IPSEC message mirroring method and device

Abstract

The invention discloses an IPSEC (Internet Protocol Security) message mirroring method and IPSEC message mirroring equipment. The method comprises the following steps: step 1, configuring a new command; 2, the IPSEC encryption module judges whether the command in the step 1 is configured or not before encryption, and if the command is not configured, original process encryption is carried out and is kept unchanged; step 3, if the command in the step 1 is configured; after IPSEC encryption, copying an original message to a cache, and continuing to encrypt the original message; if the encryption process fails or is abnormally discarded, the message is discarded; the cache is emptied, and the copied message is also discarded; step 4, if the encryption is normal, performing port mirroring processing on the cached message before encryption at the last step of sending the IPSEC encrypted message at the interface, and sending the message to a target mirroring port; and after mirroring, the cache is emptied for cyclic caching of the next IPSEC original message. According to the invention, an accurate positioning method can be provided when the SDWAN service has a fault, and the fault can be positioned in time.

Description

Technical Field

[0001] This invention relates to the field of network communication technology, and specifically to a method and device for IPSEC mirroring messages. Background Technology

[0002] IPSec is a security and confidentiality architecture proposed by the IETF (Internet Engineering Task Force) that uses cryptography to protect IP layer communications. It is a protocol suite that protects IP protocol network transport protocols (a collection of interrelated protocols) by encrypting and authenticating IP protocol packets. IPSec mainly consists of the following protocols: 1. Authentication Header (AH): Provides connectionless data integrity, message authentication, and protection against replay attacks for IP datagrams; 2. Encapsulate Security Payload (ESP) to provide confidentiality, data source authentication, connectionless integrity, replay protection, and limited traffic-flow confidentiality; 3. Security Association (SA) provides algorithms and data packets, and provides the parameters required for AH and ESP operations.

[0003] IV. Key Protocol (IKE) provides the life and exchange of keys for symmetric cryptography.

[0004] China Mobile's SDWAN project uses IPsec encryption technology. POP nodes are centrally deployed, while CPE nodes are used for user access. Any user with broadband internet access can connect to the POP node via IPsec, making it convenient and applicable to a wide range of scenarios. However, due to users' low internet quality requirements, issues such as packet loss, latency, meeting lag, and office system lag sometimes occur. Packet capture analysis is needed to determine whether the problem lies with the CPE device or the internet itself. Due to the special nature of IPsec encryption, packet analysis is not possible. Therefore, this function is needed to analyze packets before IPsec encryption. With this function, problems can be easily identified, fault location time can be shortened, and operation and maintenance capabilities can be improved. Summary of the Invention

[0005] The present invention proposes a method and device for IPSEC mirroring packets, which can provide an accurate location method and timely fault location when SDWAN service fails.

[0006] To achieve the above objectives, the present invention adopts the following technical solution: A method for IPsec mirroring packets involves performing the following steps via a computer device: Step 1: Configure the new command: IPSEC MIRROR ENABLE Step 2: Before encryption, the IPSEC encryption module checks whether the command in Step 1 is configured. If not, the original encryption process remains unchanged.

[0007] Step 3: If the command in Step 1 was configured, after IPSEC encryption, a copy of the original packet will be added to the cache, and the original packet will continue to be encrypted. If encryption fails or other abnormal situations occur during the process, the packet will be discarded. The cache will also be cleared, and the copied packet will be discarded as well.

[0008] Step 4: If encryption is successful, simultaneously with the final step of sending the encrypted IPSEC message out of the interface, perform port mirroring on the cached unencrypted message and send it to the destination mirror port. After mirroring, clear the cache for reuse in the next IPSEC raw message cyclical buffering.

[0009] On the other hand, the present invention also discloses a device for IPSEC mirroring packets in China Mobile's SDWAN project, including an IPSEC mirroring command configuration module, an IPSEC encryption module, an IPSEC pre-encryption packet caching module, a mirroring module, and a cache clearing module; The IPSEC mirroring command configuration module is used to configure newly developed commands, which will mirror the original packets before IPSEC encryption. The IPSEC encryption module is used to encrypt business messages using IPSEC. The IPSEC pre-encryption message caching module is used to copy and store the original plaintext message before IPSEC encryption into the cache area; The mirroring module is used to perform port mirroring, mirroring plaintext packets from the buffer to the configured destination port; The cache clearing module is used to clear the original packets copied before IPSEC encryption in the cache.

