Zero-trust gateway encrypted traffic non-inductive filtering method and device based on eBPF multi-level mapping architecture, and computer program product

Abstract

The invention provides a zero-trust gateway encrypted traffic non-inductive filtering method and device based on an eBPF multi-level mapping architecture and a computer program product. The method comprises the steps that a data packet is intercepted in a network driving layer through an XDP mode of an eBPF, and quintuple and encryption protocol visible meta information are extracted; performing hierarchical strategy matching on the meta-information by adopting a multi-stage mapping architecture, and dynamically optimizing a search path through a performance model; and executing real-time verification and access decisions based on a zero-trust policy engine to realize non-perceptual filtering of encrypted traffic. According to the method, the problems of weak detection capability and high matching delay of a traditional scheme under encrypted traffic are solved, the method has the advantages of high speed, low delay and high precision, and meanwhile, data privacy and compliance are guaranteed.

Description

Technical Field

[0001] This invention relates to the field of computer network and information security technology, and in particular to a method, device and computer program product for seamless filtering of encrypted traffic in a zero-trust gateway based on an eBPF (Extended Berkeley Packet Filter) multi-level mapping architecture. Background Technology

[0002] With the continuous deepening of informatization and digitalization, encrypted network communication has become one of the core means to ensure data security and privacy.

[0003] Currently, encryption protocols such as HTTPS, TLS 1.3, and QUIC are commonly used to encrypt network traffic to prevent attacks, theft, or tampering of encrypted communication content. However, this also poses challenges to traditional network security protection systems. Specifically, traditional security devices such as firewalls, intrusion detection systems (IDS), and intrusion prevention systems (IPS) often rely on deep packet inspection (DPI) technology, which parses application-layer data to match security rules. However, in encrypted traffic, the application-layer payload is completely encrypted, and DPI technology can only rely on a small amount of visible metadata (such as IP address, port number, and SNI in the TLS handshake) for judgment, greatly weakening its ability to detect and defend against malicious traffic, data breaches, and lateral movement attacks. Furthermore, traditional traffic processing models often require data packets to enter the kernel protocol stack before being processed by user-space security modules, resulting in frequent switching between kernel and user modes, increasing processing latency, and causing excessive CPU resource consumption in high-concurrency environments.

[0004] Meanwhile, zero-trust security architecture emphasizes "never trust, continuous verification," requiring real-time authentication and risk assessment for every access and connection. This necessitates dynamic policy updates and complex matching, which traditional architectures struggle to meet the requirements of low latency and high throughput. Summary of the Invention

[0005] In view of the shortcomings of the prior art described above, the purpose of this invention is to provide a method, device and computer program product for seamless filtering of encrypted traffic in a zero-trust gateway based on an eBPF multi-level mapping architecture, which solves the problems of weak detection and defense capabilities against attack behavior in the existing technology when handling zero-trust access control in encrypted traffic scenarios, and the increase in matching delay and decrease in throughput due to low mapping lookup efficiency.

[0006] To achieve the above and other related objectives, this invention first provides a method for seamless filtering of encrypted traffic in a zero-trust gateway based on an eBPF multi-level mapping architecture, comprising:

[0007] Encrypted traffic data packets are intercepted at the network driver layer, and the metadata of the data packets is parsed and extracted. The metadata includes five-tuple information and encrypted metadata. Using the eBPF multi-level mapping (MAP) architecture, hierarchical map lookup and policy matching are performed on the metadata. Based on the matching policy after policy matching, the connection context is verified in real time, and access control decisions are executed according to the verification results. Based on the decision results of the access control decisions, the encrypted traffic is filtered based on protocol metadata.

[0008] In one optional embodiment, the data packet interception method includes:

[0009] The eBPF program is mounted to the network driver layer of the gateway device using XDP mode. When the gateway device starts up, the eBPF program is loaded into the kernel through the user program so that the data packets are processed by the eBPF program first after they arrive at the network card.

