Secure tunnel transmission method and device, equipment, storage medium and program product

Abstract

The invention relates to a secure tunnel transmission method and device, equipment, a storage medium and a program product. The method comprises the following steps: receiving a security tunnel configuration strategy distributed by a control center and a corresponding table of application IDs and application IP addresses; establishing a security tunnel with the security gateway of the opposite end according to the security tunnel configuration strategy; distributing the security parameters negotiated by the security tunnel to each application program of the home terminal; receiving a first encrypted traffic initiated by an application program from a home terminal and an application ID of an opposite terminal; and according to the corresponding table of the application ID and the application IP address, after the application ID of the opposite terminal and the destination information of the security gateway of the opposite terminal are packaged in a protocol header, the first encrypted traffic is sent to the security gateway of the opposite terminal through the security tunnel. Therefore, encryption and decryption operations can be shunted to a back-end application program, so that the gateway node only needs to pay attention to identification and forwarding of tunnel traffic, the performance pressure of the gateway node is remarkably reduced, and repeated encryption and decryption operations of internal traffic are reduced.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a secure tunnel transmission method, apparatus, computer equipment, computer-readable storage medium, and computer program product. Background Art

[0002] Secure tunnel technology is widely used in various communication fields to encrypt and protect the integrity of traffic at the OSI / ISO (Open System Interconnection model for computer networks) data link layer or network layer. In the field of communications, based on the requirements of 3GPP (Third Generation Partnership Project), encrypted transmission should be implemented in the mid-haul interface (F1-c / F1-u), backhaul interface (NG-c / NG-u / Xn-c / Xn-u / X2-c / X2-u), and fronthaul interface based on eCPRI (enhanced Common Public Radio Interface) technology. In satellite Internet, encrypted transmission technology is also applied to satellite-to-ground transmission scenarios.

[0003] In traditional technologies, no matter which secure tunnel protocol is used, it is usually necessary to terminate the secure tunnel and decrypt the traffic on the application system or the front-end gateway node.

[0004] However, if each application is allowed to establish its own secure tunnel, the number of tunnels will increase exponentially with the increase in the number of applications; and if a front-end gateway node is used to decrypt and forward traffic, the performance pressure on the gateway node will increase. Summary of the invention

[0005] Based on this, it is necessary to provide a secure tunnel transmission method, device, computer equipment, computer-readable storage medium and computer program product that can reduce repeated encryption and decryption of internal traffic and reduce the performance pressure of gateway nodes in response to the above-mentioned technical problems.

[0006] In a first aspect, the present application provides a secure tunnel transmission method, which is applied to a security gateway of a local end, wherein the security gateway of the local end is communicatively connected with each application program of the local end, and the method comprises:

[0007] Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center; the ID is the identity identifier and the IP is the Internet protocol;

[0008] Establishing a secure tunnel with the peer security gateway according to the secure tunnel configuration policy;

[0009] Distribute the security parameters negotiated by the secure tunnel to various applications on the local end;

[0010] Receive first encrypted traffic initiated by an application on the local end and an application ID on the other end; the first encrypted traffic is traffic obtained by encrypting the first initial traffic by the application on the local end according to security parameters;

[0011] According to the correspondence table between the application ID and the application IP address, the application ID of the other end and the destination information of the security gateway of the other end are encapsulated in the protocol header, and the first encrypted traffic is sent to the security gateway of the other end through a secure tunnel, so that when the security gateway of the other end receives the first encrypted traffic, it forwards the first encrypted traffic to the application of the other end according to the parsed protocol header information.

[0012] In one of the embodiments, the correspondence table between the application ID and the application IP address is established by the registration center according to the pre-registration applications initiated by each application program of the local end and each application program of the opposite end, and the registration center synchronizes the established correspondence table between the application ID and the application IP address to the control center;

[0013] The application ID of the other end is obtained by the application program of the local end inquiring the registration center.

[0014] In one embodiment, the destination information of the peer security gateway includes at least one of the following:

[0015] A MAC address selected according to the protocol; the MAC is a media access control address;

[0016] IP address;

[0017] Network port information.

[0018] In one embodiment, after sending the first encrypted traffic to the security gateway of the other end through the secure tunnel, the method further includes:

[0019] Receiving second encrypted traffic sent by a security gateway at the opposite end through a security tunnel;

[0020] Decrypting the protocol header information of the second encrypted traffic transmission protocol to obtain the application ID of the local end;

[0021] Determine the application IP address of the local end according to the correspondence table between the application ID and the application IP address and the application ID of the local end;

[0022] The second encrypted traffic is forwarded to the application program indicated by the application IP address of the local end.

[0023] In one embodiment, when the application ID corresponding to at least one application in the application of the local end and / or the application of the opposite end changes, the method further includes:

[0024] Receive the updated secure tunnel configuration policy and the updated correspondence table between application IDs and application IP addresses distributed by the control center.

[0025] In a second aspect, the present application further provides a secure tunnel transmission method, which is applied to a security gateway of a peer end, wherein the security gateway of the peer end is connected to each application program of the peer end in communication, and the method comprises:

[0026] Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center; the ID is the identity identifier and the IP is the Internet protocol;

[0027] Establishing a secure tunnel with the local security gateway according to the secure tunnel configuration policy;

[0028] Distribute the security parameters negotiated by the secure tunnel to each application program at the other end;

[0029] When receiving the first encrypted traffic sent by the local security gateway through the secure tunnel, the first encrypted traffic is forwarded to the application program at the other end according to the protocol header information obtained by parsing.

[0030] In one of the embodiments, the correspondence table between the application ID and the application IP address is established by a registration center based on pre-registration applications initiated by various applications on the local end and various applications on the opposite end, and the registration center synchronizes the established correspondence table between the application ID and the application IP address to the control center.

[0031] In one embodiment, when receiving first encrypted traffic sent by a security gateway of the local end through a secure tunnel, forwarding the first encrypted traffic to an application of the opposite end according to the protocol header information obtained by parsing includes:

[0032] Receiving first encrypted traffic sent by the local security gateway through the security tunnel;

[0033] Decrypting the protocol header information of the first encrypted traffic transmission protocol to obtain the application ID of the other end;

[0034] Determine the application IP address of the other end according to the correspondence table between the application ID and the application IP address and the application ID of the other end;

[0035] The first encrypted traffic is forwarded to the application program indicated by the application IP address of the other end.

[0036] In one embodiment, after forwarding the first encrypted traffic to the application program at the other end according to the parsed protocol header information, the method further includes:

[0037] Receive the second encrypted traffic initiated by the application of the other end and the application ID of the local end; the second encrypted traffic is the traffic obtained by the application of the other end encrypting the second initial traffic according to the security parameters; the application ID of the local end is obtained by the application of the other end querying the registration center, or parsed from the first encrypted traffic;

[0038] According to the correspondence table between the application ID and the application IP address, the application ID of the local end and the destination information of the security gateway of the local end are encapsulated in the protocol header, and the second encrypted traffic is sent to the security gateway of the local end through the secure tunnel; wherein the destination information of the security gateway of the local end includes at least one of the following:

[0039] A MAC address selected according to the protocol; the MAC is a media access control address;

[0040] IP address;

[0041] Network port information.

