High-performance IPSec VPN working method and system based on FPGA

Abstract

The invention discloses a high-performance IPSec VPN (Internet Protocol Security Virtual Private Network) working method and system based on an FPGA (Field Programmable Gate Array). The high-performance IPSec VPN working method comprises the following steps: acquiring target data, and carrying out first preprocessing Performing second preprocessing on a result of the first preprocessing, wherein the second preprocessing comprises a first processing strategy and a second processing strategy; and matching the second preprocessing result with a preset channel for transmission to complete data interaction. The load of the processor is effectively reduced, core key negotiation, key management, ACL and other strategy management are still on the processor side, user management is facilitated, decoupling of a control plane and a service plane is thoroughly achieved, the processor is not directly connected with an internal network and an external network, and user experience is improved. Packets, needing to be interacted with the processor of the system, of internal and external networks are filtered in the FPGA unit in a white list mode, illegal data are prevented from entering the processor, the operation safety and stability of the system are guaranteed, and meanwhile different data packets can be supported to be processed through different encryption and decryption algorithms.

Description

Technical Field

[0001] The present invention relates to the technical field of high-performance IPSec VPN working based on FPGA, and in particular to a high-performance IPSec VPN working method and system based on FPGA. Background Art

[0002] IPSec VPN is a widely used VPN technology that uses IPSec protocol to achieve remote access and provides end-to-end encryption and authentication services for public and private networks. It has security, scalability,

[0003] With characteristics such as compatibility, flexibility, and manageability, it is an important device to ensure the security of network communications. It is widely used in power transmission and distribution, energy, municipal administration, security, intelligent manufacturing, geographic monitoring and other industries.

[0004] Traditional IPSec VPN data transmission requires data packets to enter the CPU core for processing after arriving at the network card, and the processing process consumes a lot of CPU resources and performance. With the rapid development of the network, the amount of data transmission continues to increase, and CPU resources and performance can no longer meet the needs of large-bandwidth IPSec VPN data transmission. Patent document CN110138553B discloses an IPSec VPN gateway data packet processing device and method, which realizes the sending and receiving of data packets through the user-state network card polling DMA continuous memory mechanism, avoiding multiple copies, interrupted packet reception, and switching between user state and kernel state; at the same time, by binding the data layer to a separate CPU core and the control layer to another CPU core, the data layer and the control layer are separated, avoiding CPU resource competition between the data layer and the control layer.

[0005] As can be seen from the above, the current IPSec VPN implementation scheme still forwards and processes data inside the CPU after it enters the CPU, which cannot fundamentally reduce the dependence on the CPU, and the transmission performance is still limited by the CPU. Summary of the invention

[0006] The purpose of this section is to summarize some aspects of embodiments of the present invention and briefly introduce some preferred embodiments. Some simplifications or omissions may be made in this section and the specification abstract and the invention title of this application to avoid blurring the purpose of this section, the specification abstract and the invention title, and such simplifications or omissions cannot be used to limit the scope of the present invention.

[0007] In view of the above existing problems, the present invention is proposed.

[0008] Therefore, the present invention provides a high-performance IPSec VPN working method and system based on FPGA, which can solve the problems mentioned in the background technology.

[0009] In order to solve the above technical problems, the present invention provides the following technical solutions:

[0010] In a first aspect, the present invention provides a high-performance IPSec VPN working method based on FPGA, comprising:

[0011] Acquire target data, and perform first preprocessing on the target data;

[0012] Performing a second preprocessing on the result of the first preprocessing, wherein the second preprocessing includes a first processing strategy and a second processing strategy;

[0013] The second preprocessing result is matched with a preset channel for transmission to complete data interaction.

[0014] As a preferred solution of the FPGA-based high-performance IPSec VPN working method of the present invention, the step of obtaining target data and performing a first preprocessing on the target data includes:

[0015] Acquire target data, and perform a first detection on the target data;

[0016] Performing a first classification on the target data that passes the first detection to obtain first classification data and second classification data;

[0017] The first preprocessing includes a first detection and a first classification.

[0018] As a preferred solution of the FPGA-based high-performance IPSec VPN working method of the present invention, the second preprocessing includes:

[0019] processing the first classified data using a first processing strategy, the first processing strategy including at least a first encryption operation;

[0020] The second classified data is processed by a second processing strategy, the second processing strategy including at least a second decryption operation.

