A cryptographic protocol testing method and device for the xfrm framework

Abstract

The present invention discloses a cryptographic protocol testing method and device for an xfrm framework. The method determines an insertion point according to the characteristics of the xfrm framework; inserts an xfrm driver module through a static insertion module; inserts an xfrm kernel module through a kernel detection module; loads a static insertion driver, a kernel insertion driver, and a new xfrm driver after insertion; manually configures and issues SA and SP policies in user mode, and a network security device negotiates and configures a communication policy; calls an interface function of the xfrm driver module insertion and captures the driver insertion result; after the network security device completes the configuration of the communication policy, it performs encrypted communication and sends and receives IPSec messages; calls an interface function of the xfrm kernel module insertion and captures the kernel insertion result; checks and analyzes the cryptographic protocol test results of the xfrm framework, adjusts the insertion position, modifies the configuration policy, and performs iterative testing. The present invention can improve test efficiency and observability.

Description

Technical Field

[0001] The present invention relates to the technical field of cryptographic protocol testing, and in particular to a cryptographic protocol testing method and device for an XFRM framework. Background Art

[0002] Network cryptography machines typically establish secure communication channels over public networks using the IPSec protocol to ensure the confidentiality, integrity, and authentication of data transmissions. The XFRM framework, a scalable functional framework introduced by the Linux 2.6 kernel for security processing, allows network cryptography machines to implement IPSec based on the XFRM framework. XFRM is used to issue security alliances and configure security policies, thus fulfilling the network cryptography machine's business functions.

[0003] Currently, to ensure security and increase communication speeds, network cryptographic equipment manufacturers often use algorithm chips or algorithm cards instead of the soft algorithms provided by the Linux kernel, but still use the xfrm framework to implement the IPSec protocol. Cryptographic protocols implemented in this way often suffer from the following issues: First, consistency issues with the cryptographic protocol implementation and technical specifications; second, incorrect implementation of cryptographic protocol functions; and third, security issues with the cryptographic protocol implementation. The theoretical security of the IPSec protocol does not necessarily represent the security of the actual engineering implementation. Existing testing methods for cryptographic protocols are relatively scarce, and the inherent complexity of the cryptographic protocols often results in inadequate and untargeted testing. Furthermore, the observability of the testing process and results is poor, resulting in low testing efficiency.

[0004] Therefore, how to invent a cryptographic protocol testing method for the xfrm framework and improve testing efficiency has become an urgent problem to be solved. Summary of the Invention

[0005] To this end, the present invention provides a cryptographic protocol testing method and device for the xfrm framework. By deploying a kernel plug-in module in the xfrm framework, different plug-in methods are performed according to different functional modules of the xfrm framework. When the network device uses the xfrm interface, the plug-in results are captured to achieve the purpose of testing the cryptographic protocol function and security.

[0006] To achieve the above objectives, the present invention provides the following technical solution: a cryptographic protocol testing method for the xfrm framework, comprising:

[0007] Determine the insertion points based on the characteristics of the xfrm framework;

[0008] Use the static instrumentation module to instrument the xfrm driver module and generate a static instrumentation driver;

[0009] Use the kernel detection module to insert the xfrm kernel module and generate a kernel insertion driver;

[0010] Load the static instrumentation driver, the kernel instrumentation driver, and the new xfrm driver after instrumentation;

[0011] SA and SP policies are manually configured and delivered in user mode, and network security devices negotiate and configure communication policies.

[0012] Call the xfrm driver module instrumentation interface function to capture the driver instrumentation results; transmit the driver instrumentation results from the kernel layer to the user layer through the netlink communication mechanism and store them in the database;

[0013] After the network security device completes the configuration of communication policies, it performs encrypted communication and sends and receives IPSec messages;

[0014] Calling the xfrm kernel module instrumentation interface function to capture the kernel instrumentation result; transmitting the kernel instrumentation result from the kernel layer to the user layer through the netlink communication mechanism, and storing it in the database;

[0015] Review and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; adjust the insertion position and modify the configuration strategy based on the analysis results, test requirements, and test phenomena, and perform iterative testing.

[0016] As a preferred solution for the cryptographic protocol testing method of the xfrm framework, the steps of inserting the xfrm kernel module by the kernel detection module are as follows:

[0017] By setting conditional judgment, confirm the entry function of sending and receiving IPSec packets into the xfrm framework;

[0018] According to the entry function of the xfrm framework, analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it;

[0019] Determine the subsequent processing flow based on the judgment result.

[0020] Obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; based on the execution result, confirm whether the key node function is called and executed and the execution status;

[0021] The kernel detection is fixed in the xfrm framework to generate the kernel instrumentation driver.

[0022] As a preferred solution for the cryptographic protocol testing method of the xfrm framework, the steps of inserting the xfrm driver module by the static insertion module are as follows:

[0023] Find the source code file opened by the xfrm framework and insert program statements into the source code file;

[0024] Analyze the code structure and interface function parameters of the source code file; find SA and SP processing functions from the source code file;

[0025] Capture the instrumentation results through the static instrumentation driver;

[0026] Calling the instrumentation interface from the source code file;

[0027] The source code file after the insertion is compiled to generate a new xfrm driver, and the driver is loaded.

