Message processing method and apparatus, and electronic device
By determining the SA status and SPI consistency of the ESP packet matching in the IPSec node device, it is determined whether to decrypt the ESP packet, which solves the problem of excessive system resource consumption when dealing with forged ESP packets, and achieves resource conservation and system stability.
Patent Information
- Application Number
- CN202411665772.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-11-20
- Publication Date
- 2025-02-18
AI Technical Summary
When processing ESP packets, IPSec node devices may consume a large amount of system resources, especially when an attacker forged a large number of ESP packets, causing the system to deny service.
By implementing the message processing method in the IPSec node device, the latest status of the SA that matches the source IP address and the destination IP address carried by the ESP packet are determined, and whether to perform decryption processing is determined based on the consistency of the SPI, thereby saving system resources.
It effectively saves system resources, avoids system denial of service caused by a large number of attempts to decrypt, and improves system security and stability.
Smart Images
Figure CN119484121A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the field of network communications, and in particular to a message processing method and device, and electronic equipment. Background Art
[0002] IPSec (Internet Protocol Security) is also called IPSec SA. The premise of IPSec secure data transmission is to successfully establish a security alliance SA (Security Association) between IPSec peers. Among them, peers are two endpoints running the IPSec protocol, which can also be understood as two electronic devices running the IPSec protocol, one of which can also be called an IPSec node device, and the other can also be called a peer node device. In the IPSec protocol suite, there is an ESP (Encapsulating Security Payload) protocol, which is used to provide encryption and authentication services to protect the transmission security of IP (Internet Protocol) data packets, and supports the use of sequence numbers to prevent replay attacks.
[0003] The SA between IPSec peers needs to be negotiated, and there may be inconsistencies between the SAs of the two endpoints. For example, the peer node device has updated the SA, but the local node device has not updated the SA. When peer A uses the new SA to encapsulate the message and sends it to peer B, peer B needs to process the ESP message instead of simply discarding it. For example, after receiving the ESP message, peer B will search for the SA based on the source IP, destination IP, protocol number, and SPI (Security Parameter Index) carried in the ESP message; if it cannot find the SA, it will search for the SA based on the source IP, destination IP, and protocol number carried in the ESP message; and then use the found SA to try to decrypt the ESP message.
[0004] Since the header of the ESP message is plain text, attackers have the opportunity to forge ESP messages by replacing the source IP, replacing SPI, etc. For example, an attacker can pretend to be peer A and send ESP messages to peer B. If the attacker pretends to send a large number of ESP messages to peer B, peer B needs to decrypt a large number of ESP messages, which consumes a lot of system resources and may even cause system denial of service in serious cases.
[0005] It should be noted that the information disclosed in the above background technology section is only used to enhance the understanding of the background of the present application, and therefore may include information that does not constitute the prior art known to ordinary technicians in the field. Summary of the invention
[0006] In order to provide a basic understanding of some aspects of the disclosed embodiments, a brief summary is given below. The summary is not an extensive review, nor is it intended to identify key / critical components or delineate the scope of protection of these embodiments, but rather serves as a prelude to the detailed description that follows.
[0007] The embodiments of the present application provide a message processing method and device, and an electronic device to save system resources.
[0008] An embodiment of the present application provides a message processing method, which is applied to an IPSec node device, including: when it is determined that there is no SA matching a first ESP message to be processed, obtaining from a database the latest state of a first SA matching a source IP address and a destination IP address carried by the first ESP message; when the latest state of the first SA is a normal state, if the IPSec node device updates the first SA to obtain a second SA, comparing the SPI carried by the first ESP message with the SPI corresponding to the second SA; when the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the second SA, determining not to decrypt the first ESP message.
[0009] In the above implementation, it is considered that the premise of normal data transmission between the IPSec node device and the peer node device is that the SA is in a normal state. At the same time, since the IPSecSA is generated through negotiation, there may be a situation where the IPSecSAs of the two endpoints are inconsistent. For example, the peer node device has updated the SA, while the IPSec node device has not updated the SA. Therefore, the attacker may find the SA that is actually in an invalid state by replacing the forged ESP message such as the source IP and SPI, but the ESP message cannot be decrypted by the invalid SA. Therefore, the present application determines that the latest state of the first SA whose source IP address and destination IP address carried by the first ESP message match is a normal state, and if the IPSec node device updates the first SA to obtain the second SA, it determines whether to decrypt the first ESP message according to whether the SPI carried by the first ESP message is consistent with the SPI corresponding to the second SA. Since the present application adds the precondition for decrypting the ESP message, it is not necessary to try to decrypt all ESP messages, thereby saving system resources.
[0010] Furthermore, the message processing method also includes: for a second ESP message sent by any peer node device of the IPSec node device, using the SA between the peer node device and the peer node device to decrypt the second ESP message to obtain a first decryption result; if the first decryption result is a failure, using a message detection method to obtain the status of the SA between the peer node device and the peer node device, and updating the status of the SA in the database.
