Method for quantum key distribution and software-defined implementation of ether data encryption and decryption

Abstract

The application discloses a method for realizing Ethernet data encryption by using quantum key distribution and software definition, which comprises the following steps: taking the MAC address information in a local encryption strategy MAC table as a source MAC address and sending the source MAC address to a management and control platform; receiving a first key distribution message returned by the management and control platform, wherein the first key distribution message comprises a source MAC address and a corresponding session key; placing the session key corresponding to each source MAC address into a source MAC address table item in the local encryption strategy MAC table, and refreshing the encryption strategy MAC table; taking the session key matching the source MAC address of an Ethernet data frame from the encryption strategy MAC table, and encrypting the Ethernet data frame to obtain an encrypted message. The application realizes the automatic generation and centralized distribution of session keys and encryption strategies, and solves the problems of security strategy distribution and key management between Ethernet devices with encryption interworking requirements in a safe and efficient manner.

Description

Technical Field

[0001] The present invention relates to the field of cryptographic application technology, and in particular to a method for implementing Ethernet data encryption and decryption by adopting quantum key distribution and software definition. Background Art

[0002] IEEE 802.1AE Media Access Control (MAC) Security defines a MAC layer security standard. It protects the confidentiality and integrity of Ethernet frames by inserting security tags into Ethernet packets and performing symmetric encryption and integrity check value (ICV) on Ethernet frames excluding MAC addresses, while also providing some protection against replay attacks. The MACsec Key Agreement protocol (MKA) in IEEE 802.1X Port-Based Network Access Control defines the physical key negotiation method in Ethernet networks, used to establish 802.1AE MACsec encryption and integrity protection keys. These two protocols combine to form the IEEE security solution for the Ethernet MAC layer.

[0003] However, in actual use, the deployment and implementation of these two protocols are not widespread, and the following problems exist:

[0004] (1) Due to the insertion of a longer security label and the addition of the ICV part, the Ethernet frame will exceed the maximum transmission unit (MTU) of the interface, which will further cause packet loss.

[0005] (2) The key used to encrypt Ethernet message frames is allocated to the entity that implements the MACsec protocol, rather than to each source entity with a MAC address. Multiple sources share one Ethernet frame protection key, and this key is only related to the entity that implements the MACsec protocol.

[0006] (3) MKA shares a symmetric key within a group to protect the negotiation process. The key can only be updated after a period of use, and there is a certain degree of repetitiveness in its use.

[0007] (4) Key distribution is performed directly on the Layer 2 link based on Ethernet frames. The key distribution server is generated between bridges through election. The reliability of the key distribution process cannot be guaranteed.

[0008] In the related technology, the Chinese invention patent application document with publication number CN111787025A records an encryption and decryption processing method, device, system and data protection gateway. The method includes: receiving an encrypted first business message sent by the edge data protection gateway; obtaining the source terminal MAC address and business feature information in the first business message, and matching the source terminal MAC address and business feature information with a pre-configured decryption policy; when the source terminal MAC address and business feature information match the decryption policy, decrypting the first business message and forwarding it to the destination server.

[0009] The Chinese invention patent application document with publication number CN111787025A provides an encryption and decryption processing method, device, and system, which receives an encrypted first business message sent by the edge data protection gateway; obtains the source terminal MAC address and business feature information in the first business message, and matches the source terminal MAC address and business feature information with a pre-configured decryption policy; when the source terminal MAC address and business feature information match the decryption policy, decrypts the first business message and forwards it to the destination server. This solution is for encryption gateways, processing data at the IP network layer. The MAC address of data sent from the gateway is the gateway's MAC address, not the original MAC address; and the MAC information used to match the policy does not come from the Ethernet frame, but exists within the business message.

[0010] Chinese invention patent application publication number CN102130768A describes a terminal device with link layer encryption and decryption capabilities and a data processing method thereof. The terminal device includes a link layer processing module, which includes a control module, a data frame encryption processing module, a data frame decryption processing module, a key management module, an algorithm module, a transmitting port, and a receiving port. The control module is connected to the transmitting port via the data frame encryption processing module; the receiving port is connected to the control module via the data frame decryption processing module; the control module is connected to the key management module; the data frame encryption processing module is connected to the data frame decryption processing module via the key management module; and the data frame encryption processing module is connected to the data frame decryption processing module via the algorithm module. The proposed method is based on pre-shared keys and pre-configured encryption strategies, but does not provide a specific key distribution protocol. Summary of the Invention

[0011] The technical problem to be solved by the present invention is how to provide an efficient, secure, manageable and controllable Ethernet data frame encryption transmission method.

[0012] The present invention solves the above technical problems through the following technical means:

[0013] In a first aspect, the present invention proposes a method for implementing Ethernet data encryption using quantum key distribution and software definition, which is applied to a first encryption bridge. The method includes:

[0014] The MAC address information in the local encryption policy MAC table is used as the source MAC address and sent to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty.

[0015] Receive a first key distribution message returned by the control platform, where the first key distribution message includes a source MAC address and a corresponding session key;

[0016] The session key corresponding to each source MAC address is placed into the source MAC address table entry in the local encryption policy MAC table, and the encryption policy MAC table is refreshed;

[0017] A session key matching the source MAC address of the Ethernet data frame is taken out from the encryption policy MAC table, and the Ethernet data frame is encrypted to obtain an encrypted message.

[0018] The present invention automatically learns source MAC addresses through encryption bridge ports and sends the learned source MAC address information to a management and control platform. The management and control platform generates different session keys based on different source MAC addresses and distributes them to other associated encryption bridges through the management and control platform, thus achieving the automatic generation and centralized distribution of session keys and encryption policies. This securely and efficiently solves the security policy distribution and key management issues between Ethernet devices with encryption intercommunication requirements. This invention primarily targets Layer 2 Ethernet frame encryption applications where keys and encryption policies are centrally distributed. Data encryption and decryption are performed based on source MAC addresses, and policy elements are automatically learned and formed. Session key and encryption policy synchronization is achieved between associated encryption bridge device nodes through software-defined encryption policies and centralized distribution.

[0019] Furthermore, a master key pool is provided in the first encryption bridge, and the master key pool stores a master key and a master key ID pre-filled by a quantum key distribution system;

[0020] Accordingly, the MAC address information in the local encryption policy MAC table is used as the source MAC address and sent to the management and control platform, including:

[0021] MAC address messages are sent to the management and control platform at irregular intervals. The MAC address messages carry information including the master key ID, encryption policy MAC table new addition count, new source MAC address, encryption policy MAC table deletion count, deleted source MAC address and the first integrity check value.

[0022] Furthermore, the first key distribution message carries information including the newly added count of the encryption policy MAC table, the master key ID, the newly added source MAC address and the corresponding session key ciphertext and the second integrity check value;

[0023] Accordingly, placing the session key corresponding to each source MAC address into a source MAC address entry in the local encryption policy MAC table and refreshing the encryption policy MAC table includes:

[0024] Using the master key ID, the server obtains the corresponding master key from its own master key pool, performs an integrity check on the second integrity check value, and decrypts the session key ciphertext to obtain the session key corresponding to each source MAC address;

[0025] The session key corresponding to each source MAC address is placed into the source MAC address table entry in the local encryption policy MAC table, and the encryption policy MAC table is refreshed.

[0026] Furthermore, the process of extracting a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table and encrypting the Ethernet data frame to obtain an encrypted message includes:

[0027] Retrieving a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table;

[0028] The session key is used to encrypt the frame data of the Ethernet data frame except the frame header, wherein the encryption mode adopts the CBC algorithm combined with the CFB algorithm.

[0029] Furthermore, before using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes:

[0030] Connect to the management and control platform through the management channel and send a registration message. The format of the registration message is: first encryption bridge ID||first encryption bridge management IP||random number R||KeyID||HMAC(Key, first encryption bridge ID||first encryption bridge management IP||random number R||KeyID), where HMAC(Key, data) means using the key Key to perform a keyed hash operation on the data data, and Key is a randomly selected master key corresponding to the first encryption bridge identifier KeyID.

[0031] Furthermore, before using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes:

[0032] Define the Ethernet interface type of the first encryption bridge, where the interface that is not connected to other encryption bridges of the same type is defined as a secret port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The secret port is used to add the source MAC address learned by the port to the local encryption policy MAC table.

[0033] Furthermore, before using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes:

[0034] Send a key injection request to the quantum key distribution network or key agent;

[0035] The master key injected by the quantum key distribution network is received through a first secure storage medium, a master key pool is established, and a key bitmap is used to identify whether each master key has been used, wherein the quantum key distribution network stores the master keys and master key IDs distributed to each encryption bridge in different security domains.

[0036] In a second aspect, the present invention proposes a method for implementing Ethernet data decryption using quantum key distribution and software definition, which is applied to a second encryption bridge. The method includes:

[0037] Receive a second key distribution message returned by the management and control platform, where the second key distribution message includes a source MAC address and a corresponding session key;

[0038] Place each source MAC address and the corresponding session key into the local decryption policy MAC table;

[0039] Receiving an encrypted message sent by the first encryption bridge, wherein the encrypted message is obtained by the first encryption bridge taking out a session key that matches a source MAC address of an Ethernet data frame from its local encryption policy MAC table and encrypting the Ethernet data frame;

[0040] The session key that matches the source MAC address of the Ethernet data frame is taken out from the decryption strategy MAC table to decrypt the encrypted message.

[0041] Furthermore, a master key pool is provided in the second encryption bridge, wherein the master key pool stores a master key and a master key ID pre-filled by a quantum key distribution system, and the method further includes:

[0042] Receive a MAC deletion message returned by the control platform, wherein the MAC deletion message carries information including a new count of the encryption policy MAC table, a master key ID, a deleted source MAC address, and a third integrity check value;

[0043] Selecting a corresponding master key from the master key pool according to the master key ID to perform an integrity check on the third integrity check value;

[0044] According to each source MAC address in the MAC deletion message, the table entry corresponding to the source MAC address in the decryption policy MAC table is deleted in sequence, and the decryption policy MAC table is refreshed.

[0045] Furthermore, before receiving the second key distribution message returned by the control platform, wherein the second key distribution message includes the source MAC address and the corresponding session key, the method further includes:

[0046] Connect to the management and control platform through the management channel and send a registration message. The format of the registration message is: second encryption bridge ID||second encryption bridge management IP||random number R||KeyID||HMAC(Key, second encryption bridge ID||plus second encryption bridge management IP||random number R||KeyID), where HMAC(Key, data) means using the key Key to perform a keyed hash operation on the data data, and Key is a randomly selected master key corresponding to the second encryption bridge identifier KeyID.

[0047] Furthermore, before receiving the second key distribution message returned by the control platform, wherein the second key distribution message includes the source MAC address and the corresponding session key, the method further includes:

[0048] The Ethernet interface type of the first encryption bridge is defined, wherein an interface not connected to other encryption bridges of the same type is defined as a encrypted port, and an interface connected to other encryption bridges of the same type is defined as an open port.

[0049] Furthermore, before receiving the second key distribution message returned by the control platform, wherein the second key distribution message includes the source MAC address and the corresponding session key, the method further includes:

[0050] Send a key injection request to the quantum key distribution network or key agent;

[0051] The master key injected by the quantum key distribution network is received through a second secure storage medium, a master key pool is established, and a key bitmap is used to identify whether each master key has been used, wherein the quantum key distribution network stores the master keys and master key IDs distributed to each encryption bridge in different security domains.

[0052] In a third aspect, the present invention proposes a method for distributing an encryption policy and a session key, which is applied to a management and control platform. The method includes:

[0053] Receive a source MAC address reporting message sent by the first encryption network bridge, wherein the source MAC address reporting message carries information including a master key ID corresponding to the first encryption network bridge and a source MAC address in the encryption policy MAC table;

[0054] For each newly received source MAC address, a corresponding session key is requested from the quantum key distribution network;

[0055] Based on the session key, a first key distribution message and a second key distribution message are generated respectively, and distributed to the first encryption bridge and the second encryption bridge, and the second encryption bridge is directly connected to the first encryption bridge.

