Cryptographic protocol test method and device for xfrm framework

Abstract

The invention discloses a cryptographic protocol testing method and device for an xfrm framework, and the method comprises the steps: determining an instrumentation point location according to the characteristics of the xfrm framework; performing instrumentation on the xfrm driving module through the static instrumentation module; performing instrumentation on the xfrm kernel module through the kernel detection module; loading the static instrumentation drive, the kernel instrumentation drive and the new xfrm drive after instrumentation; sA and SP strategies are manually configured and issued through a user mode, and the network security equipment negotiates and configures a communication strategy; calling an interface function of the instrumentation of the xfrm driving module, and capturing a driving instrumentation result; after the network security equipment completes configuration of the communication strategy, encryption communication is carried out, and an IPSec message is sent and received; calling an interface function of an xfrm kernel module instrumentation, and capturing a kernel instrumentation result; and checking and analyzing a cryptographic protocol test result of the xfrm framework, adjusting an instrumentation position, modifying a configuration strategy, and performing an iterative test. According to the invention, the test efficiency and observability can be improved.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic protocol testing, and in particular to a cryptographic protocol testing method and device for an xfrm framework. Background Art

[0002] Network cryptography machines generally establish secure communication channels on public networks through the IPSec protocol to ensure the confidentiality, integrity and authentication of data transmission. The xfrm framework is an extensible functional framework introduced by the Linux 2.6 kernel for security processing. Network cryptography machines can implement the IPSec protocol based on the xfrm framework, issue security alliances through xfrm, configure security policies, and realize the business functions of network cryptography machines.

[0003] At present, in order to ensure security and improve communication speed, network cryptographic equipment manufacturers often use algorithm chips or algorithm cards instead of the soft algorithms provided by the Linux kernel, but still use the xfrm framework to complete the implementation of the IPSec protocol. The cryptographic protocols implemented in this way often have the following problems: First, the consistency between the cryptographic protocol implementation and the technical specifications; second, the incorrect implementation of the cryptographic protocol functions; third, the security of the cryptographic protocol implementation. The theoretical security of the IPSec protocol does not represent the security of the engineering implementation. The existing testing methods for cryptographic protocols are relatively scarce, and the complexity of the cryptographic protocols themselves often leads to insufficient and non-targeted testing. There are also defects such as poor observability of the test process and results and low test efficiency.

[0004] Therefore, how to invent a cryptographic protocol testing method for the xfrm framework and improve testing efficiency has become an urgent problem to be solved. Summary of the invention

[0005] To this end, the present invention provides a cryptographic protocol testing method and device for an xfrm framework, by deploying a kernel plug-in module in the xfrm framework, performing plug-ins in different ways according to different functional modules of the xfrm framework, and capturing the plug-in results when the network device uses the xfrm interface to achieve the purpose of testing the cryptographic protocol function and security.

[0006] In order to achieve the above object, the present invention provides the following technical solution: a cryptographic protocol testing method for an xfrm framework, comprising:

[0007] Determine the insertion points according to the characteristics of the xfrm framework;

[0008] Use the static plug-in module to plug the xfrm driver module and generate a static plug-in driver;

[0009] Use the kernel detection module to insert the xfrm kernel module and generate a kernel insertion driver;

[0010] Load the static plug-in driver, the kernel plug-in driver and the plug-in new xfrm driver;

[0011] SA and SP policies are issued through manual configuration in user mode, and network security devices negotiate and configure communication policies;

[0012] Call the xfrm driver module plug-in interface function to capture the driver plug-in result; transmit the driver plug-in result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database;

[0013] After the network security device completes the configuration of the communication strategy, it performs encrypted communication and sends and receives IPSec messages;

[0014] Calling the xfrm kernel module plugging interface function to capture the kernel plugging result; transmitting the kernel plugging result from the kernel layer to the user layer through the netlink communication mechanism, and storing it in the database;

[0015] The cryptographic protocol test results of the xfrm framework are reviewed and analyzed to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion position is adjusted, the configuration strategy is modified, and iterative testing is performed.

[0016] As a preferred solution of the cryptographic protocol testing method for the xfrm framework, the steps of inserting the xfrm kernel module by the kernel detection module are as follows:

[0017] By setting conditional judgment, confirm the entry function of sending and receiving IPSec messages into the xfrm framework;

[0018] According to the entry function of the xfrm framework, analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it;

[0019] Judging the input parameters and obtaining a judgment result; determining the subsequent processing flow according to the judgment result;

[0020] Obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; confirm whether the key node function is called and executed and the execution status according to the execution result;

[0021] The kernel detection is fixed in the xfrm framework to generate the kernel stub driver.

[0022] As a preferred solution of the cryptographic protocol testing method for the xfrm framework, the steps of inserting the xfrm driver module by the static plugging module are as follows:

[0023] Find the source code file opened by the xfrm framework, and insert program statements into the source code file;

[0024] Analyze the code architecture and interface function parameters of the source code file; find SA and SP processing functions from the source code file;

[0025] Capture the instrumentation results through the static instrumentation driver;

[0026] Calling the stub interface from the source code file;

[0027] The source code file after the insertion is compiled to generate a new xfrm driver, and then load it.

