A network anomaly detection method and system based on quantum random numbers

Abstract

The present invention proposes a network anomaly detection method and system based on quantum random numbers, which relates to the field of communication technology. The optimal path from the starting node to the ending node is calculated. After the optimal route is determined, N consecutive random number blocks are applied to the device-independent quantum random number server in a secure manner, and the random number blocks are compiled in sequence to generate random number blocks. After the starting node receives the test message, it feeds back a confirmation signal, encrypts the test message with a hash value, and sends the encrypted test message to the next node until the test message is returned to the network master controller at the ending node. In the process of network testing, if an abnormality occurs, the network master controller returns the abnormality through the feedback technology, and the network master server and the random number server share the quantum key through the quantum key distribution system to ensure safe transmission, and each node in the optimal network obtains the random number block in sequence.

Description

Technical Field

[0001] The present invention belongs to the field of communication technology and relates to a network anomaly detection method and system based on quantum random numbers. Background Art

[0002] With the continuous improvement of information technology, the scale of my country's communication network continues to expand. In the actual transmission process of data, especially in some key networks, such as backbone networks such as smart grids, it is necessary to optimally plan the data transmission path to ensure efficient data transmission. In recent years, the number of network attacks has gradually increased worldwide, and the means have been continuously strengthened, causing huge losses to society and the economy. In particular, there have been many attacks on power grids internationally, exposing many security vulnerabilities and hidden dangers, such as the lack of network flow anomaly detection and active defense. At present, the commonly used network flow anomaly detection method is sampling and post-processing comparison. On the one hand, it cannot guarantee the security of the detection data. On the other hand, the anomaly is not discovered in time and cannot be accurately located. Often, the scope of the anomaly has expanded when it is discovered. Therefore, there is an urgent need for a safe network anomaly detection method that can monitor and locate in time to avoid the expansion of anomalies and reduce losses.

[0003] The device-independent quantum random number generator uses the unique properties of quantum physics. By detecting the loophole-free Bell inequality, it can verify the existence of quantum entanglement without making any assumptions about the device. The quantum entanglement can be used as the most basic resource for generating quantum randomness and used to generate random numbers. Therefore, the device-independent quantum random number based on the intrinsic randomness of quantum mechanics is unpredictable. The security of random numbers only depends on the violation of Bell's inequality. It does not require the source and working principle of the device used. It is considered to be the most secure random number generator.

[0004] The device-independent quantum random number server sends the newly generated device-independent quantum random number block with uniform randomness to the target user. Each random number block contains the target user's identification bit, the newly generated device-independent quantum random number, and also has a timestamp and the server's digital signature, as well as the hash value of the previous random number block, thereby preventing tampering with the generated data. Legitimate users can obtain the real-time generated random number blocks through the server network, and obtain related hash values, signatures and other information, and can also verify the previously generated random numbers. Because the random number blocks generated by the beacon server are unpredictable, tamper-proof, and verifiable. Summary of the invention

[0005] This scheme proposes a network anomaly detection method based on quantum random numbers, especially a network anomaly detection method based on device-independent quantum random numbers, which ensures that information is transmitted along a predetermined optimal path and can be reported in a timely manner when an abnormal situation occurs, including the following steps:

[0006] Step 1: Calculate the optimal path from the starting node to the ending node, form a sequential address list and routing table from the starting node to the ending node, the optimal route passes through the starting node, node 1, ..., node n, ..., the ending node in sequence, and the total number of nodes is N;

[0007] Step 2: After the optimal route is determined, N consecutive random number blocks are requested from the device-independent quantum random number server in a secure manner, denoted as Rand(n), n=1, 2...N, and are arranged and stored in order according to the timestamp;

[0008] Step 3, making the address list in step 1 correspond to the random number blocks stored in sequence in step 2 one by one, and compiling the random number blocks Rand(n) in sequence to generate random number blocks Rand'(n);

[0009] Step 4: According to the "address of this node" in Rand'(n), send Rand'(n) to the corresponding node in a secure communication manner;

[0010] Step 5: Send a random test message to the starting node. After receiving the test message, the starting node feeds back a confirmation signal and enters the test mode;

[0011] Step 6: record the random number block obtained by the starting node as Rand'(1), and use the hash value of Rand'(1) to encrypt the test message;

[0012] Step 7, the starting node decodes the "next node address" in Rand'(1) and compares it with the address information of the next node in the routing table. If the two addresses are consistent, the starting node sends the encrypted test message to node 1 connected to the starting node;

[0013] Step 8: After receiving the encrypted test message, node 1 uses the "hash value of the previous random number block" contained in the random number block data structure in node 1 to decrypt it. If the decryption is successful, the decrypted test message is sent back to the network master controller. The network master controller receives the returned test message and confirms that the address of node 1 is consistent with the address in the optimal path address list. After confirming that it is correct, it confirms that the test of node 1 has passed. At the same time, node 1 encrypts the test message with the hash value of the random number block Rand'(2) of this node and sends the encrypted test message to the next node according to step 6.

