A VPN network system based on quantum key technology

Abstract

The present invention discloses a VPN network system based on quantum key technology, and relates to the field of network communication technology. When the NFVO receives a request to access an accessed node, it obtains the network topology between the access node and the accessed node, and sends the network topology, node configuration information, and VPN creation command as connection information to the first virtual management configuration module and the second virtual configuration management module, so that they configure the nodes according to the node configuration information, respectively, and establish a VPN channel according to the network topology and VPN creation command; the first virtual router and the second virtual router use the first QKD module and the second QKD module to generate quantum keys, respectively, and use the quantum keys to encrypt data communication through the VPN channel. The above system combines quantum key technology and VPN technology, improves the flexibility and adaptability of the management architecture of the encrypted transmission network system, and provides a feasible network architecture for realizing large-scale quantum encryption services.

Description

Technical Field

[0001] The present invention relates to the technical field of network communication, and in particular to a VPN network system based on quantum key technology. Background Art

[0002] Quantum key technology is a communication encryption method that cannot be eavesdropped, cannot be deciphered, and is unconditionally secure. Quantum encryption communication is mainly divided into two steps: the first step is to distribute quantum keys through quantum channels. Through quantum key distribution, the two communicating parties obtain a pair of completely random quantum keys that only the two communicating parties know. The second step is to transmit ciphertext through traditional channels. Using the obtained quantum key, the sender encrypts the information into a ciphertext, and the receiver decrypts the received ciphertext, thereby achieving complete confidentiality of communication.

[0003] At this stage, quantum key technology is still in the research stage, and the existing network infrastructure is not fully utilized, resulting in poor flexibility and adaptability of the encrypted transmission network system management architecture, making it impossible to implement large-scale quantum encryption services. Summary of the invention

[0004] The purpose of the present invention is to solve the above-mentioned background technical problems and to propose a VPN network system based on quantum key technology.

[0005] The purpose of the present invention can be achieved through the following technical solutions:

[0006] An embodiment of the present invention provides a VPN network system based on quantum key technology, including an access node and an accessed node; the access node includes a network function virtualization editor NFVO, a first virtual management configuration module, a first virtual router and a first quantum key distribution QKD module; the accessed node includes a second virtual configuration management module, a second virtual router and a second QKD module;

[0007] The NFVO is configured to, upon receiving a request to access the visited node, obtain a network topology between the access node and the visited node, and send the network topology, node configuration information, and a VPN creation command as connection information to the first virtual management configuration module and the second virtual configuration management module;

[0008] The first virtual management configuration module and the second virtual configuration management module are used to configure nodes according to the node configuration information respectively, and to establish a VPN channel between the first virtual router and the second virtual router according to the network topology and the VPN creation command;

[0009] The first virtual router and the second virtual router are used to generate quantum keys using the first QKD module and the second QKD module respectively, and configure the VPN channel, and use the quantum keys to perform encrypted data communication through the VPN channel.

[0010] Optionally, the first virtual management configuration module includes a first virtual infrastructure manager VIM and a first virtual configuration package; the second virtual management configuration module includes a second VIM and a second virtual configuration package; the first virtual configuration package and the second virtual configuration package include a set of scripts and processes remotely controlled by the NFVO;

[0011] The first virtual configuration package is used to execute a script or process according to a control instruction of the NFVO to manage and configure the access node;

[0012] The second virtual configuration package is used to execute a script or process according to a control instruction of the NFVO to manage and configure the accessed node;

[0013] The first VIM and the second VIM are used to control the underlying network, computing infrastructure and storage infrastructure to build a VPN.

[0014] Optionally, the first virtual configuration package is further used to create a connection between the first virtual router and the server of the access node, granting the first virtual router access to the first QKD module;

[0015] The second virtual configuration package is also used to create a connection between the second virtual router and the server of the visited node, granting the second virtual router access to the second QKD module.

[0016] Optionally, the first virtual configuration package is further used to configure the first virtual router, obtain the first key generated by the first QKD module through the first virtual router, and send the first key to the visited node through the VPN channel;

[0017] The second virtual configuration package is further used to configure the second virtual router and send the first key to the second QKD module through the second virtual router;

[0018] The first QKD module and the second QKD module are used to determine a target transmission key by performing quantum key distribution according to the first key through the first virtual router and the second virtual router.

[0019] Optionally, the first virtual configuration package and the second virtual configuration package are further used to configure IP layer operation information of the first virtual router and the second virtual router respectively; the IP layer operation information includes routing tables, port mappings, NAT and IPsec policies.

[0020] Optionally, the first VIM and the second VIM are deployed on a Docker container platform to create a virtual network using containers and Open VSwitches.

[0021] Optionally, the node configuration information includes gateway and routing configuration, preset installation packages, and initialization parameters of internal services.