[0028] As a preferred solution for the cryptographic protocol testing method of the xfrm framework, in the process of confirming the entry function of the xfrm framework by judging the set conditions, when the message is sent, xfrm searches the message route for SA that meets the conditions, if not, it goes to ip_output(); if yes, it enters the xfrm processing process;

[0029] When receiving a message, the kernel network protocol stack is judged. If the protocol is judged to be ESP or AH, the xfrm framework is entered for reception.

[0030] As a preferred solution for the cryptographic protocol testing method of the xfrm framework, in the process of capturing the instrumentation results through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation results through configuration management and control technology.

[0031] The present invention also provides a cryptographic protocol testing device for an xfrm framework, based on the above cryptographic protocol testing method for an xfrm framework, comprising:

[0032] The insertion point confirmation unit is used to determine the insertion point according to the characteristics of the xfrm framework;

[0033] The xfrm driver module plug-in processing unit is used to plug the xfrm driver module through the static plug-in module to generate a static plug-in driver;

[0034] The xfrm kernel module stub processing unit stubs the xfrm kernel module through the kernel detection module to generate a kernel stub driver;

[0035] A driver loading unit, used for loading the static plug-in driver, the kernel plug-in driver and the plug-in new xfrm driver;

[0036] A network security device configuration unit is used to manually configure and issue SA and SP policies through user mode, and the network security device negotiates and configures communication policies;

[0037] The driver instrumentation result capture unit is used to call the interface function of the xfrm driver module instrumentation to capture the driver instrumentation result; transmit the driver instrumentation result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database;

[0038] The encrypted communication processing unit is used to perform encrypted communication and send and receive IPSec messages after the network security device completes the configuration of the communication strategy;

[0039] A kernel plugging result capturing unit, used for calling the interface function of the xfrm kernel module plugging, capturing the kernel plugging result; transmitting the kernel plugging result from the kernel layer to the user layer through the netlink communication mechanism, and storing it in the database;

[0040] The cryptographic protocol test analysis and optimization unit is used to view and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion position is adjusted, the configuration strategy is modified, and iterative testing is performed.

[0041] As a preferred solution of a cryptographic protocol testing device for an xfrm framework, in the xfrm kernel module plugging processing unit, the kernel plugging processing subunit includes:

[0042] The entry function confirmation subunit is used to confirm the entry function of the IPSec message sent and received into the xfrm framework by setting conditions;

[0043] The key node analysis and processing subunit is used to analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process according to the entry function of the xfrm framework; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it;

[0044] The input parameter judgment processing subunit is used to judge the input parameter and obtain a judgment result; according to the judgment result, determine the subsequent processing flow;

[0045] The function execution result processing subunit is used to obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; according to the execution result, confirm whether the key node function is called for execution and the execution status;

[0046] The kernel plug-in driver generation subunit is used to fix the kernel detection in the xfrm framework and generate the kernel plug-in driver.

[0047] As a preferred solution of a cryptographic protocol testing device for an xfrm framework, in the xfrm driver module plugging processing unit, the driver plugging processing subunit includes:

[0048] A source code file search subunit is used to find the source code file opened by the xfrm framework and insert program statements into the source code file;

[0049] The source code file processing subunit is used to analyze the code architecture of the source code file and the functional parameters of the interface; and to find the SA and SP processing functions from the source code file;

[0050] The instrumentation result capture subunit is used to capture the instrumentation result through the static instrumentation driver;

[0051] The plug-in interface calling subunit is used to call the plug-in interface from the source code file;

[0052] The new xfrm driver generation and loading subunit is used to compile the source code file after the stub is inserted, generate a new xfrm driver, and load it.

[0053] As a preferred solution of the cryptographic protocol testing device for the xfrm framework, in the xfrm kernel module stub processing unit, in the process of confirming the entry function of the xfrm framework by judging the set conditions, when the message is sent, xfrm searches the message routing for whether there is an SA that meets the conditions, if not, ip_output() is executed; if yes, the xfrm processing process is entered;

[0054] When receiving a message, the kernel network protocol stack is judged. If the protocol is judged to be ESP or AH, the xfrm framework is entered for reception.

[0055] As a preferred solution for a cryptographic protocol testing device for an xfrm framework, in the xfrm driver module instrumentation processing unit, in the process of capturing the instrumentation result through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation result through configuration management and control technology.

