Method for realizing Ethernet data encryption and decryption by self-learning and self-organization

Abstract

The present invention discloses a method for implementing Ethernet data encryption in a self-learning and self-organizing manner, comprising: sending a policy notification Ethernet frame to a receiving encryption bridge in a security domain, the policy notification Ethernet frame including multiple encryption policies, each encryption policy including a source MAC address in a local encryption MAC table of the sending encryption bridge and two corresponding session keys and an initialization vector; for an outbound Ethernet data frame, taking out a currently used numbered session key from an entry matching the source MAC address of the Ethernet data frame from the encryption MAC table; encrypting the Ethernet data frame using the session key, and marking the number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message. The present invention realizes the automatic generation and distribution of encryption policies without the need for a management center, and safely and efficiently solves the problem of security policy distribution and management of Layer 2 Ethernet devices without IP addresses.

Description

Technical Field

[0001] The invention relates to the technical field of cryptographic application, and in particular to a method for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner. Background Art

[0002] IEEE802.1AE-Media Access Control (MAC) Security defines a MAC layer security standard that protects the confidentiality and integrity of Ethernet message frames by inserting security tags into Ethernet packets and performing symmetric encryption and integrity check (ICV) on Ethernet message frames other than MAC addresses, and provides a certain degree of resistance to replay attacks. The MACsec Key Agreement protocol (MKA) in IEEE802.1X-Port-Based Network Access Control defines the method of physical key negotiation in Ethernet networks, which is used to establish 802.1AE MACsec encryption and integrity protection keys. These two sets of protocols combine to form the IEEE security solution at the Ethernet MAC layer.

[0003] However, in actual use, the deployment and implementation of these two protocols are not widespread, and there are the following problems:

[0004] (1) Due to the insertion of a longer security label and the increase of the ICV part, the Ethernet frame will exceed the maximum transmission unit (MTU) of the interface, which will further cause packet loss.

[0005] (2) The key used to encrypt Ethernet message frames is allocated to the entity that implements the MACsec protocol, rather than to each source entity with a MAC address. Multiple sources share one Ethernet frame protection key, and the key is only related to the entity that implements the MACsec protocol.

[0006] (3) MKA shares a symmetric key within a group to protect the negotiation process. The key can be updated only after a period of use, and there is a certain degree of repeatability in its use.

[0007] In the related art, the Chinese invention patent application document with publication number CN102130768A records a terminal device with link layer encryption and decryption capabilities and a data processing method thereof, wherein the terminal device includes a link layer processing module, the link layer processing module includes a control module, a data frame encryption processing module, a data frame decryption processing module, a key management module, an algorithm module, a transmission port and a receiving port; the control module accesses the transmission port through the data frame encryption processing module; the receiving port accesses the control module through the data frame decryption processing module; the control module is connected to the key management module; the data frame encryption processing module is connected to the data frame decryption processing module through the key management module; the data frame encryption processing module is connected to the data frame decryption processing module through the algorithm module. The method proposed in this scheme is based on pre-shared keys and pre-configured encryption strategies, but does not provide a specific key distribution protocol. Summary of the invention

[0008] The technical problem to be solved by the present invention is how to realize automatic generation and distribution of encryption policies without a management center, and solve the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0009] The present invention solves the above technical problems through the following technical means:

[0010] In a first aspect, the present invention proposes a method for implementing Ethernet data encryption in a self-learning and self-organizing manner. When an encryption bridge acts as a sender, the method comprises:

[0011] Sending a policy notification Ethernet frame to a receiving encryption bridge in a security domain, wherein the policy notification Ethernet frame includes a plurality of encryption policies, each encryption policy including a source MAC address in a local encryption MAC table of the sending encryption bridge and two corresponding session keys and an initialization vector;

[0012] For an outbound Ethernet data frame, taking out from the encrypted MAC table a session key with a currently used number in an entry matching the source MAC address of the Ethernet data frame;

[0013] The Ethernet data frame is encrypted using the session key, and the serial number of the session key is marked in the Ethernet frame protocol field to obtain an outbound encrypted message.

[0014] The present invention is mainly aimed at the application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs, encrypts data based on the source MAC address and automatically learns to form encryption strategies, and realizes automatic key distribution between device nodes in the domain through multicast, thereby realizing automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solving the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0015] Further, the sending of a policy notification Ethernet frame to a receiving encryption bridge in a security domain includes:

[0016] Based on the source MAC address in the local encrypted MAC table and the corresponding two session keys and initialization vector, a policy notification Ethernet frame is constructed, wherein the two session keys are numbered 0 and 1 respectively;

[0017] Selecting a master key from a master key pool set by itself to encrypt the policy notification Ethernet frame, and using a keyed hash algorithm to calculate an integrity check value to obtain a policy notification message;

[0018] Among them, the information carried by the policy notification message includes: Ethernet frame header, current frame policy count / confirmation mark, master key ID, source MAC address, two session keys corresponding to the source MAC address and initialization vector and integrity check value. The information of the Ethernet frame header includes the source MAC address, destination MAC address and frame type. The source MAC address is the MAC address of the encryption bridge sending interface, and the destination MAC address is a multicast MAC address defined using privatization.

[0019] Further, the sending of a policy notification Ethernet frame to a receiving encryption bridge in a security domain includes:

[0020] Determine whether the length of the policy notification Ethernet frame exceeds the interface MTU;

[0021] When it is determined that the interface MTU is exceeded, the policy notification Ethernet frame is fragmented.

[0022] Furthermore, the time interval for sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain is less than or equal to half of the session key usage time threshold, and the same policy notification Ethernet frame is sent n times continuously, where n is a positive integer.

[0023] Further, after encrypting the Ethernet data frame using the session key and marking the number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message, the method further includes:

[0024] Recording the usage time and usage frequency of the currently used session key;

[0025] When the usage time or the number of times of usage exceeds the corresponding threshold, the random number generated by the random number generator of the encryption bridge itself is used to refresh the currently used session key;

[0026] The currently used session key is switched to a session key with another number.

[0027] Furthermore, the policy notifies that a confirmation mark is added to the highest bit of the byte of the Ethernet frame, so that the receiving encryption bridge determines whether a confirmation frame needs to be sent according to the confirmation mark.

[0028] Further, when the confirmation mark requires the receiving encryption bridge to send a confirmation frame, the method further includes:

[0029] The sending encryption bridge starts the timer queue and adds the policy notification Ethernet frame to the queue for periodic retransmission until the policy notification Ethernet frame becomes invalid or all receiving encryption bridges in the security domain have replied to the confirmation frame.

[0030] Further, the Ethernet data frame is encrypted using the session key, and the number of the session key is marked in the Ethernet frame protocol field to obtain an outbound encrypted message, including:

[0031] Encrypting the outbound Ethernet data frame based on the currently used session key, with the encryption mode being a CBC algorithm combined with a CFB algorithm;

[0032] The unregistered bit in the Ethernet frame protocol field is marked with the number of the session key, and the usage count of the session key is increased by 1.

[0033] Furthermore, before sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes:

[0034] Send a key filling request to the quantum key distribution network;

[0035] The master key returned by the quantum key distribution network is obtained through the first secure storage medium integrated by the sender encryption bridge, and a master key pool is established based on the master key, and a key bitmap is used to identify whether each master key has been used, wherein each encryption bridge in the same security domain shares a master key with the same master key ID.

[0036] Furthermore, before sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes:

[0037] Define the Ethernet interface type of the sender encryption bridge, wherein the interface that is not connected to other encryption bridges of the same type is defined as a secret port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The secret port is used to add the source MAC address learned by the port to the local encryption MAC table.

[0038] Furthermore, before sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes:

[0039] Connect to the control platform through the management channel and send a registration message to the control platform to register.

[0040] The present invention is mainly aimed at the application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs, encrypts data based on the source MAC address and automatically learns to form encryption strategies, and realizes automatic key distribution between device nodes in the domain through multicast, thereby realizing automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solving the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0041] In a second aspect, the present invention proposes a method for implementing Ethernet data decryption in a self-learning and self-organizing manner. When an encryption bridge acts as a receiver, the method comprises:

[0042] Receiving a policy notification Ethernet frame sent by a sender encryption bridge in the same security domain, wherein the policy notification Ethernet frame includes a plurality of encryption policies, each encryption policy including a source MAC address in a local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector;

[0043] According to the strategy, the Ethernet frame is notified, and each source MAC address and the two corresponding session keys and initialization vector are added to the local decryption MAC table;

[0044] Receiving an outbound encrypted message sent by the sender encryption bridge, wherein the outbound encrypted message is obtained by encrypting an outbound Ethernet data frame using a session key with a current number and marking the number of the session key in an Ethernet frame protocol field;

[0045] An entry matching the source MAC address of the encrypted message frame is selected from the decryption MAC table, and a session key corresponding to the encrypted message frame is selected according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

[0046] Furthermore, the format of the policy notification Ethernet frame is an Ethernet frame header, a current frame policy count / confirmation tag, a master key ID, a source MAC address, two session keys corresponding to the source MAC address and an initialization vector and an integrity check value, wherein the master key ID comes from the master key pool of the sender encryption bridge itself;

[0047] Accordingly, the Ethernet frame is notified according to the strategy, and each source MAC address and the two corresponding session keys and initialization vector are added to the local decryption MAC table, including:

[0048] Select a corresponding master key from its own master key pool according to the master key ID, and perform an integrity check on the integrity check value;

[0049] After the integrity check is passed, the policy notification Ethernet frame is decrypted using the master key to obtain each source MAC address and the two corresponding session keys and initialization vector;

[0050] Each source MAC address and the two corresponding session keys and initialization vector are added to the local decryption MAC table, and the decryption MAC table is refreshed.

