CN105025004B - A kind of double stack IPSec VPN devices - Google Patents

Abstract

The invention discloses a kind of double stack IPSec VPN devices, belong to Network Communicate Security technical field.Double stack IPSec VPN devices of the invention include double stack VPN process parts, safety database structure and search part, security protocol process part, data stream transmitting machined part and CPU part.Compared with prior art, the present invention can be good at offer IPv4 and realize that VPN technologies need the Network Security Service provided into IPv6 transition processes, all using hardware circuits which process, CPU is used for safeguarding database and tables of data the process part of data flow, adapts to express network information security application.

Description

A dual-stack IPSec VPN device

technical field

The invention relates to the technical field of network communication security, in particular to a dual-stack IPSec VPN device.

Background technique

On the one hand, the openness of the network itself allows any user to access and enjoy its convenience. On the other hand, if the network communication does not take security protection measures, the communication data will be available to any user who enters the network. Yes, the communication process is not secure. For now, with the development of network technology and the rise of a large number of new network services, especially in the government, telecommunications, finance and data communication companies, the security requirements for network communications have reached an unprecedented height. The types of information have increased dramatically. The shortage of IPv4 address resources is a serious problem facing the current IP network. The industry recognizes that migrating to IPv6 is the most effective way to completely solve the exhaustion of IPv4 addresses. On the other hand, migrating from IPv4 to IPv6 will encounter problems that have already affected the deployed VPN network. The problem. In addition, with the popularization of high-speed networks, 10G and 40G networks have begun to be popularized, 100G networks have begun to be deployed in more developed areas, and 400G networks are also coming out of laboratories and starting to be application-oriented. How to ensure data security under such a high-speed network? Security has also become a very pressing issue.

Aiming at the problem of network security, the Internet Engineering Task Force (IETF) proposed a set of security protocols for protecting data at the IP layer, which is the IPSec protocol. The IPSec protocol is a standard, robust and inclusive mechanism. The protocol itself provides a set of default and mandatory security algorithms to ensure that different IPSec implementations can achieve intercommunication. It is the IP layer data of IPv4 and IPv6 Provide security assurance, this security includes data source authentication, data integrity authentication, data confidentiality and anti-replay protection.

In view of the long-term migration stage from IPv4 to IPv6 in the future, existing transition technologies include dual-stack technology, tunnel technology, and NAT-PT technology. Dual-stack technology means that the communication node is a dual-protocol stack node. When communicating with an IPv4 node, the IPv4 protocol stack is selected, and when communicating with an IPv6 node, the IPv6 protocol stack is selected. The tunnel technology realizes the communication between two IPv6 sites through the IPv4 network, including various manual tunnel technologies and automatic tunnel technologies. NAT-PT technology realizes the intercommunication between IPv4 network and IPv6 network through mutual conversion between IPv4 and IPv6 addresses. For now, the dual-stack technology solution is the most mature and has a wider scope of application, and is currently the mainstream choice for global operators to deploy IPv6.

The combination of dual-stack network technology, IPSec technology and VPN technology makes the device have a strong scope of application, and can achieve the goals of network protocol migration, network security protection and VPN network construction.

At present, there are mainly three ways to realize dual-stack IPSec VPN, the way of general processor + pure software, the way of general processor + hardware algorithm acceleration module and integrated network processor. The first method has the greatest flexibility and the slowest speed, and is not suitable for applications under high-speed networks. The second method is less flexible, and the CPU still bears a large data flow. It is also not suitable for applications under high-speed networks. The third method is flexible. The performance is moderate, the CPU does not interfere with the flow of data flow, and the CPU is only used for configuration and management operations. The bus architecture is divided into three buses: the bus of the CPU and the bus of the incoming and outgoing message data streams, which are independent of each other. The IPSec protocol realizes all hardware circuits, has strong scalability and the highest speed, and is suitable for high-speed network scenarios.

Contents of the invention

The technical problem to be solved by the present invention is to overcome the deficiencies of the prior art, and provide a dual-stack IPSec VPN device, which can provide security services for the deployment of the next generation IPv4 to IPv6 high-speed network, with high data processing and transmission efficiency and strong scalability.

The present invention specifically adopts the following technical solutions to solve the above technical problems:

A dual-stack IPSec VPN device, including a dual-stack VPN processing part, a security database construction and search part, a security protocol processing part, a data stream transmission mechanism part and a CPU part;

The dual-stack VPN processing part is used for the processing of dual protocol stacks and the processing of VPN headers, including an outgoing dual-stack VPN preprocessing module, an outgoing VPN management table, and an incoming dual-stack VPN preprocessing module;

The security database construction and search part is used to complete two types of IPv4 and IPv6 security policy database maintenance, matching search and one type of security association database maintenance, matching search; it includes outgoing dual-stack security processing module, datagram Document caching module, outbound security database operation interface, outbound dual-stack security database module, entry dual-stack security processing module, entry security database operation interface and entry dual-stack security database module;

