Method for realizing two-layer transparent link encryption configuration through BGP (Border Gateway Protocol)

Abstract

The invention discloses a method for realizing two-layer transparent link encryption automatic configuration based on BGP (Border Gateway Protocol) dynamic routing. In order to solve the problems that an extra packaging head is introduced in an existing encryption scheme, the two-layer transparent transmission requirement cannot be met, and the manual configuration maintenance complexity is O (N), the expansion group attribute is introduced to serve as an encryption metadata carrier by expanding a BGP protocol. And the collaborative key management system generates mapping, and directly embeds the configuration information into a BGP routing update message. And a receiving end automatically analyzes attributes and issues an encryption strategy during route learning, so that deep fusion of route discovery and configuration is realized, and encryption association based on subnet mapping can be established without manual intervention. According to the scheme, the strict requirement of zero packet length increase is met, the configuration complexity is reduced to O (N), and the safety operation and maintenance efficiency of a large-scale dynamic network is remarkably improved.

Description

Technical Field

[0001] This invention relates to the field of network security equipment hardware technology, specifically to an integrated Bypass structure and method for an MPO interface encryption machine for high-speed optical networks. Background Technology

[0002] In modern network communication, link encryption is a key technology for ensuring the security of Data Center Interconnect (DCI) and enterprise leased lines. However, existing link encryption schemes have the following significant drawbacks in large-scale, multi-branch network environments: 1. Exponential Growth in Configuration Complexity: In a Full Mesh network architecture that prioritizes direct communication between nodes, any two devices in the network need to establish independent encrypted channels. For a network with $N$ nodes, the total number of encrypted channels is $N \times (N-1) / 2$ (i.e., the sum of N-1 connections from the first node, N-2 connections from the second node, and so on). As the number of nodes increases, the configuration and maintenance workload grows by an order of $O(N^2)$, resulting in extremely high operational costs and a high susceptibility to errors. 2. Disconnect between the routing plane and the security plane: Even if dynamic routing protocols such as BGP are deployed in the network, encryption configurations (such as encryption associations and encryption policies) still need to be manually and statically set independently of the routing protocol. BGP can only perform path discovery and cannot synchronously distribute encrypted metadata, resulting in the coexistence of "dynamic routing" and "static encryption," which cannot adapt to flexible changes in the topology. 3. Key management and synchronization difficulties: The lack of a centralized key management mechanism means that the distribution, regular updates, and network-wide synchronization of massive keys rely entirely on manual intervention. During key switching or policy adjustments, it is difficult to guarantee consistency across all network devices, which can easily lead to communication interruptions. 4. Insufficient deployment transparency: Traditional encryption technologies (such as IPsec) often change the original data packet structure in their working mode (such as adding ESP / AH headers and triggering fragmentation), which is less transparent to intermediate network devices and increases the complexity of network optimization. 5. Limitations of existing BGP encryption schemes: Existing BGP encryption attempts (such as BGP+IPsec converged schemes) are mostly based on Layer 3 channels. Although they utilize BGP to publish encryption associations, they still cannot get rid of the problem of increased packet length caused by the encapsulation header, and they are difficult to meet the underlying transmission requirements of "Layer 2 transparency" and "zero packet length increase" in demanding fields such as finance and industrial control. Therefore, how to achieve deep integration of route discovery and encryption configuration, reduce the complexity of encryption configuration from $O(N^2)$ to the linear level, and realize automated key management are the technical problems that urgently need to be solved in the construction of large-scale secure networks. Summary of the Invention

