A DPD and kernel state detection-based national secret IPSec data link checking method

Abstract

This invention relates to the field of computer network security technology, specifically disclosing a national standard IPSec data link inspection method based on DPD and kernel state detection. The method includes: IPSec nodes periodically acquiring peer data link information via the extended DPD message protocol, comparing it with local data link information to determine if the user-mode data links of the two nodes are consistent; each IPSec node's user-mode program periodically acquiring kernel-mode data link information, comparing it with user-mode data link information to determine if the user-mode and kernel-mode data links are consistent; if the user-mode data links of the two nodes are consistent, and the user-mode and kernel-mode data links of each node are consistent, then the kernel-mode data links of the two nodes are determined to be consistent. This invention employs the above-mentioned national standard IPSec data link inspection method based on DPD and kernel state detection, requiring no manual intervention, and can automatically detect abnormal data links in a timely manner, achieving automatic data link recovery, thereby enhancing the robustness of the IPSec system.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and in particular to a Chinese national cryptographic IPSec data link inspection method based on DPD and kernel state detection. Background Technology

[0002] The Chinese national cryptographic standard IPSec (GM / T 0022-2023 IPSec VPN Technical Specification) is implemented based on an extension of IKEv1. The international standard RFC3706 ("A Traffic-Based Method of Detecting Dead Internet Key Exchange (IKE) Peers") provides a standard protocol specifically for detecting the health of the IPSec control link. However, this protocol's application is limited to the control link and cannot detect the data link. In some special cases, a phenomenon may occur where the control link communication is normal but the data link communication is abnormal. This can lead the management level to mistakenly believe that data communication is normal, while in reality, data communication at the business level has encountered problems.

[0003] For example, in scenarios with extremely high data traffic between the two nodes, the following situation may occur: before the two nodes perform a rekey (i.e., data link renegotiation, after which a new data link will be established between the two nodes), the sliding window of the data link at one node reaches its upper limit (i.e., 2^32-1). At this point, that node will discard all subsequent data packets. However, since the control link is in a normal state, the management system will not issue an alarm to the administrator indicating a problem with the data link.

[0004] For example, in some IPSec software implementations, after a rekey is completed, the existing aging data tunnel in the kernel continues to be used until its hard lifetime ends, at which point it switches to the newly renegotiated data tunnel. When one node completes a rekey, it actively closes the aging data tunnel by sending a DELETE message to the peer node, immediately enabling the new data tunnel. However, DELETE messages are transmitted via UDP packets and lack reliability guarantees. If this message is lost, a situation arises where one node uses the new data tunnel while the other continues to use the aging one, resulting in all service data being discarded at the peer node. However, because the control link is normal, the management system will not alert the administrator to the data link problem.

[0005] In addition to these, other subtle scenarios can lead to inconsistencies in the data tunnels between the two nodes, which will not be detailed here. In these cases, business data communication can only be restored after the user reports the problem to the administrator, who can then restore the data connection by manually rekeying, re-establishing the data link, or restarting the service. This situation is unacceptable in scenarios with high robustness requirements. Summary of the Invention

[0006] The purpose of this invention is to provide a national cryptographic IPSec data link inspection method based on DPD and kernel status detection. This method solves the problem that the IPSec protocol only provides health checks for the control link, but not for the data link. In certain subtle scenarios, this can lead to poor robustness, such as data packet loss, slow problem detection, and the need for human intervention. This mechanism can automatically detect abnormal data links in a timely manner without human intervention and realize the automatic recovery of the data link, ultimately improving the robustness of the IPSec system.

[0007] To achieve the above objectives, this invention provides a method for checking IPSec data links based on DPD and kernel state detection, comprising the following steps:

[0008] S1. IPSec nodes periodically obtain peer data link information through the extended DPD message protocol, compare it with local data link information, and determine whether the user-mode data links of the two nodes are consistent.

[0009] S2. The user-space program of each IPSec node periodically obtains kernel-space data link information and compares it with the user-space data link information to determine whether the user-space and kernel-space data links are consistent.

[0010] S3. If it is determined that the data links in the user mode of both ends of the node are consistent, and the data links in the user mode and kernel mode of each end node are consistent, then it is determined that the data links in the kernel mode of both ends of the node are consistent.

[0011] Preferably, S1 is as follows:

[0012] IPSec node A periodically sends DPD requests to IPSec node B via the DPD protocol;

[0013] After receiving the DPD request, IPSec node B sends a DPD response to IPSec node A by extending the DPD message protocol and providing the timestamps of the most recent data packet received and the most recent data packet sent by each data link belonging to the corresponding control link.

