[go: up one dir, main page]

WO2025118789A1 - Procédé de double chiffrement basé sur ipsec et sur clé quantique, et passerelle de chiffrement - Google Patents

Procédé de double chiffrement basé sur ipsec et sur clé quantique, et passerelle de chiffrement Download PDF

Info

Publication number
WO2025118789A1
WO2025118789A1 PCT/CN2024/120830 CN2024120830W WO2025118789A1 WO 2025118789 A1 WO2025118789 A1 WO 2025118789A1 CN 2024120830 W CN2024120830 W CN 2024120830W WO 2025118789 A1 WO2025118789 A1 WO 2025118789A1
Authority
WO
WIPO (PCT)
Prior art keywords
data
encryption
quantum key
decryption
gateway
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Pending
Application number
PCT/CN2024/120830
Other languages
English (en)
Chinese (zh)
Inventor
徐凯年
覃洋
龙翔
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
China Telecom Quantum Technology Co Ltd
Original Assignee
China Telecom Quantum Technology Co Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by China Telecom Quantum Technology Co Ltd filed Critical China Telecom Quantum Technology Co Ltd
Publication of WO2025118789A1 publication Critical patent/WO2025118789A1/fr
Pending legal-status Critical Current
Anticipated expiration legal-status Critical

Links

Classifications

    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0485—Networking architectures for enhanced packet encryption processing, e.g. offloading of IPsec packet processing or efficient security association look-up
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L12/00—Data switching networks
    • H04L12/66—Arrangements for connecting between networks having differing types of switching systems, e.g. gateways
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/02—Network architectures or network communication protocols for network security for separating internal from external traffic, e.g. firewalls
    • H04L63/0272—Virtual private networks
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/04—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks
    • H04L63/0428—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload
    • H04L63/0478—Network architectures or network communication protocols for network security for providing a confidential data exchange among entities communicating through data packet networks wherein the data content is protected, e.g. by encrypting or encapsulating the payload applying multiple layers of encryption, e.g. nested tunnels or encrypting the content with a first key and then with at least a second key
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L63/00—Network architectures or network communication protocols for network security
    • H04L63/20—Network architectures or network communication protocols for network security for managing network security; network security policies in general
    • H04L63/205—Network architectures or network communication protocols for network security for managing network security; network security policies in general involving negotiation or determination of the one or more network security mechanisms to be used, e.g. by negotiation between the client and the server or between peers or by selection according to the capabilities of the entities involved
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/08—Key distribution or management, e.g. generation, sharing or updating, of cryptographic keys or passwords
    • H04L9/0816—Key establishment, i.e. cryptographic processes or cryptographic protocols whereby a shared secret becomes available to two or more parties, for subsequent use
    • H04L9/0852—Quantum cryptography
    • H—ELECTRICITY
    • H04—ELECTRIC COMMUNICATION TECHNIQUE
    • H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
    • H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
    • H04L9/40—Network security protocols

