A message processing method for red-black isolated IPSEC

Abstract

The application discloses a message processing method for red-black isolation IPSEC and relates to the technical field of network communication. The method comprises the following steps: constructing a red area and a black area, and arranging an isolation unit between the two areas; based on the netfilter mechanism of a LINUX kernel, registering multiple hook points in a message processing flow to realize message passing; and sending and receiving messages through the constructed message processing flow. The method solves the technical problem that logical isolation between the red area and the black area is not complete in the prior art, ensures strict logical isolation between the red area and the black area, and improves the security and reliability of data transmission between the red area and the black area.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of network communication, and particularly relates to a message processing method for red-black isolated IPSEC. BACKGROUND

[0002] In modern network communication, data security and regional isolation are the key to ensuring stable operation of the system. However, in the implementation of isolation between the red area (internal network processing sensitive data) and the black area (public network or non-trusted area), the existing technology usually relies on simple hardware isolation or a single encryption scheme, which has problems such as incomplete logical isolation, high risk of data leakage, and performance bottleneck. For example, in the process of data transmission, encryption and decryption operations often consume a large amount of resources, and the processing flow of different types of messages lacks optimization, resulting in low efficiency. In addition, in the face of complex network attacks and illegal access, the existing scheme is difficult to achieve fine-grained data flow filtering and control, and cannot meet the needs of high-security communication. Therefore, there is an urgent need for a solution that can achieve efficient logical isolation between the red area and the black area, and accurately classify and process messages, to improve data transmission efficiency and security.

[0003] At the present stage, there is a technical problem of incomplete logical isolation between the red area and the black area in the related technology. SUMMARY

[0004] The present application provides a message processing method for red-black isolated IPSEC, which solves the technical problem of incomplete logical isolation between the red area and the black area in the prior art.

[0005] The present application provides a message processing method for red-black isolated IPSEC, which includes:

[0006] A red area and a black area are constructed, and an isolation unit is constructed between the red area and the black area; a plurality of hook points are registered in the message processing flow in the red area, the black area and the isolation unit by using the netfilter mechanism of the LINUX kernel, and the messages are processed, wherein the plurality of hook points include PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT and POST_ROUTING; and the messages are processed based on the constructed message processing flow, wherein the message processing flow includes a sending direction and a receiving direction.

[0007] The application provides a message processing method for red-black isolated IPSEC, which comprises the following steps: constructing a red area and a black area, and setting an isolation unit between the red area and the black area; registering multiple hook points in a message processing flow based on a netfilter mechanism of a LINUX kernel to realize message passing; and sending and receiving messages through the constructed message processing flow, so that strict logical isolation between the red area and the black area is ensured, and the security and reliability of data transmission between the red area and the black area are improved. BRIEF DESCRIPTION OF DRAWINGS

[0008] In order to more clearly illustrate the technical solutions of the embodiments of the present disclosure, the drawings of the embodiments of the present disclosure will be briefly introduced below. In the present application, a flow chart is used to illustrate the operations performed by the system according to the embodiments of the present application. It should be understood that the foregoing or the following operations are not necessarily performed in sequence. On the contrary, according to the needs, various steps can be processed in reverse order or at the same time. Meanwhile, other operations can be added to these processes, or one or more steps of operations can be removed from these processes.

[0009] Figure 1 A flowchart of a message processing method for red-black isolated IPSEC provided by the embodiments of the present application;

[0010] Figure 2 A red area encrypted message processing flowchart of a message processing method for red-black isolated IPSEC provided by the embodiments of the present application;

[0011] Figure 3 A black area CPU forwarding flowchart of a message processing method for red-black isolated IPSEC provided by the embodiments of the present application, which is for the out direction of the message sent to the external network after passing through the isolation unit;

[0012] Figure 4 A black area CPU message processing flowchart of a message processing method for red-black isolated IPSEC provided by the embodiments of the present application, which is for the in direction of the message received from the external network and needing to be decrypted;

[0013] Figure 5 A red area CPU message processing flowchart of a message processing method for red-black isolated IPSEC provided by the embodiments of the present application, which is for the in direction of the message received from the isolation unit after decryption;

[0014] Figure 6 A tunnel encryption authentication mode OB direction encapsulation processing flowchart of a message processing method for red-black isolated IPSEC provided by the embodiments of the present application;

[0015] Figure 7A transmission encryption authentication mode OB direction encapsulation processing flow diagram of a message processing method of red-black isolated IPSEC provided by an embodiment of the present application is shown in the figure.

[0016] Figure 8 An authentication only mode OB direction encapsulation processing flow diagram of a message processing method of red-black isolated IPSEC provided by an embodiment of the present application is shown in the figure.

