Method and system for encrypting and decrypting network session data stream using quantum key distribution

Abstract

The present invention discloses a method and system for implementing encryption and decryption of network session data streams by using quantum key distribution, including reading a master key from a connected secure storage medium, establishing a master key pool, and using a key bitmap to indicate whether the master key has been used; encrypting an outbound data message using a data encryption key to obtain an encrypted data message; based on the key bitmap, randomly selecting an unused master key from the master key pool, and putting the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID into the secure message header of the encrypted data message to obtain an outbound encrypted message; sending the outbound encrypted message from a network interface connected to an external network. The present invention solves the problem that an encryption gateway cannot negotiate session keys for data streams of different network sessions under complex network environments such as bidirectional NAT, and the key synchronization problem of one session (stream) and one key.

Description

Technical Field

[0001] The present invention relates to the field of cryptographic application technology, and in particular to a method and system for implementing encryption and decryption of network session data streams by using quantum key distribution. Background Art

[0002] The concept of network session generally refers to the five-tuple of network data packets, that is, the network connection uniquely identified by the source IP address, destination IP address, protocol number, source transport layer port, and destination transport layer port number. The network session data flow is the network data flow uniquely identified by the five-tuple of the network session. Network sessions and network session data flows have a certain life cycle, which exist during the duration of the user network service associated with the session and are closed or destroyed after the associated user network service is terminated.

[0003] At present, when the local area networks of various branches are interconnected, the network session data flows of different services are transmitted through secure encrypted channels established by encryption gateways such as VPN devices. Before the network session data flows are transmitted, key exchange protocols such as IKE are required between encryption gateways to negotiate the session keys used by different network data flows. This model has the following problems:

[0004] (1) There needs to be a communication channel between encryption gateways for direct key negotiation, which is difficult to implement in complex network environments such as NAT, especially when the gateways at both ends of the communication need to be NATed before they can access the Internet.

[0005] (2) The negotiation process is relatively complex and has certain computational and communication costs. Therefore, the generated session key is generally used for a period of time, and multiple network sessions use the same key. From a security perspective, it is impossible to ensure that each network session has a unique key.

[0006] (3) The key negotiation process is based on asymmetric key pairs and digital certificates. The public key used to encrypt and transmit session key materials is public. If different session keys are used for different network sessions, the frequency of key negotiation and public-private key pairs will be too high. As the computing power of quantum computers increases, there is a possibility that they may be cracked, resulting in the session keys to be transmitted being cracked and stolen.

[0007] In the related art, the Chinese invention patent document with publication number CN107453869A records a method for realizing quantum-safe IPSecVPN, by adding a QKD security interface to the IPSec VPN gateway, adding a quantum key access and application mechanism to the IPSec VPN security policy, adding a quantum key-based one-time encryption option to the IPSec encryption component, and adding a strategy of preferentially using quantum keys as pre-shared keys, session keys for data encryption algorithms, and shared keys for HMAC algorithms; realizing the integrated application of QKD and quantum encryption with the IPSec protocol, and improving the quantum security of identity authentication, message identification, and data encryption of the IPSecVPN system.

[0008] However, this solution requires key negotiation, and the network topology is complex; and the pre-shared key is directly used as the encryption key, and the key security is relatively low.

[0009] The Chinese invention patent document with publication number CN114338019A records a network communication method, system, device and storage medium based on quantum key distribution. The method includes: the terminal agent on the user device sends a dynamic port request to the gateway; the gateway sends a quantum random number request to the quantum key distribution server based on the dynamic port request; the quantum key distribution server generates a pair of quantum random numbers based on the quantum random number request, and sends one to the terminal agent and the other to the gateway to trigger the terminal agent and the gateway to determine the same dynamic port number based on the quantum random number; the terminal agent and the gateway perform data communication on the port corresponding to the dynamic port number to obtain the target data resource. The main features of this scheme are: (1) generating a dynamic port for the user terminal to access the gateway based on the quantum random number; (2) encrypting and protecting the communication between the user terminal and the gateway based on the pre-stored quantum key one-packet-one-key. Summary of the invention

[0010] The technical problem to be solved by the present invention is how to achieve key synchronization for end-to-end encrypted communication of network session data streams between different local area networks through an encryption gateway.

[0011] The present invention solves the above technical problems through the following technical means:

[0012] The present invention proposes a method for implementing encryption and decryption of network session data streams by using quantum key distribution, which is applied to an encryption gateway, wherein the encryption gateway is connected to a secure storage medium, and the method comprises:

[0013] Read a master key from the connected secure storage medium, establish a master key pool, and use a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by the quantum key distribution network;

[0014] Obtaining an outbound data message from a network interface connected to an intranet, and encrypting the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time;

[0015] Based on the key bitmap, randomly select the unused master key from the master key pool, and put the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message;

[0016] The outbound encrypted message is sent from a network interface connected to an external network.

[0017] The present invention deploys encryption gateways at different local area network entrances and exits, and solves the problem that the encryption gateway cannot negotiate session keys for data streams of different network sessions and the key synchronization problem of one session (stream) one key under complex network environments such as bidirectional NAT by using a large-capacity master key generated by a quantum key distribution system in the encryption gateway and using a one-time master key for data streams of different network sessions. The data encryption key actually used is one package and one key generated in real time, which has stronger key security than directly using a pre-stored key. The pre-filled key is used to protect the actual data encryption key and is a key protection key. A network session data stream uses an exclusive master key to protect the data encryption key, which becomes invalid when the master key is used up, and has forward and backward security. In addition, based on the pre-filled master key, the data ciphertext and the key ciphertext of the encrypted data are transmitted together in a digital envelope, which has strong adaptability and fault tolerance. Therefore, the present solution can enhance the security of network session data stream transmission when local area networks are interconnected, and realize end-to-end key synchronization and encrypted communication protection for network session data streams between different local area networks using an encryption gateway.

