Three-layer message transmission method and system

Abstract

The invention provides a three-layer message transmission method and system, and relates to the technical field of communication. The method comprises the following steps: receiving a three-layer message sent by first user equipment; obtaining a quantum key forwarded by the SDN controller, and generating a quantum session key by using a pre-generated original session key and the quantum key; encrypting and packaging the three-layer message by using the quantum session key to obtain a to-be-sent message; and forwarding the to-be-sent message to the target receiver routing device. According to the scheme, the router equipment of the sender encrypts and packages the received three-layer message by using the derived quantum session key to obtain the message to be sent, so that the quantum cracking resistance in the transmission process of the three-layer message is improved; and forwarding the to-be-sent message to the target receiver routing device, thereby realizing end-to-end quantum-level secure transmission of the three-layer message, and solving the problem that an attacker tampers the message or attacks the network device by counterfeiting message information.

Description

Technical Field

[0001] The present invention relates to the field of communication technology, and in particular to a three-layer message transmission method and system. Background Art

[0002] Layer 3 Virtual Private Network (L3VPN) is a technology for building a virtual private network on the Internet. It mainly works at the IP layer (Layer 3) and can provide point-to-point connections across the Wide Area Network (WAN) while maintaining the privacy and security of the network. Among them, L3VPN uses advanced technologies such as VRF (Virtual Routing and Forwarding) instances and BGP (Border Gateway Protocol) to achieve logical isolation and fine routing control of the network, building a solid security barrier for data transmission.

[0003] In the related technology, the encryption technology used by traditional L3VPN is an encryption algorithm based on classical mathematical problems. However, the super computing power of quantum computing can easily crack the encryption algorithm based on classical mathematical problems, which leads to the session key under the traditional IPSec protocol no longer being able to effectively resist quantum-level attacks. Summary of the invention

[0004] The purpose of the present invention is to provide a three-layer message transmission method and system to solve the problems existing in the prior art in view of the above-mentioned deficiencies in the prior art.

[0005] To achieve the above purpose, the technical solution adopted in the embodiment of the present application is as follows:

[0006] In a first aspect, an embodiment of the present application provides a three-layer message transmission method, which is applied to a sending routing device, and the method includes:

[0007] Receiving a layer-3 message sent by a first user device, wherein the layer-3 message includes: an IP address and payload data;

[0008] Obtain the quantum key forwarded by the SDN controller and generate a quantum session key using the pre-generated original session key and the quantum key;

[0009] Using the quantum session key to encrypt and encapsulate the three-layer message to obtain a message to be sent;

[0010] The message to be sent is forwarded to the target recipient routing device.

[0011] Optionally, the using the quantum session key to encrypt and encapsulate the three-layer message to obtain a message to be sent includes:

[0012] Encrypt the three-layer message using the quantum session key to generate an encrypted message;

[0013] The encrypted message is encapsulated to generate the message to be sent.

[0014] Optionally, the using the quantum session key to encrypt the three-layer message to generate an encrypted message includes:

[0015] The IPSec tunnel of the sender's routing device uses the quantum session key to securely encrypt the payload data in the three-layer message, and adds an ESP header to the three-layer message to generate an intermediate message; and encapsulates a new IP header in the outer layer of the intermediate message to generate the encrypted message. The data packet structure of the encrypted message includes: NEW IP, ESP, IP address and payload data, and the NEW IP records the source address and destination address of the IPSec tunnel.

[0016] Optionally, encapsulating the encrypted message to generate the message to be sent includes:

[0017] The SRv6 tunnel of the sending routing device encapsulates the outer layer of the encrypted message with an SRv6 message header to generate an encapsulated message, wherein the data packet structure of the encapsulated message includes: SRv6, NEW IP, ESP, IP address and payload data, and the SRv6 message header includes: destination IPv6 address, source IPv6 address and path nodes pre-arranged by the SDN controller.

[0018] Optionally, the using the quantum session key to encrypt and encapsulate the three-layer message to obtain a message to be sent includes:

[0019] Encapsulating the three-layer message to obtain an encapsulated message;

[0020] The encapsulated message is encrypted using the quantum session key to generate the message to be sent.

[0021] Optionally, encapsulating the layer-3 message to obtain an encapsulated message includes:

[0022] The SRv6 tunnel of the sending routing device encapsulates an SRv6 message header into the outer layer of the three-layer message to generate an encapsulated message. The data packet structure of the encapsulated message includes: SRv6, IP address and payload data, and the SRv6 message header includes: destination IPv6 address and source IPv6 address.

[0023] Optionally, the using the quantum session key to encrypt the encapsulated message to generate the message to be sent includes:

[0024] The IPSec tunnel of the sender's routing device uses the quantum session key to securely encrypt the payload data in the encapsulated message, and adds an ESP header to the encapsulated message to generate the message to be sent, wherein the data packet structure of the message to be sent includes: SRv6, ESP, IP address and payload data.

[0025] Optionally, forwarding the message to be sent to a target recipient routing device includes:

[0026] Determine, according to the SRv6 message header encapsulated in the outer layer of the message to be sent, a target forwarding path between a target receiver routing device and a wide area network;

[0027] According to the target forwarding path, the message to be sent is forwarded to the target recipient routing device.

[0028] In a third aspect, an embodiment of the present application further provides a three-layer message transmission method, which is applied to a receiving routing device, and the method includes:

[0029] Receive the message to be sent forwarded by the sender's routing device;

[0030] Obtain the quantum key forwarded by the SDN controller, and use the same key generation method as the sending routing device to process the original session key and the quantum key that are the same as the sending routing device to generate a quantum session key;

[0031] Decrypting and decapsulating the message to be sent using the quantum session key to obtain a three-layer message;

[0032] The layer-3 message is forwarded to the second user equipment.