[0051] Further, after receiving the policy notification Ethernet frame sent by the sender encryption bridge in the same security domain, the method further includes:

[0052] According to the confirmation mark of the highest bit of the policy notification Ethernet frame byte, a confirmation frame is sent to the receiving encryption bridge, wherein the content of the confirmation frame is the integrity check value of the policy notification Ethernet frame, the destination MAC address of the confirmation frame is the source MAC address of the policy notification Ethernet frame, and the source MAC address of the confirmation frame is the MAC address of the interface that receives the policy notification Ethernet frame and sends the confirmation frame.

[0053] Further, the selecting an entry matching the source MAC address of the encrypted message frame from the decryption MAC table, and selecting a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field, and symmetrically decrypting the encrypted message includes:

[0054] Selecting an entry that matches the source MAC address of the encrypted message frame from the decrypted MAC table, and selecting a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field;

[0055] The session key is used to perform a symmetric decryption operation on the incoming encrypted message, and the session key usage count is increased by 1.

[0056] Furthermore, before receiving the policy notification Ethernet frame sent by the sender encryption bridge in the same security domain, the method further includes:

[0057] Send a key filling request to the quantum key distribution network;

[0058] The master key returned by the quantum key distribution network is obtained through the second secure storage medium integrated by the receiving encryption bridge, and a master key pool is established based on the master key, and a key bitmap is used to identify whether each master key has been used, wherein each encryption bridge in the same security domain shares a master key with the same master key ID.

[0059] Furthermore, before receiving the policy notification Ethernet frame sent by the sender encryption bridge in the same security domain, the method further includes:

[0060] The Ethernet interface type of the receiver encryption bridge is defined, wherein the interface not connected to other encryption bridges of the same type is defined as a secret port, and the interface connected to other encryption bridges of the same type is defined as an open port.

[0061] In a third aspect, the present invention proposes a method for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, the method comprising:

[0062] The sender encryption bridge sends a policy notification Ethernet frame to the receiver encryption bridge in the security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in the local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector;

[0063] The receiving encryption bridge receives the policy notification Ethernet frame and adds each source MAC address and the two corresponding session keys and initialization vector into the decryption MAC table;

[0064] The sender encryption bridge takes out the currently used numbered session key from the table entry matching the source MAC address of the Ethernet data frame from the encryption MAC table for the outbound Ethernet data frame, encrypts the Ethernet data frame using the session key, and marks the number of the session key in the Ethernet frame protocol field;

[0065] The receiving encryption bridge receives the incoming encrypted message, selects the entry that matches the source MAC address of the encrypted message frame from the decryption MAC table, selects the session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field, and symmetrically decrypts the encrypted message.

[0066] In a fourth aspect, the present invention provides an encryption bridge, the encryption bridge comprising:

[0067] A policy notification Ethernet frame sending module is used to send a policy notification Ethernet frame to a receiving encryption bridge in a security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each of which includes a source MAC address in the local encryption MAC table of the sending encryption bridge and two corresponding session keys and an initialization vector;

[0068] A session key acquisition module, used for taking out, from the encrypted MAC table, a session key with a currently used number in an entry matching a source MAC address of the Ethernet data frame for an outbound Ethernet data frame;

[0069] The data encryption and decryption module is used to encrypt the Ethernet data frame using the session key and mark the serial number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message.

[0070] In a fifth aspect, the present invention provides an encryption bridge, the encryption bridge comprising:

[0071] A policy notification Ethernet frame receiving module is used to receive a policy notification Ethernet frame sent by a sender encryption bridge in the same security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in the local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector;

[0072] A MAC table management module, used to notify the Ethernet frame according to the strategy, and add each source MAC address and the two corresponding session keys and initialization vector into the local decryption MAC table;

[0073] An encrypted message receiving module is used to receive an outbound encrypted message sent by the sender encryption bridge, wherein the outbound encrypted message is obtained by encrypting an outbound Ethernet data frame with a session key with a current number and marking the number of the session key in an Ethernet frame protocol field;

[0074] The data encryption and decryption module is used to select a table entry matching the source MAC address of the encrypted message frame from the decryption MAC table, and select a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

[0075] In a sixth aspect, the present invention proposes a system for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, the system comprising a sender encryption bridge, a receiver encryption bridge, a management and control platform, and a quantum key distribution network, the sender encryption bridge is connected to the receiver encryption bridge, and the sender encryption bridge and the receiver encryption bridge are both connected to the management and control platform and the quantum key distribution network, the sender encryption bridge and the receiver encryption bridge are both provided with a master key pool, and the master key pool stores a master key pre-filled by the quantum key distribution network;

[0076] The management and control platform is used to divide security domains and provide registration and identity binding services for the sender encryption bridge and the receiver encryption bridge;

[0077] The sender encryption bridge is used to send a policy notification Ethernet frame encrypted by the master key to the receiver encryption bridge, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in the local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector;

[0078] The receiving encryption bridge is used to receive the policy notification Ethernet frame and add each source MAC address and the two corresponding session keys and initialization vector into a decrypted MAC table;

[0079] The sender encryption bridge is used to take out the session key with the current number in the table entry matching the source MAC address of the Ethernet data frame from the encryption MAC table for the outbound Ethernet data frame, encrypt the Ethernet data frame using the session key, and mark the number of the session key in the Ethernet frame protocol field;

[0080] The receiving encryption bridge is used to receive incoming encrypted messages, select an entry that matches the source MAC address of the encrypted message frame from the decryption MAC table, and select the session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

[0081] The advantages of the present invention are:

[0082] (1) The present invention is mainly aimed at application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs. It encrypts data based on the source MAC address and automatically learns to form encryption strategies. It realizes automatic key distribution between device nodes in the domain through multicast, realizes automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solves the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0083] (2) Each encryption strategy achieves non-interruption and zero intervention in Layer 2 network services by switching between the primary and backup session keys and transparently encrypting and decrypting Ethernet frames, thereby minimizing the impact.

[0084] (3) By dividing the security domain and pre-filling a large number of identical master keys for each device node in the security domain and using them randomly, the problem of identity authentication and distribution of session keys between bridge device nodes with encrypted intercommunication requirements is solved safely and efficiently.

[0085] Additional aspects and advantages of the present invention will be given in part in the following description and in part will be obvious from the following description, or will be learned through practice of the present invention. BRIEF DESCRIPTION OF THE DRAWINGS

[0086] Figure 1 It is a flow chart of a method for implementing Ethernet data encryption in a self-learning and self-organizing manner proposed in the first embodiment of the present invention;

[0087] Figure 2 is a flow chart of a method for implementing Ethernet data decryption in a self-learning and self-organizing manner proposed in a second embodiment of the present invention;

[0088] Figure 3 1 is a flow chart of a method for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, as proposed in a third embodiment of the present invention;

[0089] Figure 4 is a schematic diagram of the structure of an encryption bridge proposed in a fourth embodiment of the present invention;

[0090] Figure 5 is a schematic diagram of the structure of an encryption bridge proposed in a fifth embodiment of the present invention;

[0091] Figure 6 is a schematic diagram of the structure of a system for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, as proposed in a sixth embodiment of the present invention;

[0092] Figure 7 is a schematic diagram of the structure of an encryption bridge in a sixth embodiment of the present invention;

[0093] Figure 8 It is a schematic diagram of the working process of a system for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, proposed in the sixth embodiment of the present invention. DETAILED DESCRIPTION

[0094] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in combination with the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0095] Example 1

[0096] like Figure 1 As shown, the first embodiment of the present invention proposes a method for implementing Ethernet data encryption in a self-learning and self-organizing manner. When the encryption bridge acts as a sender, the method includes the following steps:

[0097] S101, sending a policy notification Ethernet frame to a receiving encryption bridge in a security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy including a source MAC address in a local encryption MAC table of the sending encryption bridge and two corresponding session keys and an initialization vector;

[0098] It should be noted that the encrypted MAC table records the source MAC address of the Ethernet frame to be encrypted. Each MAC address in the table corresponds to two session keys and initialization vectors (keys 0 and 1), which are used to encrypt Ethernet data frames with the MAC address as the source MAC.

[0099] S102, for the outbound Ethernet data frame, taking out the session key with the current number in the entry matching the source MAC address of the Ethernet data frame from the encrypted MAC table;

[0100] S103: Encrypt the Ethernet data frame using the session key, and mark the number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message.

[0101] This embodiment is mainly aimed at the application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs. It encrypts data based on the source MAC address and automatically learns to form an encryption strategy. It realizes automatic key distribution between device nodes in the domain through multicast, realizes automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solves the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0102] In addition, the session key used for data encryption in this embodiment is neither generated by negotiation nor by centralized distribution, but is automatically generated by the source device for each source MAC directly connected to the device and pushed to the entire network, and the secure transmission of the session key is ensured by the large-capacity quantum key uniformly pre-filled in the entire network. The encryption strategy is also automatically generated by the source device for each source MAC directly connected to the device and pushed to the entire network, and it is an encryption strategy based on the source MAC. In this way, self-learning and self-organizing distribution of keys and encryption strategies for the entire network is achieved, which has the advantages of high efficiency, full automation, decentralization, and no need for addressing. In addition, the method of using two primary and backup keys can realize key updates without interruption of communication, and transparent encryption and decryption is adopted without changing the Ethernet frame format.

[0103] In one embodiment, the step S101: sending a policy notification Ethernet frame to a receiving encryption bridge in a security domain includes the following steps:

[0104] S11, constructing a policy notification Ethernet frame based on the source MAC address in the local encrypted MAC table and the corresponding two session keys and the initialization vector, wherein the two session keys are numbered 0 and 1 respectively;

[0105] It should be noted that each encryption policy is composed of the source MAC address in the encryption MAC table of the bridge and two corresponding session keys, and multiple encryption policies constitute a policy notification Ethernet frame.

