Network communication dynamic encryption method, encryption and decryption system, equipment, medium and product

Abstract

The invention discloses a network communication dynamic encryption method, an encryption and decryption system, equipment, a medium and a product, and relates to the technical field of communication. The method comprises the steps that a dynamic factor is obtained through a Berkley packet filter function, a key is generated based on the dynamic factor, the key generated based on the dynamic factor has high randomness and unpredictability, and the problem that a fixed key is adopted in a traditional encryption mode, and consequently the key is prone to being cracked can be solved; moreover, by using the execution environment of the Berkley packet filter function in the kernel mode, the risk that the key is stolen in the transmission and storage process is reduced, the influence on the network communication performance is small, and the network communication encryption efficiency and the network communication security are improved. Moreover, the information of network communication is used as the basis of key generation, additional key distribution and storage management processes are not needed, complex key exchange and certificate management mechanisms are not needed, the key management process is simplified, and the operation and maintenance cost of the system is reduced.

Description

Technical Field

[0001] The present invention relates to the field of communication technologies, and particularly to a network communication dynamic encryption method, an encryption and decryption system, a device, a medium, and a product. Background Art

[0002] With the development of network communication technologies, the security of data transmission has become crucial. Related encryption communication methods (such as encryption schemes based on the SSL (Secure Sockets Layer) / TLS (Transport Layer Security) protocol and encryption schemes based on the IPSec (Internet Protocol Security) protocol) often adopt encryption algorithms and keys with long-term fixed or fixed rotation periods, which are easily analyzed and cracked by attackers. Moreover, complex key exchange and certificate management mechanisms are required, and the negotiation of keys incurs relatively high additional overheads. Especially in scenarios of high-frequency short connections and small data packet transmissions with relatively high requirements for network transmission speed, network latency will be caused. Summary of the Invention

[0003] In view of this, the purpose of the present invention is to provide a network communication dynamic encryption method, device, equipment, and storage medium, which can improve the encryption efficiency of network communication and the security of network communication, and reduce the operation and maintenance costs. The specific solutions are as follows: In a first aspect, the present application discloses a network communication dynamic encryption method, which is applied to a sending end and includes: Obtaining a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm; Using a Berkeley Packet Filter function pre-added to the kernel to intercept data to be sent, and obtaining a dynamic factor set according to the dynamic factor type; Based on the dynamic factor set and the key generation algorithm, dynamically generating a target key through the Berkeley Packet Filter function, and using the target key to encrypt the data to be sent to obtain encrypted data; Sending the encrypted data to a receiving end; the receiving end pre-receives the same key generation policy sent by the policy configuration server as the sending end, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0004] In another aspect, the present application discloses a network communication dynamic decryption method, which is applied to a receiving end and includes: Obtaining a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm; Intercept the encrypted data sent by the sender using the Berkeley Packet Filter function pre-added in the kernel, and obtain a set of dynamic factors according to the dynamic factor type; the sender pre-receives the same key generation policy sent by the policy configuration server as that of the receiver, so as to generate the same target key pair according to the key generation policy to encrypt the data to obtain the encrypted data; Based on the set of dynamic factors and the key generation algorithm, dynamically generate a target key through the Berkeley Packet Filter function, and use the target key to decrypt the encrypted data to obtain the decrypted data.

[0005] In another aspect, the present application discloses a network communication dynamic encryption and decryption system, including the aforementioned sender, policy configuration server, and receiver; The policy configuration server is used to send a key generation policy to the sender and the receiver; The sender encrypts the data to be sent using the Berkeley Packet Filter function and sends the encrypted data to the receiver; the receiver decrypts the encrypted data using the Berkeley Packet Filter function.

[0006] In another aspect, the present application discloses an electronic device, including: A memory for storing a computer program; A processor for executing the computer program to implement the aforementioned network communication dynamic encryption method or network communication dynamic decryption method.

[0007] In another aspect, the present application discloses a computer-readable storage medium for storing a computer program; wherein when the computer program is executed by a processor, it implements the aforementioned network communication dynamic encryption method or network communication dynamic decryption method.

[0008] In the present application, obtain the key generation policy sent by the policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm; intercept the data to be sent using the Berkeley Packet Filter function pre-added in the kernel, and obtain a set of dynamic factors according to the dynamic factor type; based on the set of dynamic factors and the key generation algorithm, dynamically generate a target key through the Berkeley Packet Filter function, and use the target key to encrypt the data to be sent to obtain encrypted data; send the encrypted data to the receiver; the receiver pre-receives the same key generation policy sent by the policy configuration server as that of the sender, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0009] The beneficial effects of the present invention are as follows: By obtaining dynamic factors through Berkeley Packet Filter functions, generating keys based on the dynamic factors, the generated keys have a high degree of randomness and unpredictability, which can avoid the problem that the keys are easily cracked due to the use of fixed keys in traditional encryption methods; moreover, by utilizing the execution environment of the Berkeley Packet Filter function in the kernel state, the risk of the keys being stolen during transmission and storage is reduced, and the impact on network communication performance is relatively small, improving the encryption efficiency and security of network communication. In addition, the key generation policy is uniformly sent by the policy configuration server, using the information of the network communication itself as the basis for key generation, without the need for additional key distribution and storage management processes, and without complex key exchange and certificate management mechanisms, simplifying the key management process and reducing the system operation and maintenance costs. BRIEF DESCRIPTION OF THE DRAWINGS