[0017] Figure 9 An encryption only mode OB direction encapsulation processing flow diagram of a message processing method of red-black isolated IPSEC provided by an embodiment of the present application is shown in the figure. DETAILED DESCRIPTION

[0018] The above description is only a summary of the technical scheme of the present application, in order to more clearly understand the technical means of the present application, the content of the specification can be implemented, and in order to make the above and other purposes, characteristics and advantages of the present application more obvious and easy to understand, the following specific embodiments of the present application are described.

[0019] In order to make the purpose, technical scheme and advantage of the present application more clear, the following will combine the drawings to make further detailed description of the present application, the described embodiment should not be regarded as the limitation of the present application, all other embodiments obtained by the ordinary skilled in the art without doing creative work belong to the scope of protection of the present application.

[0020] In the following description, "some embodiments" are involved, which describe a subset of all possible embodiments, but it can be understood that "some embodiments" can be the same subset or different subset of all possible embodiments, and can be combined with each other without conflict, the term "first\second" involved only distinguishes similar objects, and does not represent the specific order of the object. The terms "include" and "have" and any variants, are intended to cover non-exclusive inclusion, for example, a process, method, system, product or server including a series of steps or units does not have to be limited to those steps or units clearly listed, but can include other steps or modules not clearly listed or inherent to these processes, methods, products or devices. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as understood by those skilled in the art to which the present application belongs. The terms used herein are only for the purpose of describing the embodiments of the present application.

[0021] The embodiments of the present application provide a message processing method of red-black isolated IPSEC, as shown in the figure, the method comprises: Figure 1

[0022] ​Step S100, construct the red zone and the black zone, and construct the isolation unit between the red zone and the black zone. Specifically, first, the network environment is divided by defining the red zone and the black zone, the red zone represents the trusted area, processes internal data, and the black zone is the external untrusted area, processes network traffic from the outside. In order to ensure the safety of communication between the two, an isolation unit is designed between the red zone and the black zone, the isolation unit as an intermediary module between the red zone and the black zone, undertakes multiple core functions: encrypt and decrypt the data of cross-zone communication, ensure that the data is not tampered during transmission; strict filtering and checking of the passed message, prevent the risk data of the black zone from entering the red zone; according to the message type, the sensitive data is protected by stripping information; and according to the needs of the message processing. The isolation unit is deployed on the gateway device between the red zone and the black zone, provides strict logical isolation and security policy, effectively improves the security of the network system through encryption protocol and access management, avoids the risk of information leakage and data tampering. The strict logical isolation of the red zone and the black zone is realized, and the necessary security protection is provided in the data transmission process, and the safety of sensitive information is protected.

[0023] In step S200, the netfilter mechanism of the LINUX kernel is adopted to register a plurality of hook points in the message processing flow in the red zone, the black zone and the isolation unit, and to perform pass processing on the message, wherein the plurality of hook points include PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT and POST_ROUTING. Specifically, the network packet is processed by using the netfilter mechanism of the LINUX kernel. The netfilter mechanism is a kernel framework, which provides a plurality of hook points for performing operations in the processing process of the packet. Specifically, in the message processing flow in the red zone, the black zone and the isolation unit, five hook points, i.e., PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT and POST_ROUTING, are registered by using the netfilter mechanism, and each hook point corresponds to a different network data processing stage. The PRE_ROUTING hook point processes the packet before the packet enters the routing decision, and is used for source network address translation (SNAT) or packet filtering; the LOCAL_IN processes the packet with a local destination, and is suitable for local security policy control; the FORWARD is used for forwarding the packet, and is suitable for the packet in the router or gateway; the LOCAL_OUT hook point is used for the packet sent by the local, and controls the forwarding and security of the local traffic; and the POST_ROUTING hook point processes the packet leaving the system, and performs destination network address translation (DNAT) or other necessary final operations. By registering the customized processing logic at the hook points, the netfilter can ensure that the message is processed according to the strict security and control policy when passing through the red zone, the black zone and the isolation unit, thereby effectively guaranteeing the isolation of the network and the security of the data.

[0024] In a possible implementation, the netfilter mechanism of the LINUX kernel is adopted, and a plurality of hook points are registered in the message processing flow in the red zone, the black zone and the isolation unit for the message to be processed, wherein the plurality of hook points include PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT and POST_ROUTING. Step S200 further includes step S210, the netfilter mechanism is registered at post-routing of a network card connected to the red zone and the isolation unit, and at pre-routing of an external network network card connected to the black zone and the isolation unit. If the network card is in a bridge mode, the netfilter of the bridge is registered, and if the network card is in a gateway mode, the IP_netfilter is registered. Specifically, the netfilter mechanism is registered at the post-routing hook of the network card connected to the red zone and the isolation unit, and at the pre-routing hook of the external network network card connected to the black zone and the isolation unit, so as to ensure that the message is processed correctly according to the predetermined rules. After the message is processed in the red zone, when the message passes through the post-routing hook before entering the isolation unit, the netfilter performs the last check and routing decision on the message according to the set rules, so as to ensure data security and compliance. In the receiving direction, the message sent by the external network first enters the black zone, and when the message passes through the pre-routing hook, the netfilter performs preprocessing on the message, and then the message enters the processing flow of the black zone after it is confirmed that the message meets the security policy. Further, the registration mode of the netfilter depends on the working mode of the network card: when the network card works in the bridge mode, the netfilter processes the link layer traffic and is registered to the bridging netfilter; and when the network card works in the gateway mode, the netfilter processes and routes the IP packet and is registered to the IP_netfilter, so as to realize more efficient flow control and security protection, support the processing of the IPSEC message based on the red-black architecture in different network topology modes, support both the gateway mode and the bridge mode, and can switch between different modes according to the change of the network topology, and has high adaptability.