[0022] The embodiment of the present invention provides a VPN network system based on quantum key technology, including an access node and an accessed node; the access node includes a network function virtualization editor NFVO, a first virtual management configuration module, a first virtual router and a first quantum key distribution QKD module; the accessed node includes a second virtual configuration management module, a second virtual router and a second QKD module; the NFVO is used to obtain the network topology between the access node and the accessed node when receiving a request to access the accessed node, and send the network topology, node configuration information and a VPN creation command to the first virtual management configuration module and the second virtual configuration management module as connection information; the first virtual management configuration module and the second virtual configuration management module are used to configure the node according to the node configuration information respectively, and establish a VPN channel between the first virtual router and the second virtual router according to the network topology and the VPN creation command; the first virtual router and the second virtual router are used to generate quantum keys using the first QKD module and the second QKD module respectively, and configure the VPN channel, and use the quantum key to encrypt data communication through the VPN channel. The NFVO of the access node controls the first virtual management configuration module of the access node and the second virtual configuration management module of the accessed node to establish a VPN channel, and then uses the quantum key to encrypt data communication through the VPN channel. The combination of quantum key technology and VPN technology improves the flexibility and adaptability of the encrypted transmission network system management architecture, providing a feasible network architecture for realizing large-scale quantum encryption services. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] The present invention will be further described below in conjunction with the accompanying drawings.

[0024] Figure 1 A system block diagram of a VPN network system based on quantum key technology provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0025] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0026] The embodiment of the present invention provides a VPN network system based on quantum key technology. Figure 1 , Figure 1 A system block diagram of a VPN network system based on quantum key technology provided by an embodiment of the present invention. It includes an access node and an accessed node, and the access node and the accessed node transmit data through the Internet; the access node includes NFVO (Network Functions Virtualisation Orchestrator, Network Function Virtualization Editor), a first virtual management configuration module, a first virtual router and a first quantum key distribution QKD module; the accessed node includes a second virtual configuration management module, a second virtual router and a second QKD module;

[0027] The NFVO is configured to, upon receiving a request to access a visited node, obtain a network topology between the access node and the visited node, and send the network topology, node configuration information, and a VPN creation command as connection information to the first virtual management configuration module and the second virtual configuration management module;

[0028] A first virtual management configuration module and a second virtual configuration management module, configured to configure nodes according to the node configuration information respectively, and to establish a VPN channel between the first virtual router and the second virtual router according to the network topology and the VPN creation command;

[0029] The first virtual router and the second virtual router are used to generate quantum keys using the first QKD module and the second QKD module respectively, and configure a VPN channel to perform encrypted data communication using the quantum keys through the VPN channel.

[0030] According to a VPN network system based on quantum key technology provided by an embodiment of the present invention, the NFVO of the access node controls the first virtual management configuration module of the access node and the second virtual configuration management module of the accessed node to establish a VPN channel, and then uses the quantum key to encrypt data communication through the VPN channel. Combining quantum key technology and VPN technology, the flexibility and adaptability of the management architecture of the encrypted transmission network system are improved, and a feasible network architecture is provided for realizing large-scale quantum encryption services.

[0031] In one implementation, the VPN channel may be in IPsec tunnel mode.

[0032] In one implementation, NFVO can be used to manage the NS (Network Service) life cycle, coordinate the management of the NS life cycle, coordinate the management of the VNF (Virtual ised Network Function) life cycle, and coordinate the management of various NFVI (NFV Infrastructure) resources (which requires the support of the virtual infrastructure manager VIM) to ensure the optimal configuration of various required resources and connections.

[0033] In one embodiment, the first virtual management configuration module includes a first virtual infrastructure manager VIM and a first virtual configuration package; the second virtual management configuration module includes a second VIM and a second virtual configuration package; the first virtual configuration package and the second virtual configuration package include a set of scripts and processes remotely controlled by the NFVO;

[0034] A first virtual configuration package is used to execute a script or process according to a control instruction of the NFVO to manage and configure the access node;

[0035] The second virtual configuration package is used to execute scripts or processes according to the control instructions of the NFVO to manage and configure the accessed nodes;

[0036] The first VIM and the second VIM are used to control the underlying network, computing infrastructure, and storage infrastructure to build a VPN.

[0037] In one implementation, NFVO performs unilateral configuration of nodes, first configuring the access node and then configuring the visited node.

[0038] In one embodiment, the first virtual configuration package is further used to create a connection between the first virtual router and a server of the access node, granting the first virtual router access to the first QKD module;

[0039] The second virtual configuration package is also used to create a connection between the second virtual router and the server of the accessed node, granting the second virtual router access to the second QKD module.

[0040] In one embodiment, the first virtual configuration package is further used to configure the first virtual router, obtain the first key generated by the first QKD module through the first virtual router, and send the first key to the accessed node through the VPN channel;

[0041] The second virtual configuration package is further used to configure the second virtual router and send the first key to the second QKD module through the second virtual router;

[0042] The first QKD module and the second QKD module are used to determine a target transmission key by performing quantum key distribution according to the first key through the first virtual router and the second virtual router.