[0010] In order to more clearly illustrate the technical solutions in the embodiments of the present invention or related technologies, the following will briefly introduce the drawings required for use in the description of the embodiments or related technologies. Obviously, the drawings described below are only the embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can also be obtained based on the provided drawings. Figure 1 It is a flowchart of a network communication dynamic encryption method provided by the present application; Figure 2 It is a schematic diagram of the Berkeley Packet Filter function mounting provided by the present application; Figure 3 It is a flowchart of a network communication dynamic decryption method provided by the present application; Figure 4 It is a schematic diagram of the structure of a specific network communication dynamic encryption and decryption system provided by the present application; Figure 5 It is a flowchart of a specific network communication dynamic encryption and decryption method provided by the present application. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0011] The following will clearly and completely describe the technical solutions in the embodiments of the present application with reference to the drawings in the embodiments of the present application. Obviously, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments of the present application, all other embodiments obtained by those of ordinary skill in the art without creative efforts belong to the protection scope of the present application.

[0012] It should be noted that in the description of this application, the terms "including", "comprising" or any other variant thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements not only includes those elements but also includes other elements not expressly listed, or also includes elements inherent to such process, method, article or device. The terms "first", "second", etc. in this application are used to distinguish similar objects and not to describe a specific order or sequence.

[0013] To enable those skilled in the art of this technology to better understand the solution of this application, the following further detailed description of this application will be given in conjunction with the accompanying drawings and specific embodiments.

[0014] In combination with the specific application environment architecture or specific hardware architecture on which the execution of the network communication dynamic encryption method depends, the specific application environment architecture or specific hardware architecture will be described herein.

[0015] In the related art, in the SSL / TLS protocol solution, key generation depends on complex key exchange protocols and certificate management mechanisms, such as the public key distribution and certificate verification processes, which not only increase the system overhead but also make key management complex, prone to problems such as key leakage and difficult management, and frequent handshake negotiations in high-frequency short connection scenarios introduce additional overhead; secondly, the encryption algorithm is relatively fixed. Once the encryption algorithm is negotiated and determined, it is difficult to dynamically adjust the encryption algorithm and key according to actual requirements during the communication process, and it cannot flexibly adapt to different security levels and performance requirements. Based on the IPSec protocol encryption solution, key updates depend on protocol period negotiation, and attackers may deduce the encryption mode through long-term traffic analysis.

[0016] An embodiment of this application discloses a network communication dynamic encryption method, which is applied to the sending end. See Figure 1 As shown, the method may include the following steps: Step S11: Obtain the key generation policy sent by the policy configuration server; the key generation policy includes the dynamic factor type and the key generation algorithm.

[0017] The sending end obtains the key generation policy issued by the policy configuration server. Among them, the key generation policy includes the dynamic factor type and the key generation algorithm; the dynamic factor type contains specific parameter types. For example, the dynamic factor type includes the five-tuple and the timestamp. The sending end will subsequently extract information such as the five-tuple and the timestamp according to the dynamic factor type. The key generation algorithm is used to generate keys and includes, but is not limited to, multi-factor hashing, hierarchical hashing, chaotic mapping (such as Logistic chaotic mapping), time window dynamic keys and other algorithms. This embodiment does not limit the key generation algorithm, and any algorithm that can implement key generation is acceptable.

[0018] Among them, the above-mentioned key generation policy acquisition includes: obtaining the key generation policy through a user-space program; saving the key generation policy to the shared storage space of the kernel's packet filter function; the shared storage space supports sharing between the kernel space and the user space. The user space runs in a restricted environment and requests kernel services through system calls to implement user applications; the kernel space runs in the operating system kernel space and has full access rights to implement the core functions of the system. The sender first obtains the key generation policy sent by the policy configuration server through a user-space program, and then saves the key generation policy to the kernel, specifically, it can be saved in the shared storage space (eBPF Map) of the packet filter function; this shared storage space supports sharing between the kernel space and the user space. It can be understood that since subsequent key generation and data encryption are both executed by the packet filter function in the kernel space, the key generation policy needs to be given to the kernel.

[0019] Among them, the above-mentioned dynamic factor types can further include but are not limited to network layer factors, system layer factors, and hardware layer factors. That is, multi-dimensional dynamic factor fusion, combining factors of each layer, for example: network layer factors: source / destination IP (Internet Protocol) and port, protocol type (TCP (Transmission Control Protocol) / UDP (User Datagram Protocol)), etc.; system layer factors: process PID (Process ID), thread CPU (Central Processing Unit) affinity, memory address characteristics, etc.; hardware layer factors: CPU serial number, etc. Through the multi-factor fusion mechanism, the key generation has the ability of environment perception, and the same communication flow will generate completely different keys in different physical devices or operating environments.

[0020] Step S12: Use the Berkeley packet filter function pre-added in the kernel to intercept the data to be sent, and obtain the dynamic factor set according to the dynamic factor type.

