Encryption tunnel communication method and device for path dynamic optimization

Abstract

The invention provides an encryption tunnel communication method and device for path dynamic optimization, relates to the technical field of block chains, can be applied to the financial field and other fields, and comprises the following steps: analyzing a to-be-sent data packet to obtain an initial node and a target node, obtaining a shared communication path calculated through an ant colony algorithm from a block chain network through the initial node and the target node; providing a message sending message to a corresponding target node according to the communication path, and obtaining a verification feedback result of the target node on the message sending message through a common public key generated by using a Diffie. Hellman algorithm; and establishing a secure channel with the target node according to the verification feedback result, and providing the data packet to the target node through the secure channel.

Description

Technical Field

[0001] The present application relates to the field of blockchain technology and can be applied to the financial field and other fields, and in particular to an encrypted tunnel communication method and device with dynamic path optimization. Background Art

[0002] In a public network environment, any multi-party nodes need to meet two conditions to achieve secure communication and data transmission: on the one hand, they need to avoid the risk of eavesdropping and interference from attackers, establish a multi-party shared security area for users, and protect the security of multi-party information communication; on the other hand, they need to quickly locate the target address and make the optimal path decision based on the real-time network environment. To this end, the industry is in urgent need of developing fast, efficient, and secure multi-point secure communication technology. In recent years, the dynamic decision of the optimal path has become a hot topic of concern and research in the industry.

[0003] Traditional secure communication technologies generally use encrypted tunnel protocols to provide data encryption, verification, anti-replay and authentication verification, which better meet the security requirements of end-to-end peer-to-peer communication. For example, WireGuard is an encrypted tunnel tool based on the transport layer protocol. The protocol builds a virtual interface and supports the definition of public and private keys, routing rules, listening ports and other security parameters to achieve end-to-end secure peer-to-peer transmission. Compared with protocols such as IPsec and open VPN, WireGuard has achieved significant improvements in convenience and versatility, such as supporting standard IP, udp and other protocols to set routing and interface rules. On this basis, the datagrams encrypted by the tunnel protocol also need to find the optimal path from the source node to the target node as quickly as possible to achieve rapid data communication. At present, the routing discovery of datagrams in the industry can be divided into static routing algorithms and dynamic routing algorithms based on the data link topology and link status. The former is manually set by the network administrator to set the routing strategy, which is time-consuming and labor-intensive, and cannot be dynamically adjusted according to the real-time monitoring of the network; the latter is dynamically adjusted by the algorithm according to the real-time monitoring of the network, and can be divided into two categories: distance-vector routing algorithm and link state routing algorithm. In comparison, the link state routing algorithm has strong real-time performance and considers more factors (cost, bandwidth, response time, etc.), and has gradually become a hot research direction. Summary of the invention

[0004] The purpose of this application is to provide an encrypted tunnel communication method and device with dynamic path optimization, simulate the ant colony algorithm to solve the "traveling merchant problem", introduce the gain or loss of pheromones, and implement the dynamic path optimization algorithm of IP data packets based on the encrypted tunnel protocol. At the same time, by utilizing the decentralization and multi-party sharing characteristics of blockchain, it provides shared service capabilities such as public key basic data and routing information, realizes the organic integration of ant colony algorithm and encrypted tunnel, thereby realizing secure communication and optimized routing in the process of multi-party communication, and ensuring that multi-party communication is fast, easy to use, safe and reliable.

[0005] To achieve the above-mentioned purpose, the encrypted tunnel communication method with dynamic path optimization provided by the present application specifically includes: obtaining an initial node and a target node according to the analysis of the data packet to be sent, and obtaining a shared communication path calculated by an ant colony algorithm in the blockchain network through the initial node and the target node; providing a message sending message to the corresponding target node according to the communication path, and obtaining a verification feedback result of the message sending message by the target node using a common public key generated by the Diffie-Hellman algorithm; establishing a secure channel with the target node according to the verification feedback result, and providing the data packet to the target node through the secure channel.

[0006] In the above-mentioned path dynamic optimization encrypted tunnel communication method, optionally, the method further includes: generating corresponding node public keys and node private keys respectively through encryption functions according to node information of communication nodes participating in multi-party secure communication in the blockchain network; generating a common public key through the Diffie-Hellman algorithm according to the node public key, and storing the common public key in the blockchain network.

[0007] In the above-mentioned path dynamic optimization encrypted tunnel communication method, optionally, generating corresponding node public keys and node private keys respectively through encryption functions according to the node information of the communication nodes participating in multi-party secure communication in the blockchain network also includes: initializing the node parameters of each communication node through the elliptic curve algorithm according to the node information of the communication nodes participating in multi-party secure communication in the blockchain network; signing the corresponding node parameters stored in the blockchain network through the node private key of each communication node to generate signature data; and consensus the signature data to the blockchain network.