[0003] This invention provides a method for configuring Layer 2 transparent link encryption via BGP, aiming to solve the problems of exponential growth in configuration complexity, disconnect between routing plane and security plane, lack of centralized key management, and insufficient deployment transparency of existing link encryption in large-scale multi-branch network environments. To address the aforementioned issues, this invention provides an automatic link encryption configuration method based on the collaborative operation of BGP dynamic routing and a Key Management System (KMS). This method uses the KMS as a centralized key management center to automatically generate independent random keys for different routing channels and maintain a route-key mapping table based on network topology and BGP routing information. It utilizes the dynamic routing capabilities of the BGP protocol to automatically discover the correspondence between source and destination subnets and transmits encryption configuration information containing encryption algorithm identifiers and key indexes through the Extended Community attribute. Finally, encryption devices deployed at both ends of the link learn the routes and attributes through BGP, obtain the mapping table from the KMS, and look up the corresponding key based on the source and destination IP addresses of the data packets to achieve payload encryption and decryption. The working principle of the function described in this invention is as follows: 1. Initialization phase: KMS automatically generates random working keys based on the network topology and unique device identifiers, and constructs a routing-key mapping table containing key identifiers, indexes, and source-destination subnet information. It then distributes the keys to each link encryption device to achieve key pre-deployment. 2. Route Discovery Phase: Link-encrypted devices establish neighbor relationships via the BGP protocol. When publishing Network Layer Reachability Information (NLRI), specific extended community attributes are appended to the BGP Update message. These attributes carry metadata such as encryption algorithm identifier, key index, and encryption association lifecycle. 3. Automatic configuration phase: While learning BGP routes, the receiving device parses extended community attributes, extracts encryption configuration parameters, and retrieves matching keys from the local route-key mapping table accordingly. This automatically triggers the establishment of encryption associations and the distribution of encryption policies, achieving synchronization of routes and security policies. 4. Data encryption / decryption stage: During data plane forwarding, the device matches the source IP address and destination IP address against the routing-key mapping table, obtains the corresponding key, and performs Layer 2 transparent encryption / decryption processing only on the packet payload. This process does not add any additional protocol headers, keeping the header fields and total length of the original message completely unchanged from layer 2 to layer 4, ensuring complete transparency to intermediate network devices (such as firewalls, load balancers, and auditing devices). The beneficial effects of this invention are as follows: 1. A leap from exponential to linear configuration complexity: Through the collaboration of BGP dynamic routing and KMS, the configuration complexity of traditional point-to-point encryption schemes is reduced from $O(N^2)$ to $O(N)$. In large-scale network environments (such as 100 nodes), the manual configuration workload of thousands of encrypted channels can be reduced to only requiring a one-time definition of the routing channel, improving configuration efficiency by more than 95%. 2. Deep integration of the routing plane and security plane: By leveraging BGP extended community attributes to carry encrypted metadata, the synchronous discovery and distribution of encryption policies and routing information are achieved. When the network topology changes, the encryption configuration is automatically updated along with the routing, completely resolving the disconnect between "dynamic routing" and "static encryption". 3. Fully automated "administrator-free" key management: The system automatically generates and distributes keys based on device identity and topology information, eliminating the need for manual intervention with zero key configuration values. Through the self-learning mechanism of BGP attributes, the need for manually defining complex pairing relationships is eliminated, significantly reducing security risks caused by human error. 4. High Deployment Transparency and Compatibility: Employing payload encryption technology, the solution achieves transparent transmission while maintaining the original message header fields and total length, remaining completely transparent to intermediate network devices. Furthermore, the solution adheres to the standard BGP extension mechanism, enabling seamless integration with existing network architectures and third-party BGP devices, demonstrating strong engineering practicality. In addition, the solution fully supports national cryptographic algorithms (SM4-CFB / SM4-OFB / SM4-CTR), meeting the compliance requirements of the State Cryptography Administration for message encryption in critical industries such as finance. Attached Figure Description Figure 1 This is a system architecture diagram of an embodiment of the present invention, showing the Layer 2 link encryption deployment between two data centers, marking the locations of link encryption machines A and B, and showing the BGP neighbor relationship and data flow. Figure 2 This diagram illustrates the encoding format for BGP extended community attributes, showing the structure of the Type, Sub-Type, and Value fields, as well as the encoding methods for the Algorithm ID, Key Info, and Encryption Association Lifetime (EA) within the Value field. Figure 3 This is a flowchart of the encryption process (outbound direction), showing the complete process from receiving the raw data packet to sending the encrypted data packet, emphasizing