The security protocol processing part is used to complete the encapsulation and decapsulation processing of the IPSec AH and ESP protocols and the data message encryption, decryption, and authentication algorithm processing, which includes an IPSec protocol processing module and an algorithm processing module;

The data stream transmission mechanism part is used to control the incoming and outgoing data streams to flow through different modules and network communication interfaces in a certain order; After being processed by the stack VPN preprocessing module, the security parameters and VPN parameters are respectively encapsulated into the header of the original message; the packet data entering the internal network from the external network will be stripped of the VPN header information after entering the dual-stack VPN preprocessing After the message stripped of VPN information is processed by the dual-stack security processing module, the security parameters are encapsulated into the message header;

The CPU part, including a CPU and a bus architecture that works with it, is used to manage the security database and the VPN data table and analyze the necessary OSI model-defined transport layer and upper layer protocols above, and does not interfere with normal message flow processing ;

Among them, the CPU, the access security database operation interface, the outgoing VPN management table, and the outgoing security database operation interface are connected to each other through the on-chip bus, the external network communication interface is connected to the outgoing dual-stack security processing module through a dual-port buffer, and the outgoing dual-stack The security processing module is connected to the outbound security database operation interface and the data message cache module, the outbound dual-stack security database module is connected to the outbound database operation interface, and the outbound dual-stack security processing module and the outbound dual-stack VPN preprocessing module are buffered through dual ports The outgoing dual-stack VPN preprocessing module is connected to the outgoing VPN management table, the outgoing dual-stack VPN preprocessing module is connected to the IPSec protocol processing module through a dual-port buffer, and the IPSec protocol processing module Port buffer connection, the IPSec protocol processing module and the external network communication interface are connected through a dual-port buffer, and the internal network communication interface and the dual-stack VPN preprocessing module are connected through a dual-port buffer to enter the dual-stack VPN preprocessing The module is connected to the dual-stack security processing module through a dual-port memory, the dual-stack security processing module is connected to the security database operation interface, and the dual-stack security processing module is connected to the IPSec protocol processing module through a dual-port buffer. The IPSec protocol processing module is connected to the intranet communication interface through a dual-port buffer.

As one of the preferred solutions, the outbound dual-stack security database module includes: an outbound security policy database for storing security policy entries, an outbound security association database for storing outbound security association entries, and read and write logic for the two databases conversion interface;

The outgoing security policy database includes two databases respectively corresponding to IPv4 and IPv6: the outgoing IPv4 policy database and the outgoing IPv6 policy database, the outgoing IPv4 policy database is used to match the strategy for querying IPv4 type message traffic, and the outgoing IPv6 policy database is used for Match the policy for querying IPv6 type packet traffic;

The outgoing security association database is a storage unit used to store security association entry information, and the stored information includes a transmission mode selection field, a protocol type selection field adopted, a serial number overflow processing selection field, an encryption algorithm selection field, an authentication Algorithm selection field, encryption IV needs to be selected field, encryption algorithm key length field, authentication algorithm key length field, PMTU field, security parameter index field and serial number counter field.

As another preferred solution, the algorithm processing module includes an encryption algorithm operator, a decryption algorithm operator, an authentication algorithm operator, and a solution authentication algorithm operator; wherein, in the direction of the internal network data packet going out to the external network, the encryption algorithm operation The input interface of the device is connected to the encryption algorithm processing output interface of the IPSec protocol processing module, the input interface of the authentication algorithm operator is connected to the output interface of a two-to-one selector, and the two input interfaces of the two-to-one selector are respectively connected to the IPSec protocol processing The authentication algorithm processing output interface of the module and the output interface of the encryption algorithm operator, the output interface of the authentication algorithm operator is connected to the authentication algorithm processing result input interface of the IPSec protocol processing module; in the direction of the external network data packet entering the internal network, the authentication algorithm operation is solved The input interface of the device is connected to the output interface of the de-authentication algorithm processing result of the IPSec protocol processing module, and the output interface of the de-authentication algorithm operator and the output interface of the decryption algorithm operator are respectively connected to two input interfaces of a two-to-one selector. The output interface of the selector is connected to the input interface of the algorithm processing result of the IPSec protocol processing module, and the output interface of the de-authentication algorithm operator is also connected to the input interface of the decryption algorithm operator.

Further, the encryption/decryption algorithm operator includes at least two encryption/decryption algorithm operators using different encryption/decryption algorithms; the authentication/de-authentication algorithm operator includes at least two different authentication/de-authentication algorithm operators. Algorithm authentication/deauthentication algorithm operator.