[0018] Further, when performing one-stream-one-key encryption processing on the outbound data message, the unused master key is randomly selected from the master key pool based on the key bitmap, and the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID identifier are placed in the security message header of the encrypted data message to obtain the outbound encrypted message, which also includes:

[0019] For the outbound data message, a data flow table is established according to the data flow determined by the five-tuple, and the data flow table is associated with the ID identifier of the master key in the master key pool, and the key bitmap of the master key is marked as occupied;

[0020] For subsequent data packets after the first packet of the same data stream, the data encryption key is encrypted by using the master key ID identifier associated with the data stream table.

[0021] Further, after establishing a data flow table for the outbound data message according to the data flow determined by the quintuple, the method further includes:

[0022] Establishing a timeout for each entry in the data flow table;

[0023] When an entry is not accessed within the timeout period, the entry is deleted and the key is updated based on the master key associated with it.

[0024] Further, the key update based on the associated master key includes:

[0025] The ID of the master key is encrypted using the master key associated with it to obtain a key update request;

[0026] Sending the key update request to the quantum key distribution network so that the quantum key distribution network generates a key update message, wherein the key update message includes a key ciphertext obtained by encrypting a new master key and its ID identifier using the master key originally associated with the entry and the ID identifier of the new master key;

[0027] Receive the key update message, and use the master key originally associated with the entry to decrypt the key ciphertext to obtain the ID of the new master key;

[0028] When the ID identification of the new master key is compared correctly, the new master key is used to replace the master key originally associated with the entry, and the key bitmap of the new master key is marked as unused.

[0029] Further, after obtaining the outbound data message from the network interface connected to the intranet, the method further includes:

[0030] Determine whether the data length MSS of the outbound data message exceeds the length of the maximum data portion allowed to be transmitted;

[0031] If yes, modify the data length of the outbound data message MSS=MSS-4-n, where n is the length of the key or initialization vector;

[0032] If not, the outbound data message is encrypted using the data encryption key to obtain an encrypted data message.

[0033] Furthermore, before sending the outbound encrypted message from the network interface connected to the external network, the method further includes:

[0034] Determine whether the outbound encrypted message exceeds the MTU;

[0035] If yes, the outbound encrypted message is fragmented;

[0036] If not, the outbound encrypted message is sent from the network interface connected to the external network.

[0037] Furthermore, before reading the master key from the secure storage medium, the method further includes:

[0038] Sending a registration request to the control platform to bind to a corresponding security domain, the security domain being divided by the control platform;

[0039] Sending a key injection request to the control platform, so that the control platform forwards the key injection request to the quantum key distribution network, where the quantum key distribution network stores security domain division information and encryption gateway information in each security domain;

[0040] The master key is injected offline into the secure storage medium through a key agent or a quantum network node, and the ID identifier of the master key injected into the secure storage medium connected to each encryption gateway in the same security domain is the same.

[0041] Furthermore, when the encryption gateway is used as a receiving end, after receiving the outbound encrypted message from the network interface connected to the external network, it also includes:

[0042] Determining whether the outbound encrypted message is a fragmented message;

[0043] If yes, then the pieces are combined;

[0044] If not, selecting a master key corresponding to the master key ID from the master key pool to decrypt the ciphertext to obtain the data encryption key;

[0045] The encrypted data message is decrypted using the data encryption key.

[0046] In addition, the present invention also proposes a gateway for implementing encryption and decryption of network session data streams using quantum key distribution, the gateway comprising a data encryption and decryption processing module and a key injection module, the key injection module being connected to a secure storage medium, the secure storage medium storing a master key pre-filled by a quantum key distribution network;

[0047] The key injection module is used to read a master key from a connected secure storage medium, establish a master key pool, and use a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by a quantum key distribution network;

[0048] The data encryption and decryption processing module is used to obtain an outbound data message from a network interface connected to the intranet, and encrypt the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time;

[0049] And, for randomly selecting an unused master key from the master key pool based on the key bitmap, and putting the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message;

[0050] And, used to send the outbound encrypted message from the network interface connected to the external network.

[0051] Furthermore, the gateway further includes a flow table management module, wherein:

[0052] The flow table management module is used to establish a data flow table for the outbound data message according to the data flow determined by the quintuple, associate the data flow table with the ID identifier of the master key in the master key pool, and mark the key bitmap of the master key as occupied;

[0053] The data encryption and decryption processing module is also used to retrieve the master key ID associated with the data stream table for subsequent data packets after the first packet of the same data stream, and use the master key corresponding to the ID to encrypt the data encryption key.

[0054] Furthermore, the gateway further includes a key update module, wherein:

[0055] The key updating module is used to establish a timeout period for each table item in the data flow table, and when a table item is not accessed within the timeout period, the table item is deleted, and the key is updated based on the master key associated with the table item.

[0056] In addition, the present invention also proposes a system for implementing network session data stream encryption and decryption using quantum key distribution, the system comprising a first encryption gateway, a second encryption gateway, a management and control platform, and a quantum key distribution network, the first encryption gateway, the second encryption gateway, and the quantum key distribution network are all connected to the management and control platform, the first encryption gateway and the second encryption gateway are both connected to the quantum key distribution network, wherein the first encryption gateway and the second encryption gateway each comprise a data encryption and decryption processing module and a key injection module, the key injection module is connected to a secure storage medium, and the secure storage medium stores a master key pre-filled by the quantum key distribution network;

[0057] The management and control platform is used for performing security domain division, and registration and identity binding services for the first encryption gateway and the second encryption gateway;

[0058] The quantum key distribution network is used to pre-fill the secure storage medium with a master key;

[0059] The key injection module is used to read a master key from a connected secure storage medium, establish a master key pool, and use a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by a quantum key distribution network;

[0060] The data encryption and decryption processing module is used to obtain an outbound data message from a network interface connected to the intranet, and encrypt the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time;

[0061] And, for randomly selecting an unused master key from the master key pool based on the key bitmap, and putting the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message;

[0062] And, used to send the outbound encrypted message from the network interface connected to the external network.