[0014] Step 9: Repeat steps 6 and 7 until the termination node returns the test message to the network master controller.

[0015] Furthermore, in step 1, the routing table stores the address information along the optimal path, and each node finds the address information of the node connected to it on the optimal path through the routing table.

[0016] Furthermore, in step 5, the test message includes a random test message, a start node address, and an end node address.

[0017] Furthermore, the encrypted test message includes a test message and a random number block.

[0018] Furthermore, in step 9, if information inconsistency occurs during the process of repeating steps 6 and 7 or the network master controller cannot receive the returned test message for a long time, it proves that there is an abnormality in the network. The network master controller infers the abnormal test node based on the node address and address list that received the correct test message for the last time.

[0019] Furthermore, the network master controller periodically updates the random number block of each node according to steps 1 to 3.

[0020] Furthermore, the data structure of the random number block Rand(n) includes: identification information of the network master controller, a device-independent quantum random number, a timestamp, a digital signature of a device-independent quantum random number server, and a hash value of the previous random number block.

[0021] Furthermore, the data structure of the random number block Rand'(n) includes: the starting node address, the previous node address, the current node address, the next node address, the ending node address, the identity information of the network master controller, the device-independent quantum random number, the timestamp, the digital signature of the device-independent quantum random number server and the hash value of the previous random number block.

[0022] The present invention also proposes a network anomaly detection system based on quantum random numbers, which is used to implement the network anomaly detection method. The network anomaly detection system includes: a device-independent quantum random number server, a network master controller, a network node, a quantum network and a quantum key filling station;

[0023] The device-independent quantum random number server distributes independent quantum random number blocks to each network node through the network master controller;

[0024] The network master controller obtains the address of each network node to calculate the optimal path, and distributes random number blocks to each network node in turn according to the optimal path, and sends control commands and test messages to each network node;

[0025] The quantum network distributes quantum keys to the quantum key filling station and the device-independent quantum random number server through the key distribution node in the quantum network, and the network master controller fills the quantum key through the quantum key filling station, so that the network master controller and the device-independent quantum random number server share the quantum key.

[0026] Compared with the prior art, the present invention has the following beneficial technical effects:

[0027] This scheme proposes a new network anomaly detection method based on device-independent quantum random numbers to solve the problems of security risks in detection data and the failure to report abnormal data in a timely manner in the existing technology. This scheme has higher reliability and security.

[0028] Based on quantum random numbers, a new real-time detection method for network anomalies is proposed. If an anomaly occurs during network testing, the network master controller will transmit the technology to find the anomaly. The network master server and the random number server share the quantum key through the quantum key distribution system to ensure secure transmission. Each node in the optimal network obtains the random number block in sequence. BRIEF DESCRIPTION OF THE DRAWINGS

[0029] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative labor.

[0030] Figure 1 A schematic diagram of a network anomaly detection system based on quantum random numbers of the present invention;

[0031] Figure 2 The data structure diagram of the random number block Rand(n) of the present invention;

[0032] Figure 3 The data structure diagram of the random number block Rand'(n) of the present invention; DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solution and advantages of the embodiments of the present application clearer, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0034] In the drawings of the specific embodiments of the present invention, in order to better and more clearly describe the working principles of the various components in the system, the connection relationship of the various parts in the device is shown, which only clearly distinguishes the relative position relationship between the various components, and cannot constitute a limitation on the signal transmission direction, connection sequence and size, dimensions and shape of the components or structures.

[0035] This scheme proposes a real-time network anomaly detection method based on random numbers, especially a network anomaly detection method based on device-independent quantum random numbers, which ensures that information is transmitted along the optimal path and can be reported in time when an abnormal situation occurs.

[0036] The network anomaly detection system architecture based on quantum random numbers of the present invention is as follows Figure 1 As shown. The system includes five parts: a device-independent quantum random number server, a network master controller, a network node, a quantum network, and a quantum key filling station. Among them, the network nodes include: a starting node, node 1, ..., node n, ..., and an ending node. The device-independent quantum random number server distributes independent quantum random number blocks to each network node through the network master controller; the network master controller can obtain the IP address or MAC address of each network node, and can calculate the optimal path for the existing network nodes, and distribute random number blocks to each network node in turn according to the optimal path. The network master controller can also send control commands and test messages to each network node. The quantum network distributes quantum keys to the quantum key filling station and the device-independent quantum random number server through the key distribution node. The network master controller can fill the quantum key through the quantum key filling station, so that the quantum key can be shared between the network master controller and the device-independent quantum random number server.

