WO2025118789A1 - Double-encryption method based on ipsec and quantum key, and encryption gateway - Google Patents

Abstract

Provided in the present application is a double-encryption method based on IPsec and a quantum key. The method comprises: an encryption gateway registering to a quantum key distribution center by means of a unique identifier, and after the registration is successful, the quantum key distribution center charging a quantum key to the encryption gateway; the encryption gateway receiving a pushed data message, and labeling a data packet of the pushed data message with an encryption tag or a decryption tag; by means of creating the encryption tag and the decryption tag, setting a rule in a POSTROUTING chain of a mangel table, creating a hook node by using the encryption tag or the decryption tag, and sending the data packet labeled with the encryption tag or the decryption tag; and encrypting data to convert same into popped message data, sending the popped message data from the encryption gateway, or decrypting the data to obtain original text of ciphertext. In the present application, no additional load encapsulation is required for data encapsulation, and the original structure of a data packet is not changed, and the present application is applicable to more network environments.

Description

Dual encryption method based on IPsec and quantum key, encryption gateway

This application claims priority to the Chinese patent disclosure with application number 202311694033.6, filed with the China Patent Office on December 8, 2023, and entitled “Dual encryption method and encryption gateway based on IPsec and quantum key”, the entire contents of which are incorporated by reference in this application.

Technical Field

The present application relates to the fields of cryptographic applications and network security, and specifically to a dual encryption method and encryption gateway based on IPsec and quantum key.

Background Art

Generally, data security transmission between different branches is achieved by building IPSec (Internet Protocol Security) tunnels through VPN (Virtual Native Network) gateways, which can ensure the confidentiality, integrity and identity of IP layer data packets. If different branches are interconnected using a dedicated line provided by an operator, then the deployment of IPSec VPN will encapsulate the security payload esp, change the original structure of the data packet, and increase additional overhead and reduce transmission efficiency for users with limited network bandwidth.

At the same time, with the improvement of quantum computing capabilities, traditional key exchange protocols will transmit negotiation materials during the negotiation process, and the negotiated session keys may be deciphered.

In the related art, the Chinese invention patent application document with application publication number CN116405206A discloses a method for data encryption and decryption of a security gateway, in which quantum key encryption is used, and the session ID of the quantum key is used as the spi (Security Parameter Index) in the encapsulated security payload esp to be passed to the other end to realize data decryption. However, this solution will also add additional data encapsulation on the basis of the payload data, which will increase additional overhead for the user's network bandwidth.

In the related art, the Chinese invention patent application document with application publication number CN115567205A discloses a method for implementing encryption and decryption of network session data streams using quantum key distribution. The main features of this scheme are: (1) a mapping relationship is established between the quantum master key ID and the 5-tuple network session stream through the quantum distribution network, and the master key identifier is placed in the security message header of the encrypted data message to achieve end-to-end encrypted communication. (2) The functions of establishing, aging, and deleting the flow table are realized. This scheme also adds additional data encapsulation, increases the user's network bandwidth overhead, and has complex function implementation.

Summary of the invention

The technical problem to be solved by this application is how to achieve end-to-end encryption of data payloads without adding additional payload encapsulation, thereby improving the confidentiality of data messages while not reducing the use of user bandwidth.

This application solves the above technical problems through the following technical means:

In the first aspect, the present application proposes a dual encryption method based on IPsec and quantum key for encryption gateway, comprising the following steps:

The encryption gateway is registered with the sub-key distribution center through a unique identifier. After successful registration, The quantum key distribution center injects quantum keys into the encryption gateway;

The encryption gateway receives the incoming data message and adds an encryption tag or a decryption tag to the data packet of the incoming data message;

Use the encryption label or decryption label to create a mount node, and send the data packet with the encryption label or decryption label;

After the data is encrypted once using the security alliance, the quantum key sa is used to encrypt the data encrypted by the security alliance again. The double-encrypted data becomes outbound message data and is sent out from the encryption gateway, or the data is double-decrypted to obtain the original ciphertext.

As a further technical solution, the encryption gateway receives the incoming data message and adds an encryption tag or a decryption tag to the data packet of the incoming data message, including the following steps:

The stacked data message enters;

Match the outbound security policy based on the five-tuple information;

Determine whether the matching of the direction security policy is successful;

If the outbound security policy matches successfully, the incoming data packet is encrypted and the corresponding security association is checked based on the outbound security policy.

If a security association exists, the security association information is saved in the data message;

If the security association does not exist, the security association is negotiated through the IKE protocol and the security association information is saved in the data message;

If the outbound security policy fails to match, the source address and destination address of the incoming data packet are swapped, and the inbound security policy is matched based on the five-tuple information;

Determine whether the inbound security policy matches successfully.

If the inbound security policy matches successfully, the incoming data packet is marked with a decryption tag;

If the inbound security policy fails to match, the incoming data packet cannot match the outbound security policy or the inbound security policy and is discarded.

As a further technical solution, after the data is encrypted once using the security alliance, the data encrypted by the security alliance is encrypted again using the quantum key sa, and the double-encrypted data becomes the out-of-stack message data and is sent out from the encryption gateway, or the data is double-decrypted to obtain the ciphertext original text, which specifically includes:

Receive data with encryption or decryption tags;

Determine whether it is an outbound label or an inbound label.