[0063] The advantages of the present invention are:

[0064] (1) The present invention deploys encryption gateways at different local area network entrances and exits. By using a large-capacity master key generated by a quantum key distribution system in the encryption gateway and using a one-time master key for the data streams of different network sessions, the problem that the encryption gateway cannot negotiate session keys for the data streams of different network sessions in complex network environments such as bidirectional NAT and the key synchronization problem of one session (stream) and one key is solved. The data encryption key actually used is one packet and one key generated in real time. Compared with directly using pre-stored keys, it has stronger key security. The pre-filled key is used to protect the actual data encryption key and is a key protection key. A network session data stream uses an exclusive master key to protect the data encryption key, which becomes invalid after the master key is used up, and has forward and backward security. In addition, based on the pre-filled master key, the data ciphertext and the key ciphertext of the encrypted data are transmitted together in a digital envelope, which has strong adaptability and fault tolerance. Therefore, the present solution can enhance the security of network session data stream transmission when local area networks are interconnected, and realize the end-to-end key synchronization and encrypted communication protection of network session data streams between different local area networks using encryption gateways.

[0065] (2) The master key is not reused and is regularly updated online through an encrypted channel, which can ensure the safe use and timely update of a large number of keys.

[0066] (3) The master key is synchronized among all encryption gateways in the same security domain that can be interconnected. The key is retrieved by a key ID with a unified number. There is no need for complex security policy configuration and key distribution mechanism. It is simple and flexible to achieve full-domain encrypted communication within the security domain without reducing security.

[0067] (4) It solves the problem of secure communication and key update when the encryption gateways do not directly exchange key information, which can significantly reduce the related interactive information of session-based network data flow encryption and decryption.

[0068] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0069] Figure 1 It is a flowchart of a method for implementing encryption and decryption of network session data streams by using quantum key distribution proposed in the first embodiment of the present invention;

[0070] Figure 2 2. It is a schematic diagram of the structure of a gateway for implementing encryption and decryption of network session data streams using quantum key distribution, as proposed in the second embodiment of the present invention;

[0071] Figure 3 2 is a schematic diagram of a structure of a system for implementing encryption and decryption of network session data streams using quantum key distribution, as proposed in the third embodiment of the present invention;

[0072] Figure 4 It is a schematic diagram of the workflow of a system for encrypting and decrypting network session data streams using quantum key distribution, as proposed in the third embodiment of the present invention. DETAILED DESCRIPTION

[0073] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0074] Example 1

[0075] like Figure 1As shown, the first embodiment of the present invention proposes a method for implementing network session data stream encryption and decryption using quantum key distribution, which is applied to an encryption gateway, and the encryption gateway is connected to a secure storage medium. The method includes the following steps:

[0076] S101, reading a master key from a connected secure storage medium, establishing a master key pool, and using a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by a quantum key distribution network;

[0077] It should be noted that the format of the master key is 4-byte key ID + n-byte key and n-byte initialization vector, n is related to the encryption algorithm, and all devices in the same security domain share the same master key identified by the same key ID.

[0078] S102, obtaining an outbound data message from a network interface connected to the intranet, and encrypting the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time;

[0079] S103. Based on the key bitmap, randomly select an unused master key from the master key pool, and put the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message;

[0080] It should be noted that the encryption gateway uses the data encryption key to perform one-stream and one-key encryption processing on outbound data messages, that is, the same master key is used for the data stream uniquely identified by the five-tuple (source and destination IP addresses, protocol number, source and destination transport layer port number), and the data encryption key is a random number generated in real time. The encryption mode is CBC (integer multiples of the algorithm grouping) + CFB (the remainder other than the integer multiples of the algorithm grouping). A security message header is attached to each data message, and the data encryption key is encrypted with the pre-filled master key and then placed in the message header. The master key is randomly selected from the master key pool and is not used, and the selected key bitmap is marked as used.

[0081] S104: Send the outbound encrypted message from the network interface connected to the external network.

[0082] This embodiment deploys encryption gateways at different local area network entrances and exits. By using a large-capacity master key generated by a quantum key distribution system in the encryption gateway and using a one-time master key for data streams of different network sessions, the problem that the encryption gateway cannot negotiate session keys for data streams of different network sessions in complex network environments such as bidirectional NAT and the key synchronization problem of one key for one session (stream) are solved. The data encryption key actually used is generated in real time with one package and one key. Compared with directly using pre-stored keys, it has stronger key security. The pre-charged key is used to protect the actual data encryption key, which is a key protection key. The network session data stream uses an exclusive master key to protect the data encryption key. The master key becomes invalid after use, and has forward and backward security. The advantage of the multi-layer key system is that it protects layer by layer, and cracking must be done layer by layer, so the difficulty of cracking increases accordingly. In addition, based on the pre-filled master key, the data ciphertext and the key ciphertext of the encrypted data are transmitted together in a digital envelope, which has strong adaptability and fault tolerance. Therefore, this solution can enhance the security of network session data stream transmission when LANs are interconnected, and realize the end-to-end key synchronization and encrypted communication protection of network session data streams between different LANs using encryption gateways.

[0083] In one embodiment, when performing one-stream-one-key encryption processing on the outbound data message, the unused master key is randomly selected from the master key pool based on the key bitmap, and the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID identifier are placed in the security message header of the encrypted data message to obtain the outbound encrypted message, and the following steps are also included:

[0084] For the outbound data message, a data flow table is established according to the data flow determined by the five-tuple, and the data flow table is associated with the ID identifier of the master key in the master key pool, and the key bitmap of the master key is marked as occupied;

[0085] For subsequent data packets after the first packet of the same data stream, the data encryption key is encrypted by using the master key ID identifier associated with the data stream table.

[0086] In one embodiment, after establishing a data flow table for the outbound data message according to the data flow determined by the quintuple, the method further comprises the following steps:

[0087] Establishing a timeout for each entry in the data flow table;

[0088] When an entry is not accessed within the timeout period, the entry is deleted and the key is updated based on the master key associated with it.

