A double-tunnel nesting-based SSH national secret data transparent transmission method and system

Abstract

The application provides a SSH national secret data transparent transmission method and system based on double tunnel nesting, which is applied to a first gateway, and the method comprises the following steps: obtaining a simple network management protocol (SNMP) protocol synchronization message sent by a client; creating an inner layer session object according to five tuple information of the SNMP protocol synchronization message, and allocating a local loopback proxy port to the inner layer session object; determining a target outer layer SSH national secret protocol tunnel pointing to a second gateway; receiving the SNMP protocol synchronization message; directly encapsulating the SNMP protocol synchronization message as a payload in a channel of the target outer layer SSH national secret protocol tunnel, and encrypting the SNMP protocol synchronization message by using a national secret algorithm to obtain a national secret encrypted message; and sending the national secret encrypted message to the second gateway. The application can realize compliance upgrade from an international algorithm to a national secret algorithm by using a double layer tunnel nesting architecture without modifying both ends of a stock SSH protocol communication.

Description

Technical Field

[0001] This invention relates to the field of information security technology, and in particular to a method and system for transparent transmission of SSH national cryptographic data based on double-tunnel nesting. Background Technology

[0002] Secure Shell (SSH) is a widely used secure communication protocol in current government and enterprise operations and maintenance systems. Many deployed versions employ the RSA (an asymmetric encryption algorithm) international cryptographic system (hereinafter referred to as RSA SSH) for scenarios such as remote login, file transfer, and tunneling. However, with the publication of relevant laws and regulations and the implementation of technical standards, critical information infrastructure and systems at or above Level 3 of the Information Security Protection Standard are required to use Chinese national cryptographic algorithms, including SM2, SM3, and SM4. Therefore, a large number of existing RSA SSH operations and maintenance systems face pressure to upgrade to compliance standards.

[0003] Currently, the main technical approaches to achieving the national cryptographic standardization of the SSH protocol include the following: One approach is to directly replace the client and server software and upgrade them to the Chinese national cryptographic SSH version. This solution requires replacing the software, modifying the configuration, and verifying the services on hundreds or thousands of servers and maintenance terminals in the existing network one by one. The transformation cycle is long and costly, and it is prone to maintenance interruptions due to compatibility issues, making it difficult to promote in large government and enterprise networks.

[0004] Secondly, a VPN (Virtual Private Network) or IPsec (Internet Security Protocol) tunnel can be used to encapsulate and transmit the entire SSH traffic. While this solution can achieve national cryptographic encryption of the traffic, it requires modifying the network topology and cannot distinguish specific SSH sessions within the tunnel, making it difficult to meet the requirements for fine-grained access control and auditing. Furthermore, this solution typically loses the original client IP address, causing server logs and access control policies to become ineffective.

[0005] In summary, how to achieve a smooth and compliant upgrade of the SSH protocol from international to Chinese cryptographic algorithms without making any modifications to existing RSA SSH clients and servers, while maintaining business continuity, source address transparency, and seamless operation and maintenance, is a technical problem that urgently needs to be solved in this field. Summary of the Invention

[0006] The technical problem to be solved by the present invention is to provide a method and system for transparent transmission of SSH national cryptographic data based on double-tunnel nesting. It can realize the compliant upgrade from international algorithms to national cryptographic algorithms by utilizing the double-tunnel nesting architecture, while maintaining protocol compatibility and zero awareness of operation and maintenance.

[0007] To solve the above-mentioned technical problems, the technical solution of the present invention is as follows: A method for transparent transmission of SSH national cryptographic data based on double-tunnel nesting is applied to a local area network system where a first gateway is deployed at the network exit on the client side of the original Secure Shell protocol, and a second gateway is also deployed at the network entry on the server side of the original Secure Shell protocol in the same local area network system. The method includes: The first gateway obtains a synchronization message based on the original Secure Shell Protocol (SSH) and Simple Network Management Protocol (SNMP) sent by the original Secure Shell Protocol client; the SNMP synchronization message is a ciphertext message encrypted using the original encryption algorithm. The first gateway creates an inner session object based on the five-tuple information of the SNMP protocol synchronization message, and allocates a local loopback proxy port to the inner session object; the five-tuple information includes: original Secure Shell client address, original Secure Shell client port, original Secure Shell server address, original Secure Shell server port, and SNMP protocol; The first gateway determines the target outer layer Chinese cryptographic security shell protocol tunnel pointing to the second gateway based on the original secure shell protocol server address of the inner session object. The first gateway receives the SNMP protocol synchronization message through the local loopback proxy port; and encapsulates the SNMP protocol synchronization message as the payload directly into the channel of the target outer layer national cryptographic security shell protocol tunnel, and encrypts the SNMP protocol synchronization message using the national cryptographic algorithm to obtain a national cryptographic encrypted message. The channel is created based on the identifier of the inner session object, the original security shell protocol client address, the original security shell protocol server address, and the original security shell protocol server port. The first gateway sends the national cryptographic encryption message to the second gateway, which then decrypts the national cryptographic encryption message, restores the SNMP protocol synchronization message, and sends it to the server.

[0008] Optionally, based on the five-tuple information of the SNMP protocol synchronization message, an inner session object is created, and a local loopback agent port is allocated to the inner session object, including: Based on the five-tuple information of the SNMP protocol synchronization message, a preset session structure is created, inner storage space is allocated and target fields are filled to obtain the inner session object; Create an SNMP protocol socket for the inner session object and bind the SNMP protocol socket to a dynamically allocated local loopback agent port on the target local loopback address.

