Network transport layer data processing method, device and storage medium

Abstract

The present embodiment relates to the field of communications, and discloses a network transport layer data processing method, an apparatus, and a storage medium. The network transport layer data processing method of the present application is applied to an extended Berkeley Packet Filter (eBPF) program running in a kernel, and includes the steps of obtaining a network transport layer data packet that needs to be distributed, analyzing the network transport layer data packet, identifying a network transport layer data processing method that needs to be performed on the network transport layer data packet, and processing the network transport layer data packet based on the network transport layer data processing method.

Description

[Technical field]

[0001] This application claims priority from a Chinese patent application filed on June 11, 2021, application number 202110655627.0, the contents of which are incorporated herein by reference in their entirety.

[0002] The present embodiment relates to the field of communications, and in particular to a network transport layer data processing method, device, and storage medium. [Background technology]

[0003] At present, as the network security environment becomes more and more severe, the encryption and other security measures of network transport layer communication between system processes become more and more important. Linux, as the mainstream business product operating system in the industry, provides many installed network transport layer encryption protocols and related implementations. At present, Internet Protocol Security (IPSec) and Transport Layer Security (TLS) are relatively popular network transport layer encryption processing methods or mechanisms. As shown in Figure 1, in actual operation, IPSec operates at the network layer, which is the third layer of the Open System Interconnection Reference Model (OSI model), and protects all communication based on the IP protocol by encrypting and authenticating IP protocol packets. TLS operates at the transport layer, which is the fourth layer of the OSI model, and generally provides data security and total protection for upper layer applications based on reliable transport layer protocols such as the connection-oriented Transmission Control Protocol (TCP) and the connectionless User Datagram Protocol (UDP). Specifically, it adopts a client-server model to build a secure transport connection / tunnel between two application programs, preventing eavesdropping and tampering of the data exchanged.

[0004] The above encryption processing method or mechanism can realize data encryption or decryption processing in the kernel, but the method based on the IPSec protocol requires the system administrator to change the system's network settings or connection topology in actual operation, for example, by creating a new virtual network device or changing the global routing table, which means that intrusive settings must be made to the system's operating environment. On the other hand, the method based on the TLS protocol requires the application program to voluntarily initiate and participate in the transport connection / tunnel construction process in actual operation, and sensitive data such as related configuration parameters and digital certificates must usually be maintained by the application program itself, which means that intrusive settings must be made to the experience program itself. Summary of the Invention [Problem to be solved by the invention]

[0005] In other words, traditional network transport layer encryption processing methods are not transparent to the system environment or upper layer applications. They require the system environment or upper layer applications to change their own state and participate in the actual encryption / decryption flow. Such non-transparency brings extra deployment, configuration, management and development burdens, as well as extra risks. For example, a single incorrect configuration or implementation may fail to protect data or adversely affect the system environment, which may then affect other applications. [Means for solving the problem]

[0006] The network transport layer data processing method provided in the embodiments of the present application is a network transport layer data processing method applied to an extended Berkeley Packet Filter (eBPF) program running in a kernel, and includes the steps of obtaining a network transport layer data packet that needs to be distributed, analyzing the network transport layer data packet to identify a network transport layer data processing method that needs to be performed on the network transport layer data packet, and processing the network transport layer data packet based on the network transport layer data processing method.

[0007] A network transport layer data processing method further provided in an embodiment of the present application is a network transport layer data processing method applied to a management program operating in a user plane, and includes the steps of: monitoring whether or not an operation command for an eBPF program operating in a kernel and / or aggregated data in a processing process for network transport layer data packets aggregated by the eBPF program has been received after the management program is started; if an operation command for the eBPF program has been received, performing processing on the eBPF program based on the operation command; and if aggregated data in a processing process for network transport layer data packets aggregated by the eBPF program has been received, performing processing on the aggregated data.

[0008] A network transport layer data processing device further provided in an embodiment of the present application includes a management program running on a user plane and an eBPF program running in a kernel, at least one processor, and a memory communicatively connected to the at least one processor, wherein the management program is used to load the eBPF program into a kernel of a local environment and run the eBPF program in the kernel, and the memory stores instructions to be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute any one of the network transport layer data processing methods described above.

[0009] The present embodiment further provides a computer-readable storage medium having a computer program stored thereon, the computer program realizing any one of the network transport layer data processing methods described above when executed by a processor. [Brief description of the drawings]

[0010] One or more embodiments are illustrated by way of example only and not by way of limitation in the accompanying drawings.

[0011] [Figure 1] FIG. 1 is a schematic diagram of the correspondence between the conventional IPSec protocol, the TLS protocol, and the OSI model. [Diagram 2] FIG. 2 is a schematic flow diagram of a network transport layer data processing method applied to the management program provided in the embodiment of the present application. [Diagram 3] FIG. 3 is another schematic flow diagram of a network transport layer data processing method applied to the management program provided in an embodiment of the present application. [Figure 4] FIG. 4 is a schematic diagram of the interaction between a management program and an eBPF program in the network transport layer data processing method shown in FIG. 2 or FIG. 3. [Diagram 5]FIG. 5 is a schematic flow diagram of a network transport layer data processing method applied to an eBPF program provided in an embodiment of the present application. [Figure 6] FIG. 6 is another schematic flow diagram of a network transport layer data processing method applied to an eBPF program provided in an embodiment of the present application. [Figure 7] FIG. 7 is a schematic diagram of implementing full transparent transmission encryption between node A and node B based on the network transport layer data processing method provided in the embodiment of the present application. [Figure 8] FIG. 8 is a schematic diagram of implementing joint encryption with an upper layer application program between node A and node B based on the network transport layer data processing method provided in the embodiment of the present application. [Figure 9] FIG. 9 is a structural schematic diagram of a network transport layer data processing device provided in an embodiment of the present application. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0012] The term "and / or" in the present embodiment indicates a relation between related objects, for example, "A and / or B" indicates that three situations may exist: only A exists, A and B exist simultaneously, or only B exists. The symbol " / " usually indicates that the related objects before and after it are in an "or" relationship.

[0013] In the embodiments of the present application, "plurality" refers to two or more than two, and the same applies to other counters.

[0014] In order to clarify the purpose, technical scheme and advantages of the embodiments of the present application, the embodiments of the present application will be described in detail below in combination with the drawings. However, as can be understood by those skilled in the art, many technical details are shown in the embodiments of the present application to allow the reader to better understand the present application. However, even without these technical details or by making various modifications based on the following embodiments, the technical scheme sought to be protected by the present application can be realized. The boundaries of the following embodiments are for the convenience of explanation and do not limit the specific implementation method of the present application in any way, and the embodiments can be combined or cited with each other on the premise that there is no contradiction.

[0015] The network transport layer data processing method, device, and storage medium provided in the embodiment of the present application load and operate a management program capable of managing an eBPF program in the user plane, and further register the eBPF program in advance in the kernel using the management program, so that the kernel needs to distribute, for example, a network transport layer data packet to be sent, and a network transport layer data packet to be received and hooked to determine a network transport layer data processing method for the network transport layer data packet that needs to be distributed, and finally, the eBPF program performs processing on the currently hooked network transport layer data packet based on the determined network transport layer data processing method. Since the entire process of network transport layer data processing can be completed by the eBPF program in the rewritten kernel, the system environment or upper layer application does not need to change its own state and be involved in the actual network transport layer data processing process, realizing transparency to the system environment or upper layer application. Therefore, no extra deployment, configuration, operation and management, and development costs are required, and excellent compatibility between the system environment and the upper layer application is also guaranteed.

[0016] In addition, the network transport layer data processing scheme provided in this embodiment does not simply encrypt or decrypt network transport layer data packets based on the eBPF program loaded in the kernel, but can also be configured so that the eBPF program cooperates with an upper layer application, such as an application program running in the user plane, to realize joint encryption or decryption. Therefore, according to actual service requirements, Upper tier With minimal changes to applications, the encryption / decryption method used together with upper layer applications can further improve security during the transmission of network transport layer data packets.