[0014] After receiving the response, IPSec node A compares the timestamp of its own data link with the timestamp in the extended DPD message to determine whether the user-space data links of the two nodes are consistent.

[0015] Preferably, the methods for determining whether the user-space data links at both ends of the node are consistent include:

[0016] Traverse all data link information of IPSec node B in the response. For a given data link:

[0017] If the data link of IPSec node B is not found in all the data links of IPSec node A, it is determined that there is a problem with the user-space data link of both nodes.

[0018] If the timestamp of the last data packet received by IPSec node A stored in IPSec node A and the timestamp of the last data packet received by IPSec node A obtained in this query are unchanged; but the timestamp of the last data packet sent by IPSec node B stored in IPSec node A and the timestamp of the last data packet sent by IPSec node B in this response are different, then it is determined that there is a problem with the user-space data link between the two nodes.

[0019] If the timestamp of the last time IPSec node B received a data packet, which is stored in IPSec node A, and the timestamp of the last time IPSec node B received a data packet, which is stored in IPSec node A, are unchanged, and the timestamp of the last time IPSec node A sent a data packet, which is stored in IPSec node A, and the timestamp of the last time IPSec node A queried in this response are changed, then it is determined that there is a problem with the user-space data link between the two nodes.

[0020] Traverse all data links of IPSec node A. If a data link is not found in the response, it is determined that there is a problem with the user-space data link of both ends of the node.

[0021] Preferably, if it is determined that there is a problem with the user-space data link between the two nodes, the consistency of the user-space data link between the two nodes can be restored by initiating a Rekey renegotiation, terminating the local data link, and terminating the local control link.

[0022] Preferably, in S2, the method for determining whether the user-mode and kernel-mode data links are consistent includes:

[0023] Iterate through all data links in kernel mode. If a data link is not found in user mode, it is determined that there is a problem with the data link between user mode and kernel mode.

[0024] Iterate through all data links in user space. If a data link is not found in kernel space, it is determined that there is a problem with the data link between user space and kernel space.

[0025] Preferably, if a problem is determined to exist in the data link between user mode and kernel mode, the consistency of the data link between user mode and kernel mode is restored by initiating a rekey renegotiation through the data link and clearing the kernel mode data link.

[0026] Preferred formats for extended DPD messages include:

[0027] A 1-byte Version field is used to identify the extended protocol version;

[0028] The 3-byte RESERVED field is reserved as bytes for byte padding;

[0029] The 4-byte Initiator inbound SPI field is used to identify the SPI of a specific data link;

[0030] The 4-byte "Time for recent inbound traffic" field is used to record the timestamp of the most recent data packet received on a data link.

[0031] The 4-byte "Time for recent outbound traffic" field is used to record the timestamp of the most recent data packet sent on a data link.

[0032] When multiple data tunnels exist, append the Initiator inbound SPI, Time for recent inbound traffic, and Time for recent outbound traffic fields in sequence.

[0033] Therefore, the present invention employs the above-mentioned method for checking IPSec data links based on DPD and kernel state detection, and the beneficial effects are as follows:

[0034] (1) This invention realizes the timed interaction and comparison of user-mode data link information between two nodes through the DPD protocol, and combines the timed verification of user-mode and kernel-mode data link information to promptly detect data link anomalies that are masked by normal control links in the prior art.

[0035] (2) Compared with the traditional investigation and repair methods that rely on manual intervention, the present invention can shorten the time for anomaly discovery from several hours after user feedback to minutes, and can automatically trigger recovery mechanisms such as Rekey renegotiation and clearing abnormal links, which greatly reduces the duration of service interruption and significantly improves the self-healing capability and operational stability of the IPSec system.

[0036] (3) This invention addresses subtle abnormal scenarios such as sliding window exceeding limits and failure to switch old tunnels in time after rekeying in high-traffic scenarios. Through user-mode timestamp comparison and kernel-mode existence check, it accurately identifies hidden faults in the data transmission process, effectively solving the limitation of traditional IPSec protocol that can only detect the health status of control links. This enables the system to adapt to scenarios with extremely high requirements for communication continuity, such as finance and industrial control, and reduces economic losses caused by data link abnormalities.