[0008] In the above-mentioned encrypted tunnel communication method with dynamic path optimization, optionally, the method further includes: setting state transition rules for all communication processes of communication nodes participating in multi-party secure communication in the blockchain network; calculating the pheromone concentration of the communication path between the communication nodes according to the state transition rules by simulating the ant colony algorithm; obtaining the communication path between the communication nodes according to the pheromone concentration calculation, updating the routing table through the communication path, and uploading the routing table to the blockchain network for sharing.

[0009] In the above-mentioned encrypted tunnel communication method with dynamic path optimization, optionally, the pheromone concentration of the communication path between communication nodes calculated by simulating an ant colony algorithm according to the state transition rule includes: pheromone parameters of the communication path between communication nodes calculated by simulating an ant colony algorithm according to the state transition rule; and cyclically updating the pheromone concentration of the communication path between communication nodes according to the pheromone parameters.

[0010] In the above-mentioned path dynamically optimized encrypted tunnel communication method, optionally, providing a message sending message to a corresponding target node according to the communication path includes: generating a message sending message by splicing the identity information of the initial node and the node public key of the target node; providing the message sending message to the corresponding target node according to the communication path.

[0011] In the above-mentioned path dynamic optimization encrypted tunnel communication method, optionally, obtaining the verification feedback result of the target node on the message sending message by using the common public key generated by the Diffie-Hellman algorithm includes: performing signature verification on the message sending message by using the decryption function, the node private key of the target node and the communication nodes participating in multi-party secure communication in the blockchain network using the common public key generated by the Diffie-Hellman algorithm; and obtaining the verification feedback result by verifying the identity information of the initial node through the node public key of the initial node information and the common public key according to the signature verification result.

[0012] The present application also provides an encrypted tunnel communication device with dynamic path optimization, the device comprising: a parsing module, a verification module and an interaction module; the parsing module is used to parse an initial node and a target node according to a data packet to be sent, and obtain a shared communication path calculated by an ant colony algorithm in a blockchain network through the initial node and the target node; the verification module is used to provide a message sending message to a corresponding target node according to the communication path, and obtain a verification feedback result of the message sending message by the target node using a common public key generated by the Diffie-Hellman algorithm; the interaction module is used to establish a secure channel with the target node according to the verification feedback result, and provide the data packet to the target node through the secure channel.

[0013] The present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0014] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method.

[0015] The present application also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0016] The beneficial technical effects of the present application are: proposing an architecture for encrypted tunnel communication with dynamic path optimization, which uses the interface provided by the encrypted tunnel to simulate the ant colony algorithm to solve the "traveling merchant problem", and implements the dynamic path optimization algorithm of the IP data packet based on the encrypted tunnel protocol, thereby improving the routing access efficiency; proposing a path dynamic optimization algorithm, which uses parameters such as pheromones and distance to iteratively optimize the optimal solution for path access, achieves high-concurrency path search and dynamic update, and shortens the time consumption of multi-party secure communication; proposing a method combining encrypted tunnels and path dynamic optimization, which proposes a message structure that effectively combines the interactive mode of sending and responding to messages, realizes signature verification and identity authentication of participating nodes, and improves the security and efficiency of multi-party communication. BRIEF DESCRIPTION OF THE DRAWINGS

[0017] The drawings described herein are used to provide a further understanding of the present application, constitute a part of the present application, and do not constitute a limitation of the present application. In the drawings:

[0018] Figure 1A A schematic diagram of a flow chart of an encrypted tunnel communication method with dynamic path optimization provided in an embodiment of the present application;

[0019] Figure 1B A schematic diagram of the structure of a blockchain network provided in one embodiment of the present application;

[0020] Figure 2A A schematic diagram of a routing table update process provided in an embodiment of the present application;

[0021] Figure 2B A schematic diagram of the structure of a communication node module provided in one embodiment of the present application;

[0022] Figure 2C A schematic diagram of a pheromone concentration update process provided in an embodiment of the present application;

[0023] Figure 3 A schematic diagram of the structure of a consensus node module provided in one embodiment of the present application;

[0024] Figure 4A A schematic diagram of a process for obtaining a common public key provided in an embodiment of the present application;

[0025] Figure 4B A schematic diagram of the process of obtaining signature data provided in an embodiment of the present application;

[0026] Figure 5A schematic diagram of a message sending process for an embodiment of the present application;

[0027] Figure 6 A schematic diagram of a flow chart of signature verification and identity authentication provided in an embodiment of the present application;

[0028] Figure 7 A schematic diagram of an encrypted tunnel communication process for dynamically optimized paths provided in an embodiment of the present application;

[0029] Figure 8 A schematic diagram of the structure of an encrypted tunnel communication device with dynamic path optimization provided in one embodiment of the present application;

[0030] Fig. 9 A schematic diagram of the application logic of an encrypted tunnel communication device with dynamic path optimization provided by an embodiment of the present application;

[0031] Fig.10 A schematic diagram of the structure of an electronic device provided in one embodiment of the present application. DETAILED DESCRIPTION

[0032] The following will describe the implementation methods of the present application in detail in conjunction with the accompanying drawings and embodiments, so that the implementation process of how the present application applies technical means to solve technical problems and achieve technical effects can be fully understood and implemented accordingly. It should be noted that as long as there is no conflict, the various embodiments in the present application and the various features in the embodiments can be combined with each other, and the technical solutions formed are all within the protection scope of the present application.