[0017] In addition, based on the security and high performance of the eBPF technology itself, the security and overall performance of the network transport layer data processing scheme provided in this embodiment are also guaranteed.

[0018] Please refer to Figure 2. Figure 2 is a flow chart of a network transport layer data processing method provided in an embodiment of the present application. In this embodiment, the method is mainly applied to a management program running in the user plane.

[0019] As shown in FIG. 2, the network transport layer data processing method provided in this embodiment includes the following steps:

[0020] Step 201: After the management program is started, it is monitored whether an operation command for the eBPF program running in the kernel and / or aggregated data in the processing process for network transport layer data packets aggregated by the eBPF program are received.

[0021] The original purpose of the eBPF program (extended Berkeley Packet Filter) in this embodiment was to realize a new packet filter to replace IPTABLE (a type of network firewall), but its functions have been expanded over time. Current eBPF programs are essentially special codes that run in the kernel, and users can edit function codes within prescribed limits. These codes are compiled into bytecodes, and then loaded and executed in a special virtual machine in the kernel. Therefore, in order to manage eBPF programs according to actual service requirements, this embodiment provides a management program that runs in the user plane, allowing users to manage eBPF programs running in the kernel through the management program.

[0022] Based on the above description, in order to ensure the realization of the network transport layer data processing method provided in this embodiment and management of the eBPF program, the management program not only is responsible for loading or registering the eBPF program into the kernel, but also provides a user interaction interface.

[0023] In this embodiment, the above-mentioned management program loads the eBPF program into the kernel, which means that the bytecode that realizes the corresponding function of the eBPF program is loaded into the specified location of the kernel, so that when the kernel needs to distribute a network transport layer data packet, for example, when sending or receiving it to the outside, the network transport layer data packet that arrives at the kernel is hooked by the eBPF program loaded in the kernel, and the eBPF program can perform corresponding processing on the network transport layer data packet according to the corresponding functional interface / function.

[0024] Correspondingly, the user interaction interface provided by the management program is specifically used to receive operation commands from a user for an eBPF program running in the kernel.

[0025] As an example, the management program further feeds back to the user via a user interaction interface aggregate data fed back from the eBPF program, such as the number of successful encryptions / decryptions occurring in the processing process of the network transport layer data packets, and / or information, such as the operating status and current configuration parameters of the eBPF program, so that the user can perform subsequent operations based on the current operating status of the eBPF program.

[0026] As can be seen from the above explanation, after the management program is started, specifically by monitoring the user interaction interface, it determines whether or not there is currently an operation command for the eBPF program running in the kernel, and by monitoring the interface for interaction with the eBPF program running in the kernel, such as a system call / interface (syscall), it determines whether or not aggregated data has been received in the processing process for network transport layer data packets aggregated by the eBPF program.

[0027] Correspondingly, if it is detected that an operation command for the eBPF program running in the kernel has been received, the process proceeds to step 202. If it is detected that a network transport layer data packet output by the eBPF program running in the kernel has been received, the process proceeds to step 203.

[0028] As an example, when the management program receives current status information fed back from the eBPF program running in the kernel, such as the number of successfully decrypted network transport layer data packets, the number of successfully encrypted network transport layer data packets, and the encryption / decryption conditions and rules that the eBPF program currently complies with when encrypting / decrypting, the management program can store the received information and / or display it in a predetermined format, or feed it back to the user via a user interaction interface, based on a preset service request.

[0029] Step 202: Processing is performed on the eBPF program based on the operation command.

[0030] As an example, the operation commands for an eBPF program running in the kernel that the management program receives via the user interaction interface can be divided into three types: a configuration information update command, an eBPF program replacement command, or an eBPF program unload command.

[0031] Correspondingly, the management program performs different operations on the eBPF program already running in the kernel in response to the three different operation commands. Specifically, they are as follows:

[0032] (1) When the operation command is a configuration information update command, the processing for the eBPF program already running in the kernel is specifically as follows:

[0033] First, the setting information that needs to be updated is extracted from the setting information update command.

[0034] The setting information described in this embodiment includes one or more of the encryption / decryption conditions, the encryption rules, and the decryption rules.

[0035] The above encryption / decryption conditions are, specifically, predetermined conditions regarding which network transport layer protocol to adopt and the corresponding 4-tuple (source port number, destination port number, source IP address, destination IP address) of the network transport layer data packet that needs to be encrypted or decrypted.

[0036] Correspondingly, the encryption rule at least includes a specific encryption algorithm to be used for encryption processing on the network transport layer data packets that need to be encrypted.

[0037] In this embodiment, if the specified encryption algorithm requires the use of a key, the encryption rule must further include a key for encryption with the specified encryption algorithm.

[0038] Correspondingly, the above-mentioned decoding rule at least includes a specific decoding algorithm to be used for the decoding process on the network transport layer data packets that need to be subjected to the decoding process.

[0039] In this embodiment, if a key needs to be used in a specified decryption algorithm, the decryption rule must further include a key for decryption in the specified decryption algorithm.

[0040] In addition, encryption and decryption are usually paired, so the relevant configuration information for encryption processing of the eBPF program running in the kernel of the sender of the network transport layer data packet, for example, node A, must be compatible with the relevant configuration information for decryption processing of the eBPF program running in the kernel of the receiver of the network transport layer data packet, for example, node B.

[0041] Then, based on the extracted configuration information that needs to be updated, the configuration information mapping table corresponding to the eBPF program already running in the kernel is updated.

[0042] The configuration information mapping table described in this embodiment is a BPF MAP related to eBPF technology. In a specific operation, a corresponding BPF MAP may be designed for each different eBPF program that can run in the kernel, or one comprehensive BPF MAP may be designed and all eBPF programs that can run in the kernel may unify and share one BPF MAP. In either case, when the BPF MAP is designed in advance based on a service request, the parameters required for the eBPF program to perform encryption, decryption, etc. must be defined in the BPF MAP.

[0043] Correspondingly, when a management program manages an eBPF program running in a kernel based on the designed BPF MAP, if a change to configuration information is required, the management program only needs to update the configuration information that needs to be changed in the BPF MAP. After the eBPF program is enabled by the kernel, it autonomously searches for the required configuration information in the BPF MAP and performs corresponding operations based on the found configuration information.

[0044] In other words, the BPF MAP is essentially a kind of exchange mechanism / communication mechanism provided by the kernel, and based on the BPF MAP, interaction between management programs running in the user plane and eBPF programs running in the kernel is realized.

[0045] (2) When the operation command is an eBPF program replacement command, the processing for the eBPF program already running in the kernel is specifically as follows:

[0046] First, a replacement eBPF program is extracted from the eBPF program replacement command.

[0047] Then, the replacement eBPF program is registered in the kernel, and after the replacement eBPF program is registered in the kernel, the eBPF program running in the kernel is unloaded.

[0048] (3) If the operation command is an eBPF program unload command, as a process for an eBPF program already running in the kernel, specifically, the eBPF program running in the kernel is unloaded.

[0049] Step 203: Process the aggregated data.

[0050] As an example, when the management program receives aggregated data provided by the eBPF program when performing encryption / decryption processing on network transport layer data packets, such as the number of successful encryptions or the number of successful decryptions, the processing of the received aggregated data may be to store the aggregated data in a specified memory area and / or display it in a specified format.

[0051] In addition, in actual operation, when the received operation command is an eBPF program unload command, the management program will exit the current message processing operation after unloading the eBPF program and stop executing the network transport layer data processing method provided in this embodiment. In other situations, for example, based on a configuration parameter change command or an eBPF program replacement command, when the processing of the eBPF program already running in the kernel or the processing of the aggregated data is completed, the management program will automatically proceed to the next message processing.