[0056] The invention has the following advantages: according to the characteristics of the xfrm framework, the insertion point is determined; the xfrm driver module is inserted through the static insertion module to generate a static insertion driver; the xfrm kernel module is inserted through the kernel detection module to generate a kernel insertion driver; the static insertion driver, the kernel insertion driver and the inserted new xfrm driver are loaded; the SA and SP policies are sent down through the user state manual configuration, and the network security device negotiates and configures the communication policy; the interface function of the xfrm driver module is called to capture the driver insertion result; the driver is inserted through the netlink communication mechanism The result is transmitted from the kernel layer to the user layer and stored in the database; after the network security device completes the configuration of the communication strategy, it performs encrypted communication, sends and receives IPSec messages; calls the interface function of the xfrm kernel module plug-in to capture the kernel plug-in result; transmits the kernel plug-in result from the kernel layer to the user layer through the netlink communication mechanism, and stores it in the database; checks and analyzes the cryptographic protocol test results of the xfrm framework to obtain analysis results; according to the analysis results, test requirements and test phenomena, adjusts the plug-in position, modifies the configuration strategy, and performs iterative testing. The present invention supplements the deficiencies of the network encryption device based on the xfrm framework to implement the IPSec function in the test of the cryptographic protocol, monitors the key nodes, branch processes, etc. in the operation process of the cryptographic protocol through the kernel detection module, the static plug-in module and the configuration control module, and performs a comprehensive test on the functionality, correctness and security of the cryptographic protocol implementation under the xfrm framework. At the same time, the kernel plug-in test method often ignores the functionality or logic of the program code itself in the traditional way, resulting in a large number of invalid test points and meaningless test results, making the test efficiency quite low. The cryptographic protocol test method of the present invention is based on the concept of plug-in, but it is targeted, analyzes the composition of the xfrm framework, distinguishes the part embedded in the kernel and the module that can be loaded / unloaded independently, and adopts different plug-in test methods for these two parts, with high flexibility. The implementation process of the cryptographic protocol test method of the present invention for xfrm is extremely convenient, the test driver module code amount is extremely small, and it is easy to write. The tester can adjust the test strategy according to the stage test results at any time, and the "kernel detection module" and the "static plug-in module" are both implemented in a driving manner, which can achieve "loading as you test", fast iterative upgrade speed, high test efficiency, and can achieve full testing for the cryptographic protocol. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the implementation methods of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the implementation methods or the description of the prior art. Obviously, the drawings in the following description are only exemplary, and for ordinary technicians in this field, other implementation drawings can be derived from the provided drawings without creative work.

[0058] The structures, proportions, sizes, etc. illustrated in this specification are only used to match the contents disclosed in the specification so as to facilitate understanding and reading by persons familiar with the technology. They are not used to limit the conditions under which the present invention can be implemented, and therefore have no substantial technical significance. Any structural modification, change in proportion or adjustment of size shall still fall within the scope of the technical contents disclosed in the present invention without affecting the effects and purposes that can be achieved by the present invention.

[0059] Figure 1 A flowchart of a cryptographic protocol testing method for an xfrm framework provided in Embodiment 1 of the present invention;

[0060] Figure 2 A logical schematic diagram of an insert module in a cryptographic protocol testing method for an xfrm framework provided in Example 1 of the present invention;

[0061] Figure 3 A schematic diagram of the xfrm kernel part plugging process in a cryptographic protocol testing method for an xfrm framework provided in Example 1 of the present invention;

[0062] Figure 4 A schematic diagram of a specific implementation of xfrm kernel plugging in a cryptographic protocol testing method for an xfrm framework provided in Example 1 of the present invention;

[0063] Figure 5 A schematic diagram of the plugging process of the xfrm driver part in a cryptographic protocol testing method for the xfrm framework provided in Example 1 of the present invention;

[0064] Figure 6 A schematic diagram of a specific implementation process of xfrm driver plugging in a cryptographic protocol testing method for an xfrm framework provided in Example 1 of the present invention;

[0065] Figure 7 This is a schematic diagram of the architecture of a cryptographic protocol testing device for an xfrm framework provided in Embodiment 2 of the present invention;

[0066] Figure 8 This is a schematic diagram of the architecture of a kernel plugging processing subunit in a cryptographic protocol testing device for an xfrm framework provided in Embodiment 2 of the present invention;

[0067] Fig. 9 This is a schematic diagram of the architecture of a driver plugging processing subunit in a cryptographic protocol testing device for an xfrm framework provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0068] The following is a description of the implementation of the present invention by specific embodiments. People familiar with the art can easily understand other advantages and effects of the present invention from the contents disclosed in this specification. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0069] Example 1

[0070] See also Figure 1 Embodiment 1 of the present invention provides a full disk encryption storage method transparent to an upper layer, comprising the following steps:

[0071] S1. Determine the insertion point according to the characteristics of the xfrm framework;

[0072] S2. Insert the xfrm driver module through the static insertion module to generate a static insertion driver;

[0073] S3, insert the xfrm kernel module through the kernel detection module to generate a kernel insertion driver;

[0074] S4, loading the static plug-in driver, the kernel plug-in driver and the plug-in new xfrm driver;

[0075] S5. SA and SP policies are issued through manual configuration in user mode, and the network security device negotiates and configures the communication policy;

[0076] S6, calling the xfrm driver module plugging interface function to capture the driver plugging result; transmitting the driver plugging result from the kernel layer to the user layer through the netlink communication mechanism, and storing it in the database;

[0077] S7, after the network security device completes the configuration of the communication strategy, it performs encrypted communication and sends and receives IPSec messages;

[0078] S8, calling the xfrm kernel module plugging interface function to capture the kernel plugging result; transmitting the kernel plugging result from the kernel layer to the user layer through the netlink communication mechanism, and storing it in the database;

[0079] S9. Check and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; adjust the insertion position and modify the configuration strategy according to the analysis results, test requirements and test phenomena, and perform iterative testing.