[0033] In addition, the steps shown in the flowcharts of the accompanying drawings can be executed in a computer system such as a set of computer-executable instructions, and although a logical order is shown in the flowcharts, in some cases, the steps shown or described can be performed in an order different from that shown here.

[0034] Please refer to Figure 1A As shown, the encrypted tunnel communication method with dynamic path optimization provided by the present application specifically includes:

[0035] S101 obtains an initial node and a target node according to parsing of a data packet to be sent, and obtains a shared communication path calculated by an ant colony algorithm in a blockchain network through the initial node and the target node;

[0036] S102 provides the message sending message to the corresponding target node according to the communication path, and obtains the verification feedback result of the message sending message by the target node using the common public key generated by the Diffie-Hellman algorithm;

[0037] S103 establishes a secure channel with the target node according to the verification feedback result, and provides the data packet to the target node through the secure channel.

[0038] In the above embodiment, the overall logic is to solve the time-to-sale problem (TSP), which is defined as follows: Definition 1 TSP problem: Let v = {a,...,z} be a communication node, A = {{r,s}:r,s∈V} be a set of edges, δ(r,s) = δ(s,r) represents the cost measurement of the edge (r,s)∈A, and the TSP problem is expressed as finding the lowest cost path from the source address to the destination address. Definition 2 ATSP problem: If δ(r,s)≠δ(s,r), the TSP problem is transformed into an asymmetric ATSP problem. Specifically, the application scenarios of the above-mentioned path dynamic optimization encrypted tunnel communication method can be referred to. Figure 1B As shown, the purposes of communication node 1, communication node 2, communication node 3, and user client 4 are as follows: Communication node 1: A node participating in multi-party secure communication, which may be located inside or outside the NAT (network address translation node), and is responsible for establishing a secure channel with other nodes on the public network for secure communication. In this example, communication node 1, communication node 2, and communication node 3 are connected to form a multi-party communication network. Communication node 2: A node participating in multi-party secure communication, which may be located inside or outside the NAT (network address translation node), and is responsible for establishing a secure channel with other nodes on the public network for secure communication. Assumption: In this example, communication node 1, communication node 2, and communication node 3 are connected to form a multi-party communication network. Communication node 3: A node participating in multi-party secure communication, which may be located inside or outside the NAT (network address translation node), and is responsible for establishing a secure channel with other nodes on the public network for secure communication. Assumption: In this example, communication node 1, communication node 2, and communication node 3 are connected to form a multi-party communication network. User client 4: responsible for sending and receiving transaction requests from users to access communication nodes, forwarding transaction requests to corresponding multi-party communication nodes, receiving multi-party communication data from multi-party communication nodes, and returning them to users.

[0039] Please refer to Figure 2A As shown, in one embodiment of the present application, the method further comprises:

[0040] S201 sets state transfer rules for all communication processes of communication nodes participating in multi-party secure communication in the blockchain network;

[0041] S202 calculates the pheromone concentration of the communication path between the communication nodes by simulating the ant colony algorithm according to the state transition rule;

[0042] S203 calculates the communication path between the communication nodes according to the pheromone concentration, updates the routing table through the communication path, and uploads the routing table to the blockchain network for sharing.

[0043] In actual work, please refer to Figure 2B As shown, the communication node of the encrypted tunnel communication method with dynamic path optimization may include a communication module 21, a connection module 22, a security calculation module 23, a message processing module 24, and a routing management module 25; the application logic of each node is as follows: communication module 21: as the entrance of the communication node, realizes the sending and receiving of data messages of the recommendation system; connection module 22: responsible for establishing a secure channel for the communication node, managing the secure channel, realizing the connection, suspension and reconnection of communication, etc.; security calculation module 23: responsible for using cryptographic algorithms to encrypt and decrypt the generated data messages; message processing module 24: responsible for executing parsing and splitting of user data, forming data vectors and assembling user data messages. Routing management module 25: responsible for managing the routing of communication messages, saving, deleting and adding routing information, etc. There are two stages in the execution process: initialization and dynamic update of pheromones. The initialization process for phase one is as follows: Step 1: Set the initial node of the datagram to be a and the destination node to be b; Step 2: Set the loop flag loop; Step 2.1: In the loop, each (ant colony: routing selection) process adds a state transition rule to establish a path solution in preparation for iterative local pheromone updates; Step 2.2: Until all ant colonies have completed the establishment of path solutions.