[0009] Optionally, determining the target outer layer Chinese cryptographic security shell protocol tunnel pointing to the second gateway based on the original secure shell protocol server address of the inner session object includes: Based on the original Secure Shell Protocol server address of the inner session object, the second gateway address corresponding to the original Secure Shell Protocol server address is determined through a mapping table. The preset tunnel pool is queried using the second gateway address as the key to determine whether there is an established outer cryptographic security shell protocol tunnel pointing to the second gateway; When an established outer layer security shell protocol tunnel pointing to the second gateway exists, the established outer layer security shell protocol tunnel pointing to the second gateway is reused to obtain the target outer layer security shell protocol tunnel. If no outer layer security shell protocol tunnel pointing to the second gateway exists, a new target outer layer security shell protocol tunnel pointing to the second gateway is created.

[0010] Optionally, the channel is created based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address, and the original Secure Shell server port, including: Send the channel creation request to the second gateway, so that the second gateway establishes a reverse mapping locally based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address and the original Secure Shell server port in the channel creation request, and sends a response message to the first gateway; Based on the response message sent by the second gateway, it is determined that a channel has been created on the target outer layer national cryptographic security shell protocol tunnel.

[0011] Optionally, receiving the SNMP protocol synchronization message through the local loopback agent port includes: Modify the target address of the SNMP protocol synchronization message to the target local loopback address, and modify the target port to the local loopback proxy port; Based on the modified target address and target port, the local loopback agent port receives the SNMP protocol synchronization message.

[0012] Optionally, the SNMP protocol synchronization message is used as the payload and directly encapsulated within the channel of the target's outer national cryptographic security shell protocol tunnel, including: The channel write function is invoked to write the SNMP protocol synchronization message as a payload into the channel on the target outer national cryptographic security shell protocol tunnel; the SNMP protocol synchronization message is kept in ciphertext state and the ciphertext of the SNMP protocol synchronization message is not parsed.

[0013] This invention also provides a method for transparent transmission of SSH national cryptographic data based on double-tunnel nesting, applied to a second gateway deployed at the network entry point on the server side of the original Secure Shell protocol in a local area network system, wherein a first gateway is also deployed at the network exit point on the client side of the original Secure Shell protocol in the local area network system, and the method includes: Receive a national cryptographic encrypted message sent by the first gateway through the target outer national cryptographic security shell protocol SSH tunnel, which is encrypted using the national cryptographic algorithm; The encrypted message is decrypted to obtain the original Simple Network Management Protocol (SNMP) synchronization message. Based on the original Secure Shell Protocol (SAMP) server address and port recorded when the channel was created in the target outer layer SAMP tunnel, the SNMP protocol synchronization message is forwarded to the original SAMP server. Receive the SNMP protocol response message sent by the original Secure Shell Protocol server; The SNMP protocol response message is used as the payload and directly encapsulated in the channel of the target's outer national cryptographic security shell protocol tunnel; The SNMP protocol response message is returned to the first gateway through the channel, so that the first gateway decrypts it and sends it to the original Secure Shell protocol client through the local loopback agent port.

[0014] The present invention also provides a first gateway, which is a first gateway deployed at the network exit on the client side of the Original Shell Protocol (OSP) in a local area network system. A second gateway is also deployed at the network entry on the server side of the OSP in the same local area network system. The first gateway includes: The first transceiver module is used to acquire synchronization messages based on the original Secure Shell Protocol (SSH) and Simple Network Management Protocol (SNMP) sent by the original Secure Shell Protocol client; the SNMP synchronization messages are ciphertext messages encrypted using the original encryption algorithm. The first processing module is used to create an inner session object based on the five-tuple information of the SNMP protocol synchronization message, and to allocate a local loopback agent port to the inner session object; the five-tuple information includes: the original Secure Shell client address, the original Secure Shell client port, the original Secure Shell server address, the original Secure Shell server port, and the SNMP protocol; The first gateway determines the target outer layer secure shell protocol tunnel pointing to the second gateway based on the original Secure Shell Protocol server address of the inner session object; it receives the SNMP protocol synchronization message through the local loopback proxy port; and encapsulates the SNMP protocol synchronization message as the payload directly into the channel of the target outer layer secure shell protocol tunnel, and encrypts the SNMP protocol synchronization message using a national cryptographic algorithm to obtain a national cryptographic encrypted message. The channel is created based on the identifier of the inner session object, the original Secure Shell Protocol client address, the original Secure Shell Protocol server address, and the original Secure Shell Protocol server port; the first transceiver module sends the national cryptographic encrypted message to the second gateway, so that the second gateway decrypts the national cryptographic encrypted message, restores the SNMP protocol synchronization message, and sends it to the server.

[0015] The present invention also provides a second gateway, which is a second gateway deployed at the network entry point on the server side of the Original Shell Protocol (OSP) in a local area network (LAN) system. The LAN system also deploys a first gateway at the network exit point on the client side of the OSP. The second gateway includes: The second transceiver module is used to receive encrypted messages encrypted with Chinese cryptographic algorithms sent by the first gateway through the target outer layer Chinese cryptographic security shell protocol SSH tunnel; The second processing module is used to decrypt the national cryptographic encryption message to obtain the original Simple Network Management Protocol (SNMP) synchronization message; based on the original Secure Shell Protocol (SAMP) server address and port recorded when the channel was created in the target outer national cryptographic security shell protocol tunnel, forward the SNMP synchronization message to the original SAMP server; receive the SNMP protocol response message sent by the original SAMP server; and encapsulate the SNMP protocol response message as the payload directly into the channel on the target outer national cryptographic security shell protocol tunnel. The second transceiver module returns the SNMP protocol response message to the first gateway through the channel, so that the first gateway decrypts it and sends it to the original Secure Shell protocol client through the local loopback proxy port.

[0016] The present invention also provides a local area network system, including the first gateway and the second gateway as described above.

