Figure 3 This is a schematic diagram of a state hash fast representation in a state policy matching method for a network encryption device provided in Example 1 of the present invention;

[0038] Figure 4 A schematic diagram of a processing flow when the total number of hash nodes reaches an upper limit in a state policy matching method for a network encryption device provided in Embodiment 1 of the present invention;

[0039] Figure 5 A schematic diagram of a hash node timeout processing flow in a state policy matching method for a network encryption device provided in Embodiment 1 of the present invention;

[0040] Figure 6 A schematic diagram of the jump between TCP message states in a possible embodiment provided in Embodiment 1 of the present invention;

[0041] Figure 7 A schematic diagram of jumps between states after TCP message simplification in a possible embodiment provided in Embodiment 1 of the present invention;

[0042] Figure 8 A schematic diagram of a TCP message processing flow in a possible embodiment provided in Embodiment 1 of the present invention;

[0043] Fig. 9A schematic diagram of a UDP message connection state conversion process in a possible embodiment provided in Embodiment 1 of the present invention;

[0044] Fig.10 A schematic diagram of the ICMP message connection state transition process in a possible embodiment provided in Embodiment 1 of the present invention;

[0045] Fig.11 This is a schematic diagram of the architecture of a state policy matching device for a network encryption device provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0046] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0047] Example 1

[0048] See also Figure 1 and Figure 2 Embodiment 1 of the present invention provides a full disk encryption storage method transparent to an upper layer, comprising the following steps:

[0049] S1. After the network message enters the IPsec processing unit, the network message is subjected to five-tuple matching processing through the five-tuple matching strategy; if the network message satisfies the five-tuple matching strategy, subsequent state strategy matching processing is performed; if the network message does not satisfy the five-tuple matching strategy, the network message is discarded;

[0050] S2, for the network message processed by the five-tuple matching, the state policy matching process is performed through the state matching strategy; if the network message does not meet the state matching strategy, the state hash table is added to the node to perform subsequent message state judgment processing;

[0051] S3. Perform the message status judgment process on the state of the network message. If the state of the network message is incorrect, discard the network message; if the state of the network message is correct, perform subsequent operation processing.

[0052] In this embodiment, network messages include TCP, ICMP, and UDP. The detailed design and processing flow of the three message protocols is as follows:

[0053] 1. TCP

[0054] a1) Control the direction of actively initiated connections and only allow TCP connections specified in the policy;

[0055] b1) Track link status. Link establishment messages should comply with the three-way handshake process, and link release messages should comply with the four-wave handshake process. Data messages are only allowed to pass TCP data messages that meet the policy after completing the three-way handshake and before the four-wave handshake.

[0056] c1) The link release timeout period can be configured, and the minimum value should be ≥300 seconds;

[0057] d1) After receiving a data packet that does not conform to the link connection status, intercept the message and generate an alarm.

[0058] When the connection is not established, the connection is disconnected due to timeout, the connection is disconnected due to four handshakes, or the connection is disconnected due to RST, TCP receives a data packet (PUSH packet) and the status is abnormal. For the first three abnormal data packets, the device replies RST to the source address of the abnormal data packet, and no RST is replied to the subsequent abnormal data packets; the release connection session time is configurable, and the default value is 30 minutes.

[0059] 2. UDP

[0060] a2) According to the first message, control the connection direction and confirm the tracking link status;

[0061] b2) The link release timeout period can be configured, and the minimum value should be ≥180 seconds;

[0062] c2) If the link status is detected to be abnormal, the connection will be disconnected and an alarm will be generated.

[0063] 3. ICMP

[0064] a3) The policy only allows Echo request and Echo reply messages to pass;

[0065] b3) Control the connection direction according to the direction of the request message;

[0066] c3) ICMP error message: discard and alarm, the alarm log should contain the type and code of the error message and the source, destination IP, source and destination port, and protocol type of the faulty IP datagram;

[0067] d3) The link release timeout period can be configured, and the minimum value should be ≥30 seconds;

[0068] e3) If the link status is detected to be abnormal, the connection will be disconnected and an alarm will be generated.

[0069] Therefore, the core of the state-based policy matching function can be divided into two parts: one is the state jump and maintenance of the three types of messages: TCP, UDP, and ICMP; the other is the timeout processing mechanism for each connection.