[0044] Please refer to Figure 2C As shown, in the above embodiment, the pheromone concentration of the communication path between the communication nodes calculated by simulating the ant colony algorithm according to the state transition rule includes:

[0045] S2021 pheromone parameters of the communication path between the communication nodes calculated by simulating the ant colony algorithm according to the state transition rule;

[0046] S2022 cyclically updates the pheromone concentration of the communication path between the communication nodes according to the pheromone parameter.

[0047] Specifically, in actual work, dynamically updating the pheromone concentration belongs to the second stage, and the process of this stage is as follows:

[0048] Step 1: The ant colony dynamically updates the pheromones in the path according to the state transition rules in the first phase (initialization), where the state transition rules are defined as follows:

[0049]

[0050] In the above formula, it is assumed that the path selected by k (ant colony) is from source node a to target node b, a and b both represent communication nodes, τ represents pheromone, μ = 1 / δ represents the inverse of the path distance δ(a, b) between a and b, and J k (r) is the set of communication nodes that ant colony k (from a to b) can choose from; β is a parameter that determines the relative importance of pheromone and distance, usually β>0.

[0051] Step 2: Update the pheromone τ according to the path distance μ and the pheromone "concentration". The pheromone update rule is as follows:

[0052]

[0053] in:

[0054]

[0055] In the above formula, 0<α<1 represents the pheromone attenuation factor, L k represents the length of the path traveled by ant colony k, and m represents the number of ant colonies.

[0056] Step 3: Optimal route selection, that is, selecting the best path s according to the "concentration" of pheromones:

[0057]

[0058] Where q is a random number distributed in [0...1], q0 (0≤q0≤1) is a constant parameter, and S is a randomly selected variable that follows the state transition rule (see step 1).

[0059] Please refer to Figure 3 As shown, in one embodiment of the present application, in a blockchain network for executing an encrypted tunnel communication method for dynamic path optimization, the consensus node may include a communication module 31, a ciphertext processing module 32, a transaction processing module 33, and a key storage module 34: Communication module 31: responsible for the communication interaction between the nodes of the blockchain, completing the general blockchain node communication information transmission and reception, including transaction broadcast information, consensus information, block synchronization information, network status information, etc.; Ciphertext processing module 32: responsible for encrypting and decrypting the data message sent and received by the communication module 31; Transaction processing module 33: responsible for generating a transaction unique identifier, a contract unique identifier, and call parameters according to the transaction request provided by the ciphertext processing module 32, assembling them into a transaction message, and calling the smart contract transaction to calculate the result. Key storage module 34: responsible for storing the key generated by the communication node in a trusted space.

[0060] Please refer to Figure 4A As shown, in one embodiment of the present application, the method further comprises:

[0061] S401 generates corresponding node public keys and node private keys respectively through encryption functions according to node information of communication nodes participating in multi-party secure communication in the blockchain network;

[0062] S402 generates a common public key according to the node public key through the Diffie-Hellman algorithm, and stores the common public key in the blockchain network.

[0063] Specifically, in actual work, for all communication nodes i (i∈[1,n]), public and private keys can be set for each node in a loop; the GenKey() function is executed, and for each communication node i (i∈[1,n]), the public key pk(i) and private key sk(i) of the communication node i are generated in a loop, and pk(i) is uploaded to the blockchain for evidence storage; in form:

[0064] (pk(i),sk(i))=genkey(1 k ));

[0065] Afterwards, assuming that communication node i initiates a multi-party communication request, multiple common public keys are generated through the blockchain smart contract. Assuming that the number of communication nodes is k, the loop iteration starts from 1 to k, and the following operations are performed; the Diffie-Hellman algorithm is executed to generate a common public key, PK is set as the common public key, and PK = PK (j) (1 ≤ j ≤ K). The calculation process is iterated step by step as follows:

[0066] PK = DH (PK (i), PK);

[0067] The generated common public key PK is then uploaded to the chain for evidence.

[0068] For further information, please refer to Figure 4B As shown, in the above embodiment, generating corresponding node public keys and node private keys respectively through encryption functions according to the node information of the communication nodes participating in multi-party secure communication in the blockchain network also includes:

[0069] S4011 initializes the node parameters of each communication node through an elliptic curve algorithm according to the node information of the communication nodes participating in multi-party secure communication in the blockchain network;

[0070] S4012 uses the node private key of each communication node to sign the corresponding node parameter stored in the blockchain network to generate signature data;

[0071] S4013 consensus the signature data to the blockchain network.

[0072] Specifically, the initialization parameters of the elliptic curve algorithm X25519 that can be used in actual work, etc., are then stored in the blockchain network; and thereafter, the data shared by the blockchain network can be used to complete relevant verification during secure multi-party communication.

[0073] Please refer to Figure 5 As shown, in one embodiment of the present application, providing a message sending message to a corresponding target node according to the communication path includes:

[0074] S501 generates a message to be sent based on the identity information of the initial node and the node public key of the target node;

[0075] S502 provides a message sending message to a corresponding target node according to the communication path.