[0021] The Berkeley Packet Filter (eBPF, Extended Berkeley Packet Filter) function is pre-added to the kernel of the sender. eBPF is a powerful kernel technology that allows programs to run in the kernel space, enabling efficient monitoring of networks, storage, system calls, etc. Through eBPF, developers can dynamically load and execute programs into the Linux kernel without modifying the kernel source code. eBPF provides a security guarantee to ensure that the loaded code cannot disrupt the system's stability. This is achieved through the kernel's "validator", which checks the security of the code before program execution. Therefore, eBPF operations are widely used in fields such as performance monitoring, network analysis, and security protection. Specifically, an eBPF program can be written in advance using the eBPF toolchain, defining an eBPF function that is used to connect data, obtain dynamic factors, generate keys, and encrypt the data before network packets are sent.

[0022] The Berkeley Packet Filter function is used to intercept the data to be sent. When the data is intercepted, the set of dynamic factors is obtained according to the type of dynamic factor. It can be understood that these obtained dynamic factors change over time or with the change of the terminal. Therefore, these dynamics are not fixed, and the generated key is only used for this communication. Even if the key is leaked, it will not pose a threat to other communications. For example, the set of dynamic factors can include any one or more of network quintuples, process information (such as process context), timestamps, and hardware identifiers (such as hardware fingerprints). Moreover, these dynamic factors are obtained in the kernel state and are related to network communication, that is, the information of network communication itself is used as the basis for key generation, without the need for additional key distribution and storage management processes.

[0023] For example, for the extraction of network quintuples, quintuple information such as source IP address, destination IP address, source port, destination port, and protocol type is extracted from network data packets and used as one of the dynamic factors for key generation. This information is inherent in network communication, easy to obtain, and unique. For the acquisition of process information, information such as the PID and thread ID (Identity document) of the current process is obtained through eBPF helper functions (such as bpf_get_current_pid_tgid) and used as another dynamic factor for key generation, increasing the complexity and unpredictability of the key. The current timestamp is obtained and incorporated into the key generation process. The timestamp is a constantly changing value that can strongly support the dynamics of the key. Hardware identifiers can read hardware identifier information such as the unique identifier of the CPU and the MAC (Media Access Control Address) address. This information has a high degree of uniqueness and stability, which can further enhance the security of the key.

[0024] In this embodiment, before obtaining the key generation policy, it further includes: mounting the Berkeley Packet Filter function to the sending-end kernel, for example, mounting the Berkeley Packet Filter function to the system call entry in the kernel for network data packet sending. Specifically, the Berkeley Packet Filter function and the mount point can be sent to the engine in the sending-end user space, and the engine automatically performs the function mounting operation.

[0025] Step S13: Based on the dynamic factor set and the key generation algorithm, dynamically generate a target key through the Berkeley Packet Filter function, and use the target key to encrypt the data to be sent to obtain encrypted data.

[0026] After obtaining the dynamic factor set, a target key that conforms to the current communication is generated in combination with the key generation algorithm. After the key is generated, the Berkeley Packet Filter function encrypts the data to be sent using the key to obtain encrypted data, and then sends the encrypted data to the receiving end.

[0027] The following is an example: for the hierarchical hash key generation algorithm based on timestamps and hardware characteristics, in order to increase the dynamic nature of the key, network quintuples, timestamps, and hardware characteristic codes are used as input factors to generate keys using the hierarchical hash method. For example, the sending end obtains network quintuple information from the struct sk_buff structure (socket data buffer), splices the quintuple information and then performs a hash operation to produce hash value A. It splices the hardware characteristic code and the timestamp and then performs a hash operation to generate hash value B. It performs an exclusive OR operation on hash values A and B to generate a final key that changes over time. In this way, even if the network quintuples and process information of the two communication parties remain unchanged in a short period, the key will be continuously updated due to the change of the timestamp, improving the security of the key. That is, the dynamic factor set is obtained: def generate_key(five_tuple,pid,timestamp,hw_id); in the first layer, network quintuple hash: layer1_hash=sha256(five_tuple); in the second layer, hardware identifier + timestamp hash: layer2_hash=sha256(hw_id+currentTime); for the final key, double hash exclusive OR: returnbytes(layer1_hash^layer2_hash).

[0028] The key generation algorithm can be based on the combination and transformation of dynamic factors. The obtained dynamic factors are combined, hashed, exclusive ORed, etc. to generate an initial key. Chaotic mapping algorithms such as the Logistic mapping can use dynamic factors as initial conditions or control parameters to generate a key sequence with chaotic characteristics. Chaotic mapping has characteristics such as sensitivity to initial values, good randomness, and strong ergodicity, which can improve the security and complexity of the key.

[0029] Step S14: Send the encrypted data to the receiving end; the receiving end pre-receives the same key generation policy sent by the policy configuration server as that of the sending end, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0030] When the policy configuration server sends the key generation policy to the sending end, it will also send the key generation policy to the receiving end. That is to say, the sending end and the receiving end have the same type of dynamic factors and key generation algorithm, so that the receiving end can generate the above target key for decryption.

[0031] In the specific implementation, after obtaining the dynamic factor set according to the dynamic factor type, the following steps are further included: grouping the dynamic factors in the dynamic factor set, and classifying the dynamic factors into general parameters and specific parameters; the general parameters are the parameters that are the same at the sending end and the receiving end, and the specific parameters are the parameters that are different at the sending end and the receiving end; adding an identifier to the specific parameters, and saving the dynamic factor set to the shared storage space of the packet filter function. Among them, sending the encrypted data to the receiving end includes: sending the specific parameters in the dynamic factor set and the encrypted data to the receiving end; the specific parameters are the parameters that are different at the sending end and the receiving end.

