Network security protection method and device for Ethernet, equipment and medium

Abstract

The invention discloses a network security protection method and device for Ethernet, equipment and a medium, relates to the technical field of data communication, is applied to a link cipher machine deployed on the periphery of the Ethernet, and comprises the following steps: determining a first virtual local area network, and sending a first service data message to a first security entity so as to match a first security policy; if the strategy is a plaintext forwarding strategy, sending the first service data message to the peripheral equipment; if the strategy is a security protection strategy, determining a security channel type; performing first security label packaging and encryption processing on the first service data message according to the security alliance of the security channel type, and sending the first processed message to the peripheral equipment; determining a second virtual local area network, sending the second service data message to a second security entity, and performing security processing operation on the second service data message to obtain a second processed message; and sending or discarding the second processed message according to the second security policy. And the security protection of the service data is realized.

Description

Technical Field

[0001] This invention relates to the field of data communication technology, and in particular to a method, apparatus, device, and medium for network security protection of Ethernet. Background Technology

[0002] Ethernet is a widely used data communication network with advantages such as simple deployment, low cost, and high communication speed. However, a drawback of Ethernet communication is that business data is transmitted in plaintext, which lacks security.

[0003] Ethernet lines are susceptible to signal leakage, especially in scenarios with long-distance lines where physical security cannot be guaranteed. In scenarios with virtual lines or virtual networks, compromised intermediate devices can lead to unauthorized interception or injection of packets. Similarly, compromised physical switches also pose a risk of unauthorized packet interception or injection. Therefore, methods for protecting the confidentiality, integrity, and replay resistance of Ethernet communication data are needed to achieve network security protection for Ethernet networks.

[0004] Cryptographic techniques are generally used to protect network communication data. Current protection technologies are mainly divided into application layer, transport layer, network layer, and data link layer. Application layer protection and transport layer protection technologies generally have direct requirements for application design or require upgrades to new software systems; network layer protection technologies generally require the use of network IP (Internet Protocol) addresses, which can impact existing network planning. In some scenarios, application layer, transport layer, and network layer protection technologies cannot be implemented or are too costly to implement, necessitating data link layer protection technologies.

[0005] Therefore, how to protect the network security of Ethernet is an urgent problem to be solved. Summary of the Invention

[0006] In view of this, the purpose of this invention is to provide a method, apparatus, device, and medium for Ethernet network security protection, capable of providing security protection for service data transmitted throughout the entire Ethernet network without affecting normal network data exchange, and achieving a transparent security protection upgrade for existing Ethernet networks. The specific solution is as follows: In a first aspect, this application discloses a network security protection method for Ethernet, applied to a link cryptographic machine deployed on the periphery of the Ethernet network, comprising: After receiving a plaintext packet at the plaintext interface, the first virtual local area network corresponding to the plaintext interface is determined, and the first service data packet in the plaintext packet is sent to the first security entity corresponding to the first virtual local area network, so that the first security entity can match the corresponding first security policy according to the information in the first service data packet. If the first security policy is a plaintext forwarding policy, then the first service data packet is directly sent to the Ethernet peripheral device; If the first security policy is a security protection policy, then the security channel type of the first security entity is determined according to the type of the destination LAN address of the first service data packet and the target LAN address table. According to the security association corresponding to the security channel type, the first service data packet is encapsulated and encrypted with the corresponding first security label, and the corresponding first processed packet is sent to the peripheral device of the Ethernet through the ciphertext interface corresponding to the first security entity to complete the service data transmission. After receiving the ciphertext packet at the ciphertext interface, the second virtual local area network (VLAN) corresponding to the ciphertext interface is determined. The second service data packet in the ciphertext packet is sent to the second security entity corresponding to the second VLAN. The second security entity performs corresponding security processing operations on the second service data packet according to the security association recorded in the second security label corresponding to the second service data packet, obtains the second processed packet, and records the correspondence between the source VLAN address of the second service data packet and the source security entity in the target VLAN address table. Based on the second security policy matched with the information in the second processed message, the second processed message is sent or discarded accordingly to complete the business data transmission.

[0007] Optionally, after sending the first service data packet in the plaintext packet to the first security entity corresponding to the first virtual local area network, so that the first security entity matches the corresponding first security policy based on the information in the first service data packet, the method further includes: If no match is found with the first security policy, the first service data packet is discarded directly.

[0008] Optionally, determining the security channel type of the first security entity based on the type of the destination LAN address of the first service data packet and the target LAN address table includes: If the destination LAN address of the first service data packet is a broadcast address, then the security channel type of the first security entity is a broadcast security channel; If the destination LAN address of the first service data packet is a unicast address. Then check if the destination LAN address of the first service data packet exists in the target LAN address table of the first security entity; If it exists, then the security channel type of the first security entity is a unicast security channel; If it does not exist, then the security channel type of the first security entity is a broadcast security channel; If the destination LAN address of the first service data packet is a multicast address, then the security channel type of the first security entity is a broadcast security channel.

[0009] Optionally, the step of encapsulating and encrypting the first service data packet with a corresponding first security label according to the security association corresponding to the security channel type includes: If the security channel type of the first security entity is a broadcast security channel, then the first service data packet is encapsulated and encrypted with the corresponding first security label based on the security association in the broadcast security channel; If the security channel type of the first security entity is a unicast security channel, the first service data packet is encapsulated and encrypted with the corresponding first security label based on the security association in the unicast security channel.

[0010] Optionally, the method further includes: If the encrypted interface receives a plaintext packet, the plaintext packet is matched against a security policy by the second security entity. If a plaintext forwarding policy is matched, the service data packet corresponding to the plaintext packet is directly sent to the Ethernet-using device through the plaintext interface; otherwise, the plaintext packet is discarded.

