Dynamic multipath secure communication method and device based on NP

Abstract

The invention relates to a dynamic multi-path secure communication method and equipment based on NP, and belongs to the field of network security technologies and network processors. According to the invention, the data messages are dispersed to different outlets at the sending end NP equipment and are transmitted to the receiving end NP equipment from different physical links, and the receiving end NP equipment automatically reorders the disordered messages, so that high-security and reliable transmission of data is realized; through the technical means of establishing flow tables at a transmitting end NP device and a receiving end NP device respectively, inserting algorithm identifiers and data labels into messages, and performing timed aging on the flow tables, data messages are dispersed to different physical links for transmission, and the receiving end is automatically disordered and rearranged, so that the method is not limited by four-layer protocol types, can support TCP / UDP protocols, and is high in reliability. And meanwhile, the sending path can be controlled by selecting different algorithms, the data packet is traceable, and the communication security is protected to the greatest extent.

Description

Technical Field

[0001] The invention belongs to the field of network security technology and network processor, and in particular relates to a dynamic multi-path security communication method and equipment based on NP. Background Art

[0002] In the field of encrypted information communication, the traditional method is for the client to encrypt the data, and the encrypted data is transmitted to the other end through a physical link, and then decrypted by the other end. This physical link may be insecure. Once it is eavesdropped, whether the data is secure depends entirely on the encryption method and the eavesdropper's ability to crack the encrypted data. Some high-security communications require data to be transmitted in a dispersed manner from multiple physical links, and the probability of multiple physical links being eavesdropped at the same time is very low, so the eavesdropper cannot crack the complete data.

[0003] The main technical difficulty of multi-path data transmission is that due to differences in transmission paths, network equipment delays, etc., packets may be out of order. Using the CPU to complete functions such as dynamic routing and out-of-order reordering of data packets places high demands on CPU performance resources. Under high network performance, the CPU's packet processing capability gradually becomes a bottleneck. Due to limited hardware resources, FPGAs have certain limitations when completing large-scale applications or complex control programs. Summary of the invention

[0004] 1. Technical issues to be resolved

[0005] The technical problem to be solved by the present invention is how to provide a dynamic multi-path secure communication method and device based on NP to solve the technical difficulties such as anti-eavesdropping and message disorder in high-security communication.

[0006] (II) Technical solution

[0007] In order to solve the above technical problems, the present invention proposes a dynamic multi-path secure communication method based on NP, the method comprising:

[0008] S1. The data message enters the sending NP device from the internal network interface. The message parsing module of the sending NP device extracts the message five-tuple to form a key to check the flow table. If it does not hit, it means it is the first packet. Then a new flow table is created for the flow, and the message number statistics and timestamp are recorded in the flow table. The subsequent message five-tuple checks the flow table. If it hits this flow table, it means it is the same flow, the message number is accumulated, and the message statistics and timestamp in the flow table are updated.

[0009] S2, hash the five-tuple of the message and the message sequence number, then take the remainder of the hash result and the number of exits to select an exit;

[0010] S3, the message editing module inserts 8 bytes of data after the message IP header, including: a 4-byte algorithm identifier and a 4-byte data tag, which are used to record the routing algorithm and the message sequence number, respectively, and are used for data tracing and reordering at the receiving end;

[0011] S4, the data message is sent out from the exit selected by S2 and transmitted to the receiving NP device through different physical links;

[0012] S5, the data message enters the receiving end NP device, extracts the message five-tuple to form a key to check the flow table, if it does not hit, it means it is the first packet, then a new flow table is created for the flow; if the subsequent message five-tuple table hits this flow table, it means it is the same flow, after hitting, it is determined whether it is a message to be forwarded according to the message sequence number recorded in the data label in the message, and then the corresponding processing is performed;

[0013] S6. The message editing module of the NP device at the receiving end deletes the inserted 8 bytes of data and restores the original message;

[0014] S7. The message after out-of-order re-arrangement is sent from the interface of the receiving NP device to the internal network.