[0021] As a preferred solution of the FPGA-based high-performance IPSec VPN working method of the present invention, the second preprocessing of the result of the first preprocessing includes:

[0022] Performing a first matching judgment on the first classification data;

[0023] Performing a first encryption operation on the matched first classification data;

[0024] Performing a first aggregation on the first classified data after the first encryption operation;

[0025] The data after the first aggregation is subjected to a second detection.

[0026] As a preferred solution of the FPGA-based high-performance IPSec VPN working method of the present invention, wherein: the second preprocessing of the result of the first preprocessing further includes:

[0027] Performing a second matching judgment on the second classification data;

[0028] Performing a second decryption operation on the matched second classification data;

[0029] Performing a first aggregation on the second classified data after the second decryption operation;

[0030] The data after the first aggregation is subjected to a second detection.

[0031] As a preferred solution of the FPGA-based high-performance IPSec VPN working method of the present invention, it also includes:

[0032] The first detection is used to perform a first packet check on the target data;

[0033] The second detection is used to perform a second packet check on the first classified data after the first encryption operation and on the second classified data after the second decryption operation.

[0034] In a second aspect, the present invention provides a high-performance IPSec VPN working system based on FPGA, comprising: a first preprocessing module configured with a first preprocessing function, a second preprocessing module configured with a second preprocessing function, and a matching module configured with a matching channel transmission function;

[0035] A first preprocessing module, used for acquiring target data and performing a first preprocessing on the target data;

[0036] A second preprocessing module, configured to perform a second preprocessing on the result of the first preprocessing, wherein the second preprocessing includes a first processing strategy and a second processing strategy;

[0037] The matching module is used to match the second preprocessing result with a preset channel for transmission to complete data interaction.

[0038] As a preferred solution of the FPGA-based high-performance IPSec VPN working system described in the present invention, it also includes: a number of detection modules configured with detection functions, a number of classification modules configured with classification functions, a number of encryption or decryption modules configured with encryption or decryption functions, a number of aggregation modules configured with aggregation functions, a number of matching modules configured with matching functions, and any number of modules used to associate the above modules.

[0039] In a third aspect, the present invention provides a computer device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor implements the steps of the above-mentioned method when executing the computer program.

[0040] In a fourth aspect, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program implements the steps of the method described above when executed by a processor.

[0041] Compared with the prior art, the beneficial effects of the present invention are as follows: the present invention proposes a high-performance IPSecVPN working method and system based on FPGA, obtains target data, and performs a first preprocessing on the target data; performs a second preprocessing on the result of the first preprocessing, the second preprocessing includes a first processing strategy and a second processing strategy; matches the second preprocessing result with a preset channel for transmission to complete data interaction. The present application effectively reduces the load of the processor, and the core key negotiation and key management as well as ACL and other policy management are still on the processor side, which is convenient for user management, and completely realizes the decoupling of the control plane and the business plane. The processor does not directly connect to the internal and external networks. The packets that the internal and external networks need to interact with the processor of this system are filtered in the form of a whitelist in the FPGA unit to prevent illegal data from entering the processor, thereby ensuring the safety and stability of the system operation, and at the same time, it can support different data packets to be processed using different encryption and decryption algorithms. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the following briefly introduces the drawings required for describing the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative labor. Among them:

[0043] Figure 1 A method flow chart of a high-performance IPSec VPN working method and system based on FPGA provided by one embodiment of the present invention;

[0044] Figure 2 A functional block diagram of an IPSec VPN system of a high-performance FPGA-based IPSec VPN working method and system provided in one embodiment of the present invention;

[0045] Figure 3 A high-performance IPSec VPN working method and system based on FPGA is provided as a flowchart of sending IPSec VPN system configuration files according to an embodiment of the present invention;

[0046] Figure 4A flowchart of the interaction between an IPSec VPN system processor and an internal and external network of a high-performance IPSec VPN working method and system based on FPGA provided by one embodiment of the present invention;

[0047] Figure 5 A flow chart of transmitting data from an intranet to an extranet in an IPSec VPN system, provided by an embodiment of the present invention, of a high-performance IPSec VPN working method and system based on FPGA;

[0048] Figure 6 A high-performance IPSec VPN working method and system based on FPGA is provided as a flowchart of the transmission of extranet data and intranet data in an IPSec VPN system according to an embodiment of the present invention. DETAILED DESCRIPTION

[0049] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0050] Example 1

[0051] Reference Figure 1-Figure 6 , which is the first embodiment of the present invention, and provides a high-performance IPSec VPN working method and system based on FPGA, including:

[0052] There are some problems in the existing related technologies, such as heavy processor load, low processing efficiency, insufficient security, etc.