[0052] As can be easily understood from the above description, the network transport layer data processing method provided in this embodiment places and starts a management program in the user plane, loads an eBPF program capable of implementing encryption / decryption processing into the kernel by the management program, and monitors feedback from the eBPF program running in the kernel and operation commands from the user. Furthermore, based on the detection result of the monitoring, the corresponding result is displayed as it is in the user plane, or the eBPF program running in the kernel is managed, thereby realizing dynamic management of the eBPF program. Throughout the process, the system environment or upper layer application does not need to change its own state to be involved in the actual network transport layer data processing process, so that the encryption / decryption processing of the network transport layer data can be realized in a situation where the system environment and upper layer application are not changed at all.

[0053] In addition, because the management program directly manages the eBPF program running in the kernel, it is possible to realize operations such as enabling or disabling the eBPF program that performs encryption / decryption processing and changing the configuration information without the system environment or upper layer applications being aware of it. This makes it possible to dynamically adjust the encryption / decryption processing for data that needs to be transmitted, i.e., network transport layer data packets, and to make the network transport layer data processing more compliant with actual fluctuating service requirements.

[0054] Based on this, the network transport layer data processing method provided in this embodiment truly realizes transparency to the system environment or upload application, so that no extra deployment, configuration, operation and management and development costs are required, and excellent compatibility between the system environment and upper layer applications is also ensured.

[0055] In addition, based on the security and high performance of the eBPF technology itself, the security and overall performance of the network transport layer data processing scheme provided in this embodiment are also guaranteed.

[0056] Also, as an example, when absolute transparency is not pursued or when there is a special data protection requirement, the eBPF program and the upper layer application may cooperate to realize data encryption or protection. For example, an upper layer application may intentionally send a data packet with invalid content. If the corresponding eBPF program is deployed in the receiving environment (and the parameter settings are correct), the eBPF program can repair the invalid data before the receiving kernel sees the data, and then pass it to the kernel for processing. This allows the receiving application to read the information correctly. If the corresponding eBPF program is not deployed in the receiving environment (or the parameter settings are incorrect), the receiving kernel (and a malicious third party eavesdropping on the transmission path) will consider the data packet to be invalid and discard it, thereby protecting the security of the data.

[0057] In such a joint encryption method, when encryption is performed by an upper layer application at a node, for example node A, node A, which only transmits network transport layer data packets to the outside, does not need to place a management program in the user plane and does not need to load an eBPF program into the kernel.

[0058] Correspondingly, for node B receiving network transport layer data packets encrypted by an upper layer application at node A, it is necessary to place a management program in the user plane and load an eBPF program into the kernel, so as to cooperate to realize processing of network transport layer data packets.

[0059] Please refer to Figure 3. Figure 3 is another flow chart of a network transport layer data processing method provided in an embodiment of the present application. In this embodiment, the method is mainly applied to a management program running in a user plane.

[0060] In this embodiment, the specific operation of introducing a management program and loading an eBPF program into the kernel is as shown in FIG. 3. The network transport layer data processing method provided in this embodiment includes the following steps:

[0061] Step 301: The setting information is read from a predetermined address.

[0062] In this embodiment, when there is network transport layer data that needs to be distributed to the kernel, whether it is an internal network transport layer data packet that the kernel receives from other nodes, or an external network transport layer data packet that the kernel needs to send to other nodes, when it arrives at the kernel, it needs to be hooked to the eBPF program running in the kernel, and the corresponding network transport layer data processing, such as encryption processing or decryption processing, is performed on the network transport layer data packet hooked by the eBPF program, so that it is necessary to ensure that the eBPF program is already running in the kernel. Therefore, when the network transport layer data processing method provided in this embodiment is first executed, after the management program is located and launched in the user plane, the management program first needs to read the configuration information from a predetermined address, for example, from any configuration information file stored in the user plane.

[0063] In this embodiment, the setting information that the management program reads from a specified address similarly includes one or more of the encryption / decryption conditions, encryption rules, and decryption rules.

[0064] Step 302: Check the integrity of eBPF programs and configuration information that needs to be registered in the kernel.

[0065] In this embodiment, in order to ensure the performance and safety of processing network transport layer data packets based on the eBPF program registered in the kernel, the management program must first check the integrity of the eBPF program and the configuration information before registering the pre-designed eBPF program in the kernel and setting the read configuration information in the configuration information mapping table corresponding to the eBPF program.

[0066] Step 303: If both the eBPF program and the configuration information are complete, the eBPF program is registered in the kernel and the eBPF program is run in the kernel.

[0067] Specifically, the management program loads the bytecode of the eBPF program into the kernel of the local environment, then loads the eBPF program into the kernel, and subsequently exchanges data with the eBPF program via system calls / interfaces (syscalls).

[0068] The management program also provides an external management and query interface, e.g., a user interaction interface, so that the eBPF program running in the kernel can perform appropriate processing based on externally input operation commands.

[0069] Step 304: Set the configuration information in the configuration information mapping table corresponding to the eBPF program.

[0070] The configuration information mapping table described in this embodiment is a BPF MAP related to eBPF technology. In actual operation, configuration data or aggregated data collected during operation is exchanged between the eBPF program and the management program provided in this embodiment by one or more BPF MAPs.

[0071] It should be noted that the above example is merely an example for better understanding of the technical scheme of this embodiment, and is not intended to uniquely limit this embodiment.

[0072] Step 305: Enter the message processing cycle operation.

[0073] In this embodiment, entering the above message processing cycle operation refers to the following: A message queue is constructed in advance, and whenever a message that needs to be processed, such as an operation command for the eBPF program and / or aggregated data written by the eBPF program to the BPF MAP in the process of processing network transport layer data packets, is detected, the received message that needs to be processed is first added to the message queue, and then the information that needs to be processed is sequentially read from the message queue, and according to the specific type of the currently read information that needs to be processed, one of steps 306 to 309 is proceeded to and the corresponding operation is performed.

[0074] Step 306: When a setting information update command for the eBPF program is received, the setting information that needs to be updated is extracted from the setting information update command, and the setting information mapping table corresponding to the eBPF program is updated based on the extracted setting information that needs to be updated.

[0075] Step 307: When an eBPF program replacement command for an eBPF program is received, the replacement eBPF program is extracted from the eBPF program replacement command, the replacement eBPF program is registered in the kernel, and after the replacement eBPF program is registered in the kernel, the eBPF program running in the kernel is unloaded.

[0076] Step 308: When an eBPF program unload command for an eBPF program is received, the eBPF program running in the kernel is unloaded.

[0077] Step 309: Aggregated data in the processing process for the network transport layer data packet aggregated by the eBPF program ReceivedIn this case, the aggregated data is stored in a predetermined storage area and / or displayed in a predetermined format.

[0078] It is easily understood that steps 306 and 307 in this embodiment are almost the same as some of the specific processing methods shown in steps 202 and 203 in the embodiment shown in FIG. 2, so the description will not be repeated here.

[0079] In addition, the management program according to this embodiment, the configuration information that needs to be read, the eBPF program, and interactions with external inputs are specifically as shown in FIG. 4, and the description will not be repeated here.

[0080] Therefore, in the network transport layer data processing method provided in this embodiment, before performing network transport layer data processing, a management program running on the user plane is used to load an eBPF program into the kernel, and the configuration management of the eBPF program is performed, for example, by setting the configuration information used by the eBPF program in the encryption / decryption process in a configuration information mapping table, so that when there is a network transport layer data packet that needs to be distributed by the kernel, the eBPF program can perform the corresponding encryption and decryption processes.

[0081] Please refer to Figure 5. Figure 5 is a flow chart of a network transport layer data processing method provided in an embodiment of the present application. In this embodiment, the method is mainly applied to an eBPF program running in the kernel.

[0082] The network transport layer data processing method described in this embodiment specifically refers to encryption or decryption processing of network transport layer data packets that the kernel needs to distribute, by an eBPF program running in the kernel.

[0083] As shown in FIG. 5, the network transport layer data processing method provided in this embodiment includes the following steps:

[0084] Step 501: Obtain a network transport layer data packet that needs to be distributed.