As another preferred solution of the present invention, the IPSec protocol processing module includes:

The pre-processor of IPSec protocol encapsulation is used to analyze the security policy and security association information of outgoing packets, determine whether the packets need encryption and authentication operations or just authentication operations, and then send the packets to the corresponding operations device;

IPSec protocol encapsulation post-processor, which is used to perform protocol encapsulation processing on the message processed by the encryption operation and/or authentication operator, and write the encapsulation-processed message into the dual port between the external network communication interface buffer;

The anti-replay protector is used to perform anti-replay detection on received packets in the incoming direction and perform anti-replay processing according to the detection results;

The pre-processor for IPSec protocol decapsulation is used to analyze the security policy and security association information of incoming packets, determine whether the packets need decryption and de-authentication operations or just de-authentication operations, and then send the packets to the corresponding the operator;

IPSec protocol decapsulation post-processor, used to decapsulate the message that has been processed by the decryption operation and/or de-authentication operator, and then check whether the security policy and security association information of the message are legal, if not If it is legal, discard the message. If it is legal, write the decapsulated message into the dual-port buffer between the internal network communication interface;

IPSec protocol encapsulation pre-processor, IPSec protocol encapsulation post-processor, IPSec protocol decapsulation post-processor, IPSec protocol decapsulation post-processor, these four parts work independently and belong to parallel work, there is no circuit connection between them, and each It is respectively connected with each arithmetic unit in the algorithm processing module through an independent data path.

Compared with the prior art, in the dual-stack IPSec VPN device proposed by the present invention, the management of the dual-stack VPN, the maintenance and use of the dual-stack security database, the maintenance of the database and the data table by the CPU and the necessary IP upper layer are introduced. The processing of agreement; The module of the present invention message flow through is connected by dual-port buffer, has reduced the coupling between the module, can accelerate development progress; Adopt the data message stream processing method of multi-bus, make the present invention It has strong processing efficiency and scalability. In the technical scheme of the present invention, the processing of the message data flow is completely realized by the hardware circuit, which has high processing efficiency, reduces the complexity of the system, and is beneficial to the realizability of the system design.

Description of drawings

Fig. 1 is a kind of preferred structure of dual-stack IPSec VPN device of the present invention;

Fig. 2 is the basic processing flow of the dual-stack IPSec VPN device of the present invention for outgoing direction data;

Fig. 3 is the basic processing flow of the dual-stack IPSec VPN device of the present invention for incoming direction data;

Fig. 4 is the maintenance and usage process of the dual-stack security database in the dual-stack IPSec VPN device of the present invention;

Fig. 5 is the workflow of the dual-stack VPN processing part in the dual-stack IPSec VPN device of the present invention;

FIG. 6 is a typical deployment mode of the dual-stack IPSec VPN device of the present invention.

detailed description

The technical scheme of the present invention is described in detail below in conjunction with accompanying drawing:

Fig. 1 shows the basic structure of a preferred embodiment of the dual-stack IPSec VPN device of the present invention. The dual-stack IPSec VPN device 100 includes a dual-stack VPN processing part, a security database construction and search part, a security protocol processing part, a data flow transmission mechanism part and a CPU part; wherein, the dual-stack VPN processing part includes an outgoing dual-stack VPN preprocessing module 112. Outgoing VPN management table 105 and entering dual-stack VPN pre-processing module 115; the security database construction and search part includes an outgoing dual-stack security processing module 110, a data message cache module 111, an outgoing security database operation interface 103, and an outgoing dual-stack security The database module 104, enters the dual-stack security processing module 114, enters the security database operation interface 107 and enters the dual-stack security database module 108; the security protocol processing part includes the IPSec protocol processing module 113 and the algorithm processing module 106; the data stream transmission mechanism part includes the entry The data flow in the outgoing direction flows through different modules and network communication interfaces 109 and 116 in a certain order; the CPU part includes an embeddable CPU 101 and a bus architecture 102 that works with it;

The network communication interface 109 or 116 refers to the physical interface of the network communication interface. Ethernet interface and POS interface can be selected. The network communication interface 109 and 116 can support encapsulation and decapsulation of IPv4 and IPv6 message frames. On the one hand, the network communication interface 109 is used to receive the internal network end data link layer data sent to itself, decapsulate its data frame into a network layer data message and write it into the FIFO between the outgoing dual-stack security processing module On the other hand, it is used to encapsulate the network layer data message stored in the FIFO between the IPSec protocol processing modules into a frame and send it to the data link layer of the intranet end. On the one hand, the network communication interface 116 encapsulates the network layer data packets stored in the FIFO between the IPSec protocol processing modules into frames and sends them to the data link layer of the external network end; Layer data and decapsulate its data frame into a network layer data message and write and enter the FIFO between the dual-stack VPN preprocessing module 115.

