Working method and system of quantum security firewall based on IP switching

Abstract

The invention discloses a working method and system of a quantum security firewall based on IP switching, and the method comprises the steps: the quantum security firewall creates n virtual interfaces with a corresponding number, and distributes a group of IP addresses for each virtual interface; selecting a part of virtual interfaces as virtual interfaces for communication; the remaining virtual interfaces are used as standby virtual interfaces; the quantum key service device distributes symmetrical key files for the extranet device and the quantum security firewall in the extranet device cluster; and the external network device of the data to be transmitted generates transmission data and sends the transmission data to the corresponding virtual interface, and the quantum security firewall judges whether to switch the virtual interface based on the received transmission data. According to the invention, through an IP switching mechanism, the service corresponding to the attacked IP can be seamlessly switched to other normally running virtual interfaces in real time for transmission and processing, the continuity and availability of the service are ensured, and the risk of service interruption caused by attack is greatly reduced.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of data transmission, and in particular to a working method and system of a quantum security firewall based on IP switching. BACKGROUND

[0002] With the rapid development of network technology, network security problems are increasingly prominent. As a key network security device, the core function of the firewall is to monitor, filter and control the data traffic entering and exiting the network according to the preset security policy, so as to build a security barrier between the trusted internal network and the untrusted external network (such as the Internet). The traditional firewall checks the source address, destination address, port number and protocol type of the data packet, executes access control decisions, effectively prevents unauthorized access and defends against malicious attacks (such as intrusion attempts and virus propagation), and records network activity logs to protect the confidentiality, integrity and availability of the network environment. As the first line of defense of the network security system, the firewall has been widely used in the network environment of enterprises, government agencies and individual users, and has become an indispensable infrastructure for maintaining the stable operation of the network.

[0003] In the process of network communication, the firewall needs to continuously interact with various devices in the internal network and the external network. Currently, such communication usually relies on the real IP address configured by the physical network interface of the firewall as the addressing identifier. Specifically, whether receiving external data packets or actively initiating connections, the firewall needs to expose its real IP address for routing and addressing, which makes the address a publicly visible node in the network. However, this communication mechanism based on the real IP address has significant security flaws: once the real IP address of the firewall is detected or obtained by a malicious attacker, it will become a direct target of a distributed denial of service (DDOS) attack. Attackers can launch a flood attack on the IP address by sending a large number of fake requests, causing the firewall to degrade in performance or even completely fail due to resource exhaustion (such as bandwidth saturation and processing capacity overload). At this time, the firewall not only cannot normally execute the security policy, but also may cause the entire protected network to be interrupted, seriously affecting the normal communication process and service continuity.

[0004] In the prior art, although the intrusion prevention system (IPS) and other supplementary means have been used to alleviate the DDOS threat, the inherent vulnerability of the firewall due to the exposure of the real IP address has not been fundamentally solved. Therefore, how to effectively hide the real IP address of the firewall while maintaining its basic communication functions, reduce the risk of direct attack, and improve the overall business continuity of the network has become a technical challenge that needs to be solved in the current network security field. SUMMARY

[0005] Invention purposes: The purpose of the present application is to provide a working method and system of quantum security firewall based on IP switching, which solves the problem that the existing technology cannot fundamentally solve the inherent vulnerability of the firewall due to the exposure of the real IP address. The present application virtually outputs multiple IP addresses, so even if attacked, only one IP address will be attacked, and the use of other virtual interfaces will not be affected, which effectively hides the real IP address and reduces the risk of direct attack, thereby improving the continuity of the overall network business.

[0006] Technical solutions: The working method of the quantum security firewall based on IP switching, the method comprises the following steps:

[0007] (1) The quantum security firewall creates a corresponding number of n virtual interfaces based on the number of local physical network ports, and allocs a group of IP addresses to each virtual interface;

[0008] (2) Select a part of the virtual interfaces from the n virtual interfaces as the virtual interfaces for communication of the m external network devices in the external network device cluster, form a corresponding relationship between each external network device and its communication virtual interface; the remaining virtual interfaces are used as standby virtual interfaces for subsequent IP switching;

[0009] (3) The quantum key service device distributes symmetric key files to each external network device in the external network device cluster and the key storage unit of the quantum security firewall;

[0010] (4) The external network device to be transmitted generates transmission data based on the key in its local key file and sends it to the corresponding virtual interface, and the quantum security firewall judges whether to switch the virtual interface based on the received transmission data, if not, the current virtual interface transmits the transmission data to the quantum security firewall for processing, and then sends it to the receiving internal network device in the internal network device cluster; if switching, the quantum security firewall notifies the external network device to be transmitted that the data transmission fails, and randomly selects a group of IP addresses corresponding to the standby virtual interfaces and sends them to the external network device to be transmitted, the external network device to be transmitted retransmits the transmission data to the standby virtual interface, and the standby virtual interface transmits the transmission data to the quantum security firewall for processing, and then sends it to the receiving internal network device in the internal network device cluster.