[0010] In another aspect, the present invention also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method described above.

[0011] In another aspect, the present invention also discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method described above.

[0012] As can be seen from the above technical solutions, China Mobile's SDWAN system uses IPsec encryption to ensure user service security. However, packet encryption can lead to increased latency and even packet loss. In SDWAN projects, CPE (customer-side) devices and POP (aggregator-side) devices use public network transmission for IPsec, which can result in packet loss and high latency due to poor public network link quality. During troubleshooting, because the IPsec-mirrored packets are encrypted, they cannot be analyzed, making it difficult to pinpoint the problem. To address this, this invention allows IPsec packets to be mirrored to their unencrypted form after enabling the configuration command, thus resolving the inability to locate faults. For example, in China Mobile's SDWAN network, CPE and POP nodes use an internet channel to establish an IPsec tunnel for transmitting service data. Sometimes, packet loss and high latency occur. Due to the inconsistent internet bandwidth of CPEs, and the possibility of cross-network access from China Telecom / China Unicom, it is impossible to determine whether the packet loss is due to a problem with the CPE / POP nodes built by China Mobile or a problem with the quality of the intermediate internet link. Troubleshooting is time-consuming and labor-intensive, often involving replacement of CPE devices and internet leased lines to determine the problem. This method is resource-intensive and time-consuming. With this invention, CPE / POP nodes can directly determine whether the problem is a CPE / POP issue or an internet issue in the intermediate link by capturing packets before mirroring, quickly identifying the problem, assigning manufacturer responsibility, and proceeding to the next steps of fault optimization and handling. Attached Figure Description

[0013] Figure 1 The interactive process is handled by this invention. Detailed Implementation

[0014] To make the objectives, technical solutions, and advantages of the embodiments of the present invention clearer, the technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are some embodiments of the present invention, but not all embodiments.

[0015] like Figure 1 As shown, the method for IPSEC packet mirroring described in this embodiment includes the following steps: Step 1: Configure the new command: IPSEC MIRROR ENABLE Step 2: Before encryption, the IPSEC encryption module checks whether the command in Step 1 is configured. If not, the original encryption process remains unchanged.

[0016] Step 3: If the command in Step 1 was configured, after IPSEC encryption, a copy of the original packet will be added to the cache, and the original packet will continue to be encrypted. If encryption fails or other abnormal situations occur during the process, the packet will be discarded. The cache will also be cleared, and the copied packet will be discarded as well.

[0017] Step 4: If encryption is successful, simultaneously with the final step of sending the encrypted IPSEC message out of the interface, perform port mirroring on the cached unencrypted message and send it to the destination mirror port. After mirroring, clear the cache for reuse in the next IPSEC raw message cyclical buffering.

[0018] On the other hand, embodiments of the present invention also disclose a device for IPSEC mirroring packets in China Mobile's SDWAN project, including an IPSEC mirroring command configuration module, an IPSEC encryption module, an IPSEC pre-encryption packet caching module, a mirroring module, and a cache clearing module; The IPSEC mirroring command configuration module is used to configure newly developed commands, which will mirror the original packets before IPSEC encryption. The IPSEC encryption module is used to encrypt business messages using IPSEC. The IPSEC pre-encryption message caching module is used to copy and store the original plaintext message before IPSEC encryption into the cache area; The mirroring module is used to perform port mirroring, mirroring plaintext packets from the buffer to the configured destination port; The cache clearing module is used to clear the original packets copied before IPSEC encryption in the cache.