[0080] In this embodiment, the core of the test of the cryptographic protocol under the xfrm framework is to use the plug-in technology for design and implementation. The plug-in technology mainly performs plug-in testing from three levels: kernel detection, static plug-in, and configuration control. The kernel detection module directly scans the kernel driver symbol table to obtain and call the kernel function of the object under test without recompiling xfrm; the static plug-in module defines the standard plug-in interface and encapsulates it into a plug-in driver; the configuration control module is implemented based on netlink technology and is used to pass the plug-in results to the application layer. It is an auxiliary tool for the first two modules.

[0081] Specifically, Figure 2 As shown, XFRM kernel and driver module A001: This module belongs to the object under test. Part of the cryptographic protocol implemented based on the XFRM framework is embedded in the Linux kernel, responsible for the sending and receiving of IPSec messages; part of it is an independently loadable module responsible for the configuration and processing of key data SA and SP in the IPSec protocol. The former processes the sent or received IP messages, searches for policies, and encapsulates or decapsulates the messages according to the configuration, which is part of the Linux network protocol stack; the latter is to configure and issue security policies before executing business processes such as encryption and decryption, and determine the direction of message flow and processing methods. Both are important components of the cryptographic protocol and are also key locations for kernel plug-in.

[0082] Kernel detection B001: Based on the jprobe method in kprobe, the input parameter values ​​of the xfrm kernel-related interfaces are obtained, and the kretprobe technology is used to obtain the return value of the xfrm kernel-related interfaces. This is to test the cryptographic protocol embedded in the linux kernel of xfrm. The detection location is targeted, mainly including the entry function for sending and receiving IPSec messages, the branch for finding SA, the key node locations of different protocols and encapsulation modes, etc. This module mainly includes a series of kos for detecting the above key interfaces, which can be changed at any time according to needs. The code is simple, flexible, and does not modify the original content of xfrm. When using this module, you only need to load the driver in batches.

[0083] Static instrumentation B002: Define the standard instrumentation interface. The instrumentation interface parameters include the function name of the instrumentation location, the row number of the instrumentation location, the data to be collected and the data length, etc., to test the cryptographic protocol of the xfrm driver module. The source code of this part of the cryptographic protocol can be compiled into an independent module. The key functions include the addition, deletion, modification and query of SA and SP. Use the standard instrumentation interface defined by the static instrumentation module to perform instrumentation at the key function location of the cryptographic protocol. When using it, you need to load the static instrumentation module first, then recompile the instrumented xfrm driver and load it.

[0084] Configuration Management B003: Get the instrumentation test results. The instrumentation locations of the kernel detection module and the static instrumentation module are both in the Linux kernel layer. To facilitate the analysis of the test results, the instrumentation results need to be fed back to the user state for data statistics. As the technical support for the instrumentation module, the configuration management module uses the netlink communication mechanism to send kernel messages to the user state application. When the test is running, once the interface of the instrumentation location is executed, the instrumentation results will be captured in time. This module is embedded in the implementation of the kernel detection module and the static instrumentation module.

[0085] In this embodiment, in step S1, the insertion point is determined according to the characteristics of the xfrm framework;

[0086] Specifically, the basic principles of the xfrm framework are analyzed. The xfrm embedded in the kernel is mainly responsible for the processing of IPSec messages. The independent xfrm module that can be recompiled and loaded is mainly used to provide configuration and addition of SA, SP, etc. before transmitting encrypted and decrypted messages, and to confirm the insertion points required for testing.

[0087] In this embodiment, in step S2, the xfrm driver module is plugged by the static plugging module to generate a static plugging driver;

[0088] Specifically, for the cryptographic protocol of the xfrm module, a static plug-in module is used for testing. The standard interface encapsulated by the static plug-in module can be inserted into any position of the xfrm driver source code, and the desired test data can be captured according to the test requirements. Since the amount of code in this part is small and the recompilation speed is fast, the plug-in points can be flexibly adjusted according to the test results during testing to obtain detailed information.

[0089] Among them, Figure 5 and Figure 6 As shown, the steps for the static instrumentation module to instrument the xfrm driver module are:

[0090] S21, find the source code file opened by the xfrm framework, and insert program statements into the source code file;

[0091] Specifically, find the source code of xfrm_user.c opened by the xfrm framework. This source file provides various interfaces for upper-level users to configure various password protocols. The static stub module directly inserts program statements in the xfrm_user.c file.