[0011] In the above implementation, it is considered that in the case where the decryption of the second ESP message fails, it may be caused by an abnormality in the SA between the IPSec node device and the opposite node device, for example, the opposite node device has updated the SA, but the local node device has not updated the SA. At this time, the message detection method is actively used to obtain the state of the SA between the local node device and the opposite node device, and the state of the SA in the database is updated, so that it is easy to identify whether the first ESP message is an abnormal message without decrypting the first ESP message.
[0012] Furthermore, the state of the SA with the opposite node device is obtained by utilizing a message detection method, including: sending a preset detection message to the opposite node device; when no reply message sent by the opposite node device is received within a preset time period, determining that the state of the SA with the opposite node device is an abnormal state; when a reply message sent by the opposite node device is received within a preset time period, determining that the state of the SA with the opposite node device is a normal state.
[0013] In the above implementation, considering that the status of the SA between the IPSec node device and the opposite node device is normal, the opposite node device will reply to the detection message sent by the IPSec node device. Therefore, whether the status of the SA is normal can be accurately judged by whether the opposite node device receives the reply message within the preset time.
[0014] Furthermore, the message processing method also includes: when the state of the SA between the device and the opposite node is abnormal, repeatedly using the message detection method for a preset number of times to obtain the state of the SA with the device and the opposite node; when the preset detection results all indicate that the state of the SA is abnormal, deleting the SA from the database.
[0015] In the above implementation, by repeatedly using the message detection method to detect the state of the SA between the IPSec node device and the peer node device, the possibility of misjudging the state of the SA can be reduced. At the same time, when the multiple detection results all indicate that the state of the SA is abnormal, the SA is deleted from the database, and when the first ESP message is subsequently judged, the first ESP message will not match the SA, so there is no need to perform further judgment steps, which can save system resources.
[0016] Furthermore, the message processing method also includes: when the state of the SA between the IPSec node device and the opposite node device is an abnormal state, if the state of the SA between the IPSec node device and the other opposite node devices is a normal state, it is determined that the opposite node device is suspected to be attacked; wherein the opposite node device and the other opposite node devices are located in the same location area.
[0017] In the above implementation, considering that the SA status of the peer node devices located in the same location area is most likely the same, if the SA status between the IPSec node device and other peer node devices is normal, it can be inferred that the peer node device may be attacked, so that subsequent users can check the peer node device and maintain the correctness of the database.
[0018] Furthermore, the latest status of the first SA matching the source IP address and the destination IP address carried by the first ESP message is obtained from the database, including: when the latest status of the first SA recorded in the database is a normal status, the duration for which the latest status of the first SA is continuously maintained is less than the configured effective duration, and the remaining survival duration corresponding to the first SA is less than the configured effective threshold, the latest status of the first SA is obtained from the database; wherein the remaining survival duration represents the length of time from the current moment to the end of the SA's life cycle.
[0019] In the above implementation, considering that SA is time-limited, even if the SA is established between the IPSec node device and the peer node device, the SA may become invalid due to expiration. By combining the remaining lifetime of the SA and the duration of the latest state to assist in the judgment, the latest state of the first SA can be obtained from the database more effectively.
[0020] Furthermore, the message processing method also includes: when the SPI carried by the first ESP message is consistent with the SPI corresponding to the second SA, using the second SA to decrypt the first ESP message to obtain a second decryption result; if the second decryption result is a failure, obtaining the status of the SA between the target peer node device through a message detection method, and updating the status of the SA in the database, the target peer node device is the peer node device that sends the first ESP message.
[0021] In the above implementation, it is considered that in the case where the first ESP message decryption fails, it may be caused by an abnormality in the SA between the IPSec node device and the opposite node device. At this time, the message detection method is actively used to obtain the state of the SA between the IPSec node device and the opposite node device, and the state of the SA in the database is updated, so that it is easy to identify whether the first ESP message is an attack message without decryption, thereby improving the security of the system.
[0022] Furthermore, the message processing method further includes: when the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the first SA, determining the first ESP message as an abnormal message.
[0023] In the above implementation, the SPI is used to uniquely identify an SA. Therefore, if the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the first SA, the first ESP message is likely to be a forged message. By comparing whether the SPI values are consistent, it can be determined whether the first ESP message is an abnormal message.
[0024] An embodiment of the present application provides a message processing device, which is applied to an IPSec node device. The device includes: a state acquisition module, which, when it is determined that there is no SA matching the first ESP message to be processed, obtains the latest state of the first SA matching the source IP address and the destination IP address carried by the first ESP message from a database; a comparison module, which, when the latest state of the first SA is a normal state, compares the SPI carried by the first ESP message with the SPI corresponding to the second SA if the IPSec node device updates the first SA to obtain a second SA; and a determination module, which, when the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the second SA, determines not to decrypt the first ESP message.
