SNMPv3 high concurrency plaintext-free national secret transparent transmission method

Abstract

The application relates to the field of network communication and information security, and discloses an SNMPv3 high-concurrency plaintext-free national secret transparent transmission method, which comprises the following steps: intercepting native SNMPv3 encrypted messages initiated by a network management client through a front-end gateway and not performing analysis, encapsulating the native SNMPv3 encrypted messages as payloads to generate national secret messages, and transmitting the national secret messages to a back-end gateway; decrypting the national secret messages through the back-end gateway, extracting original native SNMPv3 encrypted messages without analysis, and transmitting the original native SNMPv3 encrypted messages to a managed network device; intercepting reverse native encrypted messages sent by the managed network device through the back-end gateway, encapsulating the reverse native encrypted messages to generate reverse national secret messages, and transmitting the reverse national secret messages to the front-end gateway; and decrypting the reverse national secret messages through the front-end gateway, extracting the reverse native encrypted messages, and transmitting the reverse native encrypted messages to the network management client. Through the application, application layer decoding and inner layer decryption are stopped, plaintext residence of data in an intermediate gateway node is avoided, the consumption of the computing resources of the device is reduced, and the performance of the system in processing high-concurrency alarm data is improved.

Description

Technical Field

[0001] This invention relates to the field of network communication and information security technology, specifically to a method for high-concurrency, plaintext-free, encrypted data transmission using SNMPv3. Background Technology

[0002] The SNMPv3 protocol is widely used in network device management due to its support for data encryption and authentication mechanisms. With increasing information security compliance requirements, it is often necessary to deploy a security gateway between the network management client and the managed network devices to convert native SNMPv3 traffic based on international standard algorithms into traffic based on Chinese cryptographic algorithms, thereby establishing a secure transmission channel.

[0003] In existing protocol conversion and gateway processing flows, after receiving native SNMPv3 messages, devices typically rely on deep packet inspection (DPI) mechanisms for processing. Specifically, the gateway first needs to perform application-layer ASN.1 structure decoding, decrypt the encrypted data blocks within the message, extract the underlying network management plaintext data, and then re-encrypt and encapsulate the plaintext using Chinese cryptographic algorithms before sending it. This processing logic has significant limitations in practical engineering applications. Both application-layer protocol decoding and ciphertext decryption are CPU-intensive operations. When a large-scale failure occurs in the network, and managed network devices suddenly generate massive Trap or Inform alarm data streams, the gateway node needs to consume a large amount of computing resources to perform these concurrent parsing tasks. This can easily lead to performance bottlenecks in the gateway device, causing alarm message congestion and forwarding delays, affecting the real-time response capabilities of the network management system. Simultaneously, during the protocol decryption and reassembly process, the gateway inevitably generates a temporary plaintext state of network management data in system memory. This processing method disrupts the end-to-end encrypted structure of the original data, making intermediate forwarding nodes potential data leakage points and failing to meet the security requirements of high-density network environments for data transmission without plaintext exposure throughout the entire process. Summary of the Invention

[0004] To address the shortcomings of existing technologies, this invention provides a method for high-concurrency, plaintext-free, national cryptographic data transmission in SNMPv3. This method solves the high-concurrency computing performance bottleneck caused by the reliance on application-layer parsing and decryption when processing protocol messages in existing SNMPv3 gateways, as well as the security risk of plaintext data exposure at intermediate nodes.

[0005] To achieve the above objectives, the present invention provides the following technical solution: a method for high-concurrency, plaintext-free, national cryptographic data transmission using SNMPv3, comprising the following steps: The front-end gateway, deployed on the network side of the SNMPv3 network management client for data interception and national sealing, intercepts native SNMPv3 encrypted messages initiated by the SNMPv3 network management client on the service port without parsing them; The front-end gateway encapsulates the native SNMPv3 encrypted message as a payload to generate a national cryptographic SNMPv3 message, and sends it through the encryption port to the back-end gateway deployed on the SNMPv3 managed network device side for national cryptographic decryption and transparent transmission. The backend gateway decrypts the national cryptographic SNMPv3 message, extracts the original native SNMPv3 encrypted message without parsing it, and then forwards the native SNMPv3 encrypted message to the SNMPv3 managed network device. The backend gateway intercepts the reverse native encrypted message sent by the SNMPv3 managed network device on the service port, encapsulates it to generate a reverse national cryptographic message, and transmits it to the frontend gateway through the encryption port. The reverse national cryptographic message is decrypted using the outer layer of the front-end gateway, the original reverse native encrypted message is extracted, and then transparently transmitted to the SNMPv3 network management client.