[0085] The network transport layer data packet to be distributed in this embodiment specifically refers to a received network transport layer data packet that the kernel needs to distribute to an upper layer application of the node, for example, an application program running on the user plane. In other words, the network transport layer data packet to be distributed is from another node.

[0086] Also, as an example, the network transport layer data packets that need to be distributed may be those that are distributed from the kernel to other nodes, i.e., the network transport layer data packets that need to be distributed are those that need to be sent from the kernel to other nodes.

[0087] In addition, in actual operation, the eBPF program loaded into the kernel is not always in an operational or enabled state, but is triggered by the kernel only when a network transport layer data packet that needs to be distributed arrives at the kernel, and executes the network transport layer data processing method provided in this embodiment.

[0088] Correspondingly, the acquired network transport layer data packets that need to be distributed are actually transmitted to the eBPF program after the kernel triggers the eBPF program.

[0089] Step 502: Analyze the network transport layer data packet to determine a network transport layer data processing scheme that needs to be performed on the network transport layer data packet.

[0090] In this embodiment, in a normal case, the protocol header of a network transport layer data packet is accompanied by information such as the protocol used in transmitting the network transport layer data packet, the 4-tuple, etc. Therefore, when determining the network transport layer data processing method to be performed on the network transport layer data packet, the network transport layer data packet is analyzed, and the protocol header of the network transport layer data packet is further extracted, and it is determined whether the network transport layer data packet needs to be encrypted or decrypted based on the protocol header and the preset encryption / decryption conditions.

[0091] Correspondingly, if it is determined that the network transport layer data packet needs to be encrypted, the network transport layer data processing method that needs to be applied to the network transport layer data is determined to be encryption processing.If it is determined that the network transport layer data packet needs to be decrypted, the network transport layer data processing method that needs to be applied to the network transport layer data is determined to be decryption processing.

[0092] The encryption / decryption conditions described in this embodiment are specifically provided by a management program that operates on the user plane. In actual operation, the encryption / decryption conditions may be a predetermined protocol for encrypting or decrypting a network transport layer data packet transmitted by the protocol.

[0093] Furthermore, the encryption / decryption conditions may be regulations for a specific port number (source port number and / or destination port number) or a specific IP address (source IP address and / or destination IP address).

[0094] It should be noted that the above example is merely an example for better understanding of the technical scheme of this embodiment, and is not intended to uniquely limit this embodiment.

[0095] In addition, in actual operation, before determining the network transport layer data processing method that needs to be performed on the network transport layer data packet, it may first be determined whether or not the network transport layer data packet needs to be subjected to network transport layer data processing, and if not, the packet may be directly handed over to the kernel for subsequent distribution operations, and if so, the network transport layer data processing method that needs to be performed may be determined.

[0096] In this embodiment, the network transport layer data processing method for the network transport layer data packets that need to be distributed is roughly divided into encryption processing and decryption processing. In actual operation, the network transport layer data packets that need to be sent to other nodes are usually encrypted, and the network transport layer data packets that need to be received from other nodes are decrypted. Based on this, when determining the network transport layer data processing method that needs to be performed for the network transport layer data packets, specifically, it is necessary to first identify whether the current network data is the one that needs to be sent or the one that has been received.

[0097] Correspondingly, if received, it is determined whether the network transport layer data packet needs to be specifically decrypted, and if it needs to be transmitted, it is determined whether the network transport layer data packet needs to be specifically encrypted.

[0098] Step 503: Processing the network transport layer data packet according to a network transport layer data processing method.

[0099] In this embodiment, when the determined network transport layer data processing method is encryption processing, the following processing is specifically performed on the network transport layer data packet.

[0100] First, a target encryption rule is selected from among preset encryption rules.

[0101] In this embodiment, the above-mentioned preset encryption rule is also provided by a management program that operates in the user plane. Specifically, the management program reads configuration information including the encryption rule from a predetermined address, and sets the read configuration information in a configuration information mapping table corresponding to the eBPF program. Therefore, the operation of selecting the target encryption rule is specifically to select an encryption rule that is suitable for a network transport layer data packet that needs to be encrypted from the configuration information mapping table.

[0102] In actual practice, the encryption rule must include at least a specific encryption algorithm.

[0103] If keys are involved, the encryption rule must further include the encryption key, which may be understood as an encryption parameter.

[0104] In addition, in actual operation, the method of selecting a target encryption rule that matches a network transport layer data packet that currently needs to be encrypted can be determined based on the contents of the protocol header of the network transport layer data packet that currently needs to be encrypted.

[0105] For example, if a specific encryption method and key to be used in correspondence with a certain protocol, a certain port number, or a certain IP address are specified in advance, then when selecting a target encryption rule, it is possible to quickly and accurately select one encryption rule that is suitable for the network transport layer data packet based on the protocol header of the network transport layer data packet that needs to be encrypted.

[0106] Additionally, as an example, the same encryption rule may be used for all network transport layer data packets that require encryption.

[0107] Next, encryption processing is performed on the payload portion of the network transport layer data packet based on the symmetric encryption rule.

[0108] Then, the protocol header is updated based on the encrypted payload portion to obtain an encrypted network transport layer data packet.

[0109] After encryption processing, the length of the encrypted payload portion is usually different from the length of the unencrypted payload portion. Therefore, after the encrypted network transport layer data packet is transmitted to another node, it must be ensured that the encrypted network transport layer data packet is not mistaken for unauthorized data due to a mismatch between the length information recorded in the protocol header and the length of the payload portion of the actually received network transport layer data packet. Therefore, after encryption processing is performed on the payload portion of the network transport layer data packet based on the target encryption rule, it is necessary to update the protocol header based on the encrypted payload portion and ensure that the information recorded in the protocol header of the finally obtained encrypted network transport layer data packet matches the length of the encrypted payload portion.

[0110] Finally, the encrypted network transport layer data packet is passed to the kernel, which then distributes the encrypted network transport layer data packet.

[0111] This provides encryption of network transport layer data that needs to be distributed.

[0112] Correspondingly, when the determined network transport layer data processing method is decryption processing, the specific processing method performed on the network transport layer data packet is as follows: First, a target decryption rule is selected from among pre-set decryption rules; Next, decryption processing is performed on the payload part of the network transport layer data packet based on the target decryption rule; Next, a protocol header is updated based on the decrypted payload part to obtain a decrypted network transport layer data packet; Finally, the decrypted network transport layer data packet is passed to a kernel, and the kernel distributes the decrypted network transport layer data packet.

[0113] To ensure that the network transport layer data packet that has been encrypted by the eBPF program reaches the kernel of the other node and is decrypted by the eBPF program running in the kernel of the other node, the decryption rule must correspond to the encryption rule, thereby ensuring that the encrypted network transport layer data packet is decrypted and returned to the original network transport layer data packet.

[0114] Therefore, the network transport layer data processing method provided in this embodiment loads and runs a management program capable of managing an eBPF program in the user plane, registers the eBPF program in advance in the kernel using the management program, and hooks the eBPF program to be distributed by the kernel, for example, network transport layer data packets to be sent and received. Then, a network transport layer data processing method for the network transport layer data packets to be distributed is determined, and finally, based on the determined network transport layer data processing method, processing is performed on the network transport layer data packets currently hooked by the eBPF program. Since the entire process of network transport layer data processing can be completed by the eBPF program in the rewritten kernel, the system environment or upper layer application does not need to change its own state and be involved in the actual network transport layer data processing process, realizing transparency to the system environment or upper layer application. Therefore, no extra deployment, configuration, operation and management, and development costs are required, and excellent compatibility between the system environment and the upper layer application is also guaranteed.