[0056] Furthermore, the source MAC address reporting message carries information including a master key ID, an encryption policy MAC table new addition count, a new source MAC address, an encryption policy MAC table deletion count, a deleted source MAC address, and a first integrity check value;

[0057] Accordingly, before applying for a corresponding session key from the quantum key distribution network for each received source MAC address, the method further includes:

[0058] Obtain a master key corresponding to the first encryption bridge from a quantum key distribution network, and verify the first integrity check value using the master key.

[0059] Furthermore, the generating a first key distribution message and a second key distribution message based on the session key respectively includes:

[0060] encrypting the session key using a master key corresponding to the first encryption bridge to generate a first key distribution message;

[0061] encrypting the session key using a master key corresponding to the second encryption bridge to generate a second key distribution message;

[0062] The information carried by the first key distribution message and the second key distribution message includes the newly added count of the encryption policy MAC table, the master key ID, the newly added source MAC address and the corresponding session key ciphertext and the second integrity check value.

[0063] Furthermore, before receiving the source MAC address reporting message sent by the first encryption bridge, the method further includes:

[0064] Establish an encryption bridge association table for the security domain. The encryption bridge association table is a two-dimensional matrix T[K][K], where K is the number of encryption bridges in the security domain, and T[i][j]=1 indicates that there is an association between bridge i and bridge j. The associated encryption bridges are directly connected.

[0065] Accordingly, before applying for a corresponding session key from the quantum key distribution network for each received source MAC address, the method further includes:

[0066] Based on the encryption bridge association table, a second encryption bridge associated with the first encryption bridge is acquired.

[0067] Furthermore, after applying for a corresponding session key from the quantum key distribution network for each newly received source MAC address, the method further includes:

[0068] A MAC delete message is sent to the second encryption bridge, where the MAC delete message carries information including a new count of the encryption policy MAC table, a master key ID, a deleted source MAC address, and a third integrity check value.

[0069] In a fourth aspect, the present invention proposes a method for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, the method comprising:

[0070] The first encryption bridge uses the MAC address information in the local encryption policy MAC table as the source MAC address and sends it to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty.

[0071] The control platform applies for a corresponding session key for each source MAC address received, generates a first key distribution message and a second key distribution message, and distributes them to the first encryption bridge and the second encryption bridge, and the second encryption bridge is directly connected to the first encryption bridge;

[0072] The first encryption bridge receives the first key distribution message, and places the session key corresponding to each source MAC address into a source MAC address entry in a local encryption policy MAC table, and refreshes the encryption policy MAC table;

[0073] The second encryption bridge receives the second key distribution message and places each source MAC address and the corresponding session key into a local decryption policy MAC table;

[0074] The first encryption bridge retrieves a session key that matches a source MAC address of an Ethernet data frame from the encryption policy MAC table, and encrypts the outgoing Ethernet data frame to obtain an encrypted message;

[0075] The second encryption bridge retrieves a session key that matches the source MAC address of the Ethernet data frame from the decryption policy MAC table, and decrypts the incoming encrypted message.

[0076] In a fifth aspect, the present invention provides an encryption bridge, comprising:

[0077] A source MAC address message sending module is used to use the MAC address information in the local encryption policy MAC table as the source MAC address and send it to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty.

[0078] A first key distribution message receiving module is used to receive a first key distribution message returned by the control platform, where the first key distribution message includes a source MAC address and a corresponding session key;

[0079] A first encryption and decryption policy MAC table management module is configured to place a session key corresponding to each source MAC address into a source MAC address entry in a local encryption policy MAC table and refresh the encryption policy MAC table;

[0080] The first data encryption and decryption module is used to retrieve a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table, encrypt the Ethernet data frame, and obtain an encrypted message.

[0081] In a sixth aspect, the present invention provides an encryption bridge, comprising:

[0082] A second key distribution message receiving module is used to receive a second key distribution message returned by the management and control platform, where the second key distribution message includes a source MAC address and a corresponding session key;

[0083] The second encryption and decryption policy MAC table management module is used to place each source MAC address and the corresponding session key into the local decryption policy MAC table;

[0084] An encrypted message receiving module is used to receive an encrypted message sent by the first encryption bridge, wherein the encrypted message is obtained by the first encryption bridge taking out a session key that matches the source MAC address of the Ethernet data frame from its local encryption policy MAC table and encrypting the Ethernet data frame;

[0085] The second data encryption and decryption module is used to retrieve a session key that matches the source MAC address of the Ethernet data frame from the decryption policy MAC table and decrypt the encrypted message.

[0086] In a seventh aspect, the present invention provides a management and control platform, comprising:

[0087] A message receiving module, configured to receive a source MAC address reporting message sent by the first encryption network bridge, wherein the source MAC address reporting message carries information including a master key ID corresponding to the first encryption network bridge and a source MAC address in the encryption policy MAC table;

[0088] A session key application module is used to apply for a corresponding session key from the quantum key distribution network for each newly received source MAC address;

[0089] The key distribution message generation module is used to generate a first key distribution message and a second key distribution message based on the session key, and distribute them to the first encryption bridge and the second encryption bridge, and the second encryption bridge is directly connected to the first encryption bridge.

[0090] In an eighth aspect, the present invention provides a system for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, the system comprising a first encryption bridge, a second encryption bridge, a management and control platform, and a quantum key distribution system, wherein the first encryption bridge and the second encryption bridge are associated with each other and are both connected to the management and control platform and the quantum key distribution system, the management and control platform is connected to the quantum key distribution system, and the first encryption bridge and the second encryption bridge are each integrated with a secure storage medium;

[0091] The management and control platform is used to distribute encryption policies and session keys based on the source MAC address information reported by the first encryption bridge;

[0092] The quantum key distribution network is used to distribute the master key to the control platform and the secure storage medium;

[0093] The first encryption bridge and the second encryption bridge are used to perform encryption and decryption processing on user Ethernet data frames transmitted through the bridges.

[0094] The advantages of the present invention are:

[0095] (1) The present invention automatically learns the source MAC address through the encryption bridge port and sends the learned source MAC address information to the management and control platform. The management and control platform generates different session keys based on different source MAC addresses and distributes them to other associated encryption bridges through the management and control platform, thus realizing the automatic generation and centralized distribution of session keys and encryption policies, and safely and efficiently solving the security policy distribution and key management problems between Ethernet devices with encryption intercommunication requirements. It is mainly aimed at the application scenario of Layer 2 Ethernet frame encryption with centralized distribution of keys and encryption policies. It performs data encryption and decryption based on the source MAC address and automatically learns to form policy elements. It achieves synchronization of session keys and encryption policies between associated encryption bridge device nodes through software-defined encryption policies and centralized distribution.

[0096] (2) The encryption strategy achieves on-demand encryption by dynamically adding or deleting MAC addresses, thereby improving the effective utilization of encryption bridge device resources.

[0097] (3) By dividing the security domain and pre-filling a large number of identical master keys for each device node in the security domain and using them randomly, the one-time-one-key session key distribution process and the identity authentication of the devices in the domain are realized by pre-filling a large number of master keys. This solves the problem of identity authentication and key distribution protection between the bridge device nodes with encryption requirements and the management and control platform safely and efficiently, thereby realizing safe, efficient, manageable and controllable Ethernet data frame encrypted transmission.

[0098] Additional aspects and advantages of the present invention will be set forth in part in the description which follows and, in part, will be obvious from the description which follows, or may be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0099] Figure 1 1 is a flow chart of a method for implementing Ethernet data encryption using quantum key distribution and software definition, as proposed in the first embodiment of the present invention;

[0100] Figure 2 2 is a flow chart of a method for implementing Ethernet data decryption using quantum key distribution and software definition, as proposed in the second embodiment of the present invention;

[0101] Figure 3 1 is a flow chart of an encryption strategy and a method for distributing session keys according to a third embodiment of the present invention;

[0102] Figure 4 4 is a flowchart of a method for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, as proposed in the fourth embodiment of the present invention;

[0103] Figure 5 is a schematic diagram of the structure of the encryption bridge proposed in the fifth embodiment of the present invention;

[0104] Figure 6 Schematic diagram of the structure of the encryption bridge proposed in the sixth embodiment of the present invention;

[0105] Figure 7 Schematic diagram of the structure of the control platform proposed in the seventh embodiment of the present invention;

[0106] Figure 8 2 is a schematic diagram of the structure of a system for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, as proposed in an eighth embodiment of the present invention;

[0107] Figure 9 2 is a schematic diagram of the structure of an encryption bridge in an eighth embodiment of the present invention;

[0108] Figure 10 This is a schematic diagram of the workflow of a system for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, as proposed in the eighth embodiment of the present invention. DETAILED DESCRIPTION

[0109] To make the objectives, technical solutions, and advantages of the embodiments of the present invention more clear, the technical solutions in the embodiments of the present invention will be clearly and completely described below in conjunction with the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. All other embodiments obtained by ordinary technicians in this field based on the embodiments of the present invention without making any creative efforts shall fall within the scope of protection of the present invention.

[0110] Example 1

[0111] like Figure 1 As shown, the first embodiment of the present invention proposes a method for implementing Ethernet data encryption using quantum key distribution and software definition, which is applied to a first encryption bridge. The method includes the following steps:

[0112] S101. Use the MAC address information in the local encryption policy MAC table as the source MAC address and send it to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty.

[0113] It should be noted that the first encryption bridge is an encryption bridge used to report messages to the management and control platform. The entries of the local encryption policy MAC table of the first encryption bridge are composed of a MAC address and a corresponding session key. The session key is used to encrypt Ethernet data frames with the MAC address as the source MAC. The session key is initially empty and distributed by the management and control platform. The life cycle of the encryption policy MAC table entries is the same as that of the ordinary MAC table entries.

[0114] S102: Receive a first key distribution message returned by the control platform, where the first key distribution message includes a source MAC address and a corresponding session key;

[0115] It should be noted that the management and control platform receives the source MAC address information, applies for the corresponding session key from the quantum key distribution network for the newly added source MAC address, and returns each source MAC address and the corresponding session key to the encryption bridge, refreshing the local encryption policy MAC table of the encryption bridge.

[0116] S103, placing the session key corresponding to each source MAC address into the source MAC address table entry in the local encryption policy MAC table, and refreshing the encryption policy MAC table;

[0117] S104 , taking out a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table, and encrypting the Ethernet data frame to obtain an encrypted message.

[0118] The embodiment of the present invention automatically learns the source MAC address through the encryption bridge port and sends the learned source MAC address information to the management and control platform. The management and control platform generates different session keys based on different source MAC addresses and distributes them to other associated encryption bridges through the management and control platform, thereby realizing the automatic generation and centralized distribution of session keys and encryption policies, and safely and efficiently solving the security policy distribution and key management problems between Ethernet devices with encryption intercommunication requirements. This embodiment is mainly aimed at the application scenario of Layer 2 Ethernet frame encryption with centralized distribution of keys and encryption policies. It performs data encryption and decryption based on the source MAC address and automatically learns to form policy elements. It achieves synchronization of session keys and encryption policies between associated encryption bridge device nodes through software-defined encryption policies and centralized distribution.

[0119] In addition, the method proposed in this embodiment is applied to an encryption bridge, directly matching the original MAC and performing encryption, decryption, and forwarding on the Ethernet frame without changing the original MAC information. The encryption strategy proposed in this embodiment is based on the source MAC of the Ethernet frame and is automatically collected and reported by the source-end bridge. The session key is generated in real time by the quantum key distribution network. The real-time control center is primarily responsible for the application and issuance of the session key. The pre-shared quantum key is used to protect the distribution of the session key and the identity authentication during bridge registration. In this embodiment, the control center acts as a controller and does not need to configure a large amount of policy information. It only needs to configure the association between the bridges. The entire process of policy generation, key application, and policy and key distribution is highly autonomous, highly efficient, and has a light management burden.