[0037] Before the system is running, the network master controller sends identity information to the device-independent quantum random number server for registration. The identity information can be the IP address or MAC of the network master controller. After successful registration, the device-independent quantum random number server can authenticate the network master controller, and the network master controller can apply for multiple random number blocks from the device-independent quantum random number server according to demand.

[0038] In order to ensure the security of communication, the network master controller and the device-independent quantum random number server use quantum secure communication to transmit information: the device-independent quantum random number server obtains the quantum key from a node in the quantum network (denoted as key distribution node 2); the quantum key filling station obtains the quantum key from another node in the quantum network (denoted as key distribution node 1) and stores it securely. The network master controller can fill the key through the quantum key filling station, so that the device-independent quantum random number server and the network master controller share the quantum key. The quantum key can be used to encrypt the identity information between the network master controller and the device-independent quantum random number server, and can also be used to encrypt the random number block, etc. Among them, the key distribution node 1 and the key distribution node 2 are deployed in the same quantum network.

[0039] After successful registration and identity authentication, the network master controller can apply for N random number blocks from the device-independent quantum random number server according to demand. N is determined by the network master controller according to demand. The data structure of the random number block generated by the device-independent quantum random number server is as follows: Figure 2 These N random number blocks are continuously generated by the same device-independent quantum random number server, so the timestamps are continuous, and each random number block carries the hash value of the previous random number block.

[0040] The steps of network anomaly detection are as follows:

[0041] Step 1: The network master controller calculates the optimal path from a certain starting node to a certain ending node according to relevant algorithms, such as Dijkstra algorithm, such as Figure 1 As shown, it is assumed that the optimal route passes through the starting node, node 1, ..., node n, ..., and the ending node in sequence, and the total number of nodes is N.

[0042] The network master controller forms a sequential address list and routing table from the starting node to the ending node. The routing table stores the address information along the optimal path. Each node can find the address information of the node connected to it on the optimal path through the routing table.

[0043] Step 2: After the optimal route is determined, the network master controller applies for N consecutive random number blocks from the device-independent quantum random number server in a secure manner, denoted as Rand(n) (n=1, 2...N). The data structure of Rand(n) is the same as Figure 2 As shown, it includes: the identity information of the network master controller, the device-independent quantum random number, the timestamp, the digital signature of the device-independent quantum random number server, and the hash value of the previous random number block; they are arranged in order according to the timestamp and stored locally.

[0044] Step 3, the network master controller matches the address list in step 1 with the random number blocks stored in sequence in step 2 one by one, and compiles the random number blocks Rand(n) (n=1, 2...N) to generate random number blocks Rand'(n) (n=1, 2...N). The data structure of the random number block is as follows: Figure 3 As shown, it includes: the starting node address, the previous node address, the current node address, the next node address, the ending node address, the identity information of the network master controller, the device-independent quantum random number, the timestamp, the digital signature of the device-independent quantum random number server and the hash value of the previous random number block.

[0045] Among them, if it is a starting node, the address of the previous node is the starting flag or other agreed identifier, such as a null pointer; similarly, if it is an ending node, the address of the next node is the starting flag or other agreed identifier, such as a null pointer.

[0046] Step 4: The network master controller sends Rand'(n) to the corresponding node in a secure communication manner according to the "address of this node" in Rand'(n). The secure communication manner here can be a classic asymmetric encryption method. After receiving Rand'(n), the node stores it locally.

[0047] Step 5, in the actual communication process, the network master controller will send a random test message to the starting node (such as node A) according to a certain rule, such as at a fixed interval, before each communication, or after each communication. After receiving the test message Stest, node A feeds back a confirmation signal to the network master controller and enters the test mode. The test message contains a random test message, the starting node address, and the ending node address.

[0048] Step 6: Node A obtains a random number block from the network master controller as Rand'(1), uses the hash value of Rand'(1) as the encryption key to encrypt the test message Stest, and obtains Hash(Rand'(1))[Stest].

[0049] Step 7: Node A decodes the "next node address" in Rand'(1) and compares it with the address information of the next node in the routing table. If the two addresses are consistent, node A sends Hash(Rand'(1))[Stest] to the next node connected to node A, that is, Figure 1 Node 1 in .