[0010] In one optional embodiment, the method for obtaining the quintuple information includes:

[0011] Parse the Ethernet header of the data packet to determine whether the frame type of the data packet is IPv4 or IPv6; if so, continue to parse the IP header of the data packet to extract the source and destination IP addresses; parse the TCP or UDP header in the data packet to extract the source port, destination port and protocol type; and the method of obtaining encrypted metadata includes: extracting the corresponding encrypted metadata according to the type of encrypted traffic.

[0012] In one optional embodiment, the multi-level mapping (MAP) architecture includes a first-level map storing connection context and a second-level map storing policy details; the hierarchical map lookup includes:

[0013] Based on the 5-tuple information, the connection context corresponding to the 5-tuple information is searched in the first-level Map; if it is found, the corresponding policy identifier is obtained; if it is not found, the default policy is executed.

[0014] Based on the policy identifier, search for the policy details corresponding to the policy identifier in the secondary map; if found, compare the extracted metadata with the policy conditions, and if all conditions are met, continue; otherwise, return a mismatch message.

[0015] In an optional embodiment, the multi-level mapping (MAP) architecture further includes a three-level map storing high-level matching conditions; and the hierarchical map lookup further includes:

[0016] Based on the user identifier, a matching condition corresponding to the user identifier is searched in the three-level map; wherein, the matching condition includes device fingerprint hash and session risk score.

[0017] In an optional embodiment, while performing the hierarchical Map lookup and strategy matching, the method further includes:

[0018] Using a performance estimation mathematical model, the matching success probability and performance cost of a multi-level Map lookup process are calculated. Based on the matching success probability and performance cost, the cache priority of each level of Map is adjusted. The matching success probability and performance cost include the overall hit probability of the system and the average latency of the multi-level lookup. The overall hit probability is used to characterize the probability that at least one level of Map is hit in the multi-level Map lookup. The average latency of the multi-level lookup is used to characterize the latency under multi-level lookup.

[0019] In a further embodiment, the performance estimation mathematical model includes:

[0020]

[0021]

[0022] in, For the first Hit probability of layer map; This represents the average access latency for this layer. This represents the overall hit probability. This represents the average latency of the system under multi-level search.

[0023] In an optional embodiment, the zero-trust gateway encrypted traffic seamless filtering method based on eBPF multi-level mapping architecture further includes:

[0024] Record the matching results of the policy matching process and transmit the matching results to user space; and / or perform dynamic updates and failure management on each of the matching policies.

[0025] A second aspect of this application provides an electronic device, including at least one processor and a memory connected to the processor, wherein: the memory is used to store a computer program; and the processor is used to execute the computer program to enable the electronic device to implement the zero-trust gateway encrypted traffic seamless filtering method based on the eBPF multi-level mapping architecture as described above.

[0026] A third aspect of this application provides a computer program product including computer-readable instructions that, when executed on an electronic device, cause the electronic device to implement any of the zero-trust gateway encrypted traffic filtering methods described above.

[0027] As described above, the zero-trust gateway encrypted traffic seamless filtering method based on eBPF multi-level mapping architecture provided in this application achieves high-speed interception and processing of data packets at the driver layer through eBPF XDP mode. Combined with a multi-level mapping architecture, it stores policy rules in layers and performs hierarchical Map lookups to quickly find matching policies corresponding to metadata and reduce lookup pressure and latency. Furthermore, based on a zero-trust policy engine, multi-dimensional verification and real-time validation allow access control decisions to be executed according to the validation results. This achieves precise control over encrypted traffic access, effectively prevents the abuse of authorized sessions, and improves communication security and real-time performance under the zero-trust architecture. While possessing advantages of high speed, low latency, and high precision, it effectively protects data privacy and compliance. Attached Figure Description

[0028] Figure 1 The diagram shown is a flowchart of an embodiment of the zero-trust gateway encrypted traffic seamless filtering method based on eBPF multi-level mapping architecture provided in this application. Figure 2 This is a schematic diagram of a multi-level map as described in one embodiment of this application; Figure 3 The diagram shown is a flowchart of yet another embodiment of the zero-trust gateway encrypted traffic seamless filtering method based on eBPF multi-level mapping architecture provided in this application. Figure 4 The diagram shown is a timing logic diagram of a zero-trust gateway encrypted traffic seamless filtering method based on eBPF multi-level mapping architecture according to an embodiment of the present invention. Figure 5 The diagram shown is a structural schematic of the electronic device provided by the present invention in one embodiment. Detailed Implementation

