SSL / TLS unloading method based on VPP and electronic device

Abstract

The invention provides an SSL / TLS unloading method based on VPP and an electronic device. The method comprises the following steps: performing an SSL / TLS negotiation process based on first load balancing software to obtain a first key; and performing an SSL / TLS encryption and decryption process based on the VPP and the first key. Based on the method, when the load balancing software is combined with the VPP to carry out SSL / TLS unloading, the SSL / TLS negotiation process and the SSL / TLS encryption and decryption process are separated and are respectively carried out based on the first load balancing software and the VPP, so that the performance overhead of the first load balancing software is reduced, and the SSL / TLS unloading efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a VPP-based SSL / TLS offloading method and electronic device. Background Art

[0002] With the full advancement of the Hypertext Transfer Protocol Secure (HTTPS), the server often unloads the Secure Socket Layer (SSL) protocol / Transport Layer Security (TLS) protocol on the gateway, so that the gateway and the server can communicate in a non-encrypted or weakly encrypted manner, avoiding the server's additional performance overhead and releasing processing power for the target application or website. Usually, SSL / TLS unloading technology is mostly based on load balancing software such as Nginx / Envoy, which runs on the user-mode process of the Linux operating system. In order to avoid the inefficiency of the Linux operating system network protocol stack, related technologies use the data plane development kit (DPDK) zero-copy technology or the vector packet processing (VPP) user-mode protocol stack technology to improve the data transmission and processing performance of the data plane. However, when the load balancing software is combined with VPP to unload SSL / TLS, the central processing unit (CPU) resources occupied by the load balancing software are insufficient, and there is a performance bottleneck. Summary of the invention

[0003] The embodiments of the present application provide a VPP-based SSL / TLS offloading method and electronic device.

[0004] In a first aspect, an embodiment of the present application provides an SSL / TLS offloading method based on VPP, the method comprising:

[0005] Performing an SSL / TLS negotiation process based on the first load balancing software to obtain a first key;

[0006] Perform SSL / TLS encryption and decryption process based on VPP and the first key.

[0007] Optionally, the SSL / TLS negotiation process includes:

[0008] The first load balancing software negotiates the first key with the first client based on the first negotiation message and the first negotiation condition, the first negotiation message is used by the first client to request negotiation of the first key, and the first negotiation condition is used to specify the condition for negotiating the first key;

[0009] If the negotiation is successful, the first load balancing software sends the first key to the VPP;

[0010] If the negotiation fails, the first load balancing software blocks the SSL / TLS negotiation process.

[0011] Optionally, the first negotiation condition includes one or more of the following:

[0012] The certificate is used by the first client to authenticate the identity of the server;

[0013] Encryption and decryption algorithms, which are used to specify the algorithms used in the SSL / TLS encryption and decryption process;

[0014] Protocol version, which is used to specify the version of the protocol used in the SSL / TLS negotiation process;

[0015] Session reuse is used to specify a mechanism for the first client to resume an established SSL session.

[0016] Optionally, the SSL / TLS encryption and decryption process includes:

[0017] The VPP decrypts the first message based on the first key to obtain a first plaintext, where the first message is a message sent by the first client;

[0018] Alternatively, the VPP encrypts the second plaintext based on the first key to obtain a second message, and the second message is a message sent to the first client.

[0019] Optionally, before the VPP encrypts the second plaintext based on the first key to obtain the second message, the method further includes:

[0020] The VPP determines the modification method and forwarding direction of the second plaintext based on the instruction of the first load balancing software.

[0021] Optionally, the first load balancing software interacts with the VPP based on an event mechanism.

[0022] Optionally, the SSL / TLS negotiation process and the SSL / TLS encryption / decryption process are accelerated based on the first accelerator.

[0023] In a second aspect, an embodiment of the present application provides an electronic device, including:

[0024] A negotiation module, configured to perform an SSL / TLS negotiation process based on the first load balancing software to obtain a first key;

[0025] The encryption and decryption module is used to perform the SSL / TLS encryption and decryption process based on the VPP and the first key.

[0026] Optionally, during the SSL / TLS negotiation process, the negotiation module is used to:

[0027] negotiating a first key with the first client based on a first negotiation message and a first negotiation condition, where the first negotiation message is used by the first client to request negotiation of the first key, and the first negotiation condition is used to specify a condition for negotiating the first key;

[0028] If the negotiation is successful, the first key is sent to the VPP;

[0029] If the negotiation fails, the SSL / TLS negotiation process is blocked.