[0115] Also, as an example, when absolute transparency is not pursued or when there is a special data protection requirement, the eBPF program and the upper layer application may cooperate to realize data encryption or protection. For example, an upper layer application may intentionally send a data packet with invalid content. If the corresponding eBPF program is deployed in the receiving environment (and the parameter settings are correct), the eBPF program can repair the invalid data before the receiving kernel sees the data, and then pass it to the kernel for processing. This allows the receiving application to read the information correctly. If the corresponding eBPF program is not deployed in the receiving environment (or the parameter settings are incorrect), the receiving kernel (and a malicious third party eavesdropping on the transmission path) will consider the data packet to be invalid and discard it, thereby protecting the security of the data.

[0116] In such a joint encryption method, when encryption is performed by an upper layer application at a node, for example node A, node A, which only transmits network transport layer data packets to the outside, does not need to place a management program in the user plane and does not need to load an eBPF program into the kernel.

[0117] Correspondingly, for node B receiving network transport layer data packets encrypted by an upper layer application at node A, it is necessary to place a management program in the user plane and load an eBPF program into the kernel, so as to cooperate to realize processing of network transport layer data packets.

[0118] In addition, based on the security and high performance of the eBPF technology itself, the security and overall performance of the network transport layer data processing scheme provided in this embodiment are also guaranteed.

[0119] In addition, the eBPF program can be loaded into the kernel by a management program running in the user plane, and the eBPF program can be managed by the management program. Therefore, in actual operation, when the eBPF program running in the kernel receives a configuration information update command sent from the user plane management program, it updates the pre-configured configuration information based on the configuration information update command. That is, it updates the configuration information set in the configuration information mapping table, specifically, any one or more of the encryption / decryption conditions, encryption rules, and decryption rules. This realizes dynamic update of the eBPF program running in the kernel, allowing the eBPF program running in the kernel to better adapt to the requirements of actual network transport layer data processing.

[0120] Please refer to Figure 6. Figure 6 is a flow chart of a network transport layer data processing method provided in an embodiment of the present application. In this embodiment, the method is mainly applied to an eBPF program running in the kernel.

[0121] As shown in FIG. 6, the network transport layer data processing method provided in this embodiment includes the following steps:

[0122] Step 601: Obtain a network transport layer data packet that needs to be distributed.

[0123] It is easily understood that step 601 in this embodiment is substantially the same as step 501 in the embodiment shown in FIG. 5, and therefore the description will not be repeated here.

[0124] Step 602: Analyze the network transport layer data packet to determine whether the network transport layer data packet needs to be processed.

[0125] In this embodiment, not all network transport layer data packets that the kernel needs to distribute need to be encrypted or decrypted, for example, when they are simply responses to information or requests sent to the other node, etc. Therefore, before determining the network transport layer data processing method of the network transport layer data packets that need to be distributed, it can first be determined based on the identification information attached to the protocol header of the analyzed network transport layer data packets whether the network transport layer data packets currently need to be distributed need to be encrypted or decrypted.

[0126] Correspondingly, if it is determined that the network transport layer data packet needs to be processed, proceed to step 603 to determine the specific network transport layer data processing method that needs to be performed on the network transport layer data packet. Conversely, if it is determined that the network transport layer data packet does not need to be processed, proceed to step 610 to directly pass the hooked network transport layer data packet to the kernel, and the kernel distributes it.

[0127] Step 603: Identify whether the network transport layer data packet is a network transport layer data packet that needs to be transmitted or a received network transport layer data packet.

[0128] As can be seen from the above description, for a network transport layer data packet that needs to undergo network transport layer data processing, if the network transport layer data packet is a network transport layer data packet that needs to be sent by the kernel to another node, the network transport layer data processing method that needs to be performed is encryption processing.

[0129] Correspondingly, when a network transport layer data packet that needs to undergo network transport layer data processing needs to be fed back from the kernel to an upper layer application, i.e., an application program located in the user plane, or is a network transport layer data packet received by the kernel from another node, the network transport layer data processing method that needs to be performed is a decoding process.

[0130] Based on this, it is possible to quickly determine a specific processing method for a network transport layer data packet that needs to be processed, simply by identifying whether the network transport layer data packet is a network transport layer data packet that needs to be transmitted or a received network transport layer data packet.

[0131] Correspondingly, if the network transport layer data packet is identified as a network transport layer data packet that needs to be transmitted, proceed to step 603. Conversely, if the network transport layer data packet is identified as a received network transport layer data packet, proceed to step 607.

[0132] Step 604: Encrypt the payload portion of the network transport layer data packet.

[0133] Step 605: Update the protocol header of the network transport layer data packet.

[0134] Step 606: Pass the encrypted network transport layer data packet to the kernel, which distributes the encrypted network transport layer data packet.

[0135] Step 607: Decrypt the payload portion of the network transport layer data packet.

[0136] Step 608: Update the protocol header of the network transport layer data packet.

[0137] Step 609: Pass the decrypted network transport layer data packet to the kernel, and the kernel distributes the decrypted network transport layer data packet.

[0138] Step 610: Pass the network transport layer data packet to the kernel, which handles distribution of the network transport layer data packet.

[0139] As a result, the network transport layer data processing method provided in this embodiment uses the eBPF program to effectively resolve the intrusion impact on the system environment and upper layer applications when traditional network transport layer data transmission encryption protocols are used, providing more flexible and powerful data transmission encryption and protection functions, and bringing better isolation and assurance in terms of security.

[0140] In addition, eBPF technology supports multiple program types, and different types of programs are used for different purposes. Currently, the Traffic Control (TC) type is more suitable for implementing the transmission encryption function. Therefore, the encryption process or DecryptionThe eBPF program that performs the processing is specifically a TC type eBPF program. By loading a TC type eBPF program into the kernel, the Linux kernel can directly hook the entrance and exit of processing the network transport layer data packet. Before the kernel receives or sends a network transport layer data packet, the TC program directly accesses the memory buffer area where the original network transport layer data packet is temporarily stored. Then, based on the address of the memory buffer area corresponding to the original network transport layer data packet, it obtains the network transport layer data packet that needs to be processed from the memory buffer area. Then, it performs the corresponding network transport layer data processing operation on the obtained network transport layer data packet, and after the corresponding network transport layer data processing operation is completed, it is passed to the kernel, and the kernel distributes and processes it.

[0141] Obviously, by using the TC type eBPF program, the specific implementation and configuration logic of data encryption / decryption can be integrated into one soft hardware unit, so that the encryption / decryption of network transport layer data can be completed without the system environment and upper layer applications knowing the details at all. In addition, the eBPF program can be dynamically loaded / unloaded during operation, just like the kernel, so the network transport layer data processing method provided in this embodiment can realize the activation / deactivation of encryption / decryption function during operation, or the dynamic replacement of encryption algorithm and configuration data, while the operating system and upper layer applications do not need to be aware of these operational changes at all.

[0142] In addition, the use of the TC type eBPF program in this embodiment is determined based on the current state of eBPF technology, and if another suitable type appears in the future rapid evolution of eBPF technology, the method implemented in this embodiment can also be realized with that. In other words, the realization of network transmission data processing using the TC type eBPF program in this embodiment is merely one specific realization method, and does not impose any limitations on the technical scheme itself provided in this embodiment.

[0143] Also, as an example, when absolute transparency is not pursued or when there is a special data protection requirement, the eBPF program and the upper layer application may cooperate to realize data encryption or protection. For example, an upper layer application may intentionally send a data packet with invalid content. If the corresponding eBPF program is deployed in the receiving environment (and the parameter settings are correct), the eBPF program can repair the invalid data before the receiving kernel sees the data, and then pass it to the kernel for processing. This allows the receiving application to read the information correctly. If the corresponding eBPF program is not deployed in the receiving environment (or the parameter settings are incorrect), the receiving kernel (and a malicious third party eavesdropping on the transmission path) will consider the data packet to be invalid and discard it, thereby protecting the security of the data.

[0144] In addition, in order to better understand the network transport layer data processing method provided in this embodiment that is applied to the management program running on the user plane and the network transport layer data processing that is applied to the eBPF program running on the kernel, the following will provide a detailed description of the network transport layer data processing, specifically the encryption and decryption processes, realized through the cooperation of the management program and the eBPF program, in conjunction with Figures 7 and 8.

