IPSec traffic triggering method and device, electronic equipment and storage medium

Abstract

The invention relates to the field of network technology and security technology, in particular to an IPSec traffic triggering method and device, electronic equipment and a storage medium. The data forwarding module receives target message data sent by a previous node; the data forwarding module matches the target message data with each first preset strategy; if the target message data is successfully matched with a first target preset strategy in the first preset strategies, the IPSec negotiation module performs IPSec negotiation with target equipment corresponding to the target message data based on the first target preset strategy; and after the IPSec negotiation is successful, the data forwarding module transmits the target message data to the next node, so that the VPN equipment can realize traffic triggering IPSec active negotiation according to the data traffic instead of being forcibly used under all conditions.

Description

Technical Field

[0001] The present invention relates to the field of network technology and security technology, and in particular to an IPSec flow triggering method, device, electronic equipment and storage medium. Background Art

[0002] With the popularity of SD-WAN (Software-Defined Wide Area Network) technology, more and more companies are beginning to adopt SD-WAN to optimize their network connections. With the application of SD-WAN, the number of IPSEC VPN users connected to it is also increasing, which means that the demand for VPN products is also growing. In order to meet the increasing user needs, VPN products need to have higher access capabilities. In VPN products, this solution currently only supports "destination routing mode". In this mode, additional routing configuration is required, which may be complicated for configuration and management.

[0003] How to enable VPN devices to trigger active IPSec negotiation based on data traffic, rather than forcing it to be used in all situations, has become an urgent problem to be solved. Summary of the invention

[0004] In view of this, the present invention provides a PSec traffic triggering method, device, electronic device and storage medium to solve the problem of how to enable VPN equipment to trigger IPSec active negotiation according to data traffic.

[0005] In a first aspect, the present invention provides an IPSec traffic triggering method, the method comprising:

[0006] The data forwarding module receives the target message data sent by the previous node;

[0007] The data forwarding module matches the target message data with each first preset strategy; the first preset strategy includes a first source IP and a first destination IP;

[0008] If the target message data successfully matches the first target preset policy among the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset policy;

[0009] After the IPSec negotiation is successful, the data forwarding module transmits the target message data to the next node.

[0010] The IPSec traffic triggering method provided by the embodiment of the present application, the data forwarding module receives the target message data sent by the previous node; the data forwarding module matches the target message data with each first preset strategy, so as to detect whether the target message data is correct, and avoid routing the wrong target message data. If the target message data successfully matches the first target preset strategy in each first preset strategy, it is determined that the current target message data is correct, and the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset strategy, so that the VPN device can realize traffic triggering IPSec active negotiation according to the data traffic, instead of forcibly using it in all cases. After the IPSec negotiation is successful, the data forwarding module transmits the target message data to the next node, ensuring the accuracy of the target message data being transmitted to the next node. The above method does not require additional configuration of routing, thereby simplifying the process and improving efficiency. And the accuracy of routing the target message data is guaranteed.

[0011] In an optional implementation manner, before the data forwarding module matches the target message data with each first preset strategy, the method includes:

[0012] The IPSec negotiation module obtains first network segment information of at least one first virtual machine corresponding to a sending device corresponding to the target message data;

[0013] The IPSec negotiation module obtains second network segment information of at least one second virtual machine corresponding to a destination device corresponding to the target message data;

[0014] The IPSec negotiation module generates an SPD policy according to each first network segment information and each second network segment information;

[0015] The IPSec negotiation module assigns unique identification information to each SPD policy;

[0016] The IPSec negotiation module synchronously generates a first preset policy corresponding to each SPD policy in the data forwarding module based on each SPD policy.

[0017] The IPSec traffic triggering method provided in the embodiment of the present application, the IPSec negotiation module obtains the first network segment information of at least one first virtual machine corresponding to the sending device corresponding to the target message data; the IPSec negotiation module obtains the second network segment information of at least one second virtual machine corresponding to the destination device corresponding to the target message data; the IPSec negotiation module generates an SPD policy based on each first network segment information and each second network segment information, thereby ensuring the accuracy of the generated SPD policy. The IPSec negotiation module assigns unique identification information to each SPD policy, so that the SPD policy can be identified. Based on each SPD policy, the IPSec negotiation module synchronously generates a first preset policy corresponding to each SPD policy in the data forwarding module, thereby ensuring the accuracy of the first preset policy corresponding to each generated SPD policy, and then the target message data can be matched based on each first preset policy.

[0018] In an optional implementation, matching the target message data with each first preset strategy includes:

[0019] The data forwarding module identifies the target message data and determines the target source IP and target destination IP corresponding to the target message data;

[0020] The data forwarding module compares the target source IP and the target destination IP with the first source IP and the first destination IP included in each first preset strategy respectively;

[0021] The data forwarding module determines the first preset policy in which the first source IP is the same as the target source IP and the first destination IP is consistent with the target destination IP as the first target preset policy.

[0022] In the IPSec traffic triggering method provided in the embodiment of the present application, the data forwarding module identifies the target message data, determines the target source IP and the target destination IP corresponding to the target message data, and ensures the accuracy of the target source IP and the target destination IP corresponding to the determined target message data. The data forwarding module compares the target source IP and the target destination IP with the first source IP and the first destination IP included in each first preset policy respectively; the data forwarding module determines the first preset policy in which the first source IP is the same as the target source IP and the first destination IP is consistent with the target destination IP as the first target preset policy, and ensures the accuracy of the determined first target preset policy.