[0025] An embodiment of the present application provides an electronic device, including a processor and a memory, wherein the memory stores computer-executable instructions that can be executed by the processor, and the processor executes the computer-executable instructions to implement the above-mentioned message processing method.
[0026] The above general description and the following description are exemplary and explanatory only and are not intended to limit the present application. BRIEF DESCRIPTION OF THE DRAWINGS
[0027] One or more embodiments are exemplarily described by corresponding drawings, and these exemplary descriptions and drawings do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are considered similar elements, and the drawings do not constitute a scale limitation, and wherein:
[0028] Figure 1 It is a schematic diagram of a message processing method provided in an embodiment of the present application;
[0029] Figure 2 is a schematic diagram of a message processing device provided in an embodiment of the present application;
[0030] Figure 3 It is a schematic diagram of an electronic device provided in an embodiment of the present application.
[0031] Reference numerals:
[0032] 1: Status acquisition module; 2: Comparison module; 3: Determination module; 4: Processor; 5: Memory; 6: Communication interface; 7: Bus. DETAILED DESCRIPTION
[0033] In order to be able to understand the features and technical contents of the embodiments of the present application in more detail, the implementation of the embodiments of the present application is described in detail below in conjunction with the accompanying drawings. The attached drawings are for reference only and are not used to limit the embodiments of the present application. In the following technical description, for the convenience of explanation, a full understanding of the disclosed embodiments is provided through multiple details. However, one or more embodiments can still be implemented without these details. In other cases, to simplify the drawings, well-known structures and devices can be simplified for display.
[0034] The terms "first", "second", etc. in the specification and claims of the embodiments of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the numbers used in this way can be interchanged where appropriate, so that the embodiments of the embodiments of the present application described here. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions.
[0035] Unless otherwise stated, the term "plurality" means two or more.
[0036] The term "correspondence" may refer to an association relationship or a binding relationship. The correspondence between A and B means that there is an association relationship or a binding relationship between A and B.
[0037] The embodiment of the present application provides a message processing method, which is applied to an IPSec node device. The IPSec node device is, for example, a router or a server. In some embodiments, an electronic device that establishes an SA with an IPSec node device is a peer node device of the IPSec node device. An IPSec node device can establish different SAs with one or more electronic devices, that is, an IPSec node device can have one or more peer node devices.
[0038] In some embodiments, the attack message is a forged ESP message, that is, the ESP message sent to the IPSec node device by the opposite node device other than the IPSec node device is the attack message.
[0039] Exemplarily, it is assumed that the IPSec node device has only one peer node device A. Only the ESP message sent by the peer node device A to the IPSec node device is a normal message, and the ESP messages sent by other electronic devices to the IPSec node device are all attack messages.
[0040] Embodiment 1
[0041] The present application provides a message processing method, which is applied to an IPSec node device. Figure 1 As shown, Figure 1 A flowchart of a message processing method provided in an embodiment of the present application includes:
[0042] Step S101, when it is determined that there is no SA matching the first ESP message to be processed, the latest state of the first SA matching the source IP address and the destination IP address carried by the first ESP message is obtained from the database;
[0043] Step S102: when the latest state of the first SA is normal, if the IPSec node device updates the first SA to obtain the second SA, the SPI carried by the first ESP message is compared with the SPI corresponding to the second SA;
[0044] Step S103: When the SPI carried in the first ESP message is inconsistent with the SPI corresponding to the second SA, it is determined not to decrypt the first ESP message.
[0045] The first ESP message may be an ESP message sent by a peer node device of an IPSec node device (the IPSec node device is referred to as a "local node device"), or may be a forged ESP message sent by an attacker through an electronic device.
[0046] In some embodiments, in the above step S101, after receiving the first ESP message, the SA can be searched according to the source IP address, destination IP address, protocol number and SPI carried by the first ESP message to find out whether there is an SA that matches the first ESP message (that is, a process of accurately searching for SA is performed). For example, if there is no SPI corresponding to any SA that is the same as the SPI carried by the first ESP message, it can be determined that there is no SA that matches the first ESP message.
[0047] If it is determined that there is no SA matching the first ESP message, then according to the source IP address and the destination IP address carried by the first ESP message, it is searched whether there is a first SA matching the source IP address and the destination IP address carried by the first ESP message (i.e., a fuzzy search SA process is performed). If there is a first SA, the latest status of the first SA is obtained from the database.
[0048] It is understandable that the header of an ESP message usually directly carries the source IP address, destination IP address, and SPI. The source IP address is the IP address that sends the ESP message. The destination IP address is the IP address that receives the ESP message. The SPI is used to uniquely identify an SA in the IPSec protocol. Specifically, when an IPSec connection is established between two IPSec peers, they negotiate the SA for secure data transmission. Each SA has a unique SPI, which will be included in the header of the ESP message so that the receiver can identify and correctly process the ESP message.
[0049] The database at least stores the corresponding relationship between the source IP address, the destination IP address and the latest state of the SA. Thus, by pre-storing the corresponding relationship between the source IP address, the destination IP address and the latest state of the SA in the database, the latest state of the SA can be obtained conveniently.