[0011] Further, the external network device sends data to its corresponding virtual interface in an encrypted manner, and correspondingly, the virtual interface corresponding to the external network device calls the corresponding key file from the key storage unit for data decryption.

[0012] Further, before the step (2), the method further comprises: each virtual interface of the quantum security firewall acquires the maximum flow M of its local physical network port, and sets the flow threshold M-thre of the attack on the physical network port.

[0013] Further, in the step (2), when n≥m, m virtual interfaces are selected from the n virtual interfaces, each external network device is allocated a virtual interface, and the remaining n-m virtual interfaces are used as standby virtual interfaces.

[0014] Further, the external network device of the to-be-transmitted data generates transmission data based on the key in its local key file and sends it to the corresponding virtual interface, which means:

[0015] 1) The external network device of the to-be-transmitted data acquires the first encryption key k1 from the local key file, records the key index idx-k1, and then uses the first encryption key k1 to encrypt the to-be-transmitted data mes to obtain the ciphertext MES; the key index idx-k1 includes the identification, key position and key length information of the key file;

[0016] 2) The external network device of the to-be-transmitted data performs hash calculation on its own identity ID to obtain the hash value H1; wherein the hash parameter used for performing hash calculation is: string str1 and input random number s1;

[0017] 3) The external network device of the to-be-transmitted data merges the ciphertext MES, the key index idx-k1, its own identity ID, the hash value H1, the string str1 and the input random number s1 to obtain the transmission data; then, the transmission data is sent to the virtual interface corresponding to the external network device of the to-be-transmitted data.

[0018] Further, the step of judging whether to switch the virtual interface based on the received transmission data means:

[0019] The quantum security firewall judges whether the data flow in the virtual interface corresponding to the current to-be-transmitted data external network device reaches the flow threshold M-thre, if not, no switching of the virtual interface is performed; if yes, switching of the virtual interface is performed.

[0020] Further, the specific process of transmitting the transmission data to the quantum security firewall for processing, and then sending it to the receiving internal network device in the internal network device cluster is:

[0021] A1: After the virtual interface corresponding to the external network device receiving the data to be transmitted receives the data, it transmits it to the quantum security firewall. The quantum security firewall parses the transmitted data to obtain the ciphertext MES', key index idx-k1', identity ID', hash value H1', ​​string str1', and input random number s1'.

[0022] A2: The quantum-safe firewall generates an irreducible polynomial p1' with a coefficient of 1 for each term of the polynomial except for the highest term, based on the coefficients of each term in the string str1'. It then uses the irreducible polynomial p1' and the input random number s1' to generate a hash function H'. p1,s1 Next, using the hash function H' p1,s1 The hash value of the identity ID' is calculated to obtain the hash value H1''; the quantum secure firewall compares the received hash value H1'' with the calculated hash value H1''. If they match, proceed to the next step; otherwise, the virtual interface retransmits the transmission data to the quantum secure firewall.

[0023] A3: The quantum-secure firewall addresses the local key file based on the key file identifier in the key index idx-k1', then uses the key position and key length information in the key index idx-k1' to obtain the first decryption key k1', and uses the first decryption key k1' to decrypt the ciphertext MES' to obtain the data to be transmitted mes'; finally, the quantum-secure firewall sends the data to be transmitted mes' to the receiving intranet device in the intranet device cluster.

[0024] Furthermore, the hash value H1 obtained by the external network device that performs a hash calculation on its own identity ID refers to:

[0025] The external network device to be transmitted generates an irreducible polynomial p1 locally and records the string consisting of the coefficients of each term except the highest term in the irreducible polynomial p1 as str1. Then, the external network device to be transmitted generates an input random number s1 locally and generates a hash function H based on the irreducible polynomial p1 and the input random number s1. p1,s1 Using hash function H p1,s1 Calculate the hash value of its own identity ID to obtain the hash value H1.