[0023] In an optional implementation, if the target message data successfully matches the first target preset policy in each first preset policy, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset policy, including:

[0024] If the target message data successfully matches the first target preset policy in each first preset policy, the data forwarding module determines the target unique identifier corresponding to the first target preset policy;

[0025] The data forwarding module transmits the target unique identifier to the IPSec negotiation module;

[0026] The IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier;

[0027] The IPSec negotiation module performs IPSec negotiation with a destination device corresponding to the target message data based on the target policy information.

[0028] The IPSec traffic triggering method provided by the embodiment of the present application is as follows: if the target message data successfully matches the first target preset policy in each first preset policy, the data forwarding module determines the target unique identifier corresponding to the first target preset policy; the data forwarding module transmits the target unique identifier to the IPSec negotiation module, so that the IPSec negotiation module can determine the first target preset policy based on the target unique identifier. The IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier, thereby ensuring the accuracy of the determined target policy information. The IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the target policy information, thereby realizing active IPSec negotiation triggered by traffic based on data traffic, rather than forcibly using it in all cases, and ensuring the accuracy of IPSec negotiation with the destination device corresponding to the target message data.

[0029] In an optional implementation, the IPSec negotiation module performs IPSec negotiation with a destination device corresponding to the target message data based on the target policy information, including:

[0030] The IPSec negotiation module obtains the start time of the IPSec negotiation based on the previous message data corresponding to the target message data;

[0031] Check whether the time interval between the current time and the start time is greater than the preset time;

[0032] If the time interval between the current time and the start time is greater than the preset time length, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the target policy information.

[0033] In the IPSec traffic triggering method provided in the embodiment of the present application, the IPSec negotiation module obtains the start time of the IPSec negotiation based on the previous message data corresponding to the target message data; detects whether the time interval between the current time and the start time is greater than the preset time length, thereby ensuring the accuracy of the obtained detection result. If the time interval between the current time and the start time is greater than the preset time length, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the target policy information. This avoids multiple IPSec negotiations in the same time period, thereby preventing the confusion of IPSec negotiation from affecting normal work.

[0034] In an optional implementation, after the IPSec negotiation succeeds, the data forwarding module transmits the target message data to the next node, including:

[0035] The data forwarding module establishes an IPSec tunnel with the device;

[0036] The data forwarding module enables the sending function;

[0037] The data forwarding module transmits the target message data to the next node through the IPSec tunnel based on the sending function.

[0038] In the IPSec traffic triggering method provided in the embodiment of the present application, the data forwarding module establishes an IPSec tunnel with the device, thereby ensuring the accuracy of the established IPSec tunnel. The data forwarding module enables the sending function; based on the sending function, the data forwarding module transmits the target message data to the next node through the IPSec tunnel, thereby achieving the transmission of the target message data to the next node.

[0039] In an optional embodiment, the method further includes:

[0040] If the target message data fails to match each of the first preset strategies, the data forwarding module discards the target message data.

[0041] The IPSec traffic triggering method provided in the embodiment of the present application, if the target message data fails to match each first preset policy successfully, the data forwarding module will discard the target message data, thereby ensuring the accuracy of the transmitted target message data and avoiding the transmission of erroneous target message data, causing data leakage and other problems.

[0042] In a second aspect, the present invention provides an IPSec traffic triggering device, the device comprising:

[0043] A receiving module, used for the data forwarding module to receive target message data sent by the previous node;

[0044] A matching module, used for the data forwarding module to match the target message data with each first preset strategy; the first preset strategy includes a first source IP and a first destination IP;

[0045] a negotiation module, configured to, if the target message data successfully matches a first target preset policy among the first preset policies, perform IPSec negotiation with a destination device corresponding to the target message data based on the first target preset policy by the IPSec negotiation module;

[0046] The sending module is used to transmit the target message data to the next section after the IPSec negotiation is successful.

[0047] The IPSec flow triggering device provided by the embodiment of the present application, the data forwarding module receives the target message data sent by the previous node; the data forwarding module matches the target message data with each first preset strategy, so as to detect whether the target message data is correct, and avoid routing the wrong target message data. If the target message data successfully matches the first target preset strategy in each first preset strategy, it is determined that the current target message data is correct, and the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset strategy, so that the VPN device can realize the traffic triggering IPSec active negotiation according to the data flow, instead of forcibly using it in all cases. After the IPSec negotiation is successful, the data forwarding module transmits the target message data to the next node, ensuring the accuracy of the target message data being transmitted to the next node. The above device does not need to configure the route additionally, thus simplifying the process and improving the efficiency. And it ensures the accuracy of routing the target message data.

[0048] In a third aspect, the present invention provides an electronic device, comprising: a memory and a processor, the memory and the processor being communicatively connected to each other, the memory storing computer instructions, and the processor executing the IPSec traffic triggering method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0049] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the IPSec traffic triggering method of the first aspect or any corresponding embodiment thereof.