[0006] The above technical solution achieves plaintext-free exposure of network management data at intermediate transmission nodes. This solution changes the inherent process of gateways relying on application-layer decoding when forwarding network protocols. Native SNMPv3 messages maintain their complete ciphertext form in the system memory of both the front-end and back-end gateways, and are directly transmitted as binary payloads. This parsing-free processing mechanism cuts off the path for plaintext data to reside at transmission nodes, and, combined with national cryptographic encryption, forms a dual encryption form with an inner layer of native international algorithm and an outer layer of national cryptographic algorithm.

[0007] Furthermore, the front-end gateway does not parse the native SNMPv3 encrypted messages, specifically including: Extract the network layer payload of the intercepted network data packet and use the network layer payload directly as the complete native SNMPv3 encrypted message; Abort the ASN.1 decoding process for the native SNMPv3 encrypted message; Skip the step of decrypting the internal encryption layer of the native SNMPv3 encrypted message, retain the original state of the authentication data and encrypted data it carries, and form a binary data block to be processed.

[0008] Furthermore, the front-end gateway encapsulates the native SNMPv3 encrypted message as a payload to generate a national standard SNMPv3 message, specifically including: Configure the complete binary data sequence of the original SNMPv3 encrypted message as the data payload of the new message, retaining the original authentication and encryption features; Generate the outer message header structure according to the national cryptographic SNMPv3 protocol specification, and fill the data payload into the corresponding data area; The preset national cryptographic algorithm parameters are invoked to encrypt and digest the overall data structure containing the data payload, thereby generating the national cryptographic SNMPv3 message.

[0009] Furthermore, the backend gateway decrypts the national standard SNMPv3 message at its outer layer to extract the original native SNMPv3 encrypted message, specifically including: The outer layer decryption operation is performed on the national cryptographic SNMPv3 message by calling the parameters of the national cryptographic algorithm. Strip the outer protocol header and outer encapsulation parameters of the national cryptographic SNMPv3 message, and extract the payload data in the data area as the original native SNMPv3 encrypted message; The application layer protocol parsing process is aborted, and the ASN.1 structure parsing is not performed on the original native SNMPv3 encrypted message, nor is the internal encryption unit decrypted.

[0010] Furthermore, the step of transparently transmitting the native SNMPv3 encrypted message to the SNMPv3 managed network device specifically includes: The unparsed, raw, native SNMPv3 encrypted message is used as the data payload of the underlying network protocol. Reset the network layer transport protocol header information and set the transmission target port to the service port on the device side; The network packet with the reset header is sent to the SNMPv3 managed network device.

[0011] The above technical solution reduces the computational resource consumption of gateway nodes. Traditional ASN.1 decoding requires deep traversal of the packet's type-length node structure, a step that consumes a significant number of CPU cycles. This solution utilizes bypass parsing and direct payload encapsulation, allowing the system to perform basic memory extraction and encapsulation of consecutive data blocks only at the network layer. This eliminates the computational overhead of nodes performing complex decryption operations and protocol decoding, thereby improving the processing efficiency of basic data packets.

[0012] In one embodiment of the present invention, the reverse native encryption message is: The message generated by the SNMPv3 managed network device when it completes processing a forward network management request or triggers a system alarm event; The reverse native encrypted message carries encryption and authentication processing data based on the native international algorithm; The traffic type corresponding to the reverse native encrypted message is response data traffic, Trap alarm traffic, or Inform alarm traffic.

[0013] Furthermore, the process of encapsulating the reverse native encrypted message to generate a reverse national cryptographic message specifically includes: Skip the application layer decoding step and do not read the network status response data and alarm fields inside the reverse native encrypted message; The complete reverse native encrypted message is used as the underlying data payload. The outer message header is constructed according to the national cryptographic standard, and the underlying data payload is filled into the message data area. The preset national cryptographic algorithm parameters are invoked to perform overall encryption and digest operations on the data structure containing the underlying data payload, thereby generating the reverse national cryptographic message.

[0014] Furthermore, the outer layer of the front-end gateway decrypts the reverse national cryptographic message and extracts the original reverse native encrypted message, specifically including: The internally preset national cryptographic algorithm parameters are invoked to perform outer layer decryption and digest verification operations on the reverse national cryptographic message; Strip the outer protocol header of the reverse national cryptographic message and extract the underlying payload located in the data area as the original reverse native encrypted message; The application layer structure parsing process is terminated, so that the reverse native encrypted message maintains the state of the inner native ciphertext in the system memory.