[0053] This application provides a method that can effectively solve the above-mentioned problems. Next, we will combine multiple embodiments to explain in detail how to implement the FPGA-based high-performance IPSec VPN working method;

[0054] Figure 1 A method flow chart of a high-performance IPSec VPN working method and system based on FPGA is shown, including:

[0055] S101, acquiring target data, and performing a first preprocessing on the target data;

[0056] In the embodiment of the present application, obtaining target data and performing a first preprocessing on the target data includes:

[0057] Acquire target data, and perform a first detection on the target data;

[0058] Performing a first classification on the target data that passes the first detection to obtain first classification data and second classification data;

[0059] The first preprocessing includes a first detection and a first classification.

[0060] In an optional embodiment, the target data may be public network data and private network data, for example, public network data and private network data in a distribution network scenario, public network data and private network data generated when any company uses the network, public network data and private network data within any target area, etc.

[0061] In an optional embodiment, the first detection may include detecting the source address and destination address of the data packet, as well as the protocol type and port number of the data packet, to ensure that the data packet complies with a predetermined network policy.

[0062] In an optional embodiment, the first detection may also include detecting the size and type of the data packet, and whether the data packet contains a specific mark or label, so as to further ensure the security and compliance of the data packet.

[0063] In an optional embodiment, the first detection may also include detecting whether the data packet contains malware or a virus, and whether the transmission rate of the data packet meets a predetermined threshold, thereby preventing potential network attacks and abnormal traffic from affecting the system.

[0064] In an embodiment of the present application, the first detection is used to perform a first packet check on the target data to ensure the format accuracy of the data packet in the target data. When the target data is an intranet data packet, a first packet check is performed on the intranet data packet to determine whether the format of the data packet is reasonable. When the target data is an extranet data packet, a first packet check is performed on the extranet data packet to determine whether the format of the data packet is reasonable.

[0065] In an optional embodiment, the first classification can be various feature classifications of data, such as different packet classifications for intranet data and extranet data, classification methods based on the source and destination network locations of data packets, or based on the priority and importance of data packets.

[0066] In an optional embodiment, the first classification is to classify the target data into first classification data and second classification data, wherein the first classification data includes the packet structure types that may be included in the internal network, for example, the common data packet types in the internal network, such as HTTP, HTTPS, FTP, etc., and the second classification data includes the data packet types that may be transmitted in the external network, such as DNS query, email transmission, etc. Through this classification, the system can process and manage the data packets more effectively.

[0067] In an embodiment of the present application, the internal and external network packets whose destination IP address is the system processor are first detected in the form of a whitelist, and only ARP packets, ICMP packets, key negotiation packets and user-defined packets are allowed to enter the system processor. Packets not in the whitelist are intercepted by the packet filtering inspection module of the FPGA to prevent illegal data packets from entering the system processor.

[0068] It should be noted that the acquisition of target data and the first preprocessing of the target data are to be able to preliminarily screen out data packets that comply with network policies, thereby reducing the burden of subsequent processing. The first classification is to classify the data packets that pass the first detection according to their characteristics, for example, grouping them according to the priority, type or source of the data packets to facilitate subsequent processing and transmission. This classification mechanism helps to improve the efficiency and accuracy of data processing and ensure that data packets can be processed according to predetermined rules and policies.

[0069] S102, performing a second preprocessing on the result of the first preprocessing, where the second preprocessing includes a first processing strategy and a second processing strategy;

[0070] In the embodiment of the present application, the second preprocessing includes:

[0071] Processing the first classified data using a first processing strategy, the first processing strategy including at least a first encryption operation;

[0072] The second classified data is processed by a second processing strategy, the second processing strategy including at least a second decryption operation.

[0073] In an optional embodiment, the first processing strategy may be to verify the specific information in the data packet in the first classification data and encrypt and send it, and the implementation method may include using a symmetric encryption algorithm, such as AES (Advanced Encryption Standard), to ensure the security of data transmission. The encryption operation can encrypt the content of the data packet to prevent the data from being read or tampered by an unauthorized third party during transmission.