[0050] In a fifth aspect, the present invention provides a computer program product, including computer instructions, which are used to enable a computer to execute the IPSec traffic triggering method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0051] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0052] Figure 1 is a flow chart of an IPSec traffic triggering method according to an embodiment of the present invention;

[0053] Figure 2 is a flow chart of another IPSec traffic triggering method according to an embodiment of the present invention;

[0054] Figure 3 is a flow chart of another IPSec traffic triggering method according to an embodiment of the present invention;

[0055] Figure 4 is a schematic diagram of a data forwarding process according to an embodiment of the present invention;

[0056] Figure 5 is a schematic diagram of the overall implementation process of traffic triggering according to an embodiment of the present invention;

[0057] Figure 6 is a schematic diagram of the operation flow of Strongswan configuration import according to an embodiment of the present invention;

[0058] Figure 7 is a structural block diagram of an IPSec flow triggering device according to an embodiment of the present invention;

[0059] Figure 8 is a structural block diagram of another IPSec flow triggering device according to an embodiment of the present invention;

[0060] Fig. 9 is a structural block diagram of yet another IPSec flow triggering device according to an embodiment of the present invention;

[0061] Fig.10 It is a schematic diagram of the hardware structure of the electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0062] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0063] With the popularity of SD-WAN (Software-Defined Wide Area Network) technology, more and more companies are beginning to adopt SD-WAN to optimize their network connections. With the application of SD-WAN, the number of IPSEC VPN users connected to it is also increasing, which means that the demand for VPN products is also growing. In order to meet the increasing user needs, VPN products need to have higher access capabilities. In VPN products, this solution currently only supports "destination routing mode". In this mode, additional routing configuration is required, which may be complicated for configuration and management.

[0064] How to enable VPN devices to trigger active IPSec negotiation based on data traffic, rather than forcing it to be used in all situations, has become an urgent problem to be solved.

[0065] It should be noted that the execution subject of the IPSec traffic triggering method provided in the embodiment of the present application can be a device triggered by IPSec traffic, and the device triggered by IPSec traffic can be implemented as part or all of an electronic device through software, hardware, or a combination of software and hardware, wherein the electronic device can be a server or a terminal, wherein the server in the embodiment of the present application can be a single server or a server cluster composed of multiple servers, and the terminal in the embodiment of the present application can be a smart phone, a personal computer, a tablet computer, a wearable device, and other intelligent hardware devices such as an intelligent robot. In the following method embodiments, the execution subject is an electronic device as an example for explanation.

[0066] According to an embodiment of the present invention, an IPSec traffic triggering method embodiment is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0067] In this embodiment, an IPSec traffic triggering method is provided, which can be used in the above-mentioned electronic device. Figure 1 : is a flow chart of an IPSec traffic triggering method according to an embodiment of the present invention. Figure 1 As shown, the process includes the following steps:

[0068] Step S101: The data forwarding module receives target message data sent by the previous node.

[0069] Specifically, the data forwarding module in the electronic device can receive the target message data sent by the previous node based on the communication connection with the previous node.

[0070] The data forwarding module may be VPP software, which is an open source version of Cisco's Vector Packet Processing (VPP) technology: a high-performance packet processing stack that can run on a commercial CPU.

[0071] Step S102: The data forwarding module matches the target message data with each first preset strategy.

[0072] The first preset strategy includes a first source IP and a first destination IP.

[0073] Specifically, the data forwarding module in the electronic device may compare the target source IP and the target destination IP corresponding to the target message data with the first source IP and the first destination IP included in each first preset policy.

[0074] This step will be described in detail below.

[0075] Step S103: If the target message data successfully matches the first target preset policy among the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset policy.

[0076] Specifically, if the target message data successfully matches a first target preset policy among the first preset policies, the IPSec negotiation module in the electronic device performs IPSec negotiation with a destination device corresponding to the target message data based on the first target preset policy.

[0077] Among them, IPSec (Internet Protocol Security) is a protocol for providing secure communication on an Internet Protocol (IP) network. The IPSec negotiation module is a part of the IPSec protocol, and its main function is to negotiate IPSec Security Association (SA) based on target policy information.

[0078] The IPSec negotiation module can be the Strongswan software, which is a complete IPsec and IKEv1 implementation for Linux kernels 2.4 and 2.6. It also fully supports the new IKEv2 protocol for Linux 2.6 kernels. Combine IKEv1 and IKEv2 modes with most other IPSec-based VPN products.

[0079] This step will be described in detail below.

[0080] Step S104: After the IPSec negotiation succeeds, the data forwarding module transmits the target message data to the next node.

[0081] Specifically, after the IPSec negotiation succeeds, the data forwarding module transmits the target message data to the next node according to the target destination IP corresponding to the target message data.

[0082] The IPSec traffic triggering method provided by the embodiment of the present application, the data forwarding module receives the target message data sent by the previous node; the data forwarding module matches the target message data with each first preset strategy, so as to detect whether the target message data is correct, and avoid routing the wrong target message data. If the target message data successfully matches the first target preset strategy in each first preset strategy, it is determined that the current target message data is correct, and the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset strategy, so that the VPN device can realize traffic triggering IPSec active negotiation according to the data traffic, instead of forcibly using it in all cases. After the IPSec negotiation is successful, the data forwarding module transmits the target message data to the next node, ensuring the accuracy of the target message data being transmitted to the next node. The above method does not require additional configuration of routing, thereby simplifying the process and improving efficiency. And the accuracy of routing the target message data is guaranteed.

[0083] In this embodiment, an IPSec traffic triggering method is provided, which can be used in the above-mentioned electronic device. Figure 2 : is a flow chart of an IPSec traffic triggering method according to an embodiment of the present invention. Figure 2 As shown, the process includes the following steps:

[0084] Step S201: The data forwarding module receives target message data sent by the previous node.

[0085] For details about this step, please refer to the above description of step S101, which will not be elaborated here.

[0086] Step S202: The IPSec negotiation module obtains first network segment information of at least one first virtual machine corresponding to a sending device corresponding to target message data.

[0087] Specifically, the IPSec negotiation module in the electronic device can receive the first network segment information of at least one first virtual machine corresponding to the sending device corresponding to the target message data input by the user, and can also receive the first network segment information of at least one first virtual machine corresponding to the sending device corresponding to the target message data sent by other devices.