CPU101 and on-chip bus 102, CPU can be the CPU of open source or commercial type embedded type, and its number of digits is preferably the general-purpose CPU of 32 or 64 bits, and on-chip bus 102 is the bus that can work with the CPU of selected type Type, CPU101 is the master device on the bus, and other devices on the bus are all slave devices, so CPU101 accesses all devices on the bus through the on-chip bus 102. The access described above is that the CPU 101 maintains the inbound security database operation interface 107, the outbound VPN management table 105 and the outbound security database operation interface 103, and this maintenance includes addition, deletion and query operations. The specific behavior is described as: CPU101 sends instructions and parameters to the bus, the bus analyzes and decodes the instructions and parameters, selects the slave device to be accessed by the CPU, and the slave device reads the instructions and parameters on the bus and responds.

The outgoing dual-stack security database module 104 and the incoming dual-stack security association 108 are used to store the security policy database (that is, SPD) and the security association database (that is, SAD) and the read-write logic conversion interface for the two databases. The security policy database is used to The storage unit for storing security policy entry information, including two databases of IPv4 and IPv6, the IPv4 policy database (SPD_V4) is used to match and query the policy of IPv4 type packet traffic, and the IPv6 policy database (SPD_V6) is used to match and query IPv6 type Packet traffic policy. The matching search function of the security policy database module is realized by the design of the CAM/TCAM structure. The policy information and SA pointer information are stored in the on-chip RAM, and the security association information is stored in the on-chip SRAM. The matching address output of CAM/TCAM corresponds to a piece of policy information and SA pointer information existing in the on-chip RAM. If the policy requirement is to apply IPSec and the SA pointer is valid, the SA pointer is used as the address input of the security association storage unit, and the SA The information is read out and the application IPSec policy information is sent to the corresponding security association operation interface 103 or 107; if the policy is to apply IPSec but the SA pointer is invalid, for the incoming direction, the application IPSec policy information and the SA pointer invalid information are sent to the security operation interface 103. For the outgoing direction, send the discard policy information to the security operation interface 107; if the policy is to bypass IPSec, then send the bypass IPSec policy information to the corresponding security operation interface 103 or 107; if the policy is to discard the data packet , the policy information is sent to the corresponding security operation interface 103 or 107;

The going out security operation interface 103 and the entry security operation interface 107 are first used to analyze the instructions and parameters accessed by the security processing module 110 or 114 and the bus 102, and secondly convert the resolved instructions and parameters into the operation logic of the database storage unit;

Going out of the dual-stack security processing module 110 and entering the dual-stack security processing module 114, first read the IP message from the respective FIFO receiving buffers until all selectors are read out and sent to the security database operation interface to match the query security policy SP and security association SA information, after receiving the information of security policy SP and security association SA, there will be the following four situations:

a) If IPSec is applied and both SAs exist, the dual-stack security processing module 110 or 114 will encapsulate the SA information in the packet header, and will first encapsulate the SA information and the IP packet header into the dual-stack security processing module to send FIFO, and then read out the message remaining in the receiving FIFO of the dual-stack security processing module and write it into the sending FIFO;

b) If IPSec is used and SA does not exist, for the outbound dual-stack security processing module 110, write the invalid SA pointer and the IP message header into the data message cache module 111, and then write the message remaining in it to receive FIFO The text is read out and written into the data message cache module 111, and for entering the dual-stack security processing module 114, the IP message header information will be discarded and the message remaining in its receiving FIFO will be read out and discarded.

c) If IPSec is bypassed, the dual-stack security processing module 110 or 114 will encapsulate the bypass IPSec control information in the message header, then write the encapsulated message header into its sending FIFO, and then put the remaining The message of the receiving FIFO is also written into its sending FIFO;

d) If it is discarded, the dual-stack security processing module 110 or 114 reads out the entire IP message and discards it;

Outgoing VPN management table, which is used to query the VPN header that needs to be sent when the packet from the internal network flows to the external network. The VPN table exists in the on-chip RAM storage unit, and its query is realized through the CAM/TCAM structure. When it receives the source IP and destination IP, use it as a VPN selector and send it to CAM/TCAM, then it will get the address of a VPN entry in the RAM storage unit, and then send the address to the RAM storage unit of the VPN table , read out the information of VPN, and VPN information is sent out to the dual-stack VPN preprocessing module of going out; The dual-stack VPN preprocessing module 112 of going out, at first reads source, purpose IP from its receiving FIFO, then sends source, purpose IP into Outgoing VPN management table, and then the outbound VPN management table will send the source and destination IP of the VPN header to the outbound VPN preprocessing module, and then the outbound VPN preprocessing module will encapsulate the VPN information into the packet header and encapsulate the packet Write the header of the message into its sending FIFO, and then read out the message remaining in its receiving FIFO and write it into its sending FIFO;

Enter dual-stack VPN preprocessing module 115, read the message that it receives FIFO, then the VPN header of message is stripped off, then the message that strips message header is written into it and sends FIFO;