[0106] S12, selecting a master key from a master key pool set by itself to encrypt the policy notification Ethernet frame, and using a keyed hash algorithm to calculate an integrity check value to obtain a policy notification message;

[0107] Among them, the entire Ethernet frame is encrypted with a randomly selected master key (the Ethernet frame header is not encrypted) and the keyed hash algorithm HMAC is used to calculate the check value (including the frame header). The frame format of the policy notification message is: 14-byte Ethernet frame header (source MAC address + destination MAC address + frame type) + 1-byte current frame policy count / confirmation mark + 4-byte master key ID + k*(source MAC address + 2n-byte key + 2n-byte initialization vector) + ICV (integrity check value), where k represents the number of encryption policies and session keys included in this data packet.

[0108] The source MAC address is the MAC address of the sending interface of the encryption bridge, the destination MAC address is a multicast MAC address defined using privatization, and the master key stored in the master key pool is the quantum key pre-filled by the quantum key distribution system.

[0109] In one embodiment, the step S101: sending a policy notification Ethernet frame to a receiving encryption bridge in a security domain, further includes the following steps:

[0110] Determine whether the length of the policy notification Ethernet frame exceeds the interface MTU;

[0111] When it is determined that the interface MTU is exceeded, the policy notification Ethernet frame is fragmented.

[0112] In one embodiment, the time interval for sending policy notification Ethernet frames to the receiving encryption bridge in the security domain is less than or equal to half of the session key usage time threshold, and the same policy notification Ethernet frame is sent n times in succession, where n is a positive integer.

[0113] Specifically, the sending time interval of the policy notification Ethernet frame is no greater than half of the session key usage time threshold. By sending the same policy notification message three times in succession each time, the key can be updated before it expires to avoid communication interruption. By setting it to be sent three times in succession, key update can be avoided due to packet loss.

[0114] In one embodiment, after the step S103: encrypting the Ethernet data frame using the session key and marking the number of the session key in the Ethernet frame protocol field to obtain the outbound encrypted message, the method further comprises the following steps:

[0115] Recording the usage time and usage frequency of the currently used session key;

[0116] When the usage time or the number of times of usage exceeds the corresponding threshold, the random number generated by the random number generator of the encryption bridge itself is used to refresh the currently used session key;

[0117] The currently used session key is switched to a session key with another number.

[0118] It should be noted that the encryption session key used by each source MAC in the encryption MAC table within a period of time is fixed to 0 or 1. The timer and usage count of the currently used key are enabled. When the usage time or usage count exceeds the threshold, a new random number is collected from the random number generator of the encryption bridge device itself to refresh the current key, and the currently used key is switched to another numbered key. That is, if key 0 is currently in use, key 0 will be refreshed after the key expires, and key 1 will be used. After the encryption bridge is started, the encryption MAC table is established based on the source MAC address learned from the encryption port and the table entries are continuously refreshed in combination with the timer, that is, the newly learned source MAC is added and the source MAC that has not been received from the encryption port for a period of time is cleared from the table.

[0119] It should be noted that each encryption strategy achieves uninterrupted and zero-intervention of Layer 2 network services and minimizes impact by switching between the primary and backup keys and transparently encrypting and decrypting Ethernet frames.

[0120] In one embodiment, the policy notifies that a confirmation mark is added to the highest bit of a byte of the Ethernet frame, so that the receiving encryption bridge determines whether a confirmation frame needs to be sent according to the confirmation mark.

[0121] It should be noted that the policy count byte of the policy notification Ethernet frame supports up to 127 policy counts, and the highest bit of this byte is a confirmation mark. If the mark is 1, the receiving encryption bridge needs to send a confirmation frame, and the sending encryption bridge starts the timer queue and adds the frame to the queue for regular retransmission until the frame expires (session key update) or all bridges in the security domain have replied to the confirmation frame; if the mark is 0, the receiving encryption bridge does not need to reply to the confirmation frame. By adding a confirmation mark to the highest bit of the policy count byte, it can be continuously retransmitted before receiving the confirmation frame to ensure acceptance.

[0122] In one embodiment, the step S103: encrypting the Ethernet data frame using the session key and marking the number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message specifically includes the following steps:

[0123] S131, encrypting the outbound Ethernet data frame based on the currently used session key, with the encryption mode being a CBC algorithm combined with a CFB algorithm;

[0124] S132: Mark the unregistered bit in the Ethernet frame protocol field with the serial number of the session key, and increase the usage count of the session key by 1.

[0125] It should be noted that the encryption bridge device node as the sender encrypts the outbound (forwarded through any open port) Ethernet data frame whose source MAC address matches the encryption MAC table, that is, it takes out the session key currently used (initial 0, then switches between 0 / 1 in sequence) from the item matching the source MAC of the frame from the encryption MAC table for encryption, and marks the 13th bit of the Ethernet frame protocol field (the Ethernet frame protocol field has 16 bits from low to high, and the 13th bit is not registered) that the session key 0 or 1 corresponding to the source MAC is used, and the session key usage count is increased by 1. The encryption mode is CBC (integer multiple of algorithm grouping) + CFB (remainder beyond integer multiple of algorithm grouping), and no additional data is added.

[0126] In one embodiment, before the step S101: sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes the following steps:

[0127] Send a key filling request to the quantum key distribution network;

[0128] The master key returned by the quantum key distribution network is obtained through the first secure storage medium integrated by the sender encryption bridge, and a master key pool is established based on the master key, and a key bitmap is used to identify whether each master key has been used, wherein each encryption bridge in the same security domain shares a master key with the same master key ID.

[0129] It should be noted that a large number of quantum keys are injected into the first secure storage medium through the quantum key distribution network. The first secure storage medium uses a large-capacity secure storage medium such as a secure TF card or a secure U shield. The key format of the master key is 4-byte key ID + n-byte key and n-byte initialization vector (n is related to the encryption algorithm). Each device in the same security domain shares the same master key identified by the same key ID.

[0130] This embodiment implements one-time-one-key session key distribution and identity authentication between devices within a domain by pre-filling a large number of master keys, thereby achieving lightweight and efficient Ethernet data frame encryption transmission.

[0131] In one embodiment, before the step S101: sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes:

[0132] Define the Ethernet interface type of the sender encryption bridge, wherein the interface that is not connected to other encryption bridges of the same type is defined as a secret port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The secret port is used to add the source MAC address learned by the port to the local encryption MAC table.

[0133] It should be noted that the processing of data frames received and sent by the open port is no different from that of general bridge equipment. In addition to performing the functions of an ordinary bridge interface, the encrypted port adds the learned source MAC address to the encrypted MAC table, collects session keys 0 and 1 randomly generated by its own random number generator, and starts a timer to periodically clear the table of source MACs that have not been received from the encrypted port within a period of time.

[0134] In one embodiment, before the step S101: sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes:

[0135] Connect to the control platform through the management channel and send a registration message to the control platform to register.

[0136] It should be noted that the management and control platform defines the security domain and receives registration requests from each encryption bridge within the security domain to complete the registration of each encryption bridge.

[0137] By dividing the security domain and pre-filling a large number of identical master keys for each device node in the security domain and using them randomly, the problem of identity authentication and distribution of session keys between bridge device nodes with encryption intercommunication requirements is solved safely and efficiently.

[0138] Example 2

[0139] like Figure 2 As shown, the second embodiment of the present invention proposes a method for implementing Ethernet data decryption in a self-learning and self-organizing manner. When the encryption bridge serves as the receiving party, the method includes the following steps:

[0140] S201, receiving a policy notification Ethernet frame sent by a sender encryption bridge in the same security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in a local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector;

[0141] S202, notifying the Ethernet frame according to the strategy, adding each source MAC address and the two corresponding session keys and initialization vector to the local decryption MAC table;

[0142] S203, receiving an outbound encrypted message sent by the sender encryption bridge, wherein the outbound encrypted message is obtained by encrypting an outbound Ethernet data frame using a session key with a current number and marking the number of the session key in an Ethernet frame protocol field;

[0143] S204. Select an entry that matches the source MAC address of the encrypted message frame from the decryption MAC table, and select a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

[0144] This embodiment is mainly aimed at the application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs. It decrypts data based on the source MAC address and automatically learns to form encryption strategies. It realizes automatic key distribution between device nodes in the domain through multicast, realizes automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solves the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0145] In one embodiment, the format of the policy notification Ethernet frame is an Ethernet frame header, a current frame policy count / confirmation tag, a master key ID, a source MAC address, two session keys corresponding to the source MAC address and an initialization vector and an integrity check value, wherein the master key ID comes from the master key pool of the sender encryption bridge itself;

[0146] Accordingly, the step S202: adding each source MAC address and the two corresponding session keys and initialization vector to the local decryption MAC table according to the policy notification Ethernet frame includes the following steps:

[0147] S221. Select a corresponding master key from its own master key pool according to the master key ID, and perform an integrity check on the integrity check value;

[0148] S222. After the integrity check passes, the policy notification Ethernet frame is decrypted using the master key to obtain each source MAC address and the two corresponding session keys and initialization vector;

[0149] S223. Add each source MAC address and the two corresponding session keys and initialization vector to a local decryption MAC table, and refresh the decryption MAC table.

[0150] It should be noted that after the encryption bridge as the receiver receives the policy notification Ethernet frame, it takes out the master key according to the master key ID to perform integrity check and decrypt the frame, and adds each source MAC and the corresponding two keys and initialization vector to the decryption MAC table, that is, adding or updating the table entry with the same source MAC in the decryption MAC table.

[0151] In one embodiment, after receiving the policy notification Ethernet frame sent by the sender encryption bridge in the same security domain, the method further includes:

[0152] According to the confirmation mark of the highest bit of the policy notification Ethernet frame byte, a confirmation frame is sent to the receiving encryption bridge, wherein the content of the confirmation frame is the integrity check value of the policy notification Ethernet frame, the destination MAC address of the confirmation frame is the source MAC address of the policy notification Ethernet frame, and the source MAC address of the confirmation frame is the MAC address of the interface that receives the policy notification Ethernet frame and sends the confirmation frame.