[0076] In actual work, the message sent may also be a handshake message, which may include the message type, recipient public key, sender public key, temporary credentials, occurrence timestamp, physical address, static information including the public key, etc. The specific format will be described in detail in subsequent embodiments and will not be described in detail here.

[0077] Please refer to Figure 6 As shown, in one embodiment of the present application, obtaining the verification feedback result of the target node sending the message by using the common public key generated by the Diffie-Hellman algorithm includes:

[0078] S601 performs signature verification on the message sending message by using a decryption function, a node private key of the target node and a common public key generated by a communication node participating in multi-party secure communication in the blockchain network using the Diffie-Hellman algorithm;

[0079] S602 verifies the identity information of the initial node through the node public key of the initial node information and the common public key according to the signature verification result to obtain a verification feedback result.

[0080] After the encrypted tunnel is built on this basis, data interaction can be carried out. In actual work, the verification process can include the following two stages: (1) identifying the third-party node information and performing signature authentication; (2) identifying the common public key information and implementing identity authentication, as follows:

[0081] 1. Signature Verification

[0082] Execute the Verifysign(PK, sk(i)) function to verify the digital signature of PK. If the verification passes, proceed to the next step, otherwise the communication connection is rejected. The function is executed as follows:

[0083] bool = Verifysign(PK, sk(i))

[0084] Where sk(i) represents the private key of node i, PK represents the common public key, bool represents the result of verifying the signature, bool=true represents success, and bool=false represents failure.

[0085] 2. Identity Authentication

[0086] Execute the AuthenKey(PK, PK(i)) function to verify the third-party node identity information of PK. If the identity authentication passes, proceed to the next step, otherwise the communication connection is rejected. The function is executed as follows:

[0087] bool=AuthenKey(PK,pk(j))

[0088] Where PK(j) represents the public key of node j, PK represents the common public key, bool represents the result of verifying the signature, bool=true represents successful identity authentication, and bool=false represents failed identity authentication.

[0089] The handshake information data format is shown in Table 1 below:

[0090] Table 1

[0091]

[0092]

[0093] The IP header indicates the data packet header, Next hop indicates the next hop routing information; type indicates the message type, TYPE = 0X1 indicates sending a message; TYPE = 0x2 indicates receiving a message, etc.; reserved indicates the receiver's public key; sender indicates the sender's public key; ephemeral indicates a temporary credential; timestamp indicates the sending timestamp; mac1 indicates physical address 1; mac2 indicates physical address 2; static indicates static information, including the common public key PK, the header information H in hash form i ,formal:

[0094] H i =Hash(Hash(Construct)||PK(i))

[0095] Among them, Hash represents the hash algorithm SHA-256, Construct represents the content information of the structure, PK(i) represents the public key of the communication node i, and || represents the byte sequence cascade operation symbol.

[0096] After receiving the communication request, the other party will respond with a message to the communication request, and if the communication is successful, it will output the success or failure result. The response message format is shown in Table 2 below:

[0097] Table 2

[0098]

[0099] Among them, type represents the message type, TYPE=0X1 represents sending a message; TYPE=0x2 represents receiving a message, etc.; reserved represents the receiver's public key; sender represents the sender's public key; ephemeral represents temporary credentials; static represents static information, Timestamp represents the sending timestamp; mac1 represents physical address 1; mac2 represents physical address 2.

[0100] In order to more clearly understand the actual application process of the encrypted tunnel communication method for path dynamic optimization provided by this application, please refer to the following Figure 7 As shown, the overall process is as follows:

[0101] S701: Initialize security parameters, such as the initialization parameters of the elliptic curve algorithm X25519 used in this example; execute the GenKey() function, for each communication node i (i∈[1,n]), cyclically generate the public key pk(i) and private key sk(i) of the communication node i, and at the same time, upload pk(i) to the blockchain for evidence storage; formally:

[0102] (pk(i),sk(i))=genkey(1 k ))

[0103] S702: For all communication processes or ant colonies k (k∈[1,n]), cyclically set state transition rules;

[0104] S703: Add an initialization state transition rule for each path search process (ant colony). The state transition rule is defined as follows:

[0105]

[0106] In the above formula, it is assumed that the path selected by k (ant colony) is from source node a to target node b, a and b both represent communication nodes, τ represents pheromone, μ = 1 / δ represents the inverse of the path distance δ(a, b) between a and b, and J k (r) is the set of communication nodes that ant colony k (from a to b) can choose from; β is a parameter that determines the relative importance of pheromone and distance, usually β>0.

[0107] S704: Prepare to add pheromone and other information to each ant colony;

[0108] S705: For all ant colonies k (k∈[1,n]), cyclically update the pheromone parameters.