[0042] In one embodiment, when the application ID corresponding to at least one application in the application of the local end and / or the application of the opposite end changes, the method further includes:

[0043] Receive the updated secure tunnel configuration policy and the updated correspondence table between application IDs and application IP addresses distributed by the control center.

[0044] In a third aspect, the present application further provides a secure tunnel transmission device, which is applied to a security gateway of a local end, wherein the security gateway of the local end is communicatively connected with each application program of the local end, and the device comprises:

[0045] A first receiving module is used to receive a secure tunnel configuration policy distributed by a control center, and a correspondence table between an application ID and an application IP address; the ID is an identity identifier, and the IP is an Internet protocol;

[0046] A first secure tunnel establishment module, configured to establish a secure tunnel with a security gateway of a peer end according to the secure tunnel configuration policy;

[0047] A first sending module, used to distribute the security parameters negotiated by the secure tunnel to various applications on the local end;

[0048] The first receiving module is further used to receive the first encrypted traffic initiated by the application at the local end and the application ID of the other end; the first encrypted traffic is the traffic obtained after the application at the local end encrypts the first initial traffic according to the security parameters;

[0049] The first sending module is also used to encapsulate the application ID of the other party and the destination information of the security gateway of the other party in a protocol header according to the correspondence table of the application ID and the application IP address, and then send the first encrypted traffic to the security gateway of the other party through a secure tunnel, so that when the security gateway of the other party receives the first encrypted traffic, it forwards the first encrypted traffic to the application of the other party according to the parsed protocol header information.

[0050] In a fourth aspect, the present application further provides a secure tunnel transmission device, which is applied to a security gateway of a peer end, wherein the security gateway of the peer end is communicatively connected with each application program of the peer end, and the device comprises:

[0051] The second receiving module is used to receive the security tunnel configuration policy distributed by the control center, and the correspondence table between the application ID and the application IP address; the ID is the identity identifier, and the IP is the Internet protocol;

[0052] A second secure tunnel establishment module, configured to establish a secure tunnel with a local security gateway according to the secure tunnel configuration policy;

[0053] A second sending module, used to distribute the security parameters negotiated by the secure tunnel to each application program of the opposite end;

[0054] The second sending module is also used to forward the first encrypted traffic to the application program at the other end according to the protocol header information obtained by parsing when receiving the first encrypted traffic sent by the security gateway of the local end through the security tunnel.

[0055] In a fifth aspect, the present application further provides a secure tunnel transmission system, comprising: a security gateway of a local end, a security gateway of a remote end, a registration center, and a control center, wherein the security gateway of the local end is connected to each application of the local end, and the security gateway of the remote end is connected to each application of the remote end, wherein:

[0056] The registration center is used to receive pre-registration applications initiated by various applications of the local end and various applications of the opposite end, and after establishing a correspondence table between application IDs and application IP addresses according to the pre-registration applications, synchronize the correspondence table between application IDs and application IP addresses to the control center;

[0057] The control center is used to distribute the security tunnel configuration policy and the corresponding table of application ID and application IP address to the security gateway of the local end and the security gateway of the opposite end; the ID is the identity identifier and the IP is the Internet protocol;

[0058] Each application program of the local end is used to initiate the first encrypted traffic and the application ID of the opposite end to the security gateway of the local end, and receive the second encrypted traffic forwarded by the security gateway of the local end;

[0059] The local security gateway is used to perform the method steps described in any one of the first aspects;

[0060] Each program of the opposite end is used to receive the first encrypted traffic forwarded by the security gateway of the opposite end, and to initiate the second encrypted traffic and the application ID of the local end to the security gateway of the opposite end;

[0061] The security gateway of the other end is used to execute the method steps described in any one of the second solutions.

[0062] In a sixth aspect, the present application further provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and when the processor executes the computer program, the method in the first aspect or any one of the embodiments of the second aspect is implemented.

[0063] In a seventh aspect, the present application further provides a computer-readable storage medium having a computer program stored thereon, wherein when the computer program is executed by a processor, the method in the first aspect or any one of the embodiments described in the second aspect is implemented.

[0064] In an eighth aspect, the present application further provides a computer program product, comprising a computer program, which, when executed by a processor, implements the method in the first aspect or any one of the embodiments described in the second aspect.

[0065] The above-mentioned secure tunnel transmission method, apparatus, computer equipment, computer-readable storage medium and computer program product, by receiving the secure tunnel configuration policy distributed by the control center, and the correspondence table between the application ID and the application IP address; thus, a secure tunnel can be established between two secure gateways based on the secure tunnel configuration policy distributed by the control center, and the target application to be forwarded can be determined according to the correspondence table between the application ID and the application IP address. According to the secure tunnel configuration policy, a secure tunnel is established with the security gateway of the other end; the security parameters negotiated by the secure tunnel are distributed to each application of this end; thereby facilitating the application to encrypt and decrypt traffic based on the security parameters of the secure tunnel, without the need for encryption and decryption by the security gateway, thereby reducing the performance pressure of the gateway node. The first encrypted traffic initiated by the application of this end and the application ID of the other end are received; the first encrypted traffic is the traffic obtained after the application of this end encrypts the first initial traffic according to the security parameters; thereby, the traffic can be encrypted by the application, and the security gateway does not need to repeatedly encrypt the traffic. According to the correspondence table between the application ID and the application IP address, the application ID of the other end and the destination information of the security gateway of the other end are encapsulated in the protocol header, and the first encrypted traffic is sent to the security gateway of the other end through the secure tunnel, so that when the security gateway of the other end receives the first encrypted traffic, it forwards the first encrypted traffic to the application of the other end according to the protocol header information obtained by parsing. In this way, the encryption and decryption operations can be diverted to the back-end application server (or application), so that the gateway node only needs to pay attention to the identification and forwarding of the tunnel traffic, significantly reducing the performance pressure of the gateway node and reducing the repeated encryption and decryption operations of the internal traffic. In addition, it also avoids the capacity problems and the complexity of policy management and configuration caused by the application directly serving as the endpoint of the security tunnel for external communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0066] In order to more clearly illustrate the technical solutions in the embodiments of the present application or related technologies, the drawings required for use in the embodiments of the present application or related technical descriptions will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0067] FIG1 is a diagram of an application environment of a secure tunnel transmission method according to an embodiment;

[0068] FIG2 is a schematic diagram of a flow chart of a secure tunnel transmission method in a first embodiment;

[0069] FIG3 is a schematic diagram of a flow chart of a secure tunnel transmission method in a second embodiment;

[0070] FIG4 is a schematic diagram of a flow chart of a secure tunnel transmission method in a third embodiment;

[0071] FIG5 is a schematic diagram of a flow chart of a secure tunnel transmission method in a fourth embodiment;

[0072] Figure 6 is a schematic diagram of a flow chart of a secure tunnel transmission method in a fifth embodiment;

[0073] FIG7 is a schematic diagram of a flow chart of a secure tunnel transmission method in a sixth embodiment;

[0074] FIG8 is a schematic diagram of a flow chart of a secure tunnel transmission method in a seventh embodiment;

[0075] FIG9 is a structural block diagram of a secure tunnel transmission device in one embodiment;

[0076] FIG10 is a structural block diagram of a secure tunnel transmission device in another embodiment;

[0077] FIG. 11 is a diagram showing the internal structure of a computer device in one embodiment. DETAILED DESCRIPTION

[0078] In order to make the purpose, technical solution and advantages of the present application more clearly understood, the present application is further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the present application and are not used to limit the present application.