[0070] In this embodiment, in step S1, after the network message enters the IPsec processing unit, the network message is subjected to five-tuple matching processing through the five-tuple matching strategy; if the network message satisfies the five-tuple matching strategy, subsequent state strategy matching processing is performed; if the network message does not satisfy the five-tuple matching strategy, the network message is discarded;

[0071] Specifically, in the IPsec unit processing, the state policy matching is placed after the five-tuple policy matching, and the state policy matching is performed when the message meets the five-tuple policy.

[0072] The steps of the five-tuple matching process are as follows:

[0073] S11, performing quintuple matching on the network message;

[0074] S12: Compare the direction of the network message with the direction of the five-tuple matching strategy. If the directions are consistent, perform subsequent state strategy matching processing; if the directions are inconsistent, discard the network message.

[0075] In this embodiment, in step S2, the network message processed by the five-tuple matching is subjected to the state policy matching process through the state matching strategy; if the network message does not meet the state matching strategy, a state hash table is added to the node to perform subsequent message state judgment processing;

[0076] Specifically, ICMP and TCP services are strongly related to direction in the state matching process. The relationship between the message direction and the five-tuple policy direction is required in the state function processing process: after the five-tuple policy function module completes the policy matching function, it returns the comparison value between the message direction and the policy direction. The processing related to the connection state is completed by the state policy matching function module, and the two are coupled in the call.

[0077] To ensure that the same connection is maintained on one node, the five-tuple of the sent message is hashed, and the five-tuple of the received message is swapped and hashed to make the hash values ​​the same.

[0078] The steps of the state strategy matching process are as follows:

[0079] S21, hash the five-tuple of the outgoing message; swap the five-tuple of the received message and hash them so that the hash values ​​are the same;

[0080] S22, performing the state policy matching process on the network message;

[0081] S23, compare the network message direction with the state matching strategy direction, if the directions are consistent, perform subsequent operation processing; if the directions are inconsistent, add the state hash table to the node and compare the message direction.

[0082] In this embodiment, the state hash table is designed to support 2048 tunnels according to IPsecVPN and is composed of a linked list array. The array has 2048 elements, that is, 0-2047 is the hash value. When different connection hash values ​​conflict, a linked list operation is performed at the node. The structure is as follows: Figure 3 As shown, to ensure that the same connection is maintained on one node, the five-tuple of the sent message is hashed, and the five-tuple of the received message is swapped and hashed to make the hash values ​​the same.

[0083] Among them, a connection node includes information such as source IP, destination IP, source port, destination port, protocol number, timeout, time, connection status, etc.

[0084] In order to ensure that the hash nodes are controllable and avoid memory leaks, the total number of hash nodes is controlled. When the total number of hash nodes reaches the upper limit, the newly created hash is replaced. The specific process is as follows: Figure 4 shown.

[0085] When a hash node times out, a connection cleanup thread is established to clean up the timed-out nodes regularly. The specific process is as follows: Figure 5 shown.

[0086] In this embodiment, in step S3, the message status judgment process is performed on the status of the network message. If the status of the network message is incorrect, the network message is discarded; if the status of the network message is correct, subsequent operation processing is performed.

[0087] In a possible embodiment, the TCP message state matching mechanism is as follows:

[0088] There are 6 TCP message flags, namely: URG, PSH, ACK, RST, SYN, FIN. Among them, URG (urgent pointer field is valid) and PSH (Push operation) have no effect on the TCP connection state, so in the state jump process, it is only necessary to jump the state of the four types of messages, ACK, RST, SYN, and FIN.

[0089] In a TCP connection, the port numbers are different between different services, so there is only one connection on each node.

[0090] A TCP connection involves 11 state transitions: Figure 6 shown.

[0091] Among them, TCP has 11 states. Figure 6 Explanations of various states, events, and transitions

[0092] As shown in Table 1:

[0093]

[0094] Table 1 Status explanation

[0095] In the implementation process, the TCP state machine can be simplified, and only the TCP link establishment and TCP link disconnection processes are strictly judged. According to the TCP state machine, it is simplified, and the simplified rules are as follows:

[0096] a4) CLOSED, LISTEN state is simplified to disconnected state;

[0097] b4) SYN-SENT is in the connection state 1, and SYN-RECEIVED is in the connection state 2;

[0098] c4)ESTABLISHED is the connected state;

[0099] d4) Since the TCP disconnection phase requires two FINs and two ACKs, the CLOSE-WAIT, LAST-ACK, FIN-WAIT-1, FIN-WAIT-2, CLOSING, and TIME-WAIT disconnection processes can be simplified to disconnection state 1 and disconnection state 2;

[0100] After simplification, the TCP jump state is 6 states, such as Figure 7 shown.