[0030] Optionally, the first negotiation condition includes one or more of the following:

[0031] The certificate is used by the first client to authenticate the identity of the server;

[0032] Encryption and decryption algorithms, which are used to specify the algorithms used in the SSL / TLS encryption and decryption process;

[0033] Protocol version, which is used to specify the version of the protocol used in the SSL / TLS negotiation process;

[0034] Session reuse is used to specify a mechanism for the first client to resume an established SSL session.

[0035] Optionally, in the SSL / TLS encryption and decryption process, the encryption and decryption module is used to:

[0036] Decrypting the first message based on the first key to obtain a first plaintext, where the first message is a message sent by the first client;

[0037] Alternatively, the second plaintext is encrypted based on the first key to obtain a second message, where the second message is a message sent to the first client.

[0038] Optionally, before encrypting the second plaintext based on the first key to obtain the second message, the encryption and decryption module is further used to:

[0039] Based on the instruction of the first load balancing software, a modification method and a forwarding direction of the second plaintext are determined.

[0040] Optionally, the first load balancing software interacts with the VPP based on an event mechanism.

[0041] Optionally, the SSL / TLS negotiation process and the SSL / TLS encryption / decryption process are accelerated based on the first accelerator.

[0042] In a third aspect, an embodiment of the present application provides an electronic device comprising a memory, at least one processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the computer program, a method as described in any one of the above-mentioned first aspects is implemented.

[0043] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method as described in any one of the above-mentioned first aspects is implemented.

[0044] In a fifth aspect, an embodiment of the present application provides a computer program product. When the computer program product is run on an electronic device, the electronic device executes any one of the methods described in the first aspect.

[0045] Based on the present application, when the load balancing software is combined with VPP to perform SSL / TLS offloading, the SSL / TLS negotiation process and the SSL / TLS encryption and decryption process are separated and performed based on the first load balancing software and VPP respectively, thereby reducing the performance overhead of the first load balancing software and helping to improve the efficiency of SSL / TLS offloading. BRIEF DESCRIPTION OF THE DRAWINGS

[0046] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for describing the embodiments are briefly introduced below.

[0047] Figure 1 It is a flowchart of the VPP-based SSL / TLS offloading method provided in an embodiment of the present application.

[0048] Figure 2 This is an example diagram of the VPP-based SSL / TLS offloading method provided in an embodiment of the present application.

[0049] Figure 3 It is a schematic diagram of the structure of an electronic device provided in one embodiment of the present application.

[0050] Figure 4 It is a structural schematic diagram of an electronic device provided in another embodiment of the present application. DETAILED DESCRIPTION

[0051] The technical solution of the embodiment of the present invention will be described below in conjunction with the accompanying drawings in the embodiment of the present invention.

[0052] Hypertext transfer protocol (HTTP) is an application layer protocol for distributed, collaborative and hypermedia information systems. It is the data communication basis of the World Wide Web. HTTP itself is insecure because the transmitted data is not encrypted and may be eavesdropped or tampered with. In order to solve this problem, HTTPS was introduced. HTTPS communicates via HTTP, but uses SSL / TLS to encrypt data packets. The main purpose of HTTPS development is to provide identity authentication for website servers and protect the privacy and integrity of exchanged data. Due to the need for encryption and decryption, there may be a certain performance overhead.

[0053] Therefore, SSL / TLS offloading technology has been developed. SSL / TLS offloading technology is a network security technology that aims to reduce the burden on the server and improve the performance and security of the system by offloading the encryption and decryption work of the SSL / TLS protocol from the server to specialized hardware or software devices.

[0054] With the full promotion of HTTPS, the server often unloads the SSL / TLS protocol on the gateway, so that the gateway and the server can communicate in a non-encrypted or weakly encrypted manner, avoiding additional performance overhead on the server and releasing processing power for the target application or website. Usually, SSL / TLS unloading technology is mostly based on load balancing software such as Nginx / Envoy, which runs on the user-mode process of the Linux operating system.