[0074] In an optional embodiment, the second processing strategy can be to verify the specific information in the data packet in the second classification data and decrypt and send it. The implementation method can include using the same symmetric key as encryption, or in some cases using asymmetric encryption technology, such as RSA algorithm, where the public key is used for encryption and the private key is used for decryption. The decryption process ensures that the data packet can be correctly identified and processed in the internal network.

[0075] In the embodiment of the present application, performing a second preprocessing on the result of the first preprocessing includes:

[0076] Performing a first matching judgment on the first classification data;

[0077] Performing a first encryption operation on the matched first classification data;

[0078] Performing a first aggregation on the first classified data after the first encryption operation;

[0079] The data after the first aggregation is subjected to a second detection.

[0080] In the embodiment of the present application, performing a second preprocessing on the result of the first preprocessing further includes:

[0081] Performing a second matching judgment on the second classification data;

[0082] Performing a second decryption operation on the matched second classification data;

[0083] Performing a first aggregation on the second classified data after the second decryption operation;

[0084] The data after the first aggregation is subjected to a second detection.

[0085] In an optional embodiment, the first matching judgment is used to match the data packet type of the first classification data, and the matching is performed through the packet header information, for example, by checking whether the data packet conforms to a specific protocol type, such as TCP or UDP, and whether it belongs to a specific service type, such as HTTP or HTTPS. This step ensures that the type of the data packet matches the predetermined network policy, thereby allowing the system to correctly process the data packet.

[0086] In an optional embodiment, the first encryption operation and the second decryption operation are not limited to the encryption and decryption algorithms, and support SM1, SM2, SM3, SM4, SM9, etc. They can also be customized by the user, and at the same time can support different encryption and decryption algorithms for processing different data packets.

[0087] In an optional embodiment, the first aggregation or second aggregation operation may be to merge multiple encrypted data packets into a larger data block to improve transmission efficiency. The aggregated data block may be further subjected to a second detection to ensure that no error or damage occurs to the data packet during the encryption and aggregation process, which is not limited in this application.

[0088] In the embodiment of the present application, the second detection is used to perform a second packet check on the first classified data after the first encryption operation and on the second classified data after the second decryption operation.

[0089] For example, Figure 2As shown, when the intranet data packet enters the FPGA unit from the intranet port, it passes the packet verification check of the packet filtering detection module and then enters the packet classification module, extracts the packet header information and sends it to the TCAM unit for ACL table entry search. If the match is successful, the TCAM unit returns the IP address, MAC address and key information of the peer VPN system. The packet classification module encapsulates the information returned by the TCAM unit and the original intranet data packet and sends it to the IPSec data processing module. The IPSec data processing module encrypts the original intranet data packet based on the key, and encapsulates it into a new encrypted packet based on the IP address and MAC address of the peer system and sends it back to the FPGA unit. The packet aggregation module forwards the encrypted packet to the packet filtering detection module after aggregation. After the external packet is verified and checked, it is sent to the MAC unit to assemble the packet and send it out from the external network port.

[0090] In an optional embodiment, when an external network data packet enters the FPGA unit from the external network port, it passes the packet verification check of the packet filtering detection module and enters the packet classification module. When it is identified as an encrypted message, the packet header information is extracted and sent to the TCAM unit for ACL table entry search. If the match is successful, the TCAM unit decrypts the key information, and the packet classification module encapsulates the information returned by the TCAM unit and the original internal network data packet and sends them to the IPSec data processing module. The IPSec data processing module decrypts the external network ciphertext data packet based on the decryption key, generates a new plaintext packet and sends it back to the packet aggregation module in the FPGA unit for aggregation and then enters the packet filtering detection module. After the external packet is verified and checked, the ARP table entry is searched in the TCAM unit according to the decrypted packet destination address IP information to obtain the destination MAC address information and encapsulate it, and then it is sent to the MAC unit to assemble the packet and send it out from the internal network port.

[0091] S103, matching the second preprocessing result with a preset channel for transmission to complete data exchange.

[0092] In an optional embodiment, matching the preset channel can be achieved by presetting the outgoing channel, for example, the external network port and the internal network port can be set for transmission;

[0093] In an optional embodiment, matching preset channels can also select a suitable channel for data transmission based on the characteristics of the data packet and the preset channel rules. For example, it can be determined which channel the data packet should be sent through based on information such as the source address, destination address, and service type of the data packet. This channel matching mechanism can effectively allocate data packets to the most appropriate transmission path, thereby optimizing network traffic, reducing delays, and improving overall network performance.

