Method for authenticating encrypted and decrypted data and related equipment

Abstract

The invention provides a method for authenticating encrypted and decrypted data and related equipment. The method comprises the following steps: acquiring an original data packet, wherein the original data packet is captured at a link layer by using an XDP technology; encrypting the effective load of the original data packet to obtain a first data packet; generating a message digest and signing the message digest to generate a message authentication code; packaging the message authentication code and the first data packet to obtain a second data packet; verifying the authenticity of the second data packet; and in response to the second data packet passing verification, writing the second data packet into a decryption thread queue for decryption so as to obtain the original data packet. Through the method, authentication encryption of data transmission between the terminal and the service system is realized, so that the data transmission between the terminal and the service system is safer.

Description

Technical Field

[0001] The present application relates to the field of communication technology, and in particular to a method and related equipment for authenticating, encrypting and decrypting data. Background Art

[0002] With the rapid development of network technology and the continuous improvement of information security requirements, link layer security technology has gradually become an important direction of network security research. Especially in network scenarios with high performance and low latency requirements, link layer transparent authentication and encryption mechanisms have received widespread attention due to their efficiency and transparency.

[0003] In some application scenarios, data transmission between the terminal and the business system is not encrypted and authenticated, which is not conducive to secure data transmission. However, directly adding encryption and authentication mechanisms to the terminal and the business system requires modifications to the terminal and the business system, which is inconvenient. Summary of the invention

[0004] In view of this, the purpose of this application is to propose a method and related equipment for authenticating, encrypting and decrypting data, so as to solve or partially solve the above problems.

[0005] Based on the above purpose, in a first aspect, the present application provides a method for authenticating, encrypting and decrypting data, comprising: Obtaining an original data packet, where the original data packet is captured at the link layer using the XDP technology; Encrypting the payload of the original data packet to obtain a first data packet; Generate a message digest and sign the message digest to generate a message authentication code; Encapsulating the message authentication code and the first data packet to obtain a second data packet; Verifying the authenticity of the second data packet; In response to the second data packet being verified successfully, the second data packet is written into a decryption thread queue for decryption to obtain the original data packet.

[0006] Optionally, obtaining the original data packet further includes: Performing first-layer filtering, second-layer filtering, and third-layer filtering on multiple target data packets at the kernel layer to obtain the original data packets; Among them, the first layer of filtering filters irrelevant traffic based on source address, destination address and port number, the second layer of filtering narrows the target range based on protocol fields, and the third layer of filtering matches the payload of the original data packet with specific rules.

[0007] Optionally, generating a message digest and signing the message digest to generate a message authentication code further includes: In the signature thread queue, the message digest is generated using the SM3 algorithm; Generate a public key and a private key using the SM2 algorithm, wherein the public key and the private key are generated in the terminal side module and the gateway module respectively; The message digest is signed using the private key to generate the message authentication code.

[0008] Optionally, the verifying the authenticity of the second data packet further includes: Reading the second data packet from the capture thread queue, and extracting the message authentication code in the second data packet in the verification thread queue; The message digest is recalculated using SM3, and the authenticity of the message authentication code is verified using the public key.

[0009] Optionally, the step of writing the second data packet into a decryption thread queue for decryption to obtain the original data packet further comprises: The second data packet is read from the verification thread queue, and the payload of the second data packet is decrypted using the SM4 algorithm in the decryption thread queue to obtain the original data packet.

[0010] Optionally, encrypting the payload of the original data packet to obtain the first data packet further includes: The original data packet is read from the capture thread queue and the payload of the original data packet is encrypted using the SM4 algorithm in the encryption thread queue to obtain the first data packet.

[0011] Optionally, encapsulating the message authentication code and the first data packet to obtain a second data packet further includes: The first data packet is read from the signature thread queue and the message authentication code and the first data packet are encapsulated to obtain the second data packet.

[0012] In a second aspect of the present application, a device for authenticating, encrypting and decrypting data is provided, comprising: An acquisition module is configured to acquire an original data packet, where the original data packet is captured at the link layer using the XDP technology; an encryption module, configured to encrypt the payload of the original data packet to obtain a first data packet; A generating module, configured to generate a message digest and sign the message digest to generate a message authentication code; an encapsulation module, configured to encapsulate the message authentication code and the first data packet to obtain a second data packet; A verification module, configured to verify the authenticity of the second data packet; The decryption module is configured to write the second data packet into a decryption thread queue for decryption in response to the second data packet being verified successfully, so as to obtain the original data packet.

[0013] In a third aspect of the present application, an electronic device is provided, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method described in the first aspect is implemented.

[0014] According to a fourth aspect of the present application, a non-transitory computer-readable storage medium is provided, wherein the non-transitory computer-readable storage medium stores computer instructions, wherein the computer instructions are used to enable a computer to execute the method described in the first aspect.

[0015] From the above, it can be seen that the present application provides a method and related equipment for authenticating, encrypting and decrypting data. The method includes: obtaining an original data packet, which is captured at the link layer using XDP technology; encrypting the payload of the original data packet to obtain a first data packet; generating a message digest and signing the message digest to generate a message authentication code; encapsulating the message authentication code and the first data packet to obtain a second data packet; verifying the authenticity of the second data packet; in response to the second data packet being verified, writing the second data packet to the decryption thread queue for decryption to obtain the original data packet. The above method realizes the authentication encryption of data transmission between the terminal and the business system, making the data transmission between the terminal and the business system more secure. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] In order to more clearly illustrate the technical solutions in the present application or related technologies, the drawings required for use in the embodiments or related technical descriptions are briefly introduced below. Obviously, the drawings described below are only embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0017] Figure 1 A schematic diagram of an exemplary network data packet processing system 100 according to an embodiment of the present application is shown.