[0029] The following specific examples illustrate the implementation of the present invention. Those skilled in the art can easily understand other advantages and effects of the present invention from the content disclosed in this specification. The present invention can also be implemented or applied through other different specific embodiments, and various details in this specification can also be modified or changed based on different viewpoints and applications without departing from the spirit of the present invention. It should be noted that, unless otherwise specified, the following embodiments and features described therein can be combined with each other.

[0030] It should be noted that the illustrations provided in the following embodiments are only schematic representations of the basic concept of the present invention, and are therefore not intended to be considered as drawings.

[0031] To facilitate understanding of the technical solution of this application, the following terms are explained, including:

[0032] Encrypted traffic: Data streams processed by encryption protocols that are transmitted over a network; during transmission, business content (such as HTTP request bodies) is encrypted; for example, encrypted traffic includes HTTPS traffic based on TLS / SSL, QUIC traffic based on UDP, etc.

[0033] XDP (eXpress Data Path): A running mode of eBPF that allows data packets to be processed directly at the network driver layer;

[0034] eBPF Map: A key-value pair storage structure in eBPF programs, used for data exchange between kernel space and user space, supporting types such as hash tables and arrays;

[0035] The 5-tuple refers to the source IP address, destination IP address, source port, destination port, and protocol type of a data packet, which is a basic identifier for network traffic;

[0036] Encryption protocol metadata: This refers to the unencrypted visible information in the encryption protocol, such as the SNI (Server Name Indication) in the TLS handshake or the connection ID in QUIC.

[0037] Zero Trust Policy: Security rules set up based on the principle of "never trust, continuous verification", including multiple dimensions such as user identity, device fingerprint, access time, and geographical location.

[0038] Unobtrusive blocking: When dropping packets that do not meet the policy, no error response is returned, preventing attackers from probing the filtering mechanism.

[0039] To address the technical problems existing in the prior art, this invention provides a method, device, and computer program product for seamless filtering of encrypted traffic in a zero-trust gateway based on an eBPF multi-level mapping architecture. By intercepting data packets at the network driver layer and storing rules in layers through multi-level mapping policy storage to optimize the lookup path and reduce latency, and by adopting a zero-trust policy to achieve dynamic updates of the mapping policy, the timeliness of the security policy can be ensured. This effectively improves the access control accuracy and system performance under encrypted traffic, meeting the real-time and security requirements of the zero-trust architecture.

[0040] Please see Figure 1 The diagram shows a flowchart of an embodiment of the zero-trust gateway encrypted traffic seamless filtering method based on the eBPF multi-level mapping architecture provided in this application.

[0041] S100 uses eBPF's XDP mode to intercept encrypted traffic packets in the network driver layer and parse the packet's five-tuple and encrypted metadata.

[0042] Specifically, the eBPF program is mounted to the network interface driver layer of the gateway device using XDP mode, so that the eBPF program is loaded into the kernel by the user program when the gateway device starts up; when in use, the eBPF system call program is bound to the receive queue of the specified network card in XDP mode to realize the mounting of the program; it should be noted that before mounting the program, it is necessary to ensure that the network card driver of the gateway device supports XDP mode.

[0043] After successful mounting, when the data packet arrives at the network card, it is first processed by the eBPF program without entering the kernel protocol stack; that is, the data packet is intercepted before entering the kernel protocol stack, and the data packet is initially parsed to extract the five-tuple and encryption protocol metadata.

[0044] In one specific implementation, the preliminary parsing of the data packet includes:

[0045] First, parse the Ethernet header in the data packet to determine whether the Ethernet type field of the data packet indicates the IPv4 or IPv6 protocol; if so, continue to parse the IP header to extract the source and destination IP addresses; then parse the TCP or UDP header to extract the source port, destination port, and protocol type to form a 5-tuple.