[0015] The present invention also provides a dynamic multi-path security communication device based on NP, the communication device comprising: an NP unit, a CPU unit and a storage unit;

[0016] The NP unit is used for message diversion, forwarding and receiving disorderly reordering, and these functions are realized through programming;

[0017] The CPU unit is used for configuration management and sending routing algorithms and egress information to the table items of the storage unit;

[0018] The storage unit is used to store the flow table and cache messages;

[0019] The NP unit includes the following modules: message transceiver module, message parsing module, message editing module, table entry management module and timer module;

[0020] A message transceiver module is used to receive and send messages from the interface;

[0021] The message parsing module is used to parse the second and third layer information of the message header and extract the five-tuple information of the message;

[0022] The message editing module is used to modify, insert and delete the original message;

[0023] The table management module is used to create, search, delete, and update various table items such as flow tables;

[0024] The timer module generates timed events at set times for flow table aging processing.

[0025] (III) Beneficial effects

[0026] The present invention proposes a dynamic multi-path secure communication method and device based on NP. Compared with the prior art, the data messages of the present invention are dispersed to different exits at the sending end NP device, and transmitted to the receiving end NP device from different physical links. The receiving end NP device automatically reorders the disordered messages, thereby realizing highly secure and reliable transmission of data. By establishing flow tables at the sending end NP device and the receiving end NP device respectively, inserting algorithm identifiers and data tags into the messages, and using technical means such as timed aging of the flow tables, the data messages are dispersed to different physical links for transmission, and the receiving end automatically reorders them. The present invention is not limited by the four-layer protocol type and can support TCP / UDP protocols. At the same time, the sending path can be controlled by selecting different algorithms, and the data packets can be traced, thereby protecting the communication security to the greatest extent. BRIEF DESCRIPTION OF THE DRAWINGS

[0027] Figure 1 It is a schematic diagram of the overall logical structure of the present invention;

[0028] Figure 2 A schematic diagram of a message structure according to an embodiment of the present invention;

[0029] Figure 3 Schematic diagram of the table structure of an embodiment of the present invention;

[0030] Figure 4 Schematic diagram of the device structure of an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to make the purpose, content and advantages of the present invention more clear, the specific implementation methods of the present invention are further described in detail below in conjunction with the drawings and examples.

[0032] NP (Network Processor) has flexible programming, high processing performance and cost advantages, and is suitable for network data processing and forwarding. In order to solve the technical difficulties of anti-eavesdropping and message disorder in high-security communication, the present invention provides a dynamic multi-path secure communication method and device based on NP.

[0033] Figure 1 It is a schematic diagram of the overall logical structure of the technical solution of the present invention, such as Figure 1 As shown, the data message is distributed to different exits of the sending NP device and transmitted to the receiving NP device through different physical links. The receiving NP device automatically reorders the message to restore it. The specific steps include:

[0034] S1. The data message enters the sending NP device from the internal network interface. The message parsing module of the sending NP device extracts the message five-tuple to form a key to check the flow table (the flow table is a hash table). If it does not hit, it means it is the first packet. Then a new flow table is created for the flow, and the message count and timestamp are recorded in the flow table. The subsequent message five-tuple checks the flow table. If it hits this flow table, it means it is the same flow. The message count is accumulated, and the message statistics and timestamp in the flow table are updated. At the same time, the message count is used as the sequence number of the message.

[0035] S2. Hash the five-tuple of the message and the message sequence number, and then select an exit by taking the remainder of the hash result and the number of exits. The hash algorithm and the number of exits can be flexibly and dynamically configured.

[0036] S3, such as Figure 2 As shown, the message editing module inserts 8 bytes of data after the message IP header, including: a 4-byte algorithm identifier and a 4-byte data label, which are respectively used to record the routing algorithm and the message sequence number, and are respectively used for data tracing and disorder reordering at the receiving end.

[0037] S4. The data message is sent out from the exit selected by S2 and transmitted to the receiving NP device through different physical links.

[0038] S5, the data message enters the receiving end NP device, extracts the message five-tuple to form a key to check the flow table (the flow table is a hash table), if it does not hit, it means it is the first packet, then a new flow table is created for the flow, the flow table structure is as follows Figure 3 As shown. The flow table includes: timestamp, sequence number to be forwarded, Validbitmap, multiple message sequence numbers + message addresses. The timestamp records the time of the most recent hit table entry, the sequence number to be forwarded is the sequence number of the expected next message, the Validbitmap records the position of the valid message in the flow table, and the message sequence number + message address records the address of a certain sequence number message in the cache.