[0028] As a preferred solution for the cryptographic protocol testing method of the xfrm framework, in the process of confirming that the IPSec message is sent and received and entering the entry function of the xfrm framework through the set condition judgment, when the message is sent, xfrm searches the message routing for whether there is an SA that meets the conditions. If not, it goes to ip_output(); if so, it enters the xfrm processing process;

[0029] When receiving a message, the kernel network protocol stack is judged. If the protocol is ESP or AH, the xfrm framework is entered for reception.

[0030] As a preferred solution for the cryptographic protocol testing method of the xfrm framework, in the process of capturing the instrumentation results through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation results through configuration management technology.

[0031] The present invention also provides a cryptographic protocol testing device for the xfrm framework, based on the above cryptographic protocol testing method for the xfrm framework, comprising:

[0032] The insertion point confirmation unit is used to determine the insertion point according to the characteristics of the xfrm framework;

[0033] The xfrm driver module instrumentation processing unit is used to instrument the xfrm driver module through the static instrumentation module to generate a static instrumentation driver;

[0034] The xfrm kernel module stub processing unit stubs the xfrm kernel module through the kernel detection module and generates a kernel stub driver;

[0035] A driver loading unit, configured to load the static instrumented driver, the kernel instrumented driver, and the instrumented new xfrm driver;

[0036] The network security device configuration unit is used to manually configure and issue SA and SP policies in user mode, and the network security device negotiates and configures communication policies;

[0037] The driver instrumentation result capture unit is used to call the xfrm driver module instrumentation interface function to capture the driver instrumentation result; transmit the driver instrumentation result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database;

[0038] The encrypted communication processing unit is used to perform encrypted communication and send and receive IPSec messages after the network security device completes the configuration of the communication strategy;

[0039] A kernel instrumentation result capturing unit is configured to call an interface function of the xfrm kernel module instrumentation to capture kernel instrumentation results; transmit the kernel instrumentation results from the kernel layer to the user layer via the netlink communication mechanism, and store them in the database;

[0040] The cryptographic protocol test analysis and optimization unit is used to view and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion position is adjusted, the configuration strategy is modified, and iterative testing is performed.

[0041] As a preferred solution of a cryptographic protocol testing device for the xfrm framework, in the xfrm kernel module plugging processing unit, the kernel plugging processing subunit includes:

[0042] The entry function confirmation subunit is used to confirm the entry function of the IPSec message sent and received into the xfrm framework by setting conditions;

[0043] The key node analysis and processing subunit is used to analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process based on the entry function of the xfrm framework; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it;

[0044] The input parameter judgment processing subunit is used to judge the input parameter and obtain a judgment result; according to the judgment result, determine the subsequent processing flow;

[0045] The function execution result processing subunit is used to obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; according to the execution result, confirm whether the key node function is called and executed and the execution status;

[0046] The kernel instrumentation driver generation subunit is used to fix the kernel detection in the xfrm framework and generate the kernel instrumentation driver.

[0047] As a preferred solution of a cryptographic protocol testing device for the xfrm framework, in the xfrm driver module instrumentation processing unit, the driver instrumentation processing subunit includes:

[0048] A source code file search subunit is used to find the source code file opened by the xfrm framework and insert program statements into the source code file;

[0049] The source code file processing subunit is used to analyze the code structure and interface function parameters of the source code file; and find SA and SP processing functions from the source code file;

[0050] The instrumentation result capture subunit is used to capture the instrumentation result through the static instrumentation driver;

[0051] The instrumentation interface calling subunit is used to call the instrumentation interface from the source code file;

[0052] The new xfrm driver generation and loading subunit is used to compile the source code file after the insertion, generate a new xfrm driver, and load it.

[0053] As a preferred solution for the cryptographic protocol testing device of the xfrm framework, in the xfrm kernel module stub processing unit, when the set conditions are judged and the IPSec message is confirmed to enter the entry function of the xfrm framework, when the message is sent, xfrm searches the message routing for whether there is an SA that meets the conditions. If not, ip_output() is executed; if so, the xfrm processing process is entered;

[0054] When receiving a message, the kernel network protocol stack is judged. If the protocol is ESP or AH, the xfrm framework is entered for reception.

[0055] As a preferred solution for a cryptographic protocol testing device for the xfrm framework, in the xfrm driver module instrumentation processing unit, in the process of capturing the instrumentation results through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation results through configuration management technology.