[0018] Figure 2 A schematic diagram of an exemplary system architecture 200 according to an embodiment of the present application is shown.

[0019] Figure 3 A schematic diagram of an exemplary device for authenticating, encrypting and decrypting data according to an embodiment of the present application is shown.

[0020] Figure 4 A schematic diagram of an exemplary electronic device according to an embodiment of the present application is shown. DETAILED DESCRIPTION

[0021] In order to make the objectives, technical solutions and advantages of the present application more clearly understood, the present application is further described in detail below in combination with specific embodiments and with reference to the accompanying drawings.

[0022] It should be noted that, unless otherwise defined, the technical terms or scientific terms used in the embodiments of the present application should be the usual meanings understood by people with ordinary skills in the field to which the present application belongs. The "first", "second" and similar words used in the embodiments of the present application do not represent any order, quantity or importance, but are only used to distinguish different components. "Including" or "comprising" and similar words mean that the elements or objects appearing in front of the word cover the elements or objects listed after the word and their equivalents, without excluding other elements or objects. "Connect" or "connected" and similar words are not limited to physical or mechanical connections, but can include electrical connections, whether direct or indirect. "Up", "down", "left", "right" and the like are only used to indicate relative positional relationships. When the absolute position of the described object changes, the relative positional relationship may also change accordingly.

[0023] The authentication mechanism is mainly used to verify the identity of network devices and both parties in communication to ensure the legitimacy of the source of the data packet. Commonly used protocols include 802.1X and digital certificate authentication based on PKI (Public Key Infrastructure). The encryption mechanism encrypts the link layer data to prevent data leakage or tampering. For example, MACsec (Media Access Control Security) ensures communication security through Ethernet frame encryption. The management and control platform uses a centralized network security management system to configure and monitor link layer security policies.

[0024] At present, the link layer authentication and encryption technology can be mainly divided into three directions: protocol-based authentication and encryption, hardware-based high-performance implementation, and software-based flexible solutions. Protocol-based authentication and encryption technologies include 802.1X and MACsec. The former implements link layer security through access control, and the latter ensures communication security through Ethernet frame encryption. Although IPSec (Internet Protocol Security, a security protocol suite used to protect Internet protocol communications) is mainly used at the network layer, it can also be used at the link layer to provide more comprehensive protection. Hardware-based high-performance implementation significantly improves the performance of link layer encryption with the help of devices that support hardware acceleration (such as network cards that support AES-NI (Advanced Encryption Standard New Instructions). Software-based flexible solutions use high-performance packet processing technologies such as XDP (eXpress Data Path) and BPF (Berkeley Packet Filter) to perform transparent authentication and encryption at the link layer to adapt to complex and dynamic network environments.

[0025] In the specific application scenarios of authentication and encryption mechanisms, typical technical examples include access control of authentication devices, link layer encryption data protection, and dynamic packet capture and transparent encryption. For example, the 802.1X protocol verifies the legitimacy of access devices through the RADIUS (Remote Authentication Dial-In User Service) server and is widely used in enterprise networks and Wi-Fi (Wireless Fidelity) hotspot management; MACsec encrypts Ethernet frames with high efficiency and adds integrity check information to data packets for the protection of data centers and corporate intranets; XDP-based real-time packet processing technology can complete authentication and encryption operations within millisecond delays and is suitable for high-performance networks. The comprehensive application of these technologies provides an efficient and flexible solution for link layer security in modern network environments.

[0026] At present, link layer authentication and encryption technology can be divided into three major directions: (1) protocol-based authentication and encryption, (2) hardware-based high-performance implementation, and (3) software-based flexible solutions.

[0027] (1) Protocol-based authentication encryption technology 802.1X is a network access control protocol that verifies the identity of devices through a RADIUS server to ensure that only authorized devices can access the network. Devices need to provide credentials (such as user name, password, or certificate) when connecting, and can only access after successful authentication. 802.1X is widely used in enterprise networks and Wi-Fi hotspots to prevent illegal devices from accessing, and supports dynamic key distribution to enhance security. MACsec (IEEE 802.1AE) is an Ethernet link layer encryption protocol that protects the security and integrity of data transmission by encrypting and authenticating Ethernet frames. It uses encryption algorithms such as AES-GCM (Advanced Encryption Standard -Galois / Counter Mode) to add integrity check values ​​to each frame to prevent data tampering and replay attacks. MACsec supports hop-by-hop encryption and is suitable for high-security scenarios such as data centers and enterprise intranets. It is often used in combination with 802.1X, with 802.1X responsible for device authentication and MACsec responsible for data encryption.

[0028] IPSec is mainly used at the network layer, but it can also provide additional protection at the link layer through tunnel mode. It supports encryption, integrity verification and identity authentication, and is suitable for high-security communications across networks.

[0029] (2) High-performance implementation based on hardware Hardware-based high-performance implementation significantly improves the performance of link layer encryption by utilizing devices that support hardware acceleration (such as network cards that support the AES-NI instruction set). These hardware acceleration devices can offload encryption and decryption operations from the CPU (Central Processing Unit) to dedicated hardware for execution, thereby significantly reducing the CPU burden and improving data processing efficiency.