[0109] S706: The specific method for updating pheromone is: updating pheromone τ according to the path distance μ and the pheromone "concentration". The pheromone update rule is as follows:

[0110]

[0111] in:

[0112]

[0113] In the above formula, 0<α<1 represents the pheromone attenuation factor, L k represents the length of the path traveled by ant colony k, and m represents the number of ant colonies.

[0114] S707: Execute the optimization path selection function to select the optimal path. The operation is as follows: According to the "concentration" of pheromone, select the best path s:

[0115]

[0116] Wherein, q is a random number distributed in [0...1], q0 (0≤q0≤1) is a constant parameter, and S is a randomly selected variable that follows the state transition rule (refer to step 403).

[0117] S708: Collect the optimal combination path nodes and update the routing table;

[0118] S709: Store the latest routing table on the blockchain to enable sharing across the entire network.

[0119] S710: When starting multi-party secure communication, the third party sends a datagram according to the dynamic routing table;

[0120] S711: After receiving the communication request, the other party will provide a message feedback to the communication request, and output a success or failure result if the communication is successful.

[0121] Please refer to Figure 8 As shown, the present application also provides an encrypted tunnel communication device with dynamic path optimization, the device comprising: a parsing module, a verification module and an interaction module; the parsing module is used to parse the data packet to be sent to obtain the initial node and the target node, and obtain a shared communication path calculated by the ant colony algorithm in the blockchain network through the initial node and the target node; the verification module is used to provide the message sending message to the corresponding target node according to the communication path, and obtain the verification feedback result of the message sending message by the target node through the common public key generated by the Diffie-Hellman algorithm; the interaction module is used to establish a secure channel with the target node according to the verification feedback result, and provide the data packet to the target node through the secure channel.

[0122] In actual work, the encrypted tunnel communication device for dynamic path optimization provided by this application mainly applies two stages of processing, which can be specifically referred to in Fig. 9 As shown:

[0123] Phase 1: Initialization phase

[0124] S901: Initialize security parameters, such as the initialization parameters of the elliptic curve algorithm X25519 used in this example, and calculate the public key and private key information of the communication node (initiator). In form:

[0125] (pk(i),sk(i))=genkey(1 k ))

[0126] S902: Upload the security parameters to the blockchain network for information storage;

[0127] S903: The communication node (receiver 1) calls the smart contract, reads the security parameters stored in the blockchain network, and then signs the security parameters with the private key sk(1) of the communication node (receiver 1);

[0128] S904: The communication node (receiver 2) calls the smart contract, reads the security parameters stored in the blockchain network, and then signs the security parameters with the private key sk(2) of the communication node (receiver 2);

[0129] S905: Execute the Diffie-Hellman algorithm to generate a common public key for multiple parties and store it on the blockchain. Let PK be the common public key, initialize PK = PK(j) (1≤j≤K), and the calculation process is iterated step by step as follows:

[0130] PK=DH(PK(i),PK).

[0131] Phase 2: Dynamic Path Optimization

[0132] S1001: The communication node (initiator) starts the communication path optimization process; for all communication processes or ant colonies k (k∈[1,n]), the state transition rules are set cyclically; and the initialization state transition rules are added for each path search process (ant colony). The state transition rules are defined as follows:

[0133]

[0134] In the above formula, it is assumed that the path selected by k (ant colony) is from source node a to target node b, a and b both represent communication nodes, τ represents pheromone, μ = 1 / δ represents the inverse of the path distance δ(a, b) between a and b, and J k (r) is the set of communication nodes that ant colony k (from a to b) can choose; β is a parameter that determines the relative importance of pheromone and distance, usually β>0;

[0135] S1002: For all ant colonies k (k∈[1,n]), cyclically update pheromone parameters. The specific method for updating pheromones is: update pheromone τ according to the path distance μ and pheromone "concentration". The pheromone update rule is as follows:

[0136]

[0137] in:

[0138]

[0139] In the above formula, 0<α<1 represents the pheromone attenuation factor, L k represents the length of the path traveled by ant colony k, and m represents the number of ant colonies.

[0140] S1003: Update the routing table information and store it on the blockchain;

[0141] S1004: Generate a message to be sent, the message information data format is shown in Table 3 below:

[0142] Table 3

[0143]

[0144] The IP header indicates the data packet header, Next hop indicates the next hop routing information; type indicates the message type, TYPE = 0X1 indicates sending a message; TYPE = 0x2 indicates receiving a message, etc.; reserved indicates the receiver's public key; sender indicates the sender's public key; ephemeral indicates a temporary credential; timestamp indicates the sending timestamp; mac1 indicates physical address 1; mac2 indicates physical address 2; static indicates static information, including the common public key PK, the header information H in hash form i ,formal:

[0145] H i =Hash(Hash(Construct)||PK(i))

[0146] Among them, Hash represents the hash algorithm SHA-256, Construct represents the content information of the structure, PK(i) represents the public key of the communication node i, and || represents the byte sequence cascade operation symbol.