[0088] The embodiment of the present application does not specifically limit the manner in which the IPSec negotiation module in the electronic device obtains the first network segment information of at least one first virtual machine corresponding to the sending device corresponding to the target message data.

[0089] Step S203: The IPSec negotiation module obtains second network segment information of at least one second virtual machine corresponding to a destination device corresponding to the target message data.

[0090] Specifically, the IPSec negotiation module in the electronic device can receive the second network segment information of at least one second virtual machine corresponding to the sending device corresponding to the target message data input by the user, and can also receive the second network segment information of at least one second virtual machine corresponding to the sending device corresponding to the target message data sent by other devices.

[0091] The embodiment of the present application does not specifically limit the manner in which the IPSec negotiation module in the electronic device obtains the second network segment information of at least one second virtual machine corresponding to the sending device corresponding to the target message data.

[0092] Step S204: The IPSec negotiation module generates an SPD policy according to the first network segment information and the second network segment information.

[0093] Specifically, the IPSec negotiation module can allow or deny data packets from the first network segment of the first virtual machine to the second network segment of the second virtual machine according to the first network segment information and the second network segment information, and set data packet filtering rules, such as source port, destination port, protocol type, etc.

[0094] For example, allow network traffic from 192.168.1.0 / 24 to 192.168.2.0 / 24. Allow TCP traffic from 192.168.1.1 to 192.168.2.2.

[0095] In Strongswan, SPD policy is host-based. You can use the following command to generate SPD policy:

[0096] For example: ipsec spd add <policy> <policy-attributes> <action>

[0097] in <policy>is the policy name, <policy-attributes>Including source IP, destination IP, protocol type, etc. <action>Is a policy action, such as accept or drop.

[0098] The first source IP and the first destination IP in the SPD policy may also define which IP traffic should be encrypted and / or authenticated, and the corresponding encryption algorithm and authentication algorithm.

[0099] Step S205: The IPSec negotiation module allocates unique identification information to each SPD policy.

[0100] Specifically, the IPSec negotiation module in the electronic device allocates unique identification information to each SPD policy.

[0101] Exemplarily, the IPSec negotiation module in the electronic device can assign a unique reqid to each SPD policy. This can be done through the Strongswan API, for example, using the ipsec reqid command:

[0102] For example: ipsec reqid <policy> <reqid>

[0103] in <reqid>Is a unique identifier for the SPD policy.

[0104] Step S206: The IPSec negotiation module synchronously generates a first preset policy corresponding to each SPD policy in the data forwarding module based on each SPD policy.

[0105] Specifically, the IPSec negotiation module in the electronic device synchronously generates a first preset policy corresponding to each SPD policy in the data forwarding module based on each SPD policy.

[0106] Exemplarily, the IPSec negotiation module in the electronic device can use the Strongswan API to synchronize the SPD policy to the VPP software, i.e., the data forwarding module. This is usually done by calling an API function, for example:

[0107] ipsec-spd-sync-to-vpp <policy>

[0108] This command will synchronize the specified SPD policy to the VPP software, namely the data forwarding module, and generate a corresponding first preset policy for each SPD policy.

[0109] Illustratively, this can be accomplished with the ipsec policy command:

[0110] ipsec policy add <policy> <policy-attributes>

[0111] in <policy-attributes>Includes the same properties as the SPD policy.

[0112] Step S207: the data forwarding module matches the target message data with each first preset strategy.

[0113] The first preset strategy includes a first source IP and a first destination IP.

[0114] Specifically, the above step S207 may include the following steps:

[0115] Step S2071, the data forwarding module identifies the target message data and determines the target source IP and target destination IP corresponding to the target message data.

[0116] Specifically, the data forwarding module in the electronic device identifies the target message data and determines the target source IP and the target destination IP corresponding to the target message data.

[0117] Step S2072: the data forwarding module compares the target source IP and the target destination IP with the first source IP and the first destination IP included in each first preset strategy respectively.

[0118] Specifically, the data forwarding module in the electronic device compares the target source IP of the target message data with the first source IP included in each first preset policy, and compares the target destination IP of the target message data with the first destination IP included in each first preset policy.

[0119] Step S2073, the data forwarding module determines the first preset policy in which the first source IP is the same as the target source IP and the first destination IP is consistent with the target destination IP as the first target preset policy.

[0120] Specifically, if there is a first source IP corresponding to the first preset policy that is consistent with the target source IP of the target message data, and the first destination source IP corresponding to the first preset policy is consistent with the target destination IP of the target message data, then the data forwarding module in the electronic device will determine the first preset policy in which the first source IP is the same as the target source IP, and the first destination IP is consistent with the target destination IP as the first target preset policy.

[0121] Step S208: If the target message data successfully matches the first target preset policy among the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset policy.

[0122] Specifically, if the target message data successfully matches a first target preset policy among the first preset policies, the IPSec negotiation module in the electronic device performs IPSec negotiation with a destination device corresponding to the target message data based on the first target preset policy.