[0092] S22, analyzing the code architecture of the source code file and the functional parameters of the interface; and finding SA and SP processing functions from the source code file;

[0093] Specifically, the code architecture of the source code file, as well as the functions and parameters of each interface, are analyzed to find the functions in the source file for adding, deleting, updating, and obtaining SA (security alliance) and SP (security policy).

[0094] S23, capturing the instrumentation result through a static instrumentation driver;

[0095] Specifically, the static instrumentation module provides the insert.ko driver, which encapsulates the callable instrumentation interface insert_test and uses configuration management technology to capture the instrumentation results. At any position in the above function, add instrumentation statements according to test requirements to obtain the node information you want to collect, as well as key process data.

[0096] S24, calling the stub interface from the source code file;

[0097] Specifically, the static instrumentation module directly calls the instrumentation interface in the source code. The source code of the function has been modified, so the xfrm_user.ko needs to be recompiled.

[0098] S25, compile the source code file after the insertion, generate a new xfrm driver, and load it.

[0099] Specifically, the source code file after the stub is compiled to generate a new xfrm_user.ko, and the driver module is reloaded, waiting for the module interface to be called and executed.

[0100] In this embodiment, in step S3, the xfrm kernel module is plugged by the kernel detection module to generate a kernel plugged driver;

[0101] Specifically, for the cryptographic protocol embedded in the kernel of xfrm, the kernel detection module is used for testing, the kernel symbol table provided by the Linux system is collected and queried, the interface functions related to xfrm are analyzed, and the kprobe driver for detecting these functions is written and compiled.

[0102] Among them, Figure 3 and Figure 4 As shown in the figure, the steps for the kernel detection module to insert the xfrm kernel module are:

[0103] S31, by setting conditional judgment, confirm the entry function of sending and receiving IPSec messages into the xfrm framework;

[0104] Specifically, when the kernel detection module inserts the xfrm kernel to process IPSec messages, it first finds the entry function for sending and receiving messages into the xfrm framework. During the message sending process, xfrm will find whether there is a SA that meets the conditions after the message routing search, that is, the interface xfrm4_lookup(). If not, it will go directly to ip_output(), otherwise it will enter the xfrm processing process. During the message receiving process, if the kernel network protocol stack determines that the protocol is ESP or AH, it will enter the xfrm framework for reception, that is, the interface xfrm4_rcv.

[0105] S32, according to the entry function of the xfrm framework, analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it;

[0106] Specifically, according to the located xfrm interface function, the key nodes of the entire xfrm framework in the IPSec message processing process are analyzed, the relevant interface definition is found in the Linux kernel symbol table, and the kretprobe technology is used to detect and record the return value of the xfrm IPSec message processing function.

[0107] S33, judging the input parameter and obtaining a judgment result; and determining a subsequent processing flow according to the judgment result;

[0108] Specifically, when processing IPSec messages, xfrm will involve judging the input parameters, determine the direction of the next processing flow, use jprobe technology to obtain the input parameter values ​​of xfrm when judging the branch statement, and track the execution path of the xfrm module.

[0109] S34, obtaining the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; according to the execution result, confirming whether the key node function is called for execution and the execution status;

[0110] Specifically, the kretprobe technology is used to obtain the execution results of each key node function in the xfrm processing flow to confirm whether the function is called and executed and the execution status.

[0111] S35, fixing the kernel detection in the xfrm framework, and generating the kernel stub driver.

[0112] Specifically, all the above-mentioned plugging operations are completed at the exit of the xfrm framework processing message, the kernel detection is fixed in the xfrm framework, a series of plugging drivers are generated, and configuration control technology is used when writing drivers to capture the plugging results. All the module drivers of the above-mentioned plugging are loaded, and the module interface is called and executed.

[0113] In this embodiment, in step S4, the static plug-in driver, the kernel plug-in driver and the plug-in new xfrm driver are loaded;

[0114] Specifically, the "new" xfrm driver that is recompiled after the stub is inserted in step S2 is loaded, and the kprobe series drivers customized according to the test requirements in step S3 are loaded in batches.

[0115] In this embodiment, in step S5, SA and SP policies are issued through manual configuration in user mode, and the network security device negotiates and configures the communication policy;

[0116] Specifically, in order to realize encrypted network communication, the network security device needs to negotiate first and configure the communication strategy. The SA and SP strategies can be manually configured and issued in the user state to realize the negotiation process.

[0117] In this embodiment, in step S6, the interface function of the xfrm driver module plugging is called to capture the driver plugging result; the driver plugging result is transmitted from the kernel layer to the user layer through the netlink communication mechanism and stored in the database;

[0118] Specifically, when executing step S5, the interface function that is plugged in the xfrm driver module will be called, the plugging result will be captured, transmitted from the kernel layer to the user layer through the netlink communication mechanism, and stored in the database.

[0119] In this embodiment, in step S7, after the network security device completes configuring the communication strategy, it performs encrypted communication and sends and receives IPSec messages;

[0120] Specifically, after the security policy is configured, the network devices can perform encrypted communication and send and receive IPSec messages.

