IPsec traffic trigger method and apparatus, electronic device, and storage medium

Abstract

The present application relates to the field of network technology and security technology, and in particular to an IPSec traffic triggering method and device, an electronic device and a storage medium. A data forwarding module receives target message data sent by a previous node; the data forwarding module matches the target message data with each first preset policy; if the target message data matches a first target preset policy in the first preset policies successfully, an IPSec negotiation module negotiates with a destination device corresponding to the target message data based on the first target preset policy; after the IPSec negotiation is successful, the data forwarding module transmits the target message data to a next node, so that a VPN device can trigger IPSec active negotiation according to data traffic, rather than being forced to use in all cases.

Description

Technical Field

[0001] This invention relates to the fields of network technology and security technology, specifically to IPSec traffic triggering methods, devices, electronic equipment, and storage media. Background Technology

[0002] With the increasing adoption of SD-WAN (Software-Defined Wide Area Network) technology, more and more enterprises are using SD-WAN to optimize their network connectivity. Along with the application of SD-WAN, the number of IPsec VPN users is also increasing, which means a growing demand for VPN products. To meet this increased demand, VPN products need to have higher access capabilities. Currently, this solution in VPN products only supports "destination routing mode." In this mode, additional routing configuration is required, which can be complex for configuration and management.

[0003] How to enable VPN devices to trigger IPSec negotiation based on data traffic, rather than forcing it in all situations, has become an urgent problem to be solved. Summary of the Invention

[0004] In view of this, the present invention provides a PSec traffic triggering method, apparatus, electronic device and storage medium to solve the problem of how to enable VPN devices to trigger IPSec active negotiation based on data traffic.

[0005] In a first aspect, the present invention provides an IPSec traffic triggering method, the method comprising:

[0006] The data forwarding module receives the target message data sent by the previous node;

[0007] The data forwarding module matches the target packet data with each of the first preset policies; the first preset policy includes the first source IP and the first destination IP.

[0008] If the target packet data successfully matches the first target preset policy in each first preset policy, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy.

[0009] After IPSec negotiation is successful, the data forwarding module transmits the target packet data to the next node.

[0010] The IPSec traffic triggering method provided in this application embodiment involves a data forwarding module receiving target packet data sent by the previous node. The data forwarding module matches the target packet data with various first preset policies to detect whether the target packet data is correct, thus avoiding the routing and transmission of erroneous target packet data. If the target packet data successfully matches the first target preset policy, it is determined that the current target packet data is correct. The IPSec negotiation module, based on the first target preset policy, performs IPSec negotiation with the destination device corresponding to the target packet data. This enables the VPN device to proactively trigger IPSec negotiation based on data traffic, rather than forcing it in all cases. After successful IPSec negotiation, the data forwarding module transmits the target packet data to the next node, ensuring the accuracy of the target packet data transmission to the next node. This method does not require additional routing configuration, thus simplifying the process and improving efficiency. It also ensures the accuracy of routing the target packet data.

[0011] In one alternative implementation, before the data forwarding module matches the target packet data with each of the first preset policies, the method includes:

[0012] The IPSec negotiation module obtains the first network segment information of at least one first virtual machine corresponding to the sending device of the target packet data;

[0013] The IPSec negotiation module obtains the second network segment information of at least one second virtual machine corresponding to the destination device corresponding to the target packet data;

[0014] The IPSec negotiation module generates SPD policies based on the information of each first network segment and each second network segment;

[0015] The IPSec negotiation module assigns unique identification information to each SPD policy;

[0016] Based on each SPD policy, the IPSec negotiation module synchronously generates a first preset policy corresponding to each SPD policy in the data forwarding module.

[0017] The IPSec traffic triggering method provided in this application includes: an IPSec negotiation module acquiring first network segment information of at least one first virtual machine corresponding to the sending device of the target packet data; an IPSec negotiation module acquiring second network segment information of at least one second virtual machine corresponding to the destination device of the target packet data; and an IPSec negotiation module generating SPD policies based on each first network segment information and each second network segment information, ensuring the accuracy of the generated SPD policies. The IPSec negotiation module assigns unique identifier information to each SPD policy, thereby enabling the identification of the SPD policies. Based on each SPD policy, the IPSec negotiation module synchronously generates a first preset policy corresponding to each SPD policy in the data forwarding module, ensuring the accuracy of the first preset policies corresponding to each generated SPD policy, and thus enabling the matching of target packet data based on each first preset policy.

[0018] In one optional implementation, matching the target message data with each of the first preset policies includes:

[0019] The data forwarding module identifies the target packet data and determines the target source IP and target destination IP corresponding to the target packet data;

[0020] The data forwarding module compares the target source IP and target destination IP with the first source IP and first destination IP included in each of the first preset strategies;

[0021] The data forwarding module determines the first target preset policy as the first preset policy where the first source IP is the same as the target source IP and the first destination IP is the same as the target destination IP.

[0022] The IPSec traffic triggering method provided in this application embodiment involves a data forwarding module that identifies target packet data and determines the target source IP and target destination IP corresponding to the target packet data, ensuring the accuracy of the determined target source IP and target destination IP. The data forwarding module compares the target source IP and target destination IP with the first source IP and first destination IP included in each first preset policy; the data forwarding module determines the first preset policy where the first source IP and target source IP are the same, and the first destination IP and target destination IP are consistent, as the first target preset policy, ensuring the accuracy of the determined first target preset policy.

[0023] In one optional implementation, if the target packet data successfully matches the first target preset policy in each of the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy, including:

[0024] If the target message data successfully matches the first target preset policy in each first preset policy, the data forwarding module determines the target unique identifier corresponding to the first target preset policy;

[0025] The data forwarding module transmits the target's unique identifier to the IPSec negotiation module;

[0026] The IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target's unique identifier;

[0027] The IPSec negotiation module negotiates IPSec with the destination device corresponding to the target packet data based on the target policy information.

[0028] The IPSec traffic triggering method provided in this application embodiment, if the target packet data successfully matches the first target preset policy in each first preset policy, then the data forwarding module determines the target unique identifier corresponding to the first target preset policy; the data forwarding module transmits the target unique identifier to the IPSec negotiation module, thereby enabling the IPSec negotiation module to determine the first target preset policy based on the target unique identifier. The IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier, ensuring the accuracy of the determined target policy information. Based on the target policy information, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data, realizing proactive IPSec negotiation triggered by traffic based on data traffic, rather than forcing it in all cases, and ensuring the accuracy of IPSec negotiation with the destination device corresponding to the target packet data.