[0123] Specifically, the basic steps of the IPSec negotiation module are as follows:

[0124] The IPSec negotiation module will first check the security policy of the target network or host to determine whether encryption or authentication is required. Then, based on the first target preset policy, the IPSec negotiation module will determine the encryption algorithm, authentication algorithm, key exchange algorithm and security parameter index (SPI) included in the first target preset policy. Then, the IPSec negotiation module will initialize a security association (SA), which is a security context for data transmission and contains the above-selected security parameters. The IPSec negotiation module uses the Internet Security Association and Key Management Protocol (ISAKMP) to negotiate SA. At the beginning of the negotiation process, one party (usually called the proposer, that is, the IPSec negotiation module in the electronic device) will send an ISAKMP Initial Exchange (ISAKMP Initial Exchange, IKE Phase 1) message, which includes the supported encryption algorithms, authentication methods and security parameters. After receiving the message sent by the proposer, the receiver (that is, the destination device corresponding to the target message data) will send a response message (usually called ISAKMP response) according to its own policy and security requirements, and propose its own security parameter selection. Through a series of proposal and response messages, the two parties finally reach a consensus on security parameters. This process is called ISAKMP main mode (IKE Phase 1). Once the SA is established, both parties will use the selected key exchange algorithm to generate keys for subsequent IPSec data encryption and authentication. Once the SA and keys are established, a secure tunnel can be established between the two parties to protect data transmission.

[0125] Step S209: After the IPSec negotiation succeeds, the data forwarding module transmits the target message data to the next node.

[0126] For details about this step, please refer to the above description of step S104, which will not be elaborated here.

[0127] The IPSec traffic triggering method provided in the embodiment of the present application, the IPSec negotiation module obtains the first network segment information of at least one first virtual machine corresponding to the sending device corresponding to the target message data; the IPSec negotiation module obtains the second network segment information of at least one second virtual machine corresponding to the destination device corresponding to the target message data; the IPSec negotiation module generates an SPD policy based on each first network segment information and each second network segment information, thereby ensuring the accuracy of the generated SPD policy. The IPSec negotiation module assigns unique identification information to each SPD policy, so that the SPD policy can be identified. Based on each SPD policy, the IPSec negotiation module synchronously generates a first preset policy corresponding to each SPD policy in the data forwarding module, thereby ensuring the accuracy of the first preset policy corresponding to each generated SPD policy, and then the target message data can be matched based on each first preset policy.

[0128] The data forwarding module identifies the target message data, determines the target source IP and target destination IP corresponding to the target message data, and ensures the accuracy of the target source IP and target destination IP corresponding to the determined target message data. The data forwarding module compares the target source IP and target destination IP with the first source IP and first destination IP included in each first preset policy; the data forwarding module determines the first preset policy in which the first source IP is the same as the target source IP and the first destination IP is consistent with the target destination IP as the first target preset policy, and ensures the accuracy of the determined first target preset policy.

[0129] In this embodiment, an IPSec traffic triggering method is provided, which can be used in the above-mentioned electronic device. Figure 3 : is a flow chart of an IPSec traffic triggering method according to an embodiment of the present invention. Figure 3 As shown, the process includes the following steps:

[0130] Step S301: The data forwarding module receives target message data sent by the previous node.

[0131] For details about this step, please refer to the above description of step S201, which will not be elaborated here.

[0132] Step S302: The data forwarding module matches the target message data with each first preset strategy.

[0133] The first preset strategy includes a first source IP and a first destination IP.

[0134] For details about this step, please refer to the above description of step S202, which will not be elaborated here.

[0135] Step S303: If the target message data successfully matches the first target preset policy among the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset policy.

[0136] Specifically, the above step S303 may include the following steps:

[0137] Step S3031: If the target message data successfully matches the first target preset policy among the first preset policies, the data forwarding module determines the target unique identifier corresponding to the first target preset policy.

[0138] Specifically, if the target message data successfully matches a first target preset policy among the first preset policies, the data forwarding module in the electronic device determines a target unique identifier corresponding to the first target preset policy.

[0139] Step S3032: The data forwarding module transmits the target unique identifier to the IPSec negotiation module.

[0140] Specifically, the data forwarding module in the electronic device transmits the target unique identifier to the IPSec negotiation module.

[0141] Step S3033: The IPSec negotiation module determines target policy information corresponding to the first target preset policy based on the target unique identifier.

[0142] Specifically, the IPSec negotiation module determines the first target preset policy based on the target unique identifier, and determines the target policy information corresponding to the first target preset policy.

[0143] The target policy information includes the first source IP, the first destination IP, the authentication algorithm, the encryption algorithm, etc.

[0144] Step S3034: The IPSec negotiation module performs IPSec negotiation with a destination device corresponding to the target message data based on the target policy information.

[0145] Specifically, the above step S3034 may include the following steps:

[0146] Step a1: The IPSec negotiation module obtains the start time of IPSec negotiation based on the previous message data corresponding to the target message data.

[0147] Specifically, the IPSec negotiation module may search the storage space for the start time of the IPSec negotiation based on the previous message data corresponding to the target message data.

[0148] Step a2, detecting whether the time interval between the current time and the start time is greater than a preset time length.

[0149] Specifically, the IPSec negotiation module calculates the time interval between the current time and the start time, and then compares the time interval between the current time and the start time with a preset duration.

[0150] The IPSec negotiation module may receive a preset duration input by a user or a preset duration sent by another device. The preset duration may be 1 minute, 30 seconds, or other durations. The embodiment of the present application does not specifically limit the preset duration.

[0151] Step a3: If the time interval between the current time and the start time is greater than the preset time, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the target policy information.

[0152] It should be noted that Strongswan software, i.e., IPSec negotiation module, can register event callback function. Once the traffic trigger callback event is received from VPP software, i.e., data forwarding module, the corresponding configured IPSec is triggered to initiate IPSec negotiation according to the event reqid value, i.e., the target unique identifier corresponding to the first target preset policy.