[0121] In this embodiment, in step S8, the interface function of the xfrm kernel module plugging is called to capture the kernel plugging result; the kernel plugging result is transmitted from the kernel layer to the user layer through the netlink communication mechanism, and stored in the database;

[0122] Specifically, when executing step S7, the driver module interface for detection in the xfrm kernel layer will be called, the instrumentation result will be captured, transmitted from the kernel layer to the user layer through the netlink communication mechanism, and stored in the database.

[0123] In this embodiment, in step S9, the cryptographic protocol test results of the xfrm framework are viewed and analyzed to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion position is adjusted, and the configuration strategy is modified to perform iterative testing.

[0124] Specifically, check the test results of the cryptographic protocol under the xfrm framework, analyze the test data, adjust the insertion position according to the test requirements and test phenomena, modify the configuration strategy, and jump back to step S301 for iterative testing.

[0125] In summary, the present invention determines the insertion point according to the characteristics of the xfrm framework; inserts the xfrm driver module through the static insertion module to generate a static insertion driver; inserts the xfrm kernel module through the kernel detection module to generate a kernel insertion driver; loads the static insertion driver, the kernel insertion driver and the new xfrm driver after insertion; manually configures and issues SA and SP policies in user mode, and the network security device negotiates and configures the communication strategy; calls the interface function of the xfrm driver module to capture the driver insertion result; and transmits the driver insertion result through the netlink communication mechanism. The result is transmitted from the kernel layer to the user layer and stored in the database; after the network security device completes the configuration of the communication strategy, it performs encrypted communication, sends and receives IPSec messages; calls the interface function of the xfrm kernel module plug-in to capture the kernel plug-in result; transmits the kernel plug-in result from the kernel layer to the user layer through the netlink communication mechanism, and stores it in the database; checks and analyzes the cryptographic protocol test results of the xfrm framework to obtain the analysis results; according to the analysis results, test requirements and test phenomena, adjusts the plug-in position, modifies the configuration strategy, and performs iterative testing. The present invention supplements the deficiencies of the network encryption device based on the xfrm framework to implement the IPSec function in the test of the cryptographic protocol, monitors the various key nodes, branch processes, etc. in the operation process of the cryptographic protocol through the kernel detection module, the static plug-in module and the configuration control module, and performs a comprehensive test on the functionality, correctness and security of the cryptographic protocol implementation under the xfrm framework. At the same time, the kernel plug-in test method often ignores the functionality or logic of the program code itself in the traditional way, resulting in a large number of invalid test points and meaningless test results, making the test efficiency quite low. The cryptographic protocol test method of the present invention is based on the concept of plug-in, but it is targeted, analyzes the composition of the xfrm framework, distinguishes the part embedded in the kernel and the module that can be loaded / unloaded independently, and adopts different plug-in test methods for these two parts, with high flexibility. The implementation process of the cryptographic protocol test method of the present invention for xfrm is extremely convenient, the test driver module code amount is extremely small, and it is easy to write. The tester can adjust the test strategy according to the stage test results at any time, and the "kernel detection module" and the "static plug-in module" are both implemented in a driving manner, which can achieve "loading as you test", fast iterative upgrade speed, high test efficiency, and can achieve full testing for the cryptographic protocol.

[0126] It should be noted that the method of the embodiment of the present disclosure can be performed by a single device, such as a computer or a server. The method of the present embodiment can also be applied in a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present disclosure, and the multiple devices will interact with each other to complete the described method.

[0127] It should be noted that the above describes some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0128] Example 2

[0129] See also Figure 7 Embodiment 2 of the present invention further provides a cryptographic protocol testing device for an xfrm framework, comprising:

[0130] The insertion point confirmation form of 001 yuan is used to determine the insertion point according to the characteristics of the xfrm framework;

[0131] The xfrm driver module plugging processing unit 002 is used to plug the xfrm driver module through the static plugging module to generate a static plugging driver;

[0132] The xfrm kernel module plugging processing unit 003 plugs the xfrm kernel module through the kernel detection module to generate a kernel plugging driver;

[0133] The driver loading unit 004 is used to load the static plug-in driver, the kernel plug-in driver and the plug-in new xfrm driver;

[0134] The network security device configuration unit 005 is used to manually configure and issue SA and SP policies through user mode, and the network security device negotiates and configures communication policies;

[0135] The driver plugging result capturing unit 006 is used to call the plugging interface function of the xfrm driver module to capture the driver plugging result; transmit the driver plugging result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database;

[0136] Encrypted communication processing unit 007, used for encrypted communication, sending and receiving IPSec messages after the network security device completes the configuration of communication strategy;

[0137] The kernel plugging result capturing unit 008 is used to call the interface function of the xfrm kernel module plugging to capture the kernel plugging result; transmit the kernel plugging result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database;

[0138] The cryptographic protocol test analysis and optimization unit 009 is used to view and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion position is adjusted, and the configuration strategy is modified to perform iterative testing.

