Method and system for realizing two-layer link encryption based on routing drainage in cloud environment

Abstract

The invention discloses a method and a system for realizing two-layer link encryption based on routing drainage in a cloud environment. The invention provides a non-intrusive drainage encryption scheme for solving the problems that two-layer link encryption equipment in an existing cloud environment cannot utilize a virtual switch standard route for drainage due to lack of a three-layer network identifier, and an existing solution needs to intrusively modify a cloud platform bottom layer code. According to the method, a miniature protocol stack is constructed in a link encryption device, a virtual IP address and a virtual MAC address for drainage are configured, only an ARP protocol and an ICMP protocol are responded, and a three-layer virtual switch recognizes the link encryption device as a next-hop gateway. And the three-layer virtual switch guides an original data packet to the link encryption device according to a routing rule, and the device performs link layer encryption on the data packet and then transmits the data packet through a specified interface in an unvarnished transmission manner. According to the method, a cloud platform network architecture does not need to be modified, the method is compatible with a mainstream virtual switch, and low-cost and non-perception link layer encryption integration in a cloud environment is realized.

Description

Technical Field

[0001] This invention relates to the field of computer network security technology, and in particular to a method and system for achieving transparent encryption of Layer 2 links through a Layer 3 routing and forwarding mechanism in a cloud computing virtualization environment. Background Technology

[0002] In traditional hardware network environments, link encryption machines typically operate at Layer 2 of the OSI model (data link layer), transparent to the upper network layers, and therefore usually do not require IP address configuration. However, with the migration of business to the cloud, deploying link encryption functionality in cloud virtual machine environments (such as OpenStack, Kubernetes, etc.) faces significant challenges: 1. Traffic redirection difficulties: Traffic forwarding in cloud environments primarily relies on the Layer 3 routing functionality of virtual switches (vSwitch). Because traditional Layer 2 link encryption logic lacks IP and MAC addresses, virtual switches cannot redirect traffic through encrypted nodes using standard routing table entries. 2. Deficiencies of Existing Solutions: To address the traffic redirection issue, existing technologies typically require modifying the underlying network code of the cloud platform (such as modifying the Neutron plugin) or introducing complex SDN controllers for flow table programming. These methods are not only costly to develop and risky to deploy, but also compromise the standardization and stability of the cloud platform, making upgrades and maintenance difficult. Therefore, there is an urgent need for a cloud environment link encryption solution that does not require modification of the underlying cloud platform architecture and is compatible with mainstream virtual switch routing mechanisms. Summary of the Invention

[0003] The purpose of this invention is to provide a method for achieving Layer 2 link encryption based on routing in a cloud environment. This invention implements a miniature protocol stack within the link encryption device, making it appear as a "gateway" device with a standard IP / MAC address on the control plane. This allows it to utilize the cloud platform's existing ARP discovery and routing mechanisms to redirect traffic; while on the data plane, the device maintains its Layer 2 transparent encryption characteristics. The core technical solution of this invention is as follows: A method for implementing Layer 2 link encryption based on routing in a cloud environment, characterized in that the method includes the following steps: S1. Deployment steps: Deploy at least one link encryption device in the cloud environment. The link encryption device is configured with at least one internal network interface (LAN) and one external network interface (WAN), and runs a micro network protocol stack. S2. Misleading and Guiding Step: The link encryption device configures a virtual IP address and a virtual MAC address through the micro network protocol stack, receives an Address Resolution Protocol (ARP) request from the Layer 3 virtual switch, and sends an ARP response, causing the Layer 3 virtual switch to update its ARP cache table and direct the next hop of the target traffic to the link encryption device. S3. Routing and forwarding steps: The Layer 3 virtual switch forwards the original data packets sent by the cloud virtual machine to the intranet interface of the link encryption device according to the preset routing rules; S4. Encryption Processing Step: After receiving the original data packet, the link encryption device performs link-layer encryption processing on it to generate a ciphertext data packet; S5. Transparent transmission step: The link encryption device sends the encrypted data packet to the peer network device or the next-hop node through the external network interface. The beneficial effects of this invention are as follows: 1. Zero intrusion: It does not require modification of the underlying network code of cloud platforms (such as OpenStack / K8s) and can work using standard routing protocols, significantly reducing integration risks. 2. Strong compatibility: Suitable for various virtualization environments that support custom routing, without relying on a specific SDN controller brand. 3. Flexible deployment: Supports virtual machine or containerized deployment, multi-tenant isolation and dynamic high availability switching, adapting to the elasticity requirements of cloud environments. Attached Figure Description Figure 1 This is a schematic diagram of the data flow for implementing Layer 2 link encryption based on routing in a cloud environment, as described in this invention. Figure 2 This is a schematic diagram illustrating the data flow of the present invention in a cloud environment, which implements Layer 2 link encryption based on routing and redirection and then flows back to the virtual Layer 3 device. Detailed Implementation The technical solution of the present invention will be further described below with reference to the accompanying drawings and specific embodiments. Example 1: Straight-through mode Figure 1 As shown in the figure, this embodiment describes a scenario where the encrypted data is directly sent to the peer device. 1. Initialization phase: The link encryption system starts the micro protocol stack and configures the virtual IP (e.g., 192.168.1.254) and virtual MAC. 2. Routing configuration: Configure routing rules in the network controller of the cloud platform to point the next hop of the destination network segment (e.g., 10.0.0.0 / 8) to the virtual IP. 3. ARP Induction: The Layer 3 virtual switch initiates an ARP request to inquire "who is 192.168.1.254?" The link encryption system replies with its own virtual MAC address via a miniature protocol stack. The switch then updates its ARP table. 4. Data flow: a. Cloud virtual machine sends data packets -> Layer 3 virtual switch looks up the table -> routing rule is hit -> forwards to the LAN port of the link encryption system. b. Key step: The link encryption system captures the message. Although the message is destined for the next hop, the encryption system intercepts it at Layer 2 and encrypts the payload using a built-in encryption module (such as SM4). c. The encrypted message is sent directly to the peer physical network device through the WAN port. Example 2: Reflow mode as follows Figure 2 As shown in the figure, this embodiment describes a scenario where encrypted data needs to be sent back to a virtual switch for secondary forwarding. The main difference lies in step (i): the link encryption system re-injects the encrypted message into a Layer 3 virtual switch (or another independent virtual network) through the WAN port, and the switch forwards it to the remote end according to the outer tunnel encapsulation or new routing rules. This is suitable for encrypted transmission scenarios across VPCs or across clouds.