[0017] The above-described solution of the present invention has at least the following beneficial effects: The above-described solution of the present invention obtains SNMP protocol synchronization messages based on the original Secure Shell protocol sent by the original Secure Shell protocol client through the first gateway; the SNMP protocol synchronization messages are ciphertext messages encrypted using the original encryption algorithm; the first gateway creates an inner session object based on the five-tuple information of the SNMP protocol synchronization messages, and allocates a local loopback proxy port to the inner session object; the five-tuple information includes: the original Secure Shell protocol client address, the original Secure Shell protocol client port, the original Secure Shell protocol server address, the original Secure Shell protocol server port, and the SNMP protocol; the first gateway determines the destination pointing to the second gateway based on the original Secure Shell protocol server address of the inner session object. The outer layer of the target RSA-SSH secure shell protocol tunnel is configured. The first gateway receives the SNMP protocol synchronization message through the local loopback proxy port and encapsulates the SNMP protocol synchronization message as the payload directly into the channel of the target outer layer RSA-SSH secure shell protocol tunnel. The SNMP protocol synchronization message is then encrypted using a national cryptographic algorithm to obtain a national cryptographic encrypted message. The channel is created based on the identifier of the inner session object, the original secure shell protocol client address, the original secure shell protocol server address, and the original secure shell protocol server port. The first gateway sends the national cryptographic encrypted message to the second gateway, which decrypts the national cryptographic encrypted message, restores the SNMP protocol synchronization message, and sends it to the server. This two-layer tunnel nested architecture can achieve a compliant upgrade from international algorithms to national cryptographic algorithms without modifying the existing RSA-SSH communication endpoints, while maintaining protocol compatibility and zero-awareness of operation and maintenance. Attached Figure Description

[0018] Figure 1 This is a flowchart of the SSH national cryptographic data transparent transmission method based on double-tunnel nesting according to an embodiment of the present invention; Figure 2 This is a flowchart illustrating the specific implementation of the SSH national cryptographic data transparent transmission method based on double-tunnel nesting according to an embodiment of the present invention. Figure 3 This is a diagram of a local area network system architecture according to an embodiment of the present invention. Detailed Implementation

[0019] Exemplary embodiments of the invention will now be described in more detail with reference to the accompanying drawings. While exemplary embodiments of the invention are shown in the drawings, it should be understood that the invention may be implemented in various forms and should not be limited to the embodiments set forth herein. Rather, these embodiments are provided so that this invention will be thorough and complete, and will fully convey the scope of the invention to those skilled in the art.

[0020] like Figure 1As shown, an embodiment of the present invention proposes a method for transparent transmission of SSH national cryptographic data based on dual-tunnel nesting, applied to a first gateway deployed at the network egress of the client side of the original Secure Shell protocol in a local area network system. A second gateway is also deployed at the network ingress of the server side of the original Secure Shell protocol in the same local area network system. The method includes: Step 11: The first gateway obtains the SSH (Simple Network Management Protocol) synchronization message sent by the original Secure Shell protocol client; the SNMP synchronization message is a ciphertext message encrypted using the original national cryptographic algorithm; the original encryption algorithm is the RSA algorithm.

[0021] Here, the first gateway captures all SNMP synchronization messages destined for the original Secure Shell (SSH) server (i.e., the existing RSA-SSH server) using pre-configured traffic hijacking rules. Specifically, the first gateway sets rules in the preprocessing chain of the operating system kernel's packet filtering framework to redirect messages matching the destination port (i.e., the original Secure Shell server) to the first gateway's user-space listening process. The user-space listening process calls socket options to obtain the original destination address and port of the message, thereby obtaining the complete SNMP synchronization message. The SNMP synchronization message remains encrypted throughout the capture process; the first gateway does not perform any decryption or protocol parsing.

[0022] Step 12: The first gateway creates an inner session object based on the five-tuple information of the SNMP protocol synchronization message, and assigns a local loopback proxy port to the inner session object; the five-tuple information includes: original Secure Shell client address, original Secure Shell client port, original Secure Shell server address, original Secure Shell server port, and SNMP protocol; Here, the first gateway extracts a 5-tuple from the header of the captured SNMP synchronization message, consisting of the original Secure Shell client address (i.e., the source IP address of the existing RSA SSH client), source port (i.e., the port of the existing RSA SSH client), destination IP address (i.e., the IP address of the existing RSA SSH server), destination port, and protocol type. The first gateway maintains a global session hash table and creates a corresponding inner session object using the 5-tuple as the key. Simultaneously, the first gateway dynamically allocates a currently idle port number from a preset port range (e.g., 60000–61000) as the local loopback proxy port and records the port number of the local loopback proxy port in the inner session object. This local loopback proxy port is subsequently used to establish inner connections, achieving protocol stack isolation.

[0023] Step 13: The first gateway determines the target outer layer Chinese cryptographic security shell protocol tunnel pointing to the second gateway based on the original secure shell protocol server address of the inner session object. Here, the first gateway pre-loads or dynamically maintains a mapping table of "server address range - second gateway address". This mapping table can be a static configuration file or learned through dynamic routing protocols. The first gateway uses the original Secure Shell protocol server address recorded in step 12 as an index to query the mapping table and obtain the network address (i.e., the IP address of the second gateway) to which the server belongs. Subsequently, the first gateway uses the second gateway address as the key to query the locally maintained tunnel pool and decides whether to reuse an existing outer-layer Chinese cryptographic security shell protocol tunnel or create a new outer-layer Chinese cryptographic security shell protocol tunnel.

[0024] Step 14: The first gateway receives the SNMP protocol synchronization message through the local loopback proxy port; and encapsulates the SNMP protocol synchronization message as the payload directly into the channel of the target outer layer national cryptographic security shell protocol tunnel, and encrypts the SNMP protocol synchronization message using the national cryptographic algorithm to obtain a national cryptographic encrypted message. The channel is created based on the identifier of the inner session object, the original security shell protocol client address, the original security shell protocol server address, and the original security shell protocol server port. Here, the first gateway modifies the target IP address of the initially hijacked SNMP synchronization message to the address of the local loopback agent port, and the target port to the local loopback agent port allocated in step 12, while the source address and source port remain unchanged. The modified message re-enters the operating system protocol stack through the kernel packet injection interface. Since the target address is the address of the local loopback agent port, the message is routed by the kernel to the local loopback agent port and is ultimately received by the agent process bound to the local loopback agent port. At this point, an SNMP protocol connection is established between the original client and the local agent port.