[0029] In one optional implementation, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information, including:

[0030] The IPSec negotiation module obtains the start time of IPSec negotiation based on the previous packet data corresponding to the target packet data;

[0031] Check if the time interval between the current time and the start time is greater than the preset duration;

[0032] If the time interval between the current time and the start time is greater than the preset duration, the IPSec negotiation module will perform IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information.

[0033] The IPSec traffic triggering method provided in this application involves an IPSec negotiation module that obtains the start time of IPSec negotiation based on the previous packet data corresponding to the target packet data; it also checks whether the time interval between the current time and the start time is greater than a preset duration, ensuring the accuracy of the detection results. If the time interval between the current time and the start time is greater than the preset duration, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information. This avoids multiple IPSec negotiations occurring within the same time period, thus preventing IPSec negotiation chaos from affecting normal operation.

[0034] In one optional implementation, after successful IPSec negotiation, the data forwarding module transmits the target packet data to the next node, including:

[0035] The data forwarding module establishes an IPSec tunnel with the device;

[0036] Enable the send function in the data forwarding module;

[0037] The data forwarding module uses a send function to transmit the target packet data to the next node through an IPSec tunnel.

[0038] The IPSec traffic triggering method provided in this application establishes an IPSec tunnel between the data forwarding module and the device, ensuring the accuracy of the established IPSec tunnel. The data forwarding module enables a send function; based on the send function, the data forwarding module transmits the target packet data to the next node through the IPSec tunnel, thereby realizing the transmission of the target packet data to the next node.

[0039] In one alternative implementation, the method further includes:

[0040] If the target packet data does not match any of the first preset strategies, the data forwarding module will discard the target packet data.

[0041] The IPSec traffic triggering method provided in this application embodiment can discard the target packet data if the target packet data does not match each of the first preset policies. This ensures the accuracy of the transmitted target packet data and avoids transmitting incorrect target packet data, which could lead to data leakage and other problems.

[0042] Secondly, the present invention provides an IPSec traffic triggering device, the device comprising:

[0043] The receiving module is used by the data forwarding module to receive the target message data sent by the previous node;

[0044] The matching module is used by the data forwarding module to match the target packet data with various first preset policies; the first preset policies include the first source IP and the first destination IP.

[0045] The negotiation module is used to perform IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy if the target packet data successfully matches the first target preset policy in each first preset policy.

[0046] The sending module is used to transmit the target packet data to the next segment after the IPSec negotiation is successful.

[0047] The IPSec traffic triggering device provided in this application embodiment includes a data forwarding module that receives target packet data sent by the previous node. The data forwarding module matches the target packet data with various first preset policies to detect whether the target packet data is correct, thus avoiding the routing and transmission of erroneous target packet data. If the target packet data successfully matches the first target preset policy, it is determined that the current target packet data is correct. The IPSec negotiation module, based on the first target preset policy, performs IPSec negotiation with the destination device corresponding to the target packet data. This enables the VPN device to initiate IPSec negotiation based on data traffic, rather than forcing it in all cases. After successful IPSec negotiation, the data forwarding module transmits the target packet data to the next node, ensuring the accuracy of the target packet data transmission to the next node. This device does not require additional routing configuration, thus simplifying the process and improving efficiency. It also ensures the accuracy of routing the target packet data.

[0048] Thirdly, the present invention provides an electronic device, comprising: a memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the computer instructions to perform the IPSec traffic triggering method of the first aspect or any corresponding embodiment described above.

[0049] Fourthly, the present invention provides a computer-readable storage medium storing computer instructions for causing a computer to execute the IPSec traffic triggering method of the first aspect or any corresponding embodiment thereof.

[0050] Fifthly, the present invention provides a computer program product, including computer instructions for causing a computer to execute the IPSec traffic triggering method of the first aspect or any corresponding embodiment thereof. Attached Figure Description

[0051] To more clearly illustrate the specific embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the specific embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of the present invention. For those skilled in the art, other drawings can be obtained from these drawings without creative effort.

[0052] Figure 1 This is a flowchart illustrating the IPSec traffic triggering method according to an embodiment of the present invention;

[0053] Figure 2 This is a flowchart illustrating another IPSec traffic triggering method according to an embodiment of the present invention;

[0054] Figure 3 This is a flowchart illustrating another IPSec traffic triggering method according to an embodiment of the present invention;

[0055] Figure 4 This is a schematic diagram of the data forwarding process according to an embodiment of the present invention;

[0056] Figure 5 This is a schematic diagram of the overall implementation process of traffic triggering according to an embodiment of the present invention;

[0057] Figure 6 This is a schematic diagram of the Strongswan configuration import operation process according to an embodiment of the present invention;

[0058] Figure 7 This is a structural block diagram of an IPSec traffic triggering device according to an embodiment of the present invention;

[0059] Figure 8 This is a structural block diagram of another IPSec traffic triggering device according to an embodiment of the present invention;

[0060] Figure 9 This is a structural block diagram of another IPSec traffic triggering device according to an embodiment of the present invention;

[0061] Figure 10 This is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Detailed Implementation

[0062] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0063] With the increasing adoption of SD-WAN (Software-Defined Wide Area Network) technology, more and more enterprises are using SD-WAN to optimize their network connectivity. Along with the application of SD-WAN, the number of IPsec VPN users is also increasing, which means a growing demand for VPN products. To meet this increased demand, VPN products need to have higher access capabilities. Currently, this solution in VPN products only supports "destination routing mode." In this mode, additional routing configuration is required, which can be complex for configuration and management.

[0064] How to enable VPN devices to trigger IPSec negotiation based on data traffic, rather than forcing it in all situations, has become an urgent problem to be solved.

[0065] It should be noted that the IPSec traffic triggering method provided in this application embodiment can be executed by an IPSec traffic triggering device. This device can be implemented as part or all of an electronic device through software, hardware, or a combination of both. The electronic device can be a server or a terminal. In this application embodiment, the server can be a single server or a server cluster composed of multiple servers. The terminal in this application embodiment can be a smartphone, personal computer, tablet computer, wearable device, or other intelligent hardware device such as a smart robot. The following method embodiments will use an electronic device as an example for explanation.