[0153] Specifically, if the confirmation flag bit of the policy notification Ethernet frame is 1, the encryption bridge that accepts the policy needs to send a confirmation frame. The destination MAC of the frame is the source MAC of the policy notification frame, and the source MAC is the interface MAC that receives the frame and sends a confirmation frame. The content of the confirmation frame is the integrity check value ICV of the policy notification frame.

[0154] In one embodiment, the step S204: selecting an entry matching the source MAC address of the encrypted message frame from the decryption MAC table, and selecting a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field, and symmetrically decrypting the encrypted message, comprises the following steps:

[0155] S241, selecting an entry matching the source MAC address of the encrypted message frame from the decrypted MAC table, and selecting a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field;

[0156] S242: Use the session key to perform a symmetric decryption operation on the incoming encrypted message, and add 1 to the session key usage count.

[0157] It should be noted that the encryption bridge device node as the receiver decrypts the inbound (accepted through any open port) Ethernet data frame whose source MAC address matches the decryption MAC table, that is, it selects the item matching the source MAC of the frame from the decryption MAC table, and selects the session key No. 0 or No. 1 corresponding to the source MAC from the item according to the 13th bit of the Ethernet frame protocol field, performs symmetric decryption operation on the frame, and increases the session key usage count by 1.

[0158] In one embodiment, before the step S201: receiving the policy notification Ethernet frame sent by the sender encryption bridge in the same security domain, the method further includes the following steps:

[0159] Send a key filling request to the quantum key distribution network;

[0160] The master key returned by the quantum key distribution network is obtained through the second secure storage medium integrated by the receiving encryption bridge, and a master key pool is established based on the master key, and a key bitmap is used to identify whether each master key has been used, wherein each encryption bridge in the same security domain shares a master key with the same master key ID.

[0161] It should be noted that a large number of quantum keys are injected into the second secure storage medium through the quantum key distribution network. The first secure storage medium uses a large-capacity secure storage medium such as a secure TF card or a secure U shield. The key format of the master key is 4-byte key ID + n-byte key and n-byte initialization vector (n is related to the encryption algorithm). Each device in the same security domain shares the same master key identified by the same key ID.

[0162] This embodiment implements one-time-one-key session key distribution and identity authentication between devices within a domain by pre-filling a large number of master keys, thereby achieving lightweight and efficient Ethernet data frame encryption transmission.

[0163] In one embodiment, before the step S201: receiving the policy notification Ethernet frame sent by the sender encryption bridge in the same security domain, the method further includes:

[0164] The Ethernet interface type of the receiver encryption bridge is defined, wherein the interface not connected to other encryption bridges of the same type is defined as a secret port, and the interface connected to other encryption bridges of the same type is defined as an open port.

[0165] Example 3

[0166] like Figure 3 As shown, the third embodiment of the present invention proposes a method for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, and the method includes the following steps:

[0167] S301, the sender encryption bridge sends a policy notification Ethernet frame to the receiver encryption bridge in the security domain, the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes the source MAC address in the local encryption MAC table of the sender encryption bridge and the corresponding two session keys and initialization vector;

[0168] S302, the receiving encryption bridge receives the policy notification Ethernet frame, and adds each source MAC address and the corresponding two session keys and initialization vector to the decryption MAC table;

[0169] S303, the sender encryption bridge takes out the currently used numbered session key from the entry matching the source MAC address of the Ethernet data frame from the encryption MAC table for the outbound Ethernet data frame, encrypts the Ethernet data frame using the session key, and marks the number of the session key in the Ethernet frame protocol field;

[0170] S304, the receiving encryption bridge receives the incoming encrypted message, selects an entry that matches the source MAC address of the encrypted message frame from the decryption MAC table, selects the session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field, and performs symmetrical decryption on the encrypted message.

[0171] This embodiment is mainly aimed at the application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs. It decrypts data based on the source MAC address and automatically learns to form encryption and decryption strategies. It realizes automatic key distribution between device nodes in the domain through multicast, realizes automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solves the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0172] In one embodiment, the step S301: the sending encryption bridge sends a policy notification Ethernet frame to the receiving encryption bridge in the security domain, specifically includes:

[0173] The sending encryption bridge periodically sends the encryption policy of this bridge to the members in the security domain. Each encryption policy consists of the source MAC address in the encryption MAC table of this bridge and the corresponding two session keys. Multiple encryption policies constitute a policy notification Ethernet frame. The entire Ethernet frame is encrypted with a randomly selected master key (the Ethernet frame header is not encrypted) and the keyed hash algorithm HMAC is used to calculate the check value (including the frame header). The frame format is: 14-byte Ethernet frame header (source MAC address + destination MAC address + frame type) + 1-byte current frame policy count / confirmation mark + 4-byte master key ID + k*(source MAC + 2n-byte key + 2n-byte initialization vector) + ICV (integrity check value).

[0174] The frame type adopts a private definition, the source MAC of the frame is the MAC of the bridge sending interface, and the destination MAC of the frame also adopts a privately defined multicast MAC address.

[0175] In one embodiment, the step S301: the sending encryption bridge sends a policy notification Ethernet frame to the receiving encryption bridge in the security domain, further includes:

[0176] The judgment strategy notifies the entire Ethernet frame length. If it exceeds the interface MTU, it is divided into multiple frames for transmission;

[0177] The time interval for sending policies shall not be greater than half of the session key usage time threshold, and the same policy notification message shall be sent three times in succession each time.

[0178] In one embodiment, the policy count byte of the policy notification Ethernet frame supports up to 127 policy counts, and the highest bit of the byte is a flag indicating whether confirmation is required. If the flag is 1, the receiver needs to send a confirmation frame, and the sending bridge starts the timer queue and adds the frame to the queue for periodic retransmission until the frame expires (session key is updated) or all bridges in the security domain have replied with confirmation frames.

[0179] In one embodiment, the step S302: the receiving encryption bridge receives the policy notification Ethernet frame and adds each source MAC address and the two corresponding session keys and the initialization vector to the decryption MAC table, specifically includes the following steps:

[0180] After receiving the policy notification frame, the receiving encryption bridge takes out the master key according to the master key ID to perform integrity check and decrypt the frame;

[0181] Each source MAC obtained and the corresponding two keys and initialization vector are added to the decryption MAC table, that is, the table entry with the same source MAC is added or updated in the decryption MAC table.

[0182] In one embodiment, after the receiving encryption bridge receives the policy notification Ethernet frame, if the confirmation required flag bit of the policy notification Ethernet frame is 1, the encryption bridge that accepts the policy needs to send a confirmation frame, the destination MAC of the frame is the source MAC of the policy notification frame, the source MAC is the interface MAC that receives the frame and sends the confirmation frame, and the content of the confirmation frame is the integrity check value ICV of the policy notification frame.

[0183] In one embodiment, the step S303: the sender encrypts the outbound Ethernet data frame, takes out the currently used numbered session key from the table entry matching the source MAC address of the Ethernet data frame from the encrypted MAC table, encrypts the Ethernet data frame using the session key, and marks the number of the session key in the Ethernet frame protocol field, including the following steps:

[0184] The sender encryption bridge device node encrypts the outbound (forwarded through any open port) Ethernet data frame whose source MAC address matches the encryption MAC table, that is, it takes out the session key currently used (initially 0, and then switches between 0 / 1 in sequence) from the item matching the source MAC of the frame from the encryption MAC table for encryption;

[0185] The 13th bit of the Ethernet frame protocol field (the Ethernet frame protocol field has 16 bits from low to high, and the 13th bit is not registered) is marked as using session key No. 0 or No. 1 corresponding to the source MAC, and the usage count of the session key is increased by 1.

[0186] The encryption mode is CBC (integer multiple of algorithm grouping) + CFB (remainder beyond integer multiple of algorithm grouping), without adding any extra data.

[0187] In one embodiment, the step S304: the receiving encryption bridge receives the inbound encrypted message, selects the entry matching the source MAC address of the encrypted message frame from the decryption MAC table, selects the session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field, and symmetrically decrypts the encrypted message, specifically including:

[0188] The receiving encryption bridge device node decrypts the incoming Ethernet data frame (accepted through any open port) whose source MAC address matches the decryption MAC table, that is, selects the item that matches the source MAC of the frame from the decryption MAC table, and selects the session key No. 0 or No. 1 corresponding to the source MAC from the item according to the 13th bit of the Ethernet frame protocol field, performs symmetric decryption operation on the frame, and increases the session key usage count by 1.

[0189] In one embodiment, the encryption session key used by each source MAC in the local encryption MAC table of the sending encryption bridge within a period of time is fixed to 0 or 1, and the timer and usage count of the currently used session key are enabled. When the usage time or usage count exceeds the threshold, a newly generated random number is collected from the random number generator of the encryption bridge device itself to refresh the current key, and the currently used key is switched to another numbered key.

[0190] For example: if key 0 is currently used, key 0 will be refreshed after the key expires, and key 1 will be used. After the encryption bridge is started, an encryption MAC table is established based on the source MAC address learned from the encryption port and the table entries are continuously refreshed in combination with a timer, that is, the newly learned source MAC is added and the source MAC that has not been received from the encryption port for a period of time is cleared from the table.

[0191] In this embodiment, two MAC tables are separately established outside the MAC learning mechanism of the encryption bridge, one is the encryption MAC table, and the other is the decryption MAC table. Among them: the encryption MAC table records the source MAC address of the Ethernet frame to be encrypted, and each MAC address in the table corresponds to two session keys and initialization vectors (keys 0 and 1), which are used to encrypt the Ethernet data frame with the MAC address as the source MAC; the decryption MAC table records the source MAC address of the Ethernet frame to be decrypted, and each MAC address in the table corresponds to two session keys (keys 0 and 1) and has a usage count, which is used to decrypt the Ethernet data frame with the MAC address as the source MAC.