[0011] Optionally, sending the second service data packet in the encrypted packet to the second security entity corresponding to the second virtual LAN, so that the second security entity performs corresponding security processing operations on the second service data packet according to the security association recorded in the second security tag corresponding to the second service data packet, to obtain a second processed packet, includes: The second service data packet in the encrypted packet is sent to the second security entity corresponding to the second virtual LAN, so that the second security entity sends the second service data packet to the preset security component according to the security association recorded in the second security tag corresponding to the second service data packet. The second security tag is parsed by the preset security component. The target security alliance is queried according to the security channel identifier and security alliance identifier in the second security tag. The second service data packet is decrypted and its integrity is verified according to the key in the target security alliance to obtain the decrypted packet and the verification result. If the verification fails, the second service data packet will be discarded directly. If the verification is successful, the security tag encapsulation corresponding to the decrypted message is removed to obtain the second processed message.

[0012] Optionally, the step of sending or discarding the second processed message according to the second security policy matched based on the information in the second processed message includes: If the information in the second processed message matches the second security policy which is a no-forwarding policy, then the second processed message is discarded directly. Otherwise, the second processed message is sent to the Ethernet-using device through the plaintext interface corresponding to the second security entity.

[0013] Secondly, this application discloses an Ethernet network security protection device, applied to a link cryptographic machine deployed on the periphery of an Ethernet network, comprising: The first security policy matching module is used to determine the first virtual local area network corresponding to the plaintext interface after receiving a plaintext packet at the plaintext interface, and send the first service data packet in the plaintext packet to the first security entity corresponding to the first virtual local area network, so that the first security entity can match the corresponding first security policy according to the information in the first service data packet. The first service data packet sending module is used to directly send the first service data packet to the Ethernet peripheral device if the first security policy is a plaintext forwarding policy. The security channel type determination module is used to determine the security channel type of the first security entity based on the type of the destination LAN address of the first service data packet and the target LAN address table if the first security policy is a security protection policy. The first processed message sending module is used to encapsulate and encrypt the first service data message with a corresponding first security label according to the security association corresponding to the security channel type, and send the corresponding first processed message to the peripheral device of the Ethernet through the ciphertext interface corresponding to the first security entity to complete the service data transmission. The second service data packet sending module is used to determine the second virtual local area network corresponding to the ciphertext interface after receiving the ciphertext packet at the ciphertext interface, and send the second service data packet in the ciphertext packet to the second security entity corresponding to the second virtual local area network. The second security entity performs corresponding security processing operations on the second service data packet according to the security association recorded in the second security label corresponding to the second service data packet to obtain the second processed packet, and records the correspondence between the source local area network address of the second service data packet and the source security entity in the target local area network address table. The second processed message processing module is used to perform corresponding sending or discarding operations on the second processed message according to the second security policy matched by the information in the second processed message, so as to complete the business data transmission.

[0014] Thirdly, this application discloses an electronic device, including: Memory, used to store computer programs; A processor is used to execute computer programs to implement network security protection methods for Ethernet as described above.

[0015] Fourthly, this application discloses a computer-readable storage medium storing a computer program, which, when executed by a processor, implements the aforementioned Ethernet network security protection method.

[0016] In this application, after receiving a plaintext packet at a plaintext interface, a link cryptographic machine deployed on the Ethernet periphery determines the first virtual local area network (VLAN) corresponding to the plaintext interface and sends the first service data packet in the plaintext packet to the first security entity corresponding to the first VLAN. The first security entity then matches the corresponding first security policy based on the information in the first service data packet. If the first security policy is a plaintext forwarding policy, the first service data packet is directly sent to the Ethernet peripheral device. If the first security policy is a security protection policy, the security channel type of the first security entity is determined based on the type of the destination VLAN address of the first service data packet and the target VLAN address table. The first service data packet is then encapsulated and encrypted with a corresponding first security label according to the security association corresponding to the security channel type. After processing, the message is sent to the peripheral device of the Ethernet via the ciphertext interface corresponding to the first security entity to complete the service data transmission. Upon receiving the ciphertext packet at the ciphertext interface, the second virtual LAN corresponding to the ciphertext interface is determined, and the second service data message in the ciphertext packet is sent to the second security entity corresponding to the second virtual LAN. The second security entity then performs corresponding security processing operations on the second service data message according to the security association recorded in the second security tag corresponding to the second service data message, obtaining a second processed message. The correspondence between the source LAN address and the source security entity of the second service data message is recorded in the target LAN address table. Based on the second security policy matched by the information in the second processed message, the second processed message is sent or discarded accordingly to complete the service data transmission. Therefore, this application designs a link cryptographic machine deployed on the periphery of the protected Ethernet. All service data messages entering the Ethernet are encrypted by the link cryptographic machine, and encrypted service data messages leaving the Ethernet are decrypted by the link cryptographic machine before being sent to devices outside the Ethernet. It can provide secure protection for service data transmitted throughout the entire Ethernet network without affecting normal data exchange, solving the problem that existing link-layer protection technologies can only protect individual lines due to limitations in protocol design, operating costs, energy consumption, and performance. By deploying link encryption devices at the periphery, it achieves a transparent security upgrade for existing Ethernet networks. Attached Figure Description

[0017] To more clearly illustrate the technical solutions in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0018] Figure 1This is a flowchart of a network security protection method for Ethernet disclosed in this application; Figure 2 This is a schematic diagram of a secure communication model disclosed in this application; Figure 3 This is a schematic diagram of a message processing flow disclosed in this application; Figure 4 This is a schematic diagram of the structure of an Ethernet network security protection device disclosed in this application; Figure 5 This is a structural diagram of an electronic device disclosed in this application. Detailed Implementation

[0019] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0020] Currently, MACSec (Media Access Control Security) is the most widely used Ethernet link layer protection technology. The main drawback of MACSec is that it is a Layer 2 point-to-point protocol, meaning it cannot span Ethernet switches and can only protect a single Ethernet line, not the entire network.