[0139] In this embodiment, Figure 8 As shown, in the xfrm kernel module plugging processing unit 003, the kernel plugging processing subunit includes:

[0140] The entry function confirmation subunit 031 is used to confirm the entry function of the IPSec message sent and received into the xfrm framework by setting conditions;

[0141] The key node analysis and processing subunit 032 is used to analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process according to the entry function of the xfrm framework; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it;

[0142] The input parameter judgment processing subunit 033 is used to judge the input parameter and obtain a judgment result; according to the judgment result, determine the subsequent processing flow;

[0143] The function execution result processing subunit 034 is used to obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; according to the execution result, confirm whether the key node function is called for execution and the execution status;

[0144] The kernel plug-in driver generation subunit 035 is used to fix the kernel detection in the xfrm framework and generate the kernel plug-in driver.

[0145] In this embodiment, Fig. 9 As shown, in the xfrm driver module plugging processing unit 002, the driver plugging processing subunit includes:

[0146] The source code file search subunit 021 is used to find the source code file opened by the xfrm framework and insert program statements into the source code file;

[0147] The source code file processing subunit 022 is used to analyze the code architecture and interface function parameters of the source code file; and to retrieve SA and SP processing functions from the source code file;

[0148] The instrumentation result capturing subunit 023 is used to capture the instrumentation result through a static instrumentation driver;

[0149] The plug-in interface calling subunit 024 is used to call the plug-in interface from the source code file;

[0150] The new xfrm driver generation and loading subunit 025 is used to compile the source code file after the insertion, generate a new xfrm driver, and load it.

[0151] In this embodiment, in the xfrm kernel module plugging processing unit 003, in the process of confirming that the IPSec message is sent and received and entering the entry function of the xfrm framework through the set condition judgment, when the message is sent, xfrm searches the message routing for whether there is an SA that meets the conditions, if not, it goes to ip_output(); if yes, it enters the xfrm processing process;

[0152] When receiving a message, the kernel network protocol stack is judged. If the protocol is judged to be ESP or AH, the xfrm framework is entered for reception.

[0153] In this embodiment, in the xfrm driver module instrumentation processing unit 002, in the process of capturing the instrumentation result through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation result through configuration management and control technology.

[0154] It should be noted that the information interaction, execution process, etc. between the modules of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the present application, and will not be repeated here.

[0155] Example 3

[0156] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code for a cryptographic protocol testing method for an xfrm framework is stored. The program code includes instructions for executing embodiment 1 or any possible implementation thereof for a cryptographic protocol testing method for an xfrm framework.

[0157] The computer-readable storage medium may be any available medium that can be accessed by a computer or a data storage device such as a server or a data center that includes one or more available media. The available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state drive (SSD)).

[0158] Example 4

[0159] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0160] The processor and the memory communicate with each other via a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute a cryptographic protocol testing method for the xfrm framework of Example 1 or any possible implementation thereof.

[0161] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor implemented by reading software codes stored in a memory. The memory can be integrated in the processor or can be located outside the processor and exist independently.

[0162] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable systems. The computer instructions can be stored in a computer-readable storage medium, or transmitted from a computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center.

[0163] Obviously, those skilled in the art should understand that the above modules or steps of the present invention can be implemented by a general computing system, they can be concentrated on a single computing system, or distributed on a network composed of multiple computing systems, and optionally, they can be implemented by a program code executable by a computing system, so that they can be stored in a storage system and executed by the computing system, and in some cases, the steps shown or described can be executed in a different order than here, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0164] Although the present invention has been described in detail above by general description and specific embodiments, it is obvious to those skilled in the art that some modifications or improvements can be made to the present invention. Therefore, these modifications or improvements made without departing from the spirit of the present invention all belong to the scope of protection claimed by the present invention.

Claims

1. A cryptographic protocol testing method for the xfrm framework, characterized in that: include: Determine the insertion points according to the characteristics of the xfrm framework; Use the static plug-in module to plug the xfrm driver module and generate a static plug-in driver; Use the kernel detection module to insert the xfrm kernel module and generate a kernel insertion driver; Load the static plug-in driver, the kernel plug-in driver and the plug-in new xfrm driver; SA and SP policies are issued through manual configuration in user mode, and network security devices negotiate and configure communication policies; Call the xfrm driver module plug-in interface function to capture the driver plug-in result; transmit the driver plug-in result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database; After the network security device completes the configuration of the communication strategy, it performs encrypted communication and sends and receives IPSec messages; Calling the xfrm kernel module plugging interface function to capture the kernel plugging result; transmitting the kernel plugging result from the kernel layer to the user layer through the netlink communication mechanism, and storing it in the database; The cryptographic protocol test results of the xfrm framework are reviewed and analyzed to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion position is adjusted, the configuration strategy is modified, and iterative testing is performed.

2. A cryptographic protocol testing method for the xfrm framework according to claim 1, characterized in that: The steps of inserting the xfrm kernel module by the kernel detection module are as follows: By setting conditional judgment, confirm the entry function of sending and receiving IPSec messages into the xfrm framework; According to the entry function of the xfrm framework, analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it; Judging the input parameters and obtaining a judgment result; determining the subsequent processing flow according to the judgment result; Obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; confirm whether the key node function is called and executed and the execution status according to the execution result; The kernel detection is fixed in the xfrm framework to generate the kernel stub driver.