[0033] Optionally, the using the quantum session key to decrypt and decapsulate the message to be sent to obtain a three-layer message includes:

[0034] Decapsulating the message to be sent to generate an encrypted message;

[0035] The encrypted message is decrypted using the quantum session key to generate the three-layer message.

[0036] Optionally, the decapsulating the message to be sent to generate an encrypted message includes:

[0037] The SRv6 tunnel of the receiving routing device decapsulates the SRv6 message header of the outer layer of the message to be sent to generate the encrypted message.

[0038] Optionally, the decrypting the encrypted message using the quantum session key to generate the three-layer message includes:

[0039] The IPSec tunnel of the receiver's routing device uses the quantum session key to decrypt the encrypted message, remove the ESP header in the encrypted message, and generate the three-layer message.

[0040] Optionally, the using the quantum session key to decrypt and decapsulate the message to be sent to obtain a three-layer message includes:

[0041] Decrypting the message to be sent using the quantum session key to obtain a decrypted message;

[0042] The decrypted message is decapsulated to obtain the three-layer message.

[0043] Optionally, the using the quantum session key to decrypt the message to be sent to obtain a decrypted message includes:

[0044] The IPSec tunnel of the receiver's routing device uses the quantum session key to decrypt the message to be sent, and removes the ESP header in the encrypted message to generate the decrypted message;

[0045] The decrypted message is decapsulated to obtain the three-layer message, including:

[0046] The SRv6 tunnel of the receiving routing device decapsulates the SRv6 message header of the outer layer of the decrypted message to generate the three-layer message.

[0047] In a third aspect, an embodiment of the present application further provides a three-layer message transmission system, the system comprising: a first user device, a sender routing device, a receiver routing device, a second user device, an SDN controller and a quantum cryptography service platform;

[0048] The sending party routing device is connected to the receiving party routing device via a wide area network communication;

[0049] The SDN controller is respectively connected to the sender routing device, the receiver routing device, and the quantum key platform for obtaining a quantum key from the quantum cryptography service platform and distributing the obtained quantum key to the sender routing device and the receiver routing device;

[0050] The sending party routing device is used to execute the method provided in the first aspect;

[0051] The receiving routing device is used to execute the method provided in the second aspect.

[0052] The beneficial effects of this application are:

[0053] The embodiment of the present application provides a three-layer message transmission method and system. In this solution, the sending party routing device obtains the quantum key forwarded by the SDN controller, and uses the pre-generated original session key and the quantum key to generate a quantum session key, and then uses the quantum session key to encrypt and encapsulate the received three-layer message to obtain the message to be sent, and forwards the message to be sent to the target receiving party routing device, thereby improving the anti-quantum cracking capability during the three-layer message transmission process; then, the target receiving party routing device uses the same quantum session key as the sending party routing device to decrypt and decapsulate the received message to generate a three-layer message, thereby realizing quantum-level secure transmission of the three-layer message from end to end, and solving the problem of attackers tampering with messages or attacking network devices by forging message information. BRIEF DESCRIPTION OF THE DRAWINGS

[0054] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the drawings required for use in the embodiments are briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present invention and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without creative work.

[0055] Figure 1 A schematic diagram of the architecture of a three-layer message transmission system provided in an embodiment of the present application;

[0056] Figure 2 A schematic diagram of a process flow of a three-layer message transmission method provided in an embodiment of the present application;

[0057] Figure 3 A flowchart of another three-layer message transmission method provided in an embodiment of the present application;

[0058] Figure 4 A flowchart of another layer 3 message transmission method provided in an embodiment of the present application;

[0059] Figure 5 A flowchart of another three-layer message transmission method provided in an embodiment of the present application;

[0060] Figure 6 A flowchart of another layer 3 message transmission method provided in an embodiment of the present application;

[0061] Figure 7 A flowchart of another three-layer message transmission method provided in an embodiment of the present application;

[0062] Figure 8 The process of three-layer message encapsulation and decapsulation provided for this application Figure 1 ;

[0063] Fig. 9 The process of three-layer message encapsulation and decapsulation provided for this application Figure 2 .

[0064] Icons: 1-first user device; 2-sender routing device; 3-receiver routing device; 4-second user device; 5-SDN controller; 6-quantum cryptography service platform. DETAILED DESCRIPTION

[0065] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0066] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0067] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0068] First, the professional terms involved in this application are introduced.

[0069] 1. Internet Protocol Security (IPSec): It protects the network transmission protocol cluster (a collection of interrelated protocols) of the IP protocol by encrypting and authenticating IP protocol packets.

[0070] 2. Encapsulating Security Payload (ESP): It is a key component of the IPsec (Internet Protocol Security) protocol, mainly used to protect the confidentiality and integrity of IP data packets.

[0071] 3. Layer 3 Virtual Private Network (L3VPN): It is a technology for building a virtual private network on the Internet. It mainly works at the IP layer (the third layer) and can provide point-to-point connections across the wide area network (WAN) while maintaining the privacy and security of the network.

[0072] 4. Segment Routing over IPv6 (SRv6): It introduces the concept of source routing into the IPv6 protocol. In SRv6, the router sends the data packet directly to the destination address based on the source routing information in the message.