[0055] In order to avoid the inefficiency of the Linux operating system network protocol stack, related technologies use DPDK zero-copy technology or VPP user-mode protocol stack technology to improve the data transmission and processing performance of the data plane. However, when the load balancing software is combined with VPP for SSL / TLS offloading, the CPU resources occupied by the load balancing software are insufficient, and there is a performance bottleneck. Take the solution of Nginx combining VPP with LDP communication for SSL / TLS offloading as an example, where LDP refers to LD_PRELOAD. Based on LDP, the dynamic link library can be loaded first before the program runs, and the system library function can be overwritten in this way. In this solution, the SSL / TLS negotiation and encryption and decryption processes are all completed on Nginx, and VPP only plays the role of sending and receiving packets. However, on the forwarding device, most of the CPU cores are allocated to VPP, resulting in performance bottlenecks in the encryption and decryption process of Nginx and insufficient performance. In addition, Nginx and VPP interact in a message copying manner, and the performance is relatively low.

[0056] Based on this, Figure 1The embodiment of the present application provides a VPP-based SSL / TLS unloading method. The method is applicable to forwarding devices, such as gateways, routers, etc., which can undertake the SSL / TLS negotiation and encryption and decryption work in the communication process between the client and the server.

[0057] like Figure 1 As shown, the method may include steps S110 - S120 .

[0058] In step S110, an SSL / TLS negotiation process is performed based on the first load balancing software to obtain a first key. The SSL / TLS negotiation process can be triggered based on a message from the client for requesting SSL / TLS negotiation, so that the first load balancing software can negotiate a first key with the client based on the message, and the first key is a symmetric key for encryption and decryption of communications between the client and the forwarding device. As an example, the first load balancing software can be Nginx, and the SSL / TLS negotiation process can be performed by the TLS negotiation part in Nginx.

[0059] In step S120, an SSL / TLS encryption / decryption process is performed based on the VPP and the first key. The SSL / TLS encryption / decryption process may include encrypting plaintext using the first key, or decrypting a message using the first key. The VPP may obtain the first key from the first load balancing software, for example, by receiving the first key issued by the first load balancing software.

[0060] It is worth noting that Figure 1 In the method shown, the work of sending and receiving messages in the communication process between the forwarding device and other devices (server or client) can be undertaken by VPP, and the first load balancing software can interact with VPP for relevant information. For example, VPP can receive a message from the client for requesting SSL / TLS negotiation, and inform the first load balancing software that there is a message to be negotiated. For another example, the first load balancing software can send the message in the negotiation process to VPP, and VPP sends it to the client. Based on this, the forwarding capability of VPP can be fully utilized, which helps to improve the packet forwarding rate of the forwarding device. Furthermore, before the SSL / TLS negotiation process, VPP can establish a flow table entry based on the transmission control protocol (TCP) handshake message, perform connection management, and uniformly control and process subsequent messages.

[0061] Based on the present application, when the load balancing software is combined with VPP to perform SSL / TLS offloading, the SSL / TLS negotiation process and the SSL / TLS encryption and decryption process are separated and performed based on the first load balancing software and VPP respectively, thereby reducing the performance overhead of the first load balancing software and helping to improve the efficiency of SSL / TLS offloading.

[0062] The following is a detailed introduction to the SSL / TLS negotiation process and the SSL / TLS encryption and decryption process.

[0063] SSL / TLS negotiation process (performed by the first load balancing software)

[0064] Optionally, the SSL / TLS negotiation process may include: the first load balancing software negotiates the first key with the first client based on the first negotiation message and the first negotiation condition, the first negotiation message can be used by the first client to request the negotiation of the first key, and the first negotiation condition can be used to specify the conditions for negotiating the first key; if the negotiation is successful, the first load balancing software sends the first key to the VPP; if the negotiation fails, the first load balancing software blocks the SSL / TLS negotiation process.

[0065] The first client may be any client that communicates with the forwarding device, and the first client may request the forwarding device to negotiate the first key through a first negotiation message. The first negotiation message may be received by the VPP and passed to the first load balancing software, and the message generated by the first load balancing software and the client during the negotiation of the first key may also be passed via the VPP. The first negotiation condition may be determined by the first load balancing software, for example, the first load balancing software may determine the first negotiation condition based on the first negotiation message.