[0056] The present invention has the following advantages: according to the characteristics of the xfrm framework, the insertion point is determined; the xfrm driver module is inserted through the static insertion module to generate a static insertion driver; the xfrm kernel module is inserted through the kernel detection module to generate a kernel insertion driver; the static insertion driver, the kernel insertion driver and the new xfrm driver after insertion are loaded; the SA and SP policies are manually configured and issued in the user state, and the network security device negotiates and configures the communication policy; the interface function of the xfrm driver module is called to capture the driver insertion result; the driver is inserted through the netlink communication mechanism The result is transmitted from the kernel layer to the user layer and stored in the database; after the network security device completes the configuration of the communication strategy, it performs encrypted communication and sends and receives IPSec messages; the interface function of the xfrm kernel module plug-in is called to capture the kernel plug-in result; the kernel plug-in result is transmitted from the kernel layer to the user layer through the netlink communication mechanism and stored in the database; the cryptographic protocol test result of the xfrm framework is viewed and analyzed to obtain the analysis result; according to the analysis result, test requirements and test phenomena, the plug-in position is adjusted, and the configuration strategy is modified to perform iterative testing. The present invention supplements the deficiencies of the network encryption device that implements the IPSec function based on the xfrm framework in testing the cryptographic protocol. By monitoring various key nodes, branch processes and other aspects during the operation of the cryptographic protocol through the kernel detection module, the static plug-in module and the configuration control module, a full range of tests are performed on the functionality, correctness and security of the cryptographic protocol implemented under the xfrm framework. At the same time, the kernel plug-in test method often ignores the functionality or logic of the program code itself in a traditional way, resulting in a large number of invalid test points and meaningless test results, making the test efficiency quite low. The cryptographic protocol testing method of the present invention is based on the concept of plug-in, but is targeted, analyzes the composition of the xfrm framework, distinguishes the part embedded in the kernel and the module that can be loaded / unloaded independently, and adopts different plug-in test methods for these two parts, with high flexibility. The cryptographic protocol testing method implementation process of the present invention for xfrm is extremely convenient, the test driver module code amount is extremely small, and it is easy to write. The tester can adjust the test strategy according to the stage test results at any time, and the "kernel detection module" and the "static plug-in module" are both implemented in a driving manner, which can achieve "loading as the test is carried out", the iterative upgrade speed is fast, the test efficiency is high, and a full test for the cryptographic protocol can be achieved. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] To more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for the embodiments or the description of the prior art. Obviously, the drawings described below are merely exemplary, and those skilled in the art can, without inventive effort, derive other implementation drawings based on the provided drawings.

[0058] The structures, proportions, sizes, etc. illustrated in this specification are intended solely to complement the contents disclosed herein and to facilitate understanding and reading by persons skilled in the art. They are not intended to limit the conditions under which the present invention may be implemented and therefore have no substantive technical significance. Any structural modifications, changes in proportions, or adjustments in sizes, without affecting the efficacy and objectives of the present invention, shall remain within the scope of the technical contents disclosed herein.

[0059] Figure 1 This is a flow chart of a cryptographic protocol testing method for the xfrm framework provided in Example 1 of the present invention;

[0060] Figure 2 This is a logical diagram of an instrumentation module in a cryptographic protocol testing method for an xfrm framework provided in Example 1 of the present invention;

[0061] Figure 3 This is a schematic diagram of the xfrm kernel part instrumentation process in a cryptographic protocol testing method for the xfrm framework provided in Example 1 of the present invention;

[0062] Figure 4 This is a schematic diagram of a specific implementation of xfrm kernel plugging in a cryptographic protocol testing method for an xfrm framework provided in Example 1 of the present invention;

[0063] Figure 5 This is a schematic diagram of the xfrm driver part instrumentation process in a cryptographic protocol testing method for the xfrm framework provided in Example 1 of the present invention;

[0064] Figure 6 This is a schematic diagram of a specific implementation process of xfrm driver instrumentation in a cryptographic protocol testing method for an xfrm framework provided in Example 1 of the present invention;

[0065] Figure 7 This is a schematic diagram of the architecture of a cryptographic protocol testing device for the xfrm framework provided in Example 2 of the present invention;

[0066] Figure 8 This is a schematic diagram of the architecture of a kernel plugging processing subunit in a cryptographic protocol testing device for an xfrm framework provided in Example 2 of the present invention;

[0067] Figure 9 This is a schematic diagram of the architecture of a driver instrumentation processing subunit in a cryptographic protocol testing device for an xfrm framework provided in Example 2 of the present invention. DETAILED DESCRIPTION

[0068] The following describes the implementation of the present invention using specific embodiments. Those skilled in the art will readily understand the other advantages and benefits of the present invention from the disclosure herein. Obviously, the embodiments described are only a portion of the present invention, not all of it. All other embodiments derived by persons of ordinary skill in the art based on the embodiments of the present invention without inventive effort are intended to fall within the scope of protection of the present invention.

[0069] Example 1

[0070] See also Figure 1 Embodiment 1 of the present invention provides a full disk encryption storage method transparent to an upper layer, comprising the following steps:

[0071] S1. Determine the insertion point according to the characteristics of the xfrm framework;

[0072] S2. Use the static instrumentation module to instrument the xfrm driver module and generate a static instrumentation driver;

[0073] S3. Use the kernel detection module to insert the xfrm kernel module and generate a kernel insertion driver;

[0074] S4, loading the static instrumentation driver, the kernel instrumentation driver, and the new xfrm driver after instrumentation;

[0075] S5. SA and SP policies are manually configured in user mode, and the network security device negotiates and configures the communication policy.

[0076] S6. Call the xfrm driver module instrumentation interface function to capture the driver instrumentation result; transmit the driver instrumentation result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database;

[0077] S7. After the network security device completes the configuration of the communication policy, it performs encrypted communication and sends and receives IPSec messages;

[0078] S8. Calling the xfrm kernel module instrumentation interface function to capture kernel instrumentation results; transmitting the kernel instrumentation results from the kernel layer to the user layer through the netlink communication mechanism, and storing them in the database;

[0079] S9. Check and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; adjust the insertion position and modify the configuration strategy according to the analysis results, test requirements and test phenomena, and perform iterative testing.