[0153] Specifically, if the time interval between the current time and the start time is greater than a preset time length, the IPSec negotiation module performs IPSec negotiation with a destination device corresponding to the target message data based on the target policy information.

[0154] Specifically, the basic steps of the IPSec negotiation module are as follows:

[0155] The IPSec negotiation module will first check the security policy of the target network or host to determine whether encryption or authentication is required. Then, based on the first target preset policy, the IPSec negotiation module will determine the encryption algorithm, authentication algorithm, key exchange algorithm and security parameter index (SPI) included in the first target preset policy. Then, the IPSec negotiation module will initialize a security association (SA), which is a security context for data transmission and contains the above-selected security parameters. The IPSec negotiation module uses the Internet Security Association and Key Management Protocol (ISAKMP) to negotiate SA. At the beginning of the negotiation process, one party (usually called the proposer, that is, the IPSec negotiation module in the electronic device) will send an ISAKMP Initial Exchange (ISAKMP Initial Exchange, IKE Phase 1) message, which includes the supported encryption algorithms, authentication methods and security parameters. After receiving the message sent by the proposer, the receiver (that is, the destination device corresponding to the target message data) will send a response message (usually called ISAKMP response) according to its own policy and security requirements, and propose its own security parameter selection. Through a series of proposal and response messages, the two parties finally reach a consensus on security parameters. This process is called ISAKMP main mode (IKE Phase 1). Once the SA is established, both parties will use the selected key exchange algorithm to generate keys for subsequent IPSec data encryption and authentication. Once the SA and keys are established, a secure tunnel can be established between the two parties to protect data transmission.

[0156] Step S304: After the IPSec negotiation succeeds, the data forwarding module transmits the target message data to the next node.

[0157] Specifically, the above step S304 may include the following steps:

[0158] Step S3041: The data forwarding module establishes an IPSec tunnel with the device.

[0159] Specifically, after the IPSec negotiation succeeds, the data forwarding module establishes an IPSec tunnel with the device.

[0160] Step S3042: the data forwarding module enables the sending function.

[0161] Specifically, the data forwarding module in the electronic device enables the sending function.

[0162] Exemplarily, the data forwarding module in the electronic device may enable the sending function according to the following operations:

[0163] feature ipsec enable

[0164] This will ensure that the ipsec4-output node is able to handle IPSec traffic.

[0165] Step S3043: The data forwarding module transmits the target message data to the next node through the IPSec tunnel based on the sending function.

[0166] Specifically, the data forwarding module in the electronic device encrypts the target message data through the IPSec tunnel based on the sending function and transmits it to the next node.

[0167] Step S305: If the target message data does not successfully match each of the first preset policies, the data forwarding module discards the target message data.

[0168] Specifically, if the target message data fails to match each of the first preset strategies, the data forwarding module in the electronic device discards the target message data.

[0169] The IPSec traffic triggering method provided by the embodiment of the present application is as follows: if the target message data successfully matches the first target preset policy in each first preset policy, the data forwarding module determines the target unique identifier corresponding to the first target preset policy; the data forwarding module transmits the target unique identifier to the IPSec negotiation module, so that the IPSec negotiation module can determine the first target preset policy based on the target unique identifier. The IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier, thereby ensuring the accuracy of the determined target policy information. The IPSec negotiation module obtains the start time of the IPSec negotiation based on the previous message data corresponding to the target message data; and detects whether the time interval between the current time and the start time is greater than the preset duration, thereby ensuring the accuracy of the obtained detection result. If the time interval between the current time and the start time is greater than the preset duration, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the target policy information. Thus, multiple IPSec negotiations are avoided in the same time period, thereby avoiding the confusion of IPSec negotiations affecting normal work. The traffic-triggered IPSec active negotiation is realized according to the data traffic, rather than being used forcibly in all cases, and the accuracy of the IPSec negotiation performed by the destination device corresponding to the target message data is ensured.

[0170] After the IPSec negotiation is successful, the data forwarding module establishes an IPSec tunnel with the device, ensuring the accuracy of the established IPSec tunnel. The data forwarding module enables the sending function; based on the sending function, the data forwarding module transmits the target message data to the next node through the IPSec tunnel, thereby achieving the transmission of the target message data to the next node.

[0171] If the target message data does not successfully match each of the first preset strategies, the data forwarding module will discard the target message data, thereby ensuring the accuracy of the transmitted target message data and avoiding the problem of transmitting erroneous target message data and causing data leakage.

[0172] In order to better introduce the IPSec traffic triggering method implemented in this application, the target message data forwarding process is as follows: Figure 4 , Strongswan implements IPSec negotiation, and after successful negotiation, it synchronizes IPSecsa to VPP, and VPP forwards data. The specific steps include:

[0173] 1. SPD strategy synchronization

[0174] Strongswan generates an SPD policy for traffic-triggered outbound traffic based on the IPSec connection configuration, synchronizes it to VPP through the API, and generates a policy policy on Strongswan. Each policy has a unique reqid. When synchronizing the SPD policy, Strongswan enables the ipsec4-output-feature of the outbound node of the interface. For example, Figure 5 , mount the ipsec4-output-feature node after the ip4-output node.

[0175] Specifically, a. Generate traffic to trigger SPD:

[0176] like Figure 6 , which is the operation flow chart for Strongswan configuration import. The start_action of the Strongswan IPSec connection configuration is configured as trap, and the interface is the interface name of the IPSec port in VPP. After the configuration is loaded, Strongswan will generate a traffic-triggered policy for the subnet and synchronize it to VPP through the API. The API is the SPD policy supported by VPP, and the SPD type is TRAP. After synchronization, the IPSec port in VPP will be bound to the traffic-triggered SPD. The key value of the policy is reqid, which corresponds to the IPSecsa connection configuration of the only IPSec connection of Strongswan.