[0089] In one embodiment, the updating of the key based on the associated master key includes:

[0090] The ID of the master key is encrypted using the master key associated with it to obtain a key update request;

[0091] Sending the key update request to the quantum key distribution network so that the quantum key distribution network generates a key update message, wherein the key update message includes a key ciphertext obtained by encrypting a new master key and its ID identifier using the master key originally associated with the entry and the ID identifier of the new master key;

[0092] Receive the key update message, and use the master key originally associated with the entry to decrypt the key ciphertext to obtain the ID of the new master key;

[0093] When the ID identification of the new master key is compared correctly, the new master key is used to replace the master key originally associated with the entry, and the key bitmap of the new master key is marked as unused.

[0094] In this embodiment, each entry in the data flow table represents a data flow, and a timeout period is established for it. When the data flow table entry is not accessed within the timeout period, the data flow table entry is deleted and the update process of the associated master key is started: the master key ID number is encrypted with the master key, and a key update request is issued to the quantum key distribution system QKD. The request includes both the plaintext and ciphertext master key ID numbers. After QKD decrypts and compares the master key ID number, if it is correct, a key update message is generated and sent to all encryption gateway device nodes in the domain. The key update message includes the new master key and master key ID encrypted with the old master key, as well as the plaintext master key ID. After receiving the key update message, the encryption gateway device node decrypts with the old key and compares the master key ID number. If it is correct, the new key replaces the old key and marks it as unused.

[0095] Furthermore, in order to reduce traffic overhead, QKD can accumulate a certain number of key update messages and send them in batches.

[0096] This embodiment uses the master key for the network session data stream defined by the five-tuple. One data stream corresponds to one master key. The encryption status of the data stream is related to the master key it uses. The master key is not reused and must be updated online. The master key is not reused and is updated online regularly through an encrypted channel, which can ensure the safe use and timely update of a large number of keys.

[0097] In one embodiment, after the step S102: obtaining the outbound data message from the network interface connected to the intranet, the method further includes the following steps:

[0098] Determine whether the data length MSS of the outbound data message exceeds the length of the maximum data portion allowed to be transmitted;

[0099] If yes, modify the data length of the outbound data message MSS=MSS-4-n, where n is the length of the key or initialization vector;

[0100] If not, the outbound data message is encrypted using the data encryption key to obtain an encrypted data message.

[0101] It should be noted that the encryption gateway device node modifies the MSS data content in the outbound TCP connection establishment phase, and the new MSS = MSS-4-n, in order to avoid further fragmentation of the message after adding the security message header.

[0102] In one embodiment, before the step S104: sending the outbound encrypted message from the network interface connected to the external network, the method further includes the following steps:

[0103] Determine whether the outbound encrypted message exceeds the MTU;

[0104] If yes, the outbound encrypted message is fragmented;

[0105] If not, the outbound encrypted message is sent from the network interface connected to the external network.

[0106] It should be noted that if the length of a non-TCP message exceeds the MTU after the security message header is added, fragmentation is performed.

[0107] In one embodiment, before step S101, the method further includes the following steps:

[0108] Sending a registration request to the control platform to bind to a corresponding security domain, the security domain being divided by the control platform;

[0109] Sending a key injection request to the control platform, so that the control platform forwards the key injection request to the quantum key distribution network, where the quantum key distribution network stores security domain division information and encryption gateway information in each security domain;

[0110] The master key is injected offline into the secure storage medium through a key agent or a quantum network node, and the ID identifier of the master key injected into the secure storage medium connected to each encryption gateway in the same security domain is the same.

[0111] In one embodiment, when the encryption gateway serves as a receiving end, the method further includes:

[0112] Receiving the outbound encrypted message from a network interface connected to an external network;

[0113] Determining whether the outbound encrypted message is a fragmented message;

[0114] If yes, then the pieces are combined;

[0115] If not, selecting a master key corresponding to the master key ID from the master key pool to decrypt the ciphertext to obtain the data encryption key;

[0116] The encrypted data message is decrypted using the data encryption key.

[0117] In this embodiment, the data encryption key is randomly generated in real time by the encryption gateway in a one-pack-one-key manner and securely transmitted to other encryption gateways together with the data. There is no end-to-end correspondence between the encryption gateways. The security domain is used as the boundary and the master key ID is used as the index of the key protection key. The encryption gateways in the domain share a large-capacity master key and update it online, thereby realizing the free and secure flow of network session data streams between the encryption gateways.

[0118] Example 2

[0119] like Figure 2 As shown, the second embodiment of the present invention proposes a gateway for implementing network session data stream encryption and decryption using quantum key distribution, the gateway comprising a data encryption and decryption processing module 11 and a key injection module 12, the key injection module 12 is connected to a secure storage medium, the secure storage medium stores a master key pre-filled by a quantum key distribution network 4;

[0120] The key injection module 12 is used to read a master key from a connected secure storage medium, establish a master key pool, and use a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by the quantum key distribution network 4;

[0121] The data encryption and decryption processing module 11 is used to obtain an outbound data message from a network interface connected to the intranet, and encrypt the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time;

[0122] And, based on the key bitmap, randomly select the unused master key from the master key pool, and put the ciphertext obtained by encrypting the data encryption key with the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message;

[0123] And, sending the outbound encrypted message from a network interface connected to an external network.