[0066] According to an embodiment of the present invention, an embodiment of an IPSec traffic triggering method is provided. It should be noted that the steps shown in the flowchart in the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions. Furthermore, although a logical order is shown in the flowchart, in some cases, the steps shown or described may be executed in a different order than that shown here.

[0067] This embodiment provides an IPSec traffic triggering method, which can be used in the aforementioned electronic devices. Figure 1 This is a flowchart of an IPSec traffic triggering method according to an embodiment of the present invention, such as... Figure 1 As shown, the process includes the following steps:

[0068] Step S101: The data forwarding module receives the target message data sent by the previous node.

[0069] Specifically, the data forwarding module in the electronic device can receive target message data sent by the previous node based on the communication connection with the previous node.

[0070] The data forwarding module can be VPP software. VPP is an open-source version of Cisco Vector Packet Processing (VPP) technology: a high-performance packet processing stack that can run on commercial CPUs.

[0071] In step S102, the data forwarding module matches the target packet data with each of the first preset strategies.

[0072] The first preset strategy includes a first source IP and a first destination IP.

[0073] Specifically, the data forwarding module in the electronic device can compare the target source IP and target destination IP corresponding to the target message data with the first source IP and first destination IP included in each first preset policy.

[0074] This step will be explained in detail below.

[0075] Step S103: If the target packet data successfully matches the first target preset policy in each first preset policy, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy.

[0076] Specifically, if the target packet data successfully matches the first target preset policy in each first preset policy, the IPSec negotiation module in the electronic device performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy.

[0077] IPSec (Internet Protocol Security) is a protocol used to provide secure communication over Internet Protocol (IP) networks. The IPSec negotiation module is part of the IPSec protocol, and its main function is to negotiate IPSec Security Associations (SAs) based on target policy information.

[0078] The IPSec negotiation module can be the Strongswan software, which is a complete implementation of IPsec and IKEv1 under Linux kernels 2.4 and 2.6. It also fully supports the new IKEv2 protocol on Linux kernel 2.6. This allows it to combine IKEv1 and IKEv2 modes with most other IPSec-based VPN products.

[0079] This step will be explained in detail below.

[0080] Step S104: After successful IPSec negotiation, the data forwarding module transmits the target packet data to the next node.

[0081] Specifically, after IPSec negotiation is successful, the data forwarding module transmits the target packet data to the next node according to the target destination IP corresponding to the target packet data.

[0082] The IPSec traffic triggering method provided in this application embodiment involves a data forwarding module receiving target packet data sent by the previous node. The data forwarding module matches the target packet data with various first preset policies to detect whether the target packet data is correct, thus avoiding the routing and transmission of erroneous target packet data. If the target packet data successfully matches the first target preset policy, it is determined that the current target packet data is correct. The IPSec negotiation module, based on the first target preset policy, performs IPSec negotiation with the destination device corresponding to the target packet data. This enables the VPN device to proactively trigger IPSec negotiation based on data traffic, rather than forcing it in all cases. After successful IPSec negotiation, the data forwarding module transmits the target packet data to the next node, ensuring the accuracy of the target packet data transmission to the next node. This method does not require additional routing configuration, thus simplifying the process and improving efficiency. It also ensures the accuracy of routing the target packet data.

[0083] This embodiment provides an IPSec traffic triggering method, which can be used in the aforementioned electronic devices. Figure 2 This is a flowchart of an IPSec traffic triggering method according to an embodiment of the present invention, such as... Figure 2 As shown, the process includes the following steps:

[0084] Step S201: The data forwarding module receives the target message data sent by the previous node.

[0085] Please refer to the above description of step S101 for details on this step, which will not be repeated here.

[0086] In step S202, the IPSec negotiation module obtains the first network segment information of at least one first virtual machine corresponding to the sending device of the target packet data.

[0087] Specifically, the IPSec negotiation module in the electronic device can receive the first network segment information of at least one first virtual machine corresponding to the sending device of the target packet data input by the user, and can also receive the first network segment information of at least one first virtual machine corresponding to the sending device of the target packet data sent by other devices.

[0088] This application does not specifically limit the method by which the IPSec negotiation module in the electronic device obtains the first network segment information of at least one first virtual machine corresponding to the sending device corresponding to the target packet data.

[0089] Step S203: The IPSec negotiation module obtains the second network segment information of at least one second virtual machine corresponding to the destination device corresponding to the target packet data.

[0090] Specifically, the IPSec negotiation module in the electronic device can receive the second network segment information of at least one second virtual machine corresponding to the sending device of the target packet data input by the user, and can also receive the second network segment information of at least one second virtual machine corresponding to the sending device of the target packet data sent by other devices.

[0091] This application embodiment does not specifically limit the method by which the IPSec negotiation module in the electronic device obtains the second network segment information of at least one second virtual machine corresponding to the sending device corresponding to the target packet data.

[0092] In step S204, the IPSec negotiation module generates an SPD policy based on the information of each first network segment and each second network segment.

[0093] Specifically, the IPSec negotiation module can allow or deny data packets from the first network segment of the first virtual machine to the second network segment of the second virtual machine based on the information of each first network segment and each second network segment, and set data packet filtering rules, such as source port, destination port, protocol type, etc.

[0094] For example, network traffic from 192.168.1.0 / 24 to 192.168.2.0 / 24 is allowed. TCP traffic from 192.168.1.1 to 192.168.2.2 is allowed.

[0095] In Strongswan, SPD policies are host-based. You can use the following command to generate an SPD policy:

[0096] For example: ipsec spd add <policy> <policy-attributes> <action>

[0097] in <policy>It is the strategy name. <policy-attributes>Including source IP, destination IP, protocol type, etc. <action>These are strategic actions, such as accept or drop.

[0098] In the SPD policy, the first source IP and the first destination IP can also be defined to specify which IP traffic should be encrypted and / or authenticated, as well as the corresponding encryption and authentication algorithms.

[0099] In step S205, the IPSec negotiation module assigns unique identification information to each SPD policy.

[0100] Specifically, the IPSec negotiation module in the electronic device assigns unique identification information to each SPD policy.