[0080] In this embodiment, the core of testing cryptographic protocols within the xfrm framework is the design and implementation of instrumentation technology. Instrumentation technology primarily performs instrumentation testing at three levels: kernel detection, static instrumentation, and configuration control. The kernel detection module directly scans the kernel driver symbol table to retrieve and call kernel functions of the object under test, eliminating the need to recompile xfrm. The static instrumentation module defines a standard instrumentation interface and encapsulates it into an instrumentation driver. The configuration control module, implemented using netlink technology, delivers instrumentation results to the application layer and serves as an auxiliary tool for the first two modules.

[0081] Specifically, such as Figure 2 As shown, the XFRM kernel and driver module A001: This module is part of the test object. A portion of the cryptographic protocol implemented based on the XFRM framework is embedded in the Linux kernel, responsible for sending and receiving IPSec packets. Another portion, as an independently loadable module, is responsible for configuring and processing key data in the IPSec protocol, SA and SP. The former processes sent or received IP packets, searches for policies, and encapsulates or decapsulates packets according to the configuration, forming part of the Linux network protocol stack. The latter configures and distributes security policies before executing encryption and decryption processes, determining the direction and processing of packet flow. Both are important components of the cryptographic protocol and are key locations for kernel instrumentation.

[0082] Kernel Probing B001: This module uses the jprobe method within kprobe to obtain input parameters for xfrm kernel-related interfaces and the kretprobe technique to obtain return values. This module tests the cryptographic protocols embedded within xfrm in the Linux kernel. Probing is targeted at specific locations, including entry points for sending and receiving IPSec messages, branches for searching for SAs, and key nodes for different protocols and encapsulation modes. This module primarily includes a series of ko functions for probing these key interfaces, which can be modified at any time based on requirements. The code is simple, flexible, and does not modify the original xfrm code. Using this module requires only batch loading of drivers.

[0083] Static Instrumentation B002: Defines a standard instrumentation interface. Instrumentation interface parameters include the function name of the instrumentation location, the line number of the instrumentation location, the data to be collected, and the data length. This module tests the cryptographic protocol of the xfrm driver module. The source code for this cryptographic protocol can be compiled into a separate module. Key functions include adding, deleting, modifying, and querying SA and SP. Instrumentation is performed using the standard instrumentation interface defined by the static instrumentation module at key cryptographic protocol function locations. To use this module, first load the static instrumentation module, then recompile and load the instrumented xfrm driver.

[0084] Configuration Management B003: Obtaining Instrumentation Test Results. Both the kernel detection module and the static instrumentation module instrument the Linux kernel layer. To facilitate test result analysis, instrumentation results must be fed back to user mode for statistical analysis. The configuration management module, serving as the technical support for the instrumentation module, uses the NetLink communication mechanism to send kernel messages to user-mode applications. During the test run, once the interface at the instrumentation location is executed, the instrumentation results are captured immediately. This module is embedded in the implementation of the kernel detection module and the static instrumentation module.

[0085] In this embodiment, in step S1, the insertion point is determined according to the characteristics of the xfrm framework;

[0086] Specifically, the basic principles of the xfrm framework are analyzed. The xfrm embedded in the kernel is mainly responsible for processing IPSec messages. The independent xfrm module that can be recompiled and loaded is mainly used to configure and add SA, SP, etc. before transmitting encrypted and decrypted messages, and to confirm the insertion points required for testing.

[0087] In this embodiment, in step S2, the xfrm driver module is instrumented by the static instrumentation module to generate a static instrumentation driver;

[0088] Specifically, we use a static instrumentation module to test the cryptographic protocol of the xfrm module. This module encapsulates a standard interface that can be inserted anywhere in the xfrm driver source code and captures the desired test data based on test requirements. Because this section of code is relatively small and recompilation is fast, the instrumentation points can be flexibly adjusted during testing based on test results to obtain detailed information.

[0089] Among them, such as Figure 5 and Figure 6 As shown in the figure, the steps for the static instrumentation module to instrument the xfrm driver module are:

[0090] S21. Find the source code file opened by the xfrm framework and insert program statements into the source code file;

[0091] Specifically, find the source code of xfrm_user.c opened by the xfrm framework. This source file provides various interfaces for upper-level users to configure various password protocols. The static instrumentation module directly inserts program statements into the xfrm_user.c file.

[0092] S22, analyzing the code architecture and interface function parameters of the source code file; and finding SA and SP processing functions from the source code file;

[0093] Specifically, the code architecture of the source code file, as well as the functions and parameters of each interface, are analyzed to find the functions in the source file for adding, deleting, updating, and obtaining SA (security alliance) and SP (security policy).

[0094] S23. Capture the instrumentation results through a static instrumentation driver;

[0095] Specifically, the static instrumentation module provides the insert.ko driver, which encapsulates the callable instrumentation interface insert_test and uses configuration management technology to capture the instrumentation results. At any location in the above function, add instrumentation statements according to test requirements to obtain the node information you want to collect, as well as key process data.

[0096] S24, calling the instrumentation interface from the source code file;

[0097] Specifically, the static instrumentation module directly calls the instrumentation interface in the source code. The source code of the function has been modified, so the xfrm_user.ko needs to be recompiled.

[0098] S25. Compile the source code file after the insertion to generate a new xfrm driver, and load it.

[0099] Specifically, the source code file after the stub is compiled to generate a new xfrm_user.ko, and the driver module is reloaded, waiting for the module interface to be called and executed.