[0124] This embodiment deploys encryption gateways at different local area network entrances and exits, and solves the problem that the encryption gateway cannot negotiate session keys for data streams of different network sessions in complex network environments such as bidirectional NAT by using a large-capacity master key generated by a quantum key distribution system and a one-time master key for data streams of different network sessions, as well as the key synchronization problem of one session (stream) and one key. The data encryption key actually used is one package and one key generated in real time, which has stronger key security than directly using pre-stored keys. The pre-filled key is used to protect the actual data encryption key, which is a key protection key. A network session data stream uses an exclusive master key to protect the data encryption key, which becomes invalid when the master key is used up, and has forward and backward security. In addition, based on the pre-filled master key, the data ciphertext and the key ciphertext of the encrypted data are transmitted together in a digital envelope, realizing one package and one key, which has strong adaptability and fault tolerance. Therefore, this solution can enhance the security of network session data stream transmission when local area networks are interconnected, and realize end-to-end key synchronization and encrypted communication protection for network session data streams between different local area networks using encryption gateways.

[0125] In one embodiment, the gateway further includes a flow table management module 13, wherein:

[0126] The flow table management module 13 is used to establish a data flow table for the outbound data message according to the data flow determined by the quintuple, associate the data flow table with the ID identifier of the master key in the master key pool, and mark the key bitmap of the master key as occupied;

[0127] The data encryption and decryption processing module 11 is also used to retrieve the master key ID associated with the data flow table for subsequent data packets after the first packet of the same data flow, and use the master key corresponding to the ID to encrypt the data encryption key.

[0128] In one embodiment, the gateway further includes a key update module 14, wherein:

[0129] The key updating module 14 is used to establish a timeout period for each entry in the data flow table, and when a certain entry is not accessed within the timeout period, the entry is deleted, and the key is updated based on the master key associated with the entry.

[0130] Furthermore, the key updating module 14 is specifically configured to perform the following steps:

[0131] The ID of the master key is encrypted using the master key associated with it to obtain a key update request;

[0132] Sending the key update request to the quantum key distribution network 4 so that the quantum key distribution network 4 generates a key update message, wherein the key update message includes a key ciphertext obtained by encrypting a new master key and its ID identifier using the master key originally associated with the entry and the ID identifier of the new master key;

[0133] Receive the key update message, and use the master key originally associated with the entry to decrypt the key ciphertext to obtain the ID of the new master key;

[0134] When the ID identification of the new master key is compared correctly, the new master key is used to replace the master key originally associated with the entry, and the key bitmap of the new master key is marked as unused.

[0135] This embodiment uses the master key for the network session data stream defined by the five-tuple. One data stream corresponds to one master key. The encryption status of the data stream is related to the master key it uses. The master key is not reused and must be updated online. The master key is not reused and is updated online regularly through an encrypted channel, which can ensure the safe use and timely update of a large number of keys.

[0136] In one embodiment, the gateway further includes:

[0137] A data length determination module, used to determine whether the data length MSS of the outbound data message exceeds the length of the maximum data portion allowed to be transmitted;

[0138] A data length modification module, used to modify the data length MSS=MSS-4-n of the outbound data message when the output result of the data length judgment module is yes, where n is the length of the key or the initialization vector;

[0139] The data encryption and decryption processing module 11 is used to encrypt the outbound data message using the data encryption key to obtain an encrypted data message when the output result of the data length judgment module is no.

[0140] It should be noted that the encryption gateway device node modifies the MSS data content in the outbound TCP connection establishment phase, and the new MSS = MSS-4-n, in order to avoid further fragmentation of the message after adding the security message header.

[0141] In one embodiment, the gateway further includes:

[0142] A message length determination module, used to determine whether the outbound encrypted message exceeds the MTU;

[0143] A fragmentation processing module, used for fragmenting the outbound encrypted message when the message length judgment module outputs a yes result;

[0144] The data encryption and decryption processing module 11 is further configured to send the outbound encrypted message from the network interface connected to the external network when the message length judgment module outputs a negative result.

[0145] It should be noted that if the length of a non-TCP message exceeds the MTU after the security message header is added, fragmentation is performed.

[0146] In one embodiment, the gateway further includes:

[0147] A registration module, used to send a registration request to the control platform 3 to bind to a corresponding security domain, the security domain being divided by the control platform 3;

[0148] A key injection request module is used to send a key injection request to the control platform 3, so that the control platform 3 forwards the key injection request to the quantum key distribution network 4. The quantum key distribution network 4 injects the master key into the secure storage medium offline through a key agent or a quantum network node, and the ID identifier of the master key injected into the secure storage medium connected to each encryption gateway in the same security domain is the same; the quantum key distribution network 4 stores security domain division information and encryption gateway information in each security domain.

[0149] It should be noted that other embodiments or implementation methods of the present invention for implementing a network session data stream encryption and decryption gateway using quantum key distribution can refer to the above-mentioned method embodiments, which will not be repeated here.

[0150] Example 3

[0151] like Figure 3 As shown, the third embodiment of the present invention further proposes a system for implementing network session data stream encryption and decryption using quantum key distribution, the system comprising a first encryption gateway 1, a second encryption network 2, a management and control platform 3 and a quantum key distribution network 4, the first encryption gateway 1, the second encryption network 2 and the quantum key distribution network 4 are all connected to the management and control platform 3, the first encryption gateway 1 and the second encryption network 2 are all connected to the quantum key distribution network 4, wherein the first encryption gateway 1 and the second encryption network 2 both comprise a data encryption and decryption processing module 11 and a key injection module 12, the key injection module 12 is connected to a secure storage medium, the secure storage medium stores a master key pre-filled by the quantum key distribution network 4;

[0152] The management and control platform 3 is used for performing security domain division, and registration and identity binding services for the first encryption gateway 1 and the second encryption network 2;

[0153] The quantum key distribution network 4 is used to pre-fill the secure storage medium with a master key;

[0154] The key injection module 12 is used to read a master key from a connected secure storage medium, establish a master key pool, and use a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by the quantum key distribution network 4;

[0155] The data encryption and decryption processing module 11 is used to obtain an outbound data message from a network interface connected to the intranet, and encrypt the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time;

[0156] And, based on the key bitmap, randomly select the unused master key from the master key pool, and put the ciphertext obtained by encrypting the data encryption key with the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message;

[0157] And, sending the outbound encrypted message from a network interface connected to an external network.