[0079] The secure tunnel transmission method provided in the embodiment of the present application can be applied to the application environment as shown in Figure 1. It includes: a registration center, a control center, a security gateway and an application. The registration center is used to receive the application registration information and generate an application ID (exemplarily, the generated application ID can have a certain validity period and keep it updated); the control center is used to distribute the configuration policy and application ID of the secure tunnel to the secure gateway; the secure gateway is used to negotiate and establish a secure tunnel, and distribute the negotiated security parameters (such as keys, algorithms and other information) to each back-end application. It should be noted that although the security gateway is responsible for the negotiation and establishment of the tunnel, it only forwards encrypted traffic and does not decrypt the traffic; the application is the starting point and end point of the real business traffic at the back end of the gateway node. Exemplarily, the application decrypts the traffic through the security parameters obtained by the distribution of the security gateway.

[0080] For example, the Sidecar mode (a mode that divides the functions of an application into separate processes, allowing more functions to be added next to the application without the need for additional third-party component configuration or modification of the application code) can be used to encapsulate the common encryption and decryption operations and application registration functions. One or more applications can use one or more Sidecars in combination.

[0081] In the first exemplary embodiment, as shown in FIG2 , a secure tunnel transmission method is provided, and the method is applied to the security gateway in FIG1 as an example for explanation. In order to distinguish, the security gateway of the sending end is recorded as the security gateway of the local end, and the security gateway of the receiving end is recorded as the security gateway of the opposite end. The receiving end and the sending end can be switched (that is, the receiving end can also be used as the sending end, and the corresponding sending end can also be used as the receiving end). The method in this embodiment is applied to the security gateway of the local end, and can include the following steps 201 to 205. Among them:

[0082] Step 201: Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center.

[0083] Among them, the ID is an identity identifier, and the IP is an Internet protocol.

[0084] In this embodiment, the control center can be a computer or a server, which is used to synchronize the corresponding table of the application ID and the application IP address of the registration center and send the security tunnel configuration policy to the security gateway. The security tunnel configuration policy includes: information transmission encryption policy, protocol encapsulation policy, etc.

[0085] Exemplarily, the correspondence table between the application ID and the application IP address is established by the registration center based on the pre-registration applications initiated by each application on the local end and each application on the opposite end, and the registration center synchronizes the established correspondence table between the application ID and the application IP address to the control center.

[0086] Step 202: Establish a secure tunnel with the peer security gateway according to the secure tunnel configuration policy.

[0087] In this embodiment, a secure tunnel is established between the security gateway at the local end and the security gateway at the opposite end, for transmitting encrypted traffic between the application at the local end and the application at the opposite end.

[0088] Step 203: distribute the security parameters negotiated through the secure tunnel to various applications on the local end.

[0089] In this embodiment, after the secure tunnel is established, security parameters (eg, information such as keys and encryption algorithms) may be negotiated through the security gateway, and traffic may be encrypted and decrypted using the security parameters.

[0090] Step 204, receiving the first encrypted traffic initiated by the application program at the local end and the application ID of the peer end.

[0091] In this embodiment, the first encrypted traffic is traffic obtained by encrypting the first initial traffic according to security parameters by the application of the local end. The application ID of the opposite end is obtained by the application of the local end inquiring the registration center.

[0092] Exemplarily, the application program at the local end may initiate an application ID query request of the application program at the other end to the registration center at any time, thereby obtaining the application ID of the other end.

[0093] Step 205 , according to the correspondence table between application ID and application IP address, after encapsulating the application ID of the other end and the destination information of the security gateway of the other end in the protocol header, the first encrypted traffic is sent to the security gateway of the other end through the secure tunnel.

[0094] In this embodiment, tunnel technology will protect the real destination IP address of the application. For example, in IPsec tunnel mode, the IP address of the application is encapsulated and encrypted by the ESP (Encapsulated Security Payload) protocol. The IP address of the security gateway is added to the outside of the ESP payload to protect the application IP from being exposed. The security gateway can only know the IP address of the backend application after decrypting the ESP data message. Similarly, MACsec (Media Access Control Security) encrypts at the data link layer, and the data within the MAC header is encrypted. WireGuard identifies the tunnel node through the network interface information (such as eth, WLAN), and the target IP address can be known after decryption.

[0095] For example, when using IPSec tunnel mode, IPSec encrypts the IP header and payload, while transport mode only encrypts the IP payload. Tunnel mode provides protection for the entire IP packet by treating it as an AH or ESP payload. When using tunnel mode, the entire IP packet is encapsulated by the AH or ESP header and other IP headers. The IP address of the outer IP header is the tunnel endpoint, and the IP address of the encapsulated IP header is the final source and destination address.

[0096] Exemplarily, the destination information of the security gateway of the opposite end includes at least one of the following:

[0097] A MAC address selected according to the protocol; the MAC address is a media access control address;

[0098] IP address;

[0099] Network port information.

[0100] In this embodiment, when the application of the local end needs to communicate with the application of the opposite end, the first initial traffic and the application ID of the opposite end are first initiated to the security gateway of the local end to the security gateway of the local end. The security gateway of the local end encapsulates the application ID and the destination information of the security gateway of the opposite end (selecting the MAC address, IP address, or network port information according to the protocol) in the protocol header according to the corresponding table of the application ID and the application IP address, and finally sends the encrypted traffic to the security gateway of the opposite end. Therefore, when the security gateway of the opposite end receives the first encrypted traffic, it forwards the first encrypted traffic to the application of the opposite end according to the protocol header information obtained by parsing.

[0101] In the above-mentioned secure tunnel transmission method, by receiving the secure tunnel configuration policy distributed by the control center and the correspondence table of application ID and application IP address; thus, a secure tunnel can be established between two secure gateways based on the secure tunnel configuration policy distributed by the control center, and the target application to be forwarded can be determined according to the correspondence table of application ID and application IP address. According to the secure tunnel configuration policy, a secure tunnel is established with the security gateway of the other end; the security parameters negotiated by the secure tunnel are distributed to each application on this end; thereby facilitating the application to encrypt and decrypt traffic based on the security parameters of the secure tunnel, without the need for encryption and decryption by the security gateway, thereby reducing the performance pressure of the gateway node. The first encrypted traffic initiated by the application on this end and the application ID of the other end are received; the first encrypted traffic is the traffic obtained after the application on this end encrypts the first initial traffic according to the security parameters; thereby, the traffic can be encrypted by the application, and the security gateway does not need to repeatedly encrypt the traffic. According to the correspondence table between the application ID and the application IP address, the application ID of the other end and the destination information of the security gateway of the other end are encapsulated in the protocol header, and the first encrypted traffic is sent to the security gateway of the other end through the secure tunnel, so that when the security gateway of the other end receives the first encrypted traffic, it forwards the first encrypted traffic to the application of the other end according to the protocol header information obtained by parsing. In this way, the encryption and decryption operations can be diverted to the back-end application server (or application), so that the gateway node only needs to pay attention to the identification and forwarding of the tunnel traffic, significantly reducing the performance pressure of the gateway node and reducing the repeated encryption and decryption operations of the internal traffic. In addition, it also avoids the capacity problems and the complexity of policy management and configuration caused by the application directly serving as the endpoint of the security tunnel for external communication.