Definitions

  • the present application relates to the fields of cryptographic applications and network security, and specifically to a dual encryption method and encryption gateway based on IPsec and quantum key.
  • IPSec Internet Protocol Security
  • VPN Virtual Native Network gateways
  • the Chinese invention patent application document with application publication number CN116405206A discloses a method for data encryption and decryption of a security gateway, in which quantum key encryption is used, and the session ID of the quantum key is used as the spi (Security Parameter Index) in the encapsulated security payload esp to be passed to the other end to realize data decryption.
  • this solution will also add additional data encapsulation on the basis of the payload data, which will increase additional overhead for the user's network bandwidth.
  • the Chinese invention patent application document with application publication number CN115567205A discloses a method for implementing encryption and decryption of network session data streams using quantum key distribution.
  • the main features of this scheme are: (1) a mapping relationship is established between the quantum master key ID and the 5-tuple network session stream through the quantum distribution network, and the master key identifier is placed in the security message header of the encrypted data message to achieve end-to-end encrypted communication. (2) The functions of establishing, aging, and deleting the flow table are realized.
  • This scheme also adds additional data encapsulation, increases the user's network bandwidth overhead, and has complex function implementation.
  • the technical problem to be solved by this application is how to achieve end-to-end encryption of data payloads without adding additional payload encapsulation, thereby improving the confidentiality of data messages while not reducing the use of user bandwidth.
  • the present application proposes a dual encryption method based on IPsec and quantum key for encryption gateway, comprising the following steps:
  • the encryption gateway is registered with the sub-key distribution center through a unique identifier. After successful registration, The quantum key distribution center injects quantum keys into the encryption gateway;
  • the encryption gateway receives the incoming data message and adds an encryption tag or a decryption tag to the data packet of the incoming data message;
  • the quantum key sa is used to encrypt the data encrypted by the security alliance again.
  • the double-encrypted data becomes outbound message data and is sent out from the encryption gateway, or the data is double-decrypted to obtain the original ciphertext.
  • the encryption gateway receives the incoming data message and adds an encryption tag or a decryption tag to the data packet of the incoming data message, including the following steps:
  • the stacked data message enters
  • the incoming data packet is encrypted and the corresponding security association is checked based on the outbound security policy.
  • the security association information is saved in the data message
  • the security association is negotiated through the IKE protocol and the security association information is saved in the data message;
  • the outbound security policy fails to match, the source address and destination address of the incoming data packet are swapped, and the inbound security policy is matched based on the five-tuple information;
  • the incoming data packet is marked with a decryption tag
  • the incoming data packet cannot match the outbound security policy or the inbound security policy and is discarded.
  • the data encrypted by the security alliance is encrypted again using the quantum key sa, and the double-encrypted data becomes the out-of-stack message data and is sent out from the encryption gateway, or the data is double-decrypted to obtain the ciphertext original text, which specifically includes:
  • the data message is encrypted using the security association through the encryption label
  • the data processed by the data encryption and decryption module becomes outbound message data and is sent out from the encryption gateway;
  • the quantum key sa is obtained by decrypting the tag, and the data is decrypted using the quantum key sa;
  • the data message is decrypted using the security association to obtain the original data message.
  • data encryption adopts the CBC+ mode.
  • the encryption tag and the security association are used to encrypt the data message, which specifically includes:
  • the decryption process of using the security association to decrypt the data message to obtain the original data message specifically includes:
  • the remaining length is less than that of an encrypted data packet, take the ciphertext of the previous packet before decryption as the IV value, use the session key K to decrypt the IV, use the decryption algorithm SM4, and the decryption mode ECB to obtain Kiv, truncate Kiv to make its length equal to the ciphertext data length, and then XOR it with the ciphertext data to obtain plaintext data 2;
  • the step of obtaining the quantum key sa and re-encrypting the data encrypted by the security alliance using the quantum key sa specifically includes:
  • the quantum key ID is calculated through the SPI of the initiator and responder in the security alliance.
  • the quantum key ID calculated by SPI is unique.
  • the data encrypted by IPSec sa is encrypted again using the quantum key sa.
  • the encryption method is the same as that of S403.
  • the step of obtaining the quantum key sa by decrypting the tag and decrypting the data by using the quantum key sa specifically includes:
  • the quantum key ID is calculated through the SPI of the initiator and responder in the security alliance.
  • the quantum key ID calculated by SPI is unique.
  • the quantum key sa is used to decrypt the data encrypted by IPSec sa.
  • the decryption method is the same as that of S407.
  • the present application further provides an encryption gateway for executing a dual encryption method based on IPsec and quantum key as described in any of the above technical solutions, including:
  • the quantum key module is used for the encryption gateway to register with the quantum key distribution center through a unique identifier. After successful registration, the quantum key distribution center injects quantum keys into the quantum key module of the encryption gateway;
  • the xfrm module is used to receive the incoming data message and call the encryption and decryption label of the iptables module to add an encryption label or a decryption label to the incoming data message;