[0145] First, in actual operation, the receiver of the network transport layer data packet (hereafter referred to as the data receiver) and the sender of the network transport layer data packet (hereafter referred to as the data sender) must both use a Linux system, the kernel version must be 4.3 or higher, and eBPF-related functions must be activated.

[0146] Furthermore, both sides of a data communication, ie, the data sender and the data receiver, must communicate using a standard network transport layer protocol stack, such as IP, TCP / UDP.

[0147] In addition, in actual operation, the management program running on the user plane and the eBPF program running on the kernel may be packaged into a single software package SDK and distributed and deployed in the form of software, or may be packaged within a single mobile hardware and distributed and deployed in the form of a hardware unit.

[0148] In addition, currently, some mainstream manufacturers' network cards on the market already support the direct loading and running of eBPF programs. This means that the specific network transport layer data processing work can be completed by a dedicated chip in the network card without relying on the operating system kernel. Therefore, for this type of equipment, the eBPF program can be directly loaded and run in the equipment, so it only needs to manage the management program running on the user plane to establish communication between the two.

[0149] Please refer to Figure 7. Figure 7 is a schematic diagram of achieving full transparent transmission encryption between node A and node B. That is, the application program (upper layer application) located in the user plane does not participate in encryption and decryption, and neither the system environment nor the upper layer application of node A and node B is aware of the whole process of transmission encryption.

[0150] For the sake of convenience in the following explanation, we will first assume that the upper layer application, i.e., the application program and the encryption system (management program + eBPF program), satisfy the following settings.

[0151] The upper layer application communicates with the same application on another remote end on port 1080 using the TCP protocol, as shown in Figure 7 for Node A and Node B. The network devices of Node A and Node B are both eth0. The file name of the eBPF program is eBPF.elf. The function name responsible for encryption in the eBPF program is encrypt, and the function name responsible for decryption in the eBPF program is decrypt.

[0152] The management program needs to run on node A and node B, and loads the eBPF program with a command like the following (specifically, it loads the encryption and decryption functions in the eBPF program):

[0153] Loading the cryptography functions in an eBPF program:<tc filter add dev eth0 egress bpf da obj eBPF.elf sec encrypt>

[0154] Load the decryption function in your eBPF program:<tc filter add dev eth0 inress bpf da obj eBPF.elf sec decrypt>

[0155] When the above two load commands are executed, whether it is the kernel of node A or the kernel of node B, when sending a network transport layer data packet to eth0 (egress), it calls the encrypt function in the previously mounted eBPF program and passes the original kernel data buffer (socket kernel buffer, skb) pointer to the function.

[0156] The specific processing process of the encrypt function is as follows:

[0157] (1) Perform Ethernet protocol analysis on the skb (analyze and strip the ethernet header).

[0158] (2) Determine whether the payload portion of the network transport layer data packet is an IP protocol. If not, the process ends. 9 ) to proceed.

[0159] (3) Perform IP protocol analysis on the payload portion (analyze and strip the IP header), and if the payload protocol in the IP header does not indicate TCP, end the process. 9 ) to proceed.

[0160] (4) Perform TCP protocol analysis on the payload (analyze and strip the TCP header) and determine whether the target port is 1080. If not, the process ends. 9 ) to proceed.

[0161] (5) Calculate the data payload range (start pointer and end pointer) of the IP protocol.

[0162] (6) Encryption is performed on the IP protocol payload using a stream encryption algorithm (Rivest Cipher 4, RC4).

[0163] Note that the above is only one specific encryption algorithm. In actual operation, a person skilled in the art can select an encryption algorithm as needed, send the selected encryption algorithm to the management program, and configure it through the management program.

[0164] (7) Write back the encrypted data (you can use the bpf_skb_store_bytes in the kernel's bpf helper function), and update the IP header (mainly updating the length and check code; you can use the bpf_l3_csum_replace in the bpf helper function).

[0165] (8) The bpf helper function in the kernel: Call bpf_skb_adjust_room to update the skb.

[0166] (9) Processing ends (the kernel then proceeds to send the data after the update is complete).

[0167] This completes the encryption process for the network transport layer data packets of the eBPF program.

[0168] Correspondingly, when the load command is executed, whether it is the kernel of node A or the kernel of node B, if a network transport layer data packet is received from eth0 (ingress), it will call the decrypt function in the previously mounted eBPF program and pass the original data buffer (sk_buff, skb) pointer to the function.

[0169] The specific processing process of the decrypt function is as follows:

[0170] (1) Perform Ethernet protocol analysis on the skb (analyze and strip the ethernet header).

[0171] (2) It is determined whether the payload portion is an IP protocol. If not, the process ends. That is, the process proceeds to step (9).

[0172] (3) IP protocol analysis is performed (the IP header is analyzed and stripped), and if the payload protocol of the IP header does not indicate TCP, the process is terminated, i.e., the process proceeds to step (9).

[0173] (4) Perform TCP protocol analysis on the payload (analyze and strip the TCP header), and if the format is correct, this means that the data has not been encrypted, so the process ends without any further action, i.e., proceed to step (9).

[0174] (5) The IP payload portion is decrypted using the RC4 algorithm.

[0175] Since the encryption process above used the RC4 algorithm, the decryption process must also use the RC4 algorithm.

[0176] (6) A TCP protocol header inspection is performed on the decrypted data, and if the data is invalid, for example, the value of a certain field is not within the valid range, or the target port is not 1080, the process ends without any modification, i.e., the process proceeds to step (9).

[0177] (7) Write back the decrypted data (bpf helper function: bpf_skb_store_bytes can be used), and update the IP header (mainly updating the length and check code; bpf helper function: bpf_l3_csum_replace can be used).

[0178] (8) The bpf helper function in the kernel: Call bpf_skb_adjust_room to update the skb.

[0179] (9) Processing ends (the kernel then receives the data after the update is complete).

[0180] This completes the decoding process for the network transport layer data packet of the eBPF program.

[0181] In addition, in actual operation, the encrypt and decrypt functions need to perform the following further operations:

[0182] From the specified configuration information mapping table (BPF MAP), it obtains the necessary parameters transmitted by the management program, such as the relevant parameters of the RC4 encryption algorithm, the TCP port number, etc. It also records some operation summary data, such as the total number of encrypted / decrypted packets and the number of successes / failures, in the specified BPF MAP.

[0183] In addition, the management program not only loads the eBPF program during the initialization phase, but also transmits parameters required for the encrypt and decrypt functions through the BPF MAP, such as parameters related to the RC4 encryption algorithm and TCP port numbers, collects aggregate data recorded by the encrypt and decrypt functions during operation through the BPF MAP, such as the total number of encrypted / decrypted packets and the number of successes / failures, and allows users to manage and query the eBPF program's operating parameters, such as 4-tuple information (port number, address, etc.), and operating status, such as the number of encryption / decryption successes, and how much invalid or valid data was detected, through a command line (or other format such as Restful) interface.

[0184] As can be seen from the above description, in the fully transparent transmission encryption method, the upper layer application is not involved in the encryption / decryption flow of the network transport layer. Therefore, it does not know any details such as algorithms, parameters, timing, etc. adopted by the lower layer transmission encryption system, and when sending and receiving network data, it processes everything in clear text format without considering encryption / decryption. In this way, the upper layer application can realize encryption / decryption of network transport layer data without any operation or setting change, and since the upper layer application does not know any details of the encryption flow, even if an attacker attacks, he / she cannot understand the details of the actual encryption / decryption flow, and cannot obtain important encryption / decryption sensitive data such as keys. Therefore, not only does it solve the technical problems of the conventional non-transparent transmission encryption, such as the burden of extra configuration, setting, operation and management, and development, and the risk, but it also ensures the safety of the data content in the network transport layer data packet to be transmitted.