[0120] In one embodiment, a master key pool is provided in the first encryption bridge, wherein the master key pool stores a master key and a master key ID pre-filled by a quantum key distribution system;

[0121] Accordingly, in step S101, the MAC address information in the local encryption policy MAC table is used as the source MAC address and sent to the management and control platform, specifically including:

[0122] MAC address messages are sent to the management and control platform at irregular intervals. The MAC address messages carry information including the master key ID, encryption policy MAC table new addition count, new source MAC address, encryption policy MAC table deletion count, deleted source MAC address and the first integrity check value.

[0123] It should be noted that, in this embodiment, the first encryption bridge reports the MAC address information of the local encryption policy MAC table of the bridge to the management and control platform at irregular intervals. The message format of the MAC address message is:

[0124] 4-byte master key ID + 2-byte encryption policy MAC table new addition count + k1*(newly added source MAC address) + 2-byte encryption policy MAC table deletion count + k2*(deleted source MAC address) + ICV (first integrity check value)

[0125] Among them, the master key ID is randomly selected from the master key pool of the first encryption bridge itself, and ICV is the HMAC (Hash-based Message Authentication Code) of the entire MAC address message calculated using the master key corresponding to the master key ID; k1 and k2 represent the number of newly added source MACs and deleted source MACs, respectively.

[0126] It should be noted that in this embodiment, the first encryption bridge periodically sends MAC address messages to the control platform. Specifically, upon startup, after a period of port MAC address learning, the first encryption bridge establishes a management channel with the control platform, registers and reports the entire encryption policy MAC table, and the delete count in the report message is zero. Each time the contents of the encryption policy MAC table change, i.e., when a new or expired source MAC address is added, a MAC address report message is sent to the control platform, containing the newly added and deleted source MAC addresses.

[0127] In one embodiment, in step S102, the control platform generates a first key distribution message as follows: the control platform applies for a session key from a quantum key distribution network (QKD) for each newly added source MAC address, and encrypts the session key using a master key corresponding to the first encryption bridge (the bridge that reports the message) (the master key is obtained from the quantum key distribution network) to form a first session key ciphertext distributed to the first encryption bridge, and uses the master key to calculate the ICV (second integrity check value) of the first key distribution message.

[0128] In one embodiment, the first key distribution message carries information including an encryption policy MAC table new addition count, a master key ID, a new source MAC address and a corresponding session key ciphertext, and a second integrity check value;

[0129] Accordingly, step S103: placing the session key corresponding to each source MAC address into the source MAC address entry in the local encryption policy MAC table, and refreshing the encryption policy MAC table, specifically includes the following steps:

[0130] S131. Use the master key ID to obtain the corresponding master key from its own master key pool, perform an integrity check on the second integrity check value, and decrypt the session key ciphertext to obtain the session key corresponding to each source MAC address.

[0131] It should be noted that the master key pool stores a large number of master keys pre-filled by the quantum key distribution system.

[0132] It should be noted that after the integrity check passes, the session key ciphertext is decrypted. If the integrity check fails, the data transmission process is terminated.

[0133] S132: Place the session key corresponding to each source MAC address into the source MAC address entry in the local encryption policy MAC table, and refresh the encryption policy MAC table.

[0134] It should be noted that the encryption policy achieves on-demand encryption by dynamically adding or deleting MAC addresses through learning, thereby improving the effective utilization of encryption bridge device resources.

[0135] In one embodiment, step S104: retrieving a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table, and encrypting the Ethernet data frame to obtain an encrypted message, specifically includes the following steps:

[0136] S141. Retrieve a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table;

[0137] S142: Use the session key to encrypt the frame data of the Ethernet data frame except the frame header, wherein the encryption mode adopts the CBC algorithm combined with the CFB algorithm.

[0138] It should be noted that the device node of the first encryption bridge encrypts the outbound Ethernet data frame whose source MAC address matches the encryption policy MAC table, that is, it takes out the session key from the item matching the source MAC address of the frame from the encryption policy MAC table, and encrypts the frame data outside the Ethernet frame header. The encryption mode is CBC (integer multiple of the algorithm group) + CFB (remainder part other than the integer multiple of the algorithm group), and no additional data is added.

[0139] In one embodiment, before step S101: using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes:

[0140] Connect to the management and control platform through the management channel and send a registration message. The format of the registration message is: first encryption bridge ID||first encryption bridge management IP||random number R||KeyID||HMAC(Key, first encryption bridge ID||first encryption bridge management IP||random number R||KeyID), where HMAC(Key, data) means using the key Key to perform a keyed hash operation on the data data, and Key is a randomly selected master key corresponding to the first encryption bridge identifier KeyID.

[0141] It should be noted that when the first encryption bridge is started, it connects to the management and control platform through the management channel (configurable IP port), establishes a reliable connection (TCP long connection) and registers; after receiving the registration request, the management and control platform obtains the master key corresponding to the first encryption bridge identifier KeyID from the quantum key distribution network, verifies the registration message, and returns a registration success notification to the first encryption bridge if the verification passes. If the verification fails, it returns a registration failure notification.

[0142] In one embodiment, before step S101: using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes:

[0143] Define the Ethernet interface type of the first encryption bridge, where the interface that is not connected to other encryption bridges of the same type is defined as a secret port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The secret port is used to add the source MAC address learned by the port to the local encryption policy MAC table.

[0144] It should be noted that, in this embodiment, the open port and the secret port of the first encryption bridge not only perform the functions of ordinary bridge ports, but the secret port adds the source MAC address learned by the port to the local encryption policy MAC table, and outbound Ethernet data frames can be forwarded through any open port.

[0145] In one embodiment, before step S101: using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes the following steps:

[0146] Send a key injection request to the quantum key distribution network or key agent;

[0147] The master key injected by the quantum key distribution network is received through a first secure storage medium, a master key pool is established, and a key bitmap is used to identify whether each master key has been used, wherein the quantum key distribution network stores the master keys and master key IDs distributed to each encryption bridge in different security domains.

[0148] It should be noted that the first encryption network bridge is integrated with a first secure storage medium. The first secure storage medium can be a large-capacity secure storage medium including but not limited to a secure TF card or a secure U shield. A large number of master keys are pre-filled for the first encryption bridge through the first secure storage medium. The key format is a 4-byte key ID + n-byte key and an n-byte initialization vector (n is related to the encryption algorithm). The first encryption bridge constructs a master key pool based on this, and the quantum key distribution network stores the master keys and key IDs distributed to each device node in different security domains in the key pool.

[0149] It should be noted that, when the first encryption bridge generates a MAC address message, the master key used is randomly selected from the master key pool and is not used, and the key bitmap of the selected master key is marked as used.

[0150] It should be noted that by pre-filling a large number of master keys, a one-time pad for the session key distribution process and identity authentication of devices within the domain are implemented, thereby achieving secure, efficient, manageable and controllable Ethernet data frame encrypted transmission.

[0151] Example 2

[0152] like Figure 2 As shown, the second embodiment of the present invention proposes a method for implementing Ethernet data decryption using quantum key distribution and software definition, which is applied to the second encryption bridge. The method includes the following steps:

[0153] S201. Receive a second key distribution message returned by the management and control platform, where the second key distribution message includes a source MAC address and a corresponding session key;

[0154] It should be noted that for each new source MAC address, the management and control platform applies for a session key from the quantum key distribution network, and uses the master key corresponding to the second encryption bridge (randomly selected from the quantum key distribution network) to encrypt the session key to form a second session key ciphertext distributed to the second encryption bridge. The master key is also used to calculate the ICV (third integrity check value) of the second key distribution message.

[0155] The second key distribution message format is:

[0156] 2-byte encryption policy MAC table new addition count + 4-byte master key ID + k1 * (newly added source MAC address + session key ciphertext) + ICV (third integrity check value), where k1 indicates the number of newly added source MAC addresses.

[0157] S202, placing each source MAC address and corresponding session key into the local decryption policy MAC table;

[0158] It should be noted that for the second encryption bridge associated with the first encryption bridge, each source MAC address and corresponding session key in the second key distribution message are added to the decryption policy MAC table. The table entries are the source MAC address and the corresponding session key, where the source MAC address is the source MAC address in the second key distribution message.

[0159] S203: Receive an encrypted message sent by the first encryption bridge, wherein the encrypted message is obtained by the first encryption bridge encrypting the Ethernet data frame by taking out a session key that matches the source MAC address of the Ethernet data frame from its local encryption policy MAC table;

[0160] S204: Take out the session key that matches the source MAC address of the Ethernet data frame from the decryption policy MAC table, and decrypt the encrypted message.

[0161] In the embodiment of the present invention, the second encryption network bridge is associated with the first encryption network bridge that reports the MAC address message. The management and control platform generates different session keys based on different source MAC addresses, and distributes them to other second encryption network bridges that are associated with the first encryption network bridge through the management and control platform, thereby realizing the automatic generation and centralized distribution of session keys and encryption policies, and safely and efficiently solving the security policy distribution and key management problems between Ethernet devices with encryption intercommunication requirements. This embodiment is mainly aimed at the application scenario of Layer 2 Ethernet frame encryption with centralized distribution of keys and encryption policies. It performs data encryption and decryption based on the source MAC address and automatically learns to form policy elements. It achieves synchronization of session keys and encryption policies between associated encryption network bridge device nodes through software-defined encryption policies and centralized distribution.

[0162] In one embodiment, a master key pool is provided in the second encryption bridge, wherein the master key pool stores master keys and master key IDs pre-filled by a quantum key distribution system, and the method further comprises the following steps:

[0163] Receive a MAC deletion message returned by the control platform, wherein the MAC deletion message carries information including a new count of the encryption policy MAC table, a master key ID, a deleted source MAC address, and a third integrity check value;

[0164] Selecting a corresponding master key from the master key pool according to the master key ID to perform an integrity check on the third integrity check value;

[0165] According to each source MAC address in the MAC deletion message, the table entry corresponding to the source MAC address in the decryption policy MAC table is deleted in sequence, and the decryption policy MAC table is refreshed.

[0166] It should be noted that the format of the MAC delete message is:

[0167] 2-byte encryption policy MAC table new added count + 4-byte master key ID + k2*(deleted source MAC address) + ICV (fourth integrity check value), where k2 represents the number of deleted source MAC addresses.

[0168] When the completeness check passes, the entry corresponding to the source MAC address in the decryption policy MAC table is deleted in sequence according to each source MAC address in the MAC deletion message. If the integrity check fails, the transmission process is terminated.

[0169] In this embodiment, the encryption policy realizes on-demand encryption by dynamically adding or deleting MAC addresses through learning, thereby improving the effective utilization of encryption bridge device resources.

[0170] In one embodiment, before step S201: receiving a second key distribution message returned by the management and control platform, wherein the second key distribution message includes a source MAC address and a corresponding session key, the method further includes:

[0171] Connect to the management and control platform through the management channel and send a registration message. The format of the registration message is: second encryption bridge ID||second encryption bridge management IP||random number R||KeyID||HMAC(Key, second encryption bridge ID||plus second encryption bridge management IP||random number R||KeyID), where HMAC(Key, data) means using the key Key to perform a keyed hash operation on the data data, and Key is a randomly selected master key corresponding to the second encryption bridge identifier KeyID.

[0172] It should be noted that when the second encryption bridge is started, it connects to the management and control platform through the management channel (configurable IP port), establishes a reliable connection (TCP long connection) and registers; after receiving the registration request, the management and control platform obtains the master key corresponding to the first encryption bridge identifier KeyID from the quantum key distribution network, verifies the registration message, and returns a registration success notification to the first encryption bridge if the verification passes. If the verification fails, a registration failure notification is returned.