[0032] It can be understood that some dynamic factors are the same at the sending end and the receiving end. For example, the five-tuple information, the five-tuple information collected by the sending end is the same as the five-tuple information collected by the receiving end, and such factors belong to general parameters. While the ones obtained by the sending end and the receiving end are different, such as the timestamp information, and such factors are special parameters. If the dynamic factor contains such special parameters, these characteristic parameters need to be sent to the receiving end as well, so that the receiving end can generate the above-mentioned target key.

[0033] In this application, the eBPF program directly implements key generation and encryption / decryption operations at the bottom layer of the operating system kernel protocol stack, bypassing the performance bottleneck of traditional user-space encryption libraries. This design shortens the key life cycle and automatically rotates the keys. Even if the key is cracked, it cannot be used for subsequent data decryption, realizing forward security. Compared with the traditional TLS protocol that relies on the static trust model of a fixed certificate chain, this solution generates keys through real-time dynamic factor combinations, solving the long-term security risks caused by fixed keys. Moreover, the sending and receiving parties can generate the same key based on the preset key generation strategy, without the need for TLS-style handshake negotiation, reducing the connection establishment delay to 0.

[0034] The network communication dynamic encryption method disclosed in this application has the following advantages: 1. High dynamicity. It can dynamically generate keys according to the specific conditions of each network communication (such as network five-tuple, process information, etc.), avoiding the problem that the fixed keys in traditional encryption methods are easily cracked. 2. Improve communication security. The dynamically generated keys have high randomness and unpredictability. Combined with the execution environment of eBPF in the kernel state, the risk of the keys being stolen during transmission and storage is reduced. Moreover, due to the dynamic changes of the encryption algorithm and keys, it is difficult for attackers to conduct long-term attacks on specific encryption algorithms or keys, effectively improving the security of network communication. 3. Reduce the complexity of key management. Compared with the complex key exchange and certificate management mechanisms in traditional encryption technologies, using the information of network communication itself as the basis for key generation, there is no need for additional key distribution and storage management processes, simplifying the key management process and reducing the system operation and maintenance costs. 4. High efficiency. The eBPF technology directly processes network data packets in the kernel state, avoiding frequent data copying and context switching between the user state and the kernel state, improving the efficiency of encryption and decryption, having little impact on network communication performance, and being able to meet the real-time communication requirements in high-speed network environments.

[0035] As can be seen from the above, in this embodiment, a key generation policy sent by a policy configuration server is obtained; the key generation policy includes a dynamic factor type and a key generation algorithm; the Berkeley Packet Filter function pre-added in the kernel is used to intercept the data to be sent, and a set of dynamic factors is obtained according to the dynamic factor type; based on the set of dynamic factors and the key generation algorithm, a target key is dynamically generated through the Berkeley Packet Filter function, and the data to be sent is encrypted with the target key to obtain encrypted data; the encrypted data is sent to the receiving end; the receiving end pre-receives the same key generation policy sent by the policy configuration server as the sending end, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0036] It can be seen that dynamic factors are obtained through the Berkeley Packet Filter function, and keys are generated based on the dynamic factors. Generating keys based on dynamic factors has high randomness and unpredictability, which can avoid the problem that keys are easily cracked due to the use of fixed keys in traditional encryption methods; moreover, using the execution environment of the Berkeley Packet Filter function in the kernel state reduces the risk of the keys being stolen during transmission and storage, and has little impact on network communication performance, improving the encryption efficiency and the security of network communication. And, the key generation policy is uniformly sent by the policy configuration server, using the information of network communication itself as the basis for key generation, without the need for additional key distribution and storage management processes, without complex key exchange and certificate management mechanisms, simplifying the key management process and reducing the system operation and maintenance costs.

[0037] In some embodiments, the sending end obtains a new key generation policy sent by the policy configuration server, so as to generate a new target key by using the new key generation policy. The above new key generation policy may include a new dynamic factor type and / or a new key generation algorithm. The new dynamic factor type may be configured by an administrator. It should be noted that a change in the dynamic factor type may require adjustment of the mounting point of the Berkeley Packet Filter function. The above new key generation algorithm may be reselected by the policy configuration server from all existing key generation algorithms, or may be newly added by the administrator.

[0038] In some embodiments, the sending end obtains a new key generation algorithm sent by the policy configuration server. The new key generation algorithm is screened by the policy configuration server from a variety of key generation algorithms prestored in the policy configuration server according to the system type of the current transmission system and / or the security level requirement of this communication; the current transmission system is the system composed of the sending end and the receiving end. It can be understood that the key generation algorithm is screened by the policy configuration server from a variety of key generation algorithms prestored in the policy configuration server according to the system type of the current transmission system and / or the security level requirement of this communication; the current transmission system is the system composed of the sending end and the receiving end. The system type includes file transfer systems, video transfer systems, etc. In the related art, in an encryption scheme based on the IPSec protocol, for example, the encryption rules rely on manual predefined and cannot adjust the algorithm according to real-time dynamics. In this application, according to the different security level requirements of different system types, for example, the security level of the file transfer system is different from that of the video transfer system. The security levels required for the communication of different data are also different. Specifically, the security level can be determined according to traffic characteristics (such as protocol type, payload length). For example, short control messages are automatically switched to lightweight key generation algorithms (such as ChaCha20), thereby avoiding waste of computing resources. Therefore, by dynamically adjusting the key generation algorithm according to the communication data type and security requirements, refined management and flexible customization of the encryption policy are realized, adapting to various complex network communication scenarios. Thus, in the key generation process, through dynamic factors, attention is paid to ensuring the randomness and security of the key, avoiding predictable patterns or repeated keys; by reasonably selecting the key generation algorithm, the security of network communication is further guaranteed.