[0100] In this embodiment, in step S3, the xfrm kernel module is instrumented by the kernel detection module to generate a kernel instrumentation driver;

[0101] Specifically, for the cryptographic protocol embedded in the kernel by xfrm, the kernel detection module is used for testing, the kernel symbol table provided by the Linux system is collected and queried, the interface functions related to xfrm are analyzed, and the kprobe driver for detecting these functions is written and compiled.

[0102] Among them, such as Figure 3 and Figure 4 As shown in the figure, the steps for the kernel detection module to insert the xfrm kernel module are:

[0103] S31, by setting condition judgment, confirm the entry function of sending and receiving IPSec messages into the xfrm framework;

[0104] Specifically, when instrumenting the xfrm kernel's IPSec message processing, the kernel detection module first locates the entry point function for sending and receiving messages into the xfrm framework. During message transmission, xfrm, after performing a route lookup, checks for a matching SA (using the xfrm4_lookup() interface). If not, it directly proceeds to ip_output(); otherwise, it enters the xfrm processing process. During message reception, if the kernel network protocol stack determines the protocol is ESP or AH, it enters the xfrm framework for reception (using the xfrm4_rcv interface).

[0105] S32. Analyze and obtain key nodes of the xfrm framework in the IPSec message processing process based on the entry function of the xfrm framework; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain and record the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology;

[0106] Specifically, based on the located xfrm interface function, the key nodes of the entire xfrm framework in the IPSec message processing process are analyzed, the relevant interface definition is found in the Linux kernel symbol table, and the kretprobe technology is used to detect and record the return value of the xfrm IPSec message processing function.

[0107] S33: judge the input parameters and obtain a judgment result; determine the subsequent processing flow according to the judgment result;

[0108] Specifically, when processing IPSec messages, xfrm will involve judging the input parameters, determining the next processing flow, using jprobe technology to obtain the input parameter values of xfrm during branch statement judgment, and tracking the execution path of the xfrm module.

[0109] S34. Obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; and confirm whether the key node function is called and executed and the execution status according to the execution result;

[0110] Specifically, the kretprobe technology is used to obtain the execution results of each key node function in the xfrm processing flow to confirm whether the function is called and executed and the execution status.

[0111] S35 , fixing the kernel detection in the xfrm framework, and generating the kernel instrumentation driver.

[0112] Specifically, all the aforementioned instrumentation operations are completed at the exit of the xfrm framework's message processing. The kernel detection is fixed within the xfrm framework, and a series of instrumentation drivers are generated. Configuration management techniques are used during driver development to capture the instrumentation results. All module drivers for the instrumentation are loaded, and the module interfaces are awaited for execution.

[0113] In this embodiment, in step S4, the static instrumentation driver, the kernel instrumentation driver, and the instrumented new xfrm driver are loaded;

[0114] Specifically, the "new" xfrm driver that is recompiled after the instrumentation in step S2 is loaded, and the kprobe series drivers customized according to the test requirements in step S3 are loaded in batches.

[0115] In this embodiment, in step S5, SA and SP policies are manually configured and issued through user mode, and the network security device negotiates and configures the communication policy;

[0116] Specifically, to achieve encrypted network communication, the network security device needs to negotiate and configure the communication strategy first. The SA and SP strategies can be manually configured and issued in the user state to achieve the negotiation process.

[0117] In this embodiment, in step S6, the interface function of the xfrm driver module is called to capture the driver instrumentation result; the driver instrumentation result is transmitted from the kernel layer to the user layer through the netlink communication mechanism and stored in the database;

[0118] Specifically, when executing step S5, the interface function that is instrumented in the xfrm driver module will be called, the instrumentation result will be captured, transmitted from the kernel layer to the user layer through the netlink communication mechanism, and stored in the database.

[0119] In this embodiment, in step S7, after the network security device completes configuring the communication policy, it performs encrypted communication and sends and receives IPSec messages;

[0120] Specifically, after the security policy is configured, network devices can perform encrypted communication and send and receive IPSec messages.

[0121] In this embodiment, in step S8, the interface function of the xfrm kernel module instrumentation is called to capture the kernel instrumentation result; the kernel instrumentation result is transmitted from the kernel layer to the user layer through the netlink communication mechanism and stored in the database;

[0122] Specifically, when step S7 is executed, the driver module interface for detection in the xfrm kernel layer will be called, the instrumentation result will be captured, transmitted from the kernel layer to the user layer via the netlink communication mechanism, and stored in the database.

[0123] In this embodiment, in step S9, the cryptographic protocol test results of the xfrm framework are viewed and analyzed to obtain analysis results; based on the analysis results, test requirements and test phenomena, the insertion position is adjusted, and the configuration strategy is modified to perform iterative testing.

[0124] Specifically, check the test results of the cryptographic protocol under the xfrm framework, analyze the test data, adjust the insertion position according to the test requirements and test phenomena, modify the configuration strategy, and jump back to step S301 for iterative testing.