  • the iptables module creates encryption labels and decryption labels in advance, sets rules in the POSTROUTING chain of the shaped table, creates a mount node using encryption labels or decryption labels, and sends the data packets marked with encryption labels or decryption labels to the encryption and decryption module;
  • the data encryption and decryption module uses the security alliance to encrypt the data once, and then uses the quantum key sa to encrypt the data encrypted by the security alliance again.
  • the double-encrypted data becomes the outbound message data and is sent out from the encryption gateway, or the data is double-decrypted to obtain the original ciphertext.
  • the xfrm module specifically includes:
  • xfrm module entry unit used to push data packets into the xfrm module
  • Outbound security policy matching unit used to match outbound security policies according to quintuple information
  • the first judgment unit is used to judge whether the matching of the outbound security policy is successful
  • Security association search unit If the outbound security policy is matched successfully, it is used to add an encryption tag to the incoming data message and search for the corresponding security association according to the outbound security policy.
  • Encryption tag unit When a security association exists, the security association information is stored in the data message;
  • Security Association Negotiation Unit When a security association does not exist, it is used to negotiate a security association through the IKE protocol and save the security association information in the data message;
  • Inbound security policy matching unit when outbound security policy matching fails, it is used to swap the source address and destination address of the incoming data packet and match the inbound security policy according to the five-tuple information;
  • Decryption labeling unit If the inbound security policy is successfully matched, the incoming data packet is labeled with a decryption label;
  • Discard unit If the incoming data packet cannot match the outbound security policy or the inbound security policy, it will be discarded.
  • the data encryption and decryption module specifically includes:
  • Data receiving unit receiving data with encryption or decryption tags
  • Direction label judgment unit judges whether it is an outgoing direction label or an incoming direction label
  • the encryption unit if it is an outgoing label, encrypts the data message using the security association through the encryption label;
  • a re-encryption unit used to obtain the quantum key sa, and use the quantum key sa to re-encrypt the data encrypted by the security association;
  • the sending unit is used to convert the re-encrypted data into outbound message data and send it out from the encryption gateway;
  • the decryption unit if it is an incoming tag, obtains the quantum key sa through the decryption tag, and uses the quantum key sa to decrypt the data;
  • the decryption unit decrypts the data message again using the security association to obtain the original data message.
  • the data encryption adopts the CBC+ mode, which specifically includes:
  • the decryption process specifically includes:
  • the remaining length is less than that of an encrypted data packet, take the ciphertext of the previous packet before decryption as the IV value, use the session key K to decrypt the IV, use the decryption algorithm SM4, and the decryption mode ECB to obtain Kiv, truncate Kiv to make its length equal to the ciphertext data length, and then XOR it with the ciphertext data to obtain plaintext data 2;
  • the present application also provides a dual encryption method based on IPsec and quantum key, which is applicable to the transmission of message data from a first encryption gateway to a second encryption gateway, wherein the first encryption gateway and the second encryption gateway adopt the mechanism described in any one of claims 6 to 9, and the encryption method comprises the following steps:
  • the first encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the second encryption gateway. After successful registration, the quantum key distribution center injects the first quantum key into the quantum key module of the first encryption gateway.
  • the second encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the first encryption gateway. After successful registration, the quantum key distribution center injects the second quantum key into the quantum key module of the second encryption gateway.
  • the identifiers registered by the first encryption gateway and the second encryption gateway quantum to the key distribution center are consistent, forming the same quantum key pool, that is, the first quantum key and the second quantum key are the same;
  • the first encryption gateway receives the incoming data message and adds an encryption tag to the data packet of the incoming data message through the xfrm module;
  • the iptables module of the first encryption gateway sends the data packet marked with the encryption label in S2 to the encryption and decryption module through the hook node created by the encryption label;
  • the second encryption gateway After the second encryption gateway receives the ciphertext data from the first encryption gateway, it sends the source address and destination address
  • the five-tuple information is used to match the outbound security policy in the xfrm module, and the security alliance corresponding to the security policy is obtained; at the same time, the incoming data message is marked with a decryption tag;
  • the iptables module of the second encryption gateway uses the hook node created by the decryption label to send the data packet marked with the decryption label in step S5 to the encryption and decryption module;
  • the second encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module and uses the quantum key sa to decrypt the data;
  • the data encryption and decryption module of the second encryption gateway decrypts the data message again by using the security association stored in the data message through the decryption tag to obtain the original text of the data message.
  • the present application proposes a computing processing device, comprising: a memory in which a computer-readable code is stored; and one or more processors.
  • the computing processing device executes the authentication method based on double quantum random number protection as described above.