[0102] In a second exemplary embodiment, as shown in FIG3 , a secure tunnel transmission method is provided, and the method is applied to the security gateway in FIG1 as an example for explanation. In order to distinguish, the security gateway of the sending end is recorded as the security gateway of the local end, and the security gateway of the receiving end is recorded as the security gateway of the opposite end. The receiving end and the sending end can be switched (that is, the receiving end can also be used as the sending end, and the corresponding sending end can also be used as the receiving end). The method in this embodiment is applied to the security gateway of the local end, and can include the following steps 301 to 309. Among them:

[0103] Step 301: Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center.

[0104] Step 302: Establish a secure tunnel with the peer security gateway according to the secure tunnel configuration policy.

[0105] Step 303: distribute the security parameters negotiated through the secure tunnel to various applications on the local end.

[0106] Step 304: Receive the first encrypted traffic initiated by the application program at the local end and the application ID of the peer end.

[0107] Step 305 , according to the correspondence table between application ID and application IP address, after encapsulating the application ID of the other end and the destination information of the security gateway of the other end in the protocol header, the first encrypted traffic is sent to the security gateway of the other end through the secure tunnel.

[0108] For the specific implementation methods and technical effects of steps 301 to 305 in this embodiment, please refer to the relevant descriptions of steps 201 to 205 in the method embodiment shown in Figure 2, which will not be repeated here.

[0109] Step 306: Receive the second encrypted traffic sent by the opposite end's security gateway through the security tunnel.

[0110] In an optional implementation, after receiving the first encrypted traffic, the application at the other end decrypts the first encrypted traffic, generates a reply message, and encrypts the reply message to obtain the second encrypted traffic. The application at the other end queries the registration center to obtain the application ID of the local end, or can directly obtain the application ID of the local end when decrypting the first encrypted traffic. The application at the other end sends the second encrypted traffic and the application ID of the local end to the security gateway of the other end, and the other end sends the second encrypted traffic to the security gateway of the local end.

[0111] In another optional implementation, the application of the other end can also actively initiate traffic to the application of the local end. In this case, the application of the other end queries the registration center to obtain the application ID of the local end, and then sends the second encrypted traffic and the application ID of the local end to the security gateway of the other end, and the other end sends the second encrypted traffic to the security gateway of the local end.

[0112] Step 307: decrypt the protocol header information of the second encrypted traffic transmission protocol to obtain the application ID of the local end.

[0113] In this embodiment, the local security gateway only decrypts the protocol header information of the second encrypted traffic transmission protocol, but does not decrypt the second traffic. That is, when encrypting traffic, the traffic is not decrypted, only the protocol header information is parsed, and the ciphertext traffic is processed by the back-end application, thereby greatly reducing the node performance pressure of the local security gateway.

[0114] Step 308, determining the application IP address of the local end according to the correspondence table between the application ID and the application IP address and the application ID of the local end.

[0115] In this embodiment, after decrypting the protocol header information of the second encrypted traffic transmission protocol, the application ID of this end (used to indicate the target application being sent) can be obtained, and the IP address corresponding to the target application can be found according to the correspondence table between the application ID and the application IP address.

[0116] Step 309: forward the second encrypted traffic to the application program indicated by the application IP address of the local end.

[0117] In this embodiment, after the second encrypted traffic is forwarded to the application indicated by the application IP address of the local end, the application decrypts the second encrypted traffic according to a pre-known encryption algorithm or key.

[0118] In this embodiment, the traditional security tunnel technology features are changed (i.e., the starting point and the end point of the protocol not only maintain the connectivity of the protocol, but also perform encryption and decryption operations on the data payload). The handshake negotiation of the protocol and the maintenance of the security association are decoupled from the specific encryption and decryption operations, and the computing power of the back-end application is used for encryption and decryption processing, thereby improving the overall utilization of computing resources. The problem of business traffic forwarding is solved by pre-registration, identification synchronization, and adding a specific identification field to the protocol.

[0119] In a third exemplary embodiment, as shown in FIG4 , a secure tunnel transmission method is provided, and the method is applied to the security gateway in FIG1 as an example for explanation. In order to distinguish, the security gateway of the sending end is recorded as the security gateway of the local end, and the security gateway of the receiving end is recorded as the security gateway of the opposite end. The receiving end and the sending end can be switched (that is, the receiving end can also be used as the sending end, and the corresponding sending end can also be used as the receiving end). The method in this embodiment is applied to the security gateway of the local end, and can include the following steps 401 to 406. Among them:

[0120] Step 401: Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center.

[0121] Step 402: Establish a secure tunnel with the peer security gateway according to the secure tunnel configuration policy.

[0122] Step 403: distribute the security parameters negotiated through the secure tunnel to various applications on the local end.

[0123] Step 404, receiving the first encrypted traffic initiated by the application program at the local end and the application ID of the peer end.

[0124] Step 405 , according to the correspondence table between application ID and application IP address, after encapsulating the application ID of the other end and the destination information of the security gateway of the other end in the protocol header, the first encrypted traffic is sent to the security gateway of the other end through the secure tunnel.

[0125] For the specific implementation methods and technical effects of steps 301 to 305 in this embodiment, please refer to the relevant descriptions of steps 201 to 205 in the method embodiment shown in Figure 2, which will not be repeated here.

[0126] Step 406: Receive the updated secure tunnel configuration policy and the updated correspondence table between application IDs and application IP addresses distributed by the control center.

[0127] In this embodiment, when the application ID corresponding to at least one application in the local application and / or the opposite application changes, the registration center will receive a new registration request from the application. The registration center updates the corresponding table of application ID and application IP address according to the newly sent registration request, obtains the updated corresponding table of application ID and application IP address, and synchronizes the updated corresponding table of application ID and application IP address to the control center. Finally, the control center distributes the updated corresponding table of application ID and application IP address to the local security gateway and the opposite security gateway.

[0128] Exemplarily, when the application ID corresponding to at least one application in the application on this end and / or the application on the other end changes, if the security tunnel configuration policy needs to be updated, the updated security tunnel configuration policy is distributed by the receiving control center to the security gateway on this end and the security gateway on the other end.

[0129] For example, the application ID is calculated by the registration center based on various information provided by the application (it can be a one-way function such as a hash operation). The application ID can also have a certain validity period. When the application ID expires (or is about to expire), the application needs to re-register with the registration center.

[0130] In this embodiment, each application can obtain the corresponding information of the application ID and IP address of the other party from the registration center in advance, and can continuously monitor changes in application topology, updates of application ID, etc., to ensure that the application ID of the other party can be transmitted in plain text when the traffic is encrypted and sent to the security gateway.