If it is an outbound label, the data message is encrypted using the security association through the encryption label;

Obtain the quantum key sa, and use the quantum key sa to encrypt the data encrypted by the security alliance again;

The data processed by the data encryption and decryption module becomes outbound message data and is sent out from the encryption gateway;

If it is an incoming tag, the quantum key sa is obtained by decrypting the tag, and the data is decrypted using the quantum key sa;

The data message is decrypted using the security association to obtain the original data message.

As a further technical solution, data encryption adopts the CBC+ mode. The encryption tag and the security association are used to encrypt the data message, which specifically includes:

For data whose length is greater than one encryption block, take data of an integer multiple of the encryption block for CBC encryption to obtain ciphertext data 1;

If the remaining length is less than one encrypted data block, take the encrypted ciphertext of the previous block as the IV value, encrypt IV with the session key K, use SM4 as the encryption algorithm, use ECB as the encryption mode, obtain Kiv, intercept Kiv to make its length equal to the length of plaintext data, and then XOR it with the plaintext data to obtain ciphertext data 2;

Concatenate ciphertext data 1 and ciphertext data 2 to obtain the complete ciphertext;

The decryption process of using the security association to decrypt the data message to obtain the original data message specifically includes:

For data whose length is greater than one decryption block, take data of an integer multiple of the encryption block for CBC decryption to obtain plaintext data 1;

If the remaining length is less than that of an encrypted data packet, take the ciphertext of the previous packet before decryption as the IV value, use the session key K to decrypt the IV, use the decryption algorithm SM4, and the decryption mode ECB to obtain Kiv, truncate Kiv to make its length equal to the ciphertext data length, and then XOR it with the ciphertext data to obtain plaintext data 2;

Concatenate plaintext data 1 and plaintext data 2 to obtain the complete plaintext.

As a further technical solution, the step of obtaining the quantum key sa and re-encrypting the data encrypted by the security alliance using the quantum key sa specifically includes:

The quantum key ID is calculated through the SPI of the initiator and responder in the security alliance. The quantum key ID calculated by SPI is unique.

Obtain the quantum key sa through the quantum key ID in the quantum key pool;

The data encrypted by IPSec sa is encrypted again using the quantum key sa. The encryption method is the same as that of S403.

The step of obtaining the quantum key sa by decrypting the tag and decrypting the data by using the quantum key sa specifically includes:

The quantum key ID is calculated through the SPI of the initiator and responder in the security alliance. The quantum key ID calculated by SPI is unique.

Obtain the quantum key sa through the quantum key ID in the quantum key pool;

The quantum key sa is used to decrypt the data encrypted by IPSec sa. The decryption method is the same as that of S407.

In a second aspect, the present application further provides an encryption gateway for executing a dual encryption method based on IPsec and quantum key as described in any of the above technical solutions, including:

The quantum key module is used for the encryption gateway to register with the quantum key distribution center through a unique identifier. After successful registration, the quantum key distribution center injects quantum keys into the quantum key module of the encryption gateway;

The xfrm module is used to receive the incoming data message and call the encryption and decryption label of the iptables module to add an encryption label or a decryption label to the incoming data message;

The iptables module creates encryption labels and decryption labels in advance, sets rules in the POSTROUTING chain of the mangel table, creates a mount node using encryption labels or decryption labels, and sends the data packets marked with encryption labels or decryption labels to the encryption and decryption module;

The data encryption and decryption module uses the security alliance to encrypt the data once, and then uses the quantum key sa to encrypt the data encrypted by the security alliance again. The double-encrypted data becomes the outbound message data and is sent out from the encryption gateway, or the data is double-decrypted to obtain the original ciphertext.

As a further technical solution, the xfrm module specifically includes:

xfrm module entry unit: used to push data packets into the xfrm module;

Outbound security policy matching unit: used to match outbound security policies according to quintuple information;

The first judgment unit is used to judge whether the matching of the outbound security policy is successful;

Security association search unit: If the outbound security policy is matched successfully, it is used to add an encryption tag to the incoming data message and search for the corresponding security association according to the outbound security policy.

Encryption tag unit: When a security association exists, the security association information is stored in the data message;

Security Association Negotiation Unit: When a security association does not exist, it is used to negotiate a security association through the IKE protocol and save the security association information in the data message;

Inbound security policy matching unit: when outbound security policy matching fails, it is used to swap the source address and destination address of the incoming data packet and match the inbound security policy according to the five-tuple information;

The second judgment unit is used to judge whether the matching of the inbound security policy is successful;

Decryption labeling unit: If the inbound security policy is successfully matched, the incoming data packet is labeled with a decryption label;

Discard unit: If the incoming data packet cannot match the outbound security policy or the inbound security policy, it will be discarded.

As a further technical solution, the data encryption and decryption module specifically includes:

Data receiving unit: receiving data with encryption or decryption tags;

Direction label judgment unit: judges whether it is an outgoing direction label or an incoming direction label;

The encryption unit, if it is an outgoing label, encrypts the data message using the security association through the encryption label;

A re-encryption unit, used to obtain the quantum key sa, and use the quantum key sa to re-encrypt the data encrypted by the security association;

The sending unit is used to convert the re-encrypted data into outbound message data and send it out from the encryption gateway;

The decryption unit, if it is an incoming tag, obtains the quantum key sa through the decryption tag, and uses the quantum key sa to decrypt the data;

The decryption unit decrypts the data message again using the security association to obtain the original data message.