[0185] Please refer to Figure 8. Figure 8 is a schematic diagram of implementing joint encryption with an upper layer application program between node A and node B. That is, an application program located in the user plane is involved in encryption or decryption processing by an eBPF program running in the kernel for network transport layer data packets that need to be delivered.

[0186] Specifically, in a collaborative transmission encryption method involving an upper layer application, the upper layer application cooperates with the encryption system to achieve the encryption / decryption flow of the transmission data. There are several cooperation methods, including:

[0187] Method 1: The application program is responsible for encrypting the data it sends, and the eBPF program on the other side is responsible for decrypting the data it receives.

[0188] Method 2: The application program is responsible for decrypting the data it receives, and the other eBPF program is responsible for encrypting the data it sends.

[0189] Method 3: The application program is responsible for encrypting and decrypting the transmitted and received data, and the eBPF program is responsible for scrambling and descrambling the encrypted data when transmitting and receiving data. In other words, the eBPF program performs secondary processing of the data encrypted or decrypted by the upper layer application.

[0190] However, the above different cooperation methods only target one thing, that is, the data encryption / decryption process can only be achieved successfully when the upper layer application and the eBPF program are present. If any one part is missing, the data cannot be decrypted correctly. Although such a flexible and diverse joint encryption / decryption mechanism partially loses transparency (it needs to be involved in the encryption / decryption process as a task of the upper layer), it can effectively improve the overall security of data encryption.

[0191] Regarding the above method 3, in actual operation, it is necessary to place a management program and an eBPF program on both node A and node B, and to make the eBPF program support calls to the encrypt and decrypt functions. This can be realized in almost the same way as the explanation for Figure 7, but the user plane application program needs to include encryption and decryption functions. Decryption The operation is added.

[0192] The above-mentioned scheme 1 will be described in detail below in conjunction with Fig. 8. Other joint encryption schemes are similar in concept, and only differ in specific implementation operations and application scenarios.

[0193] In the above method 1, specifically, in node A, an application program encrypts data that needs to be transmitted using a predetermined encryption algorithm, for example, an asymmetric encryption algorithm, and in node B, a management program arranged in the user plane loads an eBPF program for decryption into the kernel. This method is particularly applicable to the following characteristics and requirements: a situation in which the application on the data sending side can be fully controlled (code and settings can be changed), a situation in which the data transmission channel is unreliable and uncontrollable, a situation in which the application on the data receiving side cannot be controlled (code and settings cannot be changed), a situation in which the network settings of the environment in which the sender and receiver exist cannot be or are difficult to change, and a situation in which only encryption of the transmitted data is required, and encryption of the response data returned from the remote end is not required.

[0194] For the sake of convenience in the following explanation, it is first assumed that the upper layer application and the encryption system satisfy the following settings.

[0195] The upper layer application communicates with the same application on another remote end on port 1080 using the TCP protocol, as in node A and node B in Figure 8. The network devices of node A and node B are both eth0. A management program runs on the user plane of node B, and an eBPF program runs on the kernel of node B. The file name of the eBPF program is eBPF.elf, and the eBPF program is responsible for decryption only. The name of the function responsible for decryption is decrypt.

[0196] At the data sending side, i.e., node A in Fig. 8, the upper layer application uses one kind of asymmetric encryption algorithm (such as X25519 elliptic curve encryption algorithm or other similar algorithms) to encrypt the TCP payload data that needs to be sent using the public key before sending it. In addition, there is no need for a management program to exist on node A, and there is no need to load any eBPF program.

[0197] At the data receiving side, i.e., Node B in Fig. 8, a management program must exist in the user plane, and an eBPF program must exist in the kernel. Furthermore, the management program at Node B must load the eBPF program (specifically, the decryption function in the eBPF program) with the following command: Load the decryption function in the eBPF program:<tc filter add dev eth0 inress bpf da obj eBPF.elf sec decrypt> .

[0198] Correspondingly, when the load command is executed, when the kernel of node B receives a network transport layer data packet sent from node A from eth0 (ingress), it calls the decrypt function in the previously mounted eBPF program and passes the skb pointer to the function.

[0199] The specific processing process of the decrypt function is as follows:

[0200] (1) Perform Ethernet protocol analysis on the skb (analyze and strip the ethernet header).

[0201] (2) It is determined whether the payload portion is an IP protocol. If not, the process ends. That is, the process proceeds to step (8).

[0202] (3) IP protocol analysis is performed (the IP header is analyzed and stripped), and if the payload protocol of the IP header does not indicate TCP, the process is terminated, i.e., the process proceeds to step (8).

[0203] (4) A TCP protocol analysis is performed on the payload portion (the TCP header is analyzed and stripped off), and if the format is invalid or the target port is not 1080, the process is terminated. In other words, the process proceeds to step (8).

[0204] (5) Decrypt the TCP payload portion using the X25519 algorithm and a secret key.

[0205] Note that the above is just one specific decryption algorithm, and in actual operation, a person skilled in the art would be able to select an encryption algorithm as needed, send the selected decryption algorithm to the management program, and configure it via the management program.

[0206] In addition, the decryption method that the eBPF program complies with when performing decryption must correspond to the encryption method adopted by the application program on node A.

[0207] (6) Write back the decrypted data (the bpf helper function bpf_skb_store_bytes can be used), and update the TCP and IP headers (mainly updating the length and check code; the bpf helper functions bpf_l3_csum_replacebpf_l3_csum_replace and bpf_l4_csum_replace can be used).

[0208] (7) Call bpf_skb_adjust_room in the bpf helper function in the kernel to update skb.

[0209] (8) Processing ends (the kernel then receives the data after the update is complete).

[0210] This completes the decoding of the network transport layer data packet in Node B using the eBPF program in the kernel.

[0211] In addition, the decrypt function must also perform operations transmitted by the management program from the specified BPF MAP, operations to obtain necessary parameters such as the relevant parameters of the X25519 encryption algorithm, the secret key, and the TCP port number, and operations to record some operation summary data in the specified BPF MAP, such as the total number of encrypted / decrypted packets and the number of successes / failures.

[0212] In addition, in actual operation, the management program running on the user plane of Node B not only loads the eBPF program at the initialization stage, but also transmits parameters required for the decrypt function through the BPF MAP, such as related parameters of the X25519 encryption algorithm, secret key, TCP port number, etc., collects aggregate data recorded by the decrypt function during operation through the BPF MAP, such as the total number of decrypted packets and the number of successes / failures, and allows users to manage and query the operating parameters and operating status of the eBPF program through a command line (or other format, such as Restful) interface.

[0213] This enables joint encryption between upper layer applications and eBPF programs, further improving the security of transmitted data while ensuring as much transparency as possible.

[0214] As can be seen from the above description, the network transport layer data processing method provided in this embodiment realizes network transport layer communication encryption under the circumstances that are not recognized by the system environment settings and upper layer applications. Therefore, it has low deployment costs and good compatibility with environments and applications. In addition, the encryption algorithm, parameters, and switches can be changed and activated at any time during operation, and the upper layer application can also choose to cooperate with the system to realize a customized joint encryption protection mechanism, so it has good flexibility and scalability. Finally, because it is based on eBPF technology, the method is also guaranteed in terms of security and performance.

[0215] Moreover, the delineation of the steps of the above various methods is only for the purpose of clarity of description. The implementation may be combined into one step, or any step may be divided into multiple steps, and as long as the same logical relationship is included, they are all within the scope of protection of this application. Making minor changes to the algorithm or flow, or introducing minor designs, without changing the core design of the algorithm and flow, is also within the scope of protection of this application.

[0216] Please refer to Figure 9. Figure 9 is a structural schematic diagram of a network transport layer data processing device provided in an embodiment of the present application.

[0217] As shown in FIG. 9, the network transport layer data processing device provided in this embodiment includes at least one processor 901 and a memory 902 communicatively connected to the at least one processor.

[0218] In addition, in order to realize fully transparent transmission encryption, or to realize transmission encryption in cooperation with an upper layer application program according to a service request, the network transport layer data processing device further includes a management program running in the user plane and an eBPF program running in the kernel.