[0101] For example, the IPSec negotiation module in an electronic device can assign a unique reqid to each SPD policy. This can be done through Strongswan's API, for example, using the ipsec reqid command:

[0102] For example: ipsec reqid <policy> <reqid>

[0103] in <reqid>It is the unique identifier of the SPD policy.

[0104] In step S206, the IPSec negotiation module generates a first preset policy corresponding to each SPD policy in the data forwarding module based on each SPD policy.

[0105] Specifically, the IPSec negotiation module in the electronic device generates a first preset policy corresponding to each SPD policy in the data forwarding module based on each SPD policy.

[0106] For example, the IPSec negotiation module in an electronic device can use Strongswan's API to synchronize the SPD policy to the VPP software, i.e., the data forwarding module. This is typically accomplished by calling an API function, such as:

[0107] IPsec spd sync-to-vpp <policy>

[0108] This command will synchronize the specified SPD policy to the VPP software, i.e., the data forwarding module, and generate a corresponding first preset policy for each SPD policy.

[0109] For example, this can be accomplished using the ipsec policy command:

[0110] IPsec policy add <policy> <policy-attributes>

[0111] in <policy-attributes>Includes the same attributes as the SPD strategy.

[0112] In step S207, the data forwarding module matches the target packet data with each of the first preset strategies.

[0113] The first preset strategy includes a first source IP and a first destination IP.

[0114] Specifically, step S207 above may include the following steps:

[0115] In step S2071, the data forwarding module identifies the target packet data and determines the target source IP and target destination IP corresponding to the target packet data.

[0116] Specifically, the data forwarding module in the electronic device identifies the target packet data and determines the target source IP and target destination IP corresponding to the target packet data.

[0117] In step S2072, the data forwarding module compares the target source IP and the target destination IP with the first source IP and the first destination IP included in each of the first preset strategies.

[0118] Specifically, the data forwarding module in the electronic device compares the target source IP of the target packet data with the first source IP included in each first preset strategy, and compares the target destination IP of the target packet data with the first destination IP included in each first preset strategy.

[0119] In step S2073, the data forwarding module determines the first preset policy, which is the same as the first source IP and the target source IP and the first destination IP and the target destination IP, as the first target preset policy.

[0120] Specifically, if there exists a first source IP corresponding to the first preset strategy that is consistent with the target source IP of the target packet data, and the first destination source IP corresponding to the first preset strategy is consistent with the target destination IP of the target packet data, then the data forwarding module in the electronic device will determine the first preset strategy, in which the first source IP is the same as the target source IP and the first destination IP is consistent with the target destination IP, as the first target preset strategy.

[0121] Step S208: If the target packet data successfully matches the first target preset policy in each first preset policy, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy.

[0122] Specifically, if the target packet data successfully matches the first target preset policy in each first preset policy, the IPSec negotiation module in the electronic device performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy.

[0123] Specifically, the basic steps for the IPSec negotiation module to conduct negotiation are as follows:

[0124] The IPSec negotiation module first checks the security policy of the target network or host to determine whether encryption or authentication is required. Then, based on the first target preset policy, the IPSec negotiation module determines the encryption algorithm, authentication algorithm, key exchange algorithm, and Security Parameter Index (SPI) included in the first target preset policy. Next, the IPSec negotiation module initializes a Security Association (SA), a security context for data transmission that contains the selected security parameters. The IPSec negotiation module uses the Internet Security Association and Key Management Protocol (ISAKMP) to negotiate the SA. At the start of the negotiation process, one party (usually called the proposer, i.e., the IPSec negotiation module in the electronic device) sends an ISAKMP Initial Exchange (IKE Phase 1) message, which includes the supported encryption algorithms, authentication methods, and security parameters. The receiver (i.e., the destination device corresponding to the target packet data), upon receiving the message from the proposer, sends a response message (usually called an ISAKMP response) based on its own policy and security requirements, proposing its own security parameter selection. Through a series of proposal and response messages, both parties ultimately reach an agreement on the security parameters. This process is called ISAKMP Main Mode (IKE Phase 1). Once the Security Agreement (SA) is established, both parties will use their chosen key exchange algorithm to generate a key for subsequent IPSec data encryption and authentication. Once both the SA and the key are established, a secure tunnel can be established between the two parties to protect data transmission.

[0125] Step S209: After successful IPSec negotiation, the data forwarding module transmits the target packet data to the next node.

[0126] Please refer to the above description of step S104 for details on this step, which will not be repeated here.

[0127] The IPSec traffic triggering method provided in this application includes: an IPSec negotiation module acquiring first network segment information of at least one first virtual machine corresponding to the sending device of the target packet data; an IPSec negotiation module acquiring second network segment information of at least one second virtual machine corresponding to the destination device of the target packet data; and an IPSec negotiation module generating SPD policies based on each first network segment information and each second network segment information, ensuring the accuracy of the generated SPD policies. The IPSec negotiation module assigns unique identifier information to each SPD policy, thereby enabling the identification of the SPD policies. Based on each SPD policy, the IPSec negotiation module synchronously generates a first preset policy corresponding to each SPD policy in the data forwarding module, ensuring the accuracy of the first preset policies corresponding to each generated SPD policy, and thus enabling the matching of target packet data based on each first preset policy.

[0128] The data forwarding module identifies the target packet data, determining the target source IP and target destination IP corresponding to the target packet data, ensuring the accuracy of the determined target source IP and target destination IP. The data forwarding module compares the target source IP and target destination IP with the first source IP and first destination IP included in each first preset strategy; the data forwarding module determines the first preset strategy where the first source IP and target source IP are the same, and the first destination IP and target destination IP are consistent, as the first target preset strategy, ensuring the accuracy of the determined first target preset strategy.

[0129] This embodiment provides an IPSec traffic triggering method, which can be used in the aforementioned electronic devices. Figure 3 This is a flowchart of an IPSec traffic triggering method according to an embodiment of the present invention, such as... Figure 3 As shown, the process includes the following steps:

[0130] Step S301: The data forwarding module receives the target message data sent by the previous node.

[0131] Please refer to the above description of step S201 for details on this step, which will not be repeated here.

[0132] In step S302, the data forwarding module matches the target packet data with each of the first preset strategies.