[0026] Furthermore, in response to switching virtual interfaces, the quantum security firewall parses the transmitted data to determine whether it is attack data; if so, it directly discards the data and the IP address corresponding to the current virtual interface, reassigns a new set of IP addresses to the current virtual interface, and puts the virtual interface into the backup virtual interface for switching.

[0027] The application also comprises a system of a working method of an IP switching-based quantum security firewall, the system comprising a quantum key service device and a cluster of intranet devices, a quantum security firewall and a cluster of extranet devices connected in sequence, the quantum key service device being further connected with the quantum security firewall and the cluster of extranet devices respectively;

[0028] The cluster of extranet devices comprises m extranet devices, each of which is used to generate transmission data and send the transmission data to a virtual interface of the quantum security firewall;

[0029] The quantum key service device is used to distribute symmetric key files for each of the cluster of extranet devices and the quantum security firewall;

[0030] The quantum security firewall is used to create a corresponding number of n virtual interfaces based on the number of local physical network ports, assign a group of IP addresses to each virtual interface, select a part of the virtual interfaces as virtual interfaces for communication, and select the remaining virtual interfaces as standby virtual interfaces; the quantum security firewall is also used to judge whether to switch the virtual interfaces based on the received transmission data, if not, receive the transmission data for processing, and then send the processed data to the cluster of intranet devices; if yes, notify the extranet device of data transmission failure, randomly select a group of IP addresses corresponding to the standby virtual interfaces and send the IP addresses to the extranet device, retransmit the transmission data from the extranet device to the standby virtual interfaces, receive the transmission data for processing, and then send the processed data to the cluster of intranet devices;

[0031] The cluster of intranet devices comprises a plurality of intranet devices, each of which is used to receive data from the quantum security firewall.

[0032] The application has the following beneficial effects: the application generates a plurality of IP addresses through virtualization, when attacked by DDOS or the like, the attack flow can only act on a certain virtual IP address, and cannot affect other virtual interfaces and the services carried thereby, so that the localization and controllability of attack influence are realized; meanwhile, through the IP switching mechanism, the services corresponding to the attacked IP can be switched to other normally operating virtual interfaces in real time and seamlessly for transmission and processing, so that the continuity and availability of the services are ensured, and the risk of service interruption caused by attack is greatly reduced. BRIEF DESCRIPTION OF DRAWINGS

[0033] Figure 1 It is a schematic diagram of an existing firewall in a network communication process;

[0034] Figure 2 It is a system structure schematic diagram of an IP switching-based quantum security firewall of the application;

[0035] Figure 3 It is a schematic diagram of assigning IP addresses to virtual interfaces;

[0036] Figure 4 For n≥m, part of the virtual interfaces as communication virtual interfaces, the remaining as standby virtual interfaces schematic diagram;

[0037] Figure 5 For n < m, part of the virtual interfaces as communication virtual interfaces, the remaining as standby virtual interfaces schematic diagram;

[0038] Figure 6 For quantum key service device for each external network device and quantum security firewall distribution of symmetric key file schematic diagram;

[0039] Figure 7 For the switching of virtual interfaces schematic diagram. DETAILED DESCRIPTION

[0040] The application will be further described below in conjunction with the accompanying drawings and embodiments:

[0041] As Figure 1 shown, in the process of network communication, the firewall needs to continuously interact with various devices of the internal network and the external network. This kind of communication usually relies on the real IP address configured by the physical network interface of the firewall as the addressing identifier. However, this communication mechanism based on the real IP address has significant security defects: once the real IP address of the firewall is detected or obtained by a malicious attacker, it will become a direct target of distributed denial of service (DDOS) attack.

[0042] When the IP address of the firewall is known in the external Internet, useless access can be constructed to generate a DDOS attack. If the firewall does not have reasonable protection measures, it will pass these useless accesses, causing the consumption of terminal processing resources in the internal network. At the same time, since the firewall plays a filtering role, it means that when a DDOS attack occurs, the firewall will bear a large number of request processing at a certain moment. How to handle this situation and ensure the normal work of the firewall is also worth considering.

[0043] In the prior art, although the intrusion prevention system (IPS) and other supplementary means have been used to alleviate the DDOS threat, the inherent vulnerability of the firewall due to the exposure of the real IP address has not been fundamentally solved. Therefore, how to effectively hide the real IP address of the firewall while maintaining its basic communication function, reduce the risk of direct attack, and thus improve the continuity of the overall network business, has become a technical challenge that needs to be solved in the current network security field.