As a further technical solution, the data encryption adopts the CBC+ mode, which specifically includes:

For data whose length is greater than one encryption block, take data of an integer multiple of the encryption block for CBC encryption to obtain ciphertext data 1;

If the remaining length is less than one encrypted data block, take the encrypted ciphertext of the previous block as the IV value, encrypt IV with the session key K, use SM4 as the encryption algorithm, use ECB as the encryption mode, obtain Kiv, intercept Kiv to make its length equal to the length of plaintext data, and then XOR it with the plaintext data to obtain ciphertext data 2;

Concatenate ciphertext data 1 and ciphertext data 2 to obtain the complete ciphertext;

The decryption process specifically includes:

For data whose length is greater than one decryption block, take data of an integer multiple of the encryption block for CBC decryption to obtain plaintext data 1;

If the remaining length is less than that of an encrypted data packet, take the ciphertext of the previous packet before decryption as the IV value, use the session key K to decrypt the IV, use the decryption algorithm SM4, and the decryption mode ECB to obtain Kiv, truncate Kiv to make its length equal to the ciphertext data length, and then XOR it with the ciphertext data to obtain plaintext data 2;

Concatenate plaintext data 1 and plaintext data 2 to obtain the complete plaintext.

In a third aspect, the present application also provides a dual encryption method based on IPsec and quantum key, which is applicable to the transmission of message data from a first encryption gateway to a second encryption gateway, wherein the first encryption gateway and the second encryption gateway adopt the mechanism described in any one of claims 6 to 9, and the encryption method comprises the following steps:

The first encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the second encryption gateway. After successful registration, the quantum key distribution center injects the first quantum key into the quantum key module of the first encryption gateway. The second encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the first encryption gateway. After successful registration, the quantum key distribution center injects the second quantum key into the quantum key module of the second encryption gateway. The identifiers registered by the first encryption gateway and the second encryption gateway quantum to the key distribution center are consistent, forming the same quantum key pool, that is, the first quantum key and the second quantum key are the same;

The first encryption gateway receives the incoming data message and adds an encryption tag to the data packet of the incoming data message through the xfrm module;

The iptables module of the first encryption gateway sends the data packet marked with the encryption label in S2 to the encryption and decryption module through the hook node created by the encryption label;

The data encryption and decryption module of the first encryption gateway encrypts the data message by using the security alliance stored in the data message through the encryption tag, obtains the quantum key sa from the quantum key pool, and uses the quantum key sa to encrypt the data encrypted by the security alliance again before sending it out;

After the second encryption gateway receives the ciphertext data from the first encryption gateway, it sends the source address and destination address The five-tuple information is used to match the outbound security policy in the xfrm module, and the security alliance corresponding to the security policy is obtained; at the same time, the incoming data message is marked with a decryption tag;

The iptables module of the second encryption gateway uses the hook node created by the decryption label to send the data packet marked with the decryption label in step S5 to the encryption and decryption module;

The second encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module and uses the quantum key sa to decrypt the data;

The data encryption and decryption module of the second encryption gateway decrypts the data message again by using the security association stored in the data message through the decryption tag to obtain the original text of the data message.

In a fourth aspect, the present application proposes a computing processing device, comprising: a memory in which a computer-readable code is stored; and one or more processors. When the computer-readable code is executed by the one or more processors, the computing processing device executes the authentication method based on double quantum random number protection as described above.

In a fifth aspect, the present application proposes a computer program, which includes a computer-readable code. When the computer-readable code is run on a computing processing device, it causes the computing processing device to execute any of the authentication methods based on double quantum random number protection as described above.

In a sixth aspect, the present application proposes a computer-readable medium in which the computer program described above is stored.

This method uses quantum key distribution, xfrm and iptables modules to encrypt the payload data behind the IP header. The main creativity lies in:

(1) Using IPSec SA and Quantum SA to double encrypt data, security is improved;

(2) Data encapsulation does not require additional payload encapsulation and does not change the original structure of the data packet. It is applicable to a wider range of network environments. No matter how complex the intermediate network environment is, the data packet can be transmitted normally in the network and does not generate additional overhead for the user's network bandwidth.

(3) There is a quantum SA for each security policy. As long as the security policy subnet is configured to a 32-bit mask, one class and one secret can be achieved, increasing data security.

This method not only meets the networking environment of traditional VPN, but also provides a data encryption mechanism based on Layer 2 network (data link layer), realizing a safer and more efficient encryption transmission method. In addition, the link is completely transparent and the connection is extremely easy to deploy.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG1 is a block diagram of a data encryption system based on quantum key in an embodiment of the present application;

FIG2 is a block diagram of the connection structure of the encryption gateway and the quantum key distribution system in an embodiment of the present application;

FIG3 is a flow chart of data processing of the xfrm module in the encryption gateway in an embodiment of the present application;

4 is a data processing flow chart of a data encryption and decryption module in an encryption gateway in an embodiment of the present application;

FIG5 is a flowchart of the interaction between encryption gateways in an embodiment of the present application;

FIG6 is a schematic diagram of the structure of a computing and processing device proposed in an embodiment of the present application;

FIG. 7 is a schematic diagram of a storage unit for program code proposed in an embodiment of the present application. picture.