[0192] In one embodiment, before step S301, the method further includes:

[0193] Define the types of each Ethernet interface of the encryption bridge: the interface that is not connected to other encryption bridges of the same type is defined as a encrypted port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The data frame processing of the open port is no different from that of a general bridge device; in addition to performing the functions of a common bridge interface, the encrypted port adds the learned source MAC address to the encryption MAC table, collects fresh random numbers to generate session keys 0 and 1, and starts a timer to regularly clear the table of source MACs that have not been received from the encrypted port within a period of time.

[0194] In one embodiment, before step S301, the method further includes:

[0195] The sender encryption bridge and the receiver encryption bridge send registration messages to the management and control platform to complete the registration.

[0196] In one embodiment, before step S301, the method further includes:

[0197] The sender encryption bridge and the receiver encryption bridge respectively send key injection requests to the quantum key distribution network, and obtain the quantum key distributed by the quantum key distribution network through their respective integrated secure storage media to build a master key pool.

[0198] This embodiment uses an encryption bridge integrated with quantum key distribution to solve the security problem of Layer 2 Ethernet data frames, and realizes a highly secure, lightweight and efficient Ethernet data frame encryption transmission method. The main technical effects are:

[0199] (1) By dividing the security domain and pre-filling a large number of identical master keys for each device node in the security domain and using them randomly, the problem of identity authentication and distribution of session keys between bridge device nodes with encryption intercommunication requirements is solved safely and efficiently;

[0200] (2) The MAC of the bridge port is automatically learned and different session keys are generated based on different source MACs. These keys are then distributed to members within the domain via multicast, thus achieving automatic generation and distribution of encryption policies without the need for a management center. This safely and efficiently solves the security policy distribution and management issues for Layer 2 Ethernet devices without IP addresses.

[0201] (3) Each encryption strategy achieves non-interruption and zero intervention in Layer 2 network services by switching between the primary and backup keys and transparently encrypting and decrypting Ethernet frames, thereby minimizing the impact.

[0202] Example 4

[0203] like Figure 4 As shown, the fourth embodiment of the present invention provides an encryption bridge, and the encryption bridge includes:

[0204] The policy notification Ethernet frame sending module 11 is used to send a policy notification Ethernet frame to the receiving encryption bridge in the security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in the local encryption MAC table of the sending encryption bridge and two corresponding session keys and an initialization vector;

[0205] The session key acquisition module 12 is used to retrieve the session key with the current number in the table entry matching the source MAC address of the Ethernet data frame from the encrypted MAC table for the outbound Ethernet data frame;

[0206] The first data encryption and decryption module 13 is used to encrypt the Ethernet data frame using the session key and mark the serial number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message.

[0207] This embodiment is mainly aimed at the application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs. It encrypts data based on the source MAC address and automatically learns to form an encryption strategy. It realizes automatic key distribution between device nodes in the domain through multicast, realizes automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solves the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0208] In one embodiment, the strategy notifies the Ethernet frame sending module 11, including:

[0209] A policy notification Ethernet frame construction unit, used to construct a policy notification Ethernet frame based on a source MAC address in a local encrypted MAC table and two corresponding session keys and an initialization vector, wherein the two session keys are numbered 0 and 1 respectively;

[0210] It should be noted that each encryption policy is composed of the source MAC address in the encryption MAC table of the bridge and two corresponding session keys, and multiple encryption policies constitute a policy notification Ethernet frame.

[0211] A policy notification message generating unit, used to select a master key from a master key pool set by itself to encrypt the policy notification Ethernet frame, and calculate the integrity check value by using a keyed hash algorithm to obtain a policy notification message;

[0212] Among them, the entire Ethernet frame is encrypted with a randomly selected master key (the Ethernet frame header is not encrypted) and the keyed hash algorithm HMAC is used to calculate the check value (including the frame header). The frame format of the policy notification message is: 14-byte Ethernet frame header (source MAC address + destination MAC address + frame type) + 1-byte current frame policy count / confirmation mark + 4-byte master key ID + k*(source MAC address + 2n-byte key + 2n-byte initialization vector) + ICV (integrity check value).

[0213] In one embodiment, the encryption bridge further comprises:

[0214] A length determination module, used to determine whether the length of the policy notification Ethernet frame exceeds the interface MTU;

[0215] Correspondingly, the policy notification Ethernet frame sending module 11 is further used to fragment the policy notification Ethernet frame and then send it when it is determined that the frame exceeds the interface MTU.

[0216] In one embodiment, the policy notification Ethernet frame sending module 11 sends policy notification Ethernet frames to the receiving encryption bridge in the security domain at a time interval less than or equal to half of the session key usage time threshold, and sends the same policy notification Ethernet frame n times in succession, where n is a positive integer.

[0217] In one embodiment, the encryption bridge further comprises:

[0218] A recording module, used to record the usage time and usage frequency of the currently used session key;

[0219] A refresh module, used to refresh the currently used session key using a random number generated by a random number generator of the encryption bridge itself when the usage time or the number of usages exceeds a corresponding threshold;

[0220] The key switching module is used to switch the currently used session key to a session key with another number.

[0221] It should be noted that the encryption session key used by each source MAC in the encryption MAC table within a period of time is fixed to 0 or 1. The timer and usage count of the currently used key are enabled. When the usage time or usage count exceeds the threshold, a new random number is collected from the random number generator of the encryption bridge device itself to refresh the current key, and the currently used key is switched to another numbered key. That is, if key 0 is currently in use, key 0 will be refreshed after the key expires, and key 1 will be used. After the encryption bridge is started, the encryption MAC table is established based on the source MAC address learned from the encryption port and the table entries are continuously refreshed in combination with the timer, that is, the newly learned source MAC is added and the source MAC that has not been received from the encryption port for a period of time is cleared from the table.

[0222] In one embodiment, the policy notifies that a confirmation mark is added to the highest bit of a byte of the Ethernet frame, so that the receiving encryption bridge determines whether a confirmation frame needs to be sent according to the confirmation mark.

[0223] It should be noted that the policy count byte of the policy notification Ethernet frame supports up to 127 policy counts, and the highest bit of this byte is the flag for whether confirmation is required. If the flag is 1, the receiving encryption bridge needs to send a confirmation frame, and the sending encryption bridge starts the timer queue and adds the frame to the queue for periodic retransmission until the frame expires (session key update) or all bridges in the security domain have replied with a confirmation frame; if the flag is 0, the receiving encryption bridge does not need to send a confirmation frame.

[0224] In one embodiment, the first data encryption and decryption module 13 includes:

[0225] An encryption unit, used for encrypting the outbound Ethernet data frame based on the currently used session key, wherein the encryption mode is a CBC algorithm combined with a CFB algorithm;

[0226] The number adding unit is used to mark the number of the session key in the unregistered bit position in the Ethernet frame protocol field, and increase the usage count of the session key by 1.

[0227] It should be noted that the encryption bridge device node as the sender encrypts the outbound (forwarded through any open port) Ethernet data frame whose source MAC address matches the encryption MAC table, that is, it takes out the session key currently used (initial 0, then switches between 0 / 1 in sequence) from the item matching the source MAC of the frame from the encryption MAC table for encryption, and marks the 13th bit of the Ethernet frame protocol field (the Ethernet frame protocol field has 16 bits from low to high, and the 13th bit is not registered) that the session key 0 or 1 corresponding to the source MAC is used, and the session key usage count is increased by 1. The encryption mode is CBC (integer multiple of algorithm grouping) + CFB (remainder beyond integer multiple of algorithm grouping), and no additional data is added.

[0228] In one embodiment, the encryption bridge further includes a key injection request module, which is used to:

[0229] Send a key filling request to the quantum key distribution network;

[0230] The master key returned by the quantum key distribution network is obtained through the first secure storage medium integrated by the sender encryption bridge, and a master key pool is established based on the master key, and a key bitmap is used to identify whether each master key has been used, wherein each encryption bridge in the same security domain shares a master key with the same master key ID.

[0231] It should be noted that a large number of quantum keys are injected into the first secure storage medium through the quantum key distribution network. The first secure storage medium uses a large-capacity secure storage medium such as a secure TF card or a secure U shield. The key format of the master key is 4-byte key ID + n-byte key and n-byte initialization vector (n is related to the encryption algorithm). Each device in the same security domain shares the same master key identified by the same key ID.

[0232] In one embodiment, the encryption bridge further includes a port type definition module, which is used to:

[0233] Define the Ethernet interface type of the sender encryption bridge, wherein the interface that is not connected to other encryption bridges of the same type is defined as a secret port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The secret port is used to add the source MAC address learned by the port to the local encryption MAC table.

[0234] It should be noted that the processing of data frames received and sent by the open port is no different from that of general bridge equipment. In addition to performing the functions of an ordinary bridge interface, the encrypted port adds the learned source MAC address to the encrypted MAC table, collects session keys 0 and 1 randomly generated by its own random number generator, and starts a timer to periodically clear the table of source MACs that have not been received from the encrypted port within a period of time.

[0235] In one embodiment, the encryption bridge further includes a registration request module, which is used to:

[0236] Connect to the control platform through the management channel and send a registration message to the control platform to register.

[0237] It should be noted that the management and control platform defines the security domain and receives registration requests from each encryption bridge within the security domain to complete the registration of each encryption bridge.

[0238] By dividing the security domain and pre-filling a large number of identical master keys for each device node in the security domain and using them randomly, the problem of identity authentication and distribution of session keys between bridge device nodes with encryption intercommunication requirements is solved safely and efficiently.

[0239] It should be noted that other embodiments or implementation methods of the encryption bridge described in the present invention can refer to the above-mentioned method embodiment 1, which will not be repeated here.