[0158] This embodiment deploys encryption gateways at different local area network entrances and exits, and solves the problem that the encryption gateway cannot negotiate session keys for data streams of different network sessions in complex network environments such as bidirectional NAT by using a large-capacity master key generated by a quantum key distribution system and a one-time master key for data streams of different network sessions, as well as the key synchronization problem of one session (stream) and one key. The data encryption key actually used is one package and one key generated in real time, which has stronger key security than directly using pre-stored keys. The pre-filled key is used to protect the actual data encryption key, which is a key protection key. A network session data stream uses an exclusive master key to protect the data encryption key, which becomes invalid when the master key is used up, and has forward and backward security. In addition, based on the pre-filled master key, the data ciphertext and the key ciphertext of the encrypted data are transmitted together in a digital envelope, realizing one package and one key, which has strong adaptability and fault tolerance. Therefore, this solution can enhance the security of network session data stream transmission when local area networks are interconnected, and realize end-to-end key synchronization and encrypted communication protection for network session data streams between different local area networks using encryption gateways.

[0159] Specifically in this embodiment, the encryption gateway is used to encrypt and decrypt user session data streamed through the network, and is composed of modules such as data encryption and decryption processing, data flow table, key update, and key injection;

[0160] Management and control platform 3: used to provide the corresponding relationship between encryption gateways, key agents, and quantum network nodes, divide security domains, and provide encryption gateway registration and identity binding services;

[0161] Key agent: used to provide agent functions of key injection and online key distribution when the nodes of the quantum key distribution network 4 cannot directly provide key injection and online key distribution services;

[0162] Quantum key distribution network 4: includes quantum network nodes and quantum network link control center, realizing quantum key generation and online distribution, quantum key relay, quantum key provision and other services;

[0163] Quantum network node: used to store generated quantum keys, receive key applications from key agents, provide keys to key agents or directly provide key injection and key online distribution services;

[0164] Quantum network link control center: can establish quantum key distribution and relay links between nodes according to quantum network node ID.

[0165] It should be noted that the quantum key distribution device in this embodiment includes but is not limited to the QKD key distribution network, and the key pre-injection and online key distribution functions involved in the present invention can be implemented using any symmetric key management system and device.

[0166] In one embodiment, the gateway further includes a flow table management module 13, wherein:

[0167] The flow table management module 13 is used to establish a data flow table for the outbound data message according to the data flow determined by the quintuple, associate the data flow table with the ID identifier of the master key in the master key pool, and mark the key bitmap of the master key as occupied;

[0168] The data encryption and decryption processing module 11 is also used to retrieve the master key ID associated with the data flow table for subsequent data packets after the first packet of the same data flow, and use the master key corresponding to the ID to encrypt the data encryption key.

[0169] In one embodiment, the gateway further includes a key update module 14, wherein:

[0170] The key updating module 14 is used to establish a timeout period for each entry in the data flow table, and when a certain entry is not accessed within the timeout period, the entry is deleted, and the key is updated based on the master key associated with the entry.

[0171] Furthermore, the key updating module 14 is specifically configured to perform the following steps:

[0172] The ID of the master key is encrypted using the master key associated with it to obtain a key update request;

[0173] Sending the key update request to the quantum key distribution network 4 so that the quantum key distribution network 4 generates a key update message, wherein the key update message includes a key ciphertext obtained by encrypting a new master key and its ID identifier using the master key originally associated with the entry and the ID identifier of the new master key;

[0174] Receive the key update message, and use the master key originally associated with the entry to decrypt the key ciphertext to obtain the ID of the new master key;

[0175] When the ID identification of the new master key is compared correctly, the new master key is used to replace the master key originally associated with the entry, and the key bitmap of the new master key is marked as unused.

[0176] This embodiment uses the master key for the network session data stream defined by the five-tuple. One data stream corresponds to one master key. The encryption status of the data stream is related to the master key it uses. The master key is not reused and must be updated online. The master key is not reused and is updated online regularly through an encrypted channel, which can ensure the safe use and timely update of a large number of keys.

[0177] In one embodiment, the gateway further includes:

[0178] A data length determination module, used to determine whether the data length MSS of the outbound data message exceeds the length of the maximum data portion allowed to be transmitted;

[0179] A data length modification module, used to modify the data length MSS=MSS-4-n of the outbound data message when the output result of the data length judgment module is yes, where n is the length of the key or the initialization vector;

[0180] The data encryption and decryption processing module 11 is used to encrypt the outbound data message using the data encryption key to obtain an encrypted data message when the output result of the data length judgment module is no.

[0181] It should be noted that the encryption gateway device node modifies the MSS data content in the outbound TCP connection establishment phase, and the new MSS = MSS-4-n, in order to avoid further fragmentation of the message after adding the security message header.

[0182] In one embodiment, the gateway further includes:

[0183] A message length determination module, used to determine whether the outbound encrypted message exceeds the MTU;

[0184] A fragmentation processing module, used for fragmenting the outbound encrypted message when the message length judgment module outputs a yes result;

[0185] The data encryption and decryption processing module 11 is further configured to send the outbound encrypted message from the network interface connected to the external network when the message length judgment module outputs a negative result.

[0186] It should be noted that if the length of a non-TCP message exceeds the MTU after the security message header is added, fragmentation is performed.

[0187] In one embodiment, the gateway further includes:

[0188] A registration module, used to send a registration request to the control platform 3 to bind to a corresponding security domain, the security domain being divided by the control platform 3;

[0189] A key injection request module is used to send a key injection request to the control platform 3, so that the control platform 3 forwards the key injection request to the quantum key distribution network 4. The quantum key distribution network 4 injects the master key into the secure storage medium offline through a key agent or a quantum network node, and the ID identifier of the master key injected into the secure storage medium connected to each encryption gateway in the same security domain is the same; the quantum key distribution network 4 stores security domain division information and encryption gateway information in each security domain.