[0094] In an optional embodiment, if Figure 2As shown, the MAC module of network port 1 and the MAC module of network port 2 in the processor unit are respectively mapped to the internal and external network ports of the network port unit. When data from the internal and external network ports enters the FPGA unit, it passes the packet verification check of the packet filtering detection module and enters the packet classification module. When the destination IP address is identified to be consistent with that of the processor, the data is extracted and forwarded to the internal network port MAC module and sent to the processor unit. Similarly, for the data sent by the processor to the internal and external networks, the processor sends it to the internal network port MAC module of the FPGA unit through the MAC module of network port 1 or the MAC module of network port 2, enters the packet aggregation module, enters the packet filtering detection module, and after passing the verification check for external packets, it is sent to the MAC unit to assemble the packets and send them out from the internal and external network ports.

[0095] In summary, the present invention proposes a high-performance IPSec VPN working method based on FPGA, which obtains target data and performs a first preprocessing on the target data; performs a second preprocessing on the result of the first preprocessing, wherein the second preprocessing includes a first processing strategy and a second processing strategy; matches the second preprocessing result with a preset channel for transmission to complete data interaction. In the present invention, the data packet first enters the FPGA, and the data is sub-packetized and aggregated in the FPGA, and the large flow data to be encrypted and decrypted is directly extracted from the FPGA to the IPSec data processing unit, which effectively reduces the load of the processor; the core key negotiation and key management and ACL and other policy management in the present application are still on the processor side, which is convenient for user management and completely realizes the decoupling of the control plane and the business plane; the processor in the present application is not directly connected to the internal and external networks, and the packets that the internal and external networks need to interact with the processor of this system are filtered in the form of a white list in the FPGA unit to prevent illegal data from entering the processor, thereby ensuring the safety and stability of system operation; the FPGA unit in the present application mainly realizes the inspection, filtering, sub-packetization and aggregation of the packet, does not involve packet protocol processing, and the FPGA is simple to implement; the IPSec processing unit in the present application does not limit the encryption and decryption algorithm, is applicable to all encryption and decryption algorithms, and can also support different data packets to be processed using different encryption and decryption algorithms.

[0096] Example 2

[0097] This embodiment also provides a high-performance IPSec VPN working system based on FPGA, including: a first preprocessing module configured with a first preprocessing function, a second preprocessing module configured with a second preprocessing function, and a matching module configured with a matching channel transmission function;

[0098] A first preprocessing module, used for acquiring target data and performing first preprocessing on the target data;

[0099] A second preprocessing module, used for performing a second preprocessing on the result of the first preprocessing, wherein the second preprocessing includes a first processing strategy and a second processing strategy;

[0100] The matching module is used to match the second preprocessing result with a preset channel for transmission to complete data interaction.

[0101] In an optional embodiment, the proposed system also includes several detection modules configured with detection functions, several classification modules configured with classification functions, several encryption or decryption modules configured with encryption or decryption functions, several aggregation modules configured with aggregation functions, several matching modules configured with matching functions, and any several modules used to associate the above modules.

[0102] The above-mentioned unit modules may be embedded in or independent of a processor in a computer device in the form of hardware, or may be stored in a memory in a computer device in the form of software, so that the processor can call and execute operations corresponding to the above-mentioned modules.

[0103] This embodiment also provides a computer device, which can be a terminal. The computer device includes a processor, a memory, a communication interface, a display screen and an input device connected through a system bus. Among them, the processor of the computer device is used to provide computing and control capabilities. The memory of the computer device includes a non-volatile storage medium and an internal memory. The non-volatile storage medium stores an operating system and a computer program. The internal memory provides an environment for the operation of the operating system and the computer program in the non-volatile storage medium. The communication interface of the computer device is used to communicate with an external terminal in a wired or wireless manner, and the wireless manner can be implemented through WIFI, an operator network, NFC (near field communication) or other technologies. When the computer program is executed by the processor, a high-performance IPSec VPN working method based on FPGA is implemented. The display screen of the computer device can be a liquid crystal display screen or an electronic ink display screen, and the input device of the computer device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the computer device housing, or an external keyboard, touchpad or mouse.