Algorithm processing module 106, which is used for the realization of encryption, decryption, authentication and de-authentication four arithmetic units, wherein the encryption algorithm has DES, 3DES and AES encryptor, the decryption algorithm has DES, 3DES and AES decryptor, and the authentication algorithm has HMAC- SHA-96 and HMAC-MD5-96. For the outgoing direction of the message, after receiving the message that needs to be encrypted and authenticated by the IPSec protocol processing module 113, the message will be sent to the encryption operator or the authentication operator for encryption or authentication processing, and the encrypted message also needs to be sent to The authentication algorithm is processed in the authentication calculator. Whether the message input of the authentication calculator is selected through an outgoing scheduler to process the message of the encryption algorithm calculator or the message that needs to be authenticated by the IPSec protocol processing module 113, after the processing of the outgoing algorithm is completed , return the message to the IPSec protocol processing module; for the incoming direction of the message, after receiving the message from the IPSec protocol encapsulation processing module, send the message to the de-authentication algorithm operator for de-authentication processing, if the de-authentication fails, then Discard the message. If the de-authentication is successful, send the message to the FIFO before the decryption algorithm operator or the FIFO before the scheduler. The decryption operator processes the message to be decrypted, and writes the message into the FIFO before entering the scheduler. Enter the FIFO of the scheduler and select to send the message of the output FIFO of the result of the deauthentication algorithm calculator or the decryption algorithm calculator to the IPSec protocol processing module 113 .

The IPSec protocol processing module 113 is used to implement the ESP and AH protocols in the IPSec of the message. For the outgoing direction, there are pre-processors for IPSec protocol encapsulation and post-processors for IPSec protocol encapsulation. The pre-processing of IPSec protocol encapsulation reads messages from the data FIFO that enters the dual-stack VPN preprocessing module 112, and analyzes the security policy of the messages. and security association information, select the input FIFO of the encryption algorithm operator in the message input algorithm processing module 106 or the input FIFO of the outgoing scheduler, then write the message into the selected input FIFO, and process the reading algorithm after IPSec protocol encapsulation The authentication algorithm operator in the module 106 outputs the message of the FIFO, carries out the IPSec protocol encapsulation processing of the message, adds the IPSec header, and delivers it to the network communication interface 116 after being encapsulated into an IP layer message; for the incoming direction, there is an anti-replay protector , IPSec protocol decapsulation pre-processor and IPSec protocol encapsulation post-processor, the anti-replay protector reads the message entering the dual-stack security processing module 114 output FIFO, then reads the SN of the IPSec header, and performs anti-replay protection processing , if it is found to be a replay packet, the packet will be discarded; if it is not a replay packet, the packet will be handed over to the pre-encapsulation processor of the IPSec protocol, and the pre-encapsulation processor of the IPSec protocol will analyze the security policy and security association of the packet information, write the message into the input FIFO of the de-authentication algorithm operator in the algorithm processing module 106, and after the IPSec protocol is decapsulated, the processor reads the message sent by the algorithm scheduler in the algorithm processing module to check the security of the message If the validity of the security policy corresponding to the alliance is found to be illegal, the message will be discarded; if it is legal, the IPSec header of the message will be stripped, the message will be processed into an IP layer message, and then delivered to the network communication interface 109. Both the outbound scheduler and the inbound scheduler can be implemented by using an alternative selector.

Fig. 2 shows the basic processing flow of the dual-stack IPSec VPN device of the present invention for outgoing direction data, including the following steps:

OS00: When the network communication interface of the intranet receives the data link layer data of the intranet network, it will decapsulate it and convert it into a data packet of the IP layer;

OS01: Extract the outbound security policy selector and send it to the security database for matching search to obtain security policy information and security association information. The outbound security policy selector here is preferably composed of source IP, destination IP, upper layer protocol number, source port and destination port ;

OS02: Analyze the security policy information and security association information, and select the processing method of the data packet flow. If IPSec is passed, the policy information bypassing IPSec will be sent to its sending FIFO buffer. If the strategy is discarded, the data packet will be The stream is read out and discarded. If IPSec is used, whether the further SA is valid, if not, the message is sent to the data message buffer module, and if it is valid, it is sent to its sending FIFO buffer;

OS03: The outbound dual-stack VPN preprocessing module extracts the VPN selector of the message, and then sends the VPN selector into the outbound VPN management table;

OS04: After the outbound dual-stack VPN preprocessing module encapsulates the VPN information, write the message into the sending FIFO between the next modules;

OS05: The IPSec protocol processing module reads that the FIFO between the outbound dual-stack VPN preprocessing module has a data message to be processed, reads the message, and performs IPSec protocol encapsulation pre-processing on the message;

OS06: The algorithm processing module reads in the message to be processed by the algorithm, and performs corresponding algorithm operation processing on the message;

OS07: For packets processed by algorithms, the packets are encapsulated by IPSec protocol and then processed.

OS08: The external network communication interface re-encapsulates the encapsulated IP layer data message into a data link layer data frame and sends it out.