[0030] Take the network card that supports AES-NI (Advanced Encryption Standard New Instruction Set) as an example. AES-NI is an instruction set designed specifically to accelerate the AES encryption algorithm, which can efficiently perform encryption and decryption operations at the hardware level. By offloading the AES encryption algorithm to the network card that supports AES-NI, the performance of link layer encryption can be significantly improved, especially when processing large-scale data traffic, achieving higher throughput and lower latency.

[0031] In addition, some high-end network cards (such as SmartNICs) also integrate dedicated encryption engines that can perform complex encryption and authentication operations directly at the hardware level. These network cards not only support AES, but can also accelerate other encryption algorithms (such as ChaCha20, SHA (Secure Hash Algorithm), etc.), further optimizing the performance of link layer encryption. Through hardware acceleration, network devices can still maintain efficient data processing capabilities under high-load environments, and are suitable for scenarios with extremely high network performance requirements such as data centers, cloud computing, and high-performance computing.

[0032] (3) Flexible software-based solutions The flexible software-based solution uses high-performance packet processing technologies such as XDP (eXpress Data Path) to achieve transparent authentication and encryption at the link layer, which can effectively cope with complex and dynamically changing network environments. XDP is a high-performance network data processing framework in the Linux operating system kernel. It allows users to process network packets directly in the kernel space, bypassing the traditional kernel network protocol stack, thereby significantly reducing latency and improving processing efficiency.

[0033] The core advantage of XDP is that it can operate on data packets before they enter the kernel network protocol stack, which makes it particularly suitable for transparent authentication and encryption at the link layer. With XDP, data packets can be processed immediately when they arrive at the network card, such as filtering, encryption, or authentication, without passing the data packets to the kernel's network protocol stack. This processing method not only reduces the processing path of data packets, but also achieves extremely high performance, which can meet the requirements of modern networks for low latency and high throughput.

[0034] In link layer transparent authentication and encryption, XDP can be used to implement a variety of functions. For example, the XDP program can quickly filter out data packets that do not comply with security policies to ensure that only authenticated devices can access the network. At the same time, XDP can also encrypt data packets before they enter the kernel protocol stack to ensure the security of data during transmission. In addition, the XDP program can dynamically adjust security policies and enable or disable specific filtering rules based on the real-time situation of network traffic, thereby adapting to complex and changing network environments.

[0035] The flexibility of XDP is also reflected in its support for dynamic loading and updating. Users can use eBPF (Extended Berkeley Packet Filter) to write custom packet processing programs and dynamically load them into the kernel for execution. This flexibility enables XDP-based solutions to adapt to different network requirements and security policies, such as automatically enabling stricter filtering rules when an attack is detected, or optimizing the performance of encryption algorithms when the network load is high.

[0036] Although the above methods and technologies have been widely used in different scenarios, the following problems still exist: (1) Insufficient transparency: Many existing methods (such as IPSec and 802.1X) have poor transparency at the link layer and require user or administrator configuration, which may affect the user experience.

[0037] (2) Performance issues: High-performance encryption and authentication mechanisms (such as AES-256 and RSA-2048) usually incur large computational overhead and may become a bottleneck in high-throughput environments.

[0038] (3) Strong hardware dependence: Solutions like MACsec rely on hardware support. If the device does not support it, it cannot be implemented. This hardware dependence limits the popularity of the technology.

[0039] (4) Lack of flexibility and adaptability: Many technologies are difficult to adapt flexibly in dynamic network environments (such as multi-point connections and heterogeneous networks).

[0040] In order to at least solve the above problems, the present application provides a method and related equipment for authenticating, encrypting and decrypting data. The method includes: obtaining an original data packet, which is captured at the link layer using XDP technology; encrypting the payload of the original data packet to obtain a first data packet; generating a message digest and signing the message digest to generate a message authentication code; encapsulating the message authentication code and the first data packet to obtain a second data packet; verifying the authenticity of the second data packet; in response to the second data packet being verified, writing the second data packet to the decryption thread queue for decryption to obtain the original data packet. The above method realizes the authentication encryption of data transmission between the terminal and the business system, making the data transmission between the terminal and the business system more secure.

[0041] Figure 1 A schematic diagram of an exemplary network data packet processing system 100 according to an embodiment of the present application is shown.

[0042] like Figure 1 As shown, the embodiment of the present application designs a secure and efficient network data packet processing system 100 based on XDP technology to implement a transparent authentication and encryption mechanism for traffic packets. The network data packet processing system 100 adds a terminal side module 106 and a gateway module 108 between the terminal 102 and the business system 104, and combines XDP technology at the link layer to implement data authentication, encryption and decryption, while maintaining a transparent effect on the terminal 102, and combines multi-threading technology and national secret algorithms to improve framework performance. The specific scheme includes: network data packet capture and an encryption authentication protocol based on a national secret algorithm. Specifically, as Figure 1As shown, the terminal 102 sends the original data packet to the terminal side module 106, the capture thread queue XDP program captures the data packet at the link layer, the encryption thread queue uses the SM4 algorithm to encrypt, the signature thread queue uses the SM3 algorithm to generate a message digest, and the message digest is signed using the SM2 private key to generate a MAC. The terminal side module 106 sends the encrypted data packet to the gateway module 108, the capture thread queue, the XDP program captures the data packet at the link layer, the verification thread queue uses the SM3 algorithm to generate a message digest, the MAC is verified using the SM2 public key, and the decryption thread queue uses the SM4 algorithm to decrypt. The gateway module 108 sends the decrypted data packet to the business system 104. In this way, there is no need to modify the terminal and the business system, and the encryption authentication and decryption of the data packet are realized by adding the terminal side module and the gateway module. At the same time, in the authentication, encryption and decryption process of the data, combined with the characteristics of different national secret algorithms, different national secret algorithms are respectively applied to the signature, message digest generation, encryption stage and decryption stage, and these stages are respectively placed in independent thread queues for execution, which can improve the efficiency of data authentication, encryption and decryption.