[0046] During the parsing process, eBPF helper functions can be used to directly access the packet memory to improve access efficiency and reduce latency.

[0047] The XDP program is used to detect the protocol characteristics of data packets to determine the type of encrypted traffic, thereby enabling traffic identification without decryption. For example, if the destination port is 443, it is determined to be HTTPS / TLS encrypted traffic.

[0048] Based on the type of encrypted traffic, the corresponding cryptographic metadata is extracted. For example, when the encrypted traffic is TLS, the SNI field in the ClientHello message is parsed as cryptographic metadata; when the encrypted traffic is QUIC, the connection ID in the initial packet is parsed as cryptographic metadata. This extracted cryptographic metadata is then formatted and stored in a temporary structure for subsequent policy matching.

[0049] It should be noted that if a data packet has an abnormal format or fails to be parsed, the data packet will be discarded or handed over to the kernel for processing.

[0050] S200, based on the multi-level mapping architecture in the eBPF program, performs hierarchical Map lookup and policy matching processing on the five-tuple and cryptographic protocol metadata;

[0051] In this application, the multi-level mapping architecture in the eBPF program is utilized to distribute policy rules across multiple levels of Maps, forming a multi-level eBPF Map to store policy rules, thereby improving the efficiency of lookup and policy matching. The multi-level Map includes at least a first-level Map and a second-level Map; wherein the first-level Map stores the connection context, and the second-level Map stores policy details.

[0052] Specifically, if the first-level Map is designed as a hash table, then the first-level Map lookup includes:

[0053] Set the 5-tuple as Key; search for the connection context corresponding to Key in the first-level Map, that is, search for the policy set related to the connection; if found, obtain the policy identifier, such as Policy ID; if not found, execute the default policy. For example, the default policy includes matching wildcard rules in the second-level Map or directly discarding.

[0054] The connection context is a dynamic set of information used for access control decisions when processing a single network connection.

[0055] The secondary Map lookup includes:

[0056] Set the policy identifier as Key; search for the policy details corresponding to Key in the secondary Map; if found, compare the extracted metadata with the found policy conditions; if all conditions are met, continue; otherwise, return a mismatch message. More specifically, the policy details include at least: basic network conditions and encrypted traffic characteristic conditions;

[0057] The basic network conditions are static or semi-static conditions in the policy rules used to match network layer and transport layer attributes, including IP address range, port range, and protocol type, etc.

[0058] The encrypted traffic feature conditions are a set of conditions in the policy rules used to match the encryption protocol handshake phase or plaintext metadata in the message header, including: SNI domain name, QUIC connection ID, etc.

[0059] In some alternative embodiments, for connections requiring more advanced verification, such as those based on device fingerprinting or risk scoring; the multi-level Map is as follows: Figure 2 As shown, in addition to the first-level Map and the second-level Map, there is also a third-level Map, which is used to store advanced matching conditions;

[0060] The advanced matching conditions, also known as dynamic policy conditions, refer to the matching conditions in policy rules that need to be updated in real time or depend on input from external systems. These conditions are used to implement fine-grained access control based on context changes in a zero-trust architecture, thereby ensuring that the policy can respond to real-time risks or environmental changes.

[0061] For example, the dynamic policy conditions include: user identity, device status, device fingerprint, access time, geographical location, session risk level, etc.

[0062] And, the three-level Map lookup includes:

[0063] Set the user identifier as the Key, and search for matching conditions such as device fingerprint hash and session risk score corresponding to the Key in the three-level Map.

[0064] It should be noted that the three-level Map lookup can be dynamically expanded as needed.

[0065] This application, through its multi-level map mapping design, enables the distributed storage and retrieval of millions of conditions according to different dimensions and levels of policy conditions, avoiding the reduction in search efficiency and latency of a single-level map when the number of rules is large; and, by setting dynamic policy conditions, the matching conditions have high real-time performance and scalability, thereby quickly blocking new threats and achieving a balance between "seamless filtering" and "continuous verification".