[0073] 5. Segment Routing Header (SRH): It is a new routing mechanism in IPv6 protocol. In traditional IP routing, data packets are forwarded according to their destination IP address, while in SegmentRouting, data packets carry an SRH, which contains a series of intermediate nodes (called segments), and data packets will pass through these nodes in sequence according to this list.

[0074] Secondly, the prior art involved in this application is introduced.

[0075] L3VPN, or Layer 3 Virtual Private Network, is an advanced network service built on top of the Internet infrastructure, designed to seamlessly connect geographically dispersed enterprise networks, allowing them to communicate efficiently and securely as if they were in the same LAN. With the accelerated pace of globalization, the demand for cross-regional expansion of enterprises is growing, and traditional WAN connection methods are inadequate due to high costs and complex management. L3VPN came into being, and with its cost-effectiveness, it has become an ideal solution to this problem.

[0076] In an open Internet environment, data security has become a core issue that enterprises cannot ignore. L3VPN uses advanced technologies such as VRF (Virtual Routing and Forwarding) instances and BGP (Border Gateway Protocol) to achieve logical isolation and fine routing control of the network, building a solid security barrier for data transmission.

[0077] Although L3VPN itself has powerful network isolation and data encapsulation capabilities, in the current environment of increasingly complex network security threats, especially when transmitting sensitive data on public networks, additional encryption and authentication measures are particularly important to ensure the absolute security of corporate data during transmission. The combination of L3VPN and encryption technology has built an efficient and secure network environment for enterprises, meeting the full range of enterprise network connection needs in the era of globalization. Therefore, the combination of L3VPN (three-layer virtual private network) and IPSec (Internet Protocol Security) is an effective way to enhance network security and protect data transmission from unauthorized access and monitoring.

[0078] However, traditional L3VPN still has the following problems:

[0079] 1. The super computing power of quantum computing can easily crack encryption algorithms based on classical mathematical problems. The session keys under the traditional IPSec protocol can no longer effectively resist quantum-level attacks.

[0080] 2. Although L3VPN based on MPLS network provides powerful routing and traffic engineering capabilities, it also brings complexity and additional overhead, increasing the difficulty of operation and maintenance.

[0081] Therefore, the three-layer message transmission method provided by the current three-layer virtual private network has the problem of resisting quantum-level attacks, making it difficult to ensure the security of the three-layer message transmission.

[0082] The embodiments of the present application are based on the above-mentioned problems. The present application provides a three-layer message transmission method, which is based on the IPSec protocol that incorporates quantum keys combined with SRv6 to encrypt and transmit the three-layer messages, thereby improving the three-layer message's ability to resist quantum attacks during transmission and improving the security of the three-layer message transmission.

[0083] Before elaborating on the technical solution provided by the present application, a brief description is first given of the application scenario of the three-layer message transmission involved in the present application.

[0084] refer to Figure 1 As shown, it is a schematic diagram of the architecture of the three-layer message transmission system provided in the embodiment of the present application; Figure 1 As shown, the three-layer message transmission system 100 includes: a first user device 1, a sender routing device 2, a receiver routing device 3, a second user device 4, an SDN controller 5 and a quantum cryptography service platform 6.

[0085] Exemplarily, for example, the first user device 1 and the second user device 4 may be data forwarding devices such as switches or routers; the sender routing device 2 and the receiver routing device 3 may be routers for implementing data packet forwarding between different networks.

[0086] The first user device 1 is directly connected to the sending routing device 2, the sending routing device 2 is connected to the receiving routing device 3 via a wide area network, and the receiving routing device 3 is directly connected to the second user device 4.

[0087] The sender routing device 2 and the receiver routing device 3 can also be called quantum security U devices, both located at the edge of the network, and are the endpoints of the quantum encryption tunnel. Through L3VPN over IPSec over SRv6 technology, the quantum security U device can establish a quantum encryption tunnel, encrypt the three-layer message, and achieve end-to-end quantum-level secure transmission.

[0088] The SDN controller 5 is mainly used to uniformly manage the sender routing device 2 and the receiver routing device 3, and also acts as an agent for the application and distribution of quantum keys to ensure that the keys are safely and accurately transmitted to the sender routing device 2 and the receiver routing device 3, while optimizing the scheduling and utilization of network resources.

[0089] The quantum cryptography service platform 6 is the core module in the three-layer message transmission system. It is responsible for the generation, management and distribution of quantum keys, ensuring that every communication is based on anti-cracking quantum keys and providing a high level of security.

[0090] Therefore, continue to refer to Figure 1As shown, in the three-layer message transmission system provided by the present application, the SDN controller agent forwards the application and distribution of the quantum key by the sender routing device 2 and the receiver routing device 3, so that when the sender routing device 2 and the receiver routing device 3 establish an IPSec tunnel, they can merge the original session key with the quantum key to derive a quantum-integrated session key, and use the quantum session key to perform IPSec encryption protection on the three-layer message, thereby improving the quantum resistance of the three-layer message; at the same time, the SDN controller can calculate the optimal or specific required path according to the network topology, traffic demand and policy requirements; then, the SDN controller converts these paths into SRv6 segment lists (Segment List), each segment represents a node or interface in the network, and the segment list is encoded as part of the IPv6 target address to guide the data packet to be forwarded along the specified path, avoid overloaded links, or achieve load balancing in a multi-path environment.

[0091] Optionally, in this solution, the SDN controller continuously monitors the network status, collects statistics and event reports from network devices, and based on this information, the SDN controller can adjust the SRv6 policy in real time to ensure network performance and service quality. For example, the SDN controller can use network status information to optimize path selection, avoid overloaded links, or achieve load balancing in a multi-path environment.