[0219] The management program is used to load or register the eBPF program into the kernel of the host environment so that the eBPF program can run within the kernel. The memory 902 stores instructions executable by the at least one processor 901, and the instructions are executed by the at least one processor 901 to cause the at least one processor 901 to execute the network transport layer data processing method described in the method embodiment applied to the management program above, or the network transport layer data processing method described in the method embodiment applied to the eBPF program.

[0220] The memory 902 and the processor 901 are connected in a bus system. The bus may include any number of interconnected buses and bridges, and the bus may connect one or more of the processor 901 and memory 902 circuits together. The bus may also connect other circuits together, such as peripherals, voltage regulators, power management circuits, etc., which are known in the art and will not be described in detail here. The bus interface is an interface between the bus and a transceiver. The transceiver may be a single component or multiple components, such as multiple receivers and transmitters, and provides a means for communicating with other devices over a transmission medium. The data processed by the processor 901 is transmitted over a wireless medium via an antenna. Furthermore, the antenna receives the data and transmits the data to the processor 901.

[0221] The processor 901 is responsible for bus management and general processing, and may provide a variety of functions, including timers, peripheral interfaces, voltage regulation, power management and other control functions. The memory 902 may be used to store data used by the processor 901 in performing operations.

[0222] The present embodiment further relates to a computer readable storage medium having stored thereon a computer program which, when executed by a processor, implements the network transport layer data processing method as described in the method embodiment above.

[0223] That is, as can be understood by those skilled in the art, all or some of the steps in the methods of the above embodiments can be achieved by instructing relevant hardware by a program. The program is stored in a storage medium and includes several instructions for making an apparatus (such as a single-chip computer, chip, etc.) or a processor execute all or some of the steps of the methods described in each embodiment of the present application. The storage medium includes various media capable of storing program code, such as U disk, mobile hard disk, ROM (Read-Only Memory), RAM (Random Access Memory), magnetic disk, or optical disk.

[0224] As will be understood by those skilled in the art, the above embodiments are specific examples for implementing the present application, but in actual practice, various changes in form and details are possible without departing from the spirit and scope of the present application.

Claims

1. 1. A network transport layer data processing method applied to an extended Berkeley Packet Filter (eBPF) program running in a kernel, comprising: obtaining a network transport layer data packet that needs to be distributed; analyzing the network transport layer data packet to determine a network transport layer data processing scheme that needs to be performed on the network transport layer data packet; and performing processing on the network transport layer data packet based on the network transport layer data processing method; said step of analyzing said network transport layer data packets to determine a network transport layer data processing scheme that needs to be performed on said network transport layer data packets comprises: parsing the network transport layer data packet to extract a protocol header of the network transport layer data packet; determining whether the network transport layer data packet needs encryption or decryption based on the protocol header and a preset encryption / decryption condition provided by a management program running on a user plane; determining a network transport layer data processing method to be performed on the network transport layer data packet as encryption processing when the network transport layer data packet needs to be encrypted; If the network transport layer data packet needs to be decrypted, determining a network transport layer data processing method that needs to be performed on the network transport layer data packet as a decryption process. Network transport layer data processing method.

2. the network transport layer data processing method is the encryption process; The step of processing the network transport layer data packet based on the network transport layer data processing method includes: selecting a target encryption rule from among preset encryption rules provided by the management program; performing encryption processing on a payload portion of the network transport layer data packet based on the symmetric encryption rule; updating the protocol header based on the encrypted payload portion to obtain an encrypted network transport layer data packet; passing the encrypted network transport layer data packet to a kernel, the kernel distributing the encrypted network transport layer data packet; 2. The network transport layer data processing method according to claim 1.

3. the network transport layer data processing method is the decryption process, The step of processing the network transport layer data packet based on the network transport layer data processing method includes: selecting a target decryption rule from among preset decryption rules provided by the management program; performing a decryption process on a payload portion of the network transport layer data packet based on the target decryption rule; updating the protocol header based on the decoded payload portion to obtain a decoded network transport layer data packet; passing the decrypted network transport layer data packet to a kernel, the kernel distributing the decrypted network transport layer data packet; 2. The network transport layer data processing method according to claim 1.

4. receiving a configuration information update command transmitted from a management program running on a user plane; updating preset setting information based on the setting information update command; The setting information includes one or more of an encryption / decryption condition, an encryption rule, and a decryption rule. The network transport layer data processing method according to any one of claims 1 to 3.

5. A network transport layer data processing method applied to a management program operating on a user plane, comprising: After the management program is started, monitoring whether an operation command for an eBPF program running in a kernel and / or aggregated data in a processing process for network transport layer data packets aggregated by the eBPF program is received; When an operation command for the eBPF program is received, a process is performed for the eBPF program based on the operation command; When receiving aggregated data in a processing process for a network transport layer data packet aggregated by the eBPF program, a step of processing the aggregated data is included; The eBPF program analyzes the network transport layer data packet, determines a network transport layer data processing method that needs to be performed on the network transport layer data packet, and processes the network transport layer data packet based on the network transport layer data processing method; said step of analyzing said network transport layer data packets to determine a network transport layer data processing scheme that needs to be performed on said network transport layer data packets comprises: parsing the network transport layer data packet to extract a protocol header of the network transport layer data packet; determining whether the network transport layer data packet needs encryption or decryption based on the protocol header and a preset encryption / decryption condition provided by a management program running on a user plane; determining a network transport layer data processing method to be performed on the network transport layer data packet as encryption processing when the network transport layer data packet needs to be encrypted; If the network transport layer data packet needs to be decrypted, determining a network transport layer data processing method that needs to be performed on the network transport layer data packet as a decryption process. Network transport layer data processing method.

6. The operation command is a setting information update command, an eBPF program replacement command, or an eBPF program unload command, When an operation command for the eBPF program is received, the step of performing a process on the eBPF program based on the operation command includes: If the operation command is the setting information update command, extracting setting information that needs to be updated from the setting information update command, and updating a setting information mapping table corresponding to the eBPF program based on the extracted setting information that needs to be updated; When the operation command is the eBPF program replacement command, extracting a replacement eBPF program from the eBPF program replacement command, registering the replacement eBPF program in a kernel, and unloading the eBPF program running in the kernel after registering the replacement eBPF program in the kernel; If the operation command is an eBPF program unload command, unloading the eBPF program running in the kernel.

6. The network transport layer data processing method according to claim 5.

7. When the eBPF program receives aggregated data in a processing process for a network transport layer data packet, the step of processing the aggregated data includes: storing the aggregated data in a predetermined storage area and / or displaying the aggregated data in a predetermined format; 7. A network transport layer data processing method according to claim 5 or 6.

8. After the management program is started, before a step of monitoring whether an operation command for an eBPF program running in a kernel and / or aggregated data in a processing process for network transport layer data packets aggregated by the eBPF program is received, reading setting information including one or more of encryption / decryption conditions, encryption rules, and decryption rules from a predetermined address; checking the integrity of the eBPF program and the configuration information that need to be registered in a kernel; If both the eBPF program and the setting information are complete, registering the eBPF program in a kernel and running the eBPF program in the kernel; setting the setting information in a setting information mapping table corresponding to the eBPF program; 7. A network transport layer data processing method according to claim 5 or 6.

9. A management program that operates in a user plane and an eBPF program that operates in a kernel, at least one processor, and a memory that is communicatively connected to the at least one processor; The management program is used to load the eBPF program into a kernel of a host environment and run the eBPF program in the kernel, and the memory stores instructions to be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to execute the network transport layer data processing method according to any one of claims 1 to 3 or the network transport layer data processing method according to claim 5 or 6. Network transport layer data processing equipment.

10. A computer-readable storage medium having a computer program stored thereon, the computer program implementing the network transport layer data processing method according to any one of claims 1 to 3, or the network transport layer data processing method according to claim 5 or 6, when executed by a processor. A computer-readable storage medium.

Images