[0015] Furthermore, the reverse native encrypted message is transparently transmitted to the SNMPv3 network management client, specifically including: The extracted original reverse native encrypted message is used as the data payload for network layer forwarding; The underlying network transmission protocol parameters are re-encapsulated, and the network layer transmission target port is set to the service port on the client side; The network data packets, after being encapsulated with the underlying network transmission protocol parameters, are forwarded and transparently transmitted to the SNMPv3 network management client.

[0016] The above technical solutions enhance the system's ability to adapt to high-concurrency alarm scenarios. Network devices often generate sudden, large-scale Trap or Inform alarm data streams when a fault is triggered. By directly skipping application-layer decoding and field reading for reverse traffic, the performance bottleneck caused by concurrent parsing of a large number of alarm messages is avoided, ensuring the device's packet throughput and forwarding stability when dealing with intensive alarm events.

[0017] Furthermore, the method also includes setting communication port attributes, specifically: The service port is set as a UDP protocol communication port of the standard service plane to carry native protocol network traffic that does not contain an outer national seal. The encrypted port is set as a UDP protocol tunnel communication port of the encrypted transmission plane to carry direct tunnel network traffic after being packaged by the national seal; The front-end gateway and the back-end gateway establish a national cryptographic encryption channel in advance based on the encryption port to achieve physical isolation and differentiation of network traffic on different planes.

[0018] The above technical solution establishes a physical-layer port traffic isolation system. The system defines two sets of communication ports to distinguish between the service plane and the encrypted transmission plane. An independent communication tunnel is established between the front-end gateway and the back-end gateway via a dedicated encrypted port. Without changing the port configuration of the native end-side devices, this achieves a physical network-layer distinction between gateway interconnection traffic and native standard network traffic, further enhancing the security of the system network.

[0019] This invention provides a high-concurrency, plaintext-free, encrypted data transmission method for SNMPv3. It offers the following advantages: 1. This invention, after intercepting native SNMPv3 encrypted messages at the front-end and back-end gateways, aborts the application-layer ASN.1 decoding process without decrypting the internal encryption unit, and directly fills the complete native ciphertext as a binary payload into the national cryptographic message for outer encapsulation. This feature avoids the conversion of network management data into plaintext in the memory of intermediate devices, eliminates the risk of data leakage in intermediate links, and simultaneously constructs a dual-encryption transmission structure with the inner layer protected by the native international algorithm and the outer layer protected by the national cryptographic algorithm.

[0020] 2. This invention skips the application layer decoding stage and performs extraction and peripheral encapsulation operations only at the network layer on consecutive data blocks, eliminating the overhead of inner layer data reassembly and cryptographic operations. This processing logic shortens the calculation cycle of a single packet forwarding, improves the packet throughput capacity of the device, and ensures system stability during sudden large-scale Trap or Inform alarm data flows.

[0021] 3. This invention distinguishes the service communication plane carrying unencapsulated native protocol messages from the direct tunnel communication plane carrying encapsulated messages in an outer national code by setting separate service ports and encryption ports in the gateway. This port attribute feature enables gateway nodes to independently process interconnected encrypted traffic based on dedicated channels. Without changing the native port configuration and underlying interaction logic of the end-side network devices, it achieves physical isolation of network traffic in different planes, improving the standardization and security of the overall system networking. Attached Figure Description

[0022] Figure 1 This is a system deployment architecture diagram of the present invention; Figure 2 This is a flowchart of the method steps of the present invention. Detailed Implementation

[0023] The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0024] Please see the appendix Figure 1 and attached Figure 2 This invention provides a method for high-concurrency, plaintext-free, encrypted data transmission using SNMPv3. The deployment includes an SNMPv3 network management client, a front-end gateway, a back-end gateway, and SNMPv3 managed network devices.

[0025] The front-end gateway is deployed on the side where the SNMPv3 network management client is located.

[0026] The backend gateway is deployed on the side where the SNMPv3 managed network device is located.

[0027] A direct gateway connection is established between the front-end gateway and the back-end gateway through a national cryptographic encryption channel.

[0028] The SNMPv3 network management client communicates with the front-end gateway via the first or second port of the UDP protocol.

[0029] The backend gateway communicates with the SNMPv3 managed network device via the first or second port of the UDP protocol.

[0030] The front-end gateway and the back-end gateway transmit messages through the third or fourth port of the UDP protocol.