[0131] In a fourth exemplary embodiment, as shown in FIG5 , a secure tunnel transmission method is provided, and the method is applied to the security gateway in FIG1 as an example for explanation. For the purpose of distinction, the security gateway of the sending end is recorded as the security gateway of the local end, and the security gateway of the receiving end is recorded as the security gateway of the opposite end. The receiving end and the sending end can be switched (that is, the receiving end can also be used as the sending end, and the corresponding sending end can also be used as the receiving end). The method in this embodiment is applied to the security gateway of the opposite end, and can include the following steps 501 to 504. Among them:

[0132] Step 501: Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center.

[0133] Among them, the ID is an identity identifier, and the IP is an Internet protocol.

[0134] In this embodiment, the control center can be a computer or a server, which is used to synchronize the corresponding table of the application ID and the application IP address of the registration center and send the security tunnel configuration policy to the security gateway. The security tunnel configuration policy includes: information transmission encryption policy, protocol encapsulation policy, etc.

[0135] Exemplarily, the correspondence table between the application ID and the application IP address is established by the registration center based on the pre-registration applications initiated by each application on the local end and each application on the opposite end, and the registration center synchronizes the established correspondence table between the application ID and the application IP address to the control center.

[0136] Step 502: Establish a secure tunnel with the local security gateway according to the secure tunnel configuration policy.

[0137] In this embodiment, a secure tunnel is established between the security gateway of the opposite end and the security gateway of the primary end, for transmitting encrypted traffic between the application of the local end and the application of the opposite end.

[0138] Step 503: distribute the security parameters negotiated through the secure tunnel to each application program at the other end.

[0139] In this embodiment, after the secure tunnel is established, security parameters (eg, information such as keys and encryption algorithms) may be negotiated through the security gateway, and traffic may be encrypted and decrypted using the security parameters.

[0140] Step 504: when receiving the first encrypted traffic sent by the local security gateway through the secure tunnel, forward the first encrypted traffic to the application program at the other end according to the protocol header information obtained by parsing.

[0141] In this embodiment, the first encrypted traffic sent by the security gateway of the local end through the secure tunnel can be received; the protocol header information of the first encrypted traffic transmission protocol can be decrypted to obtain the application ID of the other end; the application IP address of the other end can be determined based on the correspondence table between the application ID and the application IP address and the application ID of the other end; and the first encrypted traffic can be forwarded to the application indicated by the application IP address of the other end.

[0142] In this embodiment, encryption and decryption operations can be offloaded to various back-end applications, reducing the performance pressure of the security gateway, so that fewer security gateways with lower specifications and costs can be deployed; by separating traffic forwarding and encryption and decryption operations, the traffic can be directly forwarded to the back-end application in an encrypted form on the security gateway, thereby avoiding the security requirement of protecting internal traffic transmission through secondary encryption and decryption.

[0143] In a fifth exemplary embodiment, as Figure 6 As shown, a secure tunnel transmission method is provided, and the method is applied to the security gateway in FIG. 1 as an example for explanation. In order to distinguish, the security gateway of the sending end is recorded as the security gateway of the local end, and the security gateway of the receiving end is recorded as the security gateway of the opposite end. The receiving end and the sending end can be switched (that is, the receiving end can also be used as the sending end, and the corresponding sending end can also be used as the receiving end). The method in this embodiment is applied to the security gateway of the opposite end, and can include the following steps 601 to 606. Among them:

[0144] Step 601: Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center.

[0145] Step 602: Establish a secure tunnel with the local security gateway according to the secure tunnel configuration policy.

[0146] Step 603: distribute the security parameters negotiated through the secure tunnel to each application program at the other end.

[0147] Step 604: when receiving the first encrypted traffic sent by the local security gateway through the secure tunnel, forward the first encrypted traffic to the application program at the other end according to the protocol header information obtained by parsing.

[0148] For the specific implementation methods and technical effects of steps 601 to 604 in this embodiment, please refer to the relevant descriptions of steps 501 to 504 in the method embodiment shown in Figure 5, which will not be repeated here.

[0149] Step 605: Receive the second encrypted traffic initiated by the application program of the other end and the application ID of the local end.

[0150] In this embodiment, the second encrypted traffic is the traffic obtained by encrypting the second initial traffic by the application on the other end according to security parameters; the application ID of the local end is obtained by the application on the other end querying the registration center, or parsed from the first encrypted traffic.

[0151] Step 606, according to the correspondence table between application ID and application IP address, after encapsulating the local application ID and the destination information of the local security gateway in the protocol header, the second encrypted traffic is sent to the local security gateway through the secure tunnel.

[0152] In this embodiment, the destination information of the local security gateway includes at least one of the following:

[0153] A MAC address selected according to the protocol; the MAC is a media access control address;

[0154] IP address;

[0155] Network port information.

[0156] This embodiment changes the characteristics of traditional secure tunnel technology (i.e., the starting point and the end point of the protocol not only maintain the connectivity of the protocol, but also perform encryption and decryption operations on the data payload). It decouples the handshake negotiation of the protocol and the maintenance of security associations from the specific encryption and decryption operations, and uses the computing power of the back-end application to perform encryption and decryption processing, thereby improving the overall utilization of computing resources. The problem of business traffic forwarding is solved by pre-registration, identification synchronization, and adding specific identification fields to the protocol.

[0157] In a sixth exemplary embodiment, as shown in FIG7 , a secure tunnel transmission method is provided, and the method is applied to the security gateway in FIG1 as an example for explanation. For the purpose of distinction, the security gateway of the sending end is recorded as the security gateway of the local end, and the security gateway of the receiving end is recorded as the security gateway of the opposite end. The receiving end and the sending end can be switched (that is, the receiving end can also be used as the sending end, and the corresponding sending end can also be used as the receiving end). The method in this embodiment is applied to the security gateway of the opposite end, and can include the following steps 701 to 705. Among them:

[0158] Step 701: Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center.

[0159] Step 702: Establish a secure tunnel with the local security gateway according to the secure tunnel configuration policy.

[0160] Step 703: distribute the security parameters negotiated through the secure tunnel to each application program at the other end.

[0161] Step 704: when receiving the first encrypted traffic sent by the local security gateway through the secure tunnel, forward the first encrypted traffic to the opposite application according to the parsed protocol header information.

[0162] For the specific implementation methods and technical effects of steps 701 to 704 in this embodiment, please refer to the relevant descriptions of steps 501 to 504 in the method embodiment shown in Figure 5, which will not be repeated here.

[0163] Step 705: Receive the updated secure tunnel configuration policy and the updated correspondence table between application IDs and application IP addresses distributed by the control center.

[0164] In this embodiment, when the application ID corresponding to at least one application in the local application and / or the opposite application changes, the registration center will receive a new registration request from the application. The registration center updates the corresponding table of application ID and application IP address according to the newly sent registration request, obtains the updated corresponding table of application ID and application IP address, and synchronizes the updated corresponding table of application ID and application IP address to the control center. Finally, the control center distributes the updated corresponding table of application ID and application IP address to the local security gateway and the opposite security gateway.

[0165] Exemplarily, when the application ID corresponding to at least one application in the application on this end and / or the application on the other end changes, if the security tunnel configuration policy needs to be updated, the updated security tunnel configuration policy is distributed by the receiving control center to the security gateway on this end and the security gateway on the other end.