[0039] In some embodiments, before obtaining the key generation policy, it further includes: mounting the Berkeley Packet Filter function to the mounting point corresponding to the first target layer in the seven-layer network structure of the sending-end kernel; using the Berkeley Packet Filter function pre-added in the kernel to intercept the data to be sent, including: when the data to be sent passes through the mounting point, intercepting the data to be sent through the Berkeley Packet Filter function, and obtaining a dynamic factor set according to the dynamic factor type by using the Berkeley Packet Filter function. For example Figure 2 As shown, the levels of the seven-layer network structure from low to high are: Physical Layer, Data Link Layer, Network Layer, Transport Layer, Session Layer, Presentation Layer, and Application Layer. In the related art, IPsec only acts on the IP layer and cannot perceive the application layer protocol (such as the HTTP header), resulting in the disconnection between the encryption policy and the business logic; for example, it is impossible to implement high-intensity encryption for sensitive paths (such as / api / payment) in the REST API (Application Programming Interface in the REST architecture). However, in this application, by mounting the function on the network layer, application layer, etc., more dynamic factors can be obtained to achieve high-intensity encryption.

[0040] Among them, the target layer is determined according to the network communication encryption strength requirement and the network communication performance requirement; among them, the higher the network communication encryption strength requirement, the higher the level of the first target layer, and the higher the network communication performance requirement, the lower the level of the first target layer. It can be understood that the higher the level, the more data information it contains, and the richer the dynamic factors obtained. And the lower the level, the smaller the impact on the system performance for encryption and transmission at the lower level, and the higher the efficiency. Therefore, the policy configuration server can flexibly adjust the mounting point of the function according to the actual application situation. Specifically, when the first target layer is the application layer, the mounting point can be the system call entry for packet sending (sock_sendmsg / sock_recvmsg); when the first target layer is the network layer, the mounting point can be the network stack protocol entry / exit (ingress / egress); when the first target layer is the data link layer, the mounting point can be the network card driver receive function (netif_receive_skb). Of course, it can also be mounted on the Socket layer, TC (Traffic Control) module, XDP (eXpress Data Path Module) module, dynamic debugging tool kprobe, security framework LSM, etc. to capture network packets and perform encryption and decryption processing. Different mounting points are applicable to different application scenarios and performance requirements.

[0041] An embodiment of the present application discloses a network communication dynamic decryption method, which is applied to a receiving end. Refer to Figure 3 as shown, the method may include the following steps: Step S21: Obtain a key generation policy sent by a policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm.

[0042] Before obtaining the key generation policy, it further includes: mounting a Berkeley Packet Filter function to a second target layer in the seven-layer network structure of the receiving end kernel; the Berkeley Packet Filter function is mounted on a first target layer in the seven-layer network structure of the sending end kernel; the level of the first target layer is greater than or equal to the level of the second target layer, that is, in order to ensure that the receiving end can obtain the dynamic factors that need to be used, it is necessary to satisfy that the level of the first target layer is greater than or equal to the level of the second target layer.

[0043] A specific receiving - end mounting process includes: writing a corresponding eBPF program, defining an eBPF function for data decryption; determining the system - call entry for receiving network packets, such as the sock_recvmsg function; and mounting it on the sock_recvmsg system call; when the receiving end receives a network packet and calls the sock_recvmsg function, the eBPF function is triggered. The function first extracts the network five - tuple and process information from the packet, then generates a key according to the same key - generation algorithm as the sending end, decrypts the encrypted data according to the known encryption algorithm, and continues the subsequent receiving - processing flow after restoring the original data.

[0044] Step S22: Use the Berkeley Packet Filter function pre - added in the kernel to intercept the encrypted data sent by the sending end, and obtain the dynamic - factor set according to the dynamic - factor type; the sending end pre - receives the same key - generation policy sent by the policy - configuration server as that of the receiving end, so as to encrypt the data with the same target key according to the key - generation policy to obtain the encrypted data.

[0045] Step S23: Based on the dynamic - factor set and the key - generation algorithm, dynamically generate a target key through the Berkeley Packet Filter function, and use the target key to decrypt the encrypted data to obtain the decrypted data. Among them, the specific process of the above - mentioned method can refer to the corresponding content disclosed in the foregoing embodiments, and will not be elaborated here.

[0046] As can be seen from the above, by using the Berkeley Packet Filter function to obtain dynamic factors and generating keys based on dynamic factors, generating keys based on dynamic factors has high randomness and unpredictability, which can avoid the problem that the key is easily cracked due to the use of a fixed key in traditional encryption methods; moreover, by using the execution environment of the Berkeley Packet Filter function in the kernel state, the risk of the key being stolen during transmission and storage is reduced, and the impact on network - communication performance is small, improving the encryption efficiency and the security of network communication. In addition, using the information of network communication itself as the basis for key generation eliminates the need for additional key - distribution and storage - management processes, as well as complex key - exchange and certificate - management mechanisms, simplifies the key - management process, and reduces the system operation - and - maintenance cost.