[0031] Throughout the transmission process, the gateway node does not parse, decrypt, or strip the inner encryption and authentication structure of the native SNMPv3 message. It only performs encapsulation, encryption, decryption, and decapsulation processing on the outer national cryptographic SNMPv3 encapsulation required for inter-gateway transmission. The intermediate nodes of the system do not expose the native network management data plaintext. The system only performs message encapsulation and transparent transmission without exposing plaintext, thus forming a dual encryption of native SNMPv3 and national cryptographic SNMPv3.

[0032] In this embodiment, the communication ports in the system are divided into service ports and encrypted ports. The service ports are configured as UDP protocol communication ports on the standard service plane (e.g., UDP protocol port 1 or port 2), used to carry native protocol network traffic without outer national standard encryption. The encrypted ports are configured as UDP protocol tunnel communication ports on the encrypted transmission plane (e.g., UDP protocol port 3 or port 4), used to carry direct tunnel network traffic after national standard encryption. Through the above configuration, a national standard encryption channel is pre-established between the front-end gateway and the back-end gateway based on the encrypted ports, achieving physical isolation and differentiation of network traffic from different planes.

[0033] The pass-through processing for both forward and reverse traffic includes the following steps: S1. Intercept native encrypted messages: For forward traffic of query or set requests, the front-end gateway intercepts native SNMPv3 encrypted messages initiated by the SNMPv3 network management client on the first or second port of the UDP protocol. The front-end gateway does not parse the message content. The native SNMPv3 encrypted messages contain SHA and AES algorithms. S2. Encapsulation to generate national cryptographic messages: The front-end gateway does not strip the original encryption layer, but directly uses the complete original SNMPv3 encrypted message as the payload of national cryptographic SNMPv3, encapsulates it to generate national cryptographic SNMPv3 messages, and transmits them to the back-end gateway through the national cryptographic channel of the third or fourth port of the UDP protocol. S3. Complete decryption and direct pass-through: The backend gateway receives the national cryptographic SNMPv3 message and completes the national cryptographic decryption to restore the original native SNMPv3 encrypted message. The backend gateway does not parse the original native SNMPv3 encrypted message and directly passes the original native SNMPv3 encrypted message to the SNMPv3 managed network device. S4. Intercept and perform national security packaging: For the reverse traffic of response, Trap alarm or Inform alarm, the above link and processing logic are reversed and reused. The encrypted message is reported by the managed network device via SNMPv3. The backend gateway intercepts the encrypted message and performs national security packaging directly, and transmits it to the frontend gateway through the national security channel. S5. Decryption and Restore Direct Transmission: The front-end gateway receives the reverse-encapsulated message and decrypts it using national cryptographic standards. The front-end gateway then directly transmits the decrypted and restored original encrypted message to the SNMPv3 network management client.

[0034] This transparent transmission method eliminates packet parsing overhead during the processing of the front-end gateway and the back-end gateway, reducing computational performance loss and adapting to high-concurrency alarm scenarios.

[0035] For forward traffic of query or SET requests, the front-end gateway intercepts native SNMPv3 encrypted messages initiated by the SNMPv3 management client on the first or second port of the UDP protocol and performs non-parse processing. The specific processing includes the following steps: S101. In a specific implementation scenario, the SNMPv3 network management client generates a native SNMPv3 encrypted message based on a query command or a Set request command and sends it to the network link. The specific process by which the SNMPv3 network management client generates a standard protocol request message can be implemented by those skilled in the art based on network management protocol standards; its message construction and sending mechanism is well-known in the field and will not be elaborated here. The aforementioned native SNMPv3 encrypted message uses native SHA and AES algorithms during the generation phase. Specifically, the native SNMPv3 encrypted message carries authentication data generated based on the SHA algorithm and protocol data units encrypted based on the AES algorithm.

[0036] S102. The front-end gateway performs a listening operation on the target port at the network layer. In this embodiment, the ports to be listened to are the first and second ports of the UDP protocol. The front-end gateway intercepts network data packets sent by the SNMPv3 network management client to the above ports at its network interface, thereby completing the interception of native SNMPv3 encrypted messages. For the process of listening to a specified network port and intercepting underlying data packets based on the UDP protocol, those skilled in the art can use standard network programming interfaces or data packet capture libraries to implement it. The principle of network data interception is a well-known technology in the field and will not be described in detail here.

[0037] S103. The front-end gateway obtains the network layer payload of the intercepted network data packet, that is, extracts the data payload part after the UDP protocol header. This data payload is the complete native SNMPv3 encrypted message. After extracting the native SNMPv3 encrypted message, the front-end gateway does not perform any reading operations on the internal protocol structure of the message.