[0050] The status of the SA between the IPSec node device and the peer node device is used to indicate whether the SA is valid. When the SA status is normal, the SA is valid and can be used for secure data transmission between the IPSec node device and the peer node device. When the SA status is abnormal, the SA is invalid and cannot be used for secure data transmission between the IPSec node device and the peer node device.
[0051] For example, the state of SA may use the character "0" to represent a normal state, and use the character "1" to represent an abnormal state.
[0052] Here, the latest status of the SA between the IPSec node device and the opposite node device can be the latest status obtained by the IPSec node device using the message detection method for the last time. For example, the IPSec node device can periodically send detection messages to the opposite node device, and determine the latest status of the SA between the IPSec node device and the opposite node device based on whether a reply message returned by the opposite node device is received.
[0053] In some examples, when it is determined that there is an SA matching the first ESP message to be processed, the first ESP message is decrypted using the SA matching the first ESP message.
[0054] In some examples, if there is no first SA that matches the source IP address and the destination IP address carried by the first ESP message, the first ESP message is discarded.
[0055] In some examples, if there is a first SA that matches the source IP address and the destination IP address carried by the first ESP message, it is queried from the database whether the latest state of the first SA is a normal state.
[0056] In some examples, if the latest status of the first SA queried from the database is an abnormal state, the first ESP message can be cached, and within a preset time after the first ESP message is cached, a message detection method is used to detect whether the first SA between the IPSec node device and the sender of the first ESP message is normal. If the status of the first SA is re-detected to be an abnormal state, the first ESP message is not decrypted and the first ESP message is discarded.
[0057] In some examples, in the above step S102, when the latest state of the first SA is a normal state, if the IPSec node device does not update the first SA to obtain the second SA, the first SA is used to attempt to decrypt the first ESP message.
[0058] It is understandable that if the IPSec node device updates the first SA to obtain the second SA, the update time of the first SA being updated to the second SA is later than the recording time when the database records the latest state of the first SA.
[0059] In the embodiment of the present application, when determining whether to decrypt the received ESP message, not only whether the latest state of the first SA matching the source IP address and the destination IP address carried by the first ESP message is normal is considered, but also whether the IPSec node device currently updates the first SA to obtain the second SA. If the latest state of the first SA is normal and the IPSec node device updates the first SA to obtain the second SA, the SPI carried by the first ESP message is compared with the SPI corresponding to the second SA, and whether the SPI carried by the first ESP message is consistent with the SPI corresponding to the second SA is determined to determine whether to decrypt the first ESP message. Therefore, the present application adds a precondition for decrypting the ESP message, so that there is no need to attempt to decrypt all ESP messages, which can save system resources.
[0060] In some examples, when the SPI carried by the first ESP message is consistent with the SPI corresponding to the second SA, the first ESP message is decrypted using the second SA.
[0061] In some examples, when the SPI carried by the first ESP message is consistent with the SPI corresponding to the second SA, an invalid SPI (INVALID_SPI) message can be constructed for the first SA and notified to the sender of the first ESP message to make the SA between the IPSec node device and the sender of the first ESP message consistent.
[0062] In some embodiments, after determining not to perform decryption processing on the first ESP message, the first ESP message may be discarded.
[0063] In some embodiments, when the first ESP message is not decrypted, the step of constructing an invalid SPI message to notify the sender of the first ESP message will not be performed, which can further save system resources.
[0064] In some embodiments, the message processing method also includes: for a second ESP message sent by any peer node device of the IPSec node device, using the SA between the peer node device and the peer node device to decrypt the second ESP message to obtain a first decryption result; if the first decryption result is a failure, using a message detection method to obtain the status of the SA between the peer node device and the peer node device, and updating the status of the SA in the database.
[0065] In an optional manner of the above embodiment, the SA between the peer node device and the second ESP message may be used to decrypt the second ESP message, which may be: obtaining the source IP address, destination IP address and SPI carried in the second ESP message; searching the SA corresponding to the source IP address, destination IP address and SPI in the database; if the SA corresponding to the source IP address, destination IP address and SPI is obtained, the second ESP message is decrypted using the SA; if the SA corresponding to the source IP address, destination IP address and SPI is not obtained, the SA corresponding to the source IP address and destination IP address is searched in the database, and the second ESP message is decrypted using the found SA. In this way, considering that during the normal rekey period of the SA, there may be a temporary inconsistency between the SPI carried by the second ESP message and the SPI corresponding to the SA in the database. Among them, each IPSec tunnel has a validity period. When the SA validity period expires, the tunnel needs to be renegotiated, and this process is rekey. Therefore, when the corresponding SA cannot be found through the source IP address, destination IP address and SPI, the source IP address and destination IP address are used to find the SA to avoid the inability to find the SA due to misjudgment.
[0066] The database also stores the corresponding relationship between the source IP address, the destination IP address, the SPI and the SA.