[0147] S1005: The receiving node sends a response message, and the response message format is shown in Table 4 below:

[0148] Table 4

[0149]

[0150] The IP header indicates the data packet header, Next hop indicates the next hop routing information; type indicates the message type, TYPE=0X1 indicates sending a message; TYPE=0x2 indicates receiving a message, etc.; reserved indicates the receiver's public key; sender indicates the sender's public key; ephemeral indicates temporary credentials; static indicates static information, Timestamp indicates the sending timestamp; mac1 indicates physical address 1; mac2 indicates physical address 2.

[0151] The beneficial technical effects of the present application are: proposing an architecture for encrypted tunnel communication with dynamic path optimization, which uses the interface provided by the encrypted tunnel to simulate the ant colony algorithm to solve the "traveling merchant problem", and implements the dynamic path optimization algorithm of the IP data packet based on the encrypted tunnel protocol, thereby improving the routing access efficiency; proposing a path dynamic optimization algorithm, which uses parameters such as pheromones and distance to iteratively optimize the optimal solution for path access, achieves high-concurrency path search and dynamic update, and shortens the time consumption of multi-party secure communication; proposing a method combining encrypted tunnels and path dynamic optimization, which proposes a message structure that effectively combines the interactive mode of sending and responding to messages, realizes signature verification and identity authentication of participating nodes, and improves the security and efficiency of multi-party communication.

[0152] The present application also provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the above method when executing the computer program.

[0153] The present application also provides a computer-readable storage medium, wherein the computer-readable storage medium stores a computer program for executing the above method.

[0154] The present application also provides a computer program product, comprising a computer program / instruction, which implements the steps of the above method when executed by a processor.

[0155] like Fig.10 As shown, the electronic device 600 may further include: a communication module 110, an input unit 120, an audio processor 130, a display 160, and a power supply 170. It is worth noting that the electronic device 600 does not necessarily have to include Fig.10 In addition, the electronic device 600 may also include Fig.10 For components not shown, reference may be made to the prior art.

[0156] like Fig.10As shown, the central processor 100 is sometimes also referred to as a controller or an operation control, and may include a microprocessor or other processor devices and / or logic devices. The central processor 100 receives inputs and controls the operations of various components of the electronic device 600.

[0157] The memory 140 may be, for example, one or more of a cache, a flash memory, a hard drive, a removable medium, a volatile memory, a non-volatile memory or other suitable devices. The above-mentioned information related to the failure may be stored, and a program for executing the relevant information may also be stored. The CPU 100 may execute the program stored in the memory 140 to implement information storage or processing.

[0158] The input unit 120 provides input to the CPU 100. The input unit 120 is, for example, a key or a touch input device. The power supply 170 is used to provide power to the electronic device 600. The display 160 is used to display display objects such as images and text. The display may be, for example, an LCD display, but is not limited thereto.

[0159] The memory 140 may be a solid-state memory, such as a read-only memory (ROM), a random access memory (RAM), a SIM card, etc. It may also be a memory that saves information even when the power is off, can be selectively erased, and is provided with more data, examples of which are sometimes referred to as EPROMs, etc. The memory 140 may also be some other type of device. The memory 140 includes a buffer memory 141 (sometimes referred to as a buffer). The memory 140 may include an application / function storage unit 142, which is used to store application programs and function programs or processes for executing the operation of the electronic device 600 through the central processor 100.

[0160] The memory 140 may also include a data storage unit (data 143) for storing data, such as contacts, digital data, pictures, sounds, and / or any other data used by the electronic device. The driver storage unit (driver 144) of the memory 140 may include various drivers for communication functions of the electronic device and / or for executing other functions of the electronic device (such as messaging applications, address book applications, etc.).

[0161] The communication module 110 is a transmitter / receiver 110 that transmits and receives signals via an antenna 111. The communication module (transmitter / receiver) 110 is coupled to the central processor 100 to provide input signals and receive output signals, which may be the same as the case of a conventional mobile communication terminal.

[0162] Based on different communication technologies, multiple communication modules 110 may be provided in the same electronic device, such as a cellular network module, a Bluetooth module and / or a wireless LAN module. The communication module (transmitter / receiver) 110 is also coupled to a speaker 131 and a microphone 132 via an audio processor 130 to provide an audio output via the speaker 131 and receive an audio input from the microphone 132, thereby realizing a common telecommunication function. The audio processor 130 may include any suitable buffer, decoder, amplifier, etc. In addition, the audio processor 130 is also coupled to the central processor 100, so that the sound can be recorded on the local machine through the microphone 132, and the sound stored on the local machine can be played through the speaker 131.

[0163] Those skilled in the art will appreciate that the embodiments of the present application may be provided as methods, systems, or computer program products. Therefore, the present application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment in combination with software and hardware. Moreover, the present application may adopt the form of a computer program product implemented in one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that include computer-usable program code.