  • the present application proposes a computer program, which includes a computer-readable code.
  • the computer-readable code When the computer-readable code is run on a computing processing device, it causes the computing processing device to execute any of the authentication methods based on double quantum random number protection as described above.
  • the present application proposes a computer-readable medium in which the computer program described above is stored.
  • This method uses quantum key distribution, xfrm and iptables modules to encrypt the payload data behind the IP header.
  • the main creativity lies in:
  • Data encapsulation does not require additional payload encapsulation and does not change the original structure of the data packet. It is applicable to a wider range of network environments. No matter how complex the intermediate network environment is, the data packet can be transmitted normally in the network and does not generate additional overhead for the user's network bandwidth.
  • This method not only meets the networking environment of traditional VPN, but also provides a data encryption mechanism based on Layer 2 network (data link layer), realizing a safer and more efficient encryption transmission method.
  • the link is completely transparent and the connection is extremely easy to deploy.
  • FIG1 is a block diagram of a data encryption system based on quantum key in an embodiment of the present application
  • FIG2 is a block diagram of the connection structure of the encryption gateway and the quantum key distribution system in an embodiment of the present application
  • FIG3 is a flow chart of data processing of the xfrm module in the encryption gateway in an embodiment of the present application
  • FIG. 4 is a data processing flow chart of a data encryption and decryption module in an encryption gateway in an embodiment of the present application
  • FIG5 is a flowchart of the interaction between encryption gateways in an embodiment of the present application.
  • FIG6 is a schematic diagram of the structure of a computing and processing device proposed in an embodiment of the present application.
  • FIG. 7 is a schematic diagram of a storage unit for program code proposed in an embodiment of the present application. picture.
  • the present application provides a dual encryption method based on IPsec and quantum key, which is used for an encryption gateway, and the encryption gateway includes:
  • Stacked data message the data message received by the encrypted gateway
  • Outbound data message data message after encryption or decryption
  • xfrm module implements the addition, deletion, modification and query of security policies (sp), the negotiation aging of security associations (sa), matches security policies on incoming data packets, and adds encryption and decryption tags according to the direction of the matching policy;
  • xfrm stands for Transform, which is part of the IPsec protocol stack.
  • iptables (firewall) module creates encryption labels and decryption labels, sets rules in the POSTROUTING chain of the shaped table, creates a hook using encryption labels or decryption labels, and sends data matching the encryption and decryption labels to the data encryption and decryption module through the hook mechanism;
  • iptables is a firewall and network address translation tool
  • ⁇ is used to modify specific fields of the data packet
  • POSTROUTING is used to process the data packet after the routing decision.
  • Data encryption and decryption module Encrypts or decrypts data packets by judging the labels of data packets.
  • the encryption and decryption keys come from IKE key negotiation and quantum key distribution.
  • the double encryption method comprises the following steps:
  • the encryption gateway registers with the quantum key distribution center through a unique identifier. After successful registration, the quantum key distribution center injects quantum keys into the quantum key module of the encryption gateway. The identifiers registered by each communicating encryption gateway to the quantum key distribution center are consistent, forming the same quantum key pool;
  • step S20 The encryption gateway receives the incoming data message, and adds an encryption tag or a decryption tag to the data packet of the incoming data message through the xfrm module.
  • step S20 specifically includes:
  • the xfrm module matches the outbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);
  • S203 Determine whether the matching of the directional security policy (sp) is successful, if successful, proceed to S204, if failed, proceed to S207;
  • S204 The outbound security policy (sp) matches successfully, and the xfrm module calls the encryption label of the iptables module to add an encryption label to the incoming data message.
  • the xfrm module (sp) Check whether the corresponding security association (IPSec sa) exists. If it exists, go to S205. If it fails, go to S206.
  • S205 The security association (IPSec sa) exists, and the information of IPSec sa is saved in the data message;
  • S206 Security association (IPSec sa) does not exist.
  • the xfrm module negotiates the security association (IPSec sa) through the IKE protocol and saves the information of IPSec sa in the data message.
  • the outbound security policy (sp) fails to match, the xfrm module swaps the source address and the destination address of the incoming data message, and uses the xfrm module to match the inbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);
  • S208 Determine whether the match of the inbound security policy (sp) is successful. If successful, proceed to S209. If not, proceed to S210.
  • the iptables module of the encryption gateway creates a mount node using the encryption label or the decryption label, and sends the data packet marked with the encryption label or the decryption label in S204 or S209 to the encryption and decryption module.
  • Step S40 The data encryption and decryption module encrypts the data to convert it into out-of-stack message data, and sends it out from the encryption gateway, or decrypts the data to obtain the ciphertext original.
  • step S40 specifically includes:
  • Step S401 the incoming message data enters the data encryption and decryption module according to the encryption or decryption tag;
  • Step S402 Determine whether it is an outgoing label or an incoming label. If it is an outgoing label, proceed to steps S403 to S405. If it is an incoming label, proceed to step S406.
  • Step S403 The data encryption and decryption module of the encryption gateway encrypts the data message by using the IPSec sa stored in the data message through the encryption tag.