[0092] Optionally, a secure and efficient quantum encryption communication network can be constructed through the three-layer message transmission system provided by this application.

[0093] Understandably, Figure 1 The structure described above is for illustration only. The three-layer message transmission system may also include Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown. Figure 1 Each component shown in the figure can be implemented by hardware, software or a combination thereof.

[0094] The implementation principles and corresponding beneficial effects of the three-layer message transmission method steps provided in this application will be explained through multiple specific embodiments as follows.

[0095] In one embodiment, reference Figure 2 As shown, a three-layer message transmission method is provided. Optionally, the execution subject of the method can be Figure 1 The sending routing device and the receiving routing device in the three-layer message transmission method shown in .

[0096] It should be understood that in other embodiments, the order of some steps in the three-layer message transmission method can be interchanged according to actual needs, or some steps can be omitted or deleted. Figure 2As shown, the method includes:

[0097] S201: A sending routing device receives a layer-3 message sent by a first user equipment.

[0098] The layer 3 message includes: IP address and payload data Payload. The IP address includes the source IP address and the destination IP address.

[0099] Optionally, after the first user device CE1 receives the layer 3 message, the first user device CE1 sends the layer 3 message to the sending routing device U1, and the sending routing device U1 receives the layer 3 message, namely, the MAC address and the payload data Payload, from the L3VPN instance port of the first user device CE1. The L3VPN instance port refers to an interface used to distinguish different virtual private networks (VRF, Virtual Routing and Forwarding) in L3VPN, and each VRF instance represents an independent routing table and forwarding table, which is used to isolate the traffic of different customers or services.

[0100] S202. The sending routing device obtains the quantum key forwarded by the SDN controller, and uses the pre-generated original session key and the quantum key to generate a quantum session key.

[0101] Therefore, in this solution, in order to provide the security of three-layer message transmission, it is proposed to introduce quantum keys, that is, the sender routing device U1 sends a request to obtain a quantum key to the SDN controller, and the SDN controller forwards the quantum key request to the quantum cryptography service platform, and receives the first quantum key returned by the quantum cryptography service platform, and forwards the first quantum key to the sender routing device U1; then, the sender routing device U1 fuses the pre-generated original session key with the first quantum key to generate a fused quantum session key, which has the advantage of resisting attacks and cracking by quantum computing.

[0102] S203. The sending routing device uses the quantum session key to encrypt and encapsulate the three-layer message to obtain a message to be sent.

[0103] Optionally, in this solution, the three-layer message is forwarded, and the three-layer message contains an IP address. Therefore, the three-layer message can be encrypted using the quantum session key to generate an encrypted message, and then the encrypted message can be encapsulated to generate an encapsulated message, that is, a message to be sent; or, the three-layer message can be encapsulated to generate an encapsulated message, and then the encapsulated message can be encrypted using the quantum session key to generate an encrypted message, that is, a message to be sent. Therefore, encryption can be performed first and then encapsulation, or encapsulation can be performed first and then encryption.

[0104] S204: The sending routing device forwards the message to be sent to the target receiving routing device.

[0105] In this example, during the encapsulation process, the path SID arranged by the SDN controller can be inserted into the message to be sent; the sending routing device can select the best path according to the path SID and forward the message to be sent to the target receiving routing device.

[0106] Therefore, the use of quantum session keys enables the sending and receiving routing devices to establish a quantum encryption tunnel, encrypt three-layer messages, and achieve end-to-end quantum-level secure transmission.

[0107] S205. The receiving routing device obtains the quantum key forwarded by the SDN controller, and uses the same key generation method as the sending routing device to process the original session key and the quantum key that are the same as those of the sending routing device to generate a quantum session key.

[0108] In this example, the SDN controller forwards the first quantum key to the sender's routing device and sends the identifier of the first quantum key to the receiver's routing device. The receiver's routing device sends the identifier of the first quantum key to the SDN controller during decryption. The SDN controller obtains the first quantum key from the quantum cryptography service platform based on the identifier of the first quantum key and forwards the obtained first quantum key to the receiver's routing device. Then, the receiver's routing device fuses the original session key that is the same as the sender's routing device with the first quantum key to derive a quantum enhanced session key, namely, a quantum session key. Therefore, compared with the original session key, the quantum session key derived from the quantum key has a stronger ability to resist quantum cracking, providing a high level of security for the encryption of subsequent three-layer messages.

[0109] S206. The receiving routing device uses the quantum session key to decrypt and decapsulate the message to be sent to obtain a layer-3 message, and forwards the layer-3 message to the second user device.

[0110] In one feasible manner, for example, if the sending routing device U1 first encrypts and then encapsulates the three-layer message, the receiving routing device U2 needs to use the quantum session key to first decapsulate and then decrypt the received message to be sent to generate a three-layer message.

[0111] Alternatively, if the sending routing device U1 first encapsulates and then encrypts the three-layer message, the receiving routing device U2 needs to use the quantum session key to first decrypt and then decapsulate the received message to be sent to generate a three-layer message; then, the receiving routing device U2 forwards the three-layer message to the second user device CE2 according to the pre-stored routing table, thereby achieving secure transmission of the three-layer message. During the transmission process, the three-layer message has the ability to resist quantum cracking, which solves the problem of attackers tampering with messages or attacking network devices by forging message information.