[0021] To use MACSec for full Ethernet network protection, all ports on all switches in the network must support the MACSec protocol. Packets must be encrypted and decrypted at each switch during forwarding. Furthermore, because MACSec only supports key segmentation based on a pair of secure entities and not on broadcast domains, broadcast packets or unicast or multicast packets requiring flooding must be encrypted individually for each forwarding port. It's clear that deploying MACSec across the entire Ethernet network introduces a series of problems: significantly increased network deployment costs; increased packet forwarding latency and decreased throughput; and a substantial increase in overall network energy consumption, leading to higher operating costs.

[0022] Therefore, MACSec can only be used on certain specific lines in an Ethernet network to achieve security protection on the line between a pair of Ethernet ports, and cannot be used for the entire network protection of a moderately large Ethernet network. Due to the characteristics of the MACSec protocol, current network devices generally only support the MACSec protocol on certain ports. Therefore, if you want to upgrade the security protection of an existing Ethernet network, you often need to replace the original equipment, making transparent upgrades difficult. To solve the above technical problems, this application discloses a network security protection method, apparatus, device, and medium for Ethernet, which can achieve security protection for service data transmitted throughout the entire Ethernet network without affecting normal network data exchange, and achieve transparent security protection upgrades for existing Ethernet networks.

[0023] See Figure 1 As shown, this embodiment of the invention discloses a network security protection method for Ethernet, applied to a link cryptographic machine deployed on the periphery of the Ethernet network, comprising: Step S11: After receiving the plaintext packet at the plaintext interface, determine the first virtual local area network corresponding to the plaintext interface, and send the first service data packet in the plaintext packet to the first security entity corresponding to the first virtual local area network, so that the first security entity can match the corresponding first security policy according to the information in the first service data packet.

[0024] In this embodiment, a link cryptographic machine is designed and deployed on the periphery of the protected Ethernet, such as... Figure 2As shown, all incoming Ethernet service data packets are encrypted by the LinkSec, and all encrypted service data packets leaving the Ethernet are decrypted by the LinkSec before being sent to devices outside the Ethernet. The LinkSec is uniquely identified by a device ID (LSID). LinkSec only performs encryption / decryption, integrity verification, and replay protection on traffic passing through it; it does not modify MAC (Media Access Control Address) addresses, add or remove VLAN tags, or perform any other processing that might affect the operation of the protected Ethernet internal switches. The Ethernet network protected by LinkSec is called the protected network. The protected network can be a complete Ethernet, a portion of an Ethernet network enclosed by multiple LinkSecs, or a single line protected at both ends by two LinkSecs. When there are switches in the protected network, it is called network protection; when there is only one line in the protected network, that is, only a network cable between two LinkSecs without a switch, it can be called line protection. This invention applies to both line protection and network protection scenarios; the following descriptions will include network protection and will not specifically address line protection. LinkSec is deployed around the perimeter of the protected network. All entry and exit points around the protected network are connected in series with LinkSec, and traffic within the protected network must enter and exit through the surrounding LinkSec connections. Traffic entering the protected network is encrypted by LinkSec, and traffic leaving the protected network is decrypted by LinkSec. Each LinkSec connection around the protected network is configured with a unique LSID. Broadcast Domain: The protected network can be divided into multiple broadcast domains, using standard Ethernet VLAN (Virtual Local Area Network) partitioning methods such as 802.1Q VLANs or port-based VLANs. One VLAN corresponds to one broadcast domain. Alternatively, the protected network can be configured without VLANs, resulting in a single broadcast domain for the entire protected network.

[0025] In this embodiment, when a plaintext interface receives a plaintext packet, it forwards the packet to the SecY (Security Entity) corresponding to the VLAN where the interface resides, based on the binding relationship between the VLAN and the SecY. Then, the security policy component in the SecY entity matches a security policy based on the information in the packet. In other words, after receiving a plaintext packet, the plaintext interface determines the first virtual LAN corresponding to the plaintext interface and sends the first service data packet in the plaintext packet to the first security entity corresponding to the first virtual LAN, so that the first security entity matches the corresponding first security policy based on the information in the first service data packet. Here, a Security Entity (SecY): A LinkSec can be divided into multiple SecYs, and there is a one-to-one correspondence between a SecY and a broadcast domain (VLAN). When a LinkSec protects multiple VLANs, a SecY is created for each VLAN. A SecY contains one and only two interfaces: one encrypted interface connected to the protected network or line, and one plaintext interface connected to an external network or device. A SecY always receives ciphertext packets from the ciphertext interface, decrypts them, and then sends them out through the plaintext interface; conversely, it receives plaintext packets from the plaintext interface, encrypts them, and then sends them out through the ciphertext interface. Multiple SecYs within a LinkSec are isolated from each other; encrypted and decrypted data is not shared between them. All LinkSec functionality is implemented through SecYs, and packets are only encrypted / decrypted and forwarded between two fixed interfaces within the SecY, without cross-SecY switching based on MAC addresses or VLANs. The SecY identifier required for encrypted data processing directly borrows the LSID.

[0026] If no match is found with the first security policy, the first service data packet is discarded. In other words, if a packet does not match a security policy, the packet is discarded.

[0027] Step S12: If the first security policy is a plaintext forwarding policy, then the first service data packet is directly sent to the Ethernet peripheral device.

[0028] In this embodiment, if the plaintext transmission policy is met, the plaintext message needs to be sent, that is, the first service data message is directly sent to the Ethernet peripheral device.