[0043] Figure 2 A schematic diagram of an exemplary system architecture 200 according to an embodiment of the present application is shown.

[0044] like Figure 2 As shown, the system architecture 200 may be a Linux system architecture for processing network data packets. The system architecture 200 may include a user layer, a kernel layer, and a hardware layer, and describes the processing flow of data packets from an application to a network interface card (NIC).

[0045] User Layer: Applications: These are programs that run in user space and interact with the kernel through system calls to make network requests or process network packets.

[0046] Kernel layer: Network protocol stack: This is the part of the operating system kernel that is responsible for network communications and handles the transmission of packets from the application to the network interface card.

[0047] XDP Hook: XDP is an application of eBPF (Extended Berkeley Packet Filter) that processes packets at the very front end of the kernel network stack. It can process packets before they enter the network protocol stack, such as quickly discarding, filtering, or modifying them.

[0048] Driver: This is the part of the operating system kernel that interacts directly with hardware devices (such as network interface cards). It is responsible for passing packets from the hardware layer to the kernel layer, or from the kernel layer to the hardware layer.

[0049] eBPF virtual machine: This is a virtual machine in the kernel that is used to execute eBPF programs. eBPF programs are a special kernel module that can be dynamically loaded into the kernel for execution without changing the kernel source code. They are often used in scenarios such as network packet processing and performance monitoring.

[0050] Hardware layer: NIC Network Interface Card: This is a hardware device in the computer that is responsible for the physical connection with the external network. It transfers network packets from the physical network to the computer, or from the computer to the physical network.

[0051] (1) Network packet capture: Linux eBPF is a lightweight, powerful virtual machine that provides a set of libraries that allow code to be dynamically injected from user-space applications into various kernel events. At the same time, XDP provides special hooks for eBPF kernel programs to effectively pass, drop / filter, and redirect network packets received at network ports. eBPF / XDP programs can be connected to the network driver through three different points, namely skb (generic), native, and hw (HardwareOffloading, program offloading to hardware). The fastest one, namely hw or offloading mode allows XDP programs to run on the NIC itself. However, for this mode, SmartNIC is required. In native mode, XDP hooks are called in the driver before the kernel allocates the socket buffer (driver support is required). In skb or generic mode, XDP hooks are called after packet DMA (DirectMemory Access) and socket buffer allocation. Therefore, in this case, the processing performance is significantly lower than other modes. We configure the XDP tool and exclusively use xdp-dump (using native mode) for network packet capture.

[0052] like Figure 2 As shown in the figure, the XDP program directly operates the data packets received by the NIC network interface card. In this way, the XDP technology captures the data packets sent by the terminal at the link layer, and the data packets are directly processed in the kernel space to avoid copying to the user space. The XDP program is run by a single thread to avoid the competition problem introduced by multi-threaded capture. And through the optimized XDP packet capture strategy, the data packets sent by the terminal are captured according to priority: First-level filtering: quickly filter irrelevant traffic based on source address (Source IP), destination address (Destination IP), and port number.

[0053] Second layer filtering: further narrows the target range based on protocol fields (such as TCP (Transmission Control Protocol) flags).

[0054] Layer 3 filtering: Optional matching of specific rules (such as regular expression matching) on ​​packet payloads.

[0055] Precision filtering based on eBPF: XDP relies on eBPF programs to implement packet processing logic. Accurate packet capture can be achieved by writing optimized eBPF filtering rules.

[0056] Layered filtering: Implement multi-layer filtering logic in the XDP program to gradually narrow the target data packet range according to priority. Layered filtering gradually narrows the target range of the data packet, first processing simple rules, and then gradually deepening complex inspections. This can reduce processing delays while ensuring the accuracy of data packets.

[0057] (1) First-layer filtering: packet header information inspection, the goal is to quickly filter out data packets that are not related to the business and reduce the system burden. The inspection content includes: Source address and destination address: Determine whether it belongs to the target IP range, such as using subnet matching.

[0058] Source port and destination port: Filter specific protocols based on port numbers (such as port 80 for HTTP and port 443 for HTTPS).

[0059] Message Authentication Code (MAC) address matching: Checks the source MAC address of a data packet and discards packets with illegal or untrusted MAC addresses.

[0060] Packet Type: Checks the Ethernet frame type field to determine whether it is an IPv4 (Internet Protocol version 4), IPv6 (Internet Protocol version 6), or ARP (Address Resolution Protocol) packet.

[0061] (2) Second-layer filtering: protocol field inspection, further filtering data packets based on protocol fields to accurately match specific business needs. This is achieved by parsing deeper protocol headers (such as TCP (Transmission Control Protocol) or UDP (User Datagram Protocol)) after the first-layer filtering passes, and using precise comparisons (such as port numbers) or partial matches (such as domain names in HTTP fields). Detection content includes: TCP flag check: Checks whether the packet has specific flags such as SYN (Synchronize Sequence Numbers) and ACK (Acknowledgment) (for example, SYN packets are used to establish a connection).