[0066] In some practical application scenarios, for dynamically changing zero-trust policies, such as the access policy hit rate for internal application servers being extremely high during working hours but potentially dropping sharply after get off work; based on this, the demand for accessing resources will differ at different times. To better adapt to the dynamically changing zero-trust policy's demand for accessing resources and avoid resource waste and performance bottlenecks, the method further includes the following step when executing step 200:

[0067] Using a performance estimation mathematical model, the matching success probability and performance cost of the multi-level Map lookup process are calculated, so as to adjust the cache priority of each level of Map based on the matching success probability and performance cost.

[0068] The matching success probability and performance cost include the overall hit probability of the system and the average latency under multi-level search.

[0069] The overall hit probability is used to characterize the probability of "at least one level of Map being hit" in the system, reflecting the overall effectiveness of the strategy rules in the distribution of Maps at each level; the average latency under multi-level search is used to characterize the latency of the system under multi-level search, reflecting the average latency under the hit condition.

[0070] In one specific embodiment, the performance estimation mathematical model includes:

[0071]

[0072]

[0073] in, For the first Hit probability of layer map; This represents the average access latency for this layer. This represents the overall hit probability. This represents the average latency of the system under multi-level search.

[0074] Specifically, while performing multi-level Map lookup and strategy matching, the system records the hit events of each Map level and the total number of mapping events, so as to calculate the hit probability of each Map level based on the hit events and the total number of mapping events. To obtain the hit probability of each level of Map. Then, the total hit probability of the system is calculated. When the total hit probability is lower than the threshold, it indicates that the distribution of policy rules is uneven. The system triggers the cache reallocation mechanism to achieve policy optimization, such as by merging redundant rules.

[0075] Similarly, while performing multi-level Map lookups and policy matching, the average access latency corresponding to each level of the Map lookup process is obtained through eBPF's timestamp function. And combined with the hit probability corresponding to the Map lookup process at this level. and the overall hit probability in the Map search process at each level Calculate the average access latency for multi-level lookups. .

[0076] When the average delay When the value is lower than the latency threshold (e.g., 100 microseconds), the system performs load balancing operations, such as increasing the capacity of the hash table in the first-level Map and ensuring that the system maintains low latency under dynamic load, thereby better meeting the real-time requirements of zero-trust scenarios.

[0077] In one specific implementation, the method for adjusting the cache priority of each Map layer includes:

[0078] Adjust the access weights of each Map layer to ensure that the overall search efficiency meets the requirements after adjustment;

[0079] The access weight is a parameter used to reflect the access frequency of the Map layer, and is obtained by statistics of historical accesses; for example, if 80% of the access requests are in the first-level Map, then the access weight of the first-level Map is 0.8.

[0080] Specifically, for the current statistical period, the eBPF program uses built-in auxiliary functions to collect the access count, hit count, and access time of each layer's Map to obtain the corresponding access weight of each layer's Map within the current statistical period. Hit probability and average access latency And by counting the number of hash collisions in each layer of Map within the current statistical period, the collision factor of each layer of Map can be obtained within the current statistical period. ;

[0081] Based on the access weights and conflict factors of each Map layer within the current statistical period, the overall average search latency within the current statistical period is calculated as follows:

[0082]

[0083] in: This represents the overall average search latency; For the first Access weight of layer Map; This represents the conflict factor of the Map at this layer; To prevent smoothing constants with denominators of zero.

[0084] If the current overall average search latency is greater than the latency threshold, the access weights corresponding to each layer of Map are adjusted so that the adjusted overall average search latency is less than the latency threshold. New access weights are obtained, and the next cycle of statistics and access weight optimization is performed based on the new access weights.

[0085] This application's embodiments evaluate the lookup efficiency of each Map by considering its access frequency and capacity conflict factor, and adjust the priority of each Map based on these factors, thereby optimizing the overall lookup performance and reducing latency in a multi-level Map architecture.

[0086] S300, the matched policy result is used as the verification input to perform real-time verification on the connection context and multi-dimensional conditions; and the corresponding access control decision is executed based on the verification result.