[0039] If the subsequent message hits this flow table in the five-tuple lookup, it means it is the same flow. After hitting the same flow, the message sequence number recorded in the data label in the message is used to determine whether it is a message to be forwarded, and then the corresponding processing is performed. The judgment principle is:

[0040] If the packet sequence number is greater than the sequence number to be forwarded in the flow table, it indicates that the sequence is out of order, so the packet is cached and recorded in the flow table;

[0041] The message sequence number is equal to the sequence number to be forwarded in the flow table, indicating that there is no disorder, the message is forwarded, and a check is made to see if there is a cached message in the flow table. If there is, it is sent out together, and the sequence number of the message to be forwarded in the flow table is updated at the same time.

[0042] The message sequence number is smaller than the sequence number to be forwarded in the flow table, and the message is sent directly.

[0043] S6. The message editing module of the receiving NP device deletes the inserted 8 bytes of data and restores the original message.

[0044] S7. The message after out-of-order re-arrangement is sent from the interface of the receiving NP device to the internal network.

[0045] Since each flow table has a limited number of cached messages, it is necessary to regularly clear the cached messages in the flow table. At the same time, in order to prevent a flow from occupying flow table resources for a long time, it is also necessary to regularly age inactive flow tables. The specific aging process is as follows:

[0046] When a flow table is created, a timer is started. According to the set polling time t1, when the timer expires, the flow table is read to determine whether there is a cached message. If there is, the message is sent out and the cache is cleared.

[0047] After the flow table is established, each time a message hits the flow table, the timestamp in the flow table is updated to record the active time of the flow table. Each time the polling time is up, the cached message is cleared and the timestamp in the flow table is read to determine whether the difference between the current time and the flow table timestamp is greater than the set aging time t2. If it is greater than t2, the flow table is deleted.

[0048] Furthermore, the message carries routing algorithm and sequence number information, through which the egress selected by the sending NP can be restored, thereby achieving the purpose of data tracing.

[0049] like Figure 4 As shown, the present invention provides a dynamic multi-path security communication device based on NP, including: an NP unit, a CPU unit and a storage unit.

[0050] The NP unit is used for message diversion, forwarding and receiving disorderly reordering functions, and these functions are realized through programming.

[0051] The CPU unit is used for configuration management and sends down the routing algorithm and export information to the table items of the storage unit.

[0052] The storage unit is used to store various table items such as flow tables and cache messages.

[0053] Further, the NP unit includes the following modules: a message transceiver module, a message parsing module, a message editing module, a table entry management module and a timer module;

[0054] The message transceiver module is used to receive and send messages from the interface.

[0055] The message parsing module is used to parse the second and third layer information of the message header and extract the five-tuple information of the message.

[0056] The message editing module is used to modify, insert, and delete the original message.

[0057] The entry management module is used to create, search, delete, and update various entries such as flow tables.

[0058] The timer module generates timed events at set times for flow table aging processing.

[0059] The present invention proposes a dynamic multi-path secure communication method and device based on NP. Compared with the prior art, the data messages of the present invention are dispersed to different exits at the sending end NP device, and transmitted to the receiving end NP device from different physical links. The receiving end NP device automatically reorders the disordered messages, thereby realizing highly secure and reliable transmission of data. By establishing flow tables at the sending end NP device and the receiving end NP device respectively, inserting algorithm identifiers and data tags into the messages, and using technical means such as timed aging of the flow tables, the data messages are dispersed to different physical links for transmission, and the receiving end automatically reorders them. The present invention is not limited by the four-layer protocol type and can support TCP / UDP protocols. At the same time, the sending path can be controlled by selecting different algorithms, and the data packets can be traced, thereby protecting the communication security to the greatest extent.