[0062] UDP field check: Verify specific fields of UDP protocols such as DNS (Domain Name System) and DHCP (Dynamic Host Configuration Protocol).

[0063] Application layer protocol field check: further screening based on HTTP (HyperText Transfer Protocol) header fields or TLS (Transport Layer Security) handshake fields. For example, check whether the HTTP Host field contains the target domain name.

[0064] (3) Third layer filtering: Payload data inspection, by parsing the payload from the TCP or UDP header and further filtering according to regular expressions or predefined rules, to perform more detailed analysis on the packet payload that meets the conditions, such as matching specific keywords. The inspection content includes: Regular expression matching: matches a specific string or format in the payload (such as the URL of an HTTP request).

[0065] Specific rule matching: such as detecting whether a DNS query contains a specific domain name.

[0066] Hash match filtering: Hash common traffic features (such as hotspot IP addresses and port numbers) and use hash tables to quickly find matching rules, reducing the performance overhead caused by complex filtering logic. Build a flow table cache to directly mark matching traffic to avoid repeated filtering.

[0067] Use the eBPF hash table (BPF_MAP_TYPE_HASH) to cache hot traffic features. When a packet arrives, the hash table is queried first, and if a match is found, it is quickly released or processed.

[0068] (2) Encryption authentication protocol based on national secret algorithm: In order to ensure that the identities of the terminal and the gateway are authentic and reliable, prevent masquerade attacks, protect sensitive data during the authentication process, and prevent man-in-the-middle attacks, in some embodiments, the national secret standard algorithm (SM2, SM3, SM4) can be combined with multi-threading technology to implement a safer and more efficient protocol, which can be used for identity authentication between the terminal side module and the gateway module to ensure the legitimacy of communication and the integrity of data. The protocol includes an initialization phase, an authentication phase, and a key negotiation phase to ensure that secure communication is established after the identities of both parties are reliable. Use a high-performance lock-free queue-a producer-consumer queue implemented based on a ring buffer. Encryption, signing, decryption, verification and other tasks are handled by independent thread pools, and the thread pool size can be dynamically adjusted according to system resources and traffic load. Among them, the SM2 algorithm is used to generate public and private key pairs, perform digital signatures and verification, the SM3 algorithm is used to generate message digests to ensure data integrity, and the SM4 algorithm is used for symmetric encryption to protect the confidentiality of authentication data.

[0069] Encryption authentication protocol based on national secret algorithm: The protocol includes initialization phase, authentication phase and key negotiation phase to ensure that the identities of both parties are trustworthy and establish secure communication.

[0070] By combining multi-threading technology with the national encryption algorithm, a high-performance lock-free queue is used - a producer-consumer queue based on a ring buffer. Encryption, signing, decryption, verification and other tasks are handled by independent thread pools, and the thread pool size can be dynamically adjusted according to system resources and traffic load.

[0071] Initialization phase: (1) Terminal side module and gateway key pair generation: The terminal and gateway each generate a pair of SM2 public and private keys. Terminal: (PK T , S.K. T ), Gateway: (PK G , S.K. G ), where PK T and PK G Represents the public keys of the terminal and gateway respectively, SK T and SK G Represents the private keys of the terminal and gateway respectively.

[0072] (2) Public key exchange and distribution: The terminal-side module and the gateway exchange public keys through a secure channel (pre-deployment, CA (Certificate Authority) signature).

[0073] Certification stage: (1) The terminal side module sends an authentication request: The terminal side module generates a random number R T .

[0074] Construct the authentication message: , where T is the terminal identifier.

[0075] Use the private key SK of the terminal side module T For authentication message M T Sign and generate a digital signature: .

[0076] (M T , S T ) is sent to the gateway. SM2_Sign indicates the algorithm used by SM2 to generate the digital signature.

[0077] (2) Gateway verifies terminal identity: After receiving the message, the gateway extracts M T and S T .

[0078] Use the public key PK of the terminal side module T Verify the signature: .

[0079] If verification fails, the authentication request is rejected.

[0080] If the verification is successful, a random number R is generated G , construct the authentication message: , where G is the gateway identifier.

[0081] Use the gateway's private key SK G For authentication message M G Sign, generate a digital signature: .

[0082] M G , S G ) is sent to the terminal side module.

[0083] (3) Terminal verifies gateway identity: After receiving the message, the terminal extracts M G and S G .

[0084] Use the gateway's public key PK G Verify the signature: .

[0085] If the verification fails, the authentication is terminated.

[0086] Key negotiation phase: (1) Key generation: Both parties are based on the random number R T and R G, and their respective private keys and public keys, generate a shared symmetric key K through a key agreement algorithm:

[0087] Among them, SM2_KeyExchange represents the key negotiation algorithm.

[0088] (2) Key confirmation: Both parties verify key consistency through a hash check code (SM3):

[0089] The terminal sends HMAC T To the gateway, the gateway calculates the local HMAC and verifies whether it is consistent. HMAC is a hash check value. The HMAC is generated using the SM3 algorithm and combined with an identifier (such as the string "CONFIRM") as a confirmation signal to verify the consistency of the shared key generated by both parties. Among them, "CONFIRM" is a string constant that indicates confirmation information to ensure the uniqueness of key confirmation and prevent replay attacks.