[0067] For example, it is assumed that the two endpoints of the successful SA establishment are the local node device A and the opposite node device B. When the opposite node device B needs to send the ESP ciphertext to the IPSec node device, the opposite node device B first encrypts the original plaintext message through the local SA, encapsulates it into an ESP message, and then sends the ESP message to the IPSec node device. The IPSec node device needs to find the corresponding SA through the source IP address, destination IP address and SPI carried in the ESP message, and use the SA to decrypt the ESP message. Among them, the IP address of the opposite node device B is the source IP address, and the IP address of the IPSec node device is the destination IP address.
[0068] In the above embodiment, decrypting the second ESP message by using SA may be: searching for a decryption method corresponding to SA in a preset decryption database, and decrypting the second ESP message by using the decryption method. The decryption database stores the correspondence between SA and the decryption method.
[0069] It can be understood that the decryption method is the content used to decrypt the part of the encryption method. In the case where a key is required for decryption, the decryption method also includes the key used for decryption. Among them, the encryption method, for example: AES (Advanced Encryption Standard), DES (Data Encryption Standard), hash encryption, etc.
[0070] In the embodiment of the present application, an exemplary scenario of the failure of decryption of the second ESP message may be: for the opposite node device that establishes an SA with the local node device, the SA of the opposite node device is updated, while the SA of the local node device is not updated, so that the SA of the local node device cannot be used to successfully decrypt the ESP message from the opposite node device. Another exemplary scenario of message decryption failure may be: the ESP message received by the local node device is an ESP message forged by an attacker, and the ESP message cannot be successfully decrypted using the local SA of the local node device.
[0071] In the above embodiment, the state of the SA between the peer node device is obtained by using a message detection method, including: sending a preset detection message to the peer node device; if no reply message sent by the peer node device is received within a preset time period, or the reply message from the peer node device cannot be decrypted, determining that the state of the SA between the peer node device is an abnormal state; if a reply message sent by the peer node device is received within a preset time period and the reply message is successfully decrypted, determining that the state of the SA between the peer node device is a normal state.
[0072] It is understandable that the detection message sent by the IPSec node device to the peer node device is an ESP message encrypted and encapsulated using the local SA of the IPSec node device. If the peer node device can receive the detection message, the detection message will be attempted to be decrypted by the local SA of the peer node device. In addition, the reply message received by the IPSec node device from the peer node device may be an ESP message encrypted and encapsulated by the peer node device using the local SA of the peer node device, or it may be an ESP message forged by an attacker. Regardless of what kind of ESP message the reply message received by the IPSec node device is, the IPSec node device will attempt to decrypt it, and if the reply message is successfully decrypted, it will determine that the state of the SA between the IPSec node device and the peer node device is normal.
[0073] In some examples, when it is determined that the state of the SA between the IPSec node device and the peer node device is normal, if the reply message sent by the peer node device includes SA update information, the local SA of the IPSec node device is updated according to the SA update information. The locally updated SA of the IPSec node device can be used to decrypt the ESP message from the peer node device.
[0074] In the above embodiment, after obtaining the state of the SA with the opposite node device by using the message detection method, it also includes: when the state of the SA with the opposite node device is abnormal, repeatedly obtaining the state of the SA with the opposite node device by using the message detection method for a preset number of times; when the detection results of the preset number of times all indicate that the state of the SA is abnormal, deleting the SA from the database. Wherein, N is a positive integer. In this way, the SA with multiple detection results that are all abnormal is deleted from the database, and when the first ESP message is judged subsequently, the first ESP message will not match the SA, so there is no need to perform further judgment steps, which can save system resources.
[0075] In an optional manner of the above embodiment, the message processing method also includes: when the state of the SA between the IPSec node device and the opposite node device is an abnormal state, if the state of the SA between the IPSec node device and the other opposite node device is a normal state, it is determined that the opposite node device is suspected of being attacked.
[0076] In the above optional manner, the peer node device and other peer node devices are located in the same location area. Among them, the geographical information between the two peer node devices can be judged to determine whether the two peer node devices are located in the same location area. Exemplarily, the source IP addresses of the two peer node devices are obtained respectively, and the geographical information of the two peer node devices is determined respectively according to the source IP addresses. When the geographical information of the two peer node devices is located in the same location area, it is considered that the two peer node devices are located in the same location area. Among them, the geographical information can be the longitude and latitude of the peer node device, and the geographical information can also be the city where the peer node device is located.
[0077] In the above optional manner, the state of the SA between the IPSec node device and other peer node devices can be obtained by searching the database. The state of the SA between other peer node devices can also be obtained by using the message detection method. In this way, by searching the database, the state of the SA between the IPSec node device and other peer node devices can be quickly and conveniently obtained. And by using the message detection method, since it is the state of the latest detected SA, the state of the obtained SA can be made more accurate.