[0112] In summary, the embodiment of the present application provides a three-layer message transmission method. In this scheme, the sending party routing device obtains the quantum key forwarded by the SDN controller, and uses the pre-generated original session key and the quantum key to generate a quantum session key, and then uses the quantum session key to encrypt and encapsulate the received three-layer message to obtain the message to be sent, and forwards the message to be sent to the target receiving party routing device, thereby improving the ability to resist quantum cracking during the three-layer message transmission process; then, the target receiving party routing device uses the same quantum session key as the sending party routing device to decrypt and decapsulate the received message to generate a three-layer message, thereby realizing quantum-level secure transmission of the three-layer message from end to end, and the three-layer message has the ability to resist quantum cracking during the transmission process, thereby solving the problem of attackers tampering with messages or attacking network devices by forging message information.

[0113] The following embodiments will be used to explain in detail how the sending routing device encrypts and encapsulates the three-layer message.

[0114] The first method is to encrypt first and then encapsulate

[0115] Optionally, refer to Figure 3 As shown, the above step S203 includes:

[0116] S301. Encrypt the three-layer message using the quantum session key to generate an encrypted message.

[0117] S302: Encapsulate the encrypted message to generate a message to be sent.

[0118] In one feasible way, the three-layer message can be encrypted first and then encapsulated. Specifically, the three-layer message can be encrypted using a quantum session key to obtain an encrypted message, thereby improving the anti-quantum cracking capability of the encrypted message; then, the outer layer of the encrypted message is encapsulated with a message header, that is, the header information of the transport layer can be added to the outer layer of the three-layer message to generate a message to be sent. The header information of the transport layer includes: source address, destination address, etc.

[0119] Among them, in this scheme, since IPsec has been widely used in the field of network security, the combination of quantum keys and IPsec can make full use of the existing network infrastructure, that is, using quantum keys as encryption keys in the IPsec protocol can protect the confidentiality and integrity of data packets and realize the rapid deployment of quantum security.

[0120] Optionally, the above step S301 includes:

[0121] The IPSec tunnel of the sender's routing device uses the quantum session key to securely encrypt the payload data in the three-layer message, and adds an ESP header to the three-layer message to generate an intermediate message; and encapsulates a new IP header in the outer layer of the intermediate message to generate an encrypted message. The data packet structure of the encrypted message includes: NEW IP, ESP, IP address and payload data. NEW IP records the source address and destination address of the IPSec tunnel.

[0122] Among them, IPSec has two main working modes: transport mode and tunnel mode.

[0123] In this embodiment, in the tunnel mode of the IPSec tunnel, the IPSec tunnel of the routing device of the sender uses the quantum session key to encrypt and protect the payload data Payload in the three-layer message to obtain encrypted data, that is, the encrypted three-layer message; and uses the ESP protocol to encapsulate the ESP header in the outer layer of the encrypted data to generate an intermediate message, and the ESP header contains: the source IP address and the destination IP address of the IPSec tunnel; at the same time, because the original IP message is wrapped in the ESP header after the ESP header is added, it is necessary to encapsulate a new IP header in the outer layer of the intermediate message to generate an encrypted message. That is, the original three-layer message is encapsulated in a new IP data packet to achieve encryption protection of the three-layer message.

[0124] Optionally, the above step S302 includes:

[0125] The SRv6 tunnel of the sending routing device encapsulates the outer layer of the encrypted message with an SRv6 message header to generate an encapsulated message, wherein the data packet structure of the encapsulated message includes: SRv6, NEW IP, ESP, IP address and payload data, and the SRv6 message header includes: destination IPv6 address, source IPv6 address and path nodes pre-arranged by the SDN controller.

[0126] Optionally, the SRv6 tunnel of the sending routing device U1 encapsulates the outer layer of the encrypted message with an SRv6 message header to generate an encapsulated message. The SRv6 message header includes: a destination IPv6 address and a source IPv6 address, the destination IPv6 address is the address of the target receiving device U2, and the source IPv6 address is the source address of the configured SRv6 encapsulated IPv6 message header; at the same time, the path SID arranged by the SDN controller is inserted into the SRv6 message header. Therefore, it is determined that the data packet structure of the generated encapsulated message from the outside to the inside includes: SRv6, NEW IP, ESP, IP address and payload data.

[0127] The second method is to encapsulate first and then encrypt

[0128] Optionally, refer to Figure 4 As shown, the above step S203 includes:

[0129] S401. Encapsulate the layer-3 message to obtain an encapsulated message.

[0130] S402. Use the quantum session key to encrypt the encapsulated message to generate a message to be sent.

[0131] In another feasible way, the three-layer message can be encapsulated first and then encrypted. Specifically, the outer layer of the three-layer message can be encapsulated with a message header to obtain an encapsulated message, that is, the header information of the transport layer can be added to the outer layer of the three-layer message, wherein the header information of the transport layer includes: source address, destination address, etc.; then, the quantum session key is used to encrypt the payload data in the encapsulated message to generate an encrypted message, that is, a message to be sent, thereby improving the anti-quantum cracking capability of the encrypted message.

[0132] Optionally, the above step S401 includes:

[0133] The SRv6 tunnel of the sending routing device encapsulates the SRv6 message header into the outer layer of the three-layer message to generate an encapsulated message. The data packet structure of the encapsulated message includes: SRv6, IP address and payload data. The SRv6 message header includes: destination IPv6 address and source IPv6 address.