[0173] In one embodiment, before step S201: receiving a second key distribution message returned by the management and control platform, wherein the second key distribution message includes a source MAC address and a corresponding session key, the method further includes:

[0174] The Ethernet interface type of the first encryption bridge is defined, wherein an interface not connected to other encryption bridges of the same type is defined as a encrypted port, and an interface connected to other encryption bridges of the same type is defined as an open port.

[0175] It should be noted that, in this embodiment, the open port and the encrypted port of the second encryption bridge can perform the functions of ordinary bridge ports, and inbound Ethernet data frames can be forwarded through any open port.

[0176] In one embodiment, before step S201: receiving a second key distribution message returned by the management and control platform, wherein the second key distribution message includes a source MAC address and a corresponding session key, the method further includes:

[0177] Send a key injection request to the quantum key distribution network or key agent;

[0178] The master key injected by the quantum key distribution network is received through a second secure storage medium, a master key pool is established, and a key bitmap is used to identify whether each master key has been used, wherein the quantum key distribution network stores the master keys and master key IDs distributed to each encryption bridge in different security domains.

[0179] It should be noted that the second encryption network bridge is integrated with a second secure storage medium. The first secure storage medium can use a large-capacity secure storage medium including but not limited to a secure TF card or a secure U shield. A large number of master keys are pre-filled for the first encryption bridge through the first secure storage medium. The key format is a 4-byte key ID + n-byte key and an n-byte initialization vector (n is related to the encryption algorithm). The second encryption bridge constructs a master key pool based on this. The quantum key distribution network stores the master keys and key IDs distributed to each device node in different security domains in the key pool.

[0180] This embodiment implements a one-time pad in the session key distribution process and identity authentication of devices within the domain by pre-filling a large number of master keys, thereby achieving secure, efficient, manageable and controllable Ethernet data frame encrypted transmission.

[0181] Example 3

[0182] like Figure 3 As shown, the third embodiment of the present invention proposes a method for distributing an encryption policy and a session key, which is applied to a management and control platform. The method includes the following steps:

[0183] S301: Receive a source MAC address reporting message sent by a first encryption bridge, where the source MAC address reporting message carries information including a master key ID corresponding to the first encryption bridge and a source MAC address in an encryption policy MAC table;

[0184] S302. For each newly received source MAC address, request a corresponding session key from the quantum key distribution network;

[0185] S303: Generate a first key distribution message and a second key distribution message based on the session key, and distribute them to the first encryption bridge and the second encryption bridge, where the second encryption bridge is directly connected to the first encryption bridge.

[0186] This embodiment automatically learns MAC addresses through the bridge port, and the management and control platform generates different session keys based on different source MAC addresses, and distributes them to the first encryption bridge and other second encryption bridges associated with the first encryption bridge through the management and control platform, thereby realizing the automatic generation and centralized distribution of session keys and encryption policies, and safely and efficiently solving the security policy distribution and key management problems between Ethernet devices with encryption intercommunication requirements.

[0187] In one embodiment, the source MAC address reporting message carries information including a master key ID, an encryption policy MAC table new addition count, a new source MAC address, an encryption policy MAC table deletion count, a deleted source MAC address, and a first integrity check value;

[0188] Accordingly, before step S302: requesting a corresponding session key from the quantum key distribution network for each received source MAC address, the method further includes:

[0189] Obtain a master key corresponding to the first encryption bridge from a quantum key distribution network, and verify the first integrity check value using the master key.

[0190] It should be understood that when the integrity check passes, the session key corresponding to the source MAC address is obtained from the quantum key distribution network. If the integrity check fails, the data transmission process is terminated.

[0191] In one embodiment, in step S303, generating a first key distribution message and a second key distribution message based on the session key respectively includes the following steps:

[0192] S331. Encrypt the session key using the master key corresponding to the first encryption bridge to generate a first key distribution message.

[0193] S332: Encrypt the session key using the master key corresponding to the second encryption bridge to generate a second key distribution message;

[0194] The information carried by the first key distribution message and the second key distribution message includes the newly added count of the encryption policy MAC table, the master key ID, the newly added source MAC address and the corresponding session key ciphertext and the second integrity check value.

[0195] It should be noted that the master key corresponding to the first encryption bridge and the master key corresponding to the second encryption bridge are both obtained from the quantum key distribution network.

[0196] In one embodiment, after the step S302 of requesting a corresponding session key from the quantum key distribution network for each newly received source MAC address, the method further includes:

[0197] A MAC delete message is sent to the second encryption bridge, where the MAC delete message carries information including a new count of the encryption policy MAC table, a master key ID, a deleted source MAC address, and a third integrity check value.

[0198] It should be noted that the encryption policy distributed by the management and control platform achieves on-demand encryption through the dynamic addition or deletion of MAC address learning, thereby improving the effective utilization of encryption bridge device resources.

[0199] In one embodiment, before step S301: receiving the source MAC address reporting message sent by the first encryption bridge, the method further includes the following steps:

[0200] Establish an encryption bridge association table for the security domain. The encryption bridge association table is a two-dimensional matrix T[K][K], where K is the number of encryption bridges in the security domain, and T[i][j]=1 indicates that there is an association between bridge i and bridge j. The associated encryption bridges are directly connected.

[0201] Accordingly, before the step S302 of requesting a corresponding session key from the quantum key distribution network for each received source MAC address, the following steps are also included:

[0202] Based on the encryption bridge association table, a second encryption bridge associated with the first encryption bridge is acquired.

[0203] Specifically, the management and control platform updates the encryption policy MAC table corresponding to the first encryption bridge according to the source MAC reported by the encryption bridge, and triggers the key distribution process for the encryption bridge:

[0204] 1) Obtaining a list of other second encryption bridges associated with the first encryption bridge according to the association table;

[0205] 2) For each newly added source MAC address, apply for a session key from the quantum key distribution network, and encrypt it with the master key (randomly selected) of the first encryption bridge (the bridge that reports the message) and other associated second encryption bridges to form a session key ciphertext distributed to different encryption bridges. The master key is also used to calculate the ICV (integrity check value) of the key distribution message in step 3);

[0206] 3) Send the first key distribution message and the second key distribution message to the first encryption bridge and the associated second encryption bridge in turn, distributing the session key and the corresponding source MAC address. The message format is:

[0207] 2-byte encryption policy MAC table new count + 4-byte master key ID + k1*(newly added source MAC address + session key ciphertext) + ICV (integrity check value)

[0208] 4) Send MAC delete messages to the associated second encryption bridge in turn. The message format is:

[0209] 2-byte encryption policy MAC table new count + 4-byte master key ID + k2*(deleted source MAC address) + ICV (integrity check value)

[0210] 5) For each associated second encryption bridge, the management and control platform randomly obtains the master key of the bridge from the quantum key distribution network and uses the master key to perform ICV calculation.

[0211] In one embodiment, before step S301: receiving the source MAC address reporting message sent by the first encryption bridge, the method further includes the following steps:

[0212] Receive registration messages sent by the first encryption bridge and the second encryption bridge, and obtain master keys corresponding to the first encryption bridge and the second encryption bridge from a quantum key distribution network based on the registration messages, and verify the registration messages.

[0213] In one embodiment, before step S301: receiving the source MAC address reporting message sent by the first encryption bridge, the method further includes the following steps:

[0214] Define security zones for encryption bridges.

[0215] This embodiment divides the security domain and pre-fills a large number of identical master keys for each device node in the security domain and uses them randomly, thereby safely and efficiently solving the problem of identity authentication and key distribution protection between bridge device nodes with encryption requirements and the management and control platform.

[0216] Example 4

[0217] like Figure 4 As shown, the fourth embodiment of the present invention proposes a method for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, the method comprising the following steps:

[0218] S401. The first encryption bridge uses the MAC address information in the local encryption policy MAC table as the source MAC address and sends it to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty.

[0219] S402: The management and control platform applies for a corresponding session key for each received source MAC address, generates a first key distribution message and a second key distribution message, and distributes them to the first encryption bridge and the second encryption bridge, where the second encryption bridge is directly connected to the first encryption bridge.

[0220] S403: The first encryption bridge receives the first key distribution message, and places the session key corresponding to each source MAC address into the source MAC address entry in the local encryption policy MAC table, and refreshes the encryption policy MAC table.

[0221] S404: The second encryption bridge receives the second key distribution message and places each source MAC address and the corresponding session key into a local decryption policy MAC table;

[0222] S405. The first encryption bridge retrieves a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table, and encrypts the outbound Ethernet data frame to obtain an encrypted message.

[0223] S406: The second encryption bridge retrieves the session key that matches the source MAC address of the Ethernet data frame from the decryption policy MAC table, and decrypts the incoming encrypted message.

[0224] This embodiment automatically learns the source MAC address through the encryption bridge port and sends the learned source MAC address information to the management and control platform. The management and control platform generates different session keys based on different source MAC addresses and distributes them to other associated encryption bridges through the management and control platform, thus achieving the automatic generation and centralized distribution of session keys and encryption policies, and safely and efficiently solving the security policy distribution and key management issues between Ethernet devices with encryption intercommunication requirements. This embodiment is mainly aimed at the application scenario of Layer 2 Ethernet frame encryption with centralized distribution of keys and encryption policies. It performs data encryption and decryption based on the source MAC address and automatically learns to form policy elements. It achieves synchronization of session keys and encryption policies between associated encryption bridge device nodes through software-defined encryption policies and centralized distribution.

[0225] In one embodiment, each Ethernet interface of an encryption bridge is defined as a type: an interface not connected to another encryption bridge of the same type is defined as a encrypted port, and an interface connected to another encryption bridge of the same type is defined as an open port. In addition to performing the functions of a normal bridge port, a clear port adds the source MAC address learned by the port to the local encryption policy MAC table. This table entry consists of a MAC address and a corresponding session key (used to encrypt Ethernet frames with this MAC address as the source MAC address). The table entry lifecycle is the same as that of a normal MAC table entry. The session key is initially empty and distributed by the management and control platform.

[0226] In one embodiment, step S401: the first encryption bridge uses the MAC address information in the local encryption policy MAC table as the source MAC address and sends it to the management and control platform, including:

[0227] The first encryption bridge reports the MAC address information of the local encryption policy MAC table of the bridge to the management and control platform from time to time. The message format is: 4-byte master key ID + 2-byte encryption policy MAC table new addition count + k1*(newly added source MAC address) + 2-byte encryption policy MAC table deletion count + k2*(deleted source MAC address) + ICV (first integrity check value).

[0228] The master key ID is randomly selected from the master key pool of the first encryption bridge itself, and ICV is the HMAC of the entire message calculated using the master key corresponding to the master key ID.

[0229] It should be noted that each time the encryption bridge is started, after a period of port learning, it establishes a management channel to the management and control platform, registers and reports the entire encryption policy MAC table. At this time, the deletion count in the report message is zero; each time the content of the encryption policy MAC table changes, that is, there is a new added or expired source MAC address, a report message is sent to the management and control platform, the content includes the newly added and deleted MAC addresses.

[0230] In one embodiment, in step S402, the control platform applies for a corresponding session key for each received source MAC address, generates a first key distribution message and a second key distribution message, and distributes them to the first encryption bridge and the second encryption bridge, including the following steps:

[0231] S421. Obtain a list of other second encryption bridges associated with the first encryption bridge according to a pre-built encryption bridge association table;

[0232] S422. For each newly added source MAC address, apply for a session key from the quantum key distribution network, obtain a master key corresponding to the first encryption bridge from the quantum key distribution network, encrypt the session key, and obtain a first session key ciphertext; randomly obtain a master key corresponding to the second encryption bridge from the quantum key distribution network, encrypt the session key, and obtain a second session key ciphertext; use the corresponding master key to calculate the ICV (integrity check value) of the first key distribution message and the second key distribution message;

[0233] S423. Send a first key distribution message and a second key distribution message to the first encryption bridge and the associated second encryption bridge in sequence, distributing the session key and the corresponding MAC address. The message format is: 2-byte encryption policy MAC table new addition count + 4-byte master key ID + k1 * (newly added source MAC address + session key ciphertext) + ICV (integrity check value);

[0234] S424. Send MAC delete messages to the associated second encryption bridges in sequence. The message format is: 2-byte encryption policy MAC table new addition count + 4-byte master key ID + k2*(deleted source MAC address) + ICV (integrity check value);

[0235] Among them, for each associated second encryption bridge, the management and control platform randomly obtains the master key corresponding to the bridge from the quantum key distribution network and uses the master key to perform ICV calculation.