DETAILED DESCRIPTION

In order to make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in combination with the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

Referring to FIG. 2 and FIG. 5 , the present application provides a dual encryption method based on IPsec and quantum key, which is used for an encryption gateway, and the encryption gateway includes:

Stacked data message: the data message received by the encrypted gateway;

Outbound data message: data message after encryption or decryption;

xfrm module: implements the addition, deletion, modification and query of security policies (sp), the negotiation aging of security associations (sa), matches security policies on incoming data packets, and adds encryption and decryption tags according to the direction of the matching policy;

Among them, xfrm stands for Transform, which is part of the IPsec protocol stack.

iptables (firewall) module: creates encryption labels and decryption labels, sets rules in the POSTROUTING chain of the mangel table, creates a hook using encryption labels or decryption labels, and sends data matching the encryption and decryption labels to the data encryption and decryption module through the hook mechanism;

Among them, iptables is a firewall and network address translation tool, mangel is used to modify specific fields of the data packet, and POSTROUTING is used to process the data packet after the routing decision.

Data encryption and decryption module: Encrypts or decrypts data packets by judging the labels of data packets. The encryption and decryption keys come from IKE key negotiation and quantum key distribution.

The double encryption method comprises the following steps:

S10: The encryption gateway registers with the quantum key distribution center through a unique identifier. After successful registration, the quantum key distribution center injects quantum keys into the quantum key module of the encryption gateway. The identifiers registered by each communicating encryption gateway to the quantum key distribution center are consistent, forming the same quantum key pool;

S20: The encryption gateway receives the incoming data message, and adds an encryption tag or a decryption tag to the data packet of the incoming data message through the xfrm module. Referring to FIG. 3 , which is a data processing flow chart of the xfrm module in the encryption gateway in an embodiment of the present application, step S20 specifically includes:

S201: The stacked data message enters the xfrm module;

S202: the xfrm module matches the outbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);

S203: Determine whether the matching of the directional security policy (sp) is successful, if successful, proceed to S204, if failed, proceed to S207;

S204: The outbound security policy (sp) matches successfully, and the xfrm module calls the encryption label of the iptables module to add an encryption label to the incoming data message. The xfrm module (sp) Check whether the corresponding security association (IPSec sa) exists. If it exists, go to S205. If it fails, go to S206.

S205: The security association (IPSec sa) exists, and the information of IPSec sa is saved in the data message;

S206: Security association (IPSec sa) does not exist. The xfrm module negotiates the security association (IPSec sa) through the IKE protocol and saves the information of IPSec sa in the data message.

S207: The outbound security policy (sp) fails to match, the xfrm module swaps the source address and the destination address of the incoming data message, and uses the xfrm module to match the inbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);

S208: Determine whether the match of the inbound security policy (sp) is successful. If successful, proceed to S209. If not, proceed to S210.

S209: the xfrm module calls the decryption label of the iptables module to add a decryption label to the incoming data message;

S210: If the incoming data message cannot match the outgoing security policy (sp) or the incoming security policy (sp), it is discarded;

S30: The iptables module of the encryption gateway creates a mount node using the encryption label or the decryption label, and sends the data packet marked with the encryption label or the decryption label in S204 or S209 to the encryption and decryption module.

Step S40: The data encryption and decryption module encrypts the data to convert it into out-of-stack message data, and sends it out from the encryption gateway, or decrypts the data to obtain the ciphertext original. Referring to FIG. 4 , which is a data processing flow chart of the data encryption and decryption module in the encryption gateway in the embodiment of the present application, step S40 specifically includes:

Step S401: the incoming message data enters the data encryption and decryption module according to the encryption or decryption tag;

Step S402: Determine whether it is an outgoing label or an incoming label. If it is an outgoing label, proceed to steps S403 to S405. If it is an incoming label, proceed to step S406.

Step S403: The data encryption and decryption module of the encryption gateway encrypts the data message by using the IPSec sa stored in the data message through the encryption tag. The data encryption adopts the CBC+ (CBC, Cipher Block Chaining) mode, which specifically includes:

For data with a length greater than one encryption block (16 bytes), take data that is an integer multiple of 16 bytes and perform CBC encryption to obtain ciphertext data 1;

For data with a remaining length less than 16 bytes, take the ciphertext of the previous block as the IV value. Use the session key K to encrypt the IV, the encryption algorithm is SM4, and the encryption mode is ECB (Electronic Codebook) to obtain Kiv (Key and Initialization Vector). Intercept Kiv to make its length equal to the length of the plaintext data, and then XOR it with the plaintext data to obtain the ciphertext data 2;

The ciphertext data 1 and the ciphertext data 2 are concatenated to obtain the complete ciphertext, wherein the complete ciphertext does not add additional encapsulation to the original data, thereby achieving the purpose of not changing the original message structure;

Step S404: The encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module. The quantum key sa is used to encrypt the data encrypted by IPSec sa again, including:

S4041. The data encryption and decryption module calculates the quantum key ID through the spi of the initiator and responder in IPSec sa. Since spi (Security Parameter Index) is used to uniquely identify IPSec sa, the quantum key ID calculated using spi is also unique.