Claims

1. A method for implementing Layer 2 link encryption based on routing in a cloud environment, characterized in that, The method includes the following steps: S1. Deployment steps: Deploy at least one link encryption device in the cloud environment. The link encryption device is configured with at least one internal network interface (LAN) and one external network interface (WAN), and runs a micro network protocol stack. S2. Misleading and Guiding Step: The link encryption device configures a virtual IP address and a virtual MAC address through the micro network protocol stack, receives an Address Resolution Protocol (ARP) request from the Layer 3 virtual switch, and sends an ARP response, causing the Layer 3 virtual switch to update its ARP cache table and direct the next hop of the target traffic to the link encryption device. S3. Routing and forwarding steps: The Layer 3 virtual switch forwards the original data packets sent by the cloud virtual machine to the intranet interface of the link encryption device according to the preset routing rules; S4. Encryption Processing Step: After receiving the original data packet, the link encryption device performs link-layer encryption processing on it to generate a ciphertext data packet; S5. Transparent transmission step: The link encryption device sends the encrypted data packet to the peer network device or the next-hop node through the external network interface.

2. The method according to claim 1, characterized in that, The micro network protocol stack contains only functional modules for processing ARP and ICMP protocols, used to establish network connectivity identifiers. The virtual IP address and virtual MAC address are only used for traffic guidance and do not participate in the logical addressing of encrypted service data.

3. The method according to claim 1, characterized in that, The link encryption device is deployed as a virtual machine (VM) instance or a container instance; the method also includes running multiple instances of the link encryption device in parallel on a single physical host, each instance corresponding to a different tenant or security domain, to achieve multi-tenant isolated link encryption service.

4. The method according to claim 1, characterized in that, The method also includes a high availability guarantee step: the link encryption device supports dynamic updating of the virtual IP address and virtual MAC address, and notifies the Layer 3 virtual switch to update the ARP cache by actively sending gratuitous ARP messages, so as to achieve fault switching or load balancing of the link encryption service.

5. The method according to claim 1, characterized in that, In the transparent transmission step, the transmission target of the external network interface includes one of the following two modes: (1) Mode 1: Direct physical pass-through to the peer physical network device; (2) Mode 2: The data is sent back to the Layer 3 virtual switch, which then forwards it to the other end according to the routing rules.

6. A system for implementing Layer 2 link encryption based on routing in a cloud environment, characterized in that, include: (1) Cloud virtual machine, used to generate raw business data packets; (2) A Layer 3 virtual switch is used to configure routing rules, send ARP requests, update the cache table according to the ARP response, and route the original service data packets to the next hop; (3) Link encryption device, connected to the Layer 3 virtual switch, is configured to: initialize virtual IP address and virtual MAC address; run micro protocol stack to respond to ARP request from the Layer 3 virtual switch; receive the original data packet and perform link layer encryption; and send the encrypted data packet through the external network interface.

Images