[0166] For example, the application ID is calculated by the registration center based on various information provided by the application (it can be a one-way function such as a hash operation). The application ID can also have a certain validity period. When the application ID expires (is about to expire), the application needs to re-register with the registration center.

[0167] In this embodiment, each application can obtain the corresponding information of the application ID and IP address of the other party from the registration center in advance, and can continuously monitor changes in application topology, updates of application ID, etc., to ensure that the application ID of the other party can be transmitted in plain text when the traffic is encrypted and sent to the security gateway.

[0168] In a seventh exemplary embodiment, as shown in FIG8 , a secure tunnel transmission method is provided, which is applied to a communication architecture including an application, a security gateway, a registration center, and a control center, and may include the following steps:

[0169] Step a1: Each application sends an application registration request to a registration center in a pre-registration manner, and obtains an application ID through application registration.

[0170] Step a2: The registration center generates a correspondence table between application IDs and application IP addresses, and synchronizes the correspondence table between application IDs and application IP addresses to the control center.

[0171] In step a3, the application may pre-configure the address information of the communication target application and query the ID information of the target application from the registration center.

[0172] Step a4: When distributing policies to each security gateway, the control center also distributes a correspondence table between application IDs and application IP addresses.

[0173] Step a5, when the application needs to communicate with an external application, it first initiates the initial traffic and the application ID of the other end to the local security gateway. The local security gateway encapsulates the application ID and the destination information of the other end's security gateway (select MAC address, IP address, or network port information according to the protocol) in the protocol header according to the application ID and application IP address correspondence table, and sends the encrypted traffic to the other end's security gateway.

[0174] Step a6: When the peer security gateway obtains the encrypted traffic, it does not decrypt the traffic, but only parses the protocol header information, and forwards the ciphertext traffic directly to the backend application according to the application ID and IP address correspondence table.

[0175] Step a7, the application on the other end obtains the IP address of the traffic initiator after decryption and responds with a message based on the correspondence between the application ID and the IP (also obtained synchronously from the registration center).

[0176] This embodiment offloads the encryption and decryption operations to each back-end application, reducing the performance pressure of the security gateway, so that fewer security gateways with lower specifications and costs can be deployed; by splitting traffic forwarding and encryption and decryption operations, the traffic is directly forwarded to the back-end application in an encrypted form on the security gateway, thus avoiding the need for secondary encryption and decryption to protect the security of internal traffic transmission. Compared with traditional security gateways, there is no increase in the number of security tunnels required. It can be applied to physical security gateways or virtual gateways, and can also be applied to a variety of OSI / ISO network layer and below security protocols.

[0177] It should be noted that when there is a requirement for encryption speed, encryption and decryption acceleration technology can also be integrated when encrypting and decrypting the application.

[0178] It should be understood that, although the various steps in the flowcharts involved in the above-mentioned embodiments are displayed in sequence according to the indication of the arrows, these steps are not necessarily executed in sequence according to the order indicated by the arrows. Unless there is a clear explanation in this article, the execution of these steps does not have a strict order restriction, and these steps can be executed in other orders. Moreover, at least a part of the steps in the flowcharts involved in the above-mentioned embodiments can include multiple steps or multiple stages, and these steps or stages are not necessarily executed at the same time, but can be executed at different times, and the execution order of these steps or stages is not necessarily to be carried out in sequence, but can be executed in turn or alternately with other steps or at least a part of the steps or stages in other steps.

[0179] Based on the same inventive concept, the embodiment of the present application also provides a secure tunnel transmission device for implementing the secure tunnel transmission method involved above. The implementation scheme for solving the problem provided by the device is similar to the implementation scheme recorded in the above method, so the specific limitations in one or more secure tunnel transmission device embodiments provided below can refer to the limitations on the secure tunnel transmission method above, and will not be repeated here.

[0180] In an exemplary embodiment, as shown in FIG. 9 , a secure tunnel transmission device is provided, which is applied to a local security gateway, wherein the local security gateway is communicatively connected with various applications at the local end, and the device includes:

[0181] The first receiving module 901 is used to receive the security tunnel configuration policy distributed by the control center, and the correspondence table between the application ID and the application IP address; the ID is the identity identifier, and the IP is the Internet protocol;

[0182] A first secure tunnel establishing module 902, configured to establish a secure tunnel with a security gateway of a peer end according to the secure tunnel configuration policy;

[0183] A first sending module 903, configured to distribute the security parameters negotiated by the secure tunnel to various applications on the local end;

[0184] The first receiving module 901 is further used to receive the first encrypted traffic initiated by the application of the local end and the application ID of the opposite end; the first encrypted traffic is the traffic obtained after the application of the local end encrypts the first initial traffic according to the security parameters;

[0185] The first sending module 903 is also used to encapsulate the application ID of the other end and the destination information of the security gateway of the other end in a protocol header according to the correspondence table of the application ID and the application IP address, and then send the first encrypted traffic to the security gateway of the other end through a secure tunnel, so that when the security gateway of the other end receives the first encrypted traffic, it forwards the first encrypted traffic to the application of the other end according to the parsed protocol header information.

[0186] Exemplarily, the correspondence table between the application ID and the application IP address is established by the registration center according to the pre-registration applications initiated by each application program of the local end and each application program of the opposite end, and the registration center synchronizes the established correspondence table between the application ID and the application IP address to the control center;

[0187] The application ID of the other end is obtained by the application program of the local end inquiring the registration center.

[0188] Exemplarily, the destination information of the security gateway of the opposite end includes at least one of the following:

[0189] A MAC address selected according to the protocol; the MAC address is a media access control address;

[0190] IP address;

[0191] Network port information.

[0192] Exemplarily, the first receiving module 901 is further configured to receive second encrypted traffic sent by a security gateway at the opposite end through a security tunnel;

[0193] The first sending module 903 is also used to decrypt the protocol header information of the second encrypted traffic transmission protocol to obtain the application ID of the local end; determine the application IP address of the local end according to the correspondence table between the application ID and the application IP address and the application ID of the local end; and forward the second encrypted traffic to the application indicated by the application IP address of the local end.

[0194] Exemplarily, the first receiving module 901 is also used to receive an updated secure tunnel configuration policy and a correspondence table of updated application IDs and application IP addresses distributed by the control center when the application ID corresponding to at least one application in the application on the local end and / or the application on the other end changes.

[0195] Each module in the above-mentioned secure tunnel transmission device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0196] In another exemplary embodiment, as shown in FIG. 10 , a secure tunnel transmission device is provided, which is applied to a security gateway of a peer end, wherein the security gateway of the peer end is communicatively connected with each application program of the peer end, and the device includes:

[0197] The second receiving module 1001 is used to receive the security tunnel configuration policy distributed by the control center, and the correspondence table between the application ID and the application IP address; the ID is the identity identifier, and the IP is the Internet protocol;

[0198] A second secure tunnel establishing module 1002, configured to establish a secure tunnel with a local security gateway according to the secure tunnel configuration policy;

[0199] The second sending module 1003 is used to distribute the security parameters negotiated by the secure tunnel to each application program of the opposite end;

[0200] The second sending module 1003 is further configured to forward the first encrypted traffic to an application at the other end according to the parsed protocol header information when receiving the first encrypted traffic sent by the security gateway at the local end through the security tunnel.