[0038] To avoid the computational overhead and plaintext leakage risk associated with message parsing, the gateway does not perform deep packet inspection on the data stream. Unlike traditional processing flows that rely on ASN.1 decoding rules to obtain fields, the front-end gateway in this solution does not execute the ASN.1 decoding program, and therefore does not need to read the credential field and network status data inside the native SNMPv3 encrypted message.

[0039] Meanwhile, the front-end gateway is not configured with the device's original decryption key, therefore it does not perform a stripping operation on the encryption layer contained in the native SNMPv3 encrypted messages, skipping the step of decrypting the AES encryption layer. From the general principles of data processing, due to the lack of decryption and deep decoding processes, the front-end gateway's system memory and cache never contain a temporary plaintext state of network management data, thus fundamentally cutting off the path of data exposure.

[0040] Ultimately, the front-end gateway retains the original state of the SHA authentication data and AES encrypted data carried in the native SNMPv3 encrypted message, and treats the complete original message that maintains the ciphertext state as a binary data block to be processed, thereby achieving data interception without plaintext exposure.

[0041] Regarding the direct encapsulation of native encrypted text and the transmission process using Chinese cryptographic standards, after the front-end gateway obtains the data block to be processed containing the native encryption layer, it performs outer Chinese cryptographic encapsulation and completes the transmission through a dedicated channel. The specific processing includes the following steps: S201. Based on the processing rule of not stripping the native encryption layer, the front-end gateway configures the complete binary data sequence of the native SNMPv3 encrypted message obtained in the previous steps as the data payload of the new message.

[0042] During this process, since the native SNMPv3 encrypted message does not undergo decryption and parsing, its inherent SHA algorithm authentication feature and AES algorithm encryption feature are perfectly preserved in the aforementioned data payload. This data payload, in the communication protocol hierarchy, serves as an undecoded continuous byte stream, providing the underlying data foundation for the subsequent double encryption structure.

[0043] S202. The front-end gateway performs SNMPv3 message encapsulation operation on the above data payload. The front-end gateway generates the outer message header structure according to the SNMPv3 protocol specification and directly fills the continuous byte stream containing the native SHA and AES processed data into the data area of ​​the outer message.

[0044] In the specific implementation process, the front-end gateway uses the configured national cryptographic algorithm parameters to perform overall encryption and digest operations on the outer layer message, thereby generating a complete national cryptographic SNMPv3 message. From the general principle of protocol encapsulation, this nested processing method, which directly uses the complete ciphertext at the bottom layer as the payload of the upper layer protocol, makes the network transmission data physically present a double-encrypted form, with the outer layer protected by the national cryptographic algorithm and the inner layer protected by the native international algorithm.

[0045] For the specific processing flow of SNMPv3 message header construction, digest calculation and payload encryption based on the national cryptographic algorithm, those skilled in the art can implement it according to the relevant technical specifications of the existing national cryptographic network management protocol. The standard encapsulation and encryption operation mechanism of the national cryptographic message is a well-known technology in this field, and will not be described in detail here.

[0046] S203. The front-end gateway configures the underlying network transmission protocol parameters for the generated SNMPv3 messages. For the forward traffic channel, the front-end gateway configures the UDP header information and sets the transmission destination port to the third or fourth port of the UDP protocol.

[0047] The front-end gateway sends network packets with UDP headers to its network interface. Relying on a pre-established national cryptographic encryption channel between the front-end and back-end gateways, the data packets are then routed to the back-end gateway. By employing ports 1610 and 4, independent of the standard network management port, the system achieves port isolation and traffic differentiation between the standard protocol communication channel and the gateway's direct connection to the national cryptographic channel in its network architecture. Regarding the reception and processing of forward traffic on the server side, the backend gateway receives the national cryptographic SNMPv3 message and completes the decryption and transparent transmission. The specific processing includes the following steps: S301. The backend gateway listens on the configured transmission port at the network layer and receives network data packets transmitted by the frontend gateway through the national cryptographic encryption channel via the third or fourth port of the UDP protocol. The backend gateway extracts the national cryptographic SNMPv3 message from the network data packet and performs an outer-layer decryption operation on the national cryptographic SNMPv3 message by calling the national cryptographic algorithm parameters configured in the system.

[0048] For the specific calculation process of message decryption and digest verification based on the national cryptographic algorithm, those skilled in the art can use the standard national cryptographic decryption algorithm library to implement it. Its decryption and verification operation mechanism is a well-known technology in this field, and will not be described in detail here.

[0049] S302. After completing the outer layer decryption operation, the backend gateway strips the outer protocol header and outer encapsulation parameters of the SNMPv3 message and extracts the payload data located in the outer message data area. This payload data is the restored original native SNMPv3 encrypted message.