[0044] In view of this, the embodiment proposes a working system of quantum security firewall based on IP switching, as Figure 2As shown, the system comprises a quantum key service device 1 and a cluster of intranet devices 2, a quantum security firewall 3, and a cluster of extranet devices 4 connected in sequence, and the quantum key service device 1 is further connected with the quantum security firewall 3 and the cluster of extranet devices 4 respectively;

[0045] The cluster of extranet devices 4 comprises m extranet devices, each of which is configured to generate transmission data and send the transmission data to a virtual interface of the quantum security firewall 3;

[0046] The quantum key service device 1 is configured to distribute symmetric key files to each of the extranet devices in the cluster of extranet devices 4 and the quantum security firewall 3;

[0047] The quantum security firewall 3 is configured to create a corresponding number of n virtual interfaces based on the number of local physical network interfaces, assign a group of IP addresses to each virtual interface, select a part of the virtual interfaces as virtual interfaces for communication, and select the remaining virtual interfaces as backup virtual interfaces; the quantum security firewall 3 is further configured to determine whether to switch the virtual interfaces based on the received transmission data, if not, receive the transmission data for processing, and then send the processed data to the cluster of intranet devices 2; if yes, notify the extranet devices of a data transmission failure, randomly select a group of IP addresses corresponding to the backup virtual interfaces and send the IP addresses to the extranet devices, retransmit the transmission data from the extranet devices to the backup virtual interfaces, receive the transmission data for processing, and then send the processed data to the cluster of intranet devices 2; and the key storage unit of the quantum security firewall 3 is configured to store the key files;

[0048] The cluster of intranet devices 2 comprises a plurality of intranet devices, each of which is configured to receive data from the quantum security firewall 3.

[0049] The system design significantly enhances the resistance of the quantum security firewall to large-scale distributed denial-of-service attacks, improves the overall reliability of the network, and provides continuous and stable security protection for critical services.

[0050] The embodiment also provides a working method of the quantum security firewall based on IP switching, which comprises the following steps:

[0051] (1) The quantum security firewall creates a corresponding number of n virtual interfaces based on the number of local physical network interfaces, and assigns a group of IP addresses to each virtual interface; for example, as shown in the figure, the first virtual interface is assigned a first IP address, the second virtual interface is assigned a second IP address, and the nth virtual interface is assigned an nth IP address; Figure 3

[0052] ​Then, each virtual interface of the quantum-secure firewall obtains the maximum traffic M of its local physical network port and sets a traffic threshold M-thre for attacks on the physical network port. For example, this traffic threshold can be 50% of the maximum traffic, i.e., M-thre = 0.5M. Alternatively, this traffic threshold can be the maximum traffic value M-max over the past T time period, set as M-thre = a * M-max, where the coefficient a is, for example, 1.2 or 1.5, generally slightly larger than the maximum value.

[0053] In some practical applications, this step can also set a frequency threshold for attacks on the physical network interface. For example, the frequency threshold could be receiving more than Q requests per unit time. This is a common method for judging DDoS attacks, which will not be elaborated upon here; the method will only be explained from the perspective of traffic thresholds.

[0054] (2) Select a portion of the n virtual interfaces as virtual interfaces for communication between the m external network devices in the external network device cluster, and establish a correspondence between each external network device and its communication virtual interface; the remaining virtual interfaces serve as backup virtual interfaces for subsequent IP switching; that is, reserve at least one virtual interface for the subsequent IP switching process, and allocate the other virtual interfaces besides the reserved virtual interface to the m external network devices. Figure 4 As shown, when n ≥ m, virtual interfaces are determined for communication among the m external network devices in the external network device cluster. Specifically, m virtual interfaces are selected from the n virtual interfaces, and each external network device is assigned a dedicated virtual interface for subsequent data transmission; the remaining nm virtual interfaces serve as backup virtual interfaces. Figure 5 As shown, when n < m, some external network devices share a virtual interface.

[0055] (3) The quantum key service device distributes symmetric key files to the key storage units of each external network device in the external network device cluster and the quantum-secure firewall; such as Figure 6 As shown, the quantum key distribution service device distributes a key file to each external network device. For example, the first external network device receives the first key file, file1, and so on. This key file is used for encryption and decryption in subsequent communications. During data exchange, the virtual interface corresponding to the external network device retrieves the corresponding key file from the firewall's local key file storage unit based on the key file index for decryption. After distributing the symmetric key files, external network devices send encrypted data to their corresponding virtual interfaces, and the corresponding virtual interfaces retrieve the appropriate key file from the key storage unit for data decryption.