[0047] Correspondingly, an embodiment of the present application also discloses a network - communication dynamic encryption - and - decryption system, including the above - mentioned sending end, policy - configuration server, and receiving end; wherein, the policy - configuration server is used to send the key - generation policy to the sending end and the receiving end; the sending end uses the Berkeley Packet Filter function to encrypt the data to be sent and sends the encrypted data to the receiving end; the receiving end uses the Berkeley Packet Filter function to decrypt the encrypted data.

[0048] For example Figure 4 Shown is a schematic diagram of a specific network communication dynamic encryption and decryption system structure, including a policy configuration server, a client (sender), and a server (receiver). Both the client and the server include a policy generation engine. The client includes an eBPF encryption module (client), and the server includes an eBPF decryption module. Among them, the policy configuration server configures the key generation policy by specifying the dynamic factor types (source address, source port, destination address, destination port, protocol, timestamp, random number, process name, process ID, CPU ID, etc.) and the key generation method (multi-factor hash, hierarchical hash, Logistic chaotic mapping, time window dynamic key, etc.). The configured policy is sent to the policy generation engines of the client and the server.

[0049] The policy generation engine (client) is responsible for mounting the eBPF function encrypted by the client to the system call entry of data sending as needed (such as the sock_sendmsg function). The function that implements the eBPF function in the kernel code is responsible for loading, verifying, and executing the eBPF program, and receiving parameters such as the dynamic factor type and the key generation method sent by the policy configuration server, making a preliminary identification of the dynamic factors, such as obtaining the hardware signature, and marking the specific factors to be sent to the server (such as: hardware signature, timestamp, process information, etc.), and then pushing the parameters into the eBPF function in the kernel state, and saving the parameter information to the eBPFMap. The policy generation engine (server) is responsible for mounting the eBPF function decrypted by the server to the system call entry of data reception (such as the sock_recvmsg function), and receiving parameters such as the dynamic factor type and the key generation method sent by the policy configuration server, and then pushing the parameters into the eBPF function in the kernel state, and saving the parameter information to the eBPFMap.

[0050] The eBPF encryption module (client) is used to generate a key according to the pre-set dynamic factors and the key generation method when receiving data, encrypt the data, and then form a data packet with the encrypted data and the dynamic factors to be sent to the server for sending. The eBPF decryption module (server) is used to generate a key according to the pre-set dynamic factors, the dynamic factors sent by the client, and the key generation method when receiving data, and decrypt the data sent by the client.

[0051] It can be seen that by using the eBPF technology, eBPF functions are mounted on the send and receive system calls of network communication to dynamically generate keys according to network five-tuples, process information, timestamps, hardware identifiers, etc., and dynamically match encryption algorithms. Since the encryption key changes dynamically and has a short validity period, even if the encrypted transmitted data is intercepted and cracked, the encryption keys for different five-tuples and different times are different, and the cracked key cannot be used to decrypt the subsequent transmitted data, effectively overcoming the disadvantages of fixed encryption methods, complex key generation and management, and inability to dynamically adjust according to communication scenarios in the existing related technologies, and improving the security and flexibility of network communication.

[0052] For example Figure 5 As shown, the administrator defines the dynamic factor type and multiple key generation algorithms through the policy configuration server. The policy configuration server issues the key generation policy to the client policy generation engine and the server-side policy generation engine for the current communication. The key generation policy includes the dynamic factor type and a key generation algorithm. The client policy generation engine will save the key generation policy to the shared storage space (eBPFMap) of the packet filter function in the kernel, and the server side does the same. The client kernel intercepts the data to be transmitted, generates a key, encrypts the data, and then sends it to the server. The server kernel decrypts the data after generating the key to complete this communication.

[0053] By designing a dynamic encryption and decryption network communication based on eBPF, eBPF functions are mounted on the send and receive sides of network communication. The eBPF functions support multiple key generation methods. The policy engine system pushes and tells the eBPF functions on the send side and the receive side which key generation method to use. The eBPF functions generate keys based on the generation method and the parameters obtained in real time as dynamic factors, improving the encryption efficiency of network communication and the security of network communication, and reducing the system operation and maintenance cost.

[0054] Correspondingly, an embodiment of the present application also discloses a network communication dynamic encryption device, which is applied to the sending end. The device includes: A policy acquisition module, configured to acquire the key generation policy sent by the policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm; A dynamic factor acquisition module, configured to use the Berkeley packet filter function pre-added in the kernel to intercept the data to be sent, and obtain a dynamic factor set according to the dynamic factor type; A key generation module, configured to dynamically generate a target key based on the dynamic factor set and the key generation algorithm through the Berkeley packet filter function, and encrypt the data to be sent with the target key to obtain encrypted data; An encrypted data module for sending the encrypted data to a receiving end; the receiving end pre-receives the same key generation policy sent by the policy configuration server as that of the sending end, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