S4042, the data encryption and decryption module obtains the quantum key sa from the quantum key pool through the quantum key ID;

S4043, the data encryption and decryption module uses the quantum key sa to re-encrypt the data encrypted by IPSec sa, and the encryption method is consistent with the encryption method of S403;

Step S405: the data processed by the data encryption and decryption module becomes outbound message data and is sent out from the encryption gateway;

Step S406: The data encryption and decryption module of the encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module through the decryption tag, and uses the quantum key sa to decrypt the data. The decryption principle is the same as step S404, specifically including:

S4061. Calculate the quantum key ID using the SPI of the initiator and the responder in the security alliance. The quantum key ID calculated using the SPI is unique.

S4062. Obtaining a quantum key sa from a quantum key pool through a quantum key ID;

S4063. Use quantum key sa to decrypt the data encrypted by IPSec sa. The decryption method is the same as that of S407.

Step S407: decrypt the data message again using the IPSec sa stored in the data message to obtain the original data message, which specifically includes the following:

For data length greater than one decryption packet (16 bytes), take data that is an integer multiple of 16 bytes for CBC decryption to obtain plaintext data 1;

For data with a remaining length less than 16 bytes, take the ciphertext of the previous group before decryption as the IV value. Use the session key K to decrypt the IV, the decryption algorithm is SM4, and the decryption mode is ECB to obtain Kiv. Intercept Kiv to make its length equal to the ciphertext data length, and then XOR it with the ciphertext data to obtain plaintext data 2;

Concatenate plaintext data 1 and plaintext data 2 to obtain the complete plaintext.

As shown in FIG1 , this embodiment provides a data encryption system based on a quantum key, including: a first encryption gateway, a second encryption gateway, and a quantum key center. The first encryption gateway and the second encryption gateway are both connected to the quantum key center, and the first encryption gateway and the second encryption gateway negotiate a key, and the first encryption gateway and the second encryption gateway submit a registration application to the quantum key distribution center, and the quantum key distribution center distributes quantum keys to the first encryption gateway and the second encryption gateway.

The first encryption gateway and the second encryption gateway have the same structure, and adopt the encryption gateway structure and encryption method described in Example 1. Quantum key module: obtain batch quantum keys from the quantum key distribution center, and each group of keys has a unique ID.

The present application provides a dual encryption method based on IPsec and quantum key, which is applicable to message data transmitted from a first encryption gateway to a second encryption gateway. The dual encryption method includes the following steps:

S1: The first encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the second encryption gateway. After the registration is successful, the quantum key distribution center injects the first quantum key into the quantum key module of the first encryption gateway. The second encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the first encryption gateway. After the registration is successful, the quantum key distribution center injects the second quantum key into the quantum key module of the second encryption gateway.

Among them, the first encryption gateway and the second encryption gateway quantum registered to the key distribution center are consistent, will form the same quantum key pool, that is, the first quantum key and the second quantum key are the same;

S2: The first encryption gateway receives the incoming data message, and adds an encryption tag to the data packet of the incoming data message through the xfrm module. This is a data processing flow chart of the xfrm module in the encryption gateway in the embodiment of the present application. The step S2 specifically includes:

Step S201: Push data packets into the xfrm module;

Step S202: the xfrm module matches the outbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);

Step S203: Determine whether the match of the outbound security policy (sp) is successful. If the match is successful, the xfrm module calls the encryption label of the iptables module to add an encryption label to the incoming data message, and enter S204;

Step S204: The xfrm module searches for the corresponding security association (IPSec sa) according to the outbound security policy (sp). If it exists, it proceeds to S205. If it fails, it proceeds to S206.

Step S205: Save the IPSec sa information in the data message;

Step S206: the xfrm module negotiates the security association (IPSec sa) through the IKE protocol and saves the information of IPSec sa in the data message;

S3: The iptables module of the first encryption gateway uses the hook node created by the encryption label to send the data marked with the encryption label in S2 to the encryption and decryption module;

S4: The data encryption and decryption module encrypts the data into outbound message data, which is sent out from the encryption gateway. Step S4 specifically includes:

Step S401: the incoming message data enters the data encryption and decryption module according to the encryption tag;

Step S402: determine whether it is an outbound label or an inbound label. In this embodiment, if it is an outbound label, proceed to step S403.

Step S403: Perform data encryption processing. The data encryption and decryption module of the first encryption gateway encrypts the data message through the encryption tag and the IPSec sa stored in the data message. The data encryption adopts the CBC+ mode, which specifically includes:

For data with a length greater than one encryption block (16 bytes), take data that is an integer multiple of 16 bytes and perform CBC encryption to obtain ciphertext data 1;

For data with a remaining length less than 16 bytes, take the ciphertext of the previous block as the IV value. Use the session key K to encrypt the IV, the encryption algorithm is SM4, and the encryption mode is ECB to obtain Kiv. Intercept Kiv to make its length equal to the length of the plaintext data, and then XOR it with the plaintext data to obtain the ciphertext data 2;

The ciphertext data 1 and the ciphertext data 2 are concatenated to obtain the complete ciphertext, wherein the complete ciphertext does not add additional encapsulation to the original data, thereby achieving the purpose of not changing the original message structure;

S404: The first encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module, and uses the quantum key sa to encrypt the data encrypted by IPSec sa again. The step S404 specifically includes:

Step S4041: The data encryption and decryption module calculates the quantum key ID through the spi of the initiator and responder in IPSec sa. Since spi (Security Parameter Index) is used to uniquely identify IPSec sa, the quantum key ID calculated using spi is also unique.