[0133] The first preset strategy includes a first source IP and a first destination IP.

[0134] Please refer to the above description of step S202 for details on this step, which will not be repeated here.

[0135] Step S303: If the target packet data successfully matches the first target preset policy in each first preset policy, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy.

[0136] Specifically, step S303 above may include the following steps:

[0137] Step S3031: If the target message data successfully matches the first target preset policy in each first preset policy, the data forwarding module determines the target unique identifier corresponding to the first target preset policy.

[0138] Specifically, if the target message data successfully matches the first target preset policy in each first preset policy, the data forwarding module in the electronic device determines the target unique identifier corresponding to the first target preset policy.

[0139] In step S3032, the data forwarding module transmits the target unique identifier to the IPSec negotiation module.

[0140] Specifically, the data forwarding module in the electronic device transmits the target's unique identifier to the IPSec negotiation module.

[0141] In step S3033, the IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier.

[0142] Specifically, the IPSec negotiation module determines the first target preset policy based on the target's unique identifier, and determines the target policy information corresponding to the first target preset policy.

[0143] The target strategy information includes the first source IP, the first destination IP, the authentication algorithm, and the encryption algorithm.

[0144] In step S3034, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information.

[0145] Specifically, step S3034 above may include the following steps:

[0146] Step a1: The IPSec negotiation module obtains the start time of IPSec negotiation based on the previous packet data corresponding to the target packet data.

[0147] Specifically, the IPSec negotiation module can retrieve the start time of IPSec negotiation based on the previous packet data corresponding to the target packet data from the storage space.

[0148] Step a2: Detect whether the time interval between the current time and the start time is greater than the preset duration.

[0149] Specifically, the IPSec negotiation module calculates the time interval between the current time and the start time. Then, it compares the time interval between the current time and the start time with a preset duration.

[0150] The IPSec negotiation module can receive a preset duration input by the user or a preset duration sent by other devices. The preset duration can be 1 minute, 30 seconds, or other durations; this embodiment does not specifically limit the preset duration.

[0151] Step a3: If the time interval between the current time and the start time is greater than the preset duration, the IPSec negotiation module will negotiate IPSec with the destination device corresponding to the target packet data based on the target policy information.

[0152] It should be noted that the Strongswan software, i.e. the IPSec negotiation module, can register event callback functions. Once it receives traffic from the VPP software, i.e. the data forwarding module, it triggers a callback event. Based on the event reqid value, i.e. the unique identifier of the target corresponding to the first target preset policy, it triggers the corresponding configured IPSec to initiate IPSec negotiation.

[0153] Specifically, if the time interval between the current time and the start time is greater than a preset duration, the IPSec negotiation module will perform IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information.

[0154] Specifically, the basic steps for the IPSec negotiation module to conduct negotiation are as follows:

[0155] The IPSec negotiation module first checks the security policy of the target network or host to determine whether encryption or authentication is required. Then, based on the first target preset policy, the IPSec negotiation module determines the encryption algorithm, authentication algorithm, key exchange algorithm, and Security Parameter Index (SPI) included in the first target preset policy. Next, the IPSec negotiation module initializes a Security Association (SA), a security context for data transmission that contains the selected security parameters. The IPSec negotiation module uses the Internet Security Association and Key Management Protocol (ISAKMP) to negotiate the SA. At the start of the negotiation process, one party (usually called the proposer, i.e., the IPSec negotiation module in the electronic device) sends an ISAKMP Initial Exchange (IKE Phase 1) message, which includes the supported encryption algorithms, authentication methods, and security parameters. The receiver (i.e., the destination device corresponding to the target packet data), upon receiving the message from the proposer, sends a response message (usually called an ISAKMP response) based on its own policy and security requirements, proposing its own security parameter selection. Through a series of proposal and response messages, both parties ultimately reach an agreement on the security parameters. This process is called ISAKMP Main Mode (IKE Phase 1). Once the Security Agreement (SA) is established, both parties will use their chosen key exchange algorithm to generate a key for subsequent IPSec data encryption and authentication. Once both the SA and the key are established, a secure tunnel can be established between the two parties to protect data transmission.

[0156] Step S304: After successful IPSec negotiation, the data forwarding module transmits the target packet data to the next node.

[0157] Specifically, step S304 above may include the following steps:

[0158] Step S3041: The data forwarding module establishes an IPSec tunnel with the device.

[0159] Specifically, after successful IPSec negotiation, the data forwarding module establishes an IPSec tunnel with the device.

[0160] Step S3042: Enable the send function in the data forwarding module.

[0161] Specifically, the data forwarding module in the electronic device enables the send function.

[0162] For example, the data forwarding module in an electronic device can enable the send function by the following operation:

[0163] IPsec feature enable

[0164] This will ensure that the ipsec4-output node can handle IPSec traffic.

[0165] In step S3043, the data forwarding module transmits the target packet data to the next node through the IPSec tunnel based on the send function.

[0166] Specifically, the data forwarding module in the electronic device, based on the sending function, encrypts the target packet data through the IPSec tunnel before transmitting it to the next node.

[0167] In step S305, if the target packet data does not match each of the first preset strategies, the data forwarding module will discard the target packet data.

[0168] Specifically, if the target message data fails to match each of the first preset strategies, the data forwarding module in the electronic device will discard the target message data.

[0169] The IPSec traffic triggering method provided in this application embodiment, if the target packet data successfully matches the first target preset policy in each first preset policy, then the data forwarding module determines the target unique identifier corresponding to the first target preset policy; the data forwarding module transmits the target unique identifier to the IPSec negotiation module, thereby enabling the IPSec negotiation module to determine the first target preset policy based on the target unique identifier. The IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier, ensuring the accuracy of the determined target policy information. The IPSec negotiation module obtains the start time of IPSec negotiation based on the previous packet data corresponding to the target packet data; it detects whether the time interval between the current time and the start time is greater than a preset duration, ensuring the accuracy of the obtained detection results. If the time interval between the current time and the start time is greater than the preset duration, then the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information. This avoids multiple IPSec negotiations occurring in the same time period, thus preventing IPSec negotiation chaos from affecting normal operation. It achieves proactive IPSec negotiation triggered by data traffic, rather than forcing it in all situations, and ensures the accuracy of IPSec negotiation with the destination device corresponding to the target packet data.