[0134] In this embodiment, the SRv6 tunnel of the sending routing device U1 can encapsulate the outer layer of the three-layer message with an SRv6 message header, wherein the SRv6 message header includes: a destination IPv6 address and a source IPv6 address, wherein the destination IPv6 address is the End.DX2 SID, and the source IPv6 address is the source address of the configured L3VPN over SRv6 encapsulation IPv6 message header. Therefore, the data packet structure of the encapsulated message includes: SRv6, IP address, and payload data.

[0135] Optionally, the above step S402 includes:

[0136] The IPSec tunnel of the sender's routing device uses the quantum session key to securely encrypt the payload data in the encapsulated message, and adds an ESP header to the encapsulated message to generate a message to be sent. The data packet structure of the message to be sent includes: SRv6, ESP, IP address and payload data.

[0137] In this embodiment, in the transmission mode of the IPSec tunnel, the IPSec tunnel of the sender's routing device uses the quantum session key to encrypt and protect the payload data Payload in the encapsulated message, and inserts the ESP header between the SRv6 header and the encrypted three-layer message based on the ESP protocol. The ESP header contains: the source IP address and the destination IP address of the IPSec tunnel, that is, the IPSec tunnel operates on the encapsulated message in the transmission mode.

[0138] Optionally, refer to Figure 5 As shown, the above step S204 includes:

[0139] S501. Determine a target forwarding path between a target receiver routing device and a wide area network according to an SRv6 message header encapsulated in an outer layer of a message to be sent.

[0140] S502: forward the message to be sent to the target receiver routing device according to the target forwarding path.

[0141] In this embodiment, the sending routing device U1 determines the target receiving routing device according to the destination IPv6 address contained in the SRv6 header encapsulated in the outer layer of the message to be sent; at the same time, according to the path node SID inserted in the SRv6 header of the message to be sent, the optimal forwarding path in the wide area network is determined, and the message to be sent is forwarded to the target receiving routing device via the optimal forwarding path in the wide area network, so as to transmit the three-layer message to the target receiving routing device. If there is an intermediate node P in the wide area network that does not support SRv6, the node performs service transparent transmission.

[0142] The following embodiments will explain in detail how the receiving routing device performs decryption and decapsulation on the received message.

[0143] The first method is to decapsulate first and then decrypt

[0144] Optionally, refer to Figure 6 As shown, the above step S206 includes:

[0145] S601. Decapsulate the message to be sent to generate an encrypted message.

[0146] S602. Decrypt the encrypted message using the quantum session key to generate a three-layer message.

[0147] In one feasible method, for example, the sending routing device U1 first encrypts and then encapsulates the three-layer message to generate a message to be sent; after the receiving routing device U2 receives the message to be sent, it is necessary to decapsulate the message to be sent to generate an encrypted message, and then use the derived quantum session key to decrypt the encrypted message to generate a three-layer message, thereby realizing the decapsulation and decryption processing of the message to be sent.

[0148] Optionally, the above step S601 includes:

[0149] The SRv6 tunnel of the receiving routing device decapsulates the SRv6 message header of the outer layer of the message to be sent to generate an encrypted message.

[0150] In this embodiment, the SRv6 tunnel of the receiving routing device strips off the SRv6 message header encapsulated in the outer layer of the message to be sent (ie, the SRv6 message) and restores it to an encrypted message.

[0151] Optionally, the above step S602 includes:

[0152] The IPSec tunnel of the receiver's routing device uses the quantum session key to decrypt the encrypted message and remove the ESP header in the encrypted message to generate a three-layer message.

[0153] In this embodiment, the IPSec tunnel on the receiving routing device U2 uses the quantum session key to decrypt the encrypted message, and removes the ESP header encapsulated in the outer layer of the decrypted data to obtain a three-layer message, that is, the original IP message.

[0154] The second method is to decrypt first and then decapsulate

[0155] Optionally, refer to Figure 7 As shown, the above step S206 includes:

[0156] S701. Decrypt the message to be sent using the quantum session key to obtain a decrypted message.

[0157] S702: Decapsulate the decrypted message to obtain a layer-3 message.

[0158] In another feasible method, for example, the sending routing device U1 first encapsulates and then encrypts the three-layer message to generate a message to be sent; after the receiving routing device U2 receives the message to be sent, it needs to use the derived quantum session key to decrypt the message to be sent to generate a decrypted message, and then decapsulate the decrypted message to obtain the original three-layer message, thereby realizing the decryption and decapsulation processing of the message to be sent.

[0159] Optionally, the above step S701 includes:

[0160] The IPSec tunnel of the receiving party's routing device uses the quantum session key to decrypt the message to be sent, removes the ESP header in the message to be sent, and generates a decrypted message.

[0161] The above step S702 includes:

[0162] The SRv6 tunnel of the receiving routing device decapsulates and decrypts the SRv6 header of the outer layer of the message to generate a Layer 3 message.

[0163] In this embodiment, for example, in the transmission mode of the IPSec tunnel, the IPSec tunnel of the receiving routing device U2 uses the quantum session key to decrypt the message to be sent, and removes the ESP header in the message to be sent to generate a decrypted message; then, the receiving routing device U2 searches the local node Local SID table according to the pre-stored transmission path information End.DX2 SID to obtain the SRv6 message, and then the SRv6 tunnel decapsulates the SRv6 message of the outer layer of the encapsulated three-layer message to generate a three-layer message, that is, the original IP message.

[0164] In the first case, encrypt first and then encapsulate → decapsulate first and then decrypt.