[0101] like Figure 8 As shown in the figure, the processing flow of TCP message is as follows:

[0102] M1. Perform status hash table matching. If the match is successful, perform node status judgment. If the match is unsuccessful, add the status hash table to the node.

[0103] M2, judge the node status, if the node is in the disconnected state, then perform SYN message and direction judgment processing; if the node is in the connected state, the state machine jumps, and then performs subsequent processing;

[0104] M3, process the SYN message and direction judgment. If the direction is correct, jump to the connected state 1; if the direction is incorrect, keep the disconnected state and discard the message;

[0105] M4, after completing the jump connection in state 1, the message is forwarded, the timeout is updated, and subsequent processing is performed;

[0106] M5. After maintaining the disconnected state and discarding the message, determine the number of times the node sends the RST message. If the number of times is ≤3, send the RST message and perform subsequent processing; if the number of times is >3, perform subsequent processing directly.

[0107] In a possible embodiment, the UDP message status matching mechanism is as follows:

[0108] The connection state of UDP packets does not distinguish between directions and can be divided into two states: disconnected and connected (DISCONNECT, CONNECTED). The outgoing and incoming UDP packets record their states in a hash node.

[0109] State rule: When the device receives the first UDP packet that complies with the five-tuple policy and has the correct direction, the UDP connection corresponding to the five-tuple becomes connected until the link is broken and the node is deleted after timeout.

[0110] like Fig. 9 As shown in the figure, the connection state transition process of the TCP message is as follows:

[0111] N1. Perform status hash table matching. If the match is successful, perform node status judgment. If the match is unsuccessful, add the status hash table to the node.

[0112] N2. Determine the node status. If the node is in a connected state, update the timeout time and perform subsequent processing. If the node is in a disconnected state, determine the message direction.

[0113] N3. Determine the direction of the message. If the direction is correct, set it to connected state, update the timeout period, and perform subsequent processing. If the direction is incorrect, set it to disconnected state and discard the message.

[0114] In a possible embodiment, the ICMP message status matching mechanism is as follows:

[0115] ICMP messages only process the status of REQUEST and REPLY messages, and discard other types of messages. Because the ping service is directional, ICMP messages are divided into two connections: outgoing direction (OUT) and incoming direction (IN) based on the REQUEST message. ICMP messages do not have ports, so the two connections are maintained using two status bits in a hash node in the state hash table.

[0116] Status rules: REQUEST message processing: The received REQUEST message is matched according to the direction. If the direction is correct, it becomes connected state, and if the direction is wrong, it becomes disconnected state; REPLY message processing: When a REPLY message with the correct direction is received in the connected state, the business process is considered to have ended, and the connection state is set to disconnected state. All REPLY messages in the disconnected state are discarded. REQUEST messages correspond to REPLY messages one by one, such as Fig.10 As shown in the figure, the connection state transition process of the ICMP message is as follows:

[0117] T1, perform state hash table matching, if the match is successful, perform message classification; if the match is unsuccessful, add the state hash table to the node and perform message classification again;

[0118] T2: Classify the messages into REQUEST messages and REPLY messages.

[0119] T31, judge the direction of the REQUEST message, if the direction is correct, set it to connected state, update the timeout time, and perform subsequent processing; if the direction is incorrect, set it to disconnected state and discard the message;

[0120] T32. Determine the connection status of the REPLY message node. If it is in a connected state, set it to a disconnected state, update the timeout time, and perform subsequent processing; if it is in a disconnected state, update the timeout time and discard the message.