  • the data encryption adopts the CBC+ (CBC, Cipher Block Chaining) mode, which specifically includes:
  • the ciphertext data 1 and the ciphertext data 2 are concatenated to obtain the complete ciphertext, wherein the complete ciphertext does not add additional encapsulation to the original data, thereby achieving the purpose of not changing the original message structure;
  • Step S404 The encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module.
  • the quantum key sa is used to encrypt the data encrypted by IPSec sa again, including:
  • the data encryption and decryption module calculates the quantum key ID through the spi of the initiator and responder in IPSec sa. Since spi (Security Parameter Index) is used to uniquely identify IPSec sa, the quantum key ID calculated using spi is also unique.
  • the data encryption and decryption module obtains the quantum key sa from the quantum key pool through the quantum key ID;
  • the data encryption and decryption module uses the quantum key sa to re-encrypt the data encrypted by IPSec sa, and the encryption method is consistent with the encryption method of S403;
  • Step S405 the data processed by the data encryption and decryption module becomes outbound message data and is sent out from the encryption gateway;
  • Step S406 The data encryption and decryption module of the encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module through the decryption tag, and uses the quantum key sa to decrypt the data.
  • the decryption principle is the same as step S404, specifically including:
  • Step S407 decrypt the data message again using the IPSec sa stored in the data message to obtain the original data message, which specifically includes the following:
  • this embodiment provides a data encryption system based on a quantum key, including: a first encryption gateway, a second encryption gateway, and a quantum key center.
  • the first encryption gateway and the second encryption gateway are both connected to the quantum key center, and the first encryption gateway and the second encryption gateway negotiate a key, and the first encryption gateway and the second encryption gateway submit a registration application to the quantum key distribution center, and the quantum key distribution center distributes quantum keys to the first encryption gateway and the second encryption gateway.
  • the first encryption gateway and the second encryption gateway have the same structure, and adopt the encryption gateway structure and encryption method described in Example 1.
  • Quantum key module obtain batch quantum keys from the quantum key distribution center, and each group of keys has a unique ID.
  • the present application provides a dual encryption method based on IPsec and quantum key, which is applicable to message data transmitted from a first encryption gateway to a second encryption gateway.
  • the dual encryption method includes the following steps:
  • the first encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the second encryption gateway. After the registration is successful, the quantum key distribution center injects the first quantum key into the quantum key module of the first encryption gateway.
  • the second encryption gateway registers with the quantum key distribution center through the unique identifier and the unique identifier of the first encryption gateway. After the registration is successful, the quantum key distribution center injects the second quantum key into the quantum key module of the second encryption gateway.
  • the first encryption gateway and the second encryption gateway quantum registered to the key distribution center are consistent, will form the same quantum key pool, that is, the first quantum key and the second quantum key are the same;
  • the first encryption gateway receives the incoming data message, and adds an encryption tag to the data packet of the incoming data message through the xfrm module.
  • the step S2 specifically includes:
  • Step S201 Push data packets into the xfrm module
  • Step S202 the xfrm module matches the outbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);
  • Step S203 Determine whether the match of the outbound security policy (sp) is successful. If the match is successful, the xfrm module calls the encryption label of the iptables module to add an encryption label to the incoming data message, and enter S204;
  • Step S204 The xfrm module searches for the corresponding security association (IPSec sa) according to the outbound security policy (sp). If it exists, it proceeds to S205. If it fails, it proceeds to S206.
  • IPSec sa security association
  • sp outbound security policy
  • Step S205 Save the IPSec sa information in the data message
  • Step S206 the xfrm module negotiates the security association (IPSec sa) through the IKE protocol and saves the information of IPSec sa in the data message;
  • the iptables module of the first encryption gateway uses the hook node created by the encryption label to send the data marked with the encryption label in S2 to the encryption and decryption module;
  • Step S4 The data encryption and decryption module encrypts the data into outbound message data, which is sent out from the encryption gateway.
  • Step S4 specifically includes:
  • Step S401 the incoming message data enters the data encryption and decryption module according to the encryption tag;
  • Step S402 determine whether it is an outbound label or an inbound label. In this embodiment, if it is an outbound label, proceed to step S403.
  • Step S403 Perform data encryption processing.
  • the data encryption and decryption module of the first encryption gateway encrypts the data message through the encryption tag and the IPSec sa stored in the data message.
  • the data encryption adopts the CBC+ mode, which specifically includes:
  • the ciphertext data 1 and the ciphertext data 2 are concatenated to obtain the complete ciphertext, wherein the complete ciphertext does not add additional encapsulation to the original data, thereby achieving the purpose of not changing the original message structure;
  • the first encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module, and uses the quantum key sa to encrypt the data encrypted by IPSec sa again.
  • the step S404 specifically includes:
  • Step S4041 The data encryption and decryption module calculates the quantum key ID through the spi of the initiator and responder in IPSec sa. Since spi (Security Parameter Index) is used to uniquely identify IPSec sa, the quantum key ID calculated using spi is also unique.