[0055] In this embodiment, the key generation policy sent by the policy configuration server is obtained; the key generation policy includes a dynamic factor type and a key generation algorithm; the Berkeley Packet Filter function pre-added in the kernel is used to intercept the data to be sent, and the dynamic factor set is obtained according to the dynamic factor type; based on the dynamic factor set and the key generation algorithm, the target key is dynamically generated through the Berkeley Packet Filter function, and the data to be sent is encrypted with the target key to obtain encrypted data; the encrypted data is sent to the receiving end; the receiving end pre-receives the same key generation policy sent by the policy configuration server as that of the sending end, so as to generate the same target key according to the key generation policy to decrypt the encrypted data. It can be seen that by using the Berkeley Packet Filter function to obtain dynamic factors and generating keys based on the dynamic factors, the generated keys have a high degree of randomness and unpredictability, which can avoid the problem that the keys are easily cracked in traditional encryption methods using fixed keys; moreover, by using the execution environment of the Berkeley Packet Filter function in the kernel state, the risk of the key being stolen during transmission and storage is reduced, and the impact on network communication performance is small, improving the encryption efficiency and the security of network communication. In addition, using the information of the network communication itself as the basis for key generation eliminates the need for additional key distribution and storage management processes, as well as complex key exchange and certificate management mechanisms, simplifies the key management process, and reduces the system operation and maintenance costs.

[0056] Correspondingly, an embodiment of the present application also discloses a network communication dynamic encryption device applied to a receiving end, and the device includes: A policy acquisition module for obtaining the key generation policy sent by the policy configuration server; the key generation policy includes a dynamic factor type and a key generation algorithm; A dynamic factor acquisition module for using the Berkeley Packet Filter function pre-added in the kernel to intercept the encrypted data sent by the sending end, and obtaining the dynamic factor set according to the dynamic factor type; the sending end pre-receives the same key generation policy sent by the policy configuration server as that of the receiving end, so as to generate the same target key according to the key generation policy to encrypt the data to obtain the encrypted data; A decryption module for dynamically generating a target key through the Berkeley Packet Filter function based on the dynamic factor set and the key generation algorithm, and decrypting the encrypted data with the target key to obtain decrypted data.

[0057] In this embodiment, a key generation policy sent by a policy configuration server is obtained. The key generation policy includes a dynamic factor type and a key generation algorithm. The Berkeley Packet Filter (BPF) function pre-added to the kernel is used to intercept the encrypted data sent by the sender, and a set of dynamic factors is obtained according to the dynamic factor type. The sender pre-receives the same key generation policy sent by the policy configuration server as that of the receiver, so as to generate the same target key pair to encrypt the data into the encrypted data according to the key generation policy. Based on the set of dynamic factors and the key generation algorithm, a target key is dynamically generated through the BPF function, and the encrypted data is decrypted with the target key to obtain the decrypted data. It can be seen that by using the BPF function to obtain dynamic factors and generating keys based on the dynamic factors, the generated keys have high randomness and unpredictability, which can avoid the problem that the keys are easily cracked due to the use of fixed keys in traditional encryption methods. Moreover, by using the execution environment of the BPF function in the kernel state, the risk of the key being stolen during transmission and storage is reduced, and the impact on network communication performance is small, improving the encryption efficiency and the security of network communication. In addition, using the information of the network communication itself as the basis for key generation eliminates the need for additional key distribution and storage management processes, as well as complex key exchange and certificate management mechanisms, simplifies the key management process, and reduces the system operation and maintenance costs.

[0058] Through the description of the above embodiments, those skilled in the art can clearly understand that the method according to the above embodiments can be implemented by means of software plus a necessary general hardware platform. Of course, it can also be implemented by hardware, but in many cases, the former is a better implementation method.

[0059] An embodiment of the present application further provides an electronic device, including a memory and a processor. A computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any of the above embodiments of the network communication dynamic encryption method or the network communication dynamic decryption method.

[0060] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps in any of the above embodiments of the network communication dynamic encryption method or the network communication dynamic decryption method when running.

[0061] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to: various media such as USB flash drives, read-only memory (ROM), random access memory (RAM), external hard drives, magnetic disks, or optical discs that can store computer programs.

[0062] An embodiment of the present application also provides a computer program product. The computer program product includes a computer program, and when the computer program is executed by a processor, it implements the steps in any of the above network communication dynamic encryption methods or network communication dynamic decryption method embodiments.

[0063] Another embodiment of the present application also provides a computer program product, including a non-volatile computer-readable storage medium. The non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, it implements the steps in any of the above network communication dynamic encryption methods or network communication dynamic decryption method embodiments.

[0064] Those skilled in the art can further realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. To clearly illustrate the interchangeability of hardware and software, the components and steps of each example have been generally described according to their functions in the above description. Whether these functions are executed in a hardware or software manner depends on the specific application and design constraints of the technical solution. Skilled professionals can use different methods to implement the described functions for each specific application, but such implementation should not be considered to exceed the scope of this application.

[0065] The above has provided a detailed introduction to a network communication dynamic encryption method and a network communication dynamic decryption method provided by this application. Specific examples are used herein to elaborate on the principles and implementation manners of this application. The description of the above embodiments is only used to help understand the method and its core idea of this application. It should be noted that for those of ordinary skill in the art in this technical field, without departing from the principle of this application, several improvements and modifications can be made to this application, and these improvements and modifications also fall within the protection scope of this application.