Step S4042: The data encryption and decryption module obtains the quantum key sa from the quantum key pool through the quantum key ID;

Step S4043: The data encryption and decryption module uses the quantum key sa to encrypt the data encrypted by IPSec sa again, and the encryption method is consistent with the encryption method in S403;

Step S405: the data processed by the data encryption and decryption module will become outbound message data and be sent out from the first gateway;

S5: After receiving the ciphertext data from the first encryption gateway, the second encryption gateway swaps the source address and the destination address, matches the outbound security policy (sp) in the xfrm module through the five-tuple information (source IP address, destination IP address, source port, destination port, protocol), and obtains the IPSec sa corresponding to sp; at the same time, the stacked data message is marked with a decryption tag, which specifically includes the following steps:

Step S501: Push data packets into the xfrm module;

Step S502: the xfrm module matches the outbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);

Step S503: determining that the direction security policy (sp) fails to match, and proceeding to step S504;

Step S504: the xfrm module swaps the source address and the destination address of the incoming data message, and uses the xfrm module to match the inbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);

Step S505: the inbound security policy (sp) is matched successfully;

Step S506: the xfrm module calls the decryption tag of the iptables module to add a decryption tag to the incoming data message;

Step S6: The hook node created by the second encryption gateway using the decryption tag sends the data packet marked with the decryption tag in step S506 to the encryption and decryption module;

Step S7: the second encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module, and uses the quantum key sa to decrypt the data. Step S7 specifically includes:

Step S701: The data encryption and decryption module calculates the quantum key ID through the spi of the initiator and responder in IPSec sa. Since spi (Security Parameter Index) is used to uniquely identify IPSec sa, the quantum key ID calculated using spi is also unique.

Step S702: The data encryption and decryption module obtains the quantum key sa from the quantum key pool through the quantum key ID;

Step S703: The data encryption and decryption module uses the quantum key sa to decrypt the data after IPSec sa Decryption is performed;

Step S8: The data encryption and decryption module of the second encryption gateway decrypts the data message again by using the IPSec sa stored in the data message through the decryption tag to obtain the original data message, which specifically includes the following;

For data length greater than one decryption packet (16 bytes), take data that is an integer multiple of 16 bytes for CBC decryption to obtain plaintext data 1;

For data with a remaining length less than 16 bytes, take the ciphertext of the previous group before decryption as the IV value. Use the session key K to decrypt the IV, the decryption algorithm is SM4, and the decryption mode is ECB to obtain Kiv. Intercept Kiv to make its length equal to the ciphertext data length, and then XOR it with the ciphertext data to obtain plaintext data 2;

Concatenate plaintext data 1 and plaintext data 2 to obtain the complete plaintext.

The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

The various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the computing processing device according to the embodiment of the present application. The application can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein. Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.

For example, FIG6 shows a computing processing device that can implement the method according to the present application. The computing processing device conventionally includes a processor 1010 and a computer program product or computer-readable medium in the form of a memory 1020. The memory 1020 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM. The memory 1020 has a storage space 1030 for a program code 1031 for executing any method step in the above method. For example, the storage space 1030 for the program code may include individual program codes 1031 for implementing various steps in the above method respectively. These program codes can be read from or written to one or more computer program products. These computer program products include program code carriers such as a hard disk, a compact disk (CD), a memory card or a floppy disk. Such a computer program product is typically a portable or fixed storage unit as described with reference to FIG7. The storage unit may have storage segments, storage spaces, etc. arranged similarly to the memory 1020 in the computing processing device of FIG6. The program code may be, for example, in an appropriate Typically, the storage unit includes computer readable code 1031', that is, code that can be read by a processor such as 1010, which, when executed by a computing processing device, causes the computing processing device to perform the various steps in the method described above.

The term "one embodiment", "embodiment" or "one or more embodiments" herein means that a particular feature, structure or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present application. In addition, please note that the examples of the term "in one embodiment" here do not necessarily all refer to the same embodiment.

In the description provided herein, a large number of specific details are described. However, it is understood that the embodiments of the present application can be practiced without these specific details. In some instances, well-known methods, structures and techniques are not shown in detail so as not to obscure the understanding of this description.

In the claims, any reference signs placed between brackets shall not be construed as limiting the claims. The word "comprising" does not exclude the presence of elements or steps not listed in the claims. The word "a" or "an" preceding an element does not exclude the presence of a plurality of such elements. The present application may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware. The use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims (13)