[0104] This embodiment further provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the following steps are implemented:

[0105] Acquire target data, and perform first preprocessing on the target data;

[0106] Performing a second preprocessing on the result of the first preprocessing, wherein the second preprocessing includes a first processing strategy and a second processing strategy;

[0107] The second preprocessing result is matched with the preset channel for transmission to complete the data interaction.

[0108] Example 3

[0109] In an optional embodiment, if Figure 2 As shown, according to the above system configuration requirements, the following Figure 2 The specific system structure in the code is as follows:

[0110] Processor unit: used to manage all control planes of the system, including the following sub-functional modules:

[0111] (1) Management network port MAC module, used for receiving and parsing data packets from the management network port and sending packets, to achieve interaction with users. Users can view system status and read system configuration through the management network port;

[0112] (2) Network port 1 MAC module, used to connect to the intranet device, and the data packet needs to be transferred in the FPGA unit;

[0113] (3) Network port 2 MAC module, used to connect to external network devices, and data packets need to be transferred in the FPGA unit;

[0114] (4) FPGA control interface module, used by the processor to send and read FPGA configuration status, including the status of each unit inside the FPGA and statistics of sent and received packets;

[0115] (5) a key generation and management module, which is used for the processor to interact with other VPN systems in the external network to generate keys and manage the keys;

[0116] (6) TCAM interface module, used by the processor to send ACL and ARP table entries and keys to the TCAM unit.

[0117] FPGA unit: used for the data plane of the system, to parse, filter, check, sub-packetize and aggregate data, which includes the following sub-functional modules:

[0118] (1) External network port MAC module, used for receiving, analyzing, assembling and sending data packets from internal and external network ports;

[0119] (2) The internal network port MAC module is used to receive, analyze, and send packets for communication between the processor and the internal and external networks;

[0120] (3) a packet filtering module, which is used to check and filter the received and parsed data packets and to perform security checks on the sent data packets;

[0121] (4) A packet classification module is used to classify the received and parsed packets based on the search results of the TCAM unit, and send them to the processor and IPSec unit respectively. Packets that are not in the ACL table are directly discarded;

[0122] (5) a packet aggregation module, which is used to aggregate data packets that the processor needs to send outward and data packets that have been processed by IPSec;

[0123] (6) an interface control module, used to interact with the processor, receive configurations sent by the processor, and report status information to the processor;

[0124] (7) TCAM search module, used for the FPGA unit to search the TCAM unit for service packets to find ACL table entries and ARP table entries.

[0125] IPSec data processing unit: used for data encryption and decryption.

[0126] TCAM unit: used to store ACL and ARP entries and key library.

[0127] Network port unit: used for system interaction with the outside world and data transmission.

[0128] Figure 3 This is the flow chart of the IPSec VPN system configuration file delivery proposed by the present invention. The configuration of the packet filtering inspection module of the FPGA unit, the ACL table items, ARP table items, and keys of the TCAM unit all rely on the processor to deliver the system configuration file. The main workflow steps are as follows:

[0129] First, when the system is powered on or restarted, the system reads the stored configuration file;

[0130] Secondly, the read configuration files are classified and downloaded to the FPGA unit and TCAM unit respectively, among which the system IP, filtering rules, etc. are sent to the FPGA unit, and the ACL, ARP table items and keys are sent to the TCAM unit;

[0131] Next, when the user loads the configuration file, the user downloads the configuration file to the system storage through the management network port;

[0132] Finally, when the system detects that the configuration file has changed, it automatically re-issues the configuration file.

[0133] Figure 4 This is a flowchart of the interaction between the processor and the internal and external networks of the IPSec VPN system proposed by the present invention. The network detection, key negotiation and management processes between the processor and the internal and external networks are all implemented according to this flowchart. Its workflow is divided into two parts: processor data reception and processor data outbound transmission according to the data flow direction. The process steps are as follows:

[0134] Processor data receiving steps:

[0135] First, the internal and external network data packets enter the external network port MAC module of the FPGA unit from the internal and external network ports;

[0136] Secondly, the data packet is parsed in the external network port MAC module, and after passing the MAC address check and CRC check, it enters the packet filtering inspection module;

[0137] Next, the data packet enters the packet filtering inspection module. When the destination IP address of the packet is identified as the processor of this system, it is reviewed according to the configured whitelist. The data packets that pass the review enter the packet classification module.