[0066] Optionally, the first negotiation condition may include one or more of the following: certificate; encryption and decryption algorithm; protocol version; session reuse. Among them, the certificate can be used by the first client to authenticate the identity of the server, for example, to authenticate whether the server is legitimate. The encryption and decryption algorithm can be used to specify the algorithm in the SSL / TLS encryption and decryption process, and the protocol version can be used to specify the version of the protocol used in the SSL / TLS negotiation process. Session reuse can be used to specify a mechanism for the first client to restore an established SSL session, for example, it can specify whether the first client can restore an established SSL session and how to restore it. The process of the first load balancing software negotiating the first key with the first client is not limited and can be carried out according to a general process.

[0067] It is worth noting that whether the negotiation is successful can be determined based on the results of the negotiation process and the rules configured by the user. The rules configured by the user can specify the connection rate, user type, and IP range of the negotiation. If the negotiation process is successful and complies with the rules configured by the user, the negotiation is successful, otherwise the negotiation fails. When the negotiation is completed, the first load balancing software can inform the VPP of the negotiation result. For example, if the negotiation is successful, the first load balancing software can send the first key to the VPP. For another example, if the negotiation fails, the first load balancing software can inform the VPP to block the negotiation process.

[0068] By performing the SSL / TLS negotiation process based on the first load balancing software, the flexibility of the negotiation process of the first load balancing software can be fully utilized, which is easy to manage.

[0069] SSL / TLS encryption and decryption process (performed by VPP)

[0070] Optionally, the SSL / TLS encryption and decryption process may include: VPP decrypts a first message based on a first key to obtain a first plaintext, and the first message is a message sent by the first client; or VPP encrypts a second plaintext based on the first key to obtain a second message, and the second message is a message sent to the first client. That is, the SSL / TLS encryption and decryption process may include VPP decrypting a message received from the client, or VPP encrypting a plaintext to be sent to the client. As an example, the work of encrypting and decrypting a message can be performed by the symmetric encryption and decryption part of the VPP. Performing the SSL / TLS encryption and decryption process based on VPP can make full use of the CPU resources of VPP, which helps to improve the efficiency of the SSL / TLS encryption and decryption process.

[0071] Furthermore, before the VPP encrypts the second plaintext based on the first key to obtain the second message, Figure 1 The method shown may also include: VPP determines the modification method and forwarding direction of the second plaintext based on the instruction of the first load balancing software. That is, before encrypting the second plaintext, VPP can determine how to modify the second plaintext and the forwarding direction of the second plaintext according to the instruction of the first load balancing software. As an example, VPP can process the second plaintext in the forwarding plug-in, and VPP can interact with the first load balancing software through the forwarding plug-in to obtain instructions. Taking the first load balancing software as Nginx as an example, Nginx can communicate with the forwarding plug-in of VPP to provide instructions. Based on the instruction of the first load balancing software, it helps VPP to flexibly control the modification and forwarding direction of the message. It is worth noting that before VPP obtains the first key, its internal plug-ins (such as TLS plug-ins and forwarding plug-ins) transmit the message without modification.

[0072] As mentioned above, the performance of the interaction between Nginx and VPP in the relevant solutions is relatively low. Figure 1In the method shown, the first load balancing software and the VPP can interact based on an event mechanism. For example, when the VPP receives a message from the client requesting SSL / TLS negotiation, the VPP can trigger an event notification to inform the first load balancing software that there is currently a message that requires SSL / TLS negotiation. For another example, when the SSL / TLS negotiation process is successful, the first load balancing software can inform the VPP of the first key through an event notification. For another example, after the VPP decrypts the received message based on the first key, it can interact with the first load balancing software through an event to determine the message modification method and the destination direction of forwarding. Based on the event mechanism, the plaintext does not need to be uploaded to the first load balancing software, reducing memory copy consumption.

[0073] Optionally, the SSL / TLS negotiation process and the SSL / TLS encryption / decryption process can be accelerated based on the first accelerator. As an example, the first accelerator can be an Intel Quick Assist Technology (QAT) accelerator, which can offload TLS encryption tasks to dedicated hardware, further improving the speed and efficiency of encryption processing.

[0074] Combine the following Figure 2 , an example is given to introduce the SSL / TLS offloading method based on VPP in an embodiment of the present application.