[0050] In the specific implementation process, after extracting the original native SNMPv3 encrypted message, the backend gateway directly terminates the application layer protocol parsing process for that data. The backend gateway does not perform ASN.1 structure parsing on the restored original native SNMPv3 encrypted message, nor does it attempt to decrypt the inner AES encryption unit of the message. From the general principles of data processing, this mechanism ensures that the restored message retains its inherent SHA algorithm authentication features and AES algorithm encryption features. Since only the outer layer of the national cryptographic standard is stripped, the network management data objectively maintains its original encrypted form in the system cache of this node, cutting off the path to plaintext exposure at the physical link node, thus supporting the technical requirement of no plaintext exposure in the dual-gateway architecture.

[0051] S303. During the transparent transmission phase, the backend gateway treats the above-mentioned unparsed original native SNMPv3 encrypted message as the data payload of the underlying network protocol, reconfigures the UDP protocol header information, and sets the transmission target port to the first or second port of the UDP protocol.

[0052] From the perspective of network forwarding mechanism analysis, since the reassembly step at the protocol layer field level is skipped, the above transparent transmission operation only involves network layer forwarding of data blocks, reducing the computational overhead of the gateway node. Subsequently, the network data packet with the reconfigured UDP header is sent to the SNMPv3 managed network device. Because the transparent data packet is consistent in binary structure with the original message initially generated by the network management client, transparent transmission at the protocol layer is achieved. After the SNMPv3 managed network device receives the above data packet at the receiving end, it can directly use its internally configured native international algorithm key to perform subsequent decryption and command response.

[0053] For reverse traffic containing response data, Trap alarms, or Inform alarms, the system reverse-reuses the processing logic of the forward link. The backend gateway directly encapsulates and transmits the packets reported by the device. The specific processing includes the following steps: When an S401 or SNMPv3 managed network device completes a forward network management request or triggers a system alarm event, it generates a reversed native encrypted message. This reversed native encrypted message also undergoes encryption and authentication using the native international algorithm during its generation phase. The SNMPv3 managed network device then sends this reversed native encrypted message to the network link through its network port. The backend gateway intercepts this reversed native encrypted message at its network interface via either port 1 or port 2, based on the UDP protocol.

[0054] The specific process by which network devices generate standard response data packets and construct alarm messages can be implemented by those skilled in the art using standard network management protocol specifications. The generation mechanism of device-side protocol messages is a well-known technology in the field and will not be elaborated here.

[0055] S402. For intercepted reverse natively encrypted packets, the backend gateway performs a direct encapsulation operation without parsing. In the reverse traffic processing chain, the backend gateway performs the same processing logic as the frontend gateway in the forward chain, that is, it skips the application layer decoding stage of the protocol stack, does not read the network status response data and specific alarm fields inside the packet, and does not strip the native encryption layer of the packet.

[0056] In one specific implementation scenario, the backend gateway directly uses the complete reverse-encrypted native message as the underlying data payload, constructs the outer message header according to the national cryptographic standard, and fills the message data area with this underlying data payload. Subsequently, the backend gateway calls the national cryptographic algorithm parameters configured in the system to perform overall encryption and digest operations on the entire data structure containing the native ciphertext, thereby generating the reverse-encrypted national cryptographic message. This process ensures that the reverse traffic also receives dual security protection from the superposition of native encryption and the outer national cryptographic algorithm.

[0057] S403. The backend gateway configures the underlying network transmission parameters for the generated reverse Chinese cryptographic message, setting the network layer transmission target port to the third or fourth port of the UDP protocol. The backend gateway then forwards the reverse Chinese cryptographic message to the frontend gateway through a pre-established Chinese cryptographic encryption channel.

[0058] From the general principles of network data processing, when the network is large or a sudden equipment failure occurs, network nodes typically generate a large number of Trap or Inform alarm messages in a short period of time, forming a high-concurrency alarm data stream in the network link. Traditional network management message processing mechanisms, when encountering such situations, require a deep traversal of the Type-Length nodes for decoding the ASN.1 structure, a typical CPU-intensive operation that can easily create a performance bottleneck for gateway nodes.

[0059] In this embodiment, because the backend gateway avoids the complex application-layer ASN.1 structure decoding and inner-layer native ciphertext decryption operations when processing reverse alarm traffic, the system only performs basic memory extraction and outer-layer encapsulation operations on consecutive data blocks at the network layer. This bypass parsing mechanism reduces the computational resource consumption of the gateway hardware. This mechanism helps improve the packet concurrency throughput of a single gateway device per unit time, enabling the system architecture to better adapt to high-concurrency alarm scenarios within a given set of computational resources.