[0043] In one embodiment, the first virtual configuration package and the second virtual configuration package are further used to configure IP layer operation information of the first virtual router and the second virtual router respectively; the IP layer operation information includes routing table, port mapping, NAT and IPsec policy.

[0044] In one implementation, by configuring the IP layer operation information of the first virtual router and the second virtual router, the routing table and port mapping for data transmission between the two routers are determined, and the implementation mode of NAT and the function setting of IPSec are determined.

[0045] There are three ways to implement NAT, namely static NAT, dynamic NAT and port multiplexing OverLoad.

[0046] IPSec can achieve the following four functions: Data confidentiality: The IPSec sender encrypts the packet before sending it over the network. Data integrity: IPSec can verify the packet sent by the IPSec sender to ensure that the data has not been changed during transmission. Data authentication: The IPSec receiver can identify the origin of the IPSec packet. This service relies on data integrity. Anti-replay: The IPSec receiver can check and reject replayed packets.

[0047] In one embodiment, the first VIM and the second VIM are container platforms deployed on Docker, and are used to create a virtual network using containers and Open VSwitches.

[0048] In one implementation, the first VIM and the second VIM are deployed on a Docker container platform, which can further improve the flexibility of the network.

[0049] In one implementation, the switch components are formed in software according to the Open VSwitches protocol. Compared with traditional physical switches, virtual switches also have many advantages. First, the configuration is more flexible. An ordinary server can be configured with dozens or even hundreds of virtual switches, and the number of ports can be flexibly selected. Second, the cost is lower. Through virtual switching, the performance that can only be achieved by expensive ordinary switches can often be achieved.

[0050] In one embodiment, the node configuration information includes gateway and routing configuration, preset installation packages, and initialization parameters of internal services.

[0051] The above is a detailed description of an embodiment of the present invention, but the content is only a preferred embodiment of the present invention and cannot be considered to limit the scope of implementation of the present invention. All equivalent changes and improvements made within the scope of the present invention should still fall within the scope of the patent coverage of the present invention.

Claims

1. A VPN network system based on quantum key technology, characterized in that: It includes an access node and an accessed node; the access node includes a network function virtualization editor NFVO, a first virtual management configuration module, a first virtual router and a first quantum key distribution QKD module; the accessed node includes a second virtual configuration management module, a second virtual router and a second QKD module; The NFVO is configured to, upon receiving a request to access the visited node, obtain a network topology between the access node and the visited node, and send the network topology, node configuration information, and a VPN creation command as connection information to the first virtual management configuration module and the second virtual configuration management module; The first virtual management configuration module and the second virtual configuration management module are used to configure nodes according to the node configuration information respectively, and to establish a VPN channel between the first virtual router and the second virtual router according to the network topology and the VPN creation command; The first virtual router and the second virtual router are used to generate a quantum key using the first QKD module and the second QKD module respectively, and configure the VPN channel, and use the quantum key to perform encrypted data communication through the VPN channel; The first virtual management configuration module includes a first virtual infrastructure manager VIM and a first virtual configuration package, and the second virtual management configuration module includes a second VIM and a second virtual configuration package; The first virtual configuration package and the second virtual configuration package include a set of scripts and processes remotely controlled by the NFVO; The first virtual configuration package is used to execute a script or process according to a control instruction of the NFVO to manage and configure the access node; The second virtual configuration package is used to execute a script or process according to a control instruction of the NFVO to manage and configure the accessed node; The first VIM and the second VIM are used to control the underlying network, computing infrastructure and storage infrastructure to build a VPN.

2. A VPN network system based on quantum key technology according to claim 1, characterized in that: The first virtual configuration package is further used to create a connection between the first virtual router and the server of the access node, and grant the first virtual router access to the first QKD module; The second virtual configuration package is also used to create a connection between the second virtual router and the server of the visited node, granting the second virtual router access to the second QKD module.

3. A VPN network system based on quantum key technology according to claim 2, characterized in that: The first virtual configuration package is further used to configure the first virtual router, obtain the first key generated by the first QKD module through the first virtual router, and send the first key to the visited node through the VPN channel; The second virtual configuration package is further used to configure the second virtual router and send the first key to the second QKD module through the second virtual router; The first QKD module and the second QKD module are used to determine a target transmission key by performing quantum key distribution according to the first key through the first virtual router and the second virtual router.

4. A VPN network system based on quantum key technology according to claim 3, characterized in that: The first virtual configuration package and the second virtual configuration package are further used to configure IP layer operation information of the first virtual router and the second virtual router respectively; the IP layer operation information includes routing table, port mapping, NAT and IPsec policy.

5. The VPN network system based on quantum key technology according to claim 1, characterized in that: The first VIM and the second VIM are deployed on a Docker container platform and are used to create a virtual network using containers and Open VSwitches.

6. A VPN network system based on quantum key technology according to claim 1, characterized in that: The node configuration information includes gateway and routing configuration, preset installation packages, and initialization parameters of internal services.

Images