Claims

1. A dynamic encryption method for network communication, characterized in that Applied to the sender, including: Obtain the key generation policy sent by the policy configuration server; the key generation policy includes the dynamic factor type and the key generation algorithm; Use the Berkeley Packet Filter function pre-added in the kernel to intercept the data to be sent, and obtain the dynamic factor set according to the dynamic factor type; Based on the dynamic factor set and the key generation algorithm, dynamically generate the target key through the Berkeley Packet Filter function, and use the target key to encrypt the data to be sent to obtain the encrypted data; Send the encrypted data to the receiver; the receiver pre-receives the same key generation policy sent by the policy configuration server as the sender, so as to generate the same target key according to the key generation policy to decrypt the encrypted data.

2. The network communication dynamic encryption method according to claim 1, characterized in that Before obtaining the key generation policy, it further includes: Mount the Berkeley Packet Filter function to the mount point corresponding to the first target layer in the seven-layer network structure of the sender kernel; Using the Berkeley Packet Filter function pre-added in the kernel to intercept the data to be sent, including: When the data to be sent passes through the mount point, intercept the data to be sent through the Berkeley Packet Filter function, and obtain the dynamic factor set according to the dynamic factor type by using the Berkeley Packet Filter function.

3. The network communication dynamic encryption method according to claim 2, characterized in that, The first target layer is determined according to the network communication encryption strength requirement and the network communication performance requirement; among them, the higher the network communication encryption strength requirement, the higher the level of the first target layer, and the higher the network communication performance requirement, the lower the level of the first target layer.

4. The network communication dynamic encryption method according to claim 2, wherein When the first target layer is the application layer, the mount point is the system call entry for packet sending; When the first target layer is the network layer, the mount point is the network stack protocol entry / exit; When the first target layer is the data link layer, the mount point is the network card driver receive function.

5. The network communication dynamic encryption method according to claim 1, wherein The dynamic factor type includes network layer factors, system layer factors, and / or hardware layer factors.

6. The network communication dynamic encryption method according to claim 1, characterized in that Obtaining the key generation policy includes: Obtain the key generation policy through the user-mode program; Save the key generation policy to the shared storage space of the packet filter function in the kernel; the shared storage space supports sharing between the kernel mode and the user mode.

7. The network communication dynamic encryption method according to claim 1, characterized in that, Sending the encrypted data to the receiver includes: Send the specific parameters in the dynamic factor set and the encrypted data to the receiver; the specific parameters are parameters that are different between the sender and the receiver.

8. The network communication dynamic encryption method according to claim 7, characterized in that After obtaining the dynamic factor set according to the dynamic factor type, it further includes: Group the dynamic factors in the dynamic factor set, and divide the dynamic factors into general parameters and specific parameters; the general parameters are parameters that are the same between the sender and the receiver, and the specific parameters are parameters that are different between the sender and the receiver; Add an identifier to the specific parameters, and save the dynamic factor set to the shared storage space of the packet filter function.

9. The network communication dynamic encryption method according to any one of claims 1 to 8, characterized in that, It further includes: Obtain the new key generation policy sent by the policy configuration server, so as to generate a new target key by using the new key generation policy.

10. A dynamic decryption method for network communication, characterized in that, Applied to the receiver, including: Obtain the key generation policy sent by the policy configuration server; the key generation policy includes the dynamic factor type and the key generation algorithm; Use the Berkeley Packet Filter function pre-added in the kernel to intercept the encrypted data sent by the sender, and obtain the dynamic factor set according to the dynamic factor type; the sender pre-receives the same key generation policy sent by the policy configuration server as the receiver, so as to generate the same target key pair to encrypt the data to obtain the encrypted data; Based on the dynamic factor set and the key generation algorithm, dynamically generate the target key through the Berkeley Packet Filter function, and use the target key to decrypt the encrypted data to obtain the decrypted data.

11. The network communication dynamic decryption method according to claim 10, characterized in that, Before obtaining the key generation policy, it further includes: Mount the Berkeley Packet Filter function to the second target layer in the seven-layer network structure of the receiver kernel; The Berkeley Packet Filter function is mounted on the first target layer in the seven-layer network structure of the sender's kernel; the first target layer and the second target layer are the same layer.

12. A network communication dynamic encryption and decryption system, characterized in that, It includes the sender, the policy configuration server as described in any one of claims 1 to 9, and the receiver as described in claim 10 or 11; The policy configuration server is used to send the key generation policy to the sender and the receiver; The sender uses the Berkeley Packet Filter function to encrypt the data to be sent and sends the encrypted data to the receiver; the receiver uses the Berkeley Packet Filter function to decrypt the encrypted data.

13. An electronic device, characterized in that, It includes: A memory for storing a computer program; A processor for executing the computer program to implement the network communication dynamic encryption method as described in any one of claims 1 to 9, or the network communication dynamic decryption method as described in claim 10 or 11.

14. A computer-readable storage medium, characterized in that, For storing a computer program; wherein when the computer program is executed by the processor, it implements the network communication dynamic encryption method as described in any one of claims 1 to 9, or the network communication dynamic decryption method as described in claim 10 or 11.

15. A computer program product, characterized in that, It includes a computer program, which when executed by the processor, implements the network communication dynamic encryption method as described in any one of claims 1 to 9, or the network communication dynamic decryption method as described in claim 10 or 11.

Images