[0125] In summary, the present invention determines the insertion point according to the characteristics of the xfrm framework; inserts the xfrm driver module through the static insertion module to generate a static insertion driver; inserts the xfrm kernel module through the kernel detection module to generate a kernel insertion driver; loads the static insertion driver, the kernel insertion driver and the new xfrm driver after insertion; manually configures and issues SA and SP policies in user mode, and the network security device negotiates and configures the communication policy; calls the interface function of the xfrm driver module to capture the driver insertion result; and transmits the driver insertion result through the netlink communication mechanism. The result is transmitted from the kernel layer to the user layer and stored in the database; after the network security device completes the configuration of the communication strategy, it performs encrypted communication and sends and receives IPSec messages; calls the interface function of the xfrm kernel module plug-in to capture the kernel plug-in result; transmits the kernel plug-in result from the kernel layer to the user layer through the netlink communication mechanism and stores it in the database; checks and analyzes the cryptographic protocol test results of the xfrm framework to obtain analysis results; adjusts the plug-in position according to the analysis results, test requirements and test phenomena, and modifies the configuration strategy for iterative testing. The present invention supplements the deficiencies of the network encryption device that implements the IPSec function based on the xfrm framework in testing the cryptographic protocol. It monitors various key nodes, branch processes and other aspects during the operation of the cryptographic protocol through the kernel detection module, the static plug-in module and the configuration control module, and conducts a comprehensive test of the functionality, correctness and security of the cryptographic protocol implemented under the xfrm framework. At the same time, the kernel plug-in test method often ignores the functionality or logic of the program code itself in a traditional way, resulting in a large number of invalid test points and meaningless test results, making the test efficiency quite low. The cryptographic protocol testing method of the present invention is based on the concept of plug-in, but is targeted, analyzes the composition of the xfrm framework, distinguishes the part embedded in the kernel and the module that can be loaded / unloaded independently, and adopts different plug-in test methods for these two parts, with high flexibility. The cryptographic protocol testing method implementation process of the present invention for xfrm is extremely convenient, the test driver module code amount is extremely small, and it is easy to write. The tester can adjust the test strategy according to the stage test results at any time, and the "kernel detection module" and the "static plug-in module" are both implemented in a driving manner, which can achieve "loading as the test is carried out", the iterative upgrade speed is fast, the test efficiency is high, and a full test for the cryptographic protocol can be achieved.

[0126] It should be noted that the method of the embodiments of the present disclosure can be performed by a single device, such as a computer or server. The method of the embodiments of the present disclosure can also be applied in a distributed scenario, where multiple devices cooperate to perform the method. In such a distributed scenario, one of the multiple devices may only perform one or more steps of the method of the embodiments of the present disclosure, and the multiple devices will interact with each other to complete the method.

[0127] It should be noted that the above description is limited to some embodiments of the present disclosure. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recited in the claims may be performed in an order different from that described in the above embodiments and still achieve the desired results. Furthermore, the processes depicted in the accompanying drawings do not necessarily require the specific order or sequential order shown to achieve the desired results. In certain embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0128] Example 2

[0129] See also Figure 7 Embodiment 2 of the present invention further provides a cryptographic protocol testing device for an xfrm framework, comprising:

[0130] Insertion point confirmation form 001 yuan, used to determine the insertion point according to the characteristics of the xfrm framework;

[0131] The xfrm driver module plugging processing unit 002 is used to plug the xfrm driver module through the static plugging module to generate a static plugging driver;

[0132] The xfrm kernel module plugging processing unit 003 plugs the xfrm kernel module through the kernel detection module to generate a kernel plugging driver;

[0133] The driver loading unit 004 is used to load the static instrumentation driver, the kernel instrumentation driver and the new xfrm driver after instrumentation;

[0134] Network security device configuration unit 005, used to manually configure and issue SA and SP policies in user mode, and the network security device negotiates and configures communication policies;

[0135] The driver instrumentation result capturing unit 006 is used to call the xfrm driver module instrumentation interface function to capture the driver instrumentation result; transmit the driver instrumentation result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database;

[0136] Encrypted communication processing unit 007, used for encrypted communication, sending and receiving IPSec messages after the network security device completes the configuration of communication strategy;

[0137] The kernel instrumentation result capturing unit 008 is used to call the interface function of the xfrm kernel module instrumentation to capture the kernel instrumentation result; transmit the kernel instrumentation result from the kernel layer to the user layer through the netlink communication mechanism, and store it in the database;

[0138] The cryptographic protocol test analysis and optimization unit 009 is used to view and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion position is adjusted, the configuration strategy is modified, and iterative testing is performed.

[0139] In this embodiment, Figure 8 As shown, in the xfrm kernel module plugging processing unit 003, the kernel plugging processing subunit includes:

[0140] The entry function confirmation subunit 031 is used to confirm the entry function of the IPSec message sent and received into the xfrm framework by setting conditions;

[0141] The key node analysis and processing subunit 032 is used to analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process based on the entry function of the xfrm framework; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology and record it;

[0142] The input parameter judgment processing subunit 033 is used to judge the input parameter and obtain a judgment result; and determine the subsequent processing flow according to the judgment result;

[0143] The function execution result processing subunit 034 is used to obtain the execution result of the key node function when the xfrm framework processes the IPSec message through the kretprobe technology; according to the execution result, confirm whether the key node function is called and executed and the execution status;

[0144] The kernel instrumentation driver generation subunit 035 is used to fix the kernel detection in the xfrm framework and generate the kernel instrumentation driver.

[0145] In this embodiment, Figure 9 As shown, in the xfrm driver module instrumentation processing unit 002, the driver instrumentation processing subunit includes:

[0146] The source code file search subunit 021 is used to find the source code file opened by the xfrm framework and insert program statements into the source code file;

[0147] The source code file processing subunit 022 is used to analyze the code structure and interface function parameters of the source code file; and to find SA and SP processing functions from the source code file;

[0148] The instrumentation result capturing subunit 023 is used to capture the instrumentation result through the static instrumentation driver;

[0149] The instrumentation interface calling subunit 024 is used to call the instrumentation interface from the source code file;

[0150] The new xfrm driver generation and loading subunit 025 is used to compile the source code file after the insertion, generate a new xfrm driver, and load it.