[0165] Optionally, refer to Figure 8 The following is the process of encapsulation and decapsulation of the three-layer message provided by this application. Figure 1 , the method comprising:

[0166] Step 1: User data is sent to the first user equipment CE1, and the first user equipment CE1 sends the layer 3 message to the sending routing device U1;

[0167] Step 2: The sending routing device U11 receives the Layer 3 message from the L3VPN instance port of the first user device CE1. The IPSec tunnel of the sending routing device U1 uses the quantum session key to encrypt and protect the Layer 3 message. The original message is encapsulated in a new IP data packet (i.e., NEW IP), which is encrypted and protected by ESP. The source and destination addresses of the IPSec tunnel are encapsulated outside the ESP header to generate an encrypted message.

[0168] The third part is to use the SRv6 tunnel of the sending routing device U1 to encapsulate the outer layer of the encrypted message with an SRv6 message header, where the SRv6 message header includes: the destination IPv6 address, the source IPv6 address, and insert the path SID arranged by the SDN controller into the SRv6 header to generate an encapsulated message.

[0169] The destination IPv6 address is the address of U2, the source IPv6 address is the source address of the configured SRv6 encapsulated IPv6 packet header, and the path SID arranged by the SDN controller is inserted into the SRv6 header;

[0170] Step 4: The sending routing device U1 sends the message to be sent to the receiving routing device U2. The sending routing device U1 forwards the message to be sent to the receiving routing device U2 according to the SID in the SRH in the message to be sent.

[0171] Optionally, if there is an intermediate node P in the generalized network that does not support SRv6, the node performs service transparent transmission.

[0172] Step 5: After receiving the message to be sent, the receiving routing device U2 removes the outer SRv6 header of the message to be sent and restores it to an encrypted message;

[0173] Step 6: The IPSec tunnel on the receiving routing device U2 uses the same quantum session key as the sending routing device U1 to decrypt the encrypted message and generate a layer 3 message, i.e., the original IP message.

[0174] Step 7: The receiving routing device U2 forwards the layer-3 message to the second user equipment CE2 according to the pre-stored routing table.

[0175] In this embodiment, if Figure 8 As shown, the first user equipment CE1 sends an IP message to the sending routing device U1. After the IPSec tunnel on the sending routing device U1 encrypts and encapsulates the IP message, the original IP message is wrapped in the ESP header and a new IP header is encapsulated. Then the sending routing device U1 encapsulates the encrypted message in the SRv6 header and encapsulates the SRH according to the calculation of the SDN controller. Then the SRv6 message is forwarded in the wide area network according to the SRH. After receiving the SRv6 message, the receiving routing device U2 first decapsulates the SRv6 header, and then removes the IPSec encryption encapsulation, obtains the original IP message and forwards it to the second user equipment CE2, thereby realizing high-security transmission of three-layer messages.

[0176] The second case is to encapsulate first and then encrypt → decrypt first and then decapsulate.

[0177] Optionally, refer to Fig. 9 The following is the process of encapsulation and decapsulation of the three-layer message provided by this application. Figure 2 , the method comprising:

[0178] Step 1: The first user equipment CE1 sends the layer 3 message to the sending routing device U1;

[0179] Step 2: After receiving the Layer 3 message from the AC1 port of the first user equipment CE1, the sending routing device U1 searches for the SRv6 tunnel associated with the AC1 port and determines the transmission path information End.DX2 SID corresponding to the SRv6 tunnel.

[0180] Step 3: The SRv6 tunnel of the sending routing device U1 encapsulates the outer layer of the three-layer message with an SRv6 message header to generate an encapsulated message;

[0181] Step 4: The IPSec tunnel (transmission mode) on the sender routing device U1 uses the quantum session key to encrypt the payload data in the encapsulated message, and inserts the ESP header between the SRv6 message header and the original three-layer message to generate an encrypted message;

[0182] Step 5: The sending routing device U1 searches the IPv6 routing table according to the pre-stored transmission path information End.DX2SID, and forwards the encrypted message to the target receiving routing device U2 through the SRv6 BE or TE message forwarding method;

[0183] Step 6: The IPSec tunnel (transmission mode) on the target receiving router U2 uses the same quantum session key as the sending router to decrypt the encrypted message and remove the ESP header in the encrypted message to generate an encapsulated message.

[0184] Step 7: The target receiving routing device U2 searches the local node Local SID table according to the pre-stored transmission path information End.DX2 SID, determines the SRv6 message header to be removed, and decapsulates the SRv6 message header of the outer layer of the encapsulated Layer 2 message through the SRv6 tunnel of the receiving routing device to generate a Layer 2 message, matches the AC2 associated with it according to the transmission path information End.DX2 SID, and forwards the Layer 2 message to the second user equipment CE2 through the AC2.

[0185] Optionally, the present invention also provides a program product, such as a computer-readable storage medium, comprising a program, which is used to execute the above method embodiment when executed by a processor.

[0186] In the several embodiments provided by the present invention, it should be understood that the disclosed devices and methods can be implemented in other ways. For example, the device embodiments described above are only schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation, such as multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of devices or units, which can be electrical, mechanical or other forms.

[0187] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0188] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of hardware plus software functional units.

[0189] The above-mentioned integrated unit implemented in the form of a software functional unit can be stored in a computer-readable storage medium. The above-mentioned software functional unit is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) or a processor (English: processor) to perform some steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (English: Read-Only Memory, abbreviated: ROM), random access memory (English: Random Access Memory, abbreviated: RAM), disk or optical disk and other media that can store program codes.