[0060] Regarding the reception and processing of reverse alarm and response traffic on the client side, the front-end gateway receives the reverse national cryptographic messages and performs decryption and transparent transmission. The specific processing includes the following steps: S501. The front-end gateway configures a corresponding listening port at the network layer and receives reverse national cryptographic messages transmitted by the back-end gateway through the national cryptographic encryption channel via the third or fourth port of the UDP protocol. The front-end gateway extracts the message data and calls the internally configured national cryptographic algorithm parameters to perform outer-layer decryption and digest verification operations on the reverse national cryptographic message.

[0061] For the specific calculation process of network message decryption and integrity verification based on the national cryptographic standard, those skilled in the art can implement it in combination with the current national cryptographic algorithm specification and cryptographic module. The underlying logic of decryption and verification is a well-known technology in this field and will not be elaborated here.

[0062] S502: The front-end gateway strips the outer protocol header of the reverse cryptographic message and extracts the underlying payload located in the data area. This underlying payload is the reverse cryptographic message initially generated by the SNMPv3 managed network device.

[0063] In this embodiment, after extracting the reverse encrypted message, the front-end gateway does not perform application-layer structural parsing. The front-end gateway does not read the specific response parameters or alarm fields encrypted using the AES algorithm in the reverse encrypted message. Since the front-end gateway only removes the outer national standard header encapsulated by the back-end gateway, the payload data retains its inner original ciphertext state in the front-end gateway's system memory. This processing method avoids plaintext residing in intermediate nodes, providing underlying mechanism support for the overall architecture's plaintext-free characteristic.

[0064] S503: The front-end gateway uses the restored reverse encrypted message as the data payload for network layer forwarding, and re-encapsulates the underlying network transmission protocol parameters. The front-end gateway configures the UDP header information, sets the transmission destination port to the first or second UDP port, and directly passes the encapsulated network data packet to the SNMPv3 network management client.

[0065] The above-described pass-through operation only involves the directed forwarding of network layer data blocks. After the SNMPv3 network management client receives the data packet on the designated first or second port, since the data packet fully retains the native SNMPv3 protocol format and encryption structure, the SNMPv3 network management client can independently complete the final ciphertext parsing and alarm presentation by calling its own native international algorithm key.

[0066] Through the aforementioned reverse traffic processing, the system achieves double encryption isolation of messages on the intermediate transmission link without altering the interaction logic of the native network management protocols at both ends. Since the gateway node does not participate in parsing the native ciphertext, the risk of plaintext leakage is reduced, enhancing the privacy and security of network management data during transmission.

[0067] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended technical solutions and their equivalents.

Claims

1. A method for high-concurrency, plaintext-free, encrypted data transmission using SNMPv3, characterized in that: Includes the following steps: The front-end gateway, deployed on the network side of the SNMPv3 network management client for data interception and national sealing, intercepts native SNMPv3 encrypted messages initiated by the SNMPv3 network management client on the service port without parsing them; The front-end gateway encapsulates the native SNMPv3 encrypted message as a payload to generate a national cryptographic SNMPv3 message, and sends it through the encryption port to the back-end gateway deployed on the SNMPv3 managed network device side for national cryptographic decryption and transparent transmission. The backend gateway decrypts the national cryptographic SNMPv3 message, extracts the original native SNMPv3 encrypted message without parsing it, and then forwards the native SNMPv3 encrypted message to the SNMPv3 managed network device. The backend gateway intercepts the reverse native encrypted message sent by the SNMPv3 managed network device on the service port, encapsulates it to generate a reverse national cryptographic message, and transmits it to the frontend gateway through the encryption port. The reverse national cryptographic message is decrypted using the outer layer of the front-end gateway, the original reverse native encrypted message is extracted, and then transparently transmitted to the SNMPv3 network management client.

2. The SNMPv3 high-concurrency plaintext-free national cryptographic transmission method according to claim 1, characterized in that, The front-end gateway does not parse the native SNMPv3 encrypted messages, specifically including: Extract the network layer payload of the intercepted network data packet and use the network layer payload directly as the complete native SNMPv3 encrypted message; Abort the ASN.1 decoding process for the native SNMPv3 encrypted message; Skip the step of decrypting the internal encryption layer of the native SNMPv3 encrypted message, retain the original state of the authentication data and encrypted data it carries, and form a binary data block to be processed.