[0090] (3) Subsequent confirmation: After authentication, both parties use the shared symmetric key K and SM4 encryption for secure communication.

[0091] Multithreaded queue: The data packet processing adopts the producer-consumer model, and the data at each stage is managed by a multi-threaded queue to ensure that the tasks are delivered in order. The thread that captures the data packet puts the data into the queue and transfers it to the thread of the next stage after processing.

[0092] Encryption thread pool: reads data packets from the capture thread queue, encrypts the payload of the data packets using the SM4 algorithm, and puts the encrypted data packets (eg, the first data packet) into the signature thread queue.

[0093] Signature thread pool: Use the SM3 algorithm to generate a message digest to ensure data integrity. Use the SM2 algorithm to generate a public / private key pair, and use the private key to sign the message digest to generate a message authentication code (MAC). This step ensures the authenticity and source credibility of the data. The encrypted data packet is encapsulated with the MAC to obtain a second data packet, and the second data packet is sent directly to the gateway at the link layer through the XDP program.

[0094] Verification thread pool: In the gateway module, read the data packet from the capture thread queue, extract the message authentication code (MAC) and encrypted payload in the data packet, use SM3 to recalculate the message digest, use the terminal's SM2 public key to verify the authenticity of the MAC, ensure that the data packet has not been tampered with, and write the data packet to the decryption thread queue after verification.

[0095] Decryption thread pool: reads data packets from the verification thread queue, decrypts the payload using the SM4 algorithm, and puts the decrypted data packets into the sending queue.

[0096] The embodiment of the present application uses XDP technology and its feature of processing data packets before they enter the kernel protocol stack. By adding terminal modules and gateway modules between the terminal and the business system, a secure and efficient network data packet processing framework is designed to implement a transparent authentication and encryption mechanism for data. The deployment of terminal modules and gateways is transparent to the terminal and the business system, and the terminal and the business system do not need to modify any configuration or code. The terminal module and the gateway retain the original header information of the data packet during the encryption and decryption process to ensure that the communication between the terminal and the business system is not affected.

[0097] The method provided in the embodiment of the present application can achieve the following technical effects: (1) Security In the traffic road network, considering the large number of terminal devices in the Internet of Things environment, the communication between these terminal devices and the business system is often not secure enough. Therefore, the embodiment of the present application incorporates the national encryption algorithm (SM2, SM3, SM4) into the XDP network data packet processing framework, and encrypts, signs, authenticates, and decrypts the data packets by designing a safe and efficient protocol.

[0098] (2) System performance By combining multi-threading technology and using high-performance lock-free queues, encryption, signing, decryption, verification and other tasks are handled by independent thread pools. The thread pool size can be dynamically adjusted according to system resources and traffic load, which can significantly improve throughput and efficiency.

[0099] (3) Transparent certification By using XDP technology, authentication and encryption operations are embedded in the link layer to improve performance while achieving transparent processing. By adding terminal modules and gateway modules between the terminal and the business system, the XDP technology is combined at the link layer to achieve data authentication, encryption and decryption, while maintaining transparency to the terminal and business system, that is, no changes are required to the terminal and business system.

[0100] (4) Flexible packet capture and authentication strategies Dynamically adjust the packet capture strategy, selectively authenticate and encrypt according to traffic characteristics, and reduce system overhead.

[0101] (5) Security This scheme is based on the national secret algorithm and proposes an encryption authentication protocol between modules, which can fully ensure the security of communication.

[0102] (6) Efficiency This solution effectively utilizes system resources by combining multi-threading technology, especially in scenarios with high concurrent network traffic, to achieve parallel processing of tasks, thereby significantly improving throughput and efficiency.

[0103] (7) Design of network data packet flow processing framework based on XDP By adding terminal modules and gateway modules between the terminal and the business system, the XDP technology is combined at the link layer to achieve data authentication, encryption and decryption, while maintaining transparency to the terminal and the business system, that is, no changes are required to the terminal and the business system.

[0104] (8) Encryption authentication mechanism and protocol integrating multi-threading and national secret algorithm In the data packet encryption and authentication stage, in order to address the problems of low security and low processing efficiency, an encryption and authentication mechanism and protocol integrating multi-threading and national encryption algorithms is proposed. This solution can effectively utilize resources, especially in scenarios with high concurrent network traffic, to achieve parallel processing of tasks, thereby significantly improving throughput and efficiency. It also combines the SM2 / SM3 / SM4 algorithms to achieve efficient and secure encryption and authentication.

[0105] It should be noted that the method of the embodiment of the present application can be performed by a single device, such as a computer or server. The method of this embodiment can also be applied to a distributed scenario and completed by multiple devices cooperating with each other. In the case of such a distributed scenario, one of the multiple devices can only perform one or more steps in the method of the embodiment of the present application, and the multiple devices will interact with each other to complete the described method.

[0106] It should be noted that the above describes some embodiments of the present application. Other embodiments are within the scope of the appended claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the above embodiments and still achieve the desired results. In addition, the processes depicted in the accompanying drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0107] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a device for authenticating, encrypting and decrypting data.

[0108] refer to Figure 3 , the device for authenticating, encrypting and decrypting data comprises: The acquisition module 301 is configured to acquire original data packets, where the original data packets are captured at the link layer using the XDP technology.