  • spi Security Parameter Index
  • Step S4042 The data encryption and decryption module obtains the quantum key sa from the quantum key pool through the quantum key ID;
  • Step S4043 The data encryption and decryption module uses the quantum key sa to encrypt the data encrypted by IPSec sa again, and the encryption method is consistent with the encryption method in S403;
  • Step S405 the data processed by the data encryption and decryption module will become outbound message data and be sent out from the first gateway;
  • the second encryption gateway After receiving the ciphertext data from the first encryption gateway, the second encryption gateway swaps the source address and the destination address, matches the outbound security policy (sp) in the xfrm module through the five-tuple information (source IP address, destination IP address, source port, destination port, protocol), and obtains the IPSec sa corresponding to sp; at the same time, the stacked data message is marked with a decryption tag, which specifically includes the following steps:
  • Step S501 Push data packets into the xfrm module
  • Step S502 the xfrm module matches the outbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);
  • Step S503 determining that the direction security policy (sp) fails to match, and proceeding to step S504;
  • Step S504 the xfrm module swaps the source address and the destination address of the incoming data message, and uses the xfrm module to match the inbound security policy (sp) according to the five-tuple information (source IP address, destination IP address, source port, destination port, protocol);
  • Step S505 the inbound security policy (sp) is matched successfully
  • Step S506 the xfrm module calls the decryption tag of the iptables module to add a decryption tag to the incoming data message;
  • Step S6 The hook node created by the second encryption gateway using the decryption tag sends the data packet marked with the decryption tag in step S506 to the encryption and decryption module;
  • Step S7 the second encryption gateway obtains the quantum key sa from the quantum key pool of the quantum encryption module, and uses the quantum key sa to decrypt the data.
  • Step S7 specifically includes:
  • Step S701 The data encryption and decryption module calculates the quantum key ID through the spi of the initiator and responder in IPSec sa. Since spi (Security Parameter Index) is used to uniquely identify IPSec sa, the quantum key ID calculated using spi is also unique.
  • spi Security Parameter Index
  • Step S702 The data encryption and decryption module obtains the quantum key sa from the quantum key pool through the quantum key ID;
  • Step S703 The data encryption and decryption module uses the quantum key sa to decrypt the data after IPSec sa Decryption is performed;
  • Step S8 The data encryption and decryption module of the second encryption gateway decrypts the data message again by using the IPSec sa stored in the data message through the decryption tag to obtain the original data message, which specifically includes the following;
  • the device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.
  • the various component embodiments of the present application can be implemented in hardware, or in software modules running on one or more processors, or in a combination thereof. It should be understood by those skilled in the art that a microprocessor or digital signal processor (DSP) can be used in practice to implement some or all functions of some or all components in the computing processing device according to the embodiment of the present application.
  • DSP digital signal processor
  • the application can also be implemented as a device or apparatus program (e.g., computer program and computer program product) for executing part or all of the methods described herein.
  • Such a program implementing the present application can be stored on a computer-readable medium, or can have the form of one or more signals. Such a signal can be downloaded from an Internet website, or provided on a carrier signal, or provided in any other form.
  • FIG6 shows a computing processing device that can implement the method according to the present application.
  • the computing processing device conventionally includes a processor 1010 and a computer program product or computer-readable medium in the form of a memory 1020.
  • the memory 1020 can be an electronic memory such as a flash memory, an EEPROM (electrically erasable programmable read-only memory), an EPROM, a hard disk or a ROM.
  • the memory 1020 has a storage space 1030 for a program code 1031 for executing any method step in the above method.
  • the storage space 1030 for the program code may include individual program codes 1031 for implementing various steps in the above method respectively. These program codes can be read from or written to one or more computer program products.
  • These computer program products include program code carriers such as a hard disk, a compact disk (CD), a memory card or a floppy disk.
  • a computer program product is typically a portable or fixed storage unit as described with reference to FIG7.
  • the storage unit may have storage segments, storage spaces, etc. arranged similarly to the memory 1020 in the computing processing device of FIG6.
  • the program code may be, for example, in an appropriate
  • the storage unit includes computer readable code 1031', that is, code that can be read by a processor such as 1010, which, when executed by a computing processing device, causes the computing processing device to perform the various steps in the method described above.
  • one embodiment means that a particular feature, structure or characteristic described in conjunction with the embodiment is included in at least one embodiment of the present application.
  • examples of the term “in one embodiment” here do not necessarily all refer to the same embodiment.
  • any reference signs placed between brackets shall not be construed as limiting the claims.
  • the word “comprising” does not exclude the presence of elements or steps not listed in the claims.
  • the word “a” or “an” preceding an element does not exclude the presence of a plurality of such elements.
  • the present application may be implemented by means of hardware comprising several different elements and by means of a suitably programmed computer. In a unit claim enumerating several means, several of these means may be embodied by the same item of hardware.
  • the use of the words first, second, and third etc. does not indicate any order. These words may be interpreted as names.