Fig. 3 shows the basic processing flow of the dual-stack IPSec VPN device of the present invention for the incoming direction data, including the following steps:

IS00: The network communication interface of the external network receives the data frame of the data link layer, decapsulates it into a data message of the IP layer, and writes it into the FIFO buffer between the next module;

IS01: After entering the dual-stack VPN preprocessing module to read the message, strip off the VPN header of the message, and then write the message into the FIFO buffer between the next module;

IS02: Extract the incoming security policy selector and incoming security association selector of the message, and send them into the security database to match and find information about the security policy and security association. The incoming security policy selector is preferably source IP, destination Composed of IP and an upper-layer protocol number, the entry security association selector is preferably composed of source IP, destination IP, upper-layer protocol number, and SPI value;

IS03: Analyze the security policy and security association information. If IPSec is bypassed, encapsulate the bypassed IPSec information into the header of the message, and write the message into the FIFO buffer between the next module and analyze the security policy : If the IPSec policy is applied and the SA is valid, the security policy information and security association information will be encapsulated in the packet header, and written into the FIFO buffer between the next module; if the IPSec policy is applied but the SA is invalid or the packet is discarded , the message is read out and discarded directly; if IPSec is bypassed, the message is bypassed for IPSec processing;

IS04: When the IPSec protocol processing module reads and enters the FIFO buffer between the dual-stack VPN security processing module, there is a data message to be processed. First, perform anti-replay protection according to the security sequence number SN information of the message, and analyze whether the message is If the replay message is found to be a replay message, it will be discarded directly, and if it is not a replay message, it will be processed in the next step;

IS05: The IPSec protocol processing module performs IPSec protocol decapsulation preprocessing on the message, and then integrates the message into the algorithm module;

IS06: The algorithm module reads that there is a data message that needs to be processed, and sends the message to the decryption or authentication algorithm calculator for algorithm processing. After the de-authentication is completed, the de-authentication result is analyzed, and if the de-authentication fails, the message is discarded , if the de-authentication is successful, send the message to the next step for processing;

IS07: After the IPSec protocol decapsulation in the IPSec protocol processing module reads the message, the processor checks the validity of the security association and security policy of the message. If the validity check fails, the message is discarded. If the check result is legal , send the message to the next step;

IS08: The IPSec protocol decapsulation processor in the IPSec protocol processing module decapsulates the message, strips off the IPSec header, and processes it into an IP layer message to the intranet communication interface;

IS07: The data communication interface at the intranet end encapsulates the data packets at the IP layer into data link layer frames and sends them out.

Fig. 4 shows the flow of the method for maintaining and using the dual-stack security database in the dual-stack IPSec VPN device of the present invention. It should be noted that not every step requires one clock tick to complete. Those skilled in the art should understand that one clock tick can perform at least one step, going out of the database operation interface or entering the security database operation interface (hereinafter referred to as security operation) When the interface 103 or 111) receives the access request, it will distinguish whether it is the CPU access or the search access of the security processing module 113 or 106, wherein the CPU access process is as follows: the CPU sends instructions and parameters to the on-chip bus 102, and the security database operation interface receives Get the commands and parameters and analyze them, and then select the library of security association or security policy. If it is a security policy library, further select the library of IPv4 or IPv6, and then select the database of IPv4 or IPv6, and convert the parsed commands and parameters into objects. One of them is the read and write operation of the security policy database; the access of the dual-stack security processing module is as follows: the dual-stack security processing module sends matching search request commands and parameters, and the security operation interface 103 or 111 parses the received commands and parameters, Then convert the parsed commands and parameters into read operations on the security policy database, determine whether access to the security association database SAD is required, and if necessary, further convert the commands and parameters into read operations on the security association database SAD, and then output the security information results , if not needed, directly output the data security information result, and end at last.

Fig. 5 is a preferred dual-stack VPN processing method of the present invention, including outgoing dual-stack VPN preprocessing and entering dual-stack VPN preprocessing. For outgoing VPN preprocessing, first read the VPN selector of the message, which is the source and destination IP of the message header, and the VPN table module will send the selector into the matching circuit inside to find the VPN information. The matching circuit is preferably realized by a CAM structure. The information of the VPN table is stored in the RAM inside the chip, and then the information of the VPN header is output. After the outgoing VPN preprocessing module reads the VPN header information, the VPN header information is encapsulated in the message header. Write the message into the FIFO between the IPSec protocol processing module; for entering the dual-stack VPN preprocessing, read the message, analyze whether the type of the message is IPv4 or IPv6, and strip off the VPN header of this type, and then Writes to and enters the FIFO between the dual-stack security processing modules.