[0087] To achieve seamless control over encrypted traffic, the matching strategy extracted in step S200 is used as input to the verification process and verified against the connection context. Based on the zero-trust principle, the corresponding access action is determined, such as allowing or dropping the traffic.

[0088] Specifically, the connection context is compared and verified against the matching policy conditions. This comparison and verification includes a first verification based on static conditions and a second verification based on dynamic conditions. If the verification passes, XDP_PASS is returned, and the data packet is handed over to the kernel protocol stack for further processing. If the policy verification times out or fails, XDP_DROP is returned, and the data packet is directly discarded and logged. Since this discarding action is completed within the driver layer, it has no effect on the user end.

[0089] The first verification includes directly comparing information such as IP range and port range with the condition range values ​​in the matching policy; the second verification is a dynamic verification process that obtains device status or risk score in real time through the user-space engine and transmits it to the kernel space via eBPFMap.

[0090] S400, based on the decision processing result of the access control decision, and according to the type corresponding to the protocol metadata, perform decryption-free filtering processing on the encrypted traffic.

[0091] Specifically, for encrypted traffic, the corresponding policy matching is performed based on the protocol metadata in the protocol handshake phase. If a match is found, subsequent encrypted traffic data is allowed to pass; if no match is found, subsequent encrypted traffic data is refused to pass, thus avoiding performance and compliance issues caused by decryption.

[0092] In one specific implementation, the protocol metadata includes TLS protocol metadata and QUIC protocol metadata. For TLS traffic, the XDP program identifies the TLS handshake packet and parses the SNI field in the TLS handshake packet as a flow identifier. The SNI field is then matched against the allow list or block list in the policy. If a match is found, subsequent encrypted traffic data is allowed. For QUIC traffic, the XDP program identifies the initial QUIC packet and extracts the connection ID as a flow identifier. Similarly, the connection ID is matched against the allow list or block list in the policy. After matching the policy, subsequent packets are quickly decided based on the connection ID.

[0093] Furthermore, to improve the efficiency of protocol metadata collection, in some more specific implementations, a pattern matching algorithm is used for metadata extraction to reduce the computational overhead of protocol metadata. In this application, payload decryption is unnecessary; policy matching can be performed solely based on visible metadata from the protocol handshake phase and message headers. This approach avoids the significant performance overhead caused by decryption, and this seamless filtering method is completely transparent to the client, ensuring user privacy and regulatory compliance.

[0094] In some optional embodiments, the zero-trust gateway encrypted traffic seamless filtering method based on eBPF multi-level mapping architecture, such as... Figure 3 and Figure 4 As shown, it also includes:

[0095] S500 records the matching results of the policy matching process and transmits the matching results to user space;

[0096] Specifically, based on the eBPF logging mechanism, after each match, the matching result, policy identifier, matching conditions, execution action, and timestamp of each policy match are recorded. This information is asynchronously transmitted to the user-space logging module via the ringbuf provided by eBPF, i.e., written into the log buffer. The user-space logging module reads the log data in the buffer through system calls, parses it, and writes it to a local file or a remote logging system. This allows users to perform audit analysis, source tracing investigation, and policy optimization by analyzing the logs, as well as to identify high-frequency blocking events or abnormal patterns, thereby adjusting the optimization rules of the policy engine.

[0097] Furthermore, the method further includes:

[0098] S600 performs dynamic updates and failure management for the matching strategy;

[0099] Specifically, based on the zero-trust policy engine, a new policy set is retrieved from the policy center periodically or when a security event is detected, and updated to the kernel Map. It should be noted that the update process can be a full replacement or an incremental update.

[0100] To ensure efficient updates of the matching policy and further improve the security of the zero-trust policy, in some optional embodiments, atomic operations (such as RCU mechanisms) or batch updates of the latest Map storage policy rules are used in the eBPF system to ensure the accuracy and consistency of the policy.