Claims

1. A three-layer message transmission method, characterized in that: Applied to a routing device of a sender, the method comprises: Receiving a layer-3 message sent by a first user device, wherein the layer-3 message includes: an IP address and payload data; Obtain the quantum key forwarded by the SDN controller and generate a quantum session key using the pre-generated original session key and the quantum key; Using the quantum session key to encrypt and encapsulate the three-layer message to obtain a message to be sent; The message to be sent is forwarded to the target recipient routing device.

2. The method according to claim 1, characterized in that: The step of encrypting and encapsulating the three-layer message using the quantum session key to obtain a message to be sent includes: Encrypt the three-layer message using the quantum session key to generate an encrypted message; The encrypted message is encapsulated to generate the message to be sent.

3. The method according to claim 2, characterized in that The step of encrypting the three-layer message using the quantum session key to generate an encrypted message includes: The IPSec tunnel of the sender's routing device uses the quantum session key to securely encrypt the payload data in the three-layer message, and adds an ESP header to the three-layer message to generate an intermediate message; and encapsulates a new IP header in the outer layer of the intermediate message to generate the encrypted message. The data packet structure of the encrypted message includes: NEW IP, ESP, IP address and payload data, and the NEW IP records the source address and destination address of the IPSec tunnel.

4. The method according to claim 2, characterized in that: The encapsulating the encrypted message to generate the message to be sent includes: The SRv6 tunnel of the sending routing device encapsulates the outer layer of the encrypted message with an SRv6 message header to generate an encapsulated message, wherein the data packet structure of the encapsulated message includes: SRv6, NEW IP, ESP, IP address and payload data, and the SRv6 message header includes: destination IPv6 address, source IPv6 address and path nodes pre-arranged by the SDN controller.

5. The method according to claim 1, characterized in that The step of encrypting and encapsulating the three-layer message using the quantum session key to obtain a message to be sent includes: Encapsulating the three-layer message to obtain an encapsulated message; The encapsulated message is encrypted using the quantum session key to generate the message to be sent.

6. The method according to claim 5, characterized in that The step of encapsulating the three-layer message to obtain an encapsulated message includes: The SRv6 tunnel of the sending routing device encapsulates an SRv6 message header into the outer layer of the three-layer message to generate an encapsulated message. The data packet structure of the encapsulated message includes: SRv6, IP address and payload data, and the SRv6 message header includes: destination IPv6 address and source IPv6 address.

7. The method according to claim 5, characterized in that The step of encrypting the encapsulated message using the quantum session key to generate the message to be sent includes: The IPSec tunnel of the sender's routing device uses the quantum session key to securely encrypt the payload data in the encapsulated message, and adds an ESP header to the encapsulated message to generate the message to be sent, wherein the data packet structure of the message to be sent includes: SRv6, ESP, IP address and payload data.

8. The method according to claim 1, characterized in that The step of forwarding the message to be sent to a target receiver routing device includes: Determine, according to the SRv6 message header encapsulated in the outer layer of the message to be sent, a target forwarding path between a target receiver routing device and a wide area network; According to the target forwarding path, the message to be sent is forwarded to the target recipient routing device.

9. A three-layer message transmission method, characterized in that: Applied to a receiving routing device, the method includes: Receive the message to be sent forwarded by the sender's routing device; Obtain the quantum key forwarded by the SDN controller, and use the same key generation method as the sending routing device to process the original session key and the quantum key that are the same as the sending routing device to generate a quantum session key; Decrypting and decapsulating the message to be sent using the quantum session key to obtain a three-layer message; The layer-3 message is forwarded to the second user equipment.

10. The method according to claim 9, characterized in that The using of the quantum session key to decrypt and decapsulate the message to be sent to obtain a three-layer message, including: Decapsulating the message to be sent to generate an encrypted message; The encrypted message is decrypted using the quantum session key to generate the three-layer message.

11. The method according to claim 10, characterized in that The decapsulating the message to be sent to generate an encrypted message includes: The SRv6 tunnel of the receiving routing device decapsulates the SRv6 message header of the outer layer of the message to be sent to generate the encrypted message.

12. The method according to claim 10, characterized in that The decrypting the encrypted message using the quantum session key to generate the three-layer message includes: The IPSec tunnel of the receiver's routing device uses the quantum session key to decrypt the encrypted message, remove the ESP header in the encrypted message, and generate the three-layer message.

13. The method according to claim 9, characterized in that The using of the quantum session key to decrypt and decapsulate the message to be sent to obtain a three-layer message, including: Decrypting the message to be sent using the quantum session key to obtain a decrypted message; The decrypted message is decapsulated to obtain the three-layer message.

14. The method according to claim 13, characterized in that The step of using the quantum session key to decrypt the message to be sent to obtain a decrypted message includes: The IPSec tunnel of the receiver's routing device uses the quantum session key to decrypt the message to be sent, and removes the ESP header in the message to be sent to generate the decrypted message; The decapsulating the decrypted message to obtain the three-layer message includes: The SRv6 tunnel of the receiving routing device decapsulates the SRv6 message header of the outer layer of the decrypted message to generate the three-layer message.

15. A three-layer message transmission system, characterized in that: The system includes: a first user device, a sender routing device, a receiver routing device, a second user device, an SDN controller and a quantum cryptography service platform; The sending party routing device is connected to the receiving party routing device via a wide area network communication; The SDN controller is respectively connected to the sender routing device, the receiver routing device, and the quantum key platform for obtaining a quantum key from the quantum cryptography service platform and distributing the obtained quantum key to the sender routing device and the receiver routing device; The sender routing device is used to execute the method according to any one of claims 1 to 8 above; The receiving routing device is used to execute the method described in any one of claims 9 to 14.

Images