[0236] It should be noted that after receiving the encryption policy MAC table message of the first encryption bridge, the management and control platform first obtains the master key corresponding to the KeyID of the first encryption bridge from the quantum key distribution network, which is used to verify the MAC table message. If the verification passes, a key distribution message is generated. If the verification fails, the data transmission process is terminated.

[0237] In one embodiment, the management and control platform establishes an encryption bridge association table for each security domain. This table is a two-dimensional matrix, which can be represented by a two-dimensional array, namely, T[K][K] (where K is the number of encryption bridges in the security domain). T[i][j] = 1 indicates that there is an association between bridges i and j. Data frames between these associated bridges are directly reachable without the need for other encryption bridges to relay them. The associations are uniformly set by the administrator based on the network topology.

[0238] In one embodiment, step S403, in which the first encryption bridge receives the first key distribution message, places the session key corresponding to each source MAC address into a source MAC address entry in a local encryption policy MAC table, and refreshes the encryption policy MAC table, includes:

[0239] After receiving the first key distribution message, the first encryption bridge takes out the corresponding master key according to the master key ID, performs integrity check on the frame, and decrypts it;

[0240] The session key corresponding to the source MAC address in the first key distribution message is placed into the source MAC address entry corresponding to the encryption policy MAC table.

[0241] In one embodiment, step S404, wherein the second encryption bridge receives the second key distribution message and places each source MAC address and the corresponding session key into a local decryption policy MAC table, includes the following steps:

[0242] After receiving the second key distribution message, the second encryption bridge takes out the corresponding master key according to the master key ID, performs integrity check on the frame, and decrypts it;

[0243] Each source MAC address and corresponding session key in the second key distribution message is added to the decryption policy MAC table. The table entry is the source MAC address and the corresponding session key, where the source MAC address is the source MAC address in the key distribution message.

[0244] In one embodiment, step S405, wherein the first encryption bridge retrieves a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table and encrypts the outbound Ethernet data frame to obtain an encrypted message, includes the following steps:

[0245] The first encryption bridge device node encrypts the outbound Ethernet data frame (forwarded through any open port) whose source MAC address matches the encryption policy MAC table, that is, it takes out the session key in the item matching the source MAC address of the frame from the encryption policy MAC table, and encrypts the frame data outside the Ethernet frame header. The encryption mode is CBC (integer multiple of the algorithm group) + CFB (remainder part other than the integer multiple of the algorithm group), and no additional data is added.

[0246] S406: The second encryption bridge retrieves the session key that matches the source MAC address of the Ethernet data frame from the decryption policy MAC table and decrypts the inbound encrypted message, including the following steps:

[0247] The second encryption bridge device node decrypts the incoming Ethernet data frame (accepted through any open port) whose source MAC address matches the decryption policy MAC table, that is, it takes out the session key from the item matching the source MAC address of the frame from the decryption policy MAC table and decrypts the frame data outside the Ethernet frame header.

[0248] In one embodiment, the method also includes: after the second encryption bridge receives the MAC deletion message, it retrieves the master key according to the master key ID to perform an integrity check on the frame, and then deletes the table entry corresponding to the source MAC address in the decryption policy MAC table in turn according to each source MAC address in the message.

[0249] It should be noted that the encryption policy achieves on-demand encryption by dynamically adding or deleting MAC addresses through learning, thereby improving the effective utilization of encryption bridge device resources.

[0250] In one embodiment, before step S401: the first encryption bridge uses the MAC address information in the local encryption policy MAC table as the source MAC address and sends it to the management and control platform, the method further includes:

[0251] The first and second encryption bridges in the security domain are started and connected to the management and control platform through the management channel (configurable IP port), establishing a reliable connection (TCP long connection) and registering. The registration message format is: encryption bridge ID||encryption bridge management IP||random number R||KeyID||HMAC(Key, encryption bridge ID||encryption bridge management IP||random number R||KeyID);

[0252] In the above formula, HMAC(Key, data) represents a keyed hash operation performed on the data using the key Key, where Key is the master key corresponding to the randomly selected KeyID. Upon receiving the registration request, the control platform obtains the master key corresponding to the encryption bridge KeyID from the QKD network and verifies the registration message.

[0253] In one embodiment, before step S401: the first encryption bridge uses the MAC address information in the local encryption policy MAC table as the source MAC address and sends it to the management and control platform, the method further includes:

[0254] The security domain is defined by the management and control platform;

[0255] The first encryption bridge and the second encryption bridge send a key injection request to the quantum key distribution network, and use a large-capacity secure storage medium such as a secure TF card or a secure U shield to pre-inject a large number of master keys for each device node in its storage medium. The key format is a 4-byte key ID + n-byte key and an n-byte initialization vector (n is related to the encryption algorithm). The quantum key distribution network QKD stores the master keys and key IDs distributed to each device node in different security domains in the key pool.

[0256] The pre-filled master key is injected into the encryption bridge device node in the domain from the secure storage medium to establish a master key pool, and a key bitmap is used to indicate whether the key has been used.

[0257] This embodiment divides the security domain and pre-fills a large number of identical master keys for each device node in the security domain and uses them randomly, thereby safely and efficiently solving the problem of identity authentication and key distribution protection between bridge device nodes with encryption requirements and the management and control platform.

[0258] This embodiment mainly targets the application scenario of Layer 2 Ethernet frame encryption with centralized key and encryption policy distribution. It performs data encryption and decryption based on the source MAC address and automatically learns to form policy elements. It achieves synchronization of session keys and encryption policies between associated encryption bridge device nodes through software-defined encryption policies and centralized distribution. It implements one-time-only encryption in the session key distribution process and identity authentication of devices within the domain by pre-filling a large number of master keys, thereby achieving secure, efficient, manageable, and controllable Ethernet data frame encrypted transmission.

[0259] Example 5

[0260] like Figure 5 As shown, the fifth embodiment of the present invention provides an encryption bridge, which includes:

[0261] The source MAC address message sending module 11 is used to use the MAC address information in the local encryption policy MAC table as the source MAC address and send it to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty.

[0262] A first key distribution message receiving module 12 is configured to receive a first key distribution message returned by the control platform, wherein the first key distribution message includes a source MAC address and a corresponding session key;

[0263] The first encryption and decryption policy MAC table management module 13 is used to place the session key corresponding to each source MAC address into the source MAC address table entry in the local encryption policy MAC table and refresh the encryption policy MAC table;

[0264] The first data encryption and decryption module 14 is configured to retrieve a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table, and encrypt the Ethernet data frame to obtain an encrypted message.

[0265] This embodiment automatically learns the source MAC address through the encryption bridge port and sends the learned source MAC address information to the management and control platform. The management and control platform generates different session keys based on different source MAC addresses and distributes them to other associated encryption bridges through the management and control platform, thus achieving the automatic generation and centralized distribution of session keys and encryption policies, and safely and efficiently solving the security policy distribution and key management issues between Ethernet devices with encryption intercommunication requirements. This embodiment is mainly aimed at the application scenario of Layer 2 Ethernet frame encryption with centralized distribution of keys and encryption policies. It performs data encryption and decryption based on the source MAC address and automatically learns to form policy elements. It achieves synchronization of session keys and encryption policies between associated encryption bridge device nodes through software-defined encryption policies and centralized distribution.

[0266] In one embodiment, a master key pool is provided in the first encryption bridge, wherein the master key pool stores a master key and a master key ID pre-filled by a quantum key distribution system;

[0267] Accordingly, the source MAC address message sending module 11 is specifically configured to perform the following steps:

[0268] MAC address messages are sent to the management and control platform at irregular intervals. The MAC address messages carry information including the master key ID, encryption policy MAC table new addition count, new source MAC address, encryption policy MAC table deletion count, deleted source MAC address and the first integrity check value.

[0269] It should be noted that the source MAC address message sending module 11 is used to report the MAC address information of the local encryption policy MAC table of the bridge to the management and control platform from time to time. The message format of the MAC address message is:

[0270] 4-byte master key ID + 2-byte encryption policy MAC table new addition count + k1*(newly added source MAC address) + 2-byte encryption policy MAC table deletion count + k2*(deleted source MAC address) + ICV (first integrity check value), where k1 and k2 represent the number of newly added and deleted source MAC addresses, respectively.

[0271] In one embodiment, the first encryption / decryption strategy MAC table management module 13 specifically includes:

[0272] a first verification and decryption unit, configured to obtain a corresponding master key from its own master key pool using the master key ID, perform an integrity check on the second integrity check value, and decrypt the session key ciphertext to obtain a session key corresponding to each source MAC address;

[0273] The first encryption policy MAC table refreshing unit is used to place the session key corresponding to each source MAC address into the source MAC address table item in the local encryption policy MAC table, and refresh the encryption policy MAC table.

[0274] In one embodiment, the first data encryption and decryption module 14 specifically includes:

[0275] A first session key reading unit, configured to retrieve a session key matching a source MAC address of an Ethernet data frame from the encryption policy MAC table;

[0276] The first data encryption and decryption unit is used to encrypt the frame data of the Ethernet data frame except the frame header by using the session key, wherein the encryption mode adopts the CBC algorithm combined with the CFB algorithm.

[0277] In one embodiment, the encryption bridge further includes a registration message sending module, configured to:

[0278] Connect to the management and control platform through the management channel and send a registration message. The format of the registration message is: first encryption bridge ID||first encryption bridge management IP||random number R||KeyID||HMAC(Key, first encryption bridge ID||first encryption bridge management IP||random number R||KeyID), where HMAC(Key, data) means using the key Key to perform a keyed hash operation on the data data, and Key is a randomly selected master key corresponding to the first encryption bridge identifier KeyID.

[0279] In one embodiment, the encryption bridge further includes a port type definition module, configured to:

[0280] Define the Ethernet interface type of the first encryption bridge, where the interface that is not connected to other encryption bridges of the same type is defined as a secret port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The secret port is used to add the source MAC address learned by the port to the local encryption policy MAC table.

[0281] In one embodiment, the encryption bridge further includes a key application module configured to:

[0282] Send a key injection request to the quantum key distribution network or key agent;

[0283] The master key injected by the quantum key distribution network is received through a first secure storage medium, a master key pool is established, and a key bitmap is used to identify whether each master key has been used, wherein the quantum key distribution network stores the master keys and master key IDs distributed to each encryption bridge in different security domains.

[0284] It should be noted that other embodiments or implementation methods of the encryption bridge of the present invention can refer to the above-mentioned method embodiment 1, which will not be repeated here.

[0285] Example 6

[0286] like Figure 6 As shown, the sixth embodiment of the present invention provides an encryption bridge, which includes:

[0287] A second key distribution message receiving module 21 is configured to receive a second key distribution message returned by the management and control platform, where the second key distribution message includes a source MAC address and a corresponding session key;

[0288] The second encryption and decryption policy MAC table management module 22 is used to place each source MAC address and the corresponding session key into the local decryption policy MAC table;

[0289] An encrypted message receiving module 23 is configured to receive an encrypted message sent by the first encryption bridge, wherein the encrypted message is obtained by encrypting the Ethernet data frame by taking out a session key that matches the source MAC address of the Ethernet data frame from its local encryption policy MAC table;

[0290] The second data encryption and decryption module 24 is configured to retrieve a session key that matches the source MAC address of the Ethernet data frame from the decryption policy MAC table and decrypt the encrypted message.