[0025] The proxy process reads data from the socket corresponding to the local loopback proxy port, and what it reads is the complete encrypted message sent by the original client. The proxy process does not modify or parse this data, but directly calls the channel data writing interface provided by the national cryptographic security shell protocol library to write the read data as the channel payload.

[0026] The first gateway's outer layer secure shell protocol session maintains a session key (based on the SM4 algorithm) and an integrity verification key (based on the SM3 algorithm) negotiated with the second gateway. After the channel data is written in step 14, the secure shell protocol stack automatically divides the data into several encrypted blocks, performs authentication encryption using the SM4 GCM mode, and generates a verification tag for each encrypted block. The encrypted data blocks are encapsulated into secure shell protocol data packets (containing protocol type, sequence number, encrypted payload, and checksum), and sent to the second gateway's listening port via the outer tunnel's SNMP protocol socket.

[0027] Step 15: The first gateway sends the national cryptographic encryption message to the second gateway, so that the second gateway decrypts the national cryptographic encryption message, restores the SNMP protocol synchronization message, and sends it to the server.

[0028] This embodiment of the invention, without modifying any existing RSA SSH client or server code or configuration, deploys a national cryptographic gateway on both the client and server sides, utilizing a two-layer nested tunnel architecture: the outer layer is a national cryptographic SSH tunnel, and the inner layer transparently carries native RSA SSH packets. The gateway does not parse or interrupt RSA traffic, but only performs session-level mapping and transparent forwarding. It also solves engineering challenges such as multiplexing, source IP pass-through, national cryptographic hardware integration, and fault rollback, achieving a smooth upgrade with "zero modification, zero awareness, and compliant auditability."

[0029] In an optional embodiment of the present invention, step 12, creating an inner session object based on the five-tuple information of the SNMP protocol synchronization message and allocating a local loopback proxy port to the inner session object, may include: Step 121: Based on the five-tuple information of the SNMP protocol synchronization message, create a preset session structure, allocate inner storage space and fill in the target field to obtain the inner session object; Here, the session structure members include: session ID (a sequentially incrementing 64-bit unsigned integer), a 5-tuple, the current TCP state (including sequence number, acknowledgment number, window size, etc., used to maintain TCP state machine consistency), the local proxy port number, the reused outer tunnel pointer, and the channel identifier. The first gateway calls the memory allocation function to allocate storage space for the session structure and fills it. After filling, the session structure is inserted into the global session hash table with the 5-tuple as the key.

[0030] Step 122: Create an SNMP protocol socket for the inner session object and bind the SNMP protocol socket to a dynamically allocated local loopback agent port on the target local loopback address.

[0031] The first gateway calls the operating system's socket creation interface (such as the `socket` function), specifying the address family as IPv4, the type as a stream socket, and the protocol as SNMP. Then, it calls the binding interface to bind the socket to the target local loopback address and the local loopback proxy port. After successful binding, it calls the listening interface to put the socket into a listening state, waiting for connections from the original client. This socket is added to the proxy process's event polling set to promptly handle new connections and data arrival events.

[0032] In an optional embodiment of the present invention, step 13, determining the target outer Chinese cryptographic security shell protocol tunnel pointing to the second gateway based on the original Secure Shell Protocol server address of the inner session object, may include: Step 131: Based on the original Secure Shell Protocol server address of the inner session object, determine the second gateway address corresponding to the original Secure Shell Protocol server address through a mapping table; Here, the first gateway stores a configuration file that records the mapping relationship between multiple server IP address ranges and their respective second gateway IPs. When the first gateway resolves a server address, it matches it in the mapping table to obtain the corresponding second gateway IP.

[0033] Step 132: Use the second gateway address as the key to query the preset tunnel pool to determine whether there is an established outer cryptographic security shell protocol tunnel pointing to the second gateway. The first gateway queries its locally maintained tunnel pool, storing a pointer to the outer Chinese cryptographic security shell protocol tunnel structure using the second gateway's IP address as the key. The tunnel structure includes a tunnel socket file descriptor, a Chinese cryptographic session context, a reference count (number of currently open channels), tunnel status (active / inactive / idle), and the last activity timestamp. During the query, the first gateway searches for this key in the tunnel pool; if found and the tunnel status is "active," then an available tunnel is confirmed to exist.

[0034] Step 133: When an established outer layer security shell protocol tunnel pointing to the second gateway exists, reuse the established outer layer security shell protocol tunnel pointing to the second gateway to obtain the target outer layer security shell protocol tunnel. Here, when an established active tunnel exists, the first gateway retrieves the tunnel structure, increments its reference count by 1, and updates the last active timestamp. The established outer layer secure shell protocol tunnel pointing to the second gateway is reused to obtain the target outer layer secure shell protocol tunnel.

[0035] Step 134: When there is no outer layer security shell protocol tunnel pointing to the second gateway, create a new target outer layer security shell protocol tunnel pointing to the second gateway.

[0036] Here, if no active tunnel is found in the tunnel pool, a new tunnel is created. The tunnel establishment process involves the tunnel client process of the first gateway initiating an SNMP protocol connection to the second gateway's national cryptographic listening port. After the connection is established, both parties exchange versions, negotiate algorithms, perform two-way authentication based on SM2 certificates, and generate session keys according to the national cryptographic security shell protocol standard. All key operations are completed through the hardware cryptographic module built into the first gateway. After a successful handshake, the first gateway creates a tunnel structure, adds it to the tunnel pool, and sets the reference count to 1.