Landscapes

  • Engineering & Computer Science (AREA)
  • Computer Security & Cryptography (AREA)
  • Computer Networks & Wireless Communication (AREA)
  • Signal Processing (AREA)
  • Computing Systems (AREA)
  • Computer Hardware Design (AREA)
  • General Engineering & Computer Science (AREA)
  • Physics & Mathematics (AREA)
  • Electromagnetism (AREA)
  • Theoretical Computer Science (AREA)
  • Data Exchanges In Wide-Area Networks (AREA)

Abstract

La présente demande concerne un procédé de double chiffrement basé sur IPsec et sur une clé quantique. Le procédé comprend les étapes suivantes : l'enregistrement d'une passerelle de chiffrement auprès d'un centre de distribution de clé quantique au moyen d'un identifiant unique et après que l'enregistrement a réussi, le chargement, par le centre de distribution de clé quantique, d'une clé quantique à la passerelle de chiffrement; la réception par la passerelle de chiffrement d'un message de données poussé et le marquage d'un paquet de données du message de données poussé avec une étiquette de chiffrement ou une étiquette de déchiffrement; au moyen de la création de l'étiquette de chiffrement et de l'étiquette de déchiffrement, le réglage d'une règle dans une chaîne de POSTROUTING d'une table de mangel, la création d'un nœud de crochet à l'aide de l'étiquette de chiffrement ou de l'étiquette de déchiffrement et l'envoi du paquet de données étiqueté avec l'étiquette de chiffrement ou l'étiquette de déchiffrement; et le chiffrement de données pour les convertir en données de message groupées, l'envoi des données de message groupées à partir de la passerelle de chiffrement, ou le déchiffrement des données pour obtenir un texte d'origine de texte chiffré. Dans la présente demande, aucune encapsulation de charge supplémentaire n'est requise pour l'encapsulation de données, la structure d'origine d'un paquet de données n'est pas modifiée et la présente demande est applicable à davantage d'environnements de réseau.
PCT/CN2024/120830 2023-12-08 2024-09-24 Procédé de double chiffrement basé sur ipsec et sur clé quantique, et passerelle de chiffrement Pending WO2025118789A1 (fr)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN202311694033.6 2023-12-08
CN202311694033.6A CN117640235A (zh) 2023-12-08 2023-12-08 基于IPsec和量子密钥的双重加密方法、加密网关

Publications (1)

Publication Number Publication Date
WO2025118789A1 true WO2025118789A1 (fr) 2025-06-12

Family

ID=90018160

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2024/120830 Pending WO2025118789A1 (fr) 2023-12-08 2024-09-24 Procédé de double chiffrement basé sur ipsec et sur clé quantique, et passerelle de chiffrement

Country Status (2)

Country Link
CN (1) CN117640235A (fr)
WO (1) WO2025118789A1 (fr)

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN117640235A (zh) * 2023-12-08 2024-03-01 中电信量子科技有限公司 基于IPsec和量子密钥的双重加密方法、加密网关
CN119583147A (zh) * 2024-11-25 2025-03-07 中电信量子科技有限公司 二层报文传输方法及系统

Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104320332A (zh) * 2014-11-13 2015-01-28 济南华汉电气科技有限公司 多协议工业通信安全网关及应用该网关的通信方法
CN108075890A (zh) * 2016-11-16 2018-05-25 中兴通讯股份有限公司 数据发送端、数据接收端、数据传输方法及系统
CN110190956A (zh) * 2019-05-28 2019-08-30 杭州迪普科技股份有限公司 数据传输方法、装置、电子设备及机器可读存储介质
US20190372936A1 (en) * 2018-05-31 2019-12-05 Cisco Technology, Inc. Encryption for gateway tunnel-based vpns independent of wan transport addresses
CN111147344A (zh) * 2019-12-16 2020-05-12 武汉思为同飞网络技术股份有限公司 一种虚拟专用网络实现方法、装置、设备及介质
CN115567205A (zh) * 2022-09-29 2023-01-03 中电信量子科技有限公司 采用量子密钥分发实现网络会话数据流加解密方法及系统
CN116886303A (zh) * 2023-09-05 2023-10-13 中量科(南京)科技有限公司 基于量子密钥生成会话密钥的加密方法、装置及存储介质
CN117640235A (zh) * 2023-12-08 2024-03-01 中电信量子科技有限公司 基于IPsec和量子密钥的双重加密方法、加密网关

Patent Citations (8)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN104320332A (zh) * 2014-11-13 2015-01-28 济南华汉电气科技有限公司 多协议工业通信安全网关及应用该网关的通信方法
CN108075890A (zh) * 2016-11-16 2018-05-25 中兴通讯股份有限公司 数据发送端、数据接收端、数据传输方法及系统
US20190372936A1 (en) * 2018-05-31 2019-12-05 Cisco Technology, Inc. Encryption for gateway tunnel-based vpns independent of wan transport addresses
CN110190956A (zh) * 2019-05-28 2019-08-30 杭州迪普科技股份有限公司 数据传输方法、装置、电子设备及机器可读存储介质
CN111147344A (zh) * 2019-12-16 2020-05-12 武汉思为同飞网络技术股份有限公司 一种虚拟专用网络实现方法、装置、设备及介质
CN115567205A (zh) * 2022-09-29 2023-01-03 中电信量子科技有限公司 采用量子密钥分发实现网络会话数据流加解密方法及系统
CN116886303A (zh) * 2023-09-05 2023-10-13 中量科(南京)科技有限公司 基于量子密钥生成会话密钥的加密方法、装置及存储介质
CN117640235A (zh) * 2023-12-08 2024-03-01 中电信量子科技有限公司 基于IPsec和量子密钥的双重加密方法、加密网关

Also Published As

Publication number Publication date
CN117640235A (zh) 2024-03-01

Similar Documents

Publication Publication Date Title
US10673818B2 (en) Method and system for sending a message through a secure connection
US8468337B2 (en) Secure data transfer over a network
US8379638B2 (en) Security encapsulation of ethernet frames
CN109150688B (zh) IPSec VPN数据传输方法及装置
CN109428867B (zh) 一种报文加解密方法、网路设备及系统
US20190372948A1 (en) Scalable flow based ipsec processing
WO2025118789A1 (fr) Procédé de double chiffrement basé sur ipsec et sur clé quantique, et passerelle de chiffrement
CN112491821B (zh) 一种IPSec报文转发的方法及装置
US9473466B2 (en) System and method for internet protocol security processing
CN110912859B (zh) 发送报文的方法、接收报文的方法及网络设备
US9083683B2 (en) Encryption/decryption device for secure communications between a protected network and an unprotected network and associated methods
CN103227742A (zh) 一种IPSec隧道快速处理报文的方法
CN106161386B (zh) 一种实现IPsec分流的方法和装置
Farinacci et al. Locator/ID separation protocol (LISP) data-plane confidentiality
US7564976B2 (en) System and method for performing security operations on network data
CN110832806B (zh) 针对面向身份的网络的基于id的数据面安全
CN117254976B (zh) 基于VPP的国标IPsec VPN实现方法、装置、系统及电子设备
Navaz et al. Security Aspects of Mobile IP
US20100275008A1 (en) Method and apparatus for secure packet transmission
CN114039812B (zh) 数据传输通道建立方法、装置、计算机设备和存储介质
Luniya et al. SmartX--Advanced Network Security for Windows Opearating System
CN117201639A (zh) 一种报文传输方法、网络虚拟化边缘设备及存储介质
Farinacci et al. RFC 8061: Locator/ID Separation Protocol (LISP) Data-Plane Confidentiality
Xirasagar et al. Securing IP networks, part I

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 24899433

Country of ref document: EP

Kind code of ref document: A1