[0075] For example, Figure 2The first load balancing software in is Nginx. Nginx uses a multi-threaded model to handle client requests, and worker thread 1 is one of the threads. The worker thread can include symmetric encryption and decryption parts, TLS negotiation parts, SSL application programming interface (API) parts, and basic input / output abstraction (BIO) parts (OpenSSL's BIO). The stream module allows Nginx to run as a TCP / user datagram protocol (UDP) proxy server and can achieve four-layer and seven-layer load balancing. VPP can include forwarding plug-ins, TLS plug-ins-OpenSSL, shared virtual memory (SVM) first in first out (FIFO), worker threads, connection management, and LDP / VPP communication library (VCL). SVM FIFO is a mechanism for inter-process communication that allows data to be efficiently transmitted between VPP processes and applications. OpenSSL is a widely used open source library that implements SSL and TLS protocols, as well as related encryption algorithms and standards. OpenSSL provides developers with a rich set of command-line tools and programming interfaces for handling tasks such as encryption, key management, certificate generation and verification. OpenSSL context is a core concept in the OpenSSL library, which represents all the state and configuration information required for secure communication. This structure contains various parameters and settings required during the SSL / TLS handshake process, such as certificates, keys, encryption algorithms, protocol versions, etc.

[0076] like Figure 2 As shown in FIG. 1 , the SSL / TLS offloading process can be divided into a negotiation process and an encryption / decryption process.

[0077] Before the negotiation process, VPP can establish flow table entries based on TCP handshake messages, perform connection management, and uniformly control and process subsequent messages (not shown in the figure). In the negotiation process, after VPP receives the message from the client for requesting negotiation, it can trigger the event notification mechanism to inform Nginx that there is currently a message that needs to be negotiated. After Nginx receives the notification from VPP, it can flexibly select the certificate, encryption and decryption algorithm, protocol version, session multiplexing, etc. according to the notification content. On the other hand, VPP can transparently pass the message from the client for requesting negotiation to Nginx. The message can be transferred to the forwarding plug-in through the connection management in VPP and transferred to the TLS negotiation part of Nginx for processing. After Nginx completes the complete message interaction, it can notify the forwarding plug-in of VPP whether the negotiation is successful based on the set rules and the results of the negotiation. If the negotiation is successful, Nginx can send the key to the forwarding plug-in. If the negotiation fails, Nginx can notify VPP to block the process. Before the key is obtained, the TLS plug-in and forwarding plug-in inside VPP both pass the data through without modification. In addition, during the negotiation process, the message sent by Nginx to the client can be transparently transmitted to the client via VPP (shown in the figure), and the message sent by the client to Nginx can also be transparently transmitted to Nginx by VPP (not shown in the figure).

[0078] In the encryption and decryption process, after VPP receives the message from the client, it can decrypt the message according to the key obtained in the negotiation process, and then process the plaintext in the forwarding plug-in. The message can be sent to BIO via the connection management, then decrypted in the symmetric encryption and decryption part, and then processed after being sent to the forwarding plug-in via SVM FIFO. In addition, VPP can also process the plaintext to be sent to the client in the forwarding plug-in, encrypt it according to the key obtained in the negotiation process, and then send it to the client. The plaintext processed by the forwarding plug-in can be sent to the symmetric encryption and decryption part via SVM FIFO for encryption, and then go to the connection management and LDP / VCL through BIO, and finally sent to the client. The forwarding plug-in of VPP can flexibly control the modification and forwarding destination direction of the message by interacting with the forwarding controller Nginx for events (not shown in the figure). In addition, when receiving a message from the client, VPP can also notify the forwarding plug-in through the event mechanism.

[0079] In addition, the QAT accelerator can be used in both the negotiation and encryption and decryption processes to offload TLS encryption tasks to dedicated hardware, which can further improve the speed and efficiency of negotiation and encryption and decryption.

[0080] based on Figure 2The method shown uses Nginx as the control plane in the SSL / TLS offloading process, which can fully utilize the flexibility of the Nginx negotiation process and the ability to customize message processing rules, making it easy to manage and only requiring changes to the configuration file. And using VPP as the forwarding plane can adapt to the characteristics of Nginx occupying insufficient CPU resources and insufficient forwarding performance in the forwarding device, and fully utilize the forwarding capabilities of VPP. In addition, Nginx sends rules to interact with VPP through a high-performance message mechanism, and plain text is not sent to Nginx, which reduces memory copy consumption and can greatly improve the packet forwarding rate of the forwarding device.