A dual encryption method based on IPsec and quantum key, applied to an encryption gateway, wherein the method comprises the following steps: S10: The encryption gateway registers with the quantum key distribution center through the unique identifier. After successful registration, the quantum key distribution center injects quantum keys into the encryption gateway; S20: The encryption gateway receives the incoming data message and adds an encryption tag or a decryption tag to the data packet of the incoming data message; S30: Create a mounting node using the encryption label or the decryption label, and send out the data packet marked with the encryption label or the decryption label; S40: After the data is encrypted once using the security alliance, the data encrypted by the security alliance is encrypted again using the quantum key sa. The double-encrypted data becomes outbound message data and is sent out from the encryption gateway, or the data is double-decrypted to obtain the original ciphertext. A dual encryption method based on IPsec and quantum key according to claim 1, wherein S20 comprises the following steps: S201: the data packet enters the stack; S202: Matching an outbound security policy according to the five-tuple information; S203: Determine whether the matching of the directional security policy is successful, if successful, proceed to S204, if failed, proceed to S207; S204: If the outbound security policy matches successfully, the incoming data message is encrypted and the corresponding security alliance is checked according to the outbound security policy. If it exists, the process proceeds to S205. If it fails, the process proceeds to S206. S205: The security association exists, and the information of the security association is saved in the data message; S206: If the security association does not exist, the security association is negotiated through the IKE protocol, and the information of the security association is saved in the data message; S207: If the outbound security policy fails to match, the source address and the destination address of the incoming data packet are swapped, and the inbound security policy is matched according to the five-tuple information; S208: Determine whether the inbound security policy is matched successfully. If successful, proceed to step S209; if not, proceed to step S210; S209: Add a decryption tag to the incoming data message; S210: The incoming data message cannot match the outbound security policy or the inbound security policy, and is discarded. The dual encryption method based on IPsec and quantum key according to claim 2, wherein step S40 specifically comprises: S401: receiving data with an encryption tag or a decryption tag; S402: Determine whether it is an outbound label or an inbound label. If it is an outbound label, proceed to step S403 to step S405. If it is an inbound label, proceed to step S406. S403: Encrypt the data message using the security association through the encryption tag; S404: Obtain the quantum key sa, and use the quantum key sa to encrypt the data encrypted by the security association again; S405: The data processed by the data encryption and decryption module becomes outbound message data and is sent out from the encryption gateway; S406: Obtain the quantum key sa by decrypting the tag, and use the quantum key sa to decrypt the data; S407: Decrypt the data message using the security association to obtain the original data message. A dual encryption method based on IPsec and quantum key as claimed in claim 3, wherein in step S403, data encryption adopts CBC+ mode, which specifically includes: For data whose length is greater than one encryption block, take data of an integer multiple of the encryption block for CBC encryption to obtain ciphertext data 1; If the remaining length is less than one encrypted data block, take the encrypted ciphertext of the previous block as the IV value, encrypt IV with the session key K, use SM4 as the encryption algorithm, use ECB as the encryption mode, obtain Kiv, intercept Kiv to make its length equal to the length of plaintext data, and then XOR it with the plaintext data to obtain ciphertext data 2; Concatenate ciphertext data 1 and ciphertext data 2 to obtain the complete ciphertext; The decryption process in step S407 specifically includes: For data whose length is greater than one decryption block, take data of an integer multiple of the encryption block for CBC decryption to obtain plaintext data 1; If the remaining length is less than that of an encrypted data packet, take the ciphertext of the previous packet before decryption as the IV value, use the session key K to decrypt the IV, use the decryption algorithm SM4, and the decryption mode ECB to obtain Kiv, truncate Kiv to make its length equal to the ciphertext data length, and then XOR it with the ciphertext data to obtain plaintext data 2; Concatenate plaintext data 1 and plaintext data 2 to obtain the complete plaintext. The dual encryption method based on IPsec and quantum key according to claim 3, wherein step S404 specifically comprises: S4041. Calculate the quantum key ID using the SPI of the initiator and the responder in the security alliance. The quantum key ID calculated using the SPI is unique. S4042. Obtaining a quantum key sa from a quantum key pool through a quantum key ID; S4043, using quantum key sa to encrypt the data encrypted by IPSec sa again, the encryption method is the same as that of S403; Step S406 specifically includes: S4061. Calculate the quantum key ID using the SPI of the initiator and the responder in the security alliance. The quantum key ID calculated using the SPI is unique. S4062. Obtaining a quantum key sa from a quantum key pool through a quantum key ID; S4063. Use quantum key sa to decrypt the data encrypted by IPSec sa. The decryption method is the same as that of S407. Implementing a dual-mode IPsec and quantum key encryption system as claimed in any one of claims 1 to 5 An encryption gateway of a heavy encryption method, including: The quantum key module is used for the encryption gateway to register with the quantum key distribution center through a unique identifier. After successful registration, the quantum key distribution center injects quantum keys into the quantum key module of the encryption gateway; The xfrm module is used to receive the incoming data message and call the encryption and decryption label of the iptables module to add an encryption label or a decryption label to the incoming data message; The iptables module creates encryption labels and decryption labels in advance, sets rules in the POSTROUTING chain of the mangel table, creates a mount node using encryption labels or decryption labels, and sends the data packets marked with encryption labels or decryption labels to the encryption and decryption module; The data encryption and decryption module uses the security alliance to encrypt the data once, and then uses the quantum key sa to encrypt the data encrypted by the security alliance again. The double-encrypted data becomes the outbound message data and is sent out from the encryption gateway, or the data is double-decrypted to obtain the original ciphertext. An encryption gateway based on a dual encryption method of IPsec and quantum key according to claim 6, wherein the xfrm module specifically comprises: xfrm module entry unit: used to push data packets into the xfrm module; Outbound security policy matching unit: used to match