Figure 6 shows a typical deployment of a dual-stack IPSec VPN device. As shown in Figure 6, an organization has a headquarters network and two branch networks scattered in different office locations: branch 1 and branch 2. The headquarters network is a dual-stack network of IPv4 and IPv6, and branch 1 It is an IPv4 network, and branch 2 is an IPv6 network. The hosts in the headquarters network and the branch network are nodes that support dual-stack, and there are IPv4 servers and IPv6 servers in them. The switches in the headquarters network are switches that support dual-stack. When the host node of the headquarters network visits the IPv4 nodes of the headquarters network, branch 1 and branch 2, it uses the IPv4 address, and when it visits the IPv6 nodes, it uses the IPv6 address. As shown in the figure, the three inventions The dual-stack IPSec VPN device of the company is used as the default VPN node of the headquarters network and the two branch networks respectively. Each port of the dual-stack IPSec VPN device and the external network has two IP addresses, IPv4 and IPv6. This IP address is unique globally. The dual-stack IPSec VPN device and the intranet end have two IP addresses of IPv4 and IPv6 of the intranet segment. VPN communication process For example, when host a in the headquarters uses an IPv4 address to access host a in branch 1, the data packet will flow through the switch, dual-stack IPSec VPN device 1, the Internet, dual-stack IPSec VPN device 2 and then In this process, an IPSec VPN tunnel will be established between dual-stack IPSec VPN device 1 and dual-stack IPSec VPN device 2 to protect data communication. Since the IP addresses of the two parties that initiate the communication use IPv4 Therefore, when the dual-stack IPSec VPN device processes packets, it adopts the IPv4 processing method; for example, when host b in branch 2 uses an IPv6 address to access the IPv6 server in the headquarters network, the data packets will flow Through the dual-stack IPSec VPN device 3, the Internet, the dual-stack VPN device 1, the switch and the IPv6 server, since the two parties that initiate the communication and receive the communication use IPv6 addresses, the dual-stack IPSec VPN device 1 and the dual-stack IPSec VPN device 3 The IPv6 processing method will be adopted, but for the dual-stack IPSec VPN device 3, the IPv4 VPN header information will be added during the outbound VPN preprocessing, so that the IPv6 message can pass through the IPv4 type Internet network.

Claims (6)

1. a kind of double stack IPSec VPN devices, it is characterised in that including double stack VPN process parts, safety database structure and look into Look for part, security protocol process part, data stream transmitting machined part and CPU part；

Double stack VPN process parts, processing, the processing of VPN heads for dual stack, including outgoing double stack VPN pretreatments Module, outgoing VPN manage table and enter double stack VPN pretreatment modules；

The safety database structure and lookup part, for completing the two kinds of Security Policy Database dimensions of IPv4 and IPv6 Shield, matched and searched and a type of security association database are safeguarded, matched and searched；It includes outgoing double stack safe handling moulds Block, data message cache module, outgoing safety database operate interface, outgoing double stack secure data library modules, pacify into double stacks Full processing module, into safety database operate interface and enter double stack secure data library modules；

The security protocol process part, the encapsulation for completing IPSec AH and ESP agreements conciliate encapsulation process and to data Message encryption, decryption, identifying algorithm processing, it includes ipsec protocol processing module and algorithm processing module；

The data stream transmitting machined part, sequentially flowed through for control entrance and outgoing bearing data stream different Module and network communication interface；The message data of the outgoing outer net of Intranet passes through outgoing double stack secure processing modules, outgoing double stack VPN After pretreatment module processing, security parameter and VPN parameters are encapsulated into the head of original message respectively；Outer net enters the report of Intranet By will peel VPN header information off after entering double stack VPN pretreatments, this message for peeling VPN information off leads to literary data After crossing double stack secure processing module processing, security parameter is encapsulated into this header；

The CPU part, including a CPU and the bus architecture with its work of arranging in pairs or groups, for managing safety database and VPN numbers The transportation level and the upper-layer protocol of the above defined according to table and analysis osi model, and do not intervene normal message flow processing；

Wherein, CPU, pass through into safety database operate interface, outgoing VPN management table and outgoing safety database operate interface Bus on chip is connected with each other, and is connected between outbound communication interface and outgoing double stack secure processing modules by dual-port buffer, Outgoing double stack secure processing modules are connected with outgoing safety database operate interface and data packet buffer module, double stack peaces of going out Full database module is connected with outgoing database manipulation interface, and double stack secure processing modules of going out pre-process with outgoing double stack VPN Connected between module by dual-port buffer, outgoing double stack VPN pretreatment modules are connected with outgoing VPN management tables, are gone out double Connected between stack VPN pretreatment modules and ipsec protocol processing module by dual-port buffer, ipsec protocol processing module It is connected by dual-port buffer between algorithm processing module, is led between ipsec protocol processing module and outbound communication interface The connection of dual-port buffer is crossed, is connected between Intranet communication interface and the double stack VPN pretreatment modules of entrance by dual-port buffer Connect, connected into double stack VPN pretreatment modules and entering between double stack secure processing modules by dual-ported memory, into double Stack secure processing module is connected with into safety database operate interface, at double stack secure processing modules and ipsec protocol Connected between reason module by dual-port buffer, pass through dual-port between ipsec protocol processing module and Intranet communication interface Buffer connects.