[0101] To avoid performance fluctuations caused by updating large numbers of rules at once, the system supports a batch update mechanism. All rules can be configured with a Time-to-Live (TTL), automatically expiring and being removed from the Map to ensure that only valid matching policies are always retained in the Map, reducing lookup latency. When policy priorities change or conflicts occur, the policy engine performs atomic updates to ensure data consistency read by the XDP program, preventing policy matching errors or business interruptions due to the update process.

[0102] To address the technical problems existing in the prior art, embodiments of the present invention also provide an electronic device, please refer to... Figure 5The diagram shows a schematic of the structure of the electronic device 5 of the present invention; the electronic device 5 includes: at least one processor, at least one communication interface, at least one memory and at least one communication bus.

[0103] In this embodiment of the application, the number of processor, communication interface, memory and communication bus is at least one, and the processor, communication interface and memory communicate with each other through the communication bus;

[0104] The memory 51 is used to store computer programs, and the processor 52 is used to execute the computer programs stored in the memory.

[0105] Optionally, the number of memories can be one or more, and the number of processors can be one or more.

[0106] Optionally, the processor in the electronic device loads one or more instructions corresponding to application processes into the memory according to the steps in the zero-trust gateway encrypted traffic seamless filtering method based on eBPF multi-level mapping architecture as described above, and the processor runs the application stored in the memory, thereby realizing the functions in the zero-trust gateway encrypted traffic seamless filtering method based on eBPF multi-level mapping architecture as described above, which will not be elaborated here.

[0107] It should be noted that memory includes, but is not limited to, random access memory (RAM), and may also include non-volatile memory, such as at least one disk storage device. Similarly, processors can be general-purpose processors, including central processing units (CPUs), network processors (NPs), etc.; they can also be digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, or discrete hardware components.

[0108] Furthermore, this application embodiment also provides a computer storage medium carrying one or more computer programs. When the one or more computer programs are executed by an electronic device, the electronic device is able to implement the steps of the zero-trust gateway encrypted traffic seamless filtering method based on the eBPF multi-level mapping architecture provided in the above embodiment.

[0109] This invention also provides a computer-readable storage medium storing a computer program that, when invoked by a processor, implements the zero-trust gateway encrypted traffic seamless filtering method based on the eBPF multi-level mapping architecture described in the above embodiments.

[0110] A computer-readable storage medium can be a tangible device capable of holding and storing instructions used by an instruction execution device. Computer-readable storage media can be, for example, (but not limited to) electrical storage devices, magnetic storage devices, optical storage devices, electromagnetic storage devices, semiconductor storage devices, or any suitable combination thereof. More specific examples (a non-exhaustive list) of computer-readable storage media include: portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), static random access memory (SRAM), portable compact disc read-only memory (CD-ROM), digital multifunction disc (DVD), memory sticks, floppy disks, and mechanical encoding devices.

[0111] The computer-readable program described herein can be downloaded from a computer-readable storage medium to various computing / processing devices, or downloaded via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network, to an external computer or external storage device. A network adapter card or network interface in each computing / processing device receives computer-readable program instructions from the network and forwards these instructions to the computer-readable storage medium in the respective computing / processing device.

[0112] The above embodiments are merely illustrative of the principles and effects of the present invention and are not intended to limit the invention. Any person skilled in the art can modify or alter the above embodiments without departing from the spirit and scope of the present invention. Therefore, all equivalent modifications or alterations made by those skilled in the art without departing from the spirit and technical concept disclosed in the present invention should still be covered by the claims of the present invention.

Claims

1. A method for zero-trust gateway encrypted traffic transparent filtering based on eBPF multi-level mapping architecture, characterized in that, The application relates to a method for intercepting encrypted traffic data packets in a network driver layer, analyzing and extracting meta-information of the data packets, performing hierarchical Map lookup and strategy matching on the meta-information by using a multi-level Map architecture of eBPF, performing real-time verification on a connection context based on a matching strategy after strategy matching, executing an access control decision according to a verification result, and performing protocol meta-information-based filtering processing on the encrypted traffic based on a decision result of the access control decision. The data packet interception method comprises the following steps: mounting an eBPF program in an XDP mode to a network driver layer of a gateway device, loading the eBPF program into a kernel through a user program when the gateway device is started, and processing the data packets by the eBPF program after the data packets arrive at a network card. The five-tuple information acquisition method comprises the following steps: analyzing an Ethernet header of the data packet, judging whether a frame type of the data packet is IPv4 or IPv6, if yes, continuing to analyze an IP header of the data packet, extracting source and destination IP addresses, analyzing a TCP or UDP header in the data packet, and extracting a source port, a destination port and a protocol type. The encrypted meta-information acquisition method comprises the following step: extracting corresponding encrypted meta-information according to a type of the encrypted traffic. The multi-level Map architecture comprises a first-level Map for storing a connection context and a second-level Map for storing strategy details.