[0240] Example 5

[0241] like Figure 5 As shown, the fifth embodiment of the present invention provides an encryption bridge, and the encryption bridge includes:

[0242] The policy notification Ethernet frame receiving module 21 is used to receive the policy notification Ethernet frame sent by the sender encryption bridge in the same security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes the source MAC address in the local encryption MAC table of the sender encryption bridge and the corresponding two session keys and initialization vector;

[0243] The MAC table management module 22 is used to notify the Ethernet frame according to the strategy, and add each source MAC address and the corresponding two session keys and initialization vector into the local decryption MAC table;

[0244] The encrypted message receiving module 23 is used to receive the outbound encrypted message sent by the sender encryption bridge, wherein the outbound encrypted message is obtained by encrypting the outbound Ethernet data frame with the session key of the current number and marking the number of the session key in the Ethernet frame protocol field;

[0245] The second data encryption and decryption module 24 is used to select an entry matching the source MAC address of the encrypted message frame from the decryption MAC table, and select a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

[0246] This embodiment is mainly aimed at the application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs. It decrypts data based on the source MAC address and automatically learns to form encryption strategies. It realizes automatic key distribution between device nodes in the domain through multicast, realizes automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solves the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0247] In one embodiment, the format of the policy notification Ethernet frame is an Ethernet frame header, a current frame policy count / confirmation tag, a master key ID, a source MAC address, two session keys corresponding to the source MAC address and an initialization vector and an integrity check value, wherein the master key ID comes from the master key pool of the sender encryption bridge itself;

[0248] Accordingly, the MAC table management module 22 includes:

[0249] A checking unit, configured to select a corresponding master key from its own master key pool according to the master key ID, and perform an integrity check on the integrity check value;

[0250] A decryption unit, used to decrypt the policy notification Ethernet frame using the master key after the integrity check passes, to obtain each source MAC address and the two corresponding session keys and the initialization vector;

[0251] The decrypted MAC table refreshing unit is used to add each source MAC address and the two corresponding session keys and the initialization vector to the local decrypted MAC table, and refresh the decrypted MAC table.

[0252] It should be noted that after the encryption bridge as the receiver receives the policy notification Ethernet frame, it takes out the master key according to the master key ID to perform integrity check and decrypt the frame, and adds each source MAC and the corresponding two keys and initialization vector to the decryption MAC table, that is, adding or updating the table entry with the same source MAC in the decryption MAC table.

[0253] In one embodiment, the encryption bridge further includes a confirmation frame sending module, which is used to:

[0254] According to the confirmation mark of the highest bit of the policy notification Ethernet frame byte, a confirmation frame is sent to the receiving encryption bridge, wherein the content of the confirmation frame is the integrity check value of the policy notification Ethernet frame, the destination MAC address of the confirmation frame is the source MAC address of the policy notification Ethernet frame, and the source MAC address of the confirmation frame is the MAC address of the interface that receives the policy notification Ethernet frame and sends the confirmation frame.

[0255] Specifically, if the confirmation flag bit of the policy notification Ethernet frame is 1, the encryption bridge that accepts the policy needs to send a confirmation frame. The destination MAC of the frame is the source MAC of the policy notification frame, and the source MAC is the interface MAC that receives the frame and sends a confirmation frame. The content of the confirmation frame is the integrity check value ICV of the policy notification frame.

[0256] In one embodiment, the second data encryption and decryption module 24 includes:

[0257] A selection unit, used to select an entry matching the source MAC address of the encrypted message frame from the decrypted MAC table, and select a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field;

[0258] The decryption unit is used to perform a symmetric decryption operation on the inbound encrypted message using the session key, and to increase the usage count of the session key by 1.

[0259] It should be noted that the encryption bridge device node as the receiver decrypts the inbound (accepted through any open port) Ethernet data frame whose source MAC address matches the decryption MAC table, that is, it selects the item matching the source MAC of the frame from the decryption MAC table, and selects the session key No. 0 or No. 1 corresponding to the source MAC from the item according to the 13th bit of the Ethernet frame protocol field, performs symmetric decryption operation on the frame, and increases the session key usage count by 1.

[0260] In one embodiment, the encryption bridge further includes a key request module, which is used to:

[0261] Send a key filling request to the quantum key distribution network;

[0262] The master key returned by the quantum key distribution network is obtained through the second secure storage medium integrated by the receiving encryption bridge, and a master key pool is established based on the master key, and a key bitmap is used to identify whether each master key has been used, wherein each encryption bridge in the same security domain shares a master key with the same master key ID.

[0263] It should be noted that a large number of quantum keys are injected into the second secure storage medium through the quantum key distribution network. The first secure storage medium uses a large-capacity secure storage medium such as a secure TF card or a secure U shield. The key format of the master key is 4-byte key ID + n-byte key and n-byte initialization vector (n is related to the encryption algorithm). Each device in the same security domain shares the same master key identified by the same key ID.

[0264] This embodiment implements one-time-one-key session key distribution and identity authentication between devices within a domain by pre-filling a large number of master keys, thereby achieving lightweight and efficient Ethernet data frame encryption transmission.

[0265] In one embodiment, the encryption bridge further includes a port type definition module, which is used to:

[0266] The Ethernet interface type of the receiver encryption bridge is defined, wherein the interface not connected to other encryption bridges of the same type is defined as a secret port, and the interface connected to other encryption bridges of the same type is defined as an open port.

[0267] It should be noted that other embodiments or implementation methods of the encryption bridge described in the present invention can refer to the above-mentioned method embodiment 2, which will not be repeated here.

[0268] Example 6

[0269] like Figure 6 As shown, the fifth embodiment of the present invention proposes a system for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, the system comprising a sender encryption bridge 1, a receiver encryption bridge 2, a management and control platform 3 and a quantum key distribution network 4, the sender encryption bridge 1 is connected to the receiver encryption bridge 2, and the sender encryption bridge 1 and the receiver encryption bridge 2 are both connected to the management and control platform 3 and the quantum key distribution network 4, the sender encryption bridge 1 and the receiver encryption bridge 2 are both provided with a master key pool, and the master key pool stores a master key pre-filled by the quantum key distribution network;

[0270] The management and control platform 3 is used to divide the security domain and provide registration and identity binding services for the sender encryption bridge and the receiver encryption bridge;

[0271] The sender encryption bridge 1 is used to send a policy notification Ethernet frame encrypted by the master key to the receiver encryption bridge, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in the local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector;

[0272] The receiving encryption bridge 2 is used to receive the policy notification Ethernet frame and add each source MAC address and the two corresponding session keys and initialization vector into the decryption MAC table;

[0273] The sender encryption bridge 1 is used to take out the currently used numbered session key from the entry matching the source MAC address of the Ethernet data frame from the encryption MAC table for the outbound Ethernet data frame, encrypt the Ethernet data frame using the session key, and mark the number of the session key in the Ethernet frame protocol field;

[0274] The receiving encryption bridge 2 is used to receive the incoming encrypted message, select the table entry that matches the source MAC address of the encrypted message frame from the decryption MAC table, and select the session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

[0275] This embodiment is mainly aimed at the application scenarios of Layer 2 Ethernet frame encryption that do not have IP addresses and therefore cannot distribute keys in a conventional manner. It automatically learns the MAC of the bridge port and generates different session keys based on different source MACs. It decrypts data based on the source MAC address and automatically learns to form encryption and decryption strategies. It realizes automatic key distribution between device nodes in the domain through multicast, realizes automatic generation and distribution of encryption strategies without the need for a management center, and safely and efficiently solves the security policy distribution and management problems of Layer 2 Ethernet devices without IP addresses.

[0276] It should be noted that the management and control platform: provides the corresponding relationship between encryption bridges, key agents, and quantum network nodes, divides security domains, and provides registration and identity binding services for encryption bridges;

[0277] Key agent: Provides agent functions for key injection and online key distribution when the nodes of the quantum key distribution network cannot directly provide key injection and online key distribution services;

[0278] Quantum key distribution network: includes quantum network nodes and quantum network link control center, realizing quantum key generation and online distribution, quantum key relay, quantum key provision and other services;

[0279] Quantum network node: stores the generated quantum key, receives the key application from the key agent, provides the key to the key agent or directly provides key injection and key online distribution services;

[0280] Quantum network link control center: can establish quantum key distribution and relay links between nodes according to quantum network node ID.

[0281] It should be understood that the key distribution equipment involved in this embodiment includes but is not limited to the QKD key distribution network. The key pre-filling function involved can be implemented using any symmetric key management system and equipment. The symmetric encryption algorithm and cryptographic hash algorithm involved can use any algorithm that complies with national cryptographic management regulations.

[0282] Furthermore, if Figure 7 As shown, the encryption bridge is used to encrypt and decrypt user Ethernet data frames transmitted through the bridge, and is composed of modules such as data encryption and decryption processing, MAC table management module, key update, and key injection, among which:

[0283] The key injection module is connected to the secure storage medium and is used to construct a master key pool according to the master key in the secure storage medium;

[0284] MAC table management module, used to manage and refresh the encryption MAC table and the decryption MAC table;

[0285] A data encryption and decryption processing module, used to take out the currently used numbered session key from the table entry matching the source MAC address of the Ethernet data frame from the encryption MAC table, encrypt the Ethernet data frame using the session key, and mark the number of the session key in the Ethernet frame protocol field; and used to select the table entry matching the source MAC address of the encrypted message frame from the decryption MAC table for the inbound encrypted message, and select the session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field, and symmetrically decrypt the encrypted message;

[0286] The key update module is used to enable the timer and usage count of the currently used session key. When the usage time or usage count exceeds the threshold, a new random number is collected from the random number generator of the encryption bridge device itself to refresh the current key and switch the currently used key to another numbered key.

[0287] In one embodiment, each Ethernet interface of the encryption bridge is defined as a type: an interface that is not connected to other encryption bridges of the same type is defined as a secret port, and an interface that is connected to other encryption bridges of the same type is defined as an open port. The processing of data frames sent and received by the open port is no different from that of a general bridge device. The open port is used to forward outbound or inbound Ethernet data frames. In addition to performing the functions of a general bridge interface, the secret port adds the learned source MAC address to the encryption MAC table, collects newly generated random numbers as session keys 0 and 1, and starts a timer to regularly clear the table of source MACs that have not been received from the secret port within a period of time.