[0201] Exemplarily, the correspondence table between the application ID and the application IP address is established by the registration center based on the pre-registration applications initiated by each application on the local end and each application on the opposite end, and the registration center synchronizes the established correspondence table between the application ID and the application IP address to the control center.

[0202] Exemplarily, the second sending module 1003 is specifically used to: receive the first encrypted traffic sent by the security gateway of this end through the secure tunnel; decrypt the protocol header information of the first encrypted traffic transmission protocol to obtain the application ID of the other end; determine the application IP address of the other end according to the correspondence table between the application ID and the application IP address and the application ID of the other end; and forward the first encrypted traffic to the application indicated by the application IP address of the other end.

[0203] Exemplarily, the second receiving module 1001 is further used to receive the second encrypted traffic initiated by the application of the other end and the application ID of the local end; the second encrypted traffic is the traffic obtained after the application of the other end encrypts the second initial traffic according to the security parameters; the application ID of the local end is obtained by the application of the other end querying the registration center, or parsed from the first encrypted traffic;

[0204] The second sending module 1003 is further configured to encapsulate the local application ID and the destination information of the local security gateway in a protocol header according to the correspondence table of the application ID and the application IP address, and then send the second encrypted traffic to the local security gateway through the secure tunnel; wherein the destination information of the local security gateway includes at least one of the following:

[0205] A MAC address selected according to the protocol; the MAC is a media access control address;

[0206] IP address;

[0207] Network port information.

[0208] Exemplarily, the second receiving module 1001 is also used to receive an updated secure tunnel configuration policy and a correspondence table of updated application IDs and application IP addresses distributed by the control center when the application ID corresponding to at least one application in the application on the local end and / or the application on the other end changes.

[0209] Each module in the above-mentioned secure tunnel transmission device can be implemented in whole or in part by software, hardware and a combination thereof. Each of the above-mentioned modules can be embedded in or independent of the processor in the computer device in the form of hardware, or can be stored in the memory in the computer device in the form of software, so that the processor can call and execute the operations corresponding to each of the above modules.

[0210] In an exemplary embodiment, the present application further provides a secure tunnel transmission system, comprising: a local security gateway, a peer security gateway, a registration center, and a control center, wherein the local security gateway is connected to each application of the local end, and the peer security gateway is connected to each application of the peer end, wherein:

[0211] The registration center is used to receive pre-registration applications initiated by various applications of the local end and various applications of the opposite end, and after establishing a correspondence table between application IDs and application IP addresses according to the pre-registration applications, synchronize the correspondence table between application IDs and application IP addresses to the control center;

[0212] The control center is used to distribute the security tunnel configuration policy and the corresponding table of application ID and application IP address to the security gateway of the local end and the security gateway of the opposite end; the ID is the identity identifier and the IP is the Internet protocol;

[0213] Each application program of the local end is used to initiate the first encrypted traffic and the application ID of the opposite end to the security gateway of the local end, and receive the second encrypted traffic forwarded by the security gateway of the local end;

[0214] The local security gateway is used to execute the method steps described in any one of Figures 2 to 4 and 8;

[0215] Each program of the opposite end is used to receive the first encrypted traffic forwarded by the security gateway of the opposite end, and to initiate the second encrypted traffic and the application ID of the local end to the security gateway of the opposite end;

[0216] The security gateway at the other end is used to execute the method steps described in any one of Figures 5 to 8.

[0217] In an exemplary embodiment, a computer device is provided, and the internal structure diagram of the computer device can be shown in Figure 11. The computer device includes a processor, a memory, an input / output interface (Input / Output, referred to as I / O) and a communication interface. Among them, the processor, the memory and the input / output interface are connected through a system bus, and the communication interface is connected to the system bus through the input / output interface. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system, a computer program and a database. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The database of the computer device is used to store traffic data. The input / output interface of the computer device is used to exchange information between the processor and an external device. The communication interface of the computer device is used to communicate with an external terminal through a network connection. When the computer program is executed by the processor, a secure tunnel transmission method is implemented.

[0218] Those skilled in the art will understand that the structure shown in FIG. 11 is merely a block diagram of a partial structure related to the solution of the present application, and does not constitute a limitation on the computer device to which the solution of the present application is applied. The specific computer device may include more or fewer components than shown in the figure, or combine certain components, or have a different arrangement of components.

[0219] In an exemplary embodiment, a computer device is provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor implements the steps in the above-mentioned method embodiments when executing the computer program.

[0220] In one embodiment, a computer-readable storage medium is provided, on which a computer program is stored. When the computer program is executed by a processor, the steps in the above-mentioned method embodiments are implemented.

[0221] In one embodiment, a computer program product is provided, including a computer program, which implements the steps in the above method embodiments when executed by a processor.

[0222] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, stored data, displayed data, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of relevant data must comply with relevant regulations.

[0223] A person of ordinary skill in the art can understand that all or part of the processes in the above-mentioned embodiment method can be completed by instructing the relevant hardware through a computer program, and the computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, any reference to the memory, database or other medium used in the embodiments provided in the present application can include at least one of non-volatile memory and volatile memory. Non-volatile memory can include read-only memory (ROM), magnetic tape, floppy disk, flash memory, optical memory, high-density embedded non-volatile memory, resistive random access memory (ReRAM), magnetic random access memory (MRAM), ferroelectric random access memory (FRAM), phase change memory (PCM), graphene memory, etc. Volatile memory can include random access memory (RAM) or external cache memory, etc. As an illustration and not limitation, RAM can be in various forms, such as static random access memory (SRAM) or dynamic random access memory (DRAM). The database involved in each embodiment provided in this application may include at least one of a relational database and a non-relational database. Non-relational databases may include distributed databases based on blockchains, etc., but are not limited to this. The processor involved in each embodiment provided in this application may be a general-purpose processor, a central processing unit, a graphics processor, a digital signal processor, a programmable logic device, a data processing logic device based on quantum computing, an artificial intelligence (AI) processor, etc., but are not limited to this.

[0224] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this application.

[0225] The above-described embodiments only express several implementation methods of the present application, and the descriptions thereof are relatively specific and detailed, but they cannot be understood as limiting the scope of the present application. It should be pointed out that, for a person of ordinary skill in the art, several variations and improvements can be made without departing from the concept of the present application, and these all belong to the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the attached claims.

Claims

1. A secure tunnel transmission method, characterized in that: A security gateway applied to the local end, wherein the security gateway of the local end is communicatively connected with each application program of the local end, and the method comprises: Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center; the ID is the identity identifier and the IP is the Internet protocol; Establishing a secure tunnel with the peer security gateway according to the secure tunnel configuration policy; Distribute the security parameters negotiated by the secure tunnel to various applications on the local end; Receive first encrypted traffic initiated by an application on the local end and an application ID on the other end; the first encrypted traffic is traffic obtained by encrypting the first initial traffic by the application on the local end according to security parameters; According to the correspondence table between the application ID and the application IP address, the application ID of the other end and the destination information of the security gateway of the other end are encapsulated in the protocol header, and the first encrypted traffic is sent to the security gateway of the other end through a secure tunnel, so that when the security gateway of the other end receives the first encrypted traffic, it forwards the first encrypted traffic to the application of the other end according to the parsed protocol header information.