[0056] (4) The external network device that needs to transmit data generates transmission data based on the key in its local key file and sends it to the corresponding virtual interface, specifically:

[0057] 1) The external network device that needs to transmit data obtains the first encryption key k1 from the local key file and records its key index idx-k1. Then, it uses the first encryption key k1 to encrypt the data mes to be transmitted, and obtains the ciphertext MES. The key index idx-k1 includes the identifier of the key file, the key location and the key length information.

[0058] 2) The external network device to be transmitted performs a hash calculation on its own identity ID to obtain a hash value H1. The hash parameters used for the hash calculation are: the string str1 and the input random number s1. Obtaining the hash value H1 means that the external network device to be transmitted generates an irreducible polynomial p1 locally and records the string consisting of the coefficients of each term in the irreducible polynomial p1 (excluding the highest term) as str1. Then, the external network device to be transmitted generates another input random number s1 locally, and generates a hash function H based on the irreducible polynomial p1 and the input random number s1. p1,s1 Using hash function H p1,s1 Calculate the hash value of its own identity ID to obtain the hash value H1.

[0059] 3) The external network device that needs to transmit data uses the IP address of the virtual interface allocated in step (2) as the destination IP address. The external network device that needs to transmit data merges the ciphertext MES, key index idx-k1, its own identity ID, hash value H1, string str1 and input random number s1 to obtain the transmitted data. Then, it sends the transmitted data to the virtual interface corresponding to the external network device that needs to transmit data.

[0060] Next, the quantum-safe firewall determines whether to switch virtual interfaces based on the received transmission data. This means that the quantum-safe firewall determines whether the data traffic in the virtual interface corresponding to the external network device currently transmitting data has reached the traffic threshold M-thre. If the traffic threshold M-thre has not been reached, the virtual interface will not be switched. If the traffic threshold M-thre has been reached, it means that the current IP address has been used by malicious users to launch an attack, causing the traffic in the current virtual interface to surge and reach the traffic threshold. At this time, it is determined that the current virtual interface cannot continue to perform data transmission, and the virtual interface will be switched.

[0061] If no switch is made, the current virtual interface will transmit data to the quantum-safe firewall for processing, and then send it to the receiving intranet device in the intranet device cluster. The specific process is as follows:

[0062] A1: After the virtual interface corresponding to the external network device receiving the data to be transmitted receives the data, it transmits it to the quantum security firewall. The quantum security firewall parses the transmitted data to obtain the ciphertext MES', key index idx-k1', identity ID', hash value H1', ​​string str1', and input random number s1'.

[0063] A2: The quantum-safe firewall generates an irreducible polynomial p1' with a coefficient of 1 for each term of the polynomial except for the highest term, based on the coefficients of each term in the string str1'. It then uses the irreducible polynomial p1' and the input random number s1' to generate a hash function H'. p1,s1 Next, using the hash function H' p1,s1 The hash value of the identity ID' is calculated to obtain the hash value H1''; the quantum secure firewall compares the received hash value H1'' with the calculated hash value H1''. If they match, proceed to the next step; otherwise, the virtual interface retransmits the transmission data to the quantum secure firewall.

[0064] A3: The quantum-secure firewall addresses the local key file based on the key file identifier in the key index idx-k1', then uses the key position and key length information in the key index idx-k1' to obtain the first decryption key k1', and uses the first decryption key k1' to decrypt the ciphertext MES' to obtain the data to be transmitted mes'; finally, the quantum-secure firewall sends the data to be transmitted mes' to the receiving intranet device in the intranet device cluster.

[0065] If a switch occurs, the quantum-secure firewall notifies the external network device that data transmission failed. It then randomly selects a set of backup virtual interface IP addresses and sends the data to the external network device. The external network device retransmits the data to the backup virtual interface, which then transmits the data to the quantum-secure firewall for processing before sending it to the receiving internal network device in the internal network device cluster. In response to the virtual interface switch, the quantum-secure firewall parses the transmitted data to determine if it is attack data. If so, it discards the data and the IP address corresponding to the current virtual interface (because it has been attacked, indicating the IP address has been leaked and is no longer secure). A new set of IP addresses is then assigned to the current virtual interface, and the virtual interface is added to the queue of backup virtual interfaces for the switch. Figure 7 As shown, taking the switching of the first virtual interface as an example, a new set of backup virtual interfaces is selected for data transmission.