[0025] In step S300, the packet is processed based on the constructed packet processing flow, wherein the packet processing flow comprises a sending direction and a receiving direction. Specifically, in the packet processing method of the red-black isolation IPSEC, the packet processing flow of the sending direction first filters the plaintext data sent by the user through the red zone. The red zone checks and processes the packet according to the security policy, for example, checks the validity of the packet or whether it meets the predetermined transmission standard. The processed data is added with control header and encapsulation information to ensure that the data can be correctly identified and relevant control operations are performed in the network. Then, the encapsulated data is transmitted to the isolation unit, which is responsible for encrypting the data to ensure the confidentiality and integrity of the data. The encrypted ciphertext is then transmitted to the black zone, which removes the information from the ciphertext, removes the redundant encapsulation, and extracts the valid encrypted content (such as ESP ciphertext). Finally, the black zone sends the decrypted ciphertext to the external network, completing the packet processing in the sending direction. In the receiving direction, the packet of the external network is first received by the black zone, which will filter the packet and add control header information to ensure that the received data meets the expected standard. Then, the encrypted packet with the control header is sent to the isolation unit for decryption operation to restore the plaintext. The decrypted plaintext data is sent to the red zone, which further checks the integrity of the data, removes unnecessary content and performs the final filtering process. Finally, the processed original packet is sent to the target receiving end, completing the packet processing in the receiving direction. In this way, the sending and receiving processes of the entire packet are strictly controlled and processed in different areas of the red zone, the black zone and the isolation unit, thereby ensuring the security, integrity and correctness of the data. The encapsulation and decapsulation processing of the packet based on the Linux-netfilter framework can dynamically load the driver. Without loading the driver, the original packet processing flow is not affected. When the driver is loaded, not only the IPSEC service flow is supported, but also some special types of packets are supported for special processing, such as the transparent special processing of arp packets.

[0026] In a possible implementation, based on the constructed message processing flow, the message is processed, wherein the message processing flow includes a sending direction and a receiving direction, and step S300 further includes step S310, wherein the plaintext data sent by the user is filtered by the red area and control headers and encapsulation information are added. Specifically, the plaintext data sent by the user is first filtered by the red area. The red area ensures that the data packet conforms to the specified format and security requirements by implementing data legitimacy check, integrity verification and compliance review. Next, the red area adds control headers and encapsulation information to the data packet. The control headers include information such as the priority of the data packet, the source and target addresses, the protocol type, and the like, to ensure that the data can be smoothly and safely transmitted to the target. Subsequently, the red area further adds encapsulation information to the data packet, mainly including data required for encryption and identity verification, to ensure the confidentiality, integrity and security of the data during transmission. Finally, the processed plaintext data with control headers and encapsulation information is sent from the red area to the isolation unit, to prepare for subsequent encryption and transmission. This process effectively guarantees the secure transmission of data in the network.

[0027] Step S320, the plaintext data with the added control headers and encapsulation information is sent to the isolation unit for encryption to obtain ciphertext. Specifically, in the message processing flow, first, the plaintext data sent by the user will go through the filtering step of the red area, which ensures the legitimacy and integrity of the data and removes potential risky content. The filtered data will add control headers and encapsulation information, including data source, target, authentication information and timestamp, etc., for correct routing and verification of data in the subsequent transmission process. Next, the processed plaintext data will be sent to the isolation unit for encryption processing. The isolation unit uses encryption algorithms such as AES or RSA to encrypt the plaintext data, converting it into ciphertext, thereby ensuring the confidentiality of the data. The encrypted ciphertext will be transmitted to the black area for further processing.

[0028] Step S330, the ciphertext is sent to the black area, the ciphertext is information stripped, ESP ciphertext is obtained, and is sent to the external network. Specifically, the encrypted ciphertext is first transmitted from the isolation unit to the black area, and the black area is responsible for further processing the ciphertext. Specifically, the black area strips the ciphertext of information, removes redundant encapsulation headers and control information, and only retains the most core encrypted data. After this step, the ciphertext is converted into a message in ESP (Encapsulating_Security_Payload) format. The ESP format ciphertext contains encrypted data and necessary authentication information, used to ensure the confidentiality and integrity of the data. Finally, the processed ESP ciphertext is sent to the external network to ensure that it can be transmitted in a secure manner in the external network, and the data will not be leaked or tampered with. After receiving the external network, according to the preset rules, the system will decrypt the ESP ciphertext to restore the original message content.