2. The method according to claim 1, characterized in that The correspondence table between the application ID and the application IP address is established by the registration center according to the pre-registration applications initiated by each application program of the local end and each application program of the opposite end, and the registration center synchronizes the established correspondence table between the application ID and the application IP address to the control center; The application ID of the other end is obtained by the application program of the local end inquiring the registration center.

3. The method according to claim 1, characterized in that: The destination information of the peer security gateway includes at least one of the following: A MAC address selected according to the protocol; the MAC address is a media access control address; IP address; Network port information.

4. The method according to any one of claims 1 to 3, characterized in that: After sending the first encrypted traffic to the security gateway of the other end through the secure tunnel, the method further includes: Receiving second encrypted traffic sent by a security gateway at the opposite end through a security tunnel; Decrypting the protocol header information of the second encrypted traffic transmission protocol to obtain the application ID of the local end; Determine the application IP address of the local end according to the correspondence table between the application ID and the application IP address and the application ID of the local end; The second encrypted traffic is forwarded to the application program indicated by the application IP address of the local end.

5. The method according to any one of claims 1 to 3, characterized in that: When the application ID corresponding to at least one application in the application of the local end and / or the application of the opposite end changes, the method further includes: Receive the updated secure tunnel configuration policy and the updated correspondence table between application IDs and application IP addresses distributed by the control center.

6. A secure tunnel transmission method, characterized in that: A security gateway applied to a peer end, wherein the security gateway of the peer end is in communication connection with each application program of the peer end, and the method comprises: Receive the secure tunnel configuration policy and the correspondence table between application ID and application IP address distributed by the control center; the ID is the identity identifier and the IP is the Internet protocol; Establishing a secure tunnel with the local security gateway according to the secure tunnel configuration policy; Distribute the security parameters negotiated by the secure tunnel to each application program at the other end; When receiving the first encrypted traffic sent by the local security gateway through the secure tunnel, the first encrypted traffic is forwarded to the application program at the other end according to the protocol header information obtained by parsing.

7. The method according to claim 6, characterized in that The correspondence table between the application ID and the application IP address is established by the registration center based on the pre-registration applications initiated by each application on the local end and each application on the opposite end, and the registration center synchronizes the established correspondence table between the application ID and the application IP address to the control center.

8. The method according to claim 6, characterized in that When receiving first encrypted traffic sent by the local security gateway through the secure tunnel, forwarding the first encrypted traffic to the opposite application according to the parsed protocol header information includes: Receiving first encrypted traffic sent by the local security gateway through the security tunnel; Decrypting the protocol header information of the first encrypted traffic transmission protocol to obtain the application ID of the other end; Determine the application IP address of the other end according to the correspondence table between the application ID and the application IP address and the application ID of the other end; The first encrypted traffic is forwarded to the application program indicated by the application IP address of the other end.

9. The method according to any one of claims 6 to 8, characterized in that: After forwarding the first encrypted traffic to the application program at the other end according to the parsed protocol header information, the method further includes: Receive the second encrypted traffic initiated by the application of the other end and the application ID of the local end; the second encrypted traffic is the traffic obtained by the application of the other end encrypting the second initial traffic according to the security parameters; the application ID of the local end is obtained by the application of the other end querying the registration center, or parsed from the first encrypted traffic; According to the correspondence table between the application ID and the application IP address, the application ID of the local end and the destination information of the security gateway of the local end are encapsulated in the protocol header, and the second encrypted traffic is sent to the security gateway of the local end through the secure tunnel; wherein the destination information of the security gateway of the local end includes at least one of the following: A MAC address selected according to the protocol; the MAC is a media access control address; IP address; Network port information.

10. The method according to any one of claims 6 to 8, characterized in that: When the application ID corresponding to at least one application in the application of the local end and / or the application of the opposite end changes, the method further includes: Receive the updated secure tunnel configuration policy and the updated correspondence table between application IDs and application IP addresses distributed by the control center.

11. A secure tunnel transmission device, characterized in that: A security gateway applied to the local end, wherein the security gateway of the local end is connected to each application program of the local end in communication, and the device comprises: A first receiving module is used to receive a secure tunnel configuration policy distributed by a control center, and a correspondence table between an application ID and an application IP address; the ID is an identity identifier, and the IP is an Internet protocol; A first secure tunnel establishment module, configured to establish a secure tunnel with a security gateway of a peer end according to the secure tunnel configuration policy; A first sending module, used to distribute the security parameters negotiated by the secure tunnel to various applications on the local end; The first receiving module is further used to receive the first encrypted traffic initiated by the application at the local end and the application ID of the other end; the first encrypted traffic is the traffic obtained after the application at the local end encrypts the first initial traffic according to the security parameters; The first sending module is also used to encapsulate the application ID of the other party and the destination information of the security gateway of the other party in a protocol header according to the correspondence table of the application ID and the application IP address, and then send the first encrypted traffic to the security gateway of the other party through a secure tunnel, so that when the security gateway of the other party receives the first encrypted traffic, it forwards the first encrypted traffic to the application of the other party according to the parsed protocol header information.

12. A secure tunnel transmission device, characterized in that: A security gateway applied to a peer end, wherein the security gateway of the peer end is connected to each application program of the peer end in communication, and the device comprises: The second receiving module is used to receive the security tunnel configuration policy distributed by the control center, and the correspondence table between the application ID and the application IP address; the ID is the identity identifier, and the IP is the Internet protocol; A second secure tunnel establishment module, configured to establish a secure tunnel with a local security gateway according to the secure tunnel configuration policy; A second sending module, used to distribute the security parameters negotiated by the secure tunnel to each application program of the opposite end; The second sending module is also used to forward the first encrypted traffic to the application program at the other end according to the protocol header information obtained by parsing when receiving the first encrypted traffic sent by the security gateway of the local end through the security tunnel.

13. A secure tunnel transmission system, characterized in that: include: The security gateway of the local end, the security gateway of the opposite end, the registration center, and the control center, the security gateway of the local end is connected in communication with each application of the local end, and the security gateway of the opposite end is connected in communication with each application of the opposite end, wherein: The registration center is used to receive pre-registration applications initiated by various applications of the local end and various applications of the opposite end, and after establishing a correspondence table between application IDs and application IP addresses according to the pre-registration applications, synchronize the correspondence table between application IDs and application IP addresses to the control center; The control center is used to distribute the security tunnel configuration policy and the corresponding table of application ID and application IP address to the security gateway of the local end and the security gateway of the opposite end; the ID is the identity identifier and the IP is the Internet protocol; Each application program of the local end is used to initiate the first encrypted traffic and the application ID of the opposite end to the security gateway of the local end, and receive the second encrypted traffic forwarded by the security gateway of the local end; The local security gateway is used to perform the method steps described in any one of claims 1 to 5; Each program of the opposite end is used to receive the first encrypted traffic forwarded by the security gateway of the opposite end, and to initiate the second encrypted traffic and the application ID of the local end to the security gateway of the opposite end; The security gateway at the other end is used to execute the method steps described in any one of claims 6 to 10.

14. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 10 are implemented.

15. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

16. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 10 are implemented.

Images