[0029] Step S13: If the first security policy is a security protection policy, then determine the security channel type of the first security entity based on the type of the destination LAN address of the first service data packet and the target LAN address table.

[0030] In this embodiment, if the security protection policy is met, the packet enters the outbound security component for security protection. In the working principle of an Ethernet switch, the packet forwarding rules consist of the following: 1. After a message is received from the interface, the correspondence between the source MAC address of the message and the incoming interface is recorded in the MAC address table; 2. If the destination MAC address of the received message is a broadcast address, the message will be forwarded to all other interfaces in the broadcast domain except the incoming interface; 3. If the destination MAC address of the received message is a multicast address, the message will be forwarded to all other interfaces of the multicast group in the broadcast domain except for the incoming interface. 4. If the destination MAC address of the received message is a unicast address, the MAC address table is queried for the interface corresponding to that unicast address. If the record is found, the message is forwarded to the recorded interface; otherwise, the message is flooded to all other interfaces in the broadcast domain except the incoming interface.

[0031] As can be seen, Ethernet switch packet forwarding is divided into two categories: unicast and broadcast (if multicast is also simplified and classified as broadcast). Unicast relies on learning the MAC address table, while broadcast packets contain not only broadcast destination addresses but also unicast destination addresses (and multicast addresses). Therefore, in this process, if the destination LAN address of the first service data packet is a broadcast address, then the security channel type of the first security entity is a broadcast security channel; if the destination LAN address of the first service data packet is a unicast address, then the security entity checks whether the destination LAN address of the first service data packet exists in its target LAN address table; if it exists, then the security channel type of the first security entity is a unicast security channel; if it does not exist, then the security channel type of the first security entity is a broadcast security channel; if the destination LAN address of the first service data packet is a multicast address, then the security channel type of the first security entity is a broadcast security channel.

[0032] Within a broadcast domain, a unidirectional channel (or security channel) is a one-way channel from one SecY to another. A unicast security channel is uniquely identified by the tuple [source LSID, destination LSID]. Bidirectional communication between two SecYs requires a unicast security channel in each direction. A broadcast channel, broadcast from one SecY to all other SecYs within the same broadcast domain, is called a broadcast security channel, identified by [source LSID, 0xff], where 0xff is a reserved broadcast LSID. Broadcast security channels only send messages from the source SecY; there are no reverse messages, therefore no corresponding reverse security channel. In summary, within a broadcast domain, each SecY has two unicast security channels (one for sending and one for receiving) with every other SecY, and each SecY also has a broadcast security channel in the sending direction.

[0033] Step S14: According to the security association corresponding to the security channel type, the first service data packet is encapsulated and encrypted with the corresponding first security label, and the corresponding first processed packet is sent to the peripheral device of the Ethernet through the ciphertext interface corresponding to the first security entity to complete the service data transmission.

[0034] In this embodiment, under network protection scenarios, a message encrypted by a link cryptographic machine may be unicast to a specific link cryptographic machine for decryption, or it may be broadcast to all other link cryptographic machines in the broadcast domain for decryption. If unicast and broadcast are not distinguished, all link cryptographic machines in the entire broadcast domain use the same key, and the encryption and decryption process can succeed. However, this method of splitting the key according to the broadcast domain has very low security. Therefore, this invention designs two secure channels: broadcast and unicast. Key splitting is performed according to the secure channel, and the key is only shared among the SecYs within the secure channel. Therefore, if the secure channel type of the first security entity is a broadcast secure channel, the first service data packet is encapsulated and encrypted with the corresponding first security label based on the security association in the broadcast secure channel; if the secure channel type of the first security entity is a unicast secure channel, the first service data packet is encapsulated and encrypted with the corresponding first security label based on the security association in the unicast secure channel. In other words, if the destination MAC address of a plaintext packet received from the plaintext interface is a broadcast address, then the Security Association (SA) in the broadcast security channel of this SecY (source LSID is the local LSID, destination LSID is 0xff) is selected for encapsulation, encryption, and other security processing, and then it is sent out from the ciphertext interface corresponding to this SecY. If the destination MAC address of a plaintext packet received from the plaintext interface is a multicast address, it is simplified and processed the same as a broadcast address. If the destination MAC address of a plaintext packet received from the plaintext interface is a unicast address, then the SecY corresponding to the unicast address is queried in the MAC address table of this SecY. If a record is found, the SA in the unicast security channel of this SecY (source LSID is the local LSID, destination LSID is the LSID found in the MAC address table) is selected for encapsulation, encryption, and other security processing. Otherwise, the SA in the broadcast security channel of this SecY (source LSID is the local LSID, destination LSID is 0xff) is selected for encapsulation, encryption, and other security processing. In both cases, the securely processed packets are finally sent out from the ciphertext interface corresponding to this SecY. In this way, by distinguishing between broadcast security channels and unicast security channels and performing key segmentation according to the security channels, the binding relationship between messages and security channels is realized, as well as the security protection of key segmentation according to security channels, which enhances the security of service data in Ethernet. It realizes network protection of Ethernet, not just line protection. After the service data messages are encrypted, they can still be unicasted or flooded in the protected network in a normal manner.

[0035] Within a secure channel (broadcast or unicast), the actual entity implementing secure communication is the Security Association (SA). The SA is generated through a key negotiation protocol between SecYs or locally within a SecY according to rules or management configuration. The SA contains its associated secure channel identifier (a [source LSID, destination LSID] tuple, where the destination LSID is 0xff in a broadcast channel), the SA identifier, and other relevant information such as the key required for security protection. A secure channel can have multiple SAs to implement more services or security functions, such as smooth key switching and QoS (Quality of Service). An SA can be uniquely identified by combining the [source LSID, destination LSID] tuple with the SA identifier. Security Tag (SecTAG): When encrypting messages, the SecY adds a plaintext security tag (SecTAG) to the message. The SecTAG contains information such as the channel identifier (a [source LSID, destination LSID] tuple), the SA identifier, and other information required for security functions (e.g., the IV required for encryption / decryption, information for replay protection and integrity protection, etc.). When decrypting a message, SecY finds the corresponding SA based on the SecTAG in the message, and then implements security functions based on the SA, such as message integrity verification, anti-replay check, and decryption.