[0029] In a possible implementation, as shown in Figure 2 The plaintext data sent by the user is filtered by the red area and control headers and encapsulation information are added, step S310 further includes step S311, determining whether the message is a negotiation message, if so, the protocol stack is handled. Specifically, when processing incoming messages, it is first necessary to determine whether the message is a negotiation message. Negotiation messages are usually used for protocol establishment or update, and contain key exchange information, encryption algorithm negotiation or identity authentication, etc. If the message is a negotiation message, the system will hand it over to the protocol stack for processing, and the protocol stack is responsible for parsing the message and performing necessary protocol negotiation or key exchange operations. In this way, the protocol stack ensures the correct negotiation of keys, encryption algorithms and authentication methods, and ensures that subsequent data transmission is encrypted and protected according to the agreed encryption and authentication methods. After completing the negotiation, the protocol stack generates or updates key, algorithm settings, etc. information to ensure that subsequent data encryption and decryption meet the security requirements, and ultimately ensure the security and integrity of the communication.

[0030] Step S312, if no, the network layer information of the packet is extracted, it is judged whether it is a tcp or udp packet, if yes, the five tuple information is extracted, if no, the three tuple information is extracted. Specifically, if the packet is not a negotiation packet, the system will first extract the network layer information of the packet, and judge whether the packet belongs to TCP or UDP protocol. If it is a TCP or UDP packet, the system will further extract the five tuple information, which includes source IP address, destination IP address, source port number, destination port number and protocol type, which helps the system to identify the flow direction and source of the packet, and supports subsequent network management functions such as routing selection and flow control. If the packet is not a TCP or UDP protocol, the system will judge whether it belongs to other types, and extract the three tuple information, which usually includes source IP address, destination IP address and protocol type, although it does not include port number, but it can still help the system to identify and process such traffic. Through these steps, the system can make reasonable processing decisions for different types of network traffic.

[0031] Step S313, according to the five tuple information or the three tuple information, the strategy table is searched, if the strategy is not hit, the packet is processed according to the default strategy, if the strategy is hit, the sad table and the spd strategy action are parsed, the packet is discarded, sent to CPU, transmitted, and control header information is added. Specifically, first, the system will search the preset strategy table according to the five tuple information or the three tuple information in the packet. The strategy table is used to store packet processing rules based on source address, destination address, port number and protocol type. If the system fails to find a strategy matching the packet in the strategy table, the packet will be processed according to the default strategy, usually discarded or allowed to pass. If there is a matching strategy in the strategy table, the system will further parse the entries in the security association database (SAD) and the security policy database (SPD) according to the indication of the strategy, and process according to the preset action. Specifically, if the strategy requires, the system may discard the packet that does not meet the conditions, or send the packet to the CPU for more complex analysis. If the strategy indicates a transparent processing, the packet will be allowed to pass without modification, while adding control header information such as packet identification, encryption mark, etc. in the packet, which will be passed to the subsequent network layer or application layer to ensure the safety and flow management of the packet, supporting four different actions on the packet, namely encryption and decryption, transparent transmission, sending to CPU and discarding, thus realizing the ipsec function of red and black isolation, and also realizing the special processing function of the device on the packet.

[0032] In a possible implementation manner, as Figure 3As shown, the ciphertext is sent to the black zone, and information is stripped from the ciphertext to obtain ESP ciphertext, which is sent to the external network. Step S330 further includes step S331, which strips information from the ciphertext received from the isolation unit. Specifically, after receiving the ciphertext from the isolation unit, the system strips information from the ciphertext to remove additional information related to the encryption process. First, the system identifies and removes control headers in the encrypted data packet, which typically contain markers identifying the encryption process, key information, or encryption algorithm. Next, the system removes any additional checksums or verification information that is not needed later in the data processing. In addition, the system also strips all unnecessary encapsulation data that increases the size of the data packet when encrypted but is no longer needed after decryption. This process ensures that the ciphertext data is cleaned up to be valid encrypted payloads, facilitating subsequent decryption operations so that the data can be restored to the original plaintext data for subsequent processing and transmission.

[0033] Step S332, determine whether it is a negotiation message, if yes, then hand over the protocol stack processing. Specifically, after receiving the message, the system first determines whether the message is a negotiation message. Negotiation messages are typically used for parameter and key exchange processes for establishing encrypted communication, such as ISAKMP or IKE messages used in the IPsec protocol. If the message is determined to be a negotiation message, the system will hand it over to the protocol stack for processing. The protocol stack is a key component in network communication, responsible for processing messages at different protocol layers. In processing negotiation messages, the protocol stack will perform operations such as key negotiation, identity verification, and selection of encryption algorithms according to predefined protocol rules. In this way, the protocol stack can ensure that both parties of the network communication agree on encryption methods, keys, and other parameters to ensure the security of subsequent data transmission. If the message is not a negotiation message, the system skips the protocol stack processing and proceeds to the next step of the message processing flow.