[0291] The encryption bridge in this embodiment acts as a receiver and is associated with a sender encryption bridge. The management and control platform generates different session keys based on different source MAC addresses and distributes them to other receiver encryption bridges associated with the sender encryption bridge through the management and control platform. This enables the automatic generation and centralized distribution of session keys and encryption policies, safely and efficiently solving the security policy distribution and key management issues between Ethernet devices with encryption interoperability requirements. This embodiment is mainly aimed at the application scenario of Layer 2 Ethernet frame encryption with centralized distribution of keys and encryption policies. It performs data encryption and decryption based on the source MAC address and automatically learns to form policy elements. It achieves synchronization of session keys and encryption policies between associated encryption bridge device nodes through software-defined encryption policies and centralized distribution.

[0292] In one embodiment, the encryption bridge further comprises:

[0293] A deletion message receiving module is used to receive a MAC deletion message returned by the control platform, wherein the MAC deletion message carries information including the encryption policy MAC table new addition count, the master key ID, the deleted source MAC address, and the third integrity check value;

[0294] a verification module module, configured to select a corresponding master key from the master key pool according to the master key ID to perform an integrity check on the third integrity check value;

[0295] The decryption policy MAC table refreshing module is used to delete the table entry corresponding to the source MAC address in the decryption policy MAC table in sequence according to each source MAC address in the MAC deletion message, and refresh the decryption policy MAC table.

[0296] In this embodiment, the encryption policy realizes on-demand encryption by dynamically adding or deleting MAC addresses through learning, thereby improving the effective utilization of encryption bridge device resources.

[0297] In one embodiment, the encryption bridge further includes a registration message sending module, configured to:

[0298] Connect to the management and control platform through the management channel and send a registration message. The format of the registration message is: second encryption bridge ID||second encryption bridge management IP||random number R||KeyID||HMAC(Key, second encryption bridge ID||plus second encryption bridge management IP||random number R||KeyID), where HMAC(Key, data) means using the key Key to perform a keyed hash operation on the data data, and Key is a randomly selected master key corresponding to the second encryption bridge identifier KeyID.

[0299] In one embodiment, the encryption bridge further includes a port definition module configured to:

[0300] The Ethernet interface type of the first encryption bridge is defined, wherein an interface not connected to other encryption bridges of the same type is defined as a encrypted port, and an interface connected to other encryption bridges of the same type is defined as an open port.

[0301] It should be noted that, in this embodiment, the open port and the encrypted port of the second encryption bridge can perform the functions of ordinary bridge ports, and inbound Ethernet data frames can be forwarded through any open port.

[0302] In one embodiment, the encryption bridge further includes a key application module configured to:

[0303] Send a key injection request to the quantum key distribution network or key agent;

[0304] The master key injected by the quantum key distribution network is received through a second secure storage medium, a master key pool is established, and a key bitmap is used to identify whether each master key has been used, wherein the quantum key distribution network stores the master keys and master key IDs distributed to each encryption bridge in different security domains.

[0305] It should be noted that the encryption network bridge as the receiver is integrated with a second secure storage medium. The first secure storage medium can use a large-capacity secure storage medium including but not limited to a secure TF card or a secure U shield. A large number of master keys are pre-filled for the first encryption bridge through the first secure storage medium. The key format is a 4-byte key ID + n-byte key and an n-byte initialization vector (n is related to the encryption algorithm). The second encryption bridge builds a master key pool based on this. The quantum key distribution network stores the master keys and key IDs distributed to each device node in different security domains in the key pool.

[0306] This embodiment implements a one-time pad in the session key distribution process and identity authentication of devices within the domain by pre-filling a large number of master keys, thereby achieving secure, efficient, manageable and controllable Ethernet data frame encrypted transmission.

[0307] It should be noted that other embodiments or implementation methods of the encryption bridge of the present invention can refer to the above-mentioned method embodiment 2, which will not be repeated here.

[0308] Example 7

[0309] like Figure 7 As shown, the seventh embodiment of the present invention provides a management and control platform, which includes:

[0310] A message receiving module 31 is configured to receive a source MAC address reporting message sent by the first encryption bridge, wherein the source MAC address reporting message carries information including a master key ID corresponding to the first encryption bridge and a source MAC address in the encryption policy MAC table;

[0311] A session key application module 32 is configured to apply for a corresponding session key from the quantum key distribution network for each newly received source MAC address;

[0312] The key distribution message generation module 33 is used to generate a first key distribution message and a second key distribution message based on the session key, and distribute them to the first encryption bridge and the second encryption bridge, and the second encryption bridge is directly connected to the first encryption bridge.

[0313] This embodiment automatically learns MAC addresses through the bridge port, and the management and control platform generates different session keys based on different source MAC addresses, and distributes them to the first encryption bridge and other second encryption bridges associated with the first encryption bridge through the management and control platform, thereby realizing the automatic generation and centralized distribution of session keys and encryption policies, and safely and efficiently solving the security policy distribution and key management problems between Ethernet devices with encryption intercommunication requirements.

[0314] In one embodiment, the session key application module 32 includes:

[0315] a verification unit, configured to obtain a master key corresponding to the first encryption bridge from a quantum key distribution network, and verify the first integrity check value using the master key;

[0316] The session key application unit is used to apply for a corresponding session key from the quantum key distribution network for each newly received source MAC address.

[0317] In one embodiment, the key distribution message generation module 33 includes:

[0318] a first key distribution unit, configured to encrypt the session key using a master key corresponding to the first encryption bridge to generate a first key distribution message;

[0319] a second key distribution unit, configured to encrypt the session key using a master key corresponding to the second encryption bridge to generate a second key distribution message;

[0320] The information carried by the first key distribution message and the second key distribution message includes the newly added count of the encryption policy MAC table, the master key ID, the newly added source MAC address and the corresponding session key ciphertext and the second integrity check value.

[0321] In one embodiment, the management and control platform further includes a deletion message sending module, which is used to:

[0322] A MAC delete message is sent to the second encryption bridge, where the MAC delete message carries information including a new count of the encryption policy MAC table, a master key ID, a deleted source MAC address, and a third integrity check value.

[0323] In one embodiment, the management and control platform further includes an association table establishment module for:

[0324] An encryption bridge association table is established for the security domain. The encryption bridge association table is a two-dimensional matrix T[K][K], where K is the number of encryption bridges belonging to the security domain, and T[i][j]=1 indicates that there is an association between bridge i and bridge j, and the associated encryption bridges are directly connected.

[0325] In one embodiment, the management and control platform further includes a registration module for:

[0326] Receive registration messages sent by the first encryption bridge and the second encryption bridge, and obtain master keys corresponding to the first encryption bridge and the second encryption bridge from a quantum key distribution network based on the registration messages, and verify the registration messages.

[0327] In one embodiment, the management and control platform further includes a security domain demarcation module, which is used to:

[0328] Define security zones for encryption bridges.

[0329] This embodiment divides the security domain and pre-fills a large number of identical master keys for each device node in the security domain and uses them randomly, thereby safely and efficiently solving the problem of identity authentication and key distribution protection between bridge device nodes with encryption requirements and the management and control platform.

[0330] It should be noted that other embodiments or implementation methods of the encryption bridge of the present invention can refer to the above-mentioned method embodiment 3, which will not be repeated here.

[0331] Example 8

[0332] like Figure 8 As shown, the eighth embodiment of the present invention further proposes a system for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, the system comprising a first encryption bridge 1, a second encryption bridge 2, a management and control platform 3, and a quantum key distribution system 4. The first encryption bridge 1 is associated with the second encryption bridge 2 and both are connected to the management and control platform 3 and the quantum key distribution system 4. The management and control platform 3 is connected to the quantum key distribution system 4. The first encryption bridge 1 and the second encryption bridge 2 are both integrated with a secure storage medium.

[0333] The management and control platform is used to distribute encryption policies and session keys based on the source MAC address information reported by the first encryption bridge;

[0334] The quantum key distribution network is used to distribute the master key to the control platform and the secure storage medium;

[0335] The first encryption bridge and the second encryption bridge are used to perform encryption and decryption processing on user Ethernet data frames transmitted through the bridges.

[0336] It should be noted that the management and control platform: provides the correspondence between encryption bridges, key agents, and quantum network nodes, distributes encryption policies and session keys, divides security domains, and provides registration and identity binding services for encryption bridges;

[0337] Key agent: Provides agent functions for key injection and online key distribution when the nodes of the quantum key distribution network cannot directly provide key injection and online key distribution services;

[0338] Quantum key distribution network: includes quantum network nodes and quantum network link control center, realizing quantum key generation and online distribution, quantum key relay, quantum key provision and other services;

[0339] Quantum network node: stores generated quantum keys, receives key requests from key agents, provides keys to key agents, or directly provides key injection and online key distribution services;

[0340] Quantum network link control center: can establish quantum key distribution and relay links between nodes according to quantum network node ID;

[0341] Encryption bridge: encrypts and decrypts user Ethernet data frames transmitted through the bridge. It consists of modules such as data encryption and decryption processing, encryption and decryption strategy MAC table management, registration and management agent module, and key injection.

[0342] It should be understood that the key distribution equipment involved in this embodiment includes but is not limited to the QKD key distribution network, the key pre-filling function involved can be implemented using any symmetric key management system and equipment, and the symmetric encryption algorithm and cryptographic hash algorithm involved can use any algorithm that complies with national cryptographic management regulations.

[0343] In one embodiment, if Figure 9 As shown, the registration and management agent module is used to send a registration message to the management and control platform to complete the registration, send a key application to the quantum key distribution system, and obtain the master key pre-filled by the quantum key distribution network through a secure storage medium;

[0344] The key injection module is used to construct a master key pool based on the master key in the secure storage medium;

[0345] a data encryption and decryption processing module, configured to retrieve a session key that matches the source MAC address of an Ethernet data frame from the encryption policy MAC table, encrypt the outbound Ethernet data frame, and obtain an encrypted message; and to retrieve a session key that matches the source MAC address of an Ethernet data frame from the decryption policy MAC table, and decrypt the inbound encrypted message;

[0346] The encryption and decryption policy MAC table management module is used to place the session key corresponding to each source MAC address into the source MAC address table item in the local encryption policy MAC table according to the key distribution message returned by the management and control platform, and refresh the encryption policy MAC table; and is used to place each source MAC address and the corresponding session key into the local decryption policy MAC table according to the key distribution message returned by the management and control platform; and is used to delete the table item corresponding to the source MAC address in the decryption policy MAC table according to each source MAC address in the message in turn according to the MAC deletion message returned by the management and control platform.

[0347] In one embodiment, each Ethernet interface of an encryption bridge is defined as a type: an interface not connected to another encryption bridge of the same type is defined as a encrypted port, and an interface connected to another encryption bridge of the same type is defined as an open port. In addition to performing the functions of an ordinary bridge port, both the open and closed ports can be used to forward Ethernet data frames from the master station and inbound Ethernet data frames. The encrypted port adds the source MAC address learned by the port to the local encryption policy MAC table. The table entry consists of a MAC address and a corresponding session key (for encrypting Ethernet frames with the MAC address as the source MAC). The table entry lifecycle is the same as that of an ordinary MAC table entry. The session key is initially empty and distributed by the management and control platform.

[0348] In one embodiment, the control platform includes:

[0349] The association table creation module is used to create an encryption bridge association table for the security domain. This table is a two-dimensional matrix, which can be represented by a two-dimensional array, namely T[K][K] (K is the number of encryption bridges in the security domain). T[i][j] = 1 indicates that there is an association between bridges i and j. Data frames between the associated bridges can be directly reached without the need for other encryption bridges to transfer. The association relationship is uniformly set by the administrator based on the network topology.