[0036] Step S15: After receiving the ciphertext packet at the ciphertext interface, determine the second virtual local area network (VLAN) corresponding to the ciphertext interface, and send the second service data packet in the ciphertext packet to the second security entity corresponding to the second VLAN. The second security entity then performs corresponding security processing operations on the second service data packet according to the security association recorded in the second security label corresponding to the second service data packet, obtains the second processed packet, and records the correspondence between the source VLAN address of the second service data packet and the source security entity in the target VLAN address table.

[0037] In this embodiment, when a packet is received at the encrypted interface, it is passed to the SecY entity corresponding to the VLAN based on the binding relationship between the VLAN where the interface is located and the SecY. The second service data packet in the encrypted packet is sent to the second security entity corresponding to the second virtual LAN, so that the second security entity sends the second service data packet to a preset security component according to the security association recorded in the second security tag corresponding to the second service data packet. The preset security component parses the second security tag, queries the target security association based on the security channel identifier and security association identifier in the second security tag, and performs decryption and integrity verification based on the second service data packet and the key in the target security association to obtain the decrypted packet and the verification result. If the verification fails, the second service data packet is discarded directly; if the verification succeeds, the security tag encapsulation corresponding to the decrypted packet is removed to obtain the second processed packet. That is, if the encrypted interface receives an encrypted packet, the SecY passes the encrypted packet to its inbound security component for processing. The inbound security component parses the SecTAG encapsulation of the message, queries the inbound SA based on the secure channel identifier and SA identifier in the message SecTAG, performs security processing such as replay checks based on the SA, and then passes the message and the key in the SA to the cryptographic module for cryptographic operations such as hashing and decryption. After completing the cryptographic operations, the cryptographic module returns the message to the inbound security component. The inbound security component performs subsequent operations; if the integrity verification result returned by the cryptographic module fails, the message is discarded; otherwise, the inbound security component removes the SecTAG encapsulation of the message and then passes the message to the security policy component.

[0038] After the encrypted message is received from the ciphertext interface, SecY performs security processing such as decryption, verification, and anti-replay according to the security channel (which may be a unicast security channel or a broadcast security channel) and SA recorded in SecTAG. If the security processing is successful, the MAC address of the encrypted message source and the source SecY (identified by the source LSID in SecTAG) are recorded in the MAC address table of this SecY.

[0039] Furthermore, if the encrypted interface receives a plaintext packet, the second security entity performs security policy matching on the plaintext packet. If a plaintext forwarding policy is matched, the service data packet corresponding to the plaintext packet is directly sent to the Ethernet-using device through the plaintext interface; otherwise, the plaintext packet is discarded. In other words, if the encrypted interface receives a plaintext packet, the SecY needs to send the plaintext packet to its security policy component for security policy matching. If the matched policy indicates plaintext forwarding, the packet is sent as is through the plaintext interface; otherwise, the packet is discarded.

[0040] Step S16: Based on the second security policy matched with the information in the second processed message, perform corresponding sending or discarding operations on the second processed message to complete the data transmission of the service.

[0041] In this embodiment, if the second security policy matched with the information in the second processed message is a no-forwarding policy, the second processed message is discarded directly; otherwise, the second processed message is sent to the Ethernet-using device through the plaintext interface corresponding to the second security entity. That is, the security policy component matches a security policy based on the information in the message; if the matched policy prohibits forwarding the message, the message is discarded; otherwise, the message is sent out through the plaintext interface corresponding to this SeCY instance.

[0042] In summary, in this application, after receiving a plaintext packet at a plaintext interface, the link cryptographic machine deployed on the Ethernet periphery determines the first virtual local area network (VLAN) corresponding to the plaintext interface and sends the first service data packet in the plaintext packet to the first security entity corresponding to the first VLAN. The first security entity then matches the corresponding first security policy based on the information in the first service data packet. If the first security policy is a plaintext forwarding policy, the first service data packet is directly sent to the Ethernet peripheral device. If the first security policy is a security protection policy, the security channel type of the first security entity is determined based on the type of the destination VLAN address of the first service data packet and the target VLAN address table. The first service data packet is then encapsulated and encrypted with a corresponding first security label according to the security association corresponding to the security channel type. The first processed message is sent to the peripheral device of the Ethernet through the ciphertext interface corresponding to the first security entity to complete the service data transmission. After receiving the ciphertext packet at the ciphertext interface, the second virtual LAN corresponding to the ciphertext interface is determined, and the second service data packet in the ciphertext packet is sent to the second security entity corresponding to the second virtual LAN. The second security entity performs corresponding security processing operations on the second service data packet according to the security association recorded in the second security label corresponding to the second service data packet, obtains the second processed message, and records the correspondence between the source LAN address of the second service data packet and the source security entity in the target LAN address table. According to the second security policy matched by the information in the second processed message, the second processed message is sent or discarded accordingly to complete the service data transmission. It can be seen that this application designs a link cryptographic machine deployed on the periphery of the protected Ethernet. All service data packets entering the Ethernet are encrypted by the link cryptographic machine, and encrypted service data packets leaving the Ethernet are decrypted by the link cryptographic machine before being sent to devices outside the Ethernet. It can provide secure protection for service data transmitted throughout the entire Ethernet network without affecting normal data exchange, solving the problem that existing link-layer protection technologies can only protect individual lines due to limitations in protocol design, operating costs, energy consumption, and performance. By deploying link encryption devices at the periphery, it achieves a transparent security upgrade for existing Ethernet networks.