[0019] Here are some specific examples: (1) The commonly used network topology of the SDWAN network built by China Mobile is as follows: User Switch 1 (LAN port) -- CPE1 (WAN port) --- Internet --- (WAN port) ----- Mobile POP (aggregation node) User Switch 2 (LAN port) -- CPE2 (WAN port) --- Internet --- Network Deployment: China Mobile will build a unified POP aggregation node in each province, providing internet access. CPE nodes will be deployed on the user side, requiring only internet access, which can be either regular broadband or a high-quality leased line. There are no restrictions on the CPE operator; broadband providers such as China Mobile, China Telecom, China Unicom, and Great Wall Broadband can all be connected. The CPE only needs to be able to ping the public IP address of the POP node to establish an IPsec tunnel for leased line service transmission.

[0020] Business Flow: User 1 and User 2 typically belong to different branches of the same enterprise, or have a headquarters-branch relationship, such as a headquarters and a branch office. This can be used for business operations within an overdue sales system. Business Flow: User branch 1 transmits data to the provincial POP aggregation node via its local CPE, and then transmits it to User branch 2's CPE via the POP node, ultimately reaching User 2. Frequently occurring faults: Packet loss occurs in the business between User 1 and User 2, causing business delays, such as timeouts during settlement.

[0021] Current drawbacks: Because the communication between CPE and POP is encrypted using IPsec, packet capture alone cannot determine whether the problem lies with the internet or the manufacturer's CPE / POP equipment. Troubleshooting requires replacing the CPE equipment and the dedicated internet line, which is time-consuming and labor-intensive.

[0022] Through this embodiment of the invention, after configuring the command "IPSEC MIRROR ENABLE" on the CPE device, packet capture on the CPE's WAN port can be mirrored to the packets before encryption. When packet loss or other faults occur, the WAN port packets can be analyzed to determine whether the problem is with the CPE or the internet. The same applies to POP. This allows for quick identification of the problem and clarifies which manufacturer is responsible.

[0023] In another aspect, the present invention also discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, causes the processor to perform the steps of the method described above.

[0024] In another aspect, the present invention also discloses a computer device, including a memory and a processor, wherein the memory stores a computer program, and when the computer program is executed by the processor, the processor performs the steps of the method described above.

[0025] It is understood that the systems, devices, and storage media provided in the embodiments of the present invention correspond to the methods provided in the embodiments of the present invention, and the explanations, examples, and beneficial effects of the relevant content can be referred to the corresponding parts of the above methods.

[0026] In the above embodiments, implementation can be achieved entirely or partially through software, hardware, firmware, or any combination thereof. When implemented using software, it can be implemented entirely or partially as a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions described in the embodiments of this application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another. For example, the computer instructions can be transmitted from one website, computer, server, or data center to another website, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that integrates one or more available media. The available medium can be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk (SSD)).

[0027] It should be noted that, in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0028] The various embodiments in this specification are described in a related manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0029] The above embodiments are only used to illustrate the technical solutions of the present invention, and are not intended to limit it. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A method for IPsec mirroring packets, characterized in that, Includes the following steps, Step 1: Configure the new command; Step 2: Before encryption, the IPSEC encryption module checks whether the command in Step 1 is configured. If not, the original encryption process remains unchanged. Step 3: If the command from Step 1 was configured, after IPSEC encryption, a copy of the original packet will be placed in the cache, and the original packet will continue to be encrypted. If the encryption process fails or other abnormal situations occur, the message is discarded. And clear the cache and discard the copied packets; Step 4: If encryption is successful, at the last step of sending the IPSEC encrypted message out of the interface, simultaneously perform port mirroring on the cached unencrypted message and send it to the destination mirror port. After mirroring, the cache will be cleared for use in the next IPSEC raw packet circular cache.

2. A device for IPsec packet mirroring, characterized in that: Includes an IPSEC mirroring command configuration module, an IPSEC encryption module, an IPSEC pre-encryption packet caching module, a mirroring module, and a cache clearing module; The IPSEC mirroring command configuration module is used to configure newly developed commands, which will mirror the original packets before IPSEC encryption. The IPSEC encryption module is used to encrypt business messages using IPSEC. The IPSEC pre-encryption message caching module is used to copy and store the original plaintext message before IPSEC encryption into the cache area; The mirroring module is used to perform port mirroring, mirroring plaintext packets from the buffer to the configured destination port; The cache clearing module is used to clear the original packets copied before IPSEC encryption in the cache.

Images