[0288] like Figure 8 As shown, the working process of the system for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner proposed in the embodiment of the present invention is as follows:

[0289] (1) The management and control platform defines the security domain and uses a secure storage medium through a quantum key distribution network to pre-fill a large number of master keys for each device node in its storage medium. The key format is a 4-byte key ID + n-byte key and n-byte initialization vector (n is related to the encryption algorithm). All devices in the same security domain share the same master key identified by the same key ID.

[0290] (2) Inject the pre-filled master key into the encryption bridge device node in the domain, establish a master key pool, and use the key bitmap to indicate whether the key has been used.

[0291] (3) When the encryption bridge is started, two MAC tables are established separately from the MAC learning mechanism of the general bridge, one for encryption MAC table and the other for decryption MAC table. The encryption MAC table records the source MAC address of the Ethernet frame to be encrypted. Each MAC address in the table corresponds to two session keys and initialization vectors (keys 0 and 1), which are used to encrypt the Ethernet data frame with the MAC address as the source MAC; the decryption MAC table records the source MAC address of the Ethernet frame to be decrypted. Each MAC address in the table corresponds to two session keys (keys 0 and 1) and has a usage count, which is used to decrypt the Ethernet data frame with the MAC address as the source MAC.

[0292] The encryption session key used by each source MAC in the encryption MAC table within a period of time is fixed to 0 or 1. The timer and usage count of the currently used key are enabled. When the usage time or usage count exceeds the threshold, a new random number is collected from the random number generator of the encryption bridge device itself to refresh the current key, and the currently used key is switched to another key with a number. That is, if key 0 is currently used, key 0 is refreshed after the key expires, and key 1 is used. After the encryption bridge is started, the encryption MAC table is established according to the source MAC address learned by the encryption port and the table items are continuously refreshed in combination with the timer, that is, the newly learned source MAC is added and the source MAC that has not been received from the encryption port for a period of time is cleared from the table.

[0293] (4) Define the type of each Ethernet interface of the encryption bridge: the interface that is not connected to other encryption bridges of the same type is defined as a encrypted port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The data frame processing of the open port is no different from that of a general bridge device; in addition to performing the functions of a normal bridge interface, the encrypted port adds the learned source MAC address to the encryption MAC table, collects fresh random numbers to generate session keys 0 and 1, and starts a timer to periodically clear the table of source MACs that have not been received from the encrypted port within a period of time.

[0294] (5) The encryption bridge periodically sends the encryption policy of the bridge to the members in the security domain. Each encryption policy consists of the source MAC address in the encryption MAC table of the bridge and the corresponding two session keys. Multiple encryption policies form a policy notification Ethernet frame. The entire Ethernet frame is encrypted with a randomly selected master key (the Ethernet frame header is not encrypted) and the keyed hash algorithm HMAC is used to calculate the check value (including the frame header). The frame format is: 14-byte Ethernet frame header (source MAC + destination MAC + frame type) + 1-byte frame policy count / confirmation tag + 4-byte master key ID + k*(source MAC + 2n-byte key + 2n-byte initialization vector) + ICV (integrity check value), where the frame type is defined privately, the source MAC of the frame is the MAC of the bridge sending interface, and the destination MAC of the frame is also a privately defined multicast MAC address.

[0295] The length of the whole frame cannot exceed the interface MTU. If it exceeds the MTU, it will be divided into multiple frames for transmission. The time interval for sending the policy is no greater than half of the session key usage time threshold. The same policy notification message is sent three times in succession each time.

[0296] The policy count byte of this frame supports up to 127 policy counts. The highest bit of this byte is the confirmation flag. If the flag is 1, the receiver needs to send a confirmation frame. If the confirmation flag is 1, the sending bridge starts the timer queue and adds the frame to the queue for periodic retransmission until the frame expires (session key update) or all bridges in the security domain have replied with confirmation frames.

[0297] (6) After receiving the policy notification frame, the encryption bridge takes out the master key according to the master key ID, performs an integrity check on the frame and decrypts it, and adds each source MAC and the corresponding two keys and initialization vector to the decryption MAC table, that is, adding or updating the entry with the same source MAC in the decryption MAC table. If the confirmation flag bit of the policy notification frame is 1, the encryption bridge that accepts the policy needs to send a confirmation frame. The destination MAC of the frame is the source MAC of the policy notification frame, and the source MAC is the MAC of the interface that receives the frame and sends the confirmation frame. The content of the confirmation frame is the integrity check value ICV of the policy notification frame.

[0298] (7) The encryption bridge device node encrypts the outbound (forwarded through any open port) Ethernet data frame whose source MAC address matches the encryption MAC table, that is, it takes out the session key currently used (initial 0, then switches between 0 / 1 in sequence) from the item matching the source MAC of the frame from the encryption MAC table for encryption, and marks the 13th bit of the Ethernet frame protocol field (the Ethernet frame protocol field has 16 bits from low to high, and the 13th bit is not registered) that the session key 0 or 1 corresponding to the source MAC is used, and the session key usage count is increased by 1. The encryption mode is CBC (integer multiple of the algorithm grouping) + CFB (remainder beyond the integer multiple of the algorithm grouping), and no additional data is added.

[0299] (8) The receiving encryption bridge device node decrypts the incoming Ethernet data frame (accepted through any open port) whose source MAC address matches the decryption MAC table, that is, selects the item matching the source MAC of the frame from the decryption MAC table, and selects the session key No. 0 or No. 1 corresponding to the source MAC from the item according to the 13th bit of the Ethernet frame protocol field, performs symmetric decryption operation on the frame, and increases the session key usage count by 1.

[0300] This embodiment aims at the application scenario of Layer 2 Ethernet frame encryption that does not have an IP address and therefore cannot distribute keys in a conventional manner. It encrypts data based on the source MAC address and automatically learns to form an encryption and decryption strategy, realizes automatic key distribution between device nodes in the domain through multicast, and realizes one-time-one-key session key distribution process and identity authentication between devices in the domain by pre-filling a large number of master keys, thereby realizing lightweight and efficient Ethernet data frame encrypted transmission.

[0301] It should be noted that other embodiments or implementation methods of the system for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner according to the present invention can refer to the above-mentioned embodiments 4 to 6, which will not be repeated here.

[0302] It should be noted that the logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as a sequenced list of executable instructions for implementing logical functions, and can be specifically implemented in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in combination with these instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in combination with these instruction execution systems, devices or apparatuses. More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection portion with one or more wirings (electronic device), a portable computer disk box (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium and then editing, interpreting or processing in other suitable ways if necessary, and then stored in a computer memory.

[0303] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, a plurality of steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc.

[0304] In the description of this specification, the description with reference to the terms "one embodiment", "some embodiments", "examples", "specific examples", or "some examples" means that the specific features, structures, materials or characteristics described in conjunction with the embodiment or example are included in at least one embodiment or example of the present invention. In this specification, the schematic representation of the above terms does not necessarily refer to the same embodiment or example. Moreover, the specific features, structures, materials or characteristics described may be combined in any one or more embodiments or examples in a suitable manner.

[0305] In addition, the terms "first" and "second" are used for descriptive purposes only and should not be understood as indicating or implying relative importance or implicitly indicating the number of the indicated technical features. Therefore, the features defined as "first" and "second" may explicitly or implicitly include at least one of the features. In the description of the present invention, the meaning of "plurality" is at least two, such as two, three, etc., unless otherwise clearly and specifically defined.

[0306] Although the embodiments of the present invention have been shown and described above, it is to be understood that the above embodiments are exemplary and are not to be construed as limitations of the present invention. A person skilled in the art may change, modify, replace and vary the above embodiments within the scope of the present invention.

Claims

1. A method for implementing Ethernet data encryption using a self-learning and self-organizing manner, characterized in that: When the encryption bridge acts as a sender, the method includes: Sending a policy notification Ethernet frame to a receiving encryption bridge in a security domain, wherein the policy notification Ethernet frame includes a plurality of encryption policies, each encryption policy including a source MAC address in a local encryption MAC table of the sending encryption bridge and two corresponding session keys and an initialization vector; For an outbound Ethernet data frame, taking out from the encrypted MAC table a session key with a currently used number in an entry matching the source MAC address of the Ethernet data frame; The Ethernet data frame is encrypted using the session key, and the serial number of the session key is marked in the Ethernet frame protocol field to obtain an outbound encrypted message.

2. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: The sending of a policy notification Ethernet frame to a receiving encryption bridge in a security domain includes: Based on the source MAC address in the local encrypted MAC table and the corresponding two session keys and initialization vector, a policy notification Ethernet frame is constructed, wherein the two session keys are numbered 0 and 1 respectively; Selecting a master key from a master key pool set by itself to encrypt the policy notification Ethernet frame, and using a keyed hash algorithm to calculate an integrity check value to obtain a policy notification message; Among them, the information carried by the policy notification message includes: Ethernet frame header, current frame policy count / confirmation mark, master key ID, source MAC address, two session keys corresponding to the source MAC address and initialization vector and integrity check value. The information of the Ethernet frame header includes the source MAC address, destination MAC address and frame type. The source MAC address is the MAC address of the encryption bridge sending interface, and the destination MAC address is a multicast MAC address defined using privatization.

3. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: The sending of a policy notification Ethernet frame to a receiving encryption bridge in a security domain includes: Determine whether the length of the policy notification Ethernet frame exceeds the interface MTU; When it is determined that the interface MTU is exceeded, the policy notification Ethernet frame is fragmented.

4. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: The time interval for sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain is less than or equal to half of the session key usage time threshold, and the same policy notification Ethernet frame is sent n times continuously, where n is a positive integer.

5. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: After encrypting the Ethernet data frame using the session key and marking the number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message, the method further includes: Recording the usage time and usage frequency of the currently used session key; When the usage time or the number of times of usage exceeds the corresponding threshold, the random number generated by the random number generator of the encryption bridge itself is used to refresh the currently used session key; The currently used session key is switched to a session key with another number.

6. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: The policy notifies that a confirmation mark is added to the highest bit of the byte of the Ethernet frame, so that the receiving encryption bridge can determine whether a confirmation frame needs to be sent according to the confirmation mark.

7. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 6, characterized in that: When the confirmation mark indicates that the receiving encryption bridge needs to send a confirmation frame, the method further includes: The sending encryption bridge starts the timer queue and adds the policy notification Ethernet frame to the queue for periodic retransmission until the policy notification Ethernet frame becomes invalid or all receiving encryption bridges in the security domain have replied to the confirmation frame.

8. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: The method of encrypting the Ethernet data frame by using the session key and marking the number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message includes: Encrypting the outbound Ethernet data frame based on the currently used session key, with the encryption mode being a CBC algorithm combined with a CFB algorithm; The unregistered bit in the Ethernet frame protocol field is marked with the number of the session key, and the usage count of the session key is increased by 1.

9. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: Before sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes: Send a key filling request to the quantum key distribution network; The master key returned by the quantum key distribution network is obtained through the first secure storage medium integrated by the sender encryption bridge, and a master key pool is established based on the master key, and a key bitmap is used to identify whether each master key has been used, wherein each encryption bridge in the same security domain shares a master key with the same master key ID.

10. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: Before sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes: Define the Ethernet interface type of the sender encryption bridge, wherein the interface that is not connected to other encryption bridges of the same type is defined as a secret port, and the interface that is connected to other encryption bridges of the same type is defined as an open port. The secret port is used to add the source MAC address learned by the port to the local encryption MAC table.

11. The method for implementing Ethernet data encryption by self-learning and self-organizing as claimed in claim 1, characterized in that: Before sending the policy notification Ethernet frame to the receiving encryption bridge in the security domain, the method further includes: Connect to the management and control platform through the management channel, and send a registration message to the management and control platform to register.

12. A method for implementing Ethernet data decryption in a self-learning and self-organizing manner, characterized in that: When the encryption bridge acts as a receiver, the method includes: Receiving a policy notification Ethernet frame sent by a sender encryption bridge in the same security domain, wherein the policy notification Ethernet frame includes a plurality of encryption policies, each encryption policy including a source MAC address in a local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector; According to the strategy, the Ethernet frame is notified, and each source MAC address and the two corresponding session keys and initialization vector are added to the local decryption MAC table; Receiving an outbound encrypted message sent by the sender encryption bridge, wherein the outbound encrypted message is obtained by encrypting an outbound Ethernet data frame using a session key with a current number and marking the number of the session key in an Ethernet frame protocol field; An entry matching the source MAC address of the encrypted message frame is selected from the decryption MAC table, and a session key corresponding to the encrypted message frame is selected according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

13. The method for implementing Ethernet data decryption by self-learning and self-organizing as claimed in claim 12, characterized in that: The format of the policy notification Ethernet frame is an Ethernet frame header, a current frame policy count / confirmation tag, a master key ID, a source MAC address, two session keys corresponding to the source MAC address and an initialization vector and an integrity check value, wherein the master key ID comes from the master key pool of the sender encryption bridge itself; Accordingly, the Ethernet frame is notified according to the strategy, and each source MAC address and the two corresponding session keys and initialization vector are added to the local decryption MAC table, including: Select a corresponding master key from its own master key pool according to the master key ID, and perform an integrity check on the integrity check value; After the integrity check is passed, the policy notification Ethernet frame is decrypted using the master key to obtain each source MAC address and the two corresponding session keys and initialization vector; Each source MAC address and the two corresponding session keys and initialization vector are added to the local decryption MAC table, and the decryption MAC table is refreshed.

14. The method for implementing Ethernet data decryption in a self-learning and self-organizing manner as claimed in claim 12, characterized in that: After receiving the policy notification Ethernet frame sent by the encryption bridge of the sender in the same security domain, the method further includes: According to the confirmation mark of the highest bit of the policy notification Ethernet frame byte, a confirmation frame is sent to the receiving encryption bridge, wherein the content of the confirmation frame is the integrity check value of the policy notification Ethernet frame, the destination MAC address of the confirmation frame is the source MAC address of the policy notification Ethernet frame, and the source MAC address of the confirmation frame is the MAC address of the interface that receives the policy notification Ethernet frame and sends the confirmation frame.

15. The method for implementing Ethernet data decryption in a self-learning and self-organizing manner as claimed in claim 12, characterized in that: The step of selecting an entry that matches the source MAC address of the encrypted message frame from the decryption MAC table, and selecting a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field, and symmetrically decrypting the encrypted message includes: Selecting an entry that matches the source MAC address of the encrypted message frame from the decrypted MAC table, and selecting a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field; The session key is used to perform a symmetric decryption operation on the incoming encrypted message, and the session key usage count is increased by 1.

16. The method for implementing Ethernet data decryption in a self-learning and self-organizing manner as claimed in claim 12, characterized in that: Before receiving the policy notification Ethernet frame sent by the encryption bridge of the sender in the same security domain, the method further includes: Send a key filling request to the quantum key distribution network; The master key returned by the quantum key distribution network is obtained through the second secure storage medium integrated by the receiving encryption bridge, and a master key pool is established based on the master key, and a key bitmap is used to identify whether each master key has been used, wherein each encryption bridge in the same security domain shares a master key with the same master key ID.

17. The method for implementing Ethernet data decryption in a self-learning and self-organizing manner as claimed in claim 12, characterized in that: Before receiving the policy notification Ethernet frame sent by the encryption bridge of the sender in the same security domain, the method further includes: The Ethernet interface type of the receiver encryption bridge is defined, wherein the interface not connected to other encryption bridges of the same type is defined as a secret port, and the interface connected to other encryption bridges of the same type is defined as an open port.

18. A method for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, characterized in that: The method comprises: The sender encryption bridge sends a policy notification Ethernet frame to the receiver encryption bridge in the security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in the local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector; The receiving encryption bridge receives the policy notification Ethernet frame and adds each source MAC address and the two corresponding session keys and initialization vector into the decryption MAC table; The sender encryption bridge takes out the currently used numbered session key from the table entry matching the source MAC address of the Ethernet data frame from the encryption MAC table for the outbound Ethernet data frame, encrypts the Ethernet data frame using the session key, and marks the number of the session key in the Ethernet frame protocol field; The receiving encryption bridge receives the incoming encrypted message, selects the entry that matches the source MAC address of the encrypted message frame from the decryption MAC table, selects the session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field, and symmetrically decrypts the encrypted message.

19. An encryption bridge, characterized in that: The encryption bridge comprises: A policy notification Ethernet frame sending module is used to send a policy notification Ethernet frame to a receiving encryption bridge in a security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each of which includes a source MAC address in a local encryption MAC table of the sending encryption bridge and two corresponding session keys and an initialization vector; A session key acquisition module, used for taking out, from the encrypted MAC table, a session key with a currently used number in an entry matching a source MAC address of the Ethernet data frame for an outbound Ethernet data frame; The data encryption and decryption module is used to encrypt the Ethernet data frame using the session key and mark the serial number of the session key in the Ethernet frame protocol field to obtain an outbound encrypted message.

20. An encryption bridge, characterized in that: The encryption bridge comprises: A policy notification Ethernet frame receiving module is used to receive a policy notification Ethernet frame sent by a sender encryption bridge in the same security domain, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in the local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector; A MAC table management module, used to notify the Ethernet frame according to the strategy, and add each source MAC address and the two corresponding session keys and initialization vector into the local decryption MAC table; An encrypted message receiving module is used to receive an outbound encrypted message sent by the sender encryption bridge, wherein the outbound encrypted message is obtained by encrypting an outbound Ethernet data frame with a session key with a current number and marking the number of the session key in an Ethernet frame protocol field; The data encryption and decryption module is used to select a table entry matching the source MAC address of the encrypted message frame from the decryption MAC table, and select a session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

21. A system for implementing Ethernet data encryption and decryption in a self-learning and self-organizing manner, characterized in that: The system includes a sender encryption bridge, a receiver encryption bridge, a management and control platform, and a quantum key distribution network. The sender encryption bridge is connected to the receiver encryption bridge, and the sender encryption bridge and the receiver encryption bridge are both connected to the management and control platform and the quantum key distribution network. The sender encryption bridge and the receiver encryption bridge are both provided with a master key pool, and the master key pool stores a master key pre-filled by the quantum key distribution network. The management and control platform is used to divide security domains and provide registration and identity binding services for the sender encryption bridge and the receiver encryption bridge; The sender encryption bridge is used to send a policy notification Ethernet frame encrypted by the master key to the receiver encryption bridge, wherein the policy notification Ethernet frame includes multiple encryption policies, each encryption policy includes a source MAC address in the local encryption MAC table of the sender encryption bridge and two corresponding session keys and an initialization vector; The receiving encryption bridge is used to receive the policy notification Ethernet frame and add each source MAC address and the two corresponding session keys and initialization vector into a decrypted MAC table; The sender encryption bridge is used to take out the session key with the current number in the table entry matching the source MAC address of the Ethernet data frame from the encryption MAC table for the outbound Ethernet data frame, encrypt the Ethernet data frame using the session key, and mark the number of the session key in the Ethernet frame protocol field; The receiving encryption bridge is used to receive incoming encrypted messages, select an entry that matches the source MAC address of the encrypted message frame from the decryption MAC table, and select the session key corresponding to the encrypted message frame according to the key number in the Ethernet frame protocol field to symmetrically decrypt the encrypted message.

Images