[0138] Again, when the packet classification module identifies that the destination IP address of the packet is the processor of this system, the packet classification module forwards the packet to the internal network port MAC module;

[0139] Again, the FPGA unit assembles the packet to the internal network port MAC module and sends it to the network port 1 / 2 MAC module of the processor unit.

[0140] Processor data sending steps:

[0141] Again, when the processor has data to go out, it is sent from the network port 1 / 2 module to the internal network port MAC module of the FPGA unit according to the internal and external networks;

[0142] Again, the internal network port MAC module receives and parses the data packet, and after the CRC check passes, it is sent to the packet aggregation module;

[0143] Again, the packet aggregation module directly aggregates the packets and sends them to the packet filtering and inspection module;

[0144] Next, when the packet filtering module identifies that the sender IP address is this system, it will review it according to the configured whitelist, and the data packets that pass the review will enter the external network port MAC module;

[0145] Finally, the external network port MAC module assembles the packet and sends it out from the network port.

[0146] Figure 5 This is a flow chart of the transmission of intranet data to the extranet of the IPSec VPN system proposed by the present invention, and the process steps are as follows:

[0147] First, the intranet data packet enters the external network port MAC module of the FPGA unit from the network port;

[0148] Secondly, the data packet is parsed in the external network port MAC module, and after passing the MAC address check and CRC check, it enters the packet filtering inspection module;

[0149] Next, the data packet enters the packet filtering inspection module. When the destination IP address of the packet is not the IP of the local system, the data packet is checked for sensitive words, etc. After passing the inspection, it enters the packet classification module;

[0150] Once again, after the data packet enters the packet classification module, if it is identified that the destination IP address of the packet is not the IP address of this system, the packet header related information is extracted and entered into the TCAM unit to search for the ACL entry. If the search does not hit, the packet is directly intercepted and discarded; if the search hits, and the ACL entry result indicates that the data needs to be encrypted, the packet and the destination IP address, destination MAC address, and key information returned by the search for the ACL entry are sent to the IPSec data processing unit.

[0151] Again, after the data packet enters the IPSec data processing unit, the packet content is first encrypted according to the key information. After completion, it is re-packed based on the external network destination IP address and destination MAC address and sent to the packet aggregation module;

[0152] Again, the packet aggregation module aggregates the encrypted packets and sends them to the packet filtering inspection module;

[0153] Again, after the data packet enters the packet filtering inspection module, the outgoing packet is filtered for sensitive words, and after passing, it enters the external network port MAC module;

[0154] Finally, the external network port MAC module assembles the packet and sends it from the network port to the external network.

[0155] Figure 6 This is a flow chart of the transmission of data from the extranet to the intranet in the IPSec VPN system proposed by the present invention. The overall process is the reverse of the process of sending data from the intranet to the extranet. The detailed steps are as follows:

[0156] First, the external network data packet enters the external network port MAC module of the FPGA unit from the network port;

[0157] Secondly, the data packet is parsed in the external network port MAC module, and after passing the MAC address check and CRC check, it enters the packet filtering inspection module;

[0158] Next, the data packet enters the packet filtering inspection module. When the destination IP address of the packet is not the IP of the local system, the data packet is checked for sensitive words, etc. After passing the inspection, it enters the packet classification module;

[0159] Once again, after the data packet enters the packet classification module, if the destination IP address of the packet is not the IP of this system, the packet header related information is extracted and entered into the TCAM unit to search for the ACL table entry. If the search does not hit, the packet is directly intercepted and discarded; if the search hits, the packet and the key information returned by the search for the ACL table entry are sent to the IPSec data processing unit.

[0160] Again, after the data packet enters the IPSec data processing unit, the packet content is first encrypted according to the key information, and then sent to the packet aggregation module;

[0161] Again, the packet aggregation module aggregates the packets and forwards them to the packet filtering and inspection module;

[0162] Once again, after the data packet enters the packet filter inspection module, after the outgoing packet passes the sensitive word filtering inspection, the packet header related information enters the TCAM unit to search for ACL table entries and ARP table entries. If the search does not hit, the packet is directly intercepted and discarded; if the search hits, it is sent to the external network port MAC module after the MAC address returned by the ARP table entry is encapsulated;

[0163] Finally, the external network port MAC module assembles the packet and sends it from the network port to the internal network.