[0037] In an optional embodiment of the present invention, step 14, in which the channel is created based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address, and the original Secure Shell server port, includes: Step 141: Send the channel creation request to the second gateway, so that the second gateway establishes a reverse mapping locally based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address and the original Secure Shell server port in the channel creation request, and sends a response message to the first gateway; Here, the first gateway constructs a channel creation request message on the national cryptographic session of the outer tunnel. The message specifies the channel type as "Direct TCP / UDP Forwarding" extension and appends custom extension fields (original client IP, target server IP and port, session ID). This message is encrypted and sent to the second gateway. The second gateway decrypts the message, extracts the extension fields, and creates a record in its local channel mapping table. The key is the globally unique identifier for this channel, and the value is a structure containing the target server address and port, and the original client address. Subsequently, the second gateway sends a channel creation success response, which is also encrypted.

[0038] Step 142: Based on the response message sent by the second gateway, determine that a channel has been created on the target outer layer national cryptographic security shell protocol tunnel.

[0039] After receiving the response, the first gateway parses and confirms that the channel was successfully created, and obtains the channel identifier assigned by the second gateway. The first gateway binds this channel identifier to the inner session object, completing the channel creation. Thereafter, the channel can transmit data bidirectionally.

[0040] In an optional embodiment of the present invention, step 14, receiving the SNMP protocol synchronization message through the local loopback agent port, may include: Step 143: Modify the target address of the SNMP protocol synchronization message to the target local loopback address, and modify the target port to the local loopback proxy port; Here, the interceptor process of the first gateway modifies the IP header of the SNMP protocol synchronization message in memory, changing its destination IP address field from the original server IP to the target local loopback address, and its destination port field from the original server port to the assigned local loopback proxy port.

[0041] Step 144: Based on the modified target address and target port, the local loopback agent port receives the SNMP protocol synchronization message.

[0042] Here, the modified message is re-sent to the kernel protocol stack via the packet injection interface. The kernel routes the message to the loopback interface based on the destination address and delivers the data to the agent process socket listening on the local loopback agent port. The agent process receives the synchronization message from this socket, completing the establishment of the inner connection.

[0043] In an optional embodiment of the present invention, step 14, where the SNMP protocol synchronization message is used as a payload and directly encapsulated within the channel of the target outer layer national cryptographic security shell protocol tunnel, may include: Step 145: Call the channel write function to write the SNMP protocol synchronization message as the payload into the channel on the target outer national cryptographic security shell protocol tunnel; the SNMP protocol synchronization message remains in ciphertext state and the ciphertext of the SNMP protocol synchronization message is not parsed.

[0044] Here, the proxy process reads the complete TCP data segment (i.e., the ciphertext message sent by the original client) from the socket of the local loopback proxy port. This data segment is an RSA SSH encrypted payload stored as a byte stream. The proxy process directly calls the channel write API of the Chinese cryptographic security shell protocol library, passing this byte stream as a parameter. The library function encapsulates the byte stream into a channel data message, encrypts it using SM4 GCM, and puts the encrypted result into the outer tunnel's send queue. Throughout the entire process, the proxy process neither reads nor modifies any content within the byte stream, completely maintaining its ciphertext state, thereby ensuring that the end-to-end security semantics are not violated.

[0045] Embodiments of the present invention also provide a method for transparent transmission of SSH national cryptographic data based on dual-tunnel nesting, applied to a second gateway deployed at the network entry point on the server side of the original Secure Shell protocol in a local area network system, wherein a first gateway is also deployed at the network exit point on the client side of the original Secure Shell protocol in the local area network system, and the method includes: Step 21: Receive the encrypted message sent by the first gateway through the target outer layer national cryptographic security shell protocol SSH tunnel, which is encrypted using the national cryptographic algorithm; Here, the second gateway's secure shell protocol server process listens on a designated secure shell tunnel port (e.g., 8443). When the first gateway sends an encrypted data packet, the operating system delivers the packet to the listening socket, and the server process calls the receive function to obtain the complete secure shell protocol data packet.

[0046] Step 22: Decrypt the national cryptographic encryption message to obtain the original Simple Network Management Protocol (SNMP) synchronization message; Here, the second gateway uses the session key negotiated with the first gateway to decrypt the received encrypted payload and perform integrity verification. Upon successful decryption, the payload in the channel data message is restored, which is the original SNMP protocol synchronization message sent by the client (still in RSA SSH encrypted state). The second gateway does not parse the content of this payload; it only serves as a byte stream buffer.

[0047] Step 23: Based on the original Secure Shell Protocol server address and original Secure Shell Protocol server port recorded when the channel was created in the target outer layer secure shell protocol tunnel, forward the SNMP protocol synchronization message to the original Secure Shell Protocol server; The second gateway, based on the channel identifier of the current data packet, looks up the local channel mapping table to obtain the target server IP address and port corresponding to that channel. The second gateway creates a new SNMP protocol connection (or reuses an existing connection) to the original Secure Shell protocol server and sends the decrypted payload (i.e., the original SNMP protocol synchronization message) through this connection. Before sending, the second gateway modifies the source address field in the IP header to the original client IP address recorded in the mapping table, thereby achieving source address pass-through.

[0048] Step 24: Receive the SNMP protocol response message sent by the original Secure Shell Protocol server; After processing the synchronization message, the real server returns an SNMP protocol response message, which is an RSA SSH encrypted message. The second gateway receives this response through the SNMP protocol connection with the server and reads its data content.

[0049] Step 25: The SNMP protocol response message is used as the payload and directly encapsulated in the channel of the target's outer national cryptographic security shell protocol tunnel; After the second gateway connects and reads the response data from the server, it does not perform any parsing or modification. Instead, it directly calls the channel write API of the national cryptographic security shell protocol library to write the response data as the payload into the corresponding channel between the second gateway and the first gateway. After writing, the data is encrypted using national cryptographic standards and encapsulated into a national cryptographic message.