[0060] The above is only a preferred embodiment of the present invention. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the technical principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A dynamic multi-path secure communication method based on NP, characterized in that: The method includes: S1. The data message enters the sending NP device from the internal network interface. The message parsing module of the sending NP device extracts the message five-tuple to form a key to check the flow table. If it does not hit, it means it is the first packet. Then a new flow table is created for the flow, and the message count and timestamp are recorded in the flow table. The subsequent message five-tuple checks the flow table. If it hits this flow table, it means it is the same flow, the message count is accumulated, and the message statistics and timestamp in the flow table are updated. S2, hash the five-tuple of the message and the message sequence number, then take the remainder of the hash result and the number of exits to select an exit; S3, the message editing module inserts 8 bytes of data after the message IP header, including: a 4-byte algorithm identifier and a 4-byte data tag, which are used to record the routing algorithm and the message sequence number, respectively, and are used for data tracing and reordering at the receiving end; S4, the data message is sent out from the exit selected by S2 and transmitted to the receiving NP device through different physical links; S5, the data message enters the receiving end NP device, extracts the message five-tuple to form a key to check the flow table, if it does not hit, it means it is the first packet, then a new flow table is created for the flow; if the subsequent message five-tuple table hits this flow table, it means it is the same flow, after hitting, it is determined whether it is a message to be forwarded according to the message sequence number recorded in the data label in the message, and then the corresponding processing is performed; S6. The message editing module of the NP device at the receiving end deletes the inserted 8 bytes of data and restores the original message; S7. The message after out-of-order re-arrangement is sent from the interface of the receiving NP device to the internal network.

2. The NP-based dynamic multi-path secure communication method according to claim 1, characterized in that: Data messages are distributed to different exits of the sending NP device and transmitted to the receiving NP device through different physical links. The receiving NP device automatically reorders the messages to restore them.

3. The NP-based dynamic multi-path secure communication method according to claim 1, characterized in that: In S1, the number of messages is used as the sequence number of the message.

4. The NP-based dynamic multi-path secure communication method according to claim 1, characterized in that: The flow table is a hash table.

5. The NP-based dynamic multi-path secure communication method according to claim 1, characterized in that: In S5, the flow table includes: timestamp, sequence number to be forwarded, Validbitmap, multiple message sequence numbers + message addresses, the timestamp records the time of the most recent hit table entry, the sequence number to be forwarded is the sequence number of the expected next message, the Validbitmap records the position of the valid message in the flow table, and the message sequence number + message address records the address of a certain sequence number message in the cache.

6. The NP-based dynamic multi-path secure communication method according to claim 5, characterized in that: In S5, if the message sequence number recorded in the data tag in the message is greater than the sequence number to be forwarded in the flow table, it indicates disorder, and the message is cached and recorded in the flow table.

7. The NP-based dynamic multi-path secure communication method according to claim 5, characterized in that: In S5, if the message sequence number recorded in the data tag in the message is equal to the sequence number to be forwarded in the flow table, it means there is no disorder, the message is forwarded, and it is checked whether there is a cached message in the flow table. If there is, it is sent out together, and the sequence number of the message to be forwarded in the flow table is updated at the same time.

8. The NP-based dynamic multi-path secure communication method according to claim 5, characterized in that: In S5, if the message sequence number recorded in the data tag in the message is smaller than the sequence number to be forwarded in the flow table, the message is sent directly.

9. The NP-based dynamic multi-path secure communication method according to any one of claims 5 to 8, characterized in that: The method further includes: an aging process, which specifically includes: When a flow table is created, a timer is started. When the set polling time t1 expires, the flow table is read to determine whether there is a cached message. If there is, the message is sent out and the cache is cleared. After the flow table is established, each time a message hits the flow table, the timestamp in the flow table is updated to record the active time of the flow table; each time the polling time is up, the cached message is cleared and the timestamp in the flow table is read to determine whether the difference between the current time and the flow table timestamp is greater than the set aging time t2. If it is greater than t2, the flow table is deleted.

10. A NP-based dynamic multi-path secure communication device implementing the method of any one of claims 1-9, characterized in that: The communication device comprises: an NP unit, a CPU unit and a storage unit; The NP unit is used for message diversion, forwarding and receiving disorderly reordering, and these functions are realized through programming; The CPU unit is used for configuration management and sending routing algorithms and egress information to the table items of the storage unit; The storage unit is used to store the flow table and cache messages; The NP unit includes the following modules: message transceiver module, message parsing module, message editing module, table entry management module and timer module; A message transceiver module is used to receive and send messages from the interface; The message parsing module is used to parse the second and third layer information of the message header and extract the five-tuple information of the message; The message editing module is used to modify, insert and delete the original message; The table management module is used to create, search, delete, and update various table items such as flow tables; The timer module generates timed events at set times for flow table aging processing.

Images