[0037] The technical solution of the present invention will be further described in detail below with reference to the accompanying drawings and embodiments. Attached Figure Description

[0038] Figure 1 This is an overall flowchart of an embodiment of the national cryptographic IPSec data link inspection method based on DPD and kernel state detection of the present invention;

[0039] Figure 2 This is a topology diagram of an embodiment of the national cryptographic IPSec data link inspection method based on DPD and kernel state detection according to the present invention;

[0040] Figure 3 This is a schematic diagram of the extended DPD message protocol of an embodiment of the national cryptographic IPSec data link inspection method based on DPD and kernel state detection according to the present invention. Detailed Implementation

[0041] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0042] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains. The terms "first," "second," and similar terms used in this invention do not indicate any order, quantity, or importance, but are merely used to distinguish different components.

[0043] like Figure 1 As shown, a method for inspecting a national standard IPSec data link based on DPD and kernel state detection includes the following steps:

[0044] S1. The IPSec node periodically obtains the peer's data link information through the extended DPD message protocol, compares it with the local data link information, and determines whether the user-space data links of the two nodes are consistent. S1 specifically involves:

[0045] like Figure 2 As shown, IPSec node A sends DPD requests to IPSec node B periodically via the DPD protocol.

[0046] After receiving the DPD request, IPSec node B sends a DPD response to IPSec node A by extending the DPD message protocol and providing the timestamps of the most recently received (inbound) and most recently sent (outbound) data packets for each data link belonging to the corresponding control link.

[0047] After receiving the response, IPSec node A compares the timestamp of its own data link with the timestamp in the extended DPD message to determine whether the user-space data links of the two nodes are consistent.

[0048] Methods for determining whether the user-space data links at both ends of the node are consistent include:

[0049] (1) Traverse all data link information of IPSec node B in the response. For a given data link:

[0050] If the data link of IPSec node B is not found in any of the data links of IPSec node A, it is determined that there is a problem with the user-space data link between the two nodes.

[0051] If the timestamp of the last data packet received by IPSec node A, stored in IPSec node A's previous record, remains unchanged from the timestamp of the last data packet received by IPSec node A in this query, but the timestamp of the last data packet sent by IPSec node B, stored in IPSec node A's previous record, changes from the timestamp of the last data packet sent by IPSec node B in this response, it indicates that IPSec node B has recently sent data packets to IPSec node A, but IPSec node A has not processed them. Therefore, it is determined that there is a problem with the user-space data link between the two nodes.

[0052] If the timestamp of the last time IPSec node B received a data packet, stored by IPSec node A, remains unchanged compared to the timestamp of the last time IPSec node B received a data packet in this response, but the timestamp of the last time IPSec node A sent a data packet, stored by IPSec node A, changes compared to the timestamp of the last time IPSec node A queried in this response, it indicates that IPSec node A has recently sent data packets to IPSec node B, but IPSec node B has not processed them. Therefore, it is determined that there is a problem with the user-space data link between the two nodes.

[0053] (2) Traverse all data links of IPSec node A. If a data link is not found in the response, it is determined that there is a problem with the user-space data link of both ends.

[0054] If it is determined that there is a problem with the user-space data link between the two nodes, the consistency of the user-space data link between the two nodes can be restored by initiating a Rekey renegotiation, terminating the local data link, or terminating the local control link.

[0055] S2. The user-space program of each IPSec node periodically obtains all kernel-space data link information and compares it with the user-space data link information to determine whether the user-space and kernel-space data links are consistent.

[0056] Methods for determining whether the user-mode and kernel-mode data links are consistent include:

[0057] (1) Traverse all data links in kernel mode. If a data link is not found in user mode, it is determined that there is a problem between the user mode and kernel mode data links.

[0058] (2) Traverse all data links in user mode. If a data link is not found in kernel mode, it is determined that there is a problem with the data link between user mode and kernel mode.

[0059] If a problem is found in the data link between user mode and kernel mode, the consistency of the data link between user mode and kernel mode can be restored by initiating a rekey renegotiation on the data link or clearing the kernel mode data link.

[0060] S3. If it is determined that the data links in the user mode of both ends of the node are consistent, and the data links in the user mode and kernel mode of each end node are consistent, then it is determined that the data links in the kernel mode of both ends of the node are consistent.

[0061] like Figure 3 As shown, the format of the extended DPD message in this invention includes:

[0062] The 1-byte Version field is used to identify the extended protocol version.

[0063] The 3-byte RESERVED field is reserved for byte padding.

[0064] The 4-byte Initiator inbound SPI field is used to identify the SPI of a data link.

[0065] The 4-byte "Time for recent inbound traffic" field is used to record the timestamp of the most recent inbound data packet received on a data link.

[0066] The 4-byte "Time for recent outbound traffic" field is used to record the timestamp of the most recent outbound data packet sent on a data link.

[0067] When multiple data tunnels exist, the Initiator inbound SPI, Time for recent inbound traffic, and Time for recent outbound traffic fields mentioned above are appended sequentially.