[0050] Step 26: Return the SNMP protocol response message to the first gateway through the channel, so that the first gateway decrypts it and sends it to the original Secure Shell protocol client through the local loopback proxy port.

[0051] The second gateway sends the encrypted SNMP response message to the first gateway via the SNMP connection of the outer tunnel. Upon receiving the message, the first gateway decrypts it using the same session key, restoring the original byte stream of the response message (i.e., the RSA SSH ciphertext returned by the server). The first gateway's agent process writes this byte stream into the inner client connection (i.e., the connection established through the local loopback agent port), which is ultimately received by the original client's SNMP protocol stack, completing a full request-response interaction.

[0052] In the above embodiments of the present invention, an outer secure shell protocol tunnel based on national cryptographic algorithms is constructed between the first gateway and the second gateway. The RSA-encrypted messages transmitted between the original secure shell protocol client and server are encapsulated as completely transparent payloads within the outer national cryptographic tunnel for transmission without any parsing or modification. The first gateway achieves protocol stack isolation by intercepting synchronization messages, creating inner sessions, and allocating local loopback proxy ports, avoiding mutual interference between the two TCP state machines. A tunnel pool mechanism using the second gateway address as the key enables efficient reuse of the same outer tunnel by multiple inner sessions. Accurate forwarding and source IP pass-through by the second gateway are achieved by carrying the original client and server addresses in the channel open request. Throughout the entire scheme, the software and configuration of the original client and server require no modification, and the network topology changes are minimal.

[0053] It solves the technical problem of smoothly and compliantly upgrading the SSH protocol from the international algorithm system to the national cryptographic algorithm system. Without making any modifications to the existing RSA SSH client and server, it overcomes engineering challenges such as protocol stack conflicts, multi-session reuse chaos, source address loss, and complex tunnel management caused by double nesting, ensuring business continuity, transparency, and auditability.

[0054] like Figure 3 As shown, embodiments of the present invention also provide a first gateway 31, which is a first gateway 31 deployed at the network egress of the original Secure Shell Protocol (OSP) client side in a local area network system. A second gateway 32 is also deployed at the network ingress of the OSP server side in the same local area network system. The first gateway 31 includes: The first transceiver module is used to acquire synchronization messages based on the original Secure Shell Protocol (SSH) and Simple Network Management Protocol (SNMP) sent by the original Secure Shell Protocol client; the SNMP synchronization messages are ciphertext messages encrypted using the original encryption algorithm. The first processing module is used to create an inner session object based on the five-tuple information of the SNMP protocol synchronization message, and allocate a local loopback proxy port to the inner session object; the five-tuple information includes: original Secure Shell client address, original Secure Shell client port, original Secure Shell server address, original Secure Shell server port, and SNMP protocol; determine the target outer national cryptographic secure shell protocol tunnel pointing to the second gateway based on the original Secure Shell server address of the inner session object; receive the SNMP protocol synchronization message through the local loopback proxy port; and encapsulate the SNMP protocol synchronization message as a payload directly in the channel of the target outer national cryptographic secure shell protocol tunnel, and encrypt the SNMP protocol synchronization message using a national cryptographic algorithm to obtain a national cryptographic encrypted message, wherein the channel is created based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address, and the original Secure Shell server port; The first transceiver module sends the national cryptographic encryption message to the second gateway, which then decrypts the national cryptographic encryption message to restore the SNMP protocol synchronization message and sends it to the server.

[0055] Optionally, based on the five-tuple information of the SNMP protocol synchronization message, an inner session object is created, and a local loopback agent port is allocated to the inner session object, including: Based on the five-tuple information of the SNMP protocol synchronization message, a preset session structure is created, inner storage space is allocated and target fields are filled to obtain the inner session object; Create an SNMP protocol socket for the inner session object and bind the SNMP protocol socket to a dynamically allocated local loopback agent port on the target local loopback address.

[0056] Optionally, determining the target outer layer Chinese cryptographic security shell protocol tunnel pointing to the second gateway based on the original secure shell protocol server address of the inner session object includes: Based on the original Secure Shell Protocol server address of the inner session object, the second gateway address corresponding to the original Secure Shell Protocol server address is determined through a mapping table. The preset tunnel pool is queried using the second gateway address as the key to determine whether there is an established outer cryptographic security shell protocol tunnel pointing to the second gateway; When an established outer layer security shell protocol tunnel pointing to the second gateway exists, the established outer layer security shell protocol tunnel pointing to the second gateway is reused to obtain the target outer layer security shell protocol tunnel. If no outer layer security shell protocol tunnel pointing to the second gateway exists, a new target outer layer security shell protocol tunnel pointing to the second gateway is created.

[0057] Optionally, the channel is created based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address, and the original Secure Shell server port, including: Send the channel creation request to the second gateway, so that the second gateway establishes a reverse mapping locally based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address and the original Secure Shell server port in the channel creation request, and sends a response message to the first gateway; Based on the response message sent by the second gateway, it is determined that a channel has been created on the target outer layer national cryptographic security shell protocol tunnel.

[0058] Optionally, receiving the SNMP protocol synchronization message through the local loopback agent port includes: Modify the target address of the SNMP protocol synchronization message to the target local loopback address, and modify the target port to the local loopback proxy port; Based on the modified target address and target port, the local loopback agent port receives the SNMP protocol synchronization message.

[0059] Optionally, the SNMP protocol synchronization message is used as the payload and directly encapsulated within the channel of the target's outer national cryptographic security shell protocol tunnel, including: The channel write function is invoked to write the SNMP protocol synchronization message as a payload into the channel on the target outer national cryptographic security shell protocol tunnel; the SNMP protocol synchronization message is kept in ciphertext state and the ciphertext of the SNMP protocol synchronization message is not parsed.