[0177] b. Enable traffic triggering node:

[0178] After the SPD synchronization is successful, Strongswan enables the ipsec4-output-feature node of the IPSec interface through the API. It is hung after the ip4-output node is processed.

[0179] 2. Traffic trigger event callback function

[0180] Strongswan registers an event callback function. Once the VPP traffic triggers the callback event, it triggers the corresponding configured IPSec to initiate IPSec negotiation based on the event reqid value.

[0181] Specifically, Strongswan registration event callback: traffic trigger processing flow, if a traffic trigger event is received from VPP, the key value reqid is taken out, the policy installed in Strongswan is called, and the corresponding IPSec connection configuration is triggered to initiate IPSec negotiation.

[0182] Specifically, Figure 5 , VPP SPD query node ipsec4-output-feature: traverse the SPD bound to the IPSec interface. This solution only queries the SPD in the outbound direction. The query matching rule is based on the five-tuple query. If the SPD with IPSecsa can be queried, data encryption is performed and the next step of data forwarding is performed. If only the SPD of the traffic trigger TRAP type can be queried, the solution will throw the message to the traffic trigger node ipsec-policy-trap for processing, and pass the reqid of the SPD to the ipsec-policy-trap node.

[0183] The process triggers the ipsec negotiation node ipsec-policy-trap: After receiving the message, the node first determines whether to execute the VPP event reporting process based on reqid. The solution implements a reporting interval limit, and the key value reqid can only report an event once every 1 minute to prevent a large number of data messages from frequently calling the Strongswan negotiation process within the Strongswan negotiation timeout period. After the reporting timer times out, VPP calls the strong reporting api and sends it to Strongswan, and finally implements IPSec active negotiation through Strongswan.

[0184] 3. VPP strategy traversal nodes

[0185] The IPSec outbound search policy SPD node ipsec4-output-feature. All outbound data processing passes through the SPD processing node. If the outbound data does not find the corresponding IPSec Sa for the traffic, the message is thrown into the traffic trigger node for further processing. If the SPD with IPSec Sa is found, data encryption is continued to achieve data forwarding.

[0186] 4. Traffic triggering node

[0187] After policy traversal processing, the message is sent to the traffic triggering node ipsec-policy-trap for processing. The node determines whether the traffic trigger limit timer has timed out based on the reqid value of the traffic departure. If it has timed out, it can trigger Strongswan to initiate negotiation by reporting the event registered by Strongswan.

[0188] In this embodiment, an IPSec traffic triggering device is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0189] This embodiment provides an IPSec traffic triggering device, such as Figure 7 As shown, including:

[0190] Receiving module 401, used for the data forwarding module to receive the target message data sent by the previous node;

[0191] Matching module 402, used for the data forwarding module to match the target message data with each first preset strategy; the first preset strategy includes a first source IP and a first destination IP;

[0192] The negotiation module 403 is configured to perform IPSec negotiation with a destination device corresponding to the target message data based on the first target preset policy if the target message data successfully matches the first target preset policy among the first preset policies;

[0193] The sending module 404 is used for the data forwarding module to transmit the target message data to the next section after the IPSec negotiation is successful.

[0194] In some optional implementations, the IPSec flow triggering device, such as Figure 8 As shown, it also includes:

[0195] A first acquisition module 405, used for the IPSec negotiation module to acquire first network segment information of at least one first virtual machine corresponding to a sending device corresponding to target message data;

[0196] A second acquisition module 406, used for the IPSec negotiation module to acquire second network segment information of at least one second virtual machine corresponding to a destination device corresponding to the target message data;

[0197] A generating module 407, used for the IPSec negotiation module to generate an SPD policy according to each first network segment information and each second network segment information;

[0198] An allocation module 408, used for the IPSec negotiation module to allocate unique identification information to each SPD policy;

[0199] The synchronous generation module 409 is used for the IPSec negotiation module to synchronously generate first preset policies corresponding to each SPD policy in the data forwarding module based on each SPD policy.

[0200] In some optional embodiments, the above-mentioned matching module 402 is specifically used for the data forwarding module to identify the target message data and determine the target source IP and target destination IP corresponding to the target message data; the data forwarding module compares the target source IP and the target destination IP with the first source IP and the first destination IP included in each first preset policy respectively; the data forwarding module determines the first preset policy in which the first source IP is the same as the target source IP and the first destination IP is consistent with the target destination IP as the first target preset policy.

[0201] In some optional implementations, the above-mentioned negotiation module 403 is specifically used to: if the target message data successfully matches the first target preset policy in each first preset policy, the data forwarding module determines the target unique identifier corresponding to the first target preset policy; the data forwarding module transmits the target unique identifier to the IPSec negotiation module; the IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier; the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the target policy information.

[0202] In some optional implementations, the above-mentioned negotiation module 403 is specifically used for the IPSec negotiation module to obtain the start time of IPSec negotiation based on the previous message data corresponding to the target message data; detect whether the time interval between the current time and the start time is greater than the preset duration; if the time interval between the current time and the start time is greater than the preset duration, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the target policy information.

[0203] In some optional implementations, the sending module 404 is specifically used for the data forwarding module to establish an IPSec tunnel with the device; the data forwarding module enables the sending function; and the data forwarding module transmits the target message data to the next node through the IPSec tunnel based on the sending function.