[0109] The acquisition module 301 is also configured to perform first-layer filtering, second-layer filtering and third-layer filtering on multiple target data packets at the kernel layer to obtain the original data packet; wherein the first-layer filtering filters irrelevant traffic based on the source address, destination address and port number, the second-layer filtering narrows the target range based on the protocol field, and the third-layer filtering matches the payload of the original data packet with specific rules.

[0110] The encryption module 302 is configured to encrypt the payload of the original data packet to obtain a first data packet.

[0111] The encryption module 302 is further configured to read the original data packet from the capture thread queue and encrypt the payload of the original data packet using the SM4 algorithm in the encryption thread queue to obtain the first data packet.

[0112] The generating module 303 is configured to generate a message digest and sign the message digest to generate a message authentication code.

[0113] The generation module 303 is also configured to generate the message digest using the SM3 algorithm in the signature thread queue; generate a public key and a private key using the SM2 algorithm, wherein the public key and the private key are generated in the terminal side module and the gateway module respectively; and sign the message digest using the private key to generate the message authentication code.

[0114] The encapsulation module 304 is configured to encapsulate the message authentication code and the first data packet to obtain a second data packet.

[0115] The encapsulation module 304 is further configured to read the first data packet from the signature thread queue and encapsulate the message authentication code and the first data packet to obtain the second data packet.

[0116] The verification module 305 is configured to verify the authenticity of the second data packet.

[0117] The verification module 305 is also configured to read the second data packet from the capture thread queue, and extract the message authentication code in the second data packet in the verification thread queue; recalculate the message digest using SM3, and verify the authenticity of the message authentication code using the public key.

[0118] The decryption module 306 is configured to write the second data packet into a decryption thread queue for decryption in response to the second data packet being verified successfully, so as to obtain the original data packet.

[0119] The decryption module 306 is further configured to read the second data packet from the verification thread queue, and decrypt the payload of the second data packet using the SM4 algorithm in the decryption thread queue to obtain the original data packet.

[0120] For the convenience of description, the above device is described in terms of functions divided into various modules. Of course, when implementing the present application, the functions of each module can be implemented in the same or multiple software and / or hardware.

[0121] The device of the above embodiment is used to implement the corresponding method for authenticating, encrypting and decrypting data in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0122] Based on the same technical concept, corresponding to any of the above-mentioned embodiments, the present application also provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the method for authenticating, encrypting and decrypting data as described in any of the above embodiments is implemented.

[0123] Figure 4 A schematic diagram of an exemplary electronic device according to an embodiment of the present application is shown, and the electronic device may include: a processor 1010, a memory 1020, an input / output interface 1030, a communication interface 1040, and a bus 1050. The processor 1010, the memory 1020, the input / output interface 1030, and the communication interface 1040 are connected to each other in communication within the device through the bus 1050.

[0124] The processor 1010 can be implemented by a general-purpose CPU (Central Processing Unit), a microprocessor, an application-specific integrated circuit (ASIC), or one or more integrated circuits, and is used to execute relevant programs to implement the technical solutions provided in the embodiments of this specification.

[0125] The memory 1020 may be implemented in the form of ROM (Read Only Memory), RAM (Random Access Memory), static storage device, dynamic storage device, etc. The memory 1020 may store an operating system and other application programs. When the technical solutions provided in the embodiments of this specification are implemented by software or firmware, the relevant program codes are stored in the memory 1020 and are called and executed by the processor 1010.

[0126] The input / output interface 1030 is used to connect the input / output module to realize information input and output. The input / output module can be configured in the device as a component (not shown in the figure), or it can be externally connected to the device to provide corresponding functions. The input device may include a keyboard, a mouse, a touch screen, a microphone, various sensors, etc., and the output device may include a display, a speaker, a vibrator, an indicator light, etc.

[0127] The communication interface 1040 is used to connect a communication module (not shown) to realize communication interaction between the device and other devices. The communication module can realize communication through wired means (such as USB, network cable, etc.) or wireless means (such as mobile network, WIFI, Bluetooth, etc.).

[0128] The bus 1050 includes a path that transmits information between the various components of the device (eg, the processor 1010 , the memory 1020 , the input / output interface 1030 , and the communication interface 1040 ).

[0129] It should be noted that, although the above device only shows the processor 1010, the memory 1020, the input / output interface 1030, the communication interface 1040 and the bus 1050, in the specific implementation process, the device may also include other components necessary for normal operation. In addition, it can be understood by those skilled in the art that the above device may also only include the components necessary for implementing the embodiments of the present specification, and does not necessarily include all the components shown in the figure.

[0130] The electronic device of the above embodiment is used to implement the corresponding method for authenticating, encrypting and decrypting data in any of the above embodiments, and has the beneficial effects of the corresponding method embodiment, which will not be repeated here.

[0131] Based on the same technical concept, corresponding to any of the above-mentioned embodiment methods, the present application also provides a non-transitory computer-readable storage medium, wherein the non-transitory computer-readable storage medium stores computer instructions, and the computer instructions are used to enable the computer to execute the method for authenticating, encrypting and decrypting data as described in any of the above embodiments.

[0132] The computer-readable medium of this embodiment includes permanent and non-permanent, removable and non-removable media, and information storage can be implemented by any method or technology. Information can be computer-readable instructions, data structures, modules of programs, or other data. Examples of computer storage media include, but are not limited to, phase change memory (PRAM), static random access memory (SRAM), dynamic random access memory (DRAM), other types of random access memory (RAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), flash memory or other memory technology, read-only compact disk read-only memory (CD-ROM), digital versatile disk (DVD) or other optical storage, magnetic cassettes, tape disk storage or other magnetic storage devices or any other non-transmission media that can be used to store information that can be accessed by a computing device.