[0121] To summarize, after the network message of the present invention enters the Ipsec processing unit, the network message is subjected to five-tuple matching processing through the five-tuple matching strategy; if the network message satisfies the five-tuple matching strategy, subsequent state strategy matching processing is performed; if the network message does not satisfy the five-tuple matching strategy, the network message is discarded; the steps of the five-tuple matching processing are: five-tuple matching is performed on the network message; the direction of the network message is compared with the direction of the five-tuple matching strategy, if the directions are consistent, subsequent state strategy matching processing is performed; if the directions are inconsistent, the network message is discarded. The network message processed by the five-tuple matching is subjected to the state policy matching process through the state matching strategy; if the network message does not meet the state matching strategy, the state hash table is added to the node to perform subsequent message state judgment processing; the steps of the state policy matching process are: hashing the five-tuple of the sent message; swapping the five-tuple of the received message and hashing it so that the hash value is the same; performing the state policy matching process on the network message; comparing the direction of the network message with the direction of the state matching strategy, if the directions are consistent, performing subsequent operation processing; if the directions are inconsistent, adding the state hash table to the node to compare the message directions. The message state judgment process is performed on the state of the network message, if the state of the network message is incorrect, the network message is discarded; if the state of the network message is correct, subsequent operation processing is performed. The present invention can improve the security and anti-attack performance of the network encryption machine in a complex network environment.

[0122] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0123] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0124] Example 2

[0125] See also Fig.11Embodiment 2 of the present invention further provides a state policy matching device for a network encryption device, comprising:

[0126] The five-tuple matching processing module 001 is used to perform five-tuple matching processing on the network message through the five-tuple matching strategy after the network message enters the IPsec processing unit; if the network message satisfies the five-tuple matching strategy, then perform subsequent state strategy matching processing; if the network message does not satisfy the five-tuple matching strategy, then discard the network message;

[0127] The state policy matching processing module 002 is used to perform the state policy matching processing on the network message processed by the five-tuple matching through the state matching policy; if the network message does not meet the state matching policy, the state hash table is added to the node to perform subsequent message state judgment processing;

[0128] The message status judgment processing module 003 is used to perform the message status judgment processing on the status of the network message. If the status of the network message is incorrect, the network message is discarded; if the status of the network message is correct, subsequent operation processing is performed.

[0129] In this embodiment, in the quintuple matching processing module 001, the quintuple matching processing submodule includes:

[0130] A five-tuple matching submodule 011, used for performing five-tuple matching on the network message;

[0131] The first submodule 012 for message direction comparison processing is used to compare the network message direction with the quintuple matching strategy direction. If the directions are consistent, subsequent state strategy matching processing is performed; if the directions are inconsistent, the network message is discarded.

[0132] In this embodiment, in the state policy matching processing module 002, the state policy matching processing submodule includes:

[0133] The state hash table maintenance submodule 021 is used to hash the five-tuple of the sent message; and to swap the five-tuple of the received message and hash them so that the hash values ​​are the same;

[0134] The state policy matching processing submodule 022 is used to perform the state policy matching processing on the network message;

[0135] The second submodule 023 of message direction comparison processing is used to compare the network message direction with the state matching strategy direction. If the directions are consistent, subsequent operation processing is performed; if the directions are inconsistent, the state hash table is added to the node to compare the message direction.

[0136] In this embodiment, in the state policy matching processing module 002, in the process of maintaining the state hash table, the five-tuple of the sent message is hashed; the five-tuple of the received message is swapped and hashed to make the hash value the same; when the total number of hash nodes reaches the upper limit, the newly established hash is replaced; when the hash node times out, a connection cleanup thread is established to regularly clean up the timed-out nodes.

[0137] In this embodiment, in the state hash table maintenance submodule 021 of the state policy matching processing module 002, the hash node includes source IP, destination IP, source port, destination port, protocol number, timeout, time and connection status information.

[0138] It should be noted that the information interaction, execution process, etc. between the modules of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the present application, and will not be repeated here.

[0139] Example 3

[0140] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code for a state policy matching method for a network encryption device is stored. The program code includes instructions for executing embodiment 1 or any possible implementation method of a state policy matching method for a network encryption device.

[0141] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0142] Example 4

[0143] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0144] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute a state policy matching method for a network encryption device in accordance with embodiment 1 or any possible implementation thereof.

[0145] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0146] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable systems. The computer instructions can be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0147] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing system, they can be concentrated on a single computing system, or distributed on a network composed of multiple computing systems, and optionally, they can be implemented by a program code executable by a computing system, so that they can be stored in a storage system and executed by the computing system, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0148] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A state policy matching method for a network encryption device, characterized in that: include: After the network message enters the IPsec processing unit, the network message is subjected to five-tuple matching processing through the five-tuple matching strategy; If the network message satisfies the five-tuple matching strategy, subsequent state strategy matching processing is performed; if the network message does not satisfy the five-tuple matching strategy, the network message is discarded; For the network message processed by the five-tuple matching, the state policy matching process is performed through the state matching strategy; if the network message does not meet the state matching strategy, a state hash table is added to the node to perform subsequent message state judgment processing; Performing the message status judgment process on the state of the network message, and if the state of the network message is incorrect, discarding the network message; If the status of the network message is correct, subsequent operation processing is performed.