[0170] After successful IPSec negotiation, the data forwarding module establishes an IPSec tunnel with the device, ensuring the accuracy of the established IPSec tunnel. The data forwarding module enables the send function; based on the send function, the data forwarding module transmits the target packet data to the next node through the IPSec tunnel, thus realizing the transmission of the target packet data to the next node.

[0171] If the target message data does not match any of the first preset strategies, the data forwarding module will discard the target message data, thereby ensuring the accuracy of the transmitted target message data and avoiding the transmission of incorrect target message data, which could lead to data leakage and other problems.

[0172] To better illustrate the IPSec traffic triggering method implemented in this application, the target packet data forwarding process is as follows: Figure 4 Strongswan performs IPSec negotiation. Once negotiation is successful, the IPSec protocol is synchronized to the VPP, which then forwards the data. The specific steps include:

[0173] 1. SPD policy synchronization

[0174] Strongswan generates SPD policies for outbound traffic based on the IPSec connection configuration, synchronizes these policies to the VPP via API, and generates policy policies within Strongswan. Each policy has a unique reqid. While synchronizing the SPD policies, Strongswan enables the ipsec4-output-feature on the outbound node of that interface. Figure 5 The ipsec4-output-feature node is attached after the ip4-output node.

[0175] Specifically, a. Generate traffic to trigger SPD:

[0176] like Figure 6 This is a flowchart of the Strongswan configuration import process. The Strongswan IPSec connection configuration's `start_action` is set to `trap`, and `interface` is the IPsec interface name on the VPP. After the configuration is loaded, Strongswan will generate a traffic-triggered policy for the subnet and synchronize it to the VPP via API. This API uses a VPP-supported SPD policy, and the SPD type is TRAP. After synchronization, the IPsec interface under the VPP will be bound to the traffic-triggered SPD. The policy's key value is `reqid`, which corresponds to the unique IPSecsa connection configuration for a single Strongswan IPSec connection.

[0177] b. Enable traffic triggering nodes:

[0178] After successful SPD synchronization, Strongswan enables the ipsec4-output-feature node of the IPSec interface via API. This is then attached to the ip4-output node for processing.

[0179] 2. Traffic-triggered event callback function

[0180] Strongswan registers an event callback function. Once traffic from a VPP is received, the callback event is triggered. Based on the event reqid value, the corresponding configured IPSec is triggered to initiate IPsec negotiation.

[0181] Specifically, the Strongswan registration event callback is as follows: In the traffic triggering process, if a traffic triggering event is received from VPP, the key value reqid is retrieved, and the policy already installed in Strongswan is invoked to trigger the corresponding IPSec connection configuration to initiate IPSec negotiation.

[0182] Specifically, such as Figure 5 The VPP SPD query node ipsec4-output-feature iterates through the SPDs bound to the IPSec interface. This solution only queries SPDs in the direction of traffic. The query matching rule is to search for 5-tuples. If an SPD with IPSecsa is found, the data is encrypted and forwarded. If only a traffic-triggered TRAP type SPD is found, the solution will pass the packet to the traffic-triggered node ipsec-policy-trap for processing and pass the SPD's reqid to the ipsec-policy-trap node.

[0183] The process triggers IPsec negotiation at the node's ipsec-policy-trap: Upon receiving a packet, the node first determines whether to execute the VPP event reporting process based on the reqid. The solution implements a reporting interval limit: the key-value reqid can only be reported once per minute to prevent a large number of data packets from frequently invoking the Strongswan negotiation process within the Strongswan negotiation timeout period. After the reporting timer expires, the VPP calls the reporting API repeatedly to send data to Strongswan, ultimately achieving proactive IPSec negotiation through Strongswan.

[0184] 3. VPP strategy for traversing nodes

[0185] The IPSec outbound lookup policy SPD node is ipsec4-output-feature. All outbound data processing passes through this SPD processing node. If no corresponding IPSec Sa is found for the outbound traffic, the packet is passed to the traffic trigger node for further processing. If an IPSec Sa is found in the SPD lookup, data encryption is performed to achieve data forwarding.

[0186] 4. Traffic triggering node

[0187] After the policy is traversed and processed, the packet is sent to the traffic triggering node ipsec-policy-trap for processing. This node determines whether the traffic triggering limit timer has expired based on the reqid value of the traffic. If it has expired, it can trigger Strongswan to initiate negotiation by reporting the event registered with Strongswan.

[0188] This embodiment also provides an IPSec traffic triggering device for implementing the above embodiments and preferred embodiments; details already described will not be repeated. As used below, the term "module" can refer to a combination of software and / or hardware that performs a predetermined function. Although the device described in the following embodiments is preferably implemented in software, hardware implementation, or a combination of software and hardware, is also possible and contemplated.

[0189] This embodiment provides an IPSec traffic triggering device, such as... Figure 7 As shown, it includes:

[0190] The receiving module 401 is used by the data forwarding module to receive the target message data sent by the previous node;

[0191] The matching module 402 is used by the data forwarding module to match the target packet data with each first preset policy; the first preset policy includes a first source IP and a first destination IP.

[0192] The negotiation module 403 is used to perform IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy if the target packet data successfully matches the first target preset policy in each first preset policy.

[0193] The sending module 404 is used to transmit the target packet data to the next segment after the IPSec negotiation is successful.

[0194] In some alternative implementations, IPSec traffic triggering devices, such as Figure 8 As shown, it also includes:

[0195] The first acquisition module 405 is used by the IPSec negotiation module to acquire the first network segment information of at least one first virtual machine corresponding to the sending device of the target packet data;

[0196] The second acquisition module 406 is used by the IPSec negotiation module to acquire the second network segment information of at least one second virtual machine corresponding to the destination device corresponding to the target packet data;

[0197] The generation module 407 is used by the IPSec negotiation module to generate SPD policies based on the information of each first network segment and each second network segment;

[0198] The allocation module 408 is used by the IPSec negotiation module to allocate unique identification information to each SPD policy.

[0199] The synchronization generation module 409 is used by the IPSec negotiation module to synchronously generate the first preset policy corresponding to each SPD policy in the data forwarding module based on each SPD policy.