[0060] It should be noted that this device is the same as the method on the first gateway side described above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0061] Embodiments of the present invention also provide a second gateway 32, which is a second gateway 32 deployed at the network entry point on the server side of the Original Shell Protocol (OSP) in a local area network system. The local area network system also deploys a first gateway 31 at the network exit point on the client side of the OSP. The second gateway 32 includes: The second transceiver module is used to receive encrypted messages encrypted with Chinese cryptographic algorithms sent by the first gateway through the target outer layer Chinese cryptographic security shell protocol SSH tunnel; The second processing module is used to decrypt the national cryptographic encryption message to obtain the original Simple Network Management Protocol (SNMP) synchronization message; based on the original Secure Shell Protocol (SAMP) server address and port recorded when the channel was created in the target outer national cryptographic security shell protocol tunnel, the SNMP synchronization message is forwarded to the original SAMP server; the SNMP response message sent by the original SAMP server is received; the SNMP response message is used as a payload and directly encapsulated in the channel on the target outer national cryptographic security shell protocol tunnel; the second transceiver module returns the SNMP response message to the first gateway through the channel, so that the first gateway decrypts it and sends it to the original SAMP client through the local loopback proxy port.

[0062] It should be noted that this device is the same as the method on the second gateway side described above. All implementation methods in the above method embodiments are applicable to the embodiments of this device and can achieve the same technical effect.

[0063] Embodiments of the present invention also provide a local area network system 30, including a first gateway 31 and a second gateway 32 as described above. All implementations in the above method embodiments are applicable to this embodiment and can achieve the same technical effect.

[0064] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementations should not be considered beyond the scope of this invention.

[0065] Those skilled in the art will understand that, for the sake of convenience and brevity, the specific working processes of the systems, devices, and units described above can be referred to the corresponding processes in the foregoing method embodiments, and will not be repeated here.

[0066] In the embodiments provided by this invention, it should be understood that the disclosed apparatus and methods can be implemented in other ways. For example, the apparatus embodiments described above are merely illustrative. For instance, the division of units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0067] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0068] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0069] If the aforementioned functions are implemented as software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, essentially, or the part that contributes to the prior art, or a portion of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods described in the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, ROM, RAM, magnetic disks, or optical disks.

[0070] Furthermore, it should be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent solutions of the present invention. Moreover, the steps performing the above series of processes can naturally be executed in the order described, but are not necessarily required to be executed in chronological order; some steps can be executed in parallel or independently of each other. Those skilled in the art will understand that all or any step or component of the method and apparatus of the present invention can be implemented in any computing device (including processors, storage media, etc.) or network of computing devices, in hardware, firmware, software, or a combination thereof. This is something that those skilled in the art can achieve by using their basic programming skills after reading the description of the present invention.

[0071] Therefore, the object of the present invention can also be achieved by running a program or a set of programs on any computing device. The computing device can be a known general-purpose device. Therefore, the object of the present invention can also be achieved simply by providing a program product containing program code implementing the method or apparatus. That is, such a program product also constitutes the present invention, and the storage medium storing such a program product also constitutes the present invention. Obviously, the storage medium can be any known storage medium or any storage medium developed in the future. It should also be noted that in the apparatus and method of the present invention, it is obvious that the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered equivalent to the present invention. Furthermore, the steps performing the above series of processes can naturally be performed in the order described, but are not necessarily required to be performed in chronological order. Some steps can be performed in parallel or independently of each other.

[0072] The above description represents the preferred embodiments of the present invention. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of the present invention, and these improvements and modifications should also be considered within the scope of protection of the present invention.

Claims

1. A method for transparent transmission of SSH national cryptographic data based on double-tunnel nesting, characterized in that, A first gateway deployed at the network egress of the original Secure Shell protocol client side in a local area network system, wherein a second gateway is also deployed at the network egress of the original Secure Shell protocol server side in the same local area network system, the method comprising: The first gateway obtains a synchronization message based on the original Secure Shell Protocol (SSH) and Simple Network Management Protocol (SNMP) sent by the original Secure Shell Protocol client; the SNMP synchronization message is a ciphertext message encrypted using the original encryption algorithm. The first gateway creates an inner session object based on the five-tuple information of the SNMP protocol synchronization message, and allocates a local loopback proxy port to the inner session object; the five-tuple information includes: original Secure Shell client address, original Secure Shell client port, original Secure Shell server address, original Secure Shell server port, and SNMP protocol; The first gateway determines the target outer layer Chinese cryptographic security shell protocol tunnel pointing to the second gateway based on the original secure shell protocol server address of the inner session object. The first gateway receives the SNMP protocol synchronization message through the local loopback proxy port; and encapsulates the SNMP protocol synchronization message as the payload directly into the channel of the target outer layer national cryptographic security shell protocol tunnel, and encrypts the SNMP protocol synchronization message using the national cryptographic algorithm to obtain a national cryptographic encrypted message. The channel is created based on the identifier of the inner session object, the original security shell protocol client address, the original security shell protocol server address, and the original security shell protocol server port. The first gateway sends the national cryptographic encryption message to the second gateway, which then decrypts the national cryptographic encryption message, restores the SNMP protocol synchronization message, and sends it to the server.

2. The SSH national cryptographic data transparent transmission method based on double-tunnel nesting according to claim 1, characterized in that, Based on the five-tuple information of the SNMP protocol synchronization message, an inner session object is created, and a local loopback agent port is allocated to the inner session object, including: Based on the five-tuple information of the SNMP protocol synchronization message, a preset session structure is created, inner storage space is allocated and target fields are filled to obtain the inner session object; Create an SNMP protocol socket for the inner session object and bind the SNMP protocol socket to a dynamically allocated local loopback agent port on the target local loopback address.