3. A cryptographic protocol testing method for the xfrm framework according to claim 2, characterized in that: The steps of inserting the xfrm driver module by the static inserting module are as follows: Find the source code file opened by the xfrm framework, and insert program statements into the source code file; Analyze the code architecture and interface function parameters of the source code file; find SA and SP processing functions from the source code file; Capture the instrumentation results through the static instrumentation driver; Calling the stub interface from the source code file; The source code file after the insertion is compiled to generate a new xfrm driver, and then load it.

4. A cryptographic protocol testing method for the xfrm framework according to claim 3, characterized in that: In the process of confirming the entry function of the xfrm framework by judging through the set conditions, when the message is sent, xfrm searches the message route to see if there is an SA that meets the conditions. If not, ip_output() is executed; if yes, the xfrm processing process is entered; When receiving a message, the kernel network protocol stack is judged. If the protocol is judged to be ESP or AH, the xfrm framework is entered for reception.

5. A cryptographic protocol testing method for the xfrm framework according to claim 4, characterized in that: In the process of capturing the instrumentation result through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation result through configuration management and control technology.

6. A cryptographic protocol testing device for an xfrm framework, using a cryptographic protocol testing method for an xfrm framework as described in any one of claims 1 to 5, characterized in that: include: The insertion point confirmation unit is used to determine the insertion point according to the characteristics of the xfrm framework; The xfrm driver module plug-in processing unit is used to plug the xfrm driver module through the static plug-in module to generate a static plug-in driver; The xfrm kernel module stub processing unit stubs the xfrm kernel module through the kernel detection module to generate a kernel stub driver; A driver loading unit, used for loading the static plug-in driver, the kernel plug-in driver and the plug-in new xfrm driver; A network security device configuration unit is used to manually configure and issue SA and SP policies through user mode, and the network security device negotiates and configures communication policies; The driver instrumentation result capture unit is used to call the xfrm driver module instrumentation interface function and capture the driver instrumentation result; The driver instrumentation result is transmitted from the kernel layer to the user layer through the netlink communication mechanism and stored in the database; The encrypted communication processing unit is used to perform encrypted communication and send and receive IPSec messages after the network security device completes the configuration of the communication strategy; A kernel plugging result capturing unit, used for calling the interface function of the xfrm kernel module plugging, capturing the kernel plugging result; transmitting the kernel plugging result from the kernel layer to the user layer through the netlink communication mechanism, and storing it in the database; The cryptographic protocol test analysis and optimization unit is used to view and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion position is adjusted, the configuration strategy is modified, and iterative testing is performed.

7. A cryptographic protocol testing device for the xfrm framework according to claim 6, characterized in that: In the xfrm kernel module plugging processing unit, the kernel plugging processing subunit includes: The entry function confirmation subunit is used to confirm the entry function of the IPSec message sent and received into the xfrm framework by setting conditions; The key node analysis and processing subunit is used to analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process according to the entry function of the xfrm framework; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it; The input parameter judgment processing subunit is used to judge the input parameter and obtain a judgment result; according to the judgment result, determine the subsequent processing flow; The function execution result processing subunit is used to obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; according to the execution result, confirm whether the key node function is called for execution and the execution status; The kernel plug-in driver generation subunit is used to fix the kernel detection in the xfrm framework and generate the kernel plug-in driver.

8. A cryptographic protocol testing device for the xfrm framework according to claim 7, characterized in that: In the xfrm driver module plug-in processing unit, the driver plug-in processing subunit includes: A source code file search subunit is used to find the source code file opened by the xfrm framework and insert program statements into the source code file; The source code file processing subunit is used to analyze the code architecture of the source code file and the functional parameters of the interface; and to find the SA and SP processing functions from the source code file; The instrumentation result capture subunit is used to capture the instrumentation result through the static instrumentation driver; The plug-in interface calling subunit is used to call the plug-in interface from the source code file; The new xfrm driver generation and loading subunit is used to compile the source code file after the stub is inserted, generate a new xfrm driver, and load it.

9. A cryptographic protocol testing device for the xfrm framework according to claim 8, characterized in that: In the xfrm kernel module plug-in processing unit, in the process of confirming that the IPSec message is sent and received and entering the entry function of the xfrm framework through the set condition judgment, when the message is sent, xfrm searches the message routing for whether there is an SA that meets the conditions, if not, it goes to ip_output(); if yes, it enters the xfrm processing process; When receiving a message, the kernel network protocol stack is judged. If the protocol is judged to be ESP or AH, the xfrm framework is entered for reception.

10. A cryptographic protocol testing device for the xfrm framework according to claim 9, characterized in that: In the xfrm driver module instrumentation processing unit, in the process of capturing the instrumentation result through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation result through configuration management and control technology.

Images