[0200] In some optional implementations, the matching module 402 is specifically used by the data forwarding module to identify the target packet data and determine the target source IP and target destination IP corresponding to the target packet data; the data forwarding module compares the target source IP and target destination IP with the first source IP and first destination IP included in each first preset strategy; the data forwarding module determines the first preset strategy where the first source IP is the same as the target source IP and the first destination IP is consistent with the target destination IP as the first target preset strategy.

[0201] In some optional implementations, the negotiation module 403 is specifically used to: if the target packet data successfully matches the first target preset policy in each first preset policy, then the data forwarding module determines the target unique identifier corresponding to the first target preset policy; the data forwarding module transmits the target unique identifier to the IPSec negotiation module; the IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier; and the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information.

[0202] In some optional implementations, the negotiation module 403 is specifically used for the IPSec negotiation module to obtain the start time of IPSec negotiation based on the previous packet data corresponding to the target packet data; to detect whether the time interval between the current time and the start time is greater than a preset duration; if the time interval between the current time and the start time is greater than the preset duration, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information.

[0203] In some optional implementations, the sending module 404 is specifically used to establish an IPSec tunnel between the data forwarding module and the device; the data forwarding module enables the sending function; and the data forwarding module transmits the target packet data to the next node through the IPSec tunnel based on the sending function.

[0204] In some alternative implementations, IPSec traffic triggering devices, such as Figure 9 As shown, it also includes:

[0205] The discard module 410 is used to discard the target packet data if the target packet data does not match each of the first preset strategies.

[0206] Further functional descriptions of the above modules and units are the same as those in the corresponding embodiments described above, and will not be repeated here.

[0207] In this embodiment, the IPSec traffic triggering device is presented in the form of a functional unit. Here, a unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that execute one or more software or fixed programs, and / or other devices that can provide the above functions.

[0208] This invention also provides an electronic device having the above-described features. Figures 7-9 The IPSec traffic triggering device shown.

[0209] Please refer to 10. Figure 10 This is a schematic diagram of the structure of an electronic device provided in an optional embodiment of the present invention, such as... Figure 10 As shown, the electronic device includes one or more processors 10, memory 20, and interfaces for connecting the components, including high-speed interfaces and low-speed interfaces. The components communicate with each other via different buses and can be mounted on a common motherboard or otherwise as required. The processors can process instructions executed within the electronic device, including instructions stored in or on memory to display graphical information of a GUI on external input / output devices (such as display devices coupled to the interfaces). In some alternative implementations, multiple processors and / or multiple buses can be used with multiple memories and multiple memory modules, if desired. Similarly, multiple electronic devices can be connected, each providing some of the necessary operations (e.g., as a server array, a group of blade servers, or a multiprocessor system). Figure 10 Take a processor 10 as an example.

[0210] Processor 10 may be a central processing unit, a network processor, or a combination thereof. Processor 10 may further include a hardware chip. The hardware chip may be an application-specific integrated circuit (ASIC), a programmable logic device (PLD), or a combination thereof. The programmable logic device may be a complex programmable logic device (CAMP), a field-programmable gate array (FPGA), a general-purpose array logic (GDA), or any combination thereof.

[0211] The memory 20 stores instructions executable by at least one processor 10 to cause the at least one processor 10 to perform the method shown in the above embodiments.

[0212] The memory 20 may include a program storage area and a data storage area. The program storage area may store the operating system and applications required for at least one function; the data storage area may store data created based on the use of the electronic device. Furthermore, the memory 20 may include high-speed random access memory and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid-state storage device. In some alternative embodiments, the memory 20 may optionally include memory remotely located relative to the processor 10, and these remote memories may be connected to the electronic device via a network. Examples of such networks include, but are not limited to, the Internet, intranets, local area networks, mobile communication networks, and combinations thereof.

[0213] The memory 20 may include volatile memory, such as random access memory; the memory may also include non-volatile memory, such as flash memory, hard disk or solid-state drive; the memory 20 may also include a combination of the above types of memory.

[0214] The electronic device also includes a communication interface 30 for communicating with other devices or communication networks.

[0215] This invention also provides a computer-readable storage medium. The methods described above according to embodiments of the invention can be implemented in hardware or firmware, or implemented as computer code that can be recorded on a storage medium, or implemented as computer code downloaded via a network and originally stored on a remote storage medium or a non-transitory machine-readable storage medium and then stored on a local storage medium. Thus, the methods described herein can be processed by software stored on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. The storage medium can be a magnetic disk, optical disk, read-only memory, random access memory, flash memory, hard disk, or solid-state drive, etc.; further, the storage medium can also include combinations of the above types of memory. It is understood that computers, processors, microprocessor controllers, or programmable hardware include storage components capable of storing or receiving software or computer code, which, when accessed and executed by the computer, processor, or hardware, implements the methods shown in the above embodiments.

[0216] A portion of this invention can be applied as a computer program product, such as computer program instructions, which, when executed by a computer, can invoke or provide the methods and / or technical solutions according to the invention through the operation of the computer. Those skilled in the art will understand that the forms in which computer program instructions exist in a computer-readable medium include, but are not limited to, source files, executable files, installation package files, etc. Correspondingly, the ways in which computer program instructions are executed by a computer include, but are not limited to: the computer directly executing the instructions, or the computer compiling the instructions and then executing the corresponding compiled program, or the computer reading and executing the instructions, or the computer reading and installing the instructions and then executing the corresponding installed program. Here, the computer-readable medium can be any available computer-readable storage medium or communication medium accessible to a computer.