[0078] In some other embodiments, the message processing method further includes: triggering the IPSec node device to periodically send a preset detection message to the associated device. If a reply message sent by the associated device is received within a preset time period, the state of the SA between the IPSec node device and the associated device is normal; otherwise, the state of the SA between the IPSec node device and the associated device is abnormal. The state of the SA is stored or updated in the database.
[0079] The associated device may be an electronic device that has established SA with the IPSec node device. Alternatively, the associated device may be an electronic device other than the IPSec node device in the database. Alternatively, the associated device may be an electronic device with preset information, which may be a preset IP address.
[0080] The periodic sending of the preset detection message may be sending the detection message once every set time period, wherein the set time period may be set according to actual application requirements, for example, 5 minutes, 10 minutes, etc.
[0081] It can be understood that when the state of the SA between the IPSec node device and the associated device does not exist in the database, the state of the SA between the IPSec node device and the associated device can be stored after the detection message is sent. When the state of the SA between the IPSec node device and the associated device exists in the database, the state of the SA between the IPSec node device and the associated device can be updated after the detection message is sent.
[0082] At the same time, each time the IPSec node device sends a preset detection message to the associated device, the final tracking time of the latest SA state between the corresponding associated device and the IPSec node device can be updated. The final tracking time of the latest SA state represents the time when the SA state is last recorded.
[0083] The duration for which the SA latest status is maintained is the time difference between the current time and the last tracking time of the SA latest status.
[0084] Exemplarily, the IPSec node device sends a detection message to the opposite node device C at time a, and when a preset time after sending the detection message is reached, the final tracking time of the SA between the IPSec node device and the opposite node device C is updated in the database as time a.
[0085] In some embodiments, obtaining the latest state of the first SA matching the source IP address and the destination IP address carried by the first ESP message from the database in step S102 may include:
[0086] When the latest status of the first SA recorded in the database is normal, the duration for which the latest status of the first SA is maintained is less than the configured effective duration, and the remaining survival duration corresponding to the first SA is less than the configured effective threshold, the latest status of the first SA is obtained from the database; wherein the remaining survival duration represents the length of time from the current moment to the end of the SA's life cycle.
[0087] Since the SA life cycle is negotiated when the IPSec node device and the peer node device establish SA, the SA life cycle can be directly obtained and stored after the IPSec node device and the peer node device establish SA. At the same time, the time when the SA state is updated in the database can also be directly recorded and stored.
[0088] Exemplarily, the remaining survival time corresponding to the SA is less than the configured effective threshold, which means that the SA still has a remaining survival time, that is, the remaining survival time of the SA is greater than or equal to 0. The duration for which the latest state of the SA is maintained is less than the configured effective time, which means that the time difference between the final tracking time and the current moment is less than the preset time difference (the preset time difference can be used as the pre-configured effective time). For example: the time difference between the last time the state of the SA was recorded and the current moment is less than 5 minutes.
[0089] In some embodiments, the message processing method further includes: if there is no matching SA whose latest status is a normal status in the database, determining not to perform decryption processing on the first ESP message.
[0090] In some embodiments, the message processing method further includes: when the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the second SA, determining the first ESP message as an abnormal message.
[0091] In some embodiments, the message processing method also includes: when the SPI carried by the first ESP message is consistent with the SPI corresponding to the second SA, using the second SA to decrypt the first ESP message to obtain a second decryption result; if the second decryption result is a failure, obtaining the status of the SA between the target peer node device through a message detection method, and updating the status of the SA in the database, the target peer node device is the peer node device that sends the first ESP message.
[0092] The process of decrypting the first ESP message by using the second SA is similar to the process of decrypting the second ESP message by using the SA in the aforementioned embodiment, which will not be described in detail here.
[0093] Exemplarily, after different SAs are established between the IPSec node device and the peer node device, the source IP address, destination IP address, SPI, SA and remaining lifetime can be recorded in the database. For the IPSec node device, for each peer node device of the IPSec node device, the second ESP message sent by the second ESP message is decrypted using the SA between the peer node device to obtain a first decryption result; if the first decryption result is a failure, the state of the SA between the peer node device and the peer node device is obtained by using a message detection method; and the state of the SA in the database is updated. After completing the above process, the state of the SA and the duration of the latest state of the SA can be updated or recorded in the database, and finally a database is obtained that records the source IP address, destination IP address, SPI, remaining lifetime, SA, the state of the SA and the duration of the latest state of the SA. When the IPSec node device receives the first ESP message later, the SA is searched according to the source IP address, destination IP address, protocol number and SPI carried in the first ESP message. If there is no SA that completely matches the first message, it is searched whether there is a first SA that matches the source IP address and destination IP address carried by the first ESP message. When the first SA is found, if the latest status of the first SA recorded in the database is normal, the duration for which the latest status of the first SA is maintained is less than the configured effective duration, and the remaining survival duration corresponding to the first SA is less than the configured effective threshold, the latest status of the first SA is obtained from the database.