2. double stack IPSec VPN devices as claimed in claim 1, it is characterised in that outgoing double stack secure data library modules Including：For the outgoing Security Policy Database of Saving Safe Strategy entry, for storing the outgoing of outgoing Security Association entry Security association database, and the read-write logic conversion interface to two kinds of databases；

The outgoing Security Policy Database includes two databases for corresponding respectively to IPv4 and IPv6：Outgoing IPv4 strategy numbers According to storehouse and outgoing IPv6 policy databases, IPv4 policy databases of going out are used for the plan of matching inquiry IPv4 type message flows Slightly, outgoing IPv6 policy databases are used for the strategy of matching inquiry IPv6 type message flows；

The outgoing security association database is a memory cell for being used for storing Security Association items for information, what it was deposited Information is calculated including transmission mode selection field, the protocol type taken selection field, sequence number Overflow handling selection field, encryption Whether method selection field, identifying algorithm selection field, encryption IV need to select field, encryption algorithm key length field, certification Algorithm secret key length field, PMTU fields, Security Parameter Index field and sequence number counter field.

3. double stack IPSec VPN devices as claimed in claim 1, it is characterised in that the outgoing VPN management table include IPv4 and The two kinds of VPN tables memory cell of IPv6 and control access logic controller, and the control, which accesses logic controller, to be included： CPU manages VPN the inquiry, addition, the control logic circuit of deletion action of table list item, double stack VPN pretreatment modules pair of going out The control logic circuit of the inquiry operation of VPN management tables.

4. double stack IPSec VPN devices as claimed in claim 1, it is characterised in that the algorithm processing module includes encryption and calculated Method arithmetic unit, decipherment algorithm arithmetic unit, identifying algorithm arithmetic unit, solution identifying algorithm arithmetic unit；Wherein, gone out in intranet data bag On outer net direction, the AES processing output of the input interface connection ipsec protocol processing module of AES arithmetic unit connects Mouthful, the output interface of input interface one alternative selector of connection of identifying algorithm arithmetic unit, the two of the alternative selector Individual input interface connect respectively ipsec protocol processing module identifying algorithm processing output interface and AES arithmetic unit it is defeated Outgoing interface, the identifying algorithm result input of the output interface connection ipsec protocol processing module of identifying algorithm arithmetic unit connect Mouthful；Enter in outer network data bag on Intranet direction, the input interface connection ipsec protocol processing module of solution identifying algorithm arithmetic unit Solution identifying algorithm result output interface, solve identifying algorithm arithmetic unit output interface and decipherment algorithm arithmetic unit output Interface connects two input interfaces of an alternative selector, the output interface connection IPSec of the alternative selector respectively The algorithm process result input interface of protocol process module, solve identifying algorithm arithmetic unit output interface also with decipherment algorithm computing The input interface connection of device.

5. double stack IPSec VPN devices as claimed in claim 3, it is characterised in that the encryption/decryption algorithm arithmetic unit includes At least two use the encryption/decryption algorithm arithmetic unit of different encryption/decryption algorithms；Wrapped in the certification/solution identifying algorithm arithmetic unit Include at least two certification/solution identifying algorithm arithmetic units using different authentication/solution identifying algorithm.

6. double stack IPSec VPN devices as claimed in claim 1, it is characterised in that the ipsec protocol processing module includes：

Ipsec protocol encapsulates front processor, for analyzing the security strategy and safety alliance information of outer outgoing packet, determines report Text needs cryptographic calculation and authentication algorithm or simply needs to do authentication algorithm processing, and the message then is sent into corresponding computing Device；

Ipsec protocol encapsulates preprocessor, for by have been subjected to cryptographic calculation and/or authentication algorithm device it is treated after message enter The processing of row protocol encapsulation, and the dual-port buffer between the message write-in that encapsulation process is terminated and outbound communication interface；

Anti- Replay Protection device, the message for the approach axis to being received carry out anti-replay and detect and carried out according to testing result Anti- replay processing；

Ipsec protocol decapsulates front processor, for analyzing the security strategy and safety alliance information of approach axis message, determines Message needs to decrypt computing reconciliation authentication algorithm or simply needs do solution authentication algorithm processing, is then sent to the message accordingly Arithmetic unit；

Ipsec protocol decapsulates preprocessor, for will have been subjected to decryption computing and/or solve the report after authentication algorithm device treats Text carries out multi-protocol decapsulation processing, then checks whether the security strategy of the message and safety alliance information are legal, if illegal, By the packet loss, the dual-port that the message for terminating decapsulation processing if legal is write between Intranet communication interface buffers Device；

Ipsec protocol encapsulation front processor, ipsec protocol encapsulation preprocessor, ipsec protocol decapsulation preprocessor, IPSec Multi-protocol decapsulation preprocessor, this four parts work independently, belong to concurrent working, are connected between each other without circuit, and Each via independent data path with being connected respectively with each arithmetic unit in algorithm processing module.