[0164] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

[0165] Those skilled in the art will appreciate that the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, the present application can adopt the form of complete hardware embodiments, complete software embodiments, or embodiments in combination with software and hardware. Moreover, the present application can adopt the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code. The scheme in the embodiments of the present application can be implemented in various computer languages, for example, object-oriented programming language Java and literal scripting language JavaScript, etc.

[0166] The present application is described with reference to the flowcharts and / or block diagrams of the methods, devices (systems), and computer program products according to the embodiments of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, as well as the combination of the processes and / or boxes in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing device to generate a machine, so that the instructions executed by the processor of the computer or other programmable data processing device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0167] These computer program instructions may also be stored in a computer-readable memory capable of directing a computer or other programmable data processing device to operate in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture comprising an instruction device, which implements the process Figure 1 A process or multiple processes and / or boxes Figure 1 A function specified in one or more boxes.

[0168] These computer program instructions can also be loaded onto a computer or other programmable data processing device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for implementing the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0169] Although the preferred embodiments of the present application have been described, those skilled in the art may make other changes and modifications to these embodiments once they have learned the basic creative concept. Therefore, the appended claims are intended to be interpreted as including the preferred embodiments and all changes and modifications falling within the scope of the present application.

[0170] Obviously, those skilled in the art can make various changes and modifications to the present application without departing from the spirit and scope of the present application. Thus, if these modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is also intended to include these modifications and variations.

Claims

1. A high-performance IPSec VPN working method based on FPGA, characterized in that: include: Acquire target data, and perform first preprocessing on the target data; Performing a second preprocessing on the result of the first preprocessing, wherein the second preprocessing includes a first processing strategy and a second processing strategy; The second preprocessing result is matched with a preset channel for transmission to complete data interaction.

2. The high-performance IPSec VPN working method based on FPGA as claimed in claim 1, characterized in that: The acquiring target data and performing a first preprocessing on the target data includes: Acquire target data, and perform a first detection on the target data; Performing a first classification on the target data that passes the first detection to obtain first classification data and second classification data; The first preprocessing includes a first detection and a first classification.

3. The high-performance IPSec VPN working method based on FPGA as claimed in claim 2, characterized in that: The second preprocessing comprises: processing the first classified data using a first processing strategy, the first processing strategy including at least a first encryption operation; The second classified data is processed by a second processing strategy, the second processing strategy including at least a second decryption operation.

4. The high-performance IPSec VPN working method based on FPGA as claimed in claim 3, characterized in that: The performing second preprocessing on the result of the first preprocessing comprises: Performing a first matching judgment on the first classification data; Performing a first encryption operation on the matched first classification data; Performing a first aggregation on the first classified data after the first encryption operation; The data after the first aggregation is subjected to a second detection.

5. The high-performance IPSec VPN working method based on FPGA as claimed in claim 4, characterized in that: The performing a second preprocessing on the result of the first preprocessing further includes: Performing a second matching judgment on the second classification data; Performing a second decryption operation on the matched second classification data; Performing a first aggregation on the second classified data after the second decryption operation; The data after the first aggregation is subjected to a second detection.

6. The high-performance IPSec VPN working method based on FPGA as claimed in claim 5, characterized in that: Also includes: The first detection is used to perform a first packet check on the target data; The second detection is used to perform a second packet check on the first classified data after the first encryption operation and on the second classified data after the second decryption operation.

7. A high-performance IPSec VPN working system based on FPGA, characterized in that: include: A first preprocessing module configured with a first preprocessing function, a second preprocessing module configured with a second preprocessing function, and a matching module configured with a matching channel transmission function; A first preprocessing module, used for acquiring target data and performing a first preprocessing on the target data; A second preprocessing module, configured to perform a second preprocessing on the result of the first preprocessing, wherein the second preprocessing includes a first processing strategy and a second processing strategy; The matching module is used to match the second preprocessing result with a preset channel for transmission to complete data interaction.

8. The high-performance IPSec VPN working system based on FPGA as claimed in claim 7, characterized in that: It also includes several detection modules configured with detection functions, several classification modules configured with classification functions, several encryption or decryption modules configured with encryption or decryption functions, several aggregation modules configured with aggregation functions, several matching modules configured with matching functions, and any several modules used to associate the above modules.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 6 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 6 are implemented.

Images