3. The SNMPv3 high-concurrency plaintext-free national cryptographic transmission method according to claim 1, characterized in that, The front-end gateway encapsulates the native SNMPv3 encrypted message as a payload to generate a national standard SNMPv3 message, specifically including: Configure the complete binary data sequence of the original SNMPv3 encrypted message as the data payload of the new message, retaining the original authentication and encryption features; Generate the outer message header structure according to the national cryptographic SNMPv3 protocol specification, and fill the data payload into the corresponding data area; The preset national cryptographic algorithm parameters are invoked to encrypt and digest the overall data structure containing the data payload, thereby generating the national cryptographic SNMPv3 message.

4. The SNMPv3 high-concurrency plaintext-free national cryptographic transmission method according to claim 1, characterized in that, The backend gateway decrypts the national standard SNMPv3 message and extracts the original native SNMPv3 encrypted message, specifically including: The outer layer decryption operation is performed on the national cryptographic SNMPv3 message by calling the parameters of the national cryptographic algorithm. Strip the outer protocol header and outer encapsulation parameters of the national cryptographic SNMPv3 message, and extract the payload data in the data area as the original native SNMPv3 encrypted message; The application layer protocol parsing process is aborted, and the ASN.1 structure parsing is not performed on the original native SNMPv3 encrypted message, nor is the internal encryption unit decrypted.

5. The SNMPv3 high-concurrency plaintext-free national cryptographic transmission method according to claim 1, characterized in that, The step of transparently transmitting the native SNMPv3 encrypted message to the SNMPv3 managed network device specifically includes: The unparsed, raw, native SNMPv3 encrypted message is used as the data payload of the underlying network protocol. Reset the network layer transport protocol header information and set the transmission target port to the service port on the device side; The network packet with the reset header is sent to the SNMPv3 managed network device.

6. The SNMPv3 high-concurrency plaintext-free national cryptographic transmission method according to claim 1, characterized in that, The reverse native encrypted message is: The message generated by the SNMPv3 managed network device when it completes processing a forward network management request or triggers a system alarm event; The reverse native encrypted message carries encryption and authentication processing data based on the native international algorithm; The traffic type corresponding to the reverse native encrypted message is response data traffic, Trap alarm traffic, or Inform alarm traffic.

7. The SNMPv3 high-concurrency plaintext-free encrypted data transmission method according to claim 1, characterized in that, The process of encapsulating the reverse native encrypted message to generate a reverse national cryptographic message specifically includes: Skip the application layer decoding step and do not read the network status response data and alarm fields inside the reverse native encrypted message; The complete reverse native encrypted message is used as the underlying data payload. The outer message header is constructed according to the national cryptographic standard, and the underlying data payload is filled into the message data area. The preset national cryptographic algorithm parameters are invoked to perform overall encryption and digest operations on the data structure containing the underlying data payload, thereby generating the reverse national cryptographic message.

8. The SNMPv3 high-concurrency plaintext-free national cryptographic transmission method according to claim 1, characterized in that, The front-end gateway decrypts the reversed national cryptographic message at its outer layer and extracts the original reversed native encrypted message, specifically including: The internally preset national cryptographic algorithm parameters are invoked to perform outer layer decryption and digest verification operations on the reverse national cryptographic message; Strip the outer protocol header of the reverse national cryptographic message and extract the underlying payload located in the data area as the original reverse native encrypted message; The application layer structure parsing process is terminated, so that the reverse native encrypted message maintains the state of the inner native ciphertext in the system memory.

9. A method for high-concurrency, plaintext-free, encrypted data transmission of SNMPv3 according to claim 1, characterized in that, The reverse native encrypted message is transparently transmitted to the SNMPv3 network management client, specifically including: The extracted original reverse native encrypted message is used as the data payload for network layer forwarding; The underlying network transmission protocol parameters are re-encapsulated, and the network layer transmission target port is set to the service port on the client side; The network data packets, after being encapsulated with the underlying network transmission protocol parameters, are forwarded and transparently transmitted to the SNMPv3 network management client.

10. A method for high-concurrency, plaintext-free, encrypted data transmission of SNMPv3 according to claim 1, characterized in that, The method also includes setting communication port attributes, specifically: The service port is set as a UDP protocol communication port of the standard service plane to carry native protocol network traffic that does not contain an outer national seal. The encrypted port is set as a UDP protocol tunnel communication port of the encrypted transmission plane to carry direct tunnel network traffic after being packaged by the national seal; The front-end gateway and the back-end gateway establish a national cryptographic encryption channel in advance based on the encryption port to achieve physical isolation and differentiation of network traffic on different planes.

Images