[0350] The encryption and decryption policy MAC table refresh module is used to apply for a corresponding session key for each source MAC address received, generate a first key distribution message, a second key distribution message and a deletion message, and distribute them to the sender encryption bridge and the receiver encryption bridge, and send the deletion message to the receiver encryption bridge.

[0351] It should be noted that other embodiments or implementation methods of the encryption bridge and the management and control platform of the present invention can refer to the above-mentioned embodiments 5 to 7, which will not be repeated here.

[0352] It should be noted that if Figure 10 As shown, the workflow of the system for implementing Ethernet data encryption and decryption using quantum key distribution and software definition proposed in this embodiment is as follows:

[0353] (1) The control platform defines the security domain and uses a secure storage medium through the quantum key distribution network to pre-fill a large number of master keys for each encryption bridge device node in its storage medium. The key format is 4-byte key ID + n-byte key and n-byte initialization vector (n is related to the encryption algorithm). The quantum key distribution network QKD stores the master keys and key IDs distributed to each device node in different security domains in the key pool.

[0354] (2) Inject the pre-filled master key into the encryption bridge device node in the domain, establish a master key pool, and use the key bitmap to indicate whether the key has been used.

[0355] (3) The management and control platform establishes an encryption bridge association table for the security domain. This table is a two-dimensional matrix that can be represented by a two-dimensional array, namely T[K][K] (K is the number of encryption bridges in the security domain). T[i][j] = 1 indicates that there is an association between bridge i and bridge j. Data frames between the associated bridges can be directly reached without the need for other encryption bridges to transfer. The association relationship is uniformly set by the administrator based on the network topology.

[0356] An encryption policy MAC table is established on the management and control platform for each encryption bridge. The table contains the source MAC address of the device directly connected to the encryption bridge (without forwarding through other encryption bridges) and the session key used to encrypt the Ethernet frame with the MAC address as the source address. The key is obtained by the management and control platform from the network.

[0357] (4) When the encryption bridge in the security domain is started, it connects to the management and control platform through the management channel (the port with configurable IP).

[0358] Establish a reliable connection (TCP long connection) and register. The registration message format is:

[0359] Encrypted Bridge ID||Encrypted Bridge Management IP||Random Number R||KeyID||HMAC(Key, Encrypted Bridge ID||Encrypted Bridge Management IP||Random Number R||KeyID)

[0360] In the above formula, HMAC(Key, data) represents a keyed hash operation performed on the data using the key Key, where Key is the master key corresponding to the randomly selected KeyID. Upon receiving the registration request, the control platform obtains the master key corresponding to the encryption bridge KeyID from the QKD network and verifies the registration message.

[0361] (5) Definition type of each Ethernet interface of the encryption bridge: Interfaces that are not connected to other encryption bridges of the same type are defined as encrypted ports, and interfaces that are connected to other encryption bridges of the same type are defined as open ports. In addition to performing the functions of ordinary bridge ports, the encrypted port adds the source MAC address learned by the port to the local encryption policy MAC table. The table entry consists of the MAC address and the corresponding session key (encrypting the Ethernet frame with the MAC address as the source MAC). The table entry life cycle is the same as the life cycle of the ordinary MAC table entry. The session key is initially empty and distributed by the management and control platform.

[0362] (6) The first encryption bridge as the sender reports the MAC address information of the local encryption policy MAC table of the bridge to the control platform from time to time. The message format is:

[0363] 4-byte master key ID + 2-byte encryption policy MAC table new addition count + k1*(newly added source MAC address) + 2-byte encryption policy MAC table deletion count + k2*(deleted source MAC address) + ICV (integrity check value)

[0364] The master key ID is randomly selected, and ICV is the HMAC of the entire message calculated using the master key corresponding to the master key ID.

[0365] After each startup of the first encryption bridge as the sender, after a period of port learning, it establishes a management channel to the management and control platform, registers and reports the entire encryption policy MAC table. At this time, the deletion count in the report message is zero; every time the content of the encryption policy MAC table changes, that is, there is a new added or expired source MAC address, a report message is sent to the management and control platform, including the newly added and deleted MAC addresses.

[0366] (7) After receiving the encryption policy MAC table report message from the first encryption bridge as the sender, the control platform obtains the master key corresponding to the encryption bridge KeyID from the QKD network and verifies the report message. Afterwards, the control platform refreshes the encryption policy MAC table corresponding to the encryption bridge according to the reported source MAC and triggers the key distribution process for the encryption bridge:

[0367] 1) Obtain a list of other encryption bridges associated with the encryption bridge according to the association table;

[0368] 2) For each newly added source MAC address, a session key is requested from the QKD network and encrypted with the master key (randomly selected) of the local bridge (the bridge reporting the message) and other associated bridges to form the session key ciphertext distributed to different encryption bridges. The master key is also used to calculate the ICV (integrity check value) of the key distribution message in 3);

[0369] 3) Send key distribution messages to the first encryption bridge and the associated second encryption bridge in turn, distributing the session key and the corresponding MAC address. The message format is:

[0370] 2-byte encryption policy MAC table new count + 4-byte master key ID + k1*(newly added source MAC address + session key ciphertext) + ICV (integrity check value)

[0371] 4) Send MAC delete messages to the associated encryption bridges in turn. The message format is:

[0372] 2-byte encryption policy MAC table new count + 4-byte master key ID + k2*(deleted source MAC address) + ICV (integrity check value)

[0373] For each associated encryption bridge, the management and control platform randomly obtains the master key of the bridge from the QKD network and uses the master key to perform ICV calculations.

[0374] (8) After receiving the key distribution message, the encryption bridge in the security domain retrieves the master key based on the master key ID, performs an integrity check on the frame, and decrypts it. For the encryption bridge that sends the report message, the session key corresponding to the source MAC address in the key distribution message is placed in the source MAC address table entry corresponding to the encryption policy MAC table. For the encryption bridge associated with the sending encryption bridge, each source MAC address and corresponding session key in the distribution message is added to the decryption policy MAC table. The table entry is the source MAC address and the corresponding session key, where the source MAC address is the source MAC address in the key distribution message.

[0375] (9) After receiving the MAC delete message, the associated encryption bridge retrieves the master key according to the master key ID to perform an integrity check on the frame, and then deletes the entry corresponding to the source MAC address in the decryption policy MAC table in turn according to each source MAC address in the message.

[0376] (10) The first encryption bridge device node as the sender encrypts the outbound (forwarded through any open port) Ethernet data frame whose source MAC address matches the encryption policy MAC table, that is, takes out the session key from the item matching the source MAC address of the frame from the encryption policy MAC table, and encrypts the frame data other than the Ethernet frame header. The encryption mode is CBC (integer multiple of the algorithm group) + CFB (remainder other than the integer multiple of the algorithm group), and no additional data is added.

[0377] (11) The second encryption bridge device node as the receiver decrypts the incoming Ethernet data frame (received through any open port) whose source MAC address matches the decryption policy MAC table, that is, it takes out the session key in the item that matches the source MAC address of the frame from the decryption policy MAC table and decrypts the frame data outside the Ethernet frame header.

[0378] The technical effects of this embodiment are:

[0379] (1) By dividing the security domain and pre-filling a large number of identical master keys for each device node in the security domain and using them randomly, the problem of identity authentication and key distribution protection between the bridge device nodes with encryption requirements and the control center is solved safely and efficiently;

[0380] (2) By automatically learning the MAC of the bridge port and generating different session keys based on different source MACs, and distributing them to other encryption bridges with associated relationships through the management and control center, the automatic generation and centralized distribution of session keys and encryption policies are realized, which safely and efficiently solves the security policy distribution and key management problems between Ethernet devices with encryption intercommunication requirements.

[0381] (3) The encryption strategy achieves on-demand encryption by dynamically adding or deleting MAC addresses, thereby improving the effective utilization of encryption bridge device resources.

[0382] This embodiment mainly targets the application scenario of Layer 2 Ethernet frame encryption with centralized key and encryption policy distribution. It performs data encryption and decryption based on the source MAC address and automatically learns to form policy elements. It achieves synchronization of session keys and encryption policies between associated encryption bridge device nodes through software-defined encryption policies and centralized distribution. It implements one-time-only encryption in the session key distribution process and identity authentication of devices within the domain by pre-filling a large number of master keys, thereby achieving secure, efficient, manageable, and controllable Ethernet data frame encrypted transmission.

[0383] It should be noted that the logic and / or steps represented in the flowcharts or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing the logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, apparatus, or device (such as a computer-based system, a system including a processor, or other system that can fetch and execute instructions from an instruction execution system, apparatus, or device), or in conjunction with such instruction execution system, apparatus, or device. For the purposes of this specification, a "computer-readable medium" can be any device that can contain, store, communicate, propagate, or transmit a program for use by an instruction execution system, apparatus, or device, or in conjunction with such instruction execution system, apparatus, or device. More specific examples (non-exhaustive list) of computer-readable media include the following: an electrical connection portion having one or more wires (electronic device), a portable computer disk cartridge (magnetic device), random access memory (RAM), read-only memory (ROM), erasable and programmable read-only memory (EPROM or flash memory), fiber optic devices, and portable compact disc read-only memory (CDROM). Furthermore, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing it in another suitable manner if necessary, and then storing it in a computer memory.

[0384] It should be understood that various parts of the present invention can be implemented using hardware, software, firmware, or a combination thereof. In the above-described embodiments, multiple steps or methods can be implemented using software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented using hardware, as in another embodiment, any one of the following technologies known in the art or a combination thereof can be used: a discrete logic circuit having a logic gate circuit for implementing a logic function on a data signal, an application-specific integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0385] Throughout this specification, reference to terms such as "one embodiment," "some embodiments," "examples," "specific examples," or "some examples" means that a specific feature, structure, material, or characteristic described in conjunction with that embodiment or example is included in at least one embodiment or example of the present invention. In this specification, schematic representations of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in any one or more embodiments or examples.

[0386] Furthermore, the terms "first" and "second" are used for descriptive purposes only and should not be construed as indicating or implying relative importance or implicitly specifying the number of the technical features being referred to. Thus, a feature defined as "first" or "second" may explicitly or implicitly include at least one such feature. In the description of the present invention, "plurality" means at least two, such as two, three, etc., unless otherwise specifically defined.

[0387] Although the embodiments of the present invention have been shown and described above, it will be understood that the above embodiments are illustrative and are not to be construed as limitations on the present invention. A person skilled in the art may change, modify, replace and modify the above embodiments within the scope of the present invention.

Claims

1. A method for implementing Ethernet data encryption using quantum key distribution and software definition, characterized in that: Applied to a first encryption bridge, the method includes: The MAC address information in the local encryption policy MAC table is used as the source MAC address and sent to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty. Receive a first key distribution message returned by the control platform, where the first key distribution message includes a source MAC address and a corresponding session key; The session key corresponding to each source MAC address is placed into the source MAC address table entry in the local encryption policy MAC table, and the encryption policy MAC table is refreshed; A session key matching the source MAC address of the Ethernet data frame is taken out from the encryption policy MAC table, and the Ethernet data frame is encrypted to obtain an encrypted message.

2. The method for implementing Ethernet data encryption using quantum key distribution and software definition as claimed in claim 1, wherein: A master key pool is provided in the first encryption bridge, wherein the master key pool stores a master key and a master key ID pre-filled by a quantum key distribution system; Accordingly, the MAC address information in the local encryption policy MAC table is used as the source MAC address and sent to the management and control platform, including: MAC address messages are sent to the management and control platform at irregular intervals. The MAC address messages carry information including the master key ID, encryption policy MAC table new addition count, new source MAC address, encryption policy MAC table deletion count, deleted source MAC address and the first integrity check value.