[0204] In some optional implementations, the IPSec flow triggering device, such as Fig. 9 As shown, it also includes:

[0205] The discarding module 410 is configured to cause the data forwarding module to discard the target message data if the target message data fails to match each of the first preset policies.

[0206] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0207] The IPSec traffic triggering device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0208] The embodiment of the present invention also provides an electronic device having the above Figure 7-Figure 9 The IPSec traffic triggering device is shown.

[0209] See 10, Fig.10 is a schematic diagram of the structure of an electronic device provided by an optional embodiment of the present invention, such as Fig.10 As shown, the electronic device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. The various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process instructions executed in the electronic device, including instructions stored in or on the memory to display graphical information of the GUI on an external input / output device (such as a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple electronic devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Fig.10 A processor 10 is taken as an example.

[0210] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include a hardware chip. The hardware chip may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0211] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0212] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the electronic device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the electronic device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0213] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0214] The electronic device further comprises a communication interface 30 for the electronic device to communicate with other devices or a communication network.

[0215] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0216] A part of the present invention may be applied as a computer program product, such as a computer program instruction, which, when executed by a computer, can call or provide the method and / or technical solution according to the present invention through the operation of the computer. Those skilled in the art should understand that the existence of the computer program instruction in a computer-readable medium includes, but is not limited to, a source file, an executable file, an installation package file, etc., and accordingly, the way in which the computer program instruction is executed by the computer includes, but is not limited to: the computer directly executes the instruction, or the computer compiles the instruction and then executes the corresponding compiled program, or the computer reads and executes the instruction, or the computer reads and installs the instruction and then executes the corresponding installed program. Here, the computer-readable medium may be any available computer-readable storage medium or communication medium accessible to the computer.

[0217] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims. < / policy> < / policy> < / reqid> < / reqid> < / policy> < / action> < / policy> < / action> < / policy-attributes> < / policy>

Claims

1. An IPSec traffic triggering method, characterized in that: The method comprises: The data forwarding module receives the target message data sent by the previous node; The data forwarding module matches the target message data with each first preset strategy; the first preset strategy includes a first source IP and a first destination IP; If the target message data successfully matches the first target preset policy in each of the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset policy; After the IPSec negotiation succeeds, the data forwarding module transmits the target message data to the next node.

2. The method according to claim 1, characterized in that Before the data forwarding module matches the target message data with each first preset strategy, the method includes: The IPSec negotiation module obtains first network segment information of at least one first virtual machine corresponding to a sending device corresponding to the target message data; The IPSec negotiation module obtains second network segment information of at least one second virtual machine corresponding to a destination device corresponding to the target message data; The IPSec negotiation module generates an SPD policy according to each of the first network segment information and each of the second network segment information; The IPSec negotiation module allocates unique identification information to each of the SPD policies; The IPSec negotiation module synchronously generates the first preset policy corresponding to each of the SPD policies in the data forwarding module based on each of the SPD policies.

3. The method according to claim 1, characterized in that The matching of the target message data with each first preset strategy includes: The data forwarding module identifies the target message data and determines the target source IP and target destination IP corresponding to the target message data; The data forwarding module compares the target source IP and the target destination IP with the first source IP and the first destination IP included in each of the first preset policies respectively; The data forwarding module determines the first preset policy in which the first source IP is the same as the target source IP and the first destination IP is consistent with the target destination IP as the first target preset policy.

4. The method according to claim 1, characterized in that: If the target message data successfully matches the first target preset policy in each of the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target message data based on the first target preset policy, including: If the target message data successfully matches the first target preset policy in each of the first preset policies, the data forwarding module determines the target unique identifier corresponding to the first target preset policy; The data forwarding module transmits the target unique identifier to the IPSec negotiation module; The IPSec negotiation module determines target policy information corresponding to the first target preset policy based on the target unique identifier; The IPSec negotiation module performs IPSec negotiation with a destination device corresponding to the target message data based on the target policy information.

5. The method according to claim 4, characterized in that The IPSec negotiation module performs IPSec negotiation with a destination device corresponding to the target message data based on the target policy information, including: The IPSec negotiation module obtains a start time of IPSec negotiation based on the previous message data corresponding to the target message data; Detect whether the time interval between the current time and the start time is greater than a preset time length; If the time interval between the current time and the start time is greater than the preset duration, the IPSec negotiation module performs the IPSec negotiation with the destination device corresponding to the target message data based on the target policy information.

6. The method according to claim 1, characterized in that After the IPSec negotiation succeeds, the data forwarding module transmits the target message data to the next node, including: The data forwarding module establishes an IPSec tunnel with the device; The data forwarding module enables a sending function; The data forwarding module transmits the target message data to the next node through the IPSec tunnel based on the sending function.

7. The method according to claim 1, characterized in that The method further comprises: If the target message data fails to match each of the first preset strategies, the data forwarding module discards the target message data.

8. An IPSec traffic triggering device, characterized in that: The device comprises: A receiving module, used for the data forwarding module to receive target message data sent by the previous node; A matching module, used for the data forwarding module to match the target message data with each first preset strategy; the first preset strategy includes a first source IP and a first destination IP; a negotiation module, configured to, if the target message data successfully matches a first target preset policy in each of the first preset policies, perform IPSec negotiation with a destination device corresponding to the target message data based on the first target preset policy by the IPSec negotiation module; The sending module is used for the data forwarding module to transmit the target message data to the next node after the IPSec negotiation succeeds.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the IPSec traffic triggering method according to any one of claims 1 to 7 by executing the computer instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the IPSec traffic triggering method according to any one of claims 1 to 7.

Images