the core feature of "encrypting only the payload". Figure 4This is a flowchart of the decryption process (inbound direction), showing the complete process from receiving encrypted data packets to forwarding decrypted data packets, and marking the encryption association lookup and verification steps. Figure 5 This is a comparison diagram of the data packet structure, showing the difference between the original data packet structure and the encrypted data packet structure, intuitively demonstrating the "zero packet length increase" characteristic. Figure 6 The sequence diagram for the encrypted association update process illustrates the overlapping update mechanism and rollback mechanism based on BGP attribute announcements. Figure 7 A bar chart comparing the performance of this solution with IPsec and MACsec is provided to demonstrate its performance advantages in terms of throughput, latency, and IP fragmentation rate. Figure 8 This is a module architecture diagram of the link encryption machine, which includes core modules such as BGP message processing, extended community attribute parsing, automatic encryption policy configuration, Layer 2 transparent encryption and decryption processing, and encryption association management. Detailed Implementation To make the objectives, technical solutions, and advantages of the present invention clearer, the present invention will be described in detail below with reference to the accompanying drawings and specific embodiments. Workflow: 1. Key pre-distribution phase: The Key Management System (KMS) automatically generates random working keys based on the network topology and unique device identifiers (DeviceIDs), and constructs a routing-key mapping table containing key identifiers, indexes, and subnet information. KMS then distributes this mapping table to each link encryption device through a secure channel. 2. Routing and Policy Advertisement Phase: BGP neighbor relationships are established between link encryption devices. When publishing Network Layer Reachability Information (NLRI), a specific Extended Community attribute is appended to the BGP Update message. This attribute carries metadata such as the encryption algorithm identifier (Algo-ID), key index, and encryption association lifetime (EA-Lifetime). EA (Encryption Association) refers to the encryption association, which is the logical connection state required to establish an encrypted channel. 3. Automatic Policy Association Phase: While learning BGP routes, the receiving device parses extended community attributes and extracts encryption configuration parameters. The device atomically binds the source / destination subnet information in the NLRI with the encryption parameters in the extended community attributes, and retrieves the matching key from the local route-key mapping table, automatically triggering the establishment of the encryption association. 4. Transparent Encryption / Decryption Phase: During data plane forwarding, the device matches the routing-key mapping table based on the destination IP address of the data packet. The sender only encrypts the payload portion of the original message, keeping the Layer 2 and Layer 3 header fields unchanged; the receiver decrypts and restores the data based on the security association information. Example 1: Link Encryption Deployment in a Large-Scale Bank Network. In a fully interconnected network scenario of a large commercial bank with one head office data center and 99 branch data centers, the system first automatically scans the Device IDs of 100 nodes across the network via KMS and distributes dedicated encryption configuration files accordingly, achieving administrator-free manual key intervention. Subsequently, when each device publishes its local subnet route, it uses BGP extended community attributes (such as Type: 0x06, Sub-Type: 0x80) to simultaneously announce metadata including the national cryptographic standard SM4-CFB or SM4-CTR algorithm identifier and key index, ensuring that all network devices use a unified national cryptographic standard for encryption and decryption. While meeting regulatory compliance requirements, the hardware acceleration characteristics of the SM4 algorithm ensure the throughput performance of high-speed links and ensure strong consistency between routing and security policies. The receiving device not only identifies the destination subnet but also establishes a precise encryption policy association based on the characteristics of the source network. While learning the route, it automatically parses this attribute and associates it with the matching key, thereby completing the second-level logical establishment of 4,950 pairs of encrypted channels across the entire network without manual intervention. Compared with the traditional BGP+IPsec solution, this implementation does not require the establishment of a three-layer tunnel, avoiding MTU overrun and fragmentation issues caused by adding an ESP header. It achieves true Layer 2 transparent transmission, and the configuration complexity is reduced from O(N^2) to O(N). This reduces the overall configuration process from hours of manual maintenance to seconds of automatic association as routes converge synchronously. While ensuring synchronous discovery of routes and policies, it significantly improves the deployment efficiency of large-scale networks. Example 2: Dynamic Expansion of New Nodes Based on Example 1, when the bank network adds its 100th branch data center (E100), the administrator only needs to add the definition of the node in the KMS, which will automatically generate and distribute the key configuration. Subsequently, E100 accesses the network and dynamically announces its subnet routing and encryption extension attributes to the entire network through the BGP protocol. After receiving the update message, the existing node will automatically parse the attributes and trigger the association with the encryption policy of E100, thereby reducing the configuration time of the new node from 50 hours in the traditional solution to 5 minutes, realizing the "plug and play" dynamic expansion of the secure link.