[0217] Although embodiments of the invention have been described in conjunction with the accompanying drawings, those skilled in the art can make various modifications and variations without departing from the spirit and scope of the invention, and such modifications and variations all fall within the scope defined by the appended claims. < / policy> < / policy> < / reqid> < / reqid> < / policy> < / action> < / policy> < / action> < / policy-attributes> < / policy>

Claims

1. A method for triggering IPSec traffic, characterized in that, The method includes: The data forwarding module receives the target message data sent by the previous node; The IPSec negotiation module obtains the first network segment information of at least one first virtual machine corresponding to the sending device of the target packet data; The IPSec negotiation module obtains the second network segment information of at least one second virtual machine corresponding to the destination device corresponding to the target packet data; The IPSec negotiation module generates an SPD policy based on the information of each of the first network segments and each of the second network segments; The IPSec negotiation module assigns unique identification information to each of the SPD policies; Based on each of the SPD policies, the IPSec negotiation module synchronously generates a first preset policy corresponding to each of the SPD policies in the data forwarding module. The data forwarding module matches the target packet data with each of the first preset strategies; the first preset strategy includes a first source IP and a first destination IP. If the target packet data successfully matches the first target preset policy in each of the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy. After the IPSec negotiation is successful, the data forwarding module transmits the target packet data to the next node; Wherein, if the target packet data successfully matches the first target preset policy in each of the first preset policies, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy, including: If the target message data successfully matches the first target preset policy in each of the first preset policies, the data forwarding module determines the target unique identifier corresponding to the first target preset policy; The data forwarding module transmits the target unique identifier to the IPSec negotiation module; The IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier; The IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information. The IPSec negotiation module performs the following negotiation steps: The IPSec negotiation module checks the security policy of the target network or host to determine whether encryption or authentication is required; based on a first target preset policy, it determines the encryption algorithm, authentication algorithm, key exchange algorithm, and security parameter index included in the first target preset policy; the IPSec negotiation module initializes a Security Association (SA) using the Internet Security Association and Key Management Protocol (ISAKMP); at the start of the negotiation process, the IPSec negotiation module sends an ISAKMP Initial Exchange message to the target device, which includes the supported encryption algorithms, authentication methods, and security parameters; after receiving the message from the IPSec negotiation module, the target device sends a response message based on its own policy and security requirements, proposing its own security parameter selection; the IPSec negotiation module and the target device reach a consensus on security parameters through a series of proposal and response messages; once the SA is established, the IPSec negotiation module and the target device use the selected key exchange algorithm to generate a key for subsequent IPSec data encryption and authentication; once both the SA and the key are established, a secure tunnel is established between the IPSec negotiation module and the target device to protect data transmission.

2. The method according to claim 1, characterized in that, The step of matching the target message data with each of the first preset strategies includes: The data forwarding module identifies the target packet data and determines the target source IP and target destination IP corresponding to the target packet data; The data forwarding module compares the target source IP and the target destination IP with the first source IP and the first destination IP included in each of the first preset strategies; The data forwarding module determines the first preset policy, in which the first source IP is the same as the target source IP and the first destination IP is the same as the target destination IP, as the first target preset policy.

3. The method according to claim 1, characterized in that, The IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information, including: The IPSec negotiation module obtains the start time of IPSec negotiation based on the previous packet data corresponding to the target packet data; Detect whether the time interval between the current time and the start time is greater than a preset duration; If the time interval between the current time and the start time is greater than the preset duration, the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information.

4. The method according to claim 1, characterized in that, After the IPSec negotiation is successful, the data forwarding module transmits the target packet data to the next node, including: The data forwarding module establishes an IPSec tunnel with the device; The data forwarding module enables the sending function; The data forwarding module transmits the target packet data to the next node through the IPSec tunnel based on the sending function.

5. The method according to claim 1, characterized in that, The method further includes: If the target message data does not match any of the first preset policies, the data forwarding module will discard the target message data.

6. An IPSec traffic triggering device, characterized in that, The device includes: The receiving module is used by the data forwarding module to receive the target message data sent by the previous node; The matching module is used for: the IPSec negotiation module to obtain first network segment information of at least one first virtual machine corresponding to the sending device corresponding to the target packet data; the IPSec negotiation module to obtain second network segment information of at least one second virtual machine corresponding to the destination device corresponding to the target packet data; the IPSec negotiation module to generate SPD policies based on each of the first network segment information and each of the second network segment information; the IPSec negotiation module to assign unique identifier information to each of the SPD policies; the IPSec negotiation module to synchronously generate first preset policies corresponding to each of the SPD policies in the data forwarding module based on each of the SPD policies; the data forwarding module to match the target packet data with each of the first preset policies; the first preset policies include a first source IP and a first destination IP. The negotiation module is configured to, if the target packet data successfully matches a first target preset policy in each of the first preset policies, then the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy; wherein, the step of the IPSec negotiation module performing IPSec negotiation with the destination device corresponding to the target packet data based on the first target preset policy if the target packet data successfully matches a first target preset policy in each of the first preset policies includes: if the target packet data successfully matches a first target preset policy in each of the first preset policies, then the data forwarding module determines the target unique identifier corresponding to the first target preset policy; the data forwarding module forwards the target packet data to the destination device corresponding to the first target preset policy. The unique identifier is transmitted to the IPSec negotiation module; the IPSec negotiation module determines the target policy information corresponding to the first target preset policy based on the target unique identifier; the IPSec negotiation module performs IPSec negotiation with the destination device corresponding to the target packet data based on the target policy information; the IPSec negotiation module performs negotiation including: the IPSec negotiation module checks the security policy of the target network or host to determine whether encryption or authentication is required; based on the first target preset policy, it determines the encryption algorithm, authentication algorithm, key exchange algorithm, and security parameter index included in the first target preset policy; the IPSec negotiation module initializes the Security Association (SA), and the IPSec negotiation module uses the Internet... The Security Association and Key Management Protocol (ISAKMP) negotiates the Security Association (SA). At the start of the negotiation process, the IPSec negotiation module sends an ISAKMP Initial Exchange message to the destination device, which includes the supported encryption algorithms, authentication methods, and security parameters. Upon receiving the message from the IPSec negotiation module, the destination device sends a response message based on its own policies and security requirements, proposing its own security parameter selections. Through a series of proposal and response messages, the IPSec negotiation module and the destination device ultimately reach a consensus on the security parameters. Once the SA is established, the IPSec negotiation module and the destination device use the selected key exchange algorithm to generate a key for subsequent IPSec data encryption and authentication. Once both the SA and the key are established, a secure tunnel is established between the IPSec negotiation module and the destination device to protect data transmission. The sending module is used to transmit the target packet data to the next segment after the IPSec negotiation is successful, as described by the data forwarding module.

7. An electronic device, characterized in that, include: A memory and a processor are communicatively connected, the memory stores computer instructions, and the processor executes the computer instructions to perform the IPSec traffic triggering method according to any one of claims 1 to 5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer instructions for causing a computer to perform the IPSec traffic triggering method according to any one of claims 1 to 5.

Images