[0066] This invention reduces the virtual interface selection process during data transmission between external network devices and firewalls. Furthermore, by monitoring the switching process of a specific virtual interface, it becomes clear which external network device is being spoofed or has had its IP address leaked. For example, if the first virtual interface requires IP switching during communication, it indicates that the first (or second) external network device assigned to that virtual interface is malfunctioning, helping developers quickly locate and address the problem. Additionally, by switching to other virtual interfaces, attacks on a single virtual interface can prevent the real physical communication interface from directly communicating with the outside world, effectively avoiding attacks on the real physical network port. The flexible switching of virtual network ports ensures that the firewall can switch to other virtual network ports to maintain its normal operation in the event of a DDoS attack.

[0067] In summary, this invention generates multiple IP addresses through virtualization. When encountering attacks such as DDoS, the attack traffic can only affect one of the virtual IP addresses, without affecting other virtual interfaces and the services they carry. This achieves localization and controllability of the attack's impact. At the same time, through the IP switching mechanism, the services corresponding to the attacked IP can be switched to other normally operating virtual interfaces in real time and seamlessly for transmission and processing, ensuring the continuity and availability of services and greatly reducing the risk of service interruption caused by attacks.

Claims

1. A method for operating an IP-based quantum secure firewall, characterized in that The method comprises the following steps: (1) The quantum security firewall creates a corresponding number of n virtual interfaces based on the number of local physical network interfaces, and assigns a group of IP addresses to each virtual interface; (2) A part of the virtual interfaces are selected from the n virtual interfaces as virtual interfaces for communication of m external network devices in the external network device cluster, and a corresponding relationship is formed between each external network device and the virtual interface for communication thereof; the remaining virtual interfaces are used as standby virtual interfaces for subsequent IP switching; (3) The quantum key service device distributes symmetric key files to each external network device in the external network device cluster and the key storage unit of the quantum security firewall; (4) The external network device to be transmitted data generates transmission data based on the key in the local key file and sends it to the corresponding virtual interface; the quantum security firewall judges whether to switch the virtual interface based on the received transmission data; if not, the current virtual interface transmits the transmission data to the quantum security firewall for processing, and then sends it to the receiving internal network device in the internal network device cluster; if yes, the quantum security firewall notifies the external network device to be transmitted data that the data transmission fails, randomly selects a group of IP addresses corresponding to the standby virtual interfaces and sends them to the external network device to be transmitted data, and the external network device to be transmitted data retransmits the transmission data to the standby virtual interface; the standby virtual interface transmits the transmission data to the quantum security firewall for processing, and then sends it to the receiving internal network device in the internal network device cluster.

2. The working method of the quantum secure firewall based on IP switching according to claim 1, characterized in that: The external network device sends data to its corresponding virtual interface in an encrypted manner, and the corresponding virtual interface corresponding to the external network device calls the corresponding key file from the key storage unit for data decryption.

3. The working method of the quantum secure firewall based on IP switching according to claim 1, characterized in that: Before step (2), the method further comprises: each virtual interface of the quantum security firewall obtains the maximum flow M of its local physical network interface, and sets the flow threshold M-thre at which the physical network interface is attacked.

4. The working method of the quantum secure firewall based on IP switching according to claim 1, characterized in that: In step (2), when n≥m, m virtual interfaces are selected from the n virtual interfaces, one virtual interface is allocated to each external network device, and the remaining n-m virtual interfaces are used as standby virtual interfaces.

5. The working method of the quantum secure firewall based on IP switching according to claim 1, characterized in that: The external network device to be transmitted data generates transmission data based on the key in the local key file and sends it to the corresponding virtual interface, which means: 1) The external network device to be transmitted data obtains a first encryption key k1 from the local key file, records the key index idx-k1, and then uses the first encryption key k1 to encrypt the to-be-transmitted data mes to obtain the ciphertext MES; The key index idx-k1 includes the identification, key position and key length information of the key file; 2) The external network device to be transmitted data performs hash calculation on its own identity ID to obtain a hash value H1; wherein the hash parameter used for hash calculation is: a string str1 and an input random number s1; 3) the external network device of the to-be-transmitted data merges the ciphertext MES, the key index idx-k1, the identity ID of itself, the hash value H1, the string str1 and the input random number s1 to obtain transmission data, and then sends the transmission data to the virtual interface corresponding to the external network device of the to-be-transmitted data.