[0151] In this embodiment, in the xfrm kernel module plug-in processing unit 003, in the process of confirming that the IPSec message is sent and received and entering the entry function of the xfrm framework through the set condition judgment, when the message is sent, xfrm searches the message routing for whether there is an SA that meets the conditions. If not, ip_output() is executed; if so, the xfrm processing process is entered;

[0152] When receiving a message, the kernel network protocol stack is judged. If the protocol is ESP or AH, the xfrm framework is entered for reception.

[0153] In this embodiment, in the xfrm driver module instrumentation processing unit 002, in the process of capturing the instrumentation result through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation result through configuration management technology.

[0154] It should be noted that the information interaction, execution process, etc. between the modules of the above-mentioned system are based on the same concept as the method embodiment in Example 1 of the present application, and the technical effects they bring are the same as those of the method embodiment of the present application. For specific contents, please refer to the description in the method embodiment shown above in the present application, and no further details will be given here.

[0155] Example 3

[0156] Embodiment 3 of the present invention provides a non-transitory computer-readable storage medium, in which a program code for a cryptographic protocol testing method for an xfrm framework is stored. The program code includes instructions for executing embodiment 1 or any possible implementation thereof for a cryptographic protocol testing method for an xfrm framework.

[0157] Computer-readable storage media can be any available medium that can be accessed by a computer or a data storage device such as a server or data center that includes one or more available media. The available media can be magnetic media (e.g., floppy disks, hard disks, magnetic tapes), optical media (e.g., DVDs), or semiconductor media (e.g., solid-state drives (SSDs)).

[0158] Example 4

[0159] Embodiment 4 of the present invention provides an electronic device, including: a memory and a processor;

[0160] The processor and the memory communicate with each other through a bus; the memory stores program instructions that can be executed by the processor, and the processor calls the program instructions to execute a cryptographic protocol testing method for the xfrm framework of Example 1 or any possible implementation thereof.

[0161] Specifically, the processor can be implemented by hardware or by software. When implemented by hardware, the processor can be a logic circuit, an integrated circuit, etc.; when implemented by software, the processor can be a general-purpose processor, which is implemented by reading software code stored in a memory. The memory can be integrated into the processor or located outside the processor and exist independently.

[0162] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present invention is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable systems. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website, computer, server or data center to another website, computer, server or data center via a wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode.

[0163] Obviously, those skilled in the art will appreciate that the various modules or steps of the present invention described above can be implemented using a general-purpose computing system. They can be centralized on a single computing system or distributed across a network of multiple computing systems. Alternatively, they can be implemented using program code executable by a computing system, and thus, they can be stored in a storage system and executed by the computing system. In some cases, the steps shown or described herein can be performed in a different order than that shown, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module. Thus, the present invention is not limited to any particular combination of hardware and software.

[0164] Although the present invention has been described in detail above using general descriptions and specific embodiments, it will be apparent to those skilled in the art that modifications and improvements may be made thereto. Therefore, such modifications and improvements, without departing from the spirit of the present invention, are intended to be within the scope of protection claimed herein.

Claims

1. A cryptographic protocol testing method for the xfrm framework, characterized in that: include: Determine the insertion points based on the characteristics of the xfrm framework; Use the static instrumentation module to instrument the xfrm driver module and generate a static instrumentation driver; Use the kernel detection module to insert the xfrm kernel module and generate a kernel insertion driver; Load the static instrumentation driver, the kernel instrumentation driver, and the new xfrm framework driver after instrumentation; Manually configure and deliver security alliances (SAs) and security policies (SPs) in user mode, and network security devices negotiate and configure communication policies. Call the xfrm driver module instrumentation interface function to capture the driver instrumentation results; transmit the driver instrumentation results from the kernel layer to the user layer through the netlink communication mechanism and store them in the database; After the network security device completes the configuration of the communication policy, it performs encrypted communication and sends or receives IPSec messages; Calling the xfrm kernel module instrumentation interface function to capture the kernel instrumentation result; transmitting the kernel instrumentation result from the kernel layer to the user layer through the netlink communication mechanism, and storing it in the database; View and analyze the cryptographic protocol test results of the xfrm framework to obtain the analysis results; According to the analysis results, test requirements and test phenomena, the insertion points are adjusted, the configuration communication strategy is modified, and iterative testing is performed.

2. A cryptographic protocol testing method for the xfrm framework according to claim 1, characterized in that: The steps of inserting the xfrm kernel module by the kernel detection module are as follows: By setting conditional judgment, confirm the entry function of sending and receiving IPSec packets into the xfrm framework; According to the entry function of the xfrm framework, analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain the return value of the function of the key node when the xfrm framework processes the IPSec message through the kretprobe technology and record it; Determine the subsequent processing flow based on the judgment result. Obtain the execution result of the function of the key node when the xfrm framework processes the IPSec message through the kretprobe technology; according to the execution result, confirm whether the function of the key node is called and executed and the execution status; The kernel detection is fixed in the xfrm framework to generate the kernel instrumentation driver.