[0043] As described in the previous embodiment, this application discloses a network security protection method for Ethernet, which can achieve a transparent security upgrade for existing Ethernet networks by deploying a link encryption device on the periphery. The specific message processing process will be described in detail below.

[0044] The links-based cryptographic machine's interfaces are divided by VLANs, with each VLAN containing one plaintext interface and one ciphertext interface. Packet processing and forwarding occur within their respective VLANs. Forwarding always involves receiving plaintext through the plaintext interface, encrypting it, and then sending it through the ciphertext interface; or receiving ciphertext through the ciphertext interface, decrypting it, and then sending it through the plaintext interface. The links-based cryptographic machine does not implement forwarding based on MAC addresses or IP addresses. The links-based cryptographic machine creates a security entity (SecY) for each VLAN to handle packets. Each security entity includes components such as security policies, outbound security, inbound security, and cryptographic modules. Each component maintains the necessary information and performs its corresponding function.

[0045] like Figure 3 As shown, from the plaintext interface to the ciphertext interface: When a plaintext interface receives a plaintext packet (1), it transmits the packet to the SecY entity corresponding to the VLAN based on the binding relationship between the interface's VLAN and the SecY. Then, the security policy component in the SecY entity matches the security policy according to the information in the packet. If the packet does not match the security policy, it is discarded; if it matches the plaintext transmission policy, it needs to be sent in plaintext (2); if it matches the security protection policy, the packet enters the outgoing security component for security protection (3). The outgoing security component selects the outgoing SA in the unicast or broadcast security channel, encapsulates the packet with SecTAG according to the SA in the security channel, and then passes the packet and the key in the SA to the cryptographic module for encryption, HASH and other cryptographic operations (4). After the cryptographic module completes the cryptographic operation, it returns the packet to the outgoing security component (5). After performing the subsequent operations, the outgoing security component sends the ciphertext out from the ciphertext interface corresponding to this SecY instance (6).

[0046] From encrypted interface to plaintext interface: When a message is received on the encrypted interface, it is passed to the SecY entity corresponding to the VLAN according to the binding relationship between the VLAN where the interface is located and the SecY. If the encrypted interface receives a plaintext packet (7), the SecY needs to send the plaintext packet to the security policy component of the SecY for security policy matching. If the matched policy indicates that the message is forwarded in plaintext, the message is sent from the plaintext interface as is (12). Otherwise, the message is discarded. If the encrypted interface receives an encrypted packet (8), the SecY passes the encrypted packet to the inbound security component of the SecY for processing. The inbound security component parses the SecTAG encapsulation of the message, queries the inbound SA according to the security channel identifier and SA identifier in the message SecTAG, performs security processing such as replay check according to the SA, and then passes the message and the key in the SA to the cryptographic module for HASH, decryption and other cryptographic operations (9). After the cryptographic module completes the cryptographic operation, it returns the message to the inbound security component (10). The incoming security component performs post-processing. If the integrity verification result returned by the cryptographic module fails, the message is discarded; otherwise, the incoming security component removes the SecTAG encapsulation from the message and then passes the message to the security policy component (11). The security policy component matches the security policy according to the information in the message. If the matched policy prohibits forwarding the message, the message is discarded; otherwise, the message is sent out from the plaintext interface corresponding to this SecY instance (12).

[0047] In this way, the link cryptographic device only needs to be deployed on the periphery of the protected network. Whether it's unicast or broadcast packets, encryption and decryption only need to be performed once at the periphery. Compared to MACSec, which requires deployment on all lines, this significantly reduces deployment and operational costs and improves forwarding efficiency. It does not require replacing or modifying existing network equipment, nor does it require any changes to the configuration of existing network equipment. Simply connecting the link cryptographic device in series at the periphery of the Ethernet network provides transparent security enhancement.

[0048] See Figure 4 As shown, this embodiment of the invention discloses an Ethernet network security protection device, applied to a link cryptographic machine deployed on the periphery of an Ethernet network, comprising: The first security policy matching module 11 is used to determine the first virtual local area network corresponding to the plaintext interface after receiving a plaintext packet at the plaintext interface, and send the first service data packet in the plaintext packet to the first security entity corresponding to the first virtual local area network, so that the first security entity matches the corresponding first security policy according to the information in the first service data packet. The first service data packet sending module 12 is used to directly send the first service data packet to the Ethernet peripheral device if the first security policy is a plaintext forwarding policy. The security channel type determination module 13 is used to determine the security channel type of the first security entity based on the type of the destination LAN address of the first service data packet and the target LAN address table if the first security policy is a security protection policy. The first processed message sending module 14 is used to encapsulate and encrypt the first service data message with a corresponding first security label according to the security association corresponding to the security channel type, and send the corresponding first processed message to the peripheral device of the Ethernet through the ciphertext interface corresponding to the first security entity to complete the service data transmission. The second service data packet sending module 15 is used to determine the second virtual local area network corresponding to the ciphertext interface after receiving the ciphertext packet at the ciphertext interface, and send the second service data packet in the ciphertext packet to the second security entity corresponding to the second virtual local area network, so that the second security entity performs corresponding security processing operations on the second service data packet according to the security association recorded in the second security label corresponding to the second service data packet, obtains the second processed packet, and records the correspondence between the source local area network address of the second service data packet and the source security entity in the target local area network address table. The second processed message processing module 16 is used to perform corresponding sending or discarding operations on the second processed message according to the second security policy matched by the information in the second processed message, so as to complete the data transmission of business data.