outbound security policies according to quintuple information; The first judgment unit is used to judge whether the matching of the outbound security policy is successful; Security association search unit: If the outbound security policy is matched successfully, it is used to add an encryption tag to the incoming data message and search for the corresponding security association according to the outbound security policy. Encryption tag unit: When a security association exists, the security association information is stored in the data message; Security Association Negotiation Unit: When a security association does not exist, it is used to negotiate a security association through the IKE protocol and save the security association information in the data message; Inbound security policy matching unit: when outbound security policy matching fails, it is used to swap the source address and destination address of the incoming data packet and match the inbound security policy according to the five-tuple information; The second judgment unit is used to judge whether the matching of the inbound security policy is successful; Decryption labeling unit: If the inbound security policy is successfully matched, the incoming data packet is labeled with a decryption label; Discard unit: If the incoming data packet cannot match the outbound security policy or the inbound security policy, it will be discarded. An encryption gateway based on a dual encryption method of IPsec and quantum key as claimed in claim 6, wherein: The data encryption and decryption module specifically includes: Data receiving unit: receiving data with encryption or decryption tags; Direction label judgment unit: judges whether it is an outgoing direction label or an incoming direction label; Encryption unit, if it is an outgoing label, uses the security association to encrypt the datagram through the encryption label Encrypt the text; A re-encryption unit, used to obtain the quantum key sa, and use the quantum key sa to re-encrypt the data encrypted by the security association; The sending unit is used to convert the re-encrypted data into outbound message data and send it out from the encryption gateway; The decryption unit, if it is an incoming tag, obtains the quantum key sa through the decryption tag, and uses the quantum key sa to decrypt the data; The decryption unit decrypts the data message again using the security association to obtain the original data message. An encryption gateway based on a dual encryption method of IPsec and quantum key according to claim 8, wherein the data encryption adopts a CBC+ mode, which specifically includes: For data whose length is greater than one encryption block, take data of an integer multiple of the encryption block for CBC encryption to obtain ciphertext data 1; If the remaining length is less than one encrypted data block, take the encrypted ciphertext of the previous block as the IV value, encrypt IV with the session key K, use SM4 as the encryption algorithm, use ECB as the encryption mode, obtain Kiv, intercept Kiv to make its length equal to the length of plaintext data, and then XOR it with the plaintext data to obtain ciphertext data 2; Concatenate ciphertext data 1 and ciphertext data 2 to obtain the complete ciphertext; The decryption process specifically includes: For data whose length is greater than one decryption block, take data of an integer multiple of the encryption block for CBC decryption to obtain plaintext data 1; If the remaining length is less than that of an encrypted data packet, take the ciphertext of the previous packet before decryption as the IV value, use the session key K to decrypt the IV, use the decryption algorithm SM4, and the decryption mode ECB to obtain Kiv, truncate Kiv to make its length equal to the ciphertext data length, and then XOR it with the ciphertext data to obtain plaintext data 2; Concatenate plaintext data 1 and plaintext data 2 to obtain the complete plaintext. A dual encryption method based on IPsec and quantum key, applied to the transmission of message data through a first encryption gateway to a second encryption gateway, wherein the first encryption gateway and the second encryption gateway adopt the dual encryption gateway according to any one of claims 6 to 9, and the encryption method comprises the following steps: S1: The first encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the second encryption gateway. After successful registration, the quantum key distribution center injects the first quantum key into the quantum key module of the first encryption gateway. The second encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the first encryption gateway. After successful registration, the quantum key distribution center injects the second quantum key into the quantum key module of the second encryption gateway. The identifiers registered by the first encryption gateway and the second encryption gateway quantum to the key distribution center are consistent, forming the same quantum key pool, that is, the first quantum key and the second quantum key are the same; S2: The first encryption gateway receives the incoming data message and sends the data packet of the incoming data message to Add encryption tags through the xfrm module; S3: The iptables module of the first encryption gateway sends the data packet with the encryption label in S2 to the encryption and decryption module through the hook node created by the encryption label; S4: The data encryption and decryption module of the first encryption gateway encrypts the data message by using the security alliance stored in the data message through the encryption tag, obtains the quantum key sa from the quantum key pool, and uses the quantum key sa to encrypt the data encrypted by the security alliance again and sends it out; S5: After receiving the ciphertext data from the first encryption gateway, the second encryption gateway swaps the source address and the destination address, matches the outbound security policy in the xfrm module through the five-tuple information, and obtains the security alliance corresponding to the security policy; at the same time, the stacked data message is marked with a decryption tag; S6: The iptables module of the second encryption gateway uses the hook node created by the decryption label to send the data packet marked with the decryption label in step S5 to the encryption and decryption module; S7: The second encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module, and uses the quantum key sa to decrypt the data; S8: The data encryption and decryption module of the second encryption gateway decrypts the data message again by using the security association stored in the data message through the decryption tag to obtain the original data message. A computing and processing device, comprising: a memory having computer readable code stored therein; One or more processors, when the computer-readable code is executed by the one or more processors, the computing processing device performs a dual encryption method based on IPsec and quantum key as described in any one of claims 1-5. A computer program comprises a computer readable code, which, when executed on a computing processing device, causes the computing processing device to execute a dual encryption method based on IPsec and quantum key according to any one of claims 1 to 5. A computer readable medium having stored therein the computer program as claimed in claim 12.