[0094] Embodiment 2
[0095] Based on the same inventive concept, the present application embodiment provides a message processing device, such as Figure 2As shown, the message processing device includes: a state acquisition module 1, a comparison module 2 and a determination module 3.
[0096] The state acquisition module 1 acquires the latest state of the first SA matching the source IP address and the destination IP address carried by the first ESP message from the database when it is determined that there is no SA matching the first ESP message to be processed;
[0097] Comparison module 2, configured to compare the SPI carried in the first ESP message with the SPI corresponding to the second SA if the IPSec node device updates the first SA to obtain the second SA when the latest state of the first SA is a normal state;
[0098] The determination module 3 is configured to determine not to decrypt the first ESP message when the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the second SA.
[0099] In some embodiments, the message processing device also includes: a detection module, which is used to decrypt the second ESP message sent by any opposite node device of the IPSec node device using the SA between the opposite node device and the IPSec node device to obtain a first decryption result; the opposite node device is a device that establishes SA with the IPSec node device; if the first decryption result is a failure, the status of the SA between the opposite node device and the IPSec node device is obtained by using a message detection method, and the status of the SA in the database is updated.
[0100] In some embodiments, the detection module is used to obtain the status of the SA between the peer node device by using the message detection method in the following manner: sending a preset detection message to the peer node device; if no reply message sent by the peer node device is received within a preset time period, or the reply message from the peer node device cannot be decrypted, determining that the status of the SA between the peer node device is an abnormal state; if a reply message sent by the peer node device is received within a preset time period and the reply message is successfully decrypted, determining that the status of the SA between the peer node device is a normal state.
[0101] In some embodiments, the detection module is used to repeatedly obtain the status of the SA with the opposite node device by using a message detection method for a preset number of times when the status of the SA with the opposite node device is abnormal; when the preset detection results all indicate that the status of the SA is abnormal, the SA is deleted from the database.
[0102] In some embodiments, the detection module is used to determine that the opposite node device is suspected to be attacked when the state of the SA between the IPSec node device and the opposite node device is abnormal, if the state of the SA between the IPSec node device and the other opposite node device is normal; wherein the opposite node device and the other opposite node devices are located in the same location area.
[0103] In some embodiments, the status acquisition module 1 is used to obtain the latest status of the first SA from the database when the latest status of the first SA recorded in the database is a normal status, the duration for which the latest status of the first SA is maintained is less than the configured effective duration, and the remaining survival duration corresponding to the first SA is less than the configured effective threshold; wherein the remaining survival duration represents the length of time from the current moment to the end of the SA's life cycle.
[0104] In some embodiments, the determination module 3 is configured to determine the first ESP message as an abnormal message when the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the first SA.
[0105] In some embodiments, the determination module 3 is used to decrypt the first ESP message using the second SA to obtain a second decryption result when the SPI carried by the first ESP message is consistent with the SPI corresponding to the first SA; if the second decryption result is a failure, the status of the SA between the target peer node device is obtained through message detection, and the status of the SA in the database is updated, and the target peer node device is the peer node device that sends the first ESP message.
[0106] It can be understood that the various embodiments described in the first embodiment are also applicable to the second embodiment if there is no conflict. Based on the consideration of brevity of description, they will not be repeated here.
[0107] Embodiment 3
[0108] Combination Figure 3 As shown, an embodiment of the present application provides an electronic device, including a processor 4 and a memory 5. Optionally, the device may also include a communication interface 6 and a bus 7. Among them, the processor 4, the communication interface 6, and the memory 5 can communicate with each other through the bus 7. The communication interface 6 can be used for information transmission. The processor 4 can call the logic instructions in the memory 5 to execute the message processing method of the above embodiment.
[0109] In addition, the logic instructions in the above-mentioned memory 5 can be implemented in the form of software functional units and can be stored in a computer-readable storage medium when sold or used as an independent product.
[0110] The memory 5 is a computer-readable storage medium that can be used to store software programs and computer executable programs, such as program instructions / modules corresponding to the method in the embodiment of the present application. The processor 4 executes the function application and data processing by running the program instructions / modules stored in the memory 5, that is, the message processing method in the above embodiment is implemented.
[0111] The memory 5 may include a program storage area and a data storage area, wherein the program storage area may store an operating system and an application required for at least one function; the data storage area may store data created according to the use of the terminal device, etc. In addition, the memory 5 may include a high-speed random access memory and may also include a non-volatile memory.
[0112] An embodiment of the present application provides a storage medium storing computer executable instructions, wherein the computer executable instructions are configured to execute the above-mentioned message processing method.
[0113] An embodiment of the present application provides a computer program product, which includes a computer program stored on a storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer executes the above-mentioned message processing method.
[0114] The computer-readable storage medium mentioned above may be a transient computer-readable storage medium or a non-transitory computer-readable storage medium.