[0049] As can be seen, this application designs a link encryption machine deployed on the periphery of the protected Ethernet. All service data packets entering the Ethernet are encrypted by the link encryption machine, and encrypted service data packets leaving the Ethernet are decrypted by the link encryption machine before being sent to devices outside the Ethernet. This provides secure protection for service data transmitted throughout the entire Ethernet network without affecting normal network data exchange, solving the problem that existing link-layer protection technologies can only protect the line itself due to limitations in protocol design, operating costs, energy consumption, and performance. By deploying a link encryption machine on the periphery, a transparent security upgrade for existing Ethernet networks is achieved.

[0050] In some specific embodiments, the device can also be used to directly discard the first service data packet if no match is found with the first security policy.

[0051] In some specific embodiments, the secure channel type determination module 13 can be used to determine the secure channel type of the first security entity as a broadcast secure channel if the destination LAN address of the first service data packet is a broadcast address; if the destination LAN address of the first service data packet is a unicast address, query the target LAN address table of the first security entity to see if the destination LAN address of the first service data packet exists; if it exists, the secure channel type of the first security entity is a unicast secure channel; if it does not exist, the secure channel type of the first security entity is a broadcast secure channel; if the destination LAN address of the first service data packet is a multicast address, the secure channel type of the first security entity is a broadcast secure channel.

[0052] In some specific embodiments, the first processed message sending module 14 can be specifically used to perform corresponding first security label encapsulation and encryption processing on the first service data message based on the security association in the broadcast security channel if the security channel type of the first security entity is a broadcast security channel; and to perform corresponding first security label encapsulation and encryption processing on the first service data message based on the security association in the unicast security channel if the security channel type of the first security entity is a unicast security channel.

[0053] In some specific embodiments, the device can also be used to perform security policy matching on the plaintext packet through a second security entity if the encrypted interface receives a plaintext packet; if a plaintext forwarding policy is matched, the device can directly send the service data packet corresponding to the plaintext packet to the Ethernet user device through the plaintext interface; otherwise, the plaintext packet can be discarded.

[0054] In some specific embodiments, the second service data packet sending module 15 can be used to send the second service data packet in the encrypted packet to the second security entity corresponding to the second virtual local area network, so that the second security entity sends the second service data packet to a preset security component according to the security association recorded in the second security label corresponding to the second service data packet; the preset security component parses the second security label, queries the target security association according to the security channel identifier and security association identifier in the second security label, and performs decryption and integrity verification according to the second service data packet and the key in the target security association to obtain the decrypted packet and the verification result; if the verification fails, the second service data packet is directly discarded; if the verification succeeds, the security label encapsulation corresponding to the decrypted packet is removed to obtain the second processed packet.

[0055] In some specific embodiments, the second processed message processing module 16 can be used to directly discard the second processed message if the second security policy matched by the information in the second processed message is a prohibition forwarding policy; otherwise, the second processed message is sent to the Ethernet user device through the plaintext interface corresponding to the second security entity.

[0056] Furthermore, embodiments of this application also disclose an electronic device, Figure 5 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content of the diagram should not be construed as limiting the scope of this application.

[0057] Figure 5 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of this application. Specifically, the electronic device 20 may include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 stores a computer program, which is loaded and executed by the processor 21 to implement the relevant steps in the Ethernet network security protection method disclosed in any of the foregoing embodiments. Alternatively, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0058] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and external devices, and the communication protocol it follows can be any communication protocol applicable to the technical solution of this application, and is not specifically limited here; the input / output interface 25 is used to acquire external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs, and is not specifically limited here.

[0059] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or optical disk, etc. The resources stored thereon can include operating system 221, computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0060] The operating system 221 is used to manage and control the various hardware devices on the electronic device 20 and the computer program 222, which may be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program capable of performing the Ethernet network security protection method executed by the electronic device 20 as disclosed in any of the foregoing embodiments, the computer program 222 may further include a computer program capable of performing other specific tasks.

[0061] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, it implements the aforementioned disclosed Ethernet network security protection method. Specific steps of this method can be found in the corresponding content disclosed in the foregoing embodiments, and will not be repeated here.

[0062] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. For the apparatus disclosed in the embodiments, since it corresponds to the method disclosed in the embodiments, the description is relatively simple; relevant parts can be referred to in the method section.

[0063] Those skilled in the art will further recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of both. To clearly illustrate the interchangeability of hardware and software, the components and steps of the various examples have been generally described in terms of functionality in the foregoing description. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0064] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein can be implemented directly by hardware, a software module executed by a processor, or a combination of both. The software module can be located in random access memory (RAM), main memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, hard disk, removable disk, CD-ROM, or any other form of storage medium known in the art.

[0065] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0066] The technical solutions provided in this application have been described in detail above. Specific examples have been used to illustrate the principles and implementation methods of this application. The descriptions of the above embodiments are only for the purpose of helping to understand the methods and core ideas of this application. At the same time, for those skilled in the art, there will be changes in the specific implementation methods and application scope based on the ideas of this application. Therefore, the content of this specification should not be construed as a limitation of this application.

Claims

1. A network security protection method for Ethernet, characterized in that, Link cryptographic devices deployed on the periphery of Ethernet include: After receiving a plaintext packet at the plaintext interface, the first virtual local area network corresponding to the plaintext interface is determined, and the first service data packet in the plaintext packet is sent to the first security entity corresponding to the first virtual local area network, so that the first security entity can match the corresponding first security policy according to the information in the first service data packet. If the first security policy is a plaintext forwarding policy, then the first service data packet is directly sent to the Ethernet peripheral device; If the first security policy is a security protection policy, then the security channel type of the first security entity is determined according to the type of the destination LAN address of the first service data packet and the target LAN address table. According to the security association corresponding to the security channel type, the first service data packet is encapsulated and encrypted with the corresponding first security label, and the corresponding first processed packet is sent to the peripheral device of the Ethernet through the ciphertext interface corresponding to the first security entity to complete the service data transmission. After receiving the ciphertext packet at the ciphertext interface, the second virtual local area network (VLAN) corresponding to the ciphertext interface is determined. The second service data packet in the ciphertext packet is sent to the second security entity corresponding to the second VLAN. The second security entity performs corresponding security processing operations on the second service data packet according to the security association recorded in the second security label corresponding to the second service data packet, obtains the second processed packet, and records the correspondence between the source VLAN address of the second service data packet and the source security entity in the target VLAN address table. Based on the second security policy matched with the information in the second processed message, the second processed message is sent or discarded accordingly to complete the business data transmission.