[0081] The method provided in the embodiment of the present application is described in detail above. The device provided in the embodiment of the present application is described in detail below with reference to the accompanying drawings.

[0082] See also Figure 3 , is a schematic diagram of the structure of an electronic device provided in an embodiment of the present application. Figure 3 The electronic device 300 shown may include a negotiation module 310 and an encryption / decryption module 320 .

[0083] The negotiation module 310 can be used to perform an SSL / TLS negotiation process based on the first load balancing software to obtain a first key; the encryption / decryption module 320 can be used to perform an SSL / TLS encryption / decryption process based on the VPP and the first key.

[0084] Optionally, in the SSL / TLS negotiation process, the negotiation module 310 may be used to:

[0085] negotiating a first key with the first client based on the first negotiation message and the first negotiation condition, where the first negotiation message may be used by the first client to request negotiation of the first key, and the first negotiation condition may be used to specify a condition for negotiating the first key;

[0086] If the negotiation is successful, the first key is sent to the VPP;

[0087] If the negotiation fails, the SSL / TLS negotiation process is blocked.

[0088] Optionally, the first negotiation condition may include one or more of the following: certificate; encryption and decryption algorithm; protocol version; session reuse. Among them, the certificate may be used by the first client to authenticate the identity of the server, the encryption and decryption algorithm may be used to specify the algorithm in the SSL / TLS encryption and decryption process, the protocol version may be used to specify the version of the protocol used in the SSL / TLS negotiation process, and session reuse may be used to specify a mechanism for the first client to resume an established SSL session.

[0089] Optionally, in the SSL / TLS encryption and decryption process, the encryption and decryption module 320 can be used to:

[0090] Decrypting the first message based on the first key to obtain a first plaintext, where the first message is a message sent by the first client;

[0091] Alternatively, the second plaintext is encrypted based on the first key to obtain a second message, where the second message is a message sent to the first client.

[0092] Optionally, before encrypting the second plaintext based on the first key to obtain the second message, the encryption / decryption module 320 may also be used to:

[0093] Based on the instruction of the first load balancing software, a modification method and a forwarding direction of the second plaintext are determined.

[0094] Optionally, the first load balancing software may interact with the VPP based on an event mechanism.

[0095] Optionally, the SSL / TLS negotiation process and the SSL / TLS encryption / decryption process can be accelerated based on the first accelerator.

[0096] The present application also provides an electronic device. Figure 4 As shown, the electronic device 400 includes: at least one processor 401, a memory 402, and a computer program 403 stored in the memory 402 and executable on the at least one processor 401. When the processor 401 executes the computer program 403, the method provided in the present application is implemented.

[0097] Exemplarily, the computer program 403 may be divided into one or more modules / units, one or more modules / units are stored in the memory 402, and executed by the processor 401 to complete the present application. One or more modules / units may be a series of computer program instruction segments capable of completing specific functions, and the instruction segments are used to describe the execution process of the computer program in the electronic device 400.

[0098] Those skilled in the art will understand that Figure 4 It is only an example of the electronic device 400 and does not constitute a limitation of the electronic device. It may include more or fewer components than shown in the figure, or a combination of certain components, or different components. For example, the electronic device 400 may also include input and output devices, network access devices, buses, etc.

[0099] The processor 401 may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field-programmable gate arrays (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc.

[0100] The memory 402 may be an internal storage unit of the electronic device 400, such as a hard disk or memory of the electronic device 400. The memory 402 may also be an external storage device of the electronic device 400, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, etc. equipped on the electronic device 400. Further, the memory 402 may also include both an internal storage unit of the electronic device 400 and an external storage device. The memory 402 is used to store computer programs and other programs and data required by the electronic device 400. The memory 402 may also be used to temporarily store data that has been output or is to be output.

[0101] The electronic device 400 provided in this embodiment can execute the above method embodiment, and its implementation principle and technical effect are similar, which will not be repeated here.

[0102] An embodiment of the present application further provides a computer-readable storage medium, which stores a computer program. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments can be implemented.