2. The method of claim 1, wherein the eBPF multi-level map architecture based zero trust gateway encrypted traffic non-intrusive filtering method is characterized in that, The hierarchical Map lookup comprises the following steps: searching for the connection context corresponding to the five-tuple information in the first-level Map based on the five-tuple information, if the connection context is found, acquiring a corresponding strategy identifier, if the connection context is not found, executing a default strategy, searching for the strategy details corresponding to the strategy identifier in the second-level Map based on the strategy identifier, if the strategy details are found, comparing the extracted meta-information with strategy conditions, if all the strategy conditions are met, continuing, otherwise, returning unmatched information. The multi-level Map architecture further comprises a third-level Map for storing high-level matching conditions, and the hierarchical Map lookup further comprises the following steps: searching for the matching conditions corresponding to the user identifier set in the third-level Map based on the user identifier set, wherein the matching conditions comprise a device fingerprint hash and a session risk score.

3. The method of claim 1, wherein the eBPF multi-level map architecture based zero trust gateway encrypted traffic non-intrusive filtering method is characterized in that, The hierarchical Map lookup and strategy matching are performed simultaneously, and the following steps are further performed: calculating a matching success probability and a performance cost of the multi-level Map lookup process by using a performance estimation mathematical model, adjusting cache priorities of the layers of Maps based on the matching success probability and the performance cost, wherein the matching success probability and the performance cost comprise a total hit probability of the system and an average time delay of the multi-level lookup, the total hit probability is used to represent a probability that at least one Map in the multi-level Map lookup hits, and the average time delay of the multi-level lookup is used to represent a time delay size under the multi-level lookup. The performance estimation mathematical model comprises the following steps: calculating the total hit probability of the system and the average time delay of the multi-level lookup by using a performance estimation mathematical model. The method further comprises the following steps: recording a matching result of the strategy matching process, and transmitting the matching result to a user state; and / or dynamically updating and invalidating the matching strategies. The method further comprises the following steps: dynamically updating and invalidating the matching strategies.

4. The method of claim 1, wherein the eBPF multi-level map architecture based zero trust gateway encrypted traffic non-intrusive filtering method is characterized in that, ​ ​ ​ ​ 5. The method of claim 4, wherein the eBPF multi-level map architecture based zero trust gateway encrypted traffic non-intrusive filtering method is characterized in that, ​ ​ 6. The method of claim 1, wherein the method further comprises: ​ ​ ​ 7. The method of claim 6, wherein the method further comprises: ​ wherein, is the number of levels in the system; is the hit probability of the layer Map; is the average access latency of the layer; is the overall hit probability; is the average latency of the system under multi-level lookup.

8. The method of claim 1, wherein the eBPF multi-level map architecture based zero trust gateway encrypted traffic non-intrusive filtering method is characterized in that, ​ ​ ​ ​ 9. An electronic device, comprising: An electronic device comprising at least one processor and a memory connected with the processor, wherein: the memory is configured to store a computer program; the processor is configured to execute the computer program to enable the electronic device to implement the method for eBPF multi-level mapping architecture-based zero-trust gateway encrypted traffic non-perceptual filtering according to any one of claims 1-7.

10. A computer program product, characterised in that, Computer readable instructions, when executed on an electronic device, cause the electronic device to implement the method for eBPF multi-level mapping architecture-based zero-trust gateway encrypted traffic non-perceptual filtering according to any one of claims 1-7.

Images