[0133] The computer instructions stored in the storage medium of the above embodiment are used to enable the computer to execute the method for authenticating, encrypting and decrypting data as described in any of the above embodiments, and have the beneficial effects of the corresponding method embodiments, which will not be repeated here.

[0134] A person skilled in the art should understand that the discussion of any of the above embodiments is merely illustrative and is not intended to imply that the scope of the present application (including the claims) is limited to these examples. In line with the concept of the present application, the technical features in the above embodiments or different embodiments may be combined, the steps may be implemented in any order, and there are many other variations of the different aspects of the embodiments of the present application as described above, which are not provided in detail for the sake of simplicity.

[0135] In addition, to simplify the description and discussion, and in order not to make the embodiments of the present application difficult to understand, the known power / ground connections to the integrated circuit (IC) chip and other components may or may not be shown in the provided drawings. In addition, the device may be shown in the form of a block diagram to avoid making the embodiments of the present application difficult to understand, and this also takes into account the fact that the details of the implementation of these block diagram devices are highly dependent on the platform on which the embodiments of the present application are to be implemented (that is, these details should be fully within the scope of understanding of those skilled in the art). Where specific details (e.g., circuits) are set forth to describe exemplary embodiments of the present application, it is obvious to those skilled in the art that the embodiments of the present application can be implemented without these specific details or with changes in these specific details. Therefore, these descriptions should be considered illustrative rather than restrictive.

[0136] Although the present application has been described in conjunction with specific embodiments of the present application, many alternatives, modifications and variations of these embodiments will be apparent to those skilled in the art from the foregoing description. For example, other memory architectures (e.g., dynamic RAM (DRAM)) may use the discussed embodiments.

[0137] The embodiments of the present application are intended to cover all such substitutions, modifications and variations that fall within the broad scope of the appended claims. Therefore, any omissions, modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the embodiments of the present application should be included in the scope of protection of the present application.

Claims

1. A method for authenticating, encrypting and decrypting data, characterized in that: include: Obtaining an original data packet, where the original data packet is captured at the link layer using the XDP technology; Encrypting the payload of the original data packet to obtain a first data packet; Generate a message digest and sign the message digest to generate a message authentication code; Encapsulating the message authentication code and the first data packet to obtain a second data packet; Verifying the authenticity of the second data packet; In response to the second data packet being verified successfully, the second data packet is written into a decryption thread queue for decryption to obtain the original data packet.

2. The method according to claim 1, characterized in that The obtaining of the original data packet further comprises: Performing first-layer filtering, second-layer filtering, and third-layer filtering on multiple target data packets at the kernel layer to obtain the original data packets; Among them, the first layer of filtering filters irrelevant traffic based on source address, destination address and port number, the second layer of filtering narrows the target range based on protocol fields, and the third layer of filtering matches the payload of the original data packet with specific rules.

3. The method according to claim 1, characterized in that The step of generating a message digest and signing the message digest to generate a message authentication code further includes: In the signature thread queue, the message digest is generated using the SM3 algorithm; Generate a public key and a private key using the SM2 algorithm, wherein the public key and the private key are generated in the terminal side module and the gateway module respectively; The message digest is signed using the private key to generate the message authentication code.

4. The method according to claim 3, characterized in that The verifying the authenticity of the second data packet further comprises: Reading the second data packet from the capture thread queue, and extracting the message authentication code in the second data packet in the verification thread queue; The message digest is recalculated using SM3, and the authenticity of the message authentication code is verified using the public key.

5. The method according to claim 1, characterized in that The step of writing the second data packet into a decryption thread queue for decryption to obtain the original data packet further comprises: The second data packet is read from the verification thread queue, and the payload of the second data packet is decrypted using the SM4 algorithm in the decryption thread queue to obtain the original data packet.

6. The method according to claim 1, characterized in that The step of encrypting the payload of the original data packet to obtain the first data packet further comprises: The original data packet is read from the capture thread queue and the payload of the original data packet is encrypted using the SM4 algorithm in the encryption thread queue to obtain the first data packet.

7. The method according to claim 1, characterized in that The step of encapsulating the message authentication code and the first data packet to obtain a second data packet further comprises: The first data packet is read from the signature thread queue and the message authentication code and the first data packet are encapsulated to obtain the second data packet.

8. A device for authenticating, encrypting and decrypting data, characterized in that: include: An acquisition module is configured to acquire an original data packet, where the original data packet is captured at the link layer using the XDP technology; an encryption module, configured to encrypt the payload of the original data packet to obtain a first data packet; A generating module, configured to generate a message digest and sign the message digest to generate a message authentication code; an encapsulation module, configured to encapsulate the message authentication code and the first data packet to obtain a second data packet; A verification module, configured to verify the authenticity of the second data packet; The decryption module is configured to write the second data packet into a decryption thread queue for decryption in response to the second data packet being verified successfully, so as to obtain the original data packet.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the program, the method according to any one of claims 1 to 7 is implemented.

10. A non-transitory computer-readable storage medium storing computer instructions, characterized in that: The computer instructions are used to enable a computer to execute the method according to any one of claims 1 to 7.

Images