Claims

1. A method for automatic configuration of Layer 2 transparent link encryption based on the collaborative operation of Border Gateway Protocol (BGP) and Key Management System (KMS), characterized in that, The link encryption devices are dedicated hardware devices deployed in pairs at both ends of a Layer 2 physical or logical link; the method includes the following steps: a BGP dynamic route discovery step, in which the link encryption devices establish neighbor relationships through the BGP protocol, automatically discover the correspondence between source subnets and destination subnets and routes using BGP's dynamic routing capabilities, and when publishing BGP routes, in BGP... The Update message includes predefined BGP extended community attributes associated with Network Layer Reachability Information (NLRI), enabling the receiving end to automatically obtain the mapping relationship between the encryption policy and the source-destination subnet pair while maintaining the original message header and total length. In the KMS key generation and distribution step, the Key Management System (KMS) obtains the unique identifier and network information of the link encryption device, automatically generates encryption configuration files for each device, where the initial manually configured key value is 0, and the KMS automatically calculates and fills in the actual working key. The KMS maintains a route-key mapping table containing key identifiers, key indexes, source subnets, destination subnets, and routing information, and distributes it to the devices. In the automatic configuration step, the receiving link encryption device parses the BGP extended community attributes to extract the encryption algorithm identifier and key index, and based on this, looks up the key in the local route-key mapping table and automatically configures the encryption policy to establish a secure encryption channel. In the data plane encryption and decryption step, when a data packet arrives, the corresponding key is looked up in the route-key mapping table based on the source IP address and destination IP address of the data packet, and the data packet payload is encrypted or decrypted.

2. The method according to claim 1, characterized in that, The encoding format of the BGP extended community attribute includes: a type field, which uses 8-bit binary encoding and has a value of 0x06 or 0x08; a subtype field, which uses 8-bit binary encoding and uses a custom value in the range of 0x80 to 0xFF; and a value field, which uses variable-length encoding and contains the encryption algorithm identifier, key information, and encryption association lifecycle parameters.

3. The method according to claim 2, characterized in that, The specific encoding structure of the value field is as follows: the first byte is the encryption algorithm identifier, used to identify the algorithm type, including national cryptographic SM4-CFB, SM4-OFB, SM4-CTR, AES-256-CFB, AES-128-CFB or AES-256-CTR; the second to Nth bytes are the key index or key information field, used to carry the key index, Diffie-Hellman public value or key material; the last 4 bytes are the encryption association lifecycle field, using Unix timestamp or second-level countdown format.

4. The method according to claim 1, characterized in that, The Key Management System (KMS) features an administrator-free automatic generation mechanism that includes: automatically collecting the unique device identifiers of all network link encryption devices and combining them with BGP routing topology to identify node locations and the correspondence between source and destination subnets; using the unique device identifiers as seeds and automatically generating random key streams with the administrator's key configuration item set to 0; generating a routing-key mapping table that integrates key identifiers, key indexes, source subnets, destination subnets, and routing paths; and a whitelist admission mechanism based on the unique device identifiers to silently push configuration files to matching devices.

5. The method according to claim 1, characterized in that, The mechanism by which the link encryption device looks up the key from the routing-key mapping table includes: extracting the source IP address and destination IP address of the data packet, using the longest prefix matching algorithm to find the matching routing entry in the routing-key mapping table, obtaining the corresponding key ID and key value, and using a local caching mechanism to save frequently accessed source-destination routing-key triplets to accelerate the lookup.

6. The method according to claim 1, characterized in that, The BGP dynamic route discovery steps also include: real-time monitoring of BGP Update and Withdraw messages to detect topology changes; automatically deleting relevant encryption policies and policy associations when a Withdraw message is received, and automatically establishing new policy associations when an Update message is received; and re-searching the mapping table based on the new routing information after BGP convergence to ensure encryption continuity when the primary path fails.