[0164] The present application is described with reference to the flowchart and / or block diagram of the method, device (system) and computer program product according to the embodiment of the present application. It should be understood that each process and / or box in the flowchart and / or block diagram, and the combination of the process and / or box in the flowchart and / or block diagram can be realized by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, a special-purpose computer, an embedded processor or other programmable data processing device to produce a machine, so that the instructions executed by the processor of the computer or other programmable data processing device produce a device for realizing the function specified in one process or multiple processes in the flowchart and / or one box or multiple boxes in the block diagram.

[0165] These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, so that the instructions stored in the computer-readable memory produce a manufactured product including an instruction device that implements the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0166] These computer program instructions may also be loaded onto a computer or other programmable data processing device so that a series of operational steps are executed on the computer or other programmable device to produce a computer-implemented process, whereby the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in one or more processes in the flowchart and / or one or more boxes in the block diagram.

[0167] The specific embodiments described above further illustrate the purpose, technical solutions and beneficial effects of the present application. It should be understood that the above description is only a specific embodiment of the present application and is not intended to limit the scope of protection of the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the scope of protection of the present application.

Claims

1. A method for encrypted tunnel communication with dynamic path optimization, characterized in that: The method comprises: Obtaining an initial node and a target node according to parsing of the data packet to be sent, and obtaining a shared communication path calculated by an ant colony algorithm in a blockchain network through the initial node and the target node; Providing the message sending message to the corresponding target node according to the communication path, and obtaining the verification feedback result of the message sending message by the target node using the common public key generated by the Diffie-Hellman algorithm; A secure channel is established with the target node according to the verification feedback result, and the data packet is provided to the target node through the secure channel.

2. The encrypted tunnel communication method with dynamic path optimization according to claim 1, characterized in that: The method further comprises: Generate corresponding node public keys and node private keys through encryption functions according to the node information of the communication nodes participating in multi-party secure communication in the blockchain network; A common public key is generated according to the node public key through the Diffie-Hellman algorithm, and the common public key is stored in the blockchain network.

3. The encrypted tunnel communication method with dynamic path optimization according to claim 2, characterized in that: According to the node information of the communication nodes participating in the multi-party secure communication in the blockchain network, the corresponding node public key and node private key are generated through encryption functions, which also include: Initialize the node parameters of each communication node through the elliptic curve algorithm according to the node information of the communication nodes participating in multi-party secure communication in the blockchain network; Signing the corresponding node parameters stored in the blockchain network using the node private key of each communication node to generate signature data; The signature data is consensus-confirmed to the blockchain network.

4. The encrypted tunnel communication method with dynamic path optimization according to claim 1, characterized in that: The method further comprises: Set state transfer rules for all communication processes of communication nodes participating in multi-party secure communication in the blockchain network; The pheromone concentration of the communication path between the communication nodes is calculated by simulating the ant colony algorithm according to the state transfer rule; The communication path between the communication nodes is calculated according to the pheromone concentration, the routing table is updated through the communication path, and the routing table is uploaded to the blockchain network for sharing.

5. The encrypted tunnel communication method with dynamic path optimization according to claim 4, characterized in that: The pheromone concentration of the communication path between the communication nodes calculated by simulating the ant colony algorithm according to the state transfer rule includes: Pheromone parameters of the communication paths between the communication nodes calculated by simulating the ant colony algorithm according to the state transfer rule; The pheromone concentration of the communication path between the communication nodes is cyclically updated according to the pheromone parameter.

6. The encrypted tunnel communication method with dynamic path optimization according to claim 1, characterized in that: Providing a message sending message to a corresponding target node according to the communication path includes: Generate a message based on the identity information of the initial node and the node public key of the target node; The message sending message is provided to the corresponding target node according to the communication path.

7. The encrypted tunnel communication method with dynamic path optimization according to claim 6, characterized in that: Obtaining the verification feedback result of the target node sending the message by using the common public key generated by the Diffie-Hellman algorithm includes: The message is signed and verified by using a common public key generated by a decryption function, a node private key of a target node, and a communication node participating in multi-party secure communication in a blockchain network using the Diffie-Hellman algorithm; According to the signature verification result, the identity information of the initial node is verified by the node public key of the initial node information and the common public key to obtain a verification feedback result.

8. An encrypted tunnel communication device with dynamic path optimization, characterized in that: The device comprises: an analysis module, a verification module and an interaction module; The parsing module is used to parse the data packet to be sent to obtain the initial node and the target node, and obtain a shared communication path calculated by the ant colony algorithm in the blockchain network through the initial node and the target node; The verification module is used to provide the message sending message to the corresponding target node according to the communication path, and obtain the verification feedback result of the message sending message by the target node using the common public key generated by the Diffie-Hellman algorithm; The interaction module is used to establish a secure channel with the target node according to the verification feedback result, and provide the data packet to the target node through the secure channel.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the method according to any one of claims 1 to 7 is implemented.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program for causing a computer to execute the method according to any one of claims 1 to 7.

Images