[0115] The technical solution of the embodiment of the present application can be embodied in the form of a software product, which is stored in a storage medium and includes one or more instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in the embodiment of the present application. The aforementioned storage medium can be a non-transient storage medium, including: a USB flash drive, a mobile hard disk, a read-only memory, a random access memory, a magnetic disk or an optical disk, etc., which can store program codes, or a transient storage medium.
[0116] In the embodiments provided in the present application, it should be understood that the disclosed devices and methods can be implemented in other ways. The device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed.
[0117] The embodiments or examples of the present disclosure are not exhaustive, but are only illustrative of some embodiments or examples, and are not intended to be specific limitations on the scope of protection of the present disclosure. In the absence of contradiction, each step in a certain embodiment or example can be implemented as an independent example, and the steps can be combined arbitrarily. For example, the scheme after removing some steps in a certain embodiment or example can also be implemented as an independent example, and the order of the steps in a certain embodiment or example can be arbitrarily exchanged. In addition, the optional methods or optional examples in a certain embodiment or example can be combined arbitrarily; in addition, the various embodiments or examples can be combined arbitrarily, for example, some or all steps of different embodiments or examples can be combined arbitrarily, and a certain embodiment or example can be combined arbitrarily with the optional methods or optional examples of other embodiments or examples.
[0118] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.
[0119] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.
[0120] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.
Claims
1. A message processing method, characterized in that: Applied to an IPSec node device, the method comprises: When it is determined that there is no SA matching the first ESP message to be processed, acquiring from a database the latest state of the first SA matching the source IP address and the destination IP address carried by the first ESP message; In the case where the latest state of the first SA is a normal state, if the IPSec node device updates the first SA to obtain a second SA, the SPI carried by the first ESP message is compared with the SPI corresponding to the second SA; When the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the second SA, it is determined not to decrypt the first ESP message.
2. The method according to claim 1, characterized in that: The method further comprises: For a second ESP message sent by any peer node device of the IPSec node device, decrypt the second ESP message using the SA between the peer node device and the IPSec node device to obtain a first decryption result; If the first decryption result is failure, the state of the SA between the device and the opposite node is obtained by using a message detection method, and the state of the SA in the database is updated.
3. The method according to claim 2, characterized in that Acquiring the state of the SA with the opposite node device by using a message detection method includes: Sending a preset detection message to the opposite node device; In the case where no reply message sent by the opposite node device is received within a preset time period, determining that the state of the SA between the opposite node device and the opposite node device is an abnormal state; When a reply message sent by the opposite node device is received within a preset time period, it is determined that the state of the SA between the opposite node device and the opposite node device is a normal state.
4. The method according to claim 2, characterized in that: The method further comprises: When the state of the SA with the opposite node device is abnormal, repeatedly obtaining the state of the SA with the opposite node device by using a message detection method for a preset number of times; When the detection results of the preset times all indicate that the state of the SA is abnormal, the SA is deleted from the database.
5. The method according to claim 2, characterized in that: The method further comprises: In the case where the state of the SA between the IPSec node device and the opposite node device is an abnormal state, if the state of the SA between the IPSec node device and the other opposite node devices is a normal state, it is determined that the opposite node device is suspected to be attacked; wherein the opposite node device and the other opposite node devices are located in the same location area.
6. The method according to claim 1, characterized in that Acquiring from the database the latest state of the first SA that matches the source IP address and the destination IP address carried by the first ESP message, including: When the latest status of the first SA recorded in the database is a normal status, the duration for which the latest status of the first SA is maintained is less than the configured effective duration, and the remaining survival duration corresponding to the first SA is less than the configured effective threshold, the latest status of the first SA is obtained from the database; wherein the remaining survival duration represents the length of time from the current moment to the end of the SA's life cycle.
7. The method according to claim 1, characterized in that The method further comprises: When the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the second SA, the first ESP message is determined as an abnormal message.
8. The method according to claim 1, characterized in that The method further comprises: When the SPI carried by the first ESP message is consistent with the SPI corresponding to the second SA, decrypt the first ESP message using the second SA to obtain a second decryption result; If the second decryption result is failure, the state of the SA between the target peer node device and the target peer node device is obtained by message detection, and the state of the SA in the database is updated. The target peer node device is the peer node device that sends the first ESP message.
9. A message processing device, characterized in that: Applied to IPSec node equipment, the device comprises: a state acquisition module, which, when determining that there is no SA matching the first ESP message to be processed, acquires from a database the latest state of the first SA matching the source IP address and the destination IP address carried by the first ESP message; a comparison module, configured to compare the SPI carried by the first ESP message with the SPI corresponding to the second SA if the IPSec node device updates the first SA to obtain a second SA when the latest state of the first SA is a normal state; The determination module is used to determine not to decrypt the first ESP message when the SPI carried by the first ESP message is inconsistent with the SPI corresponding to the second SA.
10. An electronic device, characterized in that: It comprises a processor and a memory, wherein the memory stores computer executable instructions that can be executed by the processor, and the processor executes the computer executable instructions to implement the message processing method according to any one of claims 1 to 8.