7. The method according to claim 1, characterized in that, The encryption configuration parameters include at least one or more of the following: encryption algorithm type, authentication algorithm type, key index, encryption association lifecycle, encryption policy identifier, and traffic selector that defines the traffic range.

8. The method according to claim 1, characterized in that, The transparent encryption and decryption process includes an encryption step and a decryption step. The encryption step encrypts only the payload by parsing the data packet header and identifying the payload location, while keeping the Layer 2 frame header, Layer 3 IP header, and Layer 4 transport layer header completely unchanged and ensuring that the total length remains unchanged. The decryption step identifies the data packet based on the encryption association, decrypts the payload while keeping all header fields unchanged, verifies its integrity, and then forwards the original data packet.

9. The method according to claim 8, characterized in that, The transparent encryption and decryption process features zero packet length increase, header integrity (keeping the original header fields unchanged), and intermediate node transparency (being completely transparent to intermediate network devices).

10. The method according to claim 1, characterized in that, Its characteristics also lie in The aging and update process of encrypted associations is synchronized by using specific fields in the BGP extended community properties.

11. The method according to claim 10, characterized in that, The aging and update process of the encryption association includes: establishing a new encryption association in advance through BGP Update before the old encryption association expires and retaining a period of overlap between the old and new encryption associations to achieve a smooth switch; when the establishment of the new encryption association fails, the old encryption association is used to continue to be used and an alarm is triggered; and key updates are dynamically triggered based on lifecycle expiration, traffic statistics, manual triggering, or security policies.

12. The method according to claim 1, characterized in that, Supported encryption algorithms prioritize stream encryption algorithms or feedback mode algorithms with equal-length encryption characteristics, including: Chinese national standard SM4-CFB, SM4-OFB, SM4-CTR, AES-CFB, AES-OFB, and AES-CTR. These algorithms achieve strict consistency in the total length of the message before and after encryption by performing bitwise XOR or feedback transformation on the original data payload without introducing additional padding or authentication tags.

13. The method according to claim 12, characterized in that, Supported encryption algorithms also include Authentication-Associated Encryption (AEAD) algorithms, including: Chinese national cryptographic standard SM4-GCM, SM4-CBC, AES-GCM, AES-CBC, or ChaCha20-Poly1305; when the AEAD algorithm is selected, the total message length is maintained by sacrificing part of the payload space to accommodate the authentication tag or by using the message gaps to carry authentication information.

14. The method according to claim 12, characterized in that, Supported encryption algorithms also include Authentication-Affiliated Encryption (AEAD) algorithms, including: Chinese national cryptographic standards SM4-GCM, SM4-CBC, AES-GCM, AES-CBC, or ChaCha20-Poly1305. When using the AEAD algorithm, the message length will normally increase by several bytes. To prevent the message length from exceeding the MTU limit, TCP MSS Clamping (i.e., TCP maximum segment length clamping) technology is used in conjunction.

15. The method according to claim 1, characterized in that, The deployment methods of the link encryption device include serial deployment as a Layer 2 bridge, bypass deployment with policy-based routing, or virtualization deployment as a virtual machine / container connecting to a virtual switch.

16. The method according to claim 1, characterized in that, This includes a compatibility handling mechanism with existing BGP devices, attribute identification by using the unassigned Sub-Type range of IANA and adding vendor-specific identifiers, a downgrade process that automatically ignores attributes and records alarms when the peer does not support them, and a version compatibility mechanism that achieves backward compatibility through a version field.

17. The method according to claim 1, characterized in that, It also includes performance monitoring and statistics functions, used to count encryption throughput, latency, hardware utilization, monitor encryption association lifecycle and negotiation status, and detect encryption / decryption failure rate and attribute parsing anomalies and trigger alarms.

18. The method according to claim 1, characterized in that, It is applicable to one or more scenarios in data center interconnect (DCI), enterprise leased line encryption, cloud network interconnect, 5G backhaul network and industrial control network.

Images