[0050] Step 8: After receiving Hash(Rand'(1))

Stest

Stest

[0051] Step 9, repeat steps 6 and 7 until the termination node returns the test message to the network controller. If there is information discrepancy in the above process or the network controller cannot receive the returned test message for a long time, it proves that there is an abnormality in the network. The network controller will infer the abnormal test node based on the node address and address list that received the correct test message last time.

[0052] In order to ensure the reliability of the random number block, the network master controller may periodically update the random number block of each node according to steps 1 to 3.

[0053] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present application is generated in whole or in part. The computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions may be stored in a computer-readable storage medium or transmitted through the computer-readable storage medium. The computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or a data center that includes one or more available media integrated. The available medium may be a magnetic medium, (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0054] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any technician familiar with the technical field can easily think of various equivalent modifications or replacements within the technical scope disclosed in the present application, and these modifications or replacements should be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be based on the protection scope of the claims.

Claims

1. A network anomaly detection method based on quantum random numbers, characterized in that: The steps include: Step 1: Calculate the optimal path from the starting node to the ending node, form a sequential address list and routing table from the starting node to the ending node, the optimal route passes through the starting node, node 1, ..., node n, ..., the ending node in sequence, and the total number of nodes is N; Step 2: N nodes apply to the device-independent quantum random number server for N consecutive random number blocks, denoted as Rand(n), where n=1, 2, ..., N; Step 3, the address list is matched with the random number block one by one, and the random number block Rand(n) is compiled in sequence to generate a random number block Rand'(n); Step 4: According to the "address of this node" in the Rand'(n) data structure, send Rand'(n) to the corresponding node; Step 5: Send a random test message to the starting node, the starting node feeds back a confirmation signal and enters the test mode; Step 6: record the random number block obtained by the starting node as Rand'(1), and use the hash value of Rand'(1) to encrypt the test message; Step 7: The starting node decodes the "next node address" in the Rand'(1) data structure and compares it with the address information of the next node in the routing table. If the two addresses are consistent, the starting node sends the encrypted test message to node 1. Step 8: Node 1 decrypts the encrypted test message and sends it back to the network master controller. The network master controller confirms whether the address of node 1 is consistent with the address in the optimal path address list. At the same time, node 1 sends the test message encrypted with the hash value of the random number block Rand'(2) to the next node. Step 9: Repeat steps 6 and 7 until the termination node returns the test message to the network master controller.

2. The network anomaly detection method according to claim 1, characterized in that: In step 1, the routing table stores the address information along the optimal path, and each node finds the address information of the node connected to it on the optimal path through the routing table.

3. The network anomaly detection method according to claim 1, characterized in that: In step 5, the test message includes a random test message, a start node address, and an end node address.

4. The network anomaly detection method according to claim 1, characterized in that: The encrypted test message includes a test message and a random number block.

5. The network anomaly detection method according to claim 1, characterized in that: In step 9, if information inconsistency occurs during the process of repeating steps 6 and 7 or the network master controller cannot receive the returned test message for a long time, it proves that there is an abnormality in the network. The network master controller infers the abnormal test node based on the node address and address list that received the correct test message for the last time.

6. The network anomaly detection method according to claim 1, characterized in that: The network master controller periodically updates the random number block of each node according to steps 1 to 3.

7. The network anomaly detection method according to claim 1, characterized in that: The data structure of the random number block Rand(n) includes: the identity information of the network master controller, the device-independent quantum random number, the timestamp, the digital signature of the device-independent quantum random number server, and the hash value of the previous random number block.

8. The network anomaly detection method according to claim 1, characterized in that: The data structure of the random number block Rand'(n) includes: the starting node address, the previous node address, the current node address, the next node address, the ending node address, the identity information of the network master controller, the device-independent quantum random number, the timestamp, the digital signature of the device-independent quantum random number server and the hash value of the previous random number block.

9. A network anomaly detection system based on quantum random numbers, characterized in that: Used to implement the network anomaly detection method according to any one of claims 1 to 8, the network anomaly detection system comprises: a device-independent quantum random number server, a network master controller, a network node, a quantum network and a quantum key filling station; The device-independent quantum random number server distributes independent quantum random number blocks to each network node through the network master controller; The network master controller obtains the address of each network node to calculate the optimal path, and distributes random number blocks to each network node in turn according to the optimal path, and sends control commands and test messages to each network node; The quantum network distributes quantum keys to the quantum key filling station and the device-independent quantum random number server through the key distribution node in the quantum network, and the network master controller fills the quantum key through the quantum key filling station, so that the network master controller and the device-independent quantum random number server share the quantum key.

Images