[0068] Therefore, this invention adopts the above-mentioned national cryptographic IPSec data link inspection method based on DPD and kernel status detection. By constructing a comprehensive IPSec data link monitoring system through layered verification, it can accurately capture and repair problems such as high-traffic sliding window exceeding limits and loss of DELETE messages in Rekey, providing reliable protection for key areas and promoting the application upgrade of IPSec in highly robust scenarios.

[0069] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A method for inspecting a national standard IPSec data link based on DPD and kernel state detection, characterized in that, Includes the following steps: S1. The IPSec node periodically obtains the peer's data link information through the extended DPD message protocol, compares it with the local data link information, and determines whether the user-space data links of the two nodes are consistent; specifically: IPSec node A periodically sends DPD requests to IPSec node B via the DPD protocol; After receiving the DPD request, IPSec node B sends a DPD response to IPSec node A by extending the DPD message protocol and providing the timestamps of the most recent data packet received and the most recent data packet sent by each data link belonging to the corresponding control link. After receiving the response, IPSec node A compares the timestamp of its own data link with the timestamp in the extended DPD message to determine whether the user-space data links of the two nodes are consistent. S2. The user-space program of each IPSec node periodically obtains kernel-space data link information and compares it with the user-space data link information to determine whether the user-space and kernel-space data links are consistent. S3. If it is determined that the data links in the user mode of both ends of the node are consistent, and the data links in the user mode and kernel mode of each end node are consistent, then it is determined that the data links in the kernel mode of both ends of the node are consistent.

2. The method for checking a national cryptographic IPSec data link based on DPD and kernel state detection according to claim 1, characterized in that, Methods for determining whether the user-space data links at both ends of the node are consistent include: Traverse all data link information of IPSec node B in the response. For a given data link: If the data link of IPSec node B is not found in all the data links of IPSec node A, it is determined that there is a problem with the user-space data link of both nodes. If the timestamp of the last data packet received by IPSec node A stored in IPSec node A and the timestamp of the last data packet received by IPSec node A obtained in this query are unchanged; but the timestamp of the last data packet sent by IPSec node B stored in IPSec node A and the timestamp of the last data packet sent by IPSec node B in this response are different, then it is determined that there is a problem with the user-space data link between the two nodes. If the timestamp of the last time IPSec node B received a data packet, which is stored in IPSec node A, and the timestamp of the last time IPSec node B received a data packet, which is stored in IPSec node A, are unchanged, and the timestamp of the last time IPSec node A sent a data packet, which is stored in IPSec node A, and the timestamp of the last time IPSec node A queried in this response are changed, then it is determined that there is a problem with the user-space data link between the two nodes. Traverse all data links of IPSec node A. If a data link is not found in the response, it is determined that there is a problem with the user-space data link of both ends of the node.

3. The method for checking IPSec data links based on DPD and kernel state detection according to claim 2, characterized in that, If it is determined that there is a problem with the user-space data link between the two nodes, the consistency of the user-space data link between the two nodes can be restored by initiating a Rekey renegotiation, terminating the local data link, and terminating the local control link.

4. The method for checking a national cryptographic IPSec data link based on DPD and kernel state detection according to claim 1, characterized in that, In S2, the methods for determining whether the user-mode and kernel-mode data links are consistent include: Iterate through all data links in kernel mode. If a data link is not found in user mode, it is determined that there is a problem with the data link between user mode and kernel mode. Iterate through all data links in user space. If a data link is not found in kernel space, it is determined that there is a problem with the data link between user space and kernel space.

5. The method for checking a national cryptographic IPSec data link based on DPD and kernel state detection according to claim 4, characterized in that, If a problem is determined to exist in the data link between user mode and kernel mode, the consistency of the data link between user mode and kernel mode can be restored by initiating a rekey renegotiation through the data link and clearing the kernel mode data link.

6. The method for checking a national cryptographic IPSec data link based on DPD and kernel state detection according to claim 1, characterized in that, The format of the extended DPD message includes: A 1-byte Version field is used to identify the extended protocol version; The 3-byte RESERVED field is reserved as bytes for byte padding; The 4-byte Initiator inbound SPI field is used to identify the SPI of a specific data link; The 4-byte "Time for recent inbound traffic" field is used to record the timestamp of the most recent data packet received on a data link. The 4-byte "Time for recent outbound traffic" field is used to record the timestamp of the most recent data packet sent on a data link. When multiple data tunnels exist, append the Initiator inbound SPI, Time for recent inbound traffic, and Time for recent outbound traffic fields in sequence.

Images