2. The Ethernet network security protection method according to claim 1, characterized in that, After sending the first service data packet in the plaintext packet to the first security entity corresponding to the first virtual local area network, so that the first security entity matches the corresponding first security policy based on the information in the first service data packet, the method further includes: If no match is found with the first security policy, the first service data packet is discarded directly.

3. The Ethernet network security protection method according to claim 1, characterized in that, Determining the security channel type of the first security entity based on the type of the destination LAN address of the first service data packet and the target LAN address table includes: If the destination LAN address of the first service data packet is a broadcast address, then the security channel type of the first security entity is a broadcast security channel; If the destination LAN address of the first service data packet is a unicast address, then query the target LAN address table of the first security entity to see if the destination LAN address of the first service data packet exists. If it exists, then the security channel type of the first security entity is a unicast security channel; If it does not exist, then the security channel type of the first security entity is a broadcast security channel; If the destination LAN address of the first service data packet is a multicast address, then the security channel type of the first security entity is a broadcast security channel.

4. The Ethernet network security protection method according to claim 3, characterized in that, The step of encapsulating and encrypting the first service data packet with the corresponding first security label according to the security association corresponding to the security channel type includes: If the security channel type of the first security entity is a broadcast security channel, then the first service data packet is encapsulated and encrypted with the corresponding first security label based on the security association in the broadcast security channel; If the security channel type of the first security entity is a unicast security channel, the first service data packet is encapsulated and encrypted with the corresponding first security label based on the security association in the unicast security channel.

5. The Ethernet network security protection method according to claim 1, characterized in that, Also includes: If the encrypted interface receives a plaintext packet, the plaintext packet is matched against a security policy by the second security entity. If a plaintext forwarding policy is matched, the service data packet corresponding to the plaintext packet is directly sent to the Ethernet-using device through the plaintext interface; otherwise, the plaintext packet is discarded.

6. The Ethernet network security protection method according to claim 1, characterized in that, The step of sending the second service data packet in the encrypted packet to the second security entity corresponding to the second virtual local area network (VLAN) allows the second security entity to perform corresponding security processing operations on the second service data packet according to the security association recorded in the second security tag corresponding to the second service data packet, resulting in a second processed packet, including: The second service data packet in the encrypted packet is sent to the second security entity corresponding to the second virtual LAN, so that the second security entity sends the second service data packet to the preset security component according to the security association recorded in the second security tag corresponding to the second service data packet. The second security tag is parsed by the preset security component. The target security alliance is queried according to the security channel identifier and security alliance identifier in the second security tag. The second service data packet is decrypted and its integrity is verified according to the key in the target security alliance to obtain the decrypted packet and the verification result. If the verification fails, the second service data packet will be discarded directly. If the verification is successful, the security tag encapsulation corresponding to the decrypted message is removed to obtain the second processed message.

7. The Ethernet network security protection method according to any one of claims 1 to 6, characterized in that, The step of sending or discarding the second processed message according to the second security policy matched based on the information in the second processed message includes: If the information in the second processed message matches the second security policy which is a no-forwarding policy, then the second processed message is discarded directly. Otherwise, the second processed message is sent to the Ethernet-using device through the plaintext interface corresponding to the second security entity.

8. A network security protection device for Ethernet, characterized in that, Link cryptographic devices deployed on the periphery of Ethernet include: The first security policy matching module is used to determine the first virtual local area network corresponding to the plaintext interface after receiving a plaintext packet at the plaintext interface, and send the first service data packet in the plaintext packet to the first security entity corresponding to the first virtual local area network, so that the first security entity can match the corresponding first security policy according to the information in the first service data packet. The first service data packet sending module is used to directly send the first service data packet to the Ethernet peripheral device if the first security policy is a plaintext forwarding policy. The security channel type determination module is used to determine the security channel type of the first security entity based on the type of the destination LAN address of the first service data packet and the target LAN address table if the first security policy is a security protection policy. The first processed message sending module is used to encapsulate and encrypt the first service data message with a corresponding first security label according to the security association corresponding to the security channel type, and send the corresponding first processed message to the peripheral device of the Ethernet through the ciphertext interface corresponding to the first security entity to complete the service data transmission. The second service data packet sending module is used to determine the second virtual local area network corresponding to the ciphertext interface after receiving the ciphertext packet at the ciphertext interface, and send the second service data packet in the ciphertext packet to the second security entity corresponding to the second virtual local area network. The second security entity performs corresponding security processing operations on the second service data packet according to the security association recorded in the second security label corresponding to the second service data packet to obtain the second processed packet, and records the correspondence between the source local area network address of the second service data packet and the source security entity in the target local area network address table. The second processed message processing module is used to perform corresponding sending or discarding operations on the second processed message according to the second security policy matched by the information in the second processed message, so as to complete the business data transmission.

9. An electronic device, characterized in that, include: Memory, used to store computer programs; A processor for executing a computer program to implement the Ethernet network security protection method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that, A computer program is stored on a computer-readable storage medium, which, when executed by a processor, implements the Ethernet network security protection method as described in any one of claims 1 to 7.

Images