[0103] An embodiment of the present application provides a computer program product. When the computer program product runs on an electronic device, the electronic device can implement the steps in the above-mentioned method embodiments when executing the computer program product.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the present application implements all or part of the processes in the above method embodiments, which can be completed by instructing the relevant hardware through a computer program. The computer program can be stored in a computer-readable storage medium. When the computer program is executed by the processor, the steps of the above method embodiments can be implemented. Among them, the computer program includes computer program code, which can be in source code form, object code form, executable file or some intermediate form. The computer-readable medium may at least include: any entity or device that can carry the computer program code to the camera / electronic device, recording medium, computer memory, ROM (read-only memory), RAM (random access memory), CD-ROM (compact disc read-only memory), magnetic tape, floppy disk and optical data storage device. The computer-readable storage medium mentioned in the present application can be a non-volatile storage medium, in other words, it can be a non-transient storage medium.

[0105] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0106] Those of ordinary skill in the art will appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0107] In the embodiments provided in the present application, it should be understood that the disclosed devices / equipment and methods can be implemented in other ways. For example, the device / equipment embodiments described above are only schematic, for example, the division of modules or units is only a logical function division, and there may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0108] It should be understood that when used in the present specification and the appended claims, the term "comprising" indicates the presence of described features, wholes, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, wholes, steps, operations, elements, components and / or combinations thereof.

[0109] It should also be understood that the term “and / or” used in the specification and appended claims refers to any and all possible combinations of one or more of the associated listed items, and includes these combinations.

[0110] As used in the specification and appended claims of this application, the term "if" can be interpreted as "when" or "uponce" or "in response to determining" or "in response to detecting", depending on the context. Similarly, the phrase "if it is determined" or "if [described condition or event] is detected" can be interpreted as meaning "uponce it is determined" or "in response to determining" or "uponce [described condition or event] is detected" or "in response to detecting [described condition or event]", depending on the context.

[0111] In addition, in the description of the present application specification and the appended claims, the terms "first", "second", etc. are only used to distinguish the descriptions and cannot be understood as indicating or implying relative importance.

[0112] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or replace some or all of the technical features therein with equivalents. However, these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

Claims

1. A VPP-based SSL / TLS unloading method, characterized in that: include: Performing an SSL / TLS negotiation process based on the first load balancing software to obtain a first key; The SSL / TLS encryption and decryption process is performed based on the VPP and the first key.

2. The method according to claim 1, characterized in that The SSL / TLS negotiation process includes: The first load balancing software negotiates the first key with the first client based on a first negotiation message and a first negotiation condition, wherein the first negotiation message is used by the first client to request negotiation of the first key, and the first negotiation condition is used to specify a condition for negotiating the first key; If the negotiation is successful, the first load balancing software sends the first key to the VPP; If the negotiation fails, the first load balancing software blocks the SSL / TLS negotiation process.

3. The method according to claim 2, characterized in that The first negotiation condition includes one or more of the following: A certificate used by the first client to authenticate the identity of the server; Encryption and decryption algorithms, used to specify the algorithms used in the SSL / TLS encryption and decryption process; The protocol version is used to specify the version of the protocol used in the SSL / TLS negotiation process; Session multiplexing is used to specify a mechanism for the first client to resume an established SSL session.

4. The method according to claim 3, characterized in that: The SSL / TLS encryption and decryption process includes: The VPP decrypts the first message based on the first key to obtain a first plaintext, where the first message is a message sent by the first client; Alternatively, the VPP encrypts the second plaintext based on the first key to obtain a second message, where the second message is a message sent to the first client.

5. The method according to claim 4, characterized in that Before the VPP encrypts the second plaintext based on the first key to obtain the second message, the method further includes: The VPP determines a modification method and a forwarding direction of the second plaintext based on an instruction of the first load balancing software.

6. The method according to claim 5, characterized in that The first load balancing software interacts with the VPP based on an event mechanism.

7. The method according to claim 6, characterized in that The SSL / TLS negotiation process and the SSL / TLS encryption / decryption process are accelerated based on the first accelerator.

8. An electronic device, characterized in that: include: A negotiation module, configured to perform an SSL / TLS negotiation process based on the first load balancing software to obtain a first key; The encryption and decryption module is used to perform the SSL / TLS encryption and decryption process based on the VPP and the first key.

9. An electronic device comprising a memory, at least one processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium storing a computer program, characterized in that: When the computer program is executed by a processor, the method according to any one of claims 1 to 7 is implemented.

Images