[0190] If necessary, Figure 4 As shown, the workflow of the network session data stream encryption and decryption system using quantum key distribution proposed in this embodiment is as follows:

[0191] (1) The control platform defines the security domain, and through the quantum key distribution network QKD, uses a large-capacity secure storage medium such as a secure TF card or a secure U shield to pre-charge a large number of master keys offline to each encryption gateway device node in the security domain, establish a master key pool, and use a key bitmap to indicate whether the key has been used. All devices in the same security domain share the same master key identified by the same key ID;

[0192] The key format is 4-byte key ID + n-byte key and n-byte initialization vector, where n is related to the encryption algorithm.

[0193] (2) The encryption gateway device node modifies the MSS data content of the outbound TCP connection establishment phase, and the new MSS = MSS-4-n, to avoid message fragmentation after adding the security message header.

[0194] (3) The encryption gateway device node uses the data encryption key to perform one-stream one-key encryption processing on the outbound network session data message, that is, the same master key is used for the data stream uniquely identified by the five-tuple (source and destination IP addresses, protocol number, source and destination transport layer port number). The data encryption key is a random number generated in real time, and the encryption mode is CBC (integer multiples of the algorithm grouping) + CFB (the remainder other than the integer multiples of the algorithm grouping); and a security message header is attached to each data message, and the data encryption key is encrypted with the pre-filled master key and then placed in the message header. The master key is randomly selected from the master key pool and has not been used. The selected key bitmap is marked as used. The security header format is: 4-byte key ID + n-byte key ciphertext (n is related to the encryption algorithm).

[0195] (4) The encryption gateway device node establishes a flow table for the new outbound data message according to the data flow uniquely identified by its five-tuple (source and destination IP addresses, protocol number, source and destination transport layer port number), and associates it with the master key ID. Subsequent data messages after the first packet of the same data flow are processed using the same master key by retrieving the associated master key ID in the data flow table.

[0196] (5) If the non-TCP message plus the security message header exceeds the MTU, it will be fragmented.

[0197] (6) The encryption gateway device node decrypts the incoming data message (fragmented messages are first merged), takes out the key and initialization vector from the master key pool according to the key ID of the security message header, decrypts the data encryption key, and then decrypts the message data.

[0198] Furthermore, the workflow also includes establishing a timeout period for each entry in the data flow table to represent a data flow. When the data flow table entry is not accessed within the timeout period, the data flow table entry is deleted and the update process of the associated master key is started: the master key ID number is encrypted with the master key, and a key update request is sent to the QKD. The request includes both the plaintext and ciphertext master key ID numbers. After QKD decrypts and compares the master key ID number, if it is correct, a key update message is generated and sent to all encryption gateway device nodes in the domain. The key update message includes the new master key and master key ID encrypted with the old master key, as well as the plaintext master key ID. After receiving the key update message, the encryption gateway device node decrypts with the old key and compares the master key ID number. If it is correct, the new key replaces the old key and marks it as unused.

[0199] This embodiment uses an encryption gateway that integrates quantum key distribution to solve the transmission protection problem of network session data streams, and implements a data stream encryption solution for handshake-free network communication sessions that cannot be solved by traditional asymmetric cryptography and IKE protocols, avoiding the security risks of the handshake process. Different from the technology of key negotiation based on public key cryptography, a network session security communication method that realizes one-class one-key based on a large-capacity symmetric pre-shared key provided by quantum key distribution technology is constructed; it solves the problem of secure intercommunication and key update when the encryption gateway does not directly exchange key information, and can significantly reduce the relevant interactive information of session-based network data stream encryption and decryption.

[0200] In this solution, the data encryption key is randomly generated in real time by the encryption gateway in a one-pack-one-key manner and securely transmitted to other encryption gateways together with the data. There is no end-to-end correspondence between the encryption gateways. The security domain is used as the boundary, and the master key ID is used as the index of the key protection key. The encryption gateways in the domain share a large-capacity master key and update it online, thereby realizing the free and secure flow of network session data flows between the encryption gateways. It is mainly aimed at application scenarios where no end-to-end key negotiation is performed between encryption gateways, and no online key distribution is performed by a centralized key management system.

[0201] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0202] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0203] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0204] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0205] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for encrypting and decrypting network session data streams using quantum key distribution, characterized in that: Applied to an encryption gateway, the encryption gateway is connected to a secure storage medium, the method comprises: Read a master key from the connected secure storage medium, establish a master key pool, and use a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by the quantum key distribution network; Obtaining an outbound data message from a network interface connected to an intranet, and encrypting the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time; Based on the key bitmap, randomly select the unused master key from the master key pool, and put the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message; Sending the outbound encrypted message from a network interface connected to an external network; The method further includes: establishing a data flow table for the outbound data message according to the data flow determined by the quintuple, and associating the data flow table with the ID identifier of the master key in the master key pool, establishing a timeout period for each table item in the data flow table, and when a table item is not accessed within the timeout period, deleting the table item, and performing a key update based on the master key associated with the table item; When the encryption gateway is used as a receiving end, after receiving the outbound encrypted message from the network interface connected to the external network, the method further includes: A master key corresponding to the master key ID is selected from the master key pool to decrypt the ciphertext to obtain the data encryption key, and then the encrypted data message is decrypted using the data encryption key.

2. The method for encrypting and decrypting network session data streams using quantum key distribution as claimed in claim 1, characterized in that: When performing one-stream-one-key encryption processing on the outbound data message, the unused master key is randomly selected from the master key pool based on the key bitmap, and the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID identifier are placed in the security message header of the encrypted data message to obtain the outbound encrypted message, further comprising: When associating the data flow table with the ID of the master key in the master key pool, marking the key bitmap of the master key as occupied; For subsequent data packets after the first packet of the same data stream, the data encryption key is encrypted by using the master key ID identifier associated with the data stream table.