[0034] Step S333, if no, it is judged whether it is only encryption encapsulation mode, if yes, the four-layer checksum is recalculated and then sent to the external network, if no, it is directly sent to the external network. Specifically, when the received ciphertext is not the negotiation message, the system further judges whether the message belongs to the "only encryption encapsulation mode". In the only encryption encapsulation mode, the message content is only encrypted and not authenticated, so additional processing is required. The system first checks whether the message conforms to this mode, if yes, the system recalculates the four-layer checksum. The four-layer checksum is to ensure the integrity of the data in the transmission process, because the encryption operation modifies the message content, causing the original checksum to be invalid. After recalculating the checksum, the ciphertext is sent to the external network. If the message does not belong to the only encryption encapsulation mode, it reflects that it has undergone more complex encapsulation processing (such as encryption and authentication at the same time), at this time the system directly sends the ciphertext to the external network without recalculating the checksum. In this way, by processing different message modes respectively, the security and integrity of the data are ensured.

[0035] In a possible implementation, based on the constructed message processing flow, the message is processed, wherein the message processing flow includes a sending direction and a receiving direction, and step S300 further includes step S340, the black area receives the message sent by the external network, filters and adds control header information. Specifically, after the black area receives the message from the external network, it first performs filtering processing to ensure that the message conforms to the predetermined security standards and policies. This process includes checking the source address, destination address, protocol type and other information of the message, and performing security verification, such as using firewall rules or intrusion detection system (IDS) to prevent the transmission of risky content. After filtering, the black area will add control header information to the legal message, which is used to identify the transmission state and routing metadata of the message, such as timestamp, protocol type, encryption identifier, checksum, etc., to ensure that the message can be correctly encrypted in the isolation unit. After adding the control header information, the message is transmitted to the isolation unit for further encryption processing, preparing for subsequent decryption and transmission to the red area, ensuring that the message is processed safely and in compliance, and finally sending the plaintext data to the user.

[0036] Step S350, the message with added control header information is sent to the isolation unit for decryption, obtaining the plaintext. Specifically, after receiving the filtered and control header information added message, the black zone forwards it to the isolation unit for decryption processing. The isolation unit decrypts the encrypted data using the pre-defined key, restoring its original plaintext. This decryption process can use symmetric encryption (such as AES) or asymmetric encryption (such as RSA) method, depending on the way the message is encrypted. During decryption, the isolation unit will verify the integrity and identity of the message, ensuring that the data has not been tampered with or forged during transmission. After decryption, the restored plaintext data, including the original data payload and additional control header information, will continue to be transmitted to the red zone for further processing. The red zone will perform additional security verification on the plaintext data, such as filtering, information stripping, etc., to ensure that the data meets the system's internal security rules, and finally send it to the target user.

[0037] Step S360, send the plaintext to the red zone, filter and information stripping, obtain the original message, send to the user. Specifically, after the message is decrypted by the isolation unit and restored to plaintext, the received message will be forwarded to the red zone for further processing. In the red zone, the message will first be filtered to ensure that it meets the system's security requirements and standards. The filtering process includes reviewing the protocol header, data content, etc. in the message to check whether it contains risky data, illegal content or non-standard parts. For example, it may check for unsafe transmission protocols, viruses or other potential threats. Then, information stripping operation is performed. This means that the red zone will remove all redundant control headers, identification information or encrypted metadata from the message, leaving only the pure data content. These redundant parts include encryption identification of data, protocol type, routing information, etc., which are completely removed in this step to ensure that the message received by the end user only contains necessary data content. After processing, the message will be sent to the user as is, which means that the data will not be modified or damaged during transmission, and the transmitted data is secure and ready for use. The user system will receive these security-checked and confirmed data, ensuring data integrity and confidentiality, preventing information leakage or tampering.

[0038] In one possible implementation, as Figure 4As shown, the black area receives the message sent by the external network, filters and adds control header information, and step S340 further includes step S341 of judging whether the message sent by the external network needs to be fragmented and reassembled. If yes, fragmentation and reassembly are performed, and if no, fragmentation and reassembly are not performed. Specifically, when receiving the message sent by the external network, it is first necessary to judge whether the message has been divided into multiple fragments. If yes, the system will start the fragmentation and reassembly process, and all fragments will be combined into a complete original message in order by using the identifier and offset information of each fragment. If the message is not fragmented, reassembly is not needed, and the system will directly process the complete message. The process of fragmentation and reassembly ensures that the network layer can correctly recover the divided data, avoids data loss or errors caused by message segmentation, and ensures that the received message can be correctly processed in the original order. This process is particularly important when processing large data packets, and can effectively ensure the integrity and accuracy of the data.