3. The method for implementing Ethernet data encryption using quantum key distribution and software definition as claimed in claim 1, wherein: The first key distribution message carries information including the encryption policy MAC table new count, the master key ID, the new source MAC address and the corresponding session key ciphertext and the second integrity check value; Accordingly, placing the session key corresponding to each source MAC address into a source MAC address entry in the local encryption policy MAC table and refreshing the encryption policy MAC table includes: Using the master key ID, the server obtains the corresponding master key from its own master key pool, performs an integrity check on the second integrity check value, and decrypts the session key ciphertext to obtain the session key corresponding to each source MAC address; The session key corresponding to each source MAC address is placed into the source MAC address table entry in the local encryption policy MAC table, and the encryption policy MAC table is refreshed.

4. The method for implementing Ethernet data encryption using quantum key distribution and software definition as claimed in claim 1, wherein: The method of extracting a session key that matches a source MAC address of an Ethernet data frame from the encryption policy MAC table and encrypting the Ethernet data frame to obtain an encrypted message includes: Retrieving a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table; The session key is used to encrypt the frame data of the Ethernet data frame except the frame header, wherein the encryption mode adopts the CBC algorithm combined with the CFB algorithm.

5. The method for implementing Ethernet data encryption using quantum key distribution and software definition as claimed in claim 1, wherein: Before using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes: Connect to the management and control platform through the management channel and send a registration message. The format of the registration message is: first encryption bridge ID||first encryption bridge management IP||random number R||KeyID||HMAC(Key, first encryption bridge ID||first encryption bridge management IP||random number R||KeyID), where HMAC(Key, data) means using the key Key to perform a keyed hash operation on the data data, and Key is a randomly selected master key corresponding to the first encryption bridge identifier KeyID.

6. The method for implementing Ethernet data encryption using quantum key distribution and software definition as claimed in claim 1, wherein: Before using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes: Define the Ethernet interface type of the first encryption bridge, where the interface that is not connected to other encryption bridges of the same type is defined as a secret port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The secret port is used to add the source MAC address learned by the port to the local encryption policy MAC table.

7. The method for implementing Ethernet data encryption using quantum key distribution and software definition as claimed in claim 1, characterized in that: Before using the MAC address information in the local encryption policy MAC table as the source MAC address and sending it to the management and control platform, the method further includes: Send a key injection request to the quantum key distribution network or key agent; The master key injected by the quantum key distribution network is received through a first secure storage medium, a master key pool is established, and a key bitmap is used to identify whether each master key has been used, wherein the quantum key distribution network stores the master keys and master key IDs distributed to each encryption bridge in different security domains.

8. A method for implementing Ethernet data decryption using quantum key distribution and software definition, characterized in that: Applied to the second encryption bridge, the method includes: Receive a second key distribution message returned by the management and control platform, where the second key distribution message includes a source MAC address and a corresponding session key; Place each source MAC address and the corresponding session key into the local decryption policy MAC table; Receiving an encrypted message sent by the first encryption bridge, wherein the encrypted message is obtained by the first encryption bridge taking out a session key that matches a source MAC address of an Ethernet data frame from its local encryption policy MAC table and encrypting the Ethernet data frame; The session key that matches the source MAC address of the Ethernet data frame is taken out from the decryption strategy MAC table to decrypt the encrypted message.

9. The method for implementing Ethernet data decryption using quantum key distribution and software definition as claimed in claim 8, characterized in that: The second encryption bridge is provided with a master key pool, wherein the master key pool stores a master key and a master key ID pre-filled by a quantum key distribution system. The method further includes: Receive a MAC deletion message returned by the control platform, wherein the MAC deletion message carries information including a new count of the encryption policy MAC table, a master key ID, a deleted source MAC address, and a third integrity check value; Selecting a corresponding master key from the master key pool according to the master key ID to perform an integrity check on the third integrity check value; According to each source MAC address in the MAC deletion message, the table entry corresponding to the source MAC address in the decryption policy MAC table is deleted in sequence, and the decryption policy MAC table is refreshed.

10. The method for implementing Ethernet data decryption using quantum key distribution and software definition as claimed in claim 8, characterized in that: Before receiving the second key distribution message returned by the control platform, wherein the second key distribution message includes the source MAC address and the corresponding session key, the method further includes: Connect to the management and control platform through the management channel and send a registration message. The format of the registration message is: second encryption bridge ID||second encryption bridge management IP||random number R||KeyID||HMAC(Key, second encryption bridge ID||plus second encryption bridge management IP||random number R||KeyID), where HMAC(Key, data) means using the key Key to perform a keyed hash operation on the data data, and Key is a randomly selected master key corresponding to the second encryption bridge identifier KeyID.

11. The method for implementing Ethernet data decryption using quantum key distribution and software definition as claimed in claim 8, wherein: Before receiving the second key distribution message returned by the control platform, wherein the second key distribution message includes the source MAC address and the corresponding session key, the method further includes: The Ethernet interface type of the first encryption bridge is defined, wherein an interface not connected to other encryption bridges of the same type is defined as a encrypted port, and an interface connected to other encryption bridges of the same type is defined as an open port.

12. The method for implementing Ethernet data decryption using quantum key distribution and software definition as claimed in claim 8, wherein: Before receiving the second key distribution message returned by the control platform, wherein the second key distribution message includes the source MAC address and the corresponding session key, the method further includes: Send a key injection request to the quantum key distribution network or key agent; The master key injected by the quantum key distribution network is received through a second secure storage medium, a master key pool is established, and a key bitmap is used to identify whether each master key has been used, wherein the quantum key distribution network stores the master keys and master key IDs distributed to each encryption bridge in different security domains.

13. A method for distributing encryption strategies and session keys, characterized in that: Applied to a management and control platform, the method includes: Receive a source MAC address reporting message sent by the first encryption network bridge, wherein the source MAC address reporting message carries information including a master key ID corresponding to the first encryption network bridge and a source MAC address in the encryption policy MAC table; For each newly received source MAC address, a corresponding session key is requested from the quantum key distribution network; Based on the session key, a first key distribution message and a second key distribution message are generated respectively, and distributed to the first encryption bridge and the second encryption bridge, and the second encryption bridge is directly connected to the first encryption bridge.

14. The method for distributing encryption policies and session keys according to claim 13, wherein: The source MAC address reporting message carries information including the master key ID, the encryption policy MAC table new addition count, the new source MAC address, the encryption policy MAC table deletion count, the deleted source MAC address and the first integrity check value; Accordingly, before applying for a corresponding session key from the quantum key distribution network for each received source MAC address, the method further includes: Obtain a master key corresponding to the first encryption bridge from a quantum key distribution network, and verify the first integrity check value using the master key.

15. The method for distributing encryption policies and session keys according to claim 13, wherein: The generating, based on the session key, a first key distribution message and a second key distribution message respectively, comprises: encrypting the session key using a master key corresponding to the first encryption bridge to generate a first key distribution message; encrypting the session key using a master key corresponding to the second encryption bridge to generate a second key distribution message; The information carried by the first key distribution message and the second key distribution message includes the newly added count of the encryption policy MAC table, the master key ID, the newly added source MAC address and the corresponding session key ciphertext and the second integrity check value.

16. The method for distributing encryption policies and session keys according to claim 13, wherein: Before receiving the source MAC address reporting message sent by the first encryption bridge, the method further includes: Establish an encryption bridge association table for the security domain. The encryption bridge association table is a two-dimensional matrix T[K][K], where K is the number of encryption bridges in the security domain, and T[i][j]=1 indicates that there is an association between bridge i and bridge j. The associated encryption bridges are directly connected. Accordingly, before applying for a corresponding session key from the quantum key distribution network for each received source MAC address, the method further includes: Based on the encryption bridge association table, a second encryption bridge associated with the first encryption bridge is acquired.

17. The method for distributing encryption policies and session keys according to claim 13, wherein: After applying for a corresponding session key from the quantum key distribution network for each newly received source MAC address, the method further includes: A MAC delete message is sent to the second encryption bridge, where the MAC delete message carries information including a new count of the encryption policy MAC table, a master key ID, a deleted source MAC address, and a third integrity check value.

18. A method for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, characterized in that: The method comprises: The first encryption bridge uses the MAC address information in the local encryption policy MAC table as the source MAC address and sends it to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty. The control platform applies for a corresponding session key for each source MAC address received, generates a first key distribution message and a second key distribution message, and distributes them to the first encryption bridge and the second encryption bridge, and the second encryption bridge is directly connected to the first encryption bridge; The first encryption bridge receives the first key distribution message, and places the session key corresponding to each source MAC address into a source MAC address entry in a local encryption policy MAC table, and refreshes the encryption policy MAC table; The second encryption bridge receives the second key distribution message and places each source MAC address and the corresponding session key into a local decryption policy MAC table; The first encryption bridge retrieves a session key that matches a source MAC address of an Ethernet data frame from the encryption policy MAC table, and encrypts the outgoing Ethernet data frame to obtain an encrypted message; The second encryption bridge retrieves a session key that matches the source MAC address of the Ethernet data frame from the decryption policy MAC table, and decrypts the incoming encrypted message.

19. An encryption bridge, characterized in that: The encryption bridge comprises: A source MAC address message sending module is used to use the MAC address information in the local encryption policy MAC table as the source MAC address and send it to the management and control platform. The encryption policy MAC table includes the MAC address information and the corresponding session key. The session key is initially empty. A first key distribution message receiving module is used to receive a first key distribution message returned by the control platform, where the first key distribution message includes a source MAC address and a corresponding session key; A first encryption and decryption policy MAC table management module is configured to place a session key corresponding to each source MAC address into a source MAC address entry in a local encryption policy MAC table and refresh the encryption policy MAC table; The first data encryption and decryption module is used to retrieve a session key that matches the source MAC address of the Ethernet data frame from the encryption policy MAC table, encrypt the Ethernet data frame, and obtain an encrypted message.

20. An encryption bridge, characterized in that: The encryption bridge comprises: A second key distribution message receiving module is used to receive a second key distribution message returned by the management and control platform, where the second key distribution message includes a source MAC address and a corresponding session key; The second encryption and decryption policy MAC table management module is used to place each source MAC address and the corresponding session key into the local decryption policy MAC table; An encrypted message receiving module is used to receive an encrypted message sent by the first encryption bridge, wherein the encrypted message is obtained by the first encryption bridge taking out a session key that matches the source MAC address of the Ethernet data frame from its local encryption policy MAC table and encrypting the Ethernet data frame; The second data encryption and decryption module is used to retrieve a session key that matches the source MAC address of the Ethernet data frame from the decryption policy MAC table and decrypt the encrypted message.

21. A management and control platform, characterized in that: The control platform includes: A message receiving module, configured to receive a source MAC address reporting message sent by the first encryption network bridge, wherein the source MAC address reporting message carries information including a master key ID corresponding to the first encryption network bridge and a source MAC address in the encryption policy MAC table; A session key application module is used to apply for a corresponding session key from the quantum key distribution network for each newly received source MAC address; The key distribution message generation module is used to generate a first key distribution message and a second key distribution message based on the session key, and distribute them to the first encryption bridge and the second encryption bridge, and the second encryption bridge is directly connected to the first encryption bridge.

22. A system for implementing Ethernet data encryption and decryption using quantum key distribution and software definition, characterized in that: The system includes a first encryption bridge, a second encryption bridge, a management and control platform, and a quantum key distribution system. The first encryption bridge is associated with the second encryption bridge and is connected to the management and control platform and the quantum key distribution system. The management and control platform is connected to the quantum key distribution system. The first encryption bridge and the second encryption bridge are respectively integrated with a secure storage medium. The management and control platform is used to distribute encryption policies and session keys based on the source MAC address information reported by the first encryption bridge; The quantum key distribution system is used to distribute the master key to the control platform and the secure storage medium; The first encryption bridge and the second encryption bridge are used to perform encryption and decryption processing on user Ethernet data frames transmitted through the bridges.

Images