6. The working method of the quantum secure firewall based on IP switching according to claim 3, characterized in that: The judgment of whether to switch the virtual interface based on the received transmission data is that: The quantum security firewall judges whether the data flow in the virtual interface corresponding to the current to-be-transmitted data external network device reaches the flow threshold M-thre, and if not, no switching of the virtual interface is performed. If the flow threshold M-thre is reached, the switching of the virtual interface is performed.

7. The working method of the quantum secure firewall based on IP switching according to claim 5, characterized in that: The specific process of transmitting the transmission data to the quantum security firewall for processing and then sending to the receiving internal network device in the internal network device cluster is that: A1: After the virtual interface corresponding to the to-be-transmitted data external network device receives the transmission data, it is transmitted to the quantum security firewall, and the quantum security firewall analyzes the transmission data to obtain the ciphertext MES', the key index idx-k1', the identity ID', the hash value H1', the string str1' and the input random number s1'; A2: The quantum secure firewall generates an irreducible polynomial p1' with the highest term coefficient of 1 based on the coefficients of each bit of the string str1' corresponding to the terms other than the highest term of the polynomial, and generates a hash function H' using the irreducible polynomial p1' and the input random number s1' p1,s1 ; then, the hash value H1'' of the identity ID' is calculated using the hash function H' p1,s1 ​ The quantum security firewall compares the received hash value H1' with the calculated hash value H1'', and if they are consistent, the next step is entered. Otherwise, the virtual interface retransmits the transmission data to the quantum security firewall; A3: The quantum security firewall addresses the local key file according to the identity of the key file in the key index idx-k1', and then obtains the first decryption key k1' using the key position and key length information in the key index idx-k1', decrypts the ciphertext MES' using the first decryption key k1', and obtains the to-be-transmitted data mes'; finally, the quantum security firewall sends the to-be-transmitted data mes' to the receiving internal network device in the internal network device cluster.

8. The working method of the quantum secure firewall based on IP switching according to claim 5, characterized in that: The hash value H1 obtained by the to-be-transmitted data external network device performing hash calculation on its own identity ID is that: The external network device of the data to be transmitted generates an irreducible polynomial p1 locally, and records a string str1 composed of the coefficient of each term except the highest term in the irreducible polynomial p1; then, the external network device of the data to be transmitted generates an input random number s1 locally, generates a hash function H based on the irreducible polynomial p1 and the input random number s1 p1,s1 , and calculates the hash value H1 of the identity ID of itself by using the hash function H p1,s1 .

9. The working method of the quantum secure firewall based on IP switching according to claim 1, characterized in that: In response to switching the virtual interface, the quantum security firewall analyzes the transmission data to determine whether it is attack data; if so, the data is directly discarded, the IP address corresponding to the current virtual interface is discarded, a new set of IP addresses is allocated to the current virtual interface, and the virtual interface is put into the standby virtual interface for switching.

10. A system for working method of quantum secure firewall based on IP switching according to any one of claims 1 to 9, characterized in that: The system includes a quantum key service device and an internal network device cluster, a quantum security firewall and an external network device cluster connected in sequence, the quantum key service device is also connected with the quantum security firewall and the external network device cluster respectively; The external network device cluster includes m external network devices, each of which is used to generate transmission data and send it to the virtual interface of the quantum security firewall; The quantum key service device is used to distribute symmetric key files to each external network device in the external network device cluster and the quantum security firewall; The quantum security firewall is used for creating a corresponding number of n virtual interfaces based on the number of local physical network interfaces, assigning a group of IP addresses to each virtual interface, and selecting a part of the virtual interfaces as virtual interfaces for communication and the remaining virtual interfaces as standby virtual interfaces; and is also used for judging whether to switch the virtual interfaces based on the received transmission data, if not, receiving the transmission data for processing, and then sending to the intranet device cluster after processing; If switching, notifying the external network device of data transmission failure, randomly selecting a group of IP addresses corresponding to the standby virtual interfaces and sending to the external network device, the external network device retransmitting the transmission data to the standby virtual interfaces, receiving the transmission data for processing, and then sending to the intranet device cluster after processing; The intranet device cluster includes a plurality of intranet devices, and each intranet device is used for receiving data from the quantum security firewall.

Images