3. The SSH national cryptographic data transparent transmission method based on double-tunnel nesting according to claim 1, characterized in that, Based on the original Secure Shell Protocol (SPP) server address of the inner session object, determine the target outer SPP tunnel pointing to the second gateway, including: Based on the original Secure Shell Protocol server address of the inner session object, the second gateway address corresponding to the original Secure Shell Protocol server address is determined through a mapping table. The preset tunnel pool is queried using the second gateway address as the key to determine whether there is an established outer cryptographic security shell protocol tunnel pointing to the second gateway; When an established outer layer security shell protocol tunnel pointing to the second gateway exists, the established outer layer security shell protocol tunnel pointing to the second gateway is reused to obtain the target outer layer security shell protocol tunnel. If no outer layer security shell protocol tunnel pointing to the second gateway exists, a new target outer layer security shell protocol tunnel pointing to the second gateway is created.

4. The SSH national cryptographic data transparent transmission method based on double-tunnel nesting according to claim 1, characterized in that, The channel is created based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address, and the original Secure Shell server port, including: Send the channel creation request to the second gateway, so that the second gateway establishes a reverse mapping locally based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address and the original Secure Shell server port in the channel creation request, and sends a response message to the first gateway; Based on the response message sent by the second gateway, it is determined that a channel has been created on the target outer layer national cryptographic security shell protocol tunnel.

5. The SSH national cryptographic data transparent transmission method based on double-tunnel nesting according to claim 1, characterized in that, The SNMP protocol synchronization message is received through the local loopback agent port, including: Modify the target address of the SNMP protocol synchronization message to the target local loopback address, and modify the target port to the local loopback proxy port; Based on the modified target address and target port, the local loopback agent port receives the SNMP protocol synchronization message.

6. The SSH national cryptographic data transparent transmission method based on double-tunnel nesting according to claim 1, characterized in that, The SNMP protocol synchronization message is used as the payload and directly encapsulated within the channel of the target's outer national cryptographic security shell protocol tunnel, including: The channel write function is invoked to write the SNMP protocol synchronization message as a payload into the channel on the target outer national cryptographic security shell protocol tunnel; the SNMP protocol synchronization message is kept in ciphertext state and the ciphertext of the SNMP protocol synchronization message is not parsed.

7. A method for transparent transmission of SSH national cryptographic data based on double-tunnel nesting, characterized in that, A second gateway deployed at the network entry point on the server side of the Original Shell Protocol (OSP) protocol in a local area network (LAN) system, wherein a first gateway is also deployed at the network exit point on the client side of the OSP protocol, the method comprising: Receive a national cryptographic encrypted message sent by the first gateway through the target outer national cryptographic security shell protocol SSH tunnel, which is encrypted using the national cryptographic algorithm; The encrypted message is decrypted to obtain the original Simple Network Management Protocol (SNMP) synchronization message. Based on the original Secure Shell Protocol server address and original Secure Shell Protocol server port recorded when the channel was created in the target outer layer Secure Shell Protocol tunnel, the SNMP protocol synchronization message is forwarded to the original Secure Shell Protocol server; Receive the SNMP protocol response message sent by the original Secure Shell Protocol server; The SNMP protocol response message is used as the payload and directly encapsulated in the channel of the target's outer national cryptographic security shell protocol tunnel; The SNMP protocol response message is returned to the first gateway through the channel, so that the first gateway decrypts it and sends it to the original Secure Shell protocol client through the local loopback agent port.

8. A first gateway, characterized in that, The first gateway is a first gateway deployed at the network egress of the original Secure Shell protocol client side in a local area network system. A second gateway is also deployed at the network ingress of the original Secure Shell protocol server side in the same local area network system. The first gateway includes: The first transceiver module is used to acquire synchronization messages based on the original Secure Shell Protocol (SSH) and Simple Network Management Protocol (SNMP) sent by the original Secure Shell Protocol client; the SNMP synchronization messages are ciphertext messages encrypted using the original encryption algorithm. The first processing module is used to create an inner session object based on the five-tuple information of the SNMP protocol synchronization message, and allocate a local loopback proxy port to the inner session object; the five-tuple information includes: original Secure Shell client address, original Secure Shell client port, original Secure Shell server address, original Secure Shell server port, and SNMP protocol; determine the target outer national cryptographic secure shell protocol tunnel pointing to the second gateway based on the original Secure Shell server address of the inner session object; receive the SNMP protocol synchronization message through the local loopback proxy port; and encapsulate the SNMP protocol synchronization message as a payload directly in the channel of the target outer national cryptographic secure shell protocol tunnel, and encrypt the SNMP protocol synchronization message using a national cryptographic algorithm to obtain a national cryptographic encrypted message, wherein the channel is created based on the identifier of the inner session object, the original Secure Shell client address, the original Secure Shell server address, and the original Secure Shell server port; The first transceiver module sends the national cryptographic encryption message to the second gateway, which then decrypts the national cryptographic encryption message to restore the SNMP protocol synchronization message and sends it to the server.

9. A second gateway, characterized in that, The second gateway is a second gateway deployed at the network entry point on the server side of the original Secure Shell protocol in a local area network system. The local area network system also deploys a first gateway at the network exit point on the client side of the original Secure Shell protocol. The second gateway includes: The second transceiver module is used to receive encrypted messages encrypted with Chinese cryptographic algorithms sent by the first gateway through the target outer layer Chinese cryptographic security shell protocol SSH tunnel; The second processing module is used to decrypt the national cryptographic encryption message to obtain the original Simple Network Management Protocol (SNMP) synchronization message; based on the original Secure Shell Protocol (SAMP) server address and port recorded when the channel was created in the target outer national cryptographic security shell protocol tunnel, forward the SNMP synchronization message to the original SAMP server; receive the SNMP protocol response message sent by the original SAMP server; and encapsulate the SNMP protocol response message as the payload directly into the channel on the target outer national cryptographic security shell protocol tunnel. The second transceiver module returns the SNMP protocol response message to the first gateway through the channel, so that the first gateway decrypts it and sends it to the original Secure Shell protocol client through the local loopback proxy port.

10. A local area network system, comprising the first gateway as described in claim 8 and the second gateway as described in claim 9.

Images