3. The method for implementing network session data stream encryption and decryption using quantum key distribution as claimed in claim 1, characterized in that: The key update based on the associated master key includes: The ID of the master key is encrypted using the master key associated with it to obtain a key update request; Sending the key update request to the quantum key distribution network so that the quantum key distribution network generates a key update message, wherein the key update message includes a key ciphertext obtained by encrypting a new master key and its ID identifier using the master key originally associated with the entry and the ID identifier of the new master key; Receive the key update message, and use the master key originally associated with the entry to decrypt the key ciphertext to obtain the ID of the new master key; When the ID identification of the new master key is compared correctly, the new master key is used to replace the master key originally associated with the entry, and the key bitmap of the new master key is marked as unused.

4. The method for implementing network session data stream encryption and decryption using quantum key distribution as claimed in claim 1, characterized in that: After obtaining the outbound data message from the network interface connected to the intranet, the method further includes: Determine whether the data length MSS of the outbound data message exceeds the length of the maximum data portion allowed to be transmitted; If yes, modify the data length of the outbound data message MSS=MSS-4-n, where n is the length of the key or initialization vector; If not, the outbound data message is encrypted using the data encryption key to obtain an encrypted data message.

5. The method for implementing network session data stream encryption and decryption using quantum key distribution as claimed in claim 1, characterized in that: Before sending the outbound encrypted message from the network interface connected to the external network, the method further includes: Determine whether the outbound encrypted message exceeds the MTU; If yes, the outbound encrypted message is fragmented; If not, the outbound encrypted message is sent from the network interface connected to the external network.

6. The method for implementing network session data stream encryption and decryption using quantum key distribution as claimed in claim 1, characterized in that: Before reading the master key from the connected secure storage medium, the method further includes: Sending a registration request to the control platform to bind to a corresponding security domain, the security domain being divided by the control platform; Sending a key injection request to the control platform, so that the control platform forwards the key injection request to the quantum key distribution network, where the quantum key distribution network stores security domain division information and encryption gateway information in each security domain; The master key is injected offline into the secure storage medium through a key agent or a quantum network node, and the ID identifier of the master key injected into the secure storage medium connected to each encryption gateway in the same security domain is the same.

7. The method for implementing network session data stream encryption and decryption using quantum key distribution as claimed in claim 1, characterized in that: When the encryption gateway is used as a receiving end, after receiving the outbound encrypted message from the network interface connected to the external network, the method further includes: Determining whether the outbound encrypted message is a fragmented message; If yes, then the pieces are combined; If not, selecting a master key corresponding to the master key ID from the master key pool to decrypt the ciphertext to obtain the data encryption key; The encrypted data message is decrypted using the data encryption key.

8. A gateway for implementing encryption and decryption of network session data streams using quantum key distribution, characterized in that: The gateway includes a data encryption and decryption processing module and a key injection module, wherein the key injection module is connected to a secure storage medium, and the secure storage medium stores a master key pre-filled by a quantum key distribution network; The key injection module is used to read a master key from a connected secure storage medium, establish a master key pool, and use a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by a quantum key distribution network; The data encryption and decryption processing module is used to obtain an outbound data message from a network interface connected to the intranet, and encrypt the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time; And, for randomly selecting an unused master key from the master key pool based on the key bitmap, and putting the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message; and, for sending the outbound encrypted message from a network interface connected to an external network; The gateway also includes: A flow table management module, used for establishing a data flow table for the outbound data message according to the data flow determined by the quintuple, and associating the data flow table with the ID identifier of the master key in the master key pool; A key update module, used to establish a timeout period for each table item in the data flow table, and when a table item is not accessed within the timeout period, the table item is deleted, and the key is updated based on the master key associated with the table item; The data encryption and decryption processing module is also used to, when the encryption gateway acts as a receiving end, select a master key corresponding to the master key ID identifier from the master key pool to decrypt the ciphertext when the outbound encrypted message is received from the network interface connected to the external network, and after obtaining the data encryption key, use the data encryption key to decrypt the encrypted data message.

9. The gateway for implementing network session data stream encryption and decryption using quantum key distribution as claimed in claim 8, characterized in that: The gateway also includes a flow table management module, wherein: The flow table management module is used to mark the key bitmap of the master key as occupied when associating the data flow table with the ID identifier of the master key in the master key pool; The data encryption and decryption processing module is also used to retrieve the master key ID associated with the data stream table for subsequent data packets after the first packet of the same data stream, and use the master key corresponding to the ID to encrypt the data encryption key.

10. A system for encrypting and decrypting network session data streams using quantum key distribution, characterized in that: The system includes a first encryption gateway, a second encryption gateway, a management and control platform, and a quantum key distribution network, wherein the first encryption gateway and the second encryption gateway are used to perform the encryption and decryption method according to any one of claims 1 to 7, the first encryption gateway, the second encryption gateway, and the quantum key distribution network are all connected to the management and control platform, and the first encryption gateway and the second encryption gateway are both connected to the quantum key distribution network, wherein the first encryption gateway and the second encryption gateway each include a data encryption and decryption processing module and a key injection module, the key injection module is connected to a secure storage medium, and the secure storage medium stores a master key pre-filled by the quantum key distribution network; The management and control platform is used for performing security domain division, and registration and identity binding services for the first encryption gateway and the second encryption gateway; The quantum key distribution network is used to pre-fill the secure storage medium with a master key; The key injection module is used to read a master key from a connected secure storage medium, establish a master key pool, and use a key bitmap to indicate whether the master key has been used, wherein the master key is pre-filled into the secure storage medium by a quantum key distribution network; The data encryption and decryption processing module is used to obtain an outbound data message from a network interface connected to the intranet, and encrypt the outbound data message using a data encryption key to obtain an encrypted data message, wherein the data encryption key is a random number generated in real time; And, for randomly selecting an unused master key from the master key pool based on the key bitmap, and putting the ciphertext obtained by encrypting the data encryption key using the master key and the master key ID into the security message header of the encrypted data message to obtain an outbound encrypted message; And, used to send the outbound encrypted message from the network interface connected to the external network.

Images