2. A state policy matching method for a network encryption device according to claim 1, characterized in that: In the process of performing the five-tuple matching process on the network message by using the five-tuple matching strategy, the steps of the five-tuple matching process are: Performing quintuple matching on the network message; Compare the network message direction with the five-tuple matching strategy direction, and if the directions are consistent, perform subsequent state strategy matching processing; If the directions are inconsistent, the network message is discarded.

3. A state policy matching method for a network encryption device according to claim 2, characterized in that: In the process of performing the state policy matching process on the network message through the state matching policy, the steps of the state policy matching process are: Hash the five-tuple of the outgoing message; swap the five-tuple of the received message and hash them so that the hash values ​​are the same; Performing the state policy matching process on the network message; Compare the network message direction with the state matching strategy direction, and if the directions are consistent, perform subsequent operation processing; If the directions are inconsistent, the state hash table is added to the node to compare the message directions.

4. A state policy matching method for a network encryption device according to claim 3, characterized in that: In the process of maintaining the status hash table, the five-tuple of the sent message is hashed; the five-tuple of the received message is swapped and hashed to make the hash value the same; when the total number of hash nodes reaches the upper limit, the newly established hash is replaced; when the hash node times out, a connection cleanup thread is established to regularly clean up the timed-out nodes.

5. A state policy matching method for a network encryption device according to claim 4, characterized in that: The hash node includes source IP, destination IP, source port, destination port, protocol number, timeout, time and connection status information.

6. A state policy matching device for a network encryption device, using a state policy matching method for a network encryption device according to any one of claims 1 to 5, characterized in that: include: A five-tuple matching processing module, used for performing five-tuple matching processing on the network message through the five-tuple matching strategy after the network message enters the IPsec processing unit; If the network message satisfies the five-tuple matching strategy, subsequent state strategy matching processing is performed; if the network message does not satisfy the five-tuple matching strategy, the network message is discarded; A state policy matching processing module, used to perform the state policy matching processing on the network message processed by the five-tuple matching through the state matching policy; if the network message does not meet the state matching policy, a state hash table is added to the node to perform subsequent message state judgment processing; A message status judgment processing module, used for performing the message status judgment processing on the status of the network message, and if the status of the network message is incorrect, discarding the network message; If the status of the network message is correct, subsequent operation processing is performed.

7. A state strategy matching device for a network encryption device according to claim 6, characterized in that: In the five-tuple matching processing module, the five-tuple matching processing submodule includes: A five-tuple matching submodule, used for performing five-tuple matching on the network message; The first submodule of message direction comparison processing is used to compare the network message direction with the five-tuple matching strategy direction. If the directions are consistent, subsequent state strategy matching processing is performed; if the directions are inconsistent, the network message is discarded.

8. A state strategy matching device for a network encryption device according to claim 7, characterized in that: In the state strategy matching processing module, the state strategy matching processing submodule includes: The state hash table maintenance submodule is used to hash the five-tuple of the sent message; swap the five-tuple of the received message and hash them to make the hash values ​​the same; A state policy matching processing submodule, used for performing the state policy matching processing on the network message; The second submodule of message direction comparison processing is used to compare the network message direction with the state matching strategy direction. If the directions are consistent, subsequent operation processing is performed; if the directions are inconsistent, the state hash table is added to the node to compare the message direction.

9. A state strategy matching device for a network encryption device according to claim 8, characterized in that: In the state strategy matching processing module, in the process of maintaining the state hash table, the five-tuple of the sent message is hashed; the five-tuple of the received message is swapped and hashed to make the hash value the same; when the total number of hash nodes reaches the upper limit, the newly established hash is replaced; when the hash node times out, a connection cleanup thread is established to regularly clean up the timed-out nodes.

10. A state strategy matching device for a network encryption device according to claim 9, characterized in that: In the state hash table maintenance submodule of the state policy matching processing module, the hash node includes source IP, destination IP, source port, destination port, protocol number, timeout, time and connection status information.

Images