3. A cryptographic protocol testing method for the xfrm framework according to claim 2, characterized in that: The steps of inserting the xfrm driver module by the static inserting module are as follows: Find the source code file opened by the xfrm framework and insert program statements into the source code file; Analyze the code structure and interface function parameters of the source code file; find SA and SP processing functions from the source code file; Capture the instrumentation results through the static instrumentation driver; Calling the instrumentation interface from the source code file; Compile the source code file after the insertion to generate a new xfrm framework driver, and load it.

4. A cryptographic protocol testing method for the xfrm framework according to claim 3, characterized in that: In the process of confirming the entry function of the xfrm framework by setting conditions, when the message is sent, the xfrm framework searches the message routing for an SA that meets the conditions. If not, it goes to ip_output(); if so, it enters the xfrm framework processing process; When receiving a message, the kernel network protocol stack is judged. If the protocol is ESP or AH, the xfrm framework is entered for reception.

5. A cryptographic protocol testing method for the xfrm framework according to claim 4, characterized in that: In the process of capturing the instrumentation result through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation result through configuration management and control technology.

6. A cryptographic protocol testing device for an xfrm framework, adopting a cryptographic protocol testing method for an xfrm framework according to any one of claims 1 to 5, characterized in that: include: The insertion point confirmation unit is used to determine the insertion point according to the characteristics of the xfrm framework; The xfrm driver module instrumentation processing unit is used to instrument the xfrm driver module through the static instrumentation module to generate a static instrumentation driver; The xfrm kernel module stub processing unit stubs the xfrm kernel module through the kernel detection module and generates a kernel stub driver; A driver loading unit, configured to load the static instrumented driver, the kernel instrumented driver, and the instrumented new xfrm framework driver; The network security device configuration unit is used to manually configure and deliver the security alliance SA and security policy SP in user mode, so that the network security device can negotiate and configure the communication policy; The driver instrumentation result capture unit is used to call the xfrm driver module instrumentation interface function and capture the driver instrumentation result; The driver instrumentation result is transmitted from the kernel layer to the user layer through the netlink communication mechanism and stored in the database; The encrypted communication processing unit is used to perform encrypted communication and send or receive IPSec messages after the network security device completes the configuration of the communication strategy; A kernel instrumentation result capturing unit is configured to call an interface function of the xfrm kernel module instrumentation to capture kernel instrumentation results; transmit the kernel instrumentation results from the kernel layer to the user layer via the netlink communication mechanism, and store them in the database; The cryptographic protocol test analysis and optimization unit is used to view and analyze the cryptographic protocol test results of the xfrm framework to obtain analysis results; according to the analysis results, test requirements and test phenomena, the insertion points are adjusted, and the configuration communication strategy is modified to perform iterative testing.

7. A cryptographic protocol testing device for the xfrm framework according to claim 6, characterized in that: In the xfrm kernel module plugging processing unit, the kernel plugging processing sub-unit includes: The entry function confirmation subunit is used to confirm the entry function of the IPSec message sent and received into the xfrm framework by setting conditions; The key node analysis and processing subunit is used to analyze and obtain the key nodes of the xfrm framework in the IPSec message processing process based on the entry function of the xfrm framework; confirm the definition of the interface corresponding to the key node through the Linux kernel symbol table; obtain and record the return value of the function of the key node when the xfrm framework processes the IPSec message through the kretprobe technology; The input parameter judgment processing subunit is used to judge the input parameter and obtain a judgment result; according to the judgment result, determine the subsequent processing flow; The function execution result processing subunit is used to obtain the execution result of the function of the key node when the xfrm framework processes the IPSec message through the kretprobe technology; according to the execution result, confirm whether the function of the key node is called and executed and the execution status; The kernel instrumentation driver generation subunit is used to fix the kernel detection in the xfrm framework and generate the kernel instrumentation driver.

8. A cryptographic protocol testing device for the xfrm framework according to claim 7, characterized in that: In the xfrm driver module instrumentation processing unit, the driver instrumentation processing subunit includes: A source code file search subunit is used to find the source code file opened by the xfrm framework and insert program statements into the source code file; The source code file processing subunit is used to analyze the code structure and interface function parameters of the source code file; and find SA and SP processing functions from the source code file; The instrumentation result capture subunit is used to capture the instrumentation result through the static instrumentation driver; The instrumentation interface calling subunit is used to call the instrumentation interface from the source code file; The new xfrm framework driver generation and loading subunit is used to compile the source code file after the insertion, generate a new xfrm framework driver, and load it.

9. A cryptographic protocol testing device for the xfrm framework according to claim 8, characterized in that: In the xfrm kernel module plug-in processing unit, in the process of confirming that the IPSec message is sent and received by setting the conditions and entering the entry function of the xfrm framework, when the message is sent, the xfrm framework searches the message routing for whether there is an SA that meets the conditions. If not, ip_output() is executed; if so, the xfrm framework processing process is entered; When receiving a message, the kernel network protocol stack is judged. If the protocol is ESP or AH, the xfrm framework is entered for reception.

10. A cryptographic protocol testing device for the xfrm framework according to claim 9, characterized in that: In the xfrm driver module instrumentation processing unit, in the process of capturing the instrumentation result through the static instrumentation driver, the static instrumentation driver encapsulates a callable instrumentation interface, and captures the instrumentation result through configuration management and control technology.

Images