[0039] Step S342, judging whether the message is a negotiation message, if yes, it is processed by the negotiation unit. Specifically, during message processing, it is first necessary to judge whether the received message is a negotiation message. Negotiation messages are usually used for protocol establishment, parameter negotiation or key exchange operations, etc. When the message is identified as a negotiation message, it will be directly processed by a special negotiation unit. The task of the negotiation unit is to analyze the negotiation information in the message and process the encryption, authentication or communication protocol negotiation steps therein. For example, when establishing a secure connection, the negotiation unit may need to verify the certificate, negotiate the encryption algorithm, exchange the key, etc. This processing flow ensures that the negotiation message can be accurately parsed and processed, thereby ensuring that the secure communication between systems can be successfully established. If the message is not a negotiation message, it will enter the subsequent processing flow and perform corresponding operations according to the type or content of the message.

[0040] Step S343, if no, judge whether it is TCP or UDP message, if yes, extract five tuple information, if no, extract three tuple information. Specifically, in processing the received message, first judge whether the message is TCP or UDP protocol. If yes, extract five tuple information from the message, five tuple contains source IP address, target IP address, source port number, target port number and protocol type. Through these five elements, the system can accurately identify and manage traffic, access control, traffic forwarding and security policy judgment based on port and IP address. For example, if it is detected that the traffic from a certain source IP is continuously sent to a specific port, the system can implement speed limit, block or preferential treatment of the traffic based on five tuple information. If the message is not TCP or UDP protocol, the system extracts three tuple information, i.e. source IP address, target IP address and protocol type, which is also effective for processing other protocol traffic such as ICMP (Internet Control Message Protocol). Based on the extracted five tuple or three tuple information, the system will then query the policy table (such as SPD table) to judge whether the message meets the preset security policy. If the policy is not hit, it is processed according to the default policy; if the policy is hit, the system will discard the message, send it to the CPU for processing or pass it through according to the policy action defined in the SPD table.

[0041] Step S344, according to the five tuple information or three tuple information to determine whether to hit the spd table, if not, according to the default policy action processing, if yes, parse sad table and spd of the received message processing flow policy action, according to the policy action to the message discard, send CPU, pass through. Specifically, after receiving the message and extracting the five tuple information (including source IP, target IP, source port, target port and protocol type) or three tuple information (including source IP, target IP and protocol type), the system will query the SPD (security policy database) table according to these information, judge whether the message conforms to the preset security policy. The SPD table records the security policy rules of network traffic, such as allowed, rejected or encrypted traffic. If the five tuple or three tuple information of the message does not hit any policy in the SPD table, the system will process according to the default policy, usually discarding the message or taking the basic forwarding rule processing. If the message hits a policy in the SPD table, the system will further parse the SAD (security association database) table to obtain the security action corresponding to the policy. According to the policy action, the system may take three kinds of processing methods: first, if the policy requires discarding the message, the system will directly discard the message without any further processing; second, if the policy requires deep analysis of the message, the system will send the message to the CPU for further checking or generate a security report; finally, if the message is considered to conform to the security policy and can be transmitted normally, the system will pass the message according to the policy action, that is, allow the message to continue transmission without any modification. Through this mechanism, the system can effectively manage the message flow, ensure that it conforms to the security policy requirements, and at the same time ensure that the non-compliant traffic is correctly processed, thereby improving the security and efficiency of the network.

[0042] In a possible implementation, as Figure 5As shown, the plaintext is sent to the red zone, filtered and information stripped, obtaining the original message, sent to the user, step S360 further comprises step S361, the plaintext is stripped of information, and the MAC address of the plaintext is replaced with the MAC address of the network card or bridge connected to the isolation unit. Specifically, during the message processing process, the plaintext data needs to be stripped of information first, that is, unnecessary redundant or irrelevant data in the message is removed, and only valid information is retained. The goal of this operation is to simplify the content of the message, ensure that the core data in the message can be correctly processed, and improve the transmission efficiency. Information stripping usually involves removing useless header information and control markers, etc. in order to reduce interference and data volume in subsequent steps. Subsequently, the processing process replaces the target MAC address of the message with the MAC address of the network card or bridge connected to the isolation unit. The target MAC address points to the final destination of the data packet, but since the message needs to pass through the isolation unit before entering the safe area, the original target MAC address must be changed to the MAC address of the network interface of the isolation unit. If the isolation unit is connected through a network card, the target MAC address will be replaced with the MAC address of the network card; if connected through a bridge, the MAC address of the bridge will be replaced. This operation ensures that the message can smoothly pass through the isolation unit and continue to be delivered to the final destination along the correct path, thereby ensuring the integrity and security of data transmission between different security areas.

[0043] Step S362, determine whether it is a tcp or udp message, if yes, extract the five tuple information, if not, extract the three tuple information. Specifically, during the message processing process, the system first determines whether the message is a TCP or UDP protocol. If it is a TCP or UDP protocol, the system will extract five tuple information from the message. The five tuple contains five key information: source IP address, target IP address, source port, target port and protocol type. Through these five elements, the system can accurately identify the communication peer and the transport layer protocol of the message, providing a basis for subsequent security policy matching. These five tuple information will be used to search the policy database (SPD), and if the message matches a specific policy, the system will take appropriate processing measures according to the policy, such as discarding, sending to CPU or passing through, etc. If the message is not a TCP or UDP protocol, the system will extract three tuple information. The three tuple includes source IP address, target IP address and protocol type, which is suitable for non-transport layer protocols such as ICMP, etc. These information will also be used for policy judgment and subsequent processing. Therefore, whether the message is TCP, UDP or other type of protocol, the system can extract the necessary identification information, and perform security processing on the message according to the policy table. The implementation of policy matching matches the policy in the form of flow table, which can process the message with high performance.

[0044] Step S363, according to the five tuple information or three tuple information, it is judged whether the spd table is hit, if not, the default policy action is processed, if yes, the sad table and the policy action of the spd of the received message processing flow are parsed, the message is discarded, sent to CPU or transmitted according to the policy action. Specifically, after receiving the message, the system first searches the policy database (SPD) according to the five tuple or three tuple information of the message to find out whether there is a matching processing policy. The five tuple includes source IP, target IP, source port, target port and protocol type, and the three tuple includes source IP, target IP and protocol type. These information are used to identify the source and destination of the message. If the message is not found in the SPD table, it means that the message does not meet any specific security requirements, and the system will process according to the default preset policy, which usually includes discarding the message or performing basic traffic filtering. If the message is found in the SPD table, the system will further analyze the corresponding security association database (SAD). SAD contains specific security policy actions such as encryption, decryption, verification, etc. According to the analysis result, the system will execute the corresponding operation according to the indication in SAD, which may include discarding the message (when the message does not meet the policy or there is a security risk), sending the message to the CPU for further processing, or transmitting the message, allowing it to continue to flow without further intervention. This process ensures that all data streams entering and exiting the network are processed according to the pre-defined security policy, maximizing the security and integrity of the system.

[0045] In a possible implementation manner, as Figure 6 , Figure 7 , Figure 8 , Figure 9, the packet processing flow includes a sending direction and a receiving direction, and step S300 further includes: IPSEC packet processing involving four encapsulation modes, specifically including a tunnel encryption authentication encapsulation mode, a transmission encryption authentication encapsulation mode, an authentication-only encapsulation mode, and an encryption-only encapsulation mode. Each encapsulation mode uses a different encapsulation format to adapt to different security requirements and ensure the confidentiality, integrity of data, and security of network transmission. In the sending direction, the packet processing flow includes encapsulation operations on data. In the tunnel encryption authentication encapsulation mode, the entire IP packet (including the IP header and the payload) is encrypted and authenticated, thereby ensuring the confidentiality and integrity of data transmission and being suitable for scenarios such as VPN that need to hide the contents of the packet. The transmission encryption authentication encapsulation mode only encrypts and authenticates the data payload, which is suitable for end-to-end encryption requirements and can reduce performance overhead, and is usually used in scenarios that do not need to hide IP addresses. The authentication-only encapsulation mode only performs data integrity verification without encrypting the data, which is suitable for scenarios that require data integrity checking without encryption. The encryption-only encapsulation mode encrypts the data but does not perform authentication, which is suitable for scenarios that require data security protection but have lower requirements for data integrity. Each encapsulation mode uses a different encapsulation format to adapt to different security requirements. In the receiving direction, the processing flow performs decapsulation according to different encapsulation modes. In the tunnel encryption authentication encapsulation mode, the receiver decrypts the entire packet and performs integrity verification. In the transmission encryption authentication encapsulation mode, only the data payload is decrypted and its integrity is verified. In the authentication-only encapsulation mode, the receiver verifies the integrity of the data, but the data remains in plaintext. Finally, in the encryption-only encapsulation mode, the receiver decrypts the data content but does not perform integrity verification. Switching between the four encapsulation modes is also supported, allowing the selection of appropriate packet processing methods according to actual security requirements. In addition, the system also supports encapsulation processing of fragmented packets, ensuring that even if fragmentation occurs in the network, packet encapsulation and decapsulation can still be correctly processed, further improving the adaptability and flexibility of the system. By supporting flexible switching between different encapsulation formats and encapsulation modes, the system provides higher processing efficiency and flexibility while ensuring data security, making it suitable for various complex network environments.

[0046] The embodiment of the present application adopts the construction of the red zone and the black zone, and sets an isolation unit between the two; based on the netfilter mechanism of the LINUX kernel, a plurality of hook points are registered in the packet processing flow to realize packet passing; and through the constructed packet processing flow, the packet is processed for sending and receiving, so as to ensure strict logical isolation between the red zone and the black zone, and to improve the security and reliability of data transmission between the red zone and the black zone.

[0047] The above detailed description does not limit the scope of the application. Various modifications, combinations and equivalents thereof can be made in light of the above detailed description. Any modification, equivalent replacement and improvement made within the spirit and principle of the application shall fall within the scope of the application.

Claims

1. A method for processing a message of red-black isolated IPSEC, characterized in that, The method comprises: constructing a red zone and a black zone, and constructing an isolation unit between the red zone and the black zone; adopting a netfilter mechanism of a LINUX kernel to register a plurality of hook points in a message processing flow in the red zone, the black zone and the isolation unit, and to perform pass processing on the message, wherein the plurality of hook points comprise PRE_ROUTING, LOCAL_IN, FORWARD, LOCAL_OUT and POST_ROUTING; processing the message based on the constructed message processing flow, wherein the message processing flow comprises a sending direction and a receiving direction; the sending message processing flow of the sending direction comprises: adding control header and encapsulation information to the plaintext data sent by a user after the plaintext data is filtered by the red zone; sending the plaintext data with the added control header and encapsulation information to the isolation unit for encryption to obtain ciphertext; sending the ciphertext to the black zone, stripping information from the ciphertext to obtain ESP ciphertext, and sending the ESP ciphertext to an external network; the receiving message processing flow of the receiving direction comprises: adding control header information to the message received by the black zone from the external network after filtering the message; sending the message with the added control header information to the isolation unit for decryption to obtain plaintext; sending the plaintext to the red zone, filtering and stripping information from the plaintext to obtain original message, and sending the original message to a user; registering the netfilter mechanism to post-routing of a network card connected to the red zone and the isolation unit, and to pre-routing of an external network card connected to the black zone and the isolation unit, wherein if the network card is in a bridge mode, a netfilter of the bridge is registered, and if the network card is in a gateway mode, an IP-netfilter is registered; the sending message processing flow and the receiving message processing flow of the sending direction and the receiving direction, and a mode of encapsulating and decapsulating ESP messages in the sending message processing flow and the receiving message processing flow comprises a tunnel encryption and authentication encapsulation mode, a transmission encryption and authentication encapsulation mode, an authentication-only encapsulation mode and an encryption-only encapsulation mode.

2. The message processing method of claim 1, wherein, In the sending message processing flow, the steps performed by the red zone further comprise: determining whether the message is a negotiation message, and if yes, submitting the message to a protocol stack for processing; if no, extracting network layer information of the message, determining whether the message is a tcp or udp message, if yes, extracting five-tuple information, and if no, extracting three-tuple information; looking up a policy table according to the five-tuple information or the three-tuple information, processing the message according to a default policy if no policy is hit, and analyzing a sad table and a spd policy action if a policy is hit, and discarding the message, submitting the message to a CPU, transmitting the message transparently, and adding control header information according to the policy action.

3. The method of claim 1, wherein the method further comprises: In the sending message processing flow, the steps performed by the black zone further comprise: stripping information from the ciphertext received from the isolation unit; determining whether the message is a negotiation message, and if yes, submitting the message to a protocol stack for processing; if no, determining whether the message is in the encryption-only encapsulation mode, recalculating a four-layer checksum and sending the message to the external network if the message is in the encryption-only encapsulation mode, and directly sending the message to the external network if the message is not in the encryption-only encapsulation mode.

4. The message processing method of claim 1, wherein, The steps performed by the black area in the receiving packet processing procedure further include: determining whether the packet sent by the external network needs to be fragmented and reassembled, and if so, performing fragmentation and reassembly, and if not, not performing fragmentation and reassembly; determining whether the packet is a negotiation packet, and if so, handing it over to a negotiation unit for processing; if not, determining whether it is a tcp or udp packet, and if so, extracting five-tuple information, and if not, extracting three-tuple information; determining whether the five-tuple information or the three-tuple information hits an spd table, and if not, processing it according to a default policy action, and if so, analyzing the sad table of the receiving packet processing procedure and the policy action of the spd, and discarding, sending to the CPU, or transmitting the packet according to the policy action.

5. The message processing method of claim 1, wherein, The steps performed by the red area in the receiving packet processing procedure further include: performing information stripping on the plaintext, and replacing the destination MAC of the plaintext with the MAC address of the network card or bridge interconnected by the isolation unit; determining whether it is a tcp or udp packet, and if so, extracting five-tuple information, and if not, extracting three-tuple information; determining whether the five-tuple information or the three-tuple information hits an spd table, and if not, processing it according to a default policy action, and if so, analyzing the sad table of the receiving packet processing procedure and the policy action of the